@bobfrankston/npmglobalize 1.0.237 → 1.0.238

package/README.md

@@ -94,7 +94,7 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
-**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan lists every such edge on every run: consumer → dep and range, the `package.json` that holds the range, and — when the same dep is linked as `file:` elsewhere in the graph — the directory of its local source (that package then exists twice). Each finding is repeated as one line in the end-of-run **Issues Summary**, because the prescan block has scrolled away by the time a cascade finishes. Nothing is asked and the run continues; a range can be deliberate. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not listed. npmglobalize does not rewrite the range: change it to a `file:` path in the named `package.json`, then run `npmglobalize` in that package. (2026-09-21)
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
 
 Skip the prescan with `-no-prescan` / `-nps`.
 

package/lib.d.ts

@@ -425,7 +425,7 @@ export interface PrescanIssue {
     /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
      *  question — globalize reports it once, remembers it, and stops.
      *  'registryRef': a package in the file: graph depends on one of its own-scope packages
-     *  by version range instead of file: — reported by reportRegistryRefs, nothing asked. */
+     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked. */
     kind?: 'unscoped' | 'registryRef';
     package: string;
     /** For 'registryRef': the directory of the CONSUMER whose package.json holds the range. */
@@ -448,15 +448,23 @@ export declare function findUndeclaredImports(cwd: string, pkg: any): Undeclared
  *  user resolve all problems before starting the publish cascade instead of
  *  being interrupted mid-run. */
 export declare function prescanDepGraph(baseDir: string, visited?: Set<string>, verbose?: boolean, fileTargets?: Map<string, string>): PrescanIssue[];
-/** Report own-scope packages that some package in the file: graph takes from the registry
- *  (a version range) instead of from local source. Nothing is asked and the run continues: a
- *  range can be deliberate, and the fix is an edit to the CONSUMER's package.json, which is not
- *  npmglobalize's to make. It is printed on every run because the consumer is usually nested
- *  under other file: deps, where neither the `+` list nor the dependency tree shows it.
- *  `fileTargets` is the map prescanDepGraph filled: when the same package is linked as file:
- *  elsewhere in the graph, its directory is named — that package then exists twice, the linked
- *  source and the registry copy in the consumer's node_modules. */
-export declare function reportRegistryRefs(registryRefs: PrescanIssue[], fileTargets: Map<string, string>): void;
+/** Own-scope packages that some package in the file: graph takes from the registry (a version
+ *  range) instead of from local source get REWRITTEN to a file: path, and npm install runs in
+ *  that consumer so node_modules holds the link instead of the registry copy. The consumer is
+ *  usually nested under other file: deps, where neither the `+` list nor the dependency tree
+ *  shows it, which is why this runs in the prescan, before the cascade reads the consumer.
+ *  A range whose local source cannot be found (not linked elsewhere in the graph, no sibling
+ *  directory of that name) is reported as before and left alone. `"files": false` consumers
+ *  were never collected (see prescanDepGraph). Every outcome is also recorded for the
+ *  Issues Summary, since the prescan block has scrolled away by the end of a cascade.
+ *  2026-09-23 01:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "you should also make
+ *  sure that package.json for local packages such as httppoly uses file: rather than the npm
+ *  version". Until now this only reported (v1.0.233), and certsupport kept
+ *  `miscassists: ^1.0.61` through three runs. Returns false if an npm install failed. */
+export declare function fixRegistryRefs(registryRefs: PrescanIssue[], fileTargets: Map<string, string>, opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<boolean>;
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not

