@bobfrankston/npmglobalize 1.0.239 → 1.0.241

package/README.md

@@ -94,7 +94,9 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
-**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list (`-verbose`) nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
+
+**A `file:` dependency declared under the wrong key.** `"ubntdefs": "file:../ubntdefs"` links fine locally even when that package's own `package.json` says `@bobfrankston/ubntdefs`, because npm links a `file:` dep under whatever key you wrote. But the published `package.json` carries the version range under that key, so the registry copy of the consumer says `"ubntdefs": "^1.0.5"`, a name that is not on npm, and every registry install of it or of anything depending on it dies with E404 (dbx10 → setcolor, 2026-09-24). The prescan compares every `file:` key with the target's own name and **fixes** a mismatch: the key is renamed to the real name in the consumer's `package.json` (the `file:` path is kept), `npm uninstall <old key>` drops the link under the old name, and `npm install` links it under the real one. Nothing is asked; `-dry-run` prints what would change; each rename and any failed uninstall is repeated in the **Issues Summary**; a failed install stops the run unless `-force`. Imports in the consumer's code are not touched, so if anything imported by the old key, fix that by hand. A run with `-no-prescan` that reaches such a key stops in the transform with the same explanation rather than publishing a broken `package.json`. (2026-09-24)
 
 Skip the prescan with `-no-prescan` / `-nps`.
 

package/lib.d.ts

@@ -425,9 +425,13 @@ export interface PrescanIssue {
     /** 'unscoped': an unscoped file: dep with private intent. Not an error and not a
      *  question — globalize reports it once, remembers it, and stops.
      *  'registryRef': a package in the file: graph depends on one of its own-scope packages
-     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked. */
-    kind?: 'unscoped' | 'registryRef';
+     *  by version range instead of file: — rewritten to file: by fixRegistryRefs (2026-09-23), nothing asked.
+     *  'nameMismatch': a file: dep declared under a key that is not the target's package.json name —
+     *  key renamed, old name uninstalled, reinstalled by fixDepKeyMismatches (2026-09-24), nothing asked. */
+    kind?: 'unscoped' | 'registryRef' | 'nameMismatch';
     package: string;
+    /** 'nameMismatch' only: the key as written in the consumer's package.json (`ubntdefs`). */
+    key?: string;
     /** For 'registryRef': the directory of the CONSUMER whose package.json holds the range. */
     path: string;
     /** 'registryRef' only: name of the package whose package.json declares the dep. */
@@ -465,6 +469,18 @@ export declare function fixRegistryRefs(registryRefs: PrescanIssue[], fileTarget
     dryRun?: boolean;
     verbose?: boolean;
 }): Promise<boolean>;
+/** Rename file: dependency keys that differ from the target package's own name, then
+ *  `npm uninstall` the old name and `npm install` so node_modules holds the link under the
+ *  real name. The published package.json carries the version range under the KEY, so a
+ *  wrong key publishes a dependency nobody can install (dbx10 → `"ubntdefs": "^1.0.5"`,
+ *  setcolor's install died with E404 on 2026-09-24). Nothing is asked; -dry-run prints what
+ *  would change; each outcome lands in the Issues Summary.
+ *  2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction: "A check would be to
+ *  look at the file; to uninstall from the old name and reinstall with the new. This is safe." */
+export declare function fixDepKeyMismatches(mismatches: PrescanIssue[], opts?: {
+    dryRun?: boolean;
+    verbose?: boolean;
+}): Promise<boolean>;
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not

