@bobfrankston/npmglobalize 1.0.239 → 1.0.240

package/README.md

@@ -96,6 +96,8 @@ An unscoped dependency with private intent is reported differently: it is not a
 
 **Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
 
+**A `file:` dependency declared under the wrong key.** `"ubntdefs": "file:../ubntdefs"` links fine locally even when that package's own `package.json` says `@bobfrankston/ubntdefs`, because npm links a `file:` dep under whatever key you wrote. But the published `package.json` carries the version range under that key, so the registry copy of the consumer says `"ubntdefs": "^1.0.5"`, a name that is not on npm, and every registry install of it or of anything depending on it dies with E404 (dbx10 → setcolor, 2026-09-24). The prescan compares every `file:` key with the target's own name and **fixes** a mismatch: the key is renamed to the real name in the consumer's `package.json` (the `file:` path is kept), `npm uninstall <old key>` drops the link under the old name, and `npm install` links it under the real one. Nothing is asked; `-dry-run` prints what would change; each rename and any failed uninstall is repeated in the **Issues Summary**; a failed install stops the run unless `-force`. Imports in the consumer's code are not touched, so if anything imported by the old key, fix that by hand. A run with `-no-prescan` that reaches such a key stops in the transform with the same explanation rather than publishing a broken `package.json`. (2026-09-24)
+
 Skip the prescan with `-no-prescan` / `-nps`.
 
 #### Workspace skip prescan

package/lib.d.ts

@@ -425,9 +425,13 @@ export interface PrescanIssue {
     /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
      *  question — globalize reports it once, remembers it, and stops.
      *  'registryRef': a package in the file: graph depends on one of its own-scope packages
-     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked. */
-    kind?: 'unscoped' | 'registryRef';
+     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked.
+     *  'nameMismatch': a file: dep declared under a key that is not the target's package.json name —
+     *  key renamed, old name uninstalled, reinstalled by fixDepKeyMismatches (2026-09-24), nothing asked. */
+    kind?: 'unscoped' | 'registryRef' | 'nameMismatch';
     package: string;
+    /** 'nameMismatch' only: the key as written in the consumer's package.json (`ubntdefs`). */
+    key?: string;
     /** For 'registryRef': the directory of the CONSUMER whose package.json holds the range. */
     path: string;
     /** 'registryRef' only: name of the package whose package.json declares the dep. */
@@ -465,6 +469,18 @@ export declare function fixRegistryRefs(registryRefs: PrescanIssue[], fileTarget
     dryRun?: boolean;
     verbose?: boolean;
 }): Promise<boolean>;
+/** Rename file: dependency keys that differ from the target package's own name, then
+ *  `npm uninstall` the old name and `npm install` so node_modules holds the link under the
+ *  real name. The published package.json carries the version range under the KEY, so a
+ *  wrong key publishes a dependency nobody can install (dbx10 → `"ubntdefs": "^1.0.5"`,
+ *  setcolor's install died with E404 on 2026-09-24). Nothing is asked; -dry-run prints what
+ *  would change; each outcome lands in the Issues Summary.
+ *  2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction: "A check would be to
+ *  look at the file; to uninstall from the old name and reinstall with the new. This is safe." */
+export declare function fixDepKeyMismatches(mismatches: PrescanIssue[], opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<boolean>;
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not