package/lib.js

@@ -2001,7 +2001,7 @@ export function findUndeclaredImports(cwd, pkg) {
  *  being interrupted mid-run. */
 // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("you need to warn about @installs
 // because they may be nested so I won't see them"). `fileTargets` added: every file: target the
-// walk resolves is recorded (package name → directory) so reportRegistryRefs can say where the
+// walk resolves is recorded (package name → directory) so fixRegistryRefs can say where the
 // local source of a registry-installed package is. Own-scope deps given as a version range are
 // collected as kind 'registryRef'. Seen in certsupport: `@bobfrankston/miscassists: ^1.0.61`
 // committed in its package.json, two levels under pserve, where no tree listing showed it.
@@ -2104,34 +2104,96 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false, f
     }
     return issues;
 }
-/** Report own-scope packages that some package in the file: graph takes from the registry
- *  (a version range) instead of from local source. Nothing is asked and the run continues: a
- *  range can be deliberate, and the fix is an edit to the CONSUMER's package.json, which is not
- *  npmglobalize's to make. It is printed on every run because the consumer is usually nested
- *  under other file: deps, where neither the `+` list nor the dependency tree shows it.
- *  `fileTargets` is the map prescanDepGraph filled: when the same package is linked as file:
- *  elsewhere in the graph, its directory is named — that package then exists twice, the linked
- *  source and the registry copy in the consumer's node_modules. */
-export function reportRegistryRefs(registryRefs, fileTargets) {
+/** Where the local source of an own-scope package is, or null. First the map prescanDepGraph
+ *  filled (the package is linked as file: elsewhere in the graph); then the sibling-directory
+ *  convention every file: ref in these trees follows (`file:../<name>`): a directory named
+ *  after the unscoped package name beside the consumer, accepted only when the package.json
+ *  there carries exactly that package name. Nothing else is searched. */
+function findLocalSource(consumerDir, packageName, fileTargets) {
+    const known = fileTargets.get(packageName);
+    if (known)
+        return known;
+    const unscopedName = packageName.includes('/') ? packageName.slice(packageName.indexOf('/') + 1) : packageName;
+    const sibling = path.join(path.dirname(consumerDir), unscopedName);
+    try {
+        if (readPackageJson(sibling).name === packageName)
+            return sibling;
+    }
+    catch (error) {
+        // Justified swallow: no package.json beside the consumer under that name is the
+        // ordinary "not a sibling" outcome. The caller reports "local source not found" on
+        // null, so the information becomes that message rather than being lost.
+    }
+    return null;
+}
+/** Own-scope packages that some package in the file: graph takes from the registry (a version
+ *  range) instead of from local source get REWRITTEN to a file: path, and npm install runs in
+ *  that consumer so node_modules holds the link instead of the registry copy. The consumer is
+ *  usually nested under other file: deps, where neither the `+` list nor the dependency tree
+ *  shows it, which is why this runs in the prescan, before the cascade reads the consumer.
+ *  A range whose local source cannot be found (not linked elsewhere in the graph, no sibling
+ *  directory of that name) is reported as before and left alone. `"files": false` consumers
+ *  were never collected (see prescanDepGraph). Every outcome is also recorded for the
+ *  Issues Summary, since the prescan block has scrolled away by the end of a cascade.
+ *  2026-09-23 01:40 EDT — Claude Code (Fable 5.1), at Bob's direction: "you should also make
+ *  sure that package.json for local packages such as httppoly uses file: rather than the npm
+ *  version". Until now this only reported (v1.0.233), and certsupport kept
+ *  `miscassists: ^1.0.61` through three runs. Returns false if an npm install failed. */
+export async function fixRegistryRefs(registryRefs, fileTargets, opts = {}) {
     if (!registryRefs.length)
-        return;
+        return true;
+    const { dryRun = false, verbose = false } = opts;
     console.log(colors.yellow(`${registryRefs.length} own-scope dependenc${registryRefs.length === 1 ? 'y is' : 'ies are'} installed from npm, not linked with file: (a registry copy in node_modules, not the local source):`));
+    // One npm install per consumer, after all of its ranges are rewritten.
+    const rewrittenConsumers = new Map(); // consumer dir → consumer name
+    let ok = true;
     for (const ref of registryRefs) {
+        const pkgJsonPath = path.join(ref.path, 'package.json');
         console.log(`  ${colors.yellow('@')} ${ref.consumer} → ${ref.package} ${ref.range}`);
-        console.log(colors.dim(`       in ${path.join(ref.path, 'package.json')}`));