package/lib.js

@@ -1735,6 +1735,7 @@ export function verifyDepPathCase(cwd, pkg) {
 export function transformDeps(pkg, baseDir, verbose = false, forcePublish = false) {
     let transformed = false;
     const unpublished = [];
+    let fileRefCount = 0; // 2026-09-24: for the one-line summary below
     // If re-running on a previously-transformed pkg, merge-restore first.
     // This preserves any external modifications (AI tools, npm install, manual edits)
     // made since the last transform, then proceeds to re-transform from a clean slate.
@@ -1754,9 +1755,23 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
         for (const [name, value] of Object.entries(pkg[key])) {
             if (isFileRef(value)) {
                 const targetPath = resolveFilePath(value, baseDir);
-                console.log(colors.blue(`  + ${name} → ${value}`));
+                fileRefCount++;
+                // 2026-09-24 16:35 EDT — Claude Code (Fable 5.1), at Bob's direction: the blue
+                // "+ name → file:…" line per dep is -verbose only now. Bob: "when the packages
+                // are fine no need to list them — screen output is clutter so it's hard to see
+                // all that is happening when things are working." Deps that need work still get
+                // their ⟳ line; the rest are one summary line after the loop.
+                if (verbose)
+                    console.log(colors.blue(`  + ${name} → ${value}`));
                 try {
                     const targetPkg = readPackageJson(targetPath);
+                    // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: the range below goes
+                    // under the KEY, so a key that is not the target's name would publish a dep nobody
+                    // can install (dbx10's "ubntdefs": "^1.0.5"). The prescan renames such keys; this
+                    // is the stop for a run that skipped it (-no-prescan).
+                    if (targetPkg.name && targetPkg.name !== name) {
+                        throw new Error(`dependency key "${name}" names a package whose package.json says ${targetPkg.name}; published as "${name}" it could not be installed. Rerun without -no-prescan to have the key renamed, or rename it by hand`);
+                    }
                     const targetVersion = targetPkg.version;
                     const npmVersion = '^' + targetVersion;
                     // Check if this version exists on npm (or if force publish)
@@ -1800,6 +1815,10 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
             }
         }
     }
+    if (fileRefCount && !verbose) {
+        const fine = fileRefCount - unpublished.length;
+        console.log(colors.dim(`  ${fileRefCount} file: dependenc${fileRefCount === 1 ? "y" : "ies"}${unpublished.length ? `: ${unpublished.length} to publish (⟳ above), ${fine} on npm` : ", all on npm"}`));
+    }
     // Record snapshot of transform output so restore can distinguish untouched
     // entries from those modified externally since the transform ran.
     if (transformed) {
@@ -2075,6 +2094,21 @@ export function prescanDepGraph(baseDir, visited = new Set(), verbose = false, f
             }
             const depName = targetPkg.name || name;
             fileTargets.set(depName, targetPath);
+            // 2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction. A file: dep
+            // declared under a key that is not the target's package.json name ("ubntdefs":
+            // file:… whose package.json says "@bobfrankston/ubntdefs") links fine locally, but
+            // transformDeps writes the version range under the KEY, so the published dbx10 said
+            // `"ubntdefs": "^1.0.5"` — a name that is not on npm — and every registry install of
+            // a consumer (setcolor) died with E404. Flagged here; fixDepKeyMismatches renames the
+            // key, uninstalls the old name and reinstalls. Bob: "uninstall from the old name and
+            // reinstall with the new. This is safe."
+            if (targetPkg.name && targetPkg.name !== name) {
+                issues.push({
+                    severity: 'warning', kind: 'nameMismatch',
+                    package: targetPkg.name, key: name, path: baseDir, consumer: consumerName, range: value,
+                    message: `${consumerName} declares ${targetPkg.name} under the key "${name}" (${value})`
+                });
+            }
             // Unscoped + private-intent. This used to be a WARNING whose "continue" led
             // into the cascade prompting to rename the dep by adding a scope. The cascade
             // never renames a dependency now (see the _fromDep check in globalize), so it
@@ -2197,6 +2231,72 @@ export async function fixRegistryRefs(registryRefs, fileTargets, opts = {}) {
     console.log('');
     return ok;
 }
+/** Rename file: dependency keys that differ from the target package's own name, then
+ *  `npm uninstall` the old name and `npm install` so node_modules holds the link under the
+ *  real name. The published package.json carries the version range under the KEY, so a
+ *  wrong key publishes a dependency nobody can install (dbx10 → `"ubntdefs": "^1.0.5"`,
+ *  setcolor's install died with E404 on 2026-09-24). Nothing is asked; -dry-run prints what