package/lib.js

@@ -1757,6 +1757,13 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
                 console.log(colors.blue(`  + ${name} → ${value}`));
                 try {
                     const targetPkg = readPackageJson(targetPath);
+                    // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: the range below goes
+                    // under the KEY, so a key that is not the target's name would publish a dep nobody
+                    // can install (dbx10's "ubntdefs": "^1.0.5"). The prescan renames such keys; this
+                    // is the stop for a run that skipped it (-no-prescan).
+                    if (targetPkg.name && targetPkg.name !== name) {
+                        throw new Error(`dependency key "${name}" names a package whose package.json says ${targetPkg.name}; published as "${name}" it could not be installed. Rerun without -no-prescan to have the key renamed, or rename it by hand`);
+                    }
                     const targetVersion = targetPkg.version;
                     const npmVersion = '^' + targetVersion;
                     // Check if this version exists on npm (or if force publish)
@@ -2075,6 +2082,21 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false, f
             }
             const depName = targetPkg.name || name;
             fileTargets.set(depName, targetPath);
+            // 2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction. A file: dep
+            // declared under a key that is not the target's package.json name ("ubntdefs":
+            // file:… whose package.json says "@bobfrankston/ubntdefs") links fine locally, but
+            // transformDeps writes the version range under the KEY, so the published dbx10 said
+            // `"ubntdefs": "^1.0.5"` — a name that is not on npm — and every registry install of
+            // a consumer (setcolor) died with E404. Flagged here; fixDepKeyMismatches renames the
+            // key, uninstalls the old name and reinstalls. Bob: "uninstall from the old name and
+            // reinstall with the new. This is safe."
+            if (targetPkg.name && targetPkg.name !== name) {
+                issues.push({
+                    severity: 'warning', kind: 'nameMismatch',
+                    package: targetPkg.name, key: name, path: baseDir, consumer: consumerName, range: value,
+                    message: `${consumerName} declares ${targetPkg.name} under the key "${name}" (${value})`
+                });
+            }
             // Unscoped + private-intent. This used to be a WARNING whose "continue" led
             // into the cascade prompting to rename the dep by adding a scope. The cascade
             // never renames a dependency now (see the _fromDep check in globalize), so it
@@ -2197,6 +2219,72 @@ export async function fixRegistryRefs(registryRefs, fileTargets, opts = {}) {
     console.log('');
     return ok;
 }
+/** Rename file: dependency keys that differ from the target package's own name, then
+ *  `npm uninstall` the old name and `npm install` so node_modules holds the link under the
+ *  real name. The published package.json carries the version range under the KEY, so a
+ *  wrong key publishes a dependency nobody can install (dbx10 → `"ubntdefs": "^1.0.5"`,
+ *  setcolor's install died with E404 on 2026-09-24). Nothing is asked; -dry-run prints what
+ *  would change; each outcome lands in the Issues Summary.
+ *  2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction: "A check would be to
+ *  look at the file; to uninstall from the old name and reinstall with the new. This is safe." */
+export async function fixDepKeyMismatches(mismatches, opts = {}) {
+    if (!mismatches.length)
+        return true;
+    const { dryRun = false, verbose = false } = opts;
+    console.log(colors.yellow(`${mismatches.length} file: dependenc${mismatches.length === 1 ? 'y is' : 'ies are'} declared under a key that is not the package's own name (published that way, npm would look for a name that does not exist):`));
+    // One uninstall + install per consumer, after all of its keys are renamed.
+    const touched = new Map();
+    for (const m of mismatches) {
+        const pkgJsonPath = path.join(m.path, 'package.json');
+        console.log(`  ${colors.yellow('≠')} ${m.consumer}: "${m.key}" → ${m.package} (${m.range})`);
+        console.log(colors.dim(`       in ${pkgJsonPath}`));
+        if (dryRun) {
+            console.log(colors.dim(`       [dry-run] would rename the key to ${m.package}, then npm uninstall ${m.key} and npm install in ${m.consumer}`));
+            continue;
+        }
+        const pkg = readPackageJson(m.path);
+        let rewrote = false;
+        for (const key of DEP_KEYS) {
+            // A `.dependencies` backup (left by an interrupted transform) is the file: truth;
+            // prescanDepGraph read the key from it, so the rename goes there too.
+            for (const depsKey of ['.' + key, key]) {
+                const deps = pkg[depsKey];
+                if (!deps || deps[m.key] !== m.range)
+                    continue;
+                delete deps[m.key];
+                deps[m.package] = m.range;
+                rewrote = true;
+            }
+        }
+        if (!rewrote) {
+            console.log(colors.dim(`       key not found in ${pkgJsonPath} any more — left as is`));
+            continue;
+        }
+        writePackageJson(m.path, pkg);
+        console.log(colors.green(`       ✓ renamed to ${m.package}`));
+        recordBuildIssue(m.consumer, 'warning', `dependency key "${m.key}" renamed to ${m.package} (the file: target's own name) in ${pkgJsonPath}`);
+        const entry = touched.get(m.path) ?? { consumer: m.consumer, oldKeys: [], newNames: [] };
+        entry.oldKeys.push(m.key);
+        entry.newNames.push(m.package);
+        touched.set(m.path, entry);
+    }
+    let ok = true;
+    for (const [dir, { consumer, oldKeys, newNames }] of touched) {
+        console.log(colors.yellow(`↻ npm uninstall ${oldKeys.join(' ')} in ${consumer} (${dir}) — drops the link under the old name`));
+        const uninstall = await runCommandAsync('npm', ['uninstall', ...oldKeys], { cwd: dir, silent: !verbose });
+        if (!uninstall.success) {
+            // Not fatal: the install below links the real name; a leftover link under the old
+            // name is inert (nothing imports it) and is named so it can be removed by hand.
+            console.log(colors.yellow(`  npm uninstall failed in ${dir}; node_modules/${oldKeys.join(', node_modules/')} may remain — continuing with npm install`));
+            recordBuildIssue(consumer, 'warning', `npm uninstall ${oldKeys.join(' ')} failed in ${dir}; the old link may remain in node_modules`);
+        }
+        console.log(colors.yellow(`↻ npm install in ${consumer} (${dir}) to link ${newNames.join(', ')} under the real name`));
+        if (!await npmInstallWithCleanRetry(dir, verbose, `fixDepKeyMismatches: ${dir}`))
+            ok = false;
+    }
+    console.log('');
+    return ok;
+}
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
@@ -7617,7 +7705,15 @@ async function globalizeUnderLock(cwd, options = {}, configOptions = {}) {
             console.error(colors.red('npm install failed while linking own-scope deps as file: (see above). Stopping; use -force to continue anyway.'));
             return false;
         }
-        const allIssues = scanned.filter(i => i.kind !== 'registryRef');
+        // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: file: deps declared under a
+        // key that is not the target's name are renamed + reinstalled the same way (see
+        // fixDepKeyMismatches); a failed install stops the run unless -force.
+        const mismatchOk = await fixDepKeyMismatches(scanned.filter(i => i.kind === 'nameMismatch'), { dryRun, verbose });
+        if (!mismatchOk && !force) {
+            console.error(colors.red('npm install failed after renaming a dependency key to the package\'s own name (see above). Stopping; use -force to continue anyway.'));
+            return false;
+        }
+        const allIssues = scanned.filter(i => i.kind !== 'registryRef' && i.kind !== 'nameMismatch');
         // Unscoped deps are handled apart from the error/warning prompt below: nothing the
         // user answers could change the outcome, so nothing is asked. Report, remember,
         // stop. See reportUnscopedDeps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.239",
+  "version": "1.0.240",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",