-        const localSource = fileTargets.get(ref.package);
-        if (localSource) {
-            console.log(colors.dim(`       local source, linked as file: elsewhere in this graph: ${localSource}`));
-        }
-        // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction ("it should summarize the
-        // findings at the end"). The block above prints before the cascade and scrolls away, so
-        // each finding also goes into the Issues Summary cli.ts prints on every exit path. One
-        // self-contained line: it has to make sense with the prescan output long gone.
-        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${path.join(ref.path, 'package.json')}`
-            + (localSource ? ` (local source: ${localSource})` : ''));
-    }
-    console.log(colors.dim(`  To link one, set it to a file: path in the package.json named above, then run npmglobalize in that package.`));
+        console.log(colors.dim(`       in ${pkgJsonPath}`));
+        const localSource = findLocalSource(ref.path, ref.package, fileTargets);
+        if (!localSource) {
+            console.log(colors.dim(`       local source not found (not linked as file: elsewhere in this graph, no sibling directory of that name) — left as is`));
+            recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} is installed from npm, not file: — ${pkgJsonPath} (local source not found, left as is)`);
+            continue;
+        }
+        let relative = path.relative(ref.path, localSource).split(path.sep).join('/');
+        if (!relative.startsWith('.'))
+            relative = './' + relative;
+        const fileSpec = `file:${relative}`;
+        if (dryRun) {
+            console.log(colors.dim(`       [dry-run] would set to ${fileSpec} (${localSource}) and run npm install in ${ref.consumer}`));
+            continue;
+        }
+        const pkg = readPackageJson(ref.path);
+        let rewrote = false;
+        for (const key of DEP_KEYS) {
+            // A `.dependencies` backup (left by an interrupted transform) is the file: truth;
+            // prescanDepGraph read the range from it, so the rewrite goes there too.
+            for (const depsKey of ['.' + key, key]) {
+                const deps = pkg[depsKey];
+                if (deps && deps[ref.package] === ref.range) {
+                    deps[ref.package] = fileSpec;
+                    rewrote = true;
+                }
+            }
+        }
+        if (!rewrote) {
+            console.log(colors.dim(`       range not found in ${pkgJsonPath} any more — left as is`));
+            continue;
+        }
+        writePackageJson(ref.path, pkg);
+        console.log(colors.green(`       ✓ set to ${fileSpec} (${localSource})`));
+        recordBuildIssue(ref.consumer, 'warning', `${ref.package} ${ref.range} rewritten to ${fileSpec} in ${pkgJsonPath}`);
+        rewrittenConsumers.set(ref.path, ref.consumer);
+    }
+    for (const [consumerDir, consumerName] of rewrittenConsumers) {
+        console.log(colors.yellow(`↻ npm install in ${consumerName} (${consumerDir}) to replace the registry copy with the file: link`));
+        if (!await npmInstallWithCleanRetry(consumerDir, verbose, `fixRegistryRefs: ${consumerDir}`))
+            ok = false;
+    }
     console.log('');
+    return ok;
 }
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
@@ -7366,9 +7428,15 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
         const fileTargets = new Map();
         const scanned = prescanDepGraph(cwd, new Set(), verbose, fileTargets);
         // 2026-09-21 — Claude Code (Fable 5.1), at Bob's direction: registry refs to own-scope
-        // packages are reported apart from the prompt below, like unscoped deps — a warning
-        // with no question, since no answer would change what this run does.
-        reportRegistryRefs(scanned.filter(i => i.kind === 'registryRef'), fileTargets);
+        // packages are handled apart from the prompt below, like unscoped deps — no question.
+        // 2026-09-23 — Claude Code (Fable 5.1), at Bob's direction: they are now FIXED (rewritten
+        // to file: and npm-installed), not just reported. A failed install stops the run like
+        // ensureFileDepModules does, unless -force.
+        const refsOk = await fixRegistryRefs(scanned.filter(i => i.kind === 'registryRef'), fileTargets, { dryRun, verbose });
+        if (!refsOk && !force) {
+            console.error(colors.red('npm install failed while linking own-scope deps as file: (see above). Stopping; use -force to continue anyway.'));
+            return false;
+        }
         const allIssues = scanned.filter(i => i.kind !== 'registryRef');
         // Unscoped deps are handled apart from the error/warning prompt below: nothing the
         // user answers could change the outcome, so nothing is asked. Report, remember,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.237",
+  "version": "1.0.238",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",