+ *  would change; each outcome lands in the Issues Summary.
+ *  2026-09-24 16:20 EDT — Claude Code (Fable 5.1), at Bob's direction: "A check would be to
+ *  look at the file; to uninstall from the old name and reinstall with the new. This is safe." */
+export async function fixDepKeyMismatches(mismatches, opts = {}) {
+    if (!mismatches.length)
+        return true;
+    const { dryRun = false, verbose = false } = opts;
+    console.log(colors.yellow(`${mismatches.length} file: dependenc${mismatches.length === 1 ? 'y is' : 'ies are'} declared under a key that is not the package's own name (published that way, npm would look for a name that does not exist):`));
+    // One uninstall + install per consumer, after all of its keys are renamed.
+    const touched = new Map();
+    for (const m of mismatches) {
+        const pkgJsonPath = path.join(m.path, 'package.json');
+        console.log(`  ${colors.yellow('≠')} ${m.consumer}: "${m.key}" → ${m.package} (${m.range})`);
+        console.log(colors.dim(`       in ${pkgJsonPath}`));
+        if (dryRun) {
+            console.log(colors.dim(`       [dry-run] would rename the key to ${m.package}, then npm uninstall ${m.key} and npm install in ${m.consumer}`));
+            continue;
+        }
+        const pkg = readPackageJson(m.path);
+        let rewrote = false;
+        for (const key of DEP_KEYS) {
+            // A `.dependencies` backup (left by an interrupted transform) is the file: truth;
+            // prescanDepGraph read the key from it, so the rename goes there too.
+            for (const depsKey of ['.' + key, key]) {
+                const deps = pkg[depsKey];
+                if (!deps || deps[m.key] !== m.range)
+                    continue;
+                delete deps[m.key];
+                deps[m.package] = m.range;
+                rewrote = true;
+            }
+        }
+        if (!rewrote) {
+            console.log(colors.dim(`       key not found in ${pkgJsonPath} any more — left as is`));
+            continue;
+        }
+        writePackageJson(m.path, pkg);
+        console.log(colors.green(`       ✓ renamed to ${m.package}`));
+        recordBuildIssue(m.consumer, 'warning', `dependency key "${m.key}" renamed to ${m.package} (the file: target's own name) in ${pkgJsonPath}`);
+        const entry = touched.get(m.path) ?? { consumer: m.consumer, oldKeys: [], newNames: [] };
+        entry.oldKeys.push(m.key);
+        entry.newNames.push(m.package);
+        touched.set(m.path, entry);
+    }
+    let ok = true;
+    for (const [dir, { consumer, oldKeys, newNames }] of touched) {
+        console.log(colors.yellow(`↻ npm uninstall ${oldKeys.join(' ')} in ${consumer} (${dir}) — drops the link under the old name`));
+        const uninstall = await runCommandAsync('npm', ['uninstall', ...oldKeys], { cwd: dir, silent: !verbose });
+        if (!uninstall.success) {
+            // Not fatal: the install below links the real name; a leftover link under the old
+            // name is inert (nothing imports it) and is named so it can be removed by hand.
+            console.log(colors.yellow(`  npm uninstall failed in ${dir}; node_modules/${oldKeys.join(', node_modules/')} may remain — continuing with npm install`));
+            recordBuildIssue(consumer, 'warning', `npm uninstall ${oldKeys.join(' ')} failed in ${dir}; the old link may remain in node_modules`);
+        }
+        console.log(colors.yellow(`↻ npm install in ${consumer} (${dir}) to link ${newNames.join(', ')} under the real name`));
+        if (!await npmInstallWithCleanRetry(dir, verbose, `fixDepKeyMismatches: ${dir}`))
+            ok = false;
+    }
+    console.log('');
+    return ok;
+}
 /** Report unscoped `file:` deps found by the prescan, without asking anything.
  *
  *  An unscoped dep with private intent cannot reach npm, and npmglobalize does not
@@ -7617,7 +7717,15 @@ async function globalizeUnderLock(cwd, options = {}, configOptions = {}) {
             console.error(colors.red('npm install failed while linking own-scope deps as file: (see above). Stopping; use -force to continue anyway.'));
             return false;
         }
-        const allIssues = scanned.filter(i => i.kind !== 'registryRef');
+        // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: file: deps declared under a
+        // key that is not the target's name are renamed + reinstalled the same way (see
+        // fixDepKeyMismatches); a failed install stops the run unless -force.
+        const mismatchOk = await fixDepKeyMismatches(scanned.filter(i => i.kind === 'nameMismatch'), { dryRun, verbose });
+        if (!mismatchOk && !force) {
+            console.error(colors.red('npm install failed after renaming a dependency key to the package\'s own name (see above). Stopping; use -force to continue anyway.'));
+            return false;
+        }
+        const allIssues = scanned.filter(i => i.kind !== 'registryRef' && i.kind !== 'nameMismatch');
         // Unscoped deps are handled apart from the error/warning prompt below: nothing the
         // user answers could change the outcome, so nothing is asked. Report, remember,
         // stop. See reportUnscopedDeps.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.239",
+  "version": "1.0.241",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",