@bobfrankston/npmglobalize 1.0.240 → 1.0.241

package/README.md

@@ -94,7 +94,7 @@ Errors abort (unless `--force`); warnings prompt to continue.
 
 An unscoped dependency with private intent is reported differently: it is not a question. npmglobalize never renames a dependency to add a scope (the name is what every consumer imports by, and changing it is the dep owner's own project), so the dep cannot reach npm and neither can the package that depends on it. The first run says so in full, names the dep and its path, records it under `unscopedDepsNoted` in the consumer's `.globalize.json5`, and stops. Later runs print one line per dep and stop. Nothing is asked, because no answer could change the outcome. Fix it in the dep: scope the name in its own `package.json`, or set `npmVisibility: "public"` or `noprefix: true` in its `.globalize.json5`; the note clears itself on the next run. If the cascade reaches such a dep anyway (`-no-prescan`), it stops there with the same message. The same holds when you run npmglobalize *in* an unscoped package: it used to ask "Add scope to package name?", and now it warns and assumes no, since a rename changes what every consumer imports. Publishing an unscoped package PUBLIC on purpose takes an explicit `-npm public` or `noprefix: true`. (2026-09-14)
 
-**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
+**Own-scope packages installed from npm instead of linked.** When a package in the `file:` graph depends on one of its own-scope packages by version range (`"@bobfrankston/miscassists": "^1.0.61"`) rather than `file:`, npm puts a registry copy in that package's `node_modules` instead of a link to the local source. The consumer is usually nested under other `file:` deps, where neither the `+` list (`-verbose`) nor the dependency tree shows it, so the prescan finds every such edge. Since 2026-09-23 it **fixes** them: the range is rewritten to a `file:` path in the consumer's `package.json` and `npm install` runs in that consumer, so `node_modules` holds the link. The local source is the directory the same package is linked from elsewhere in the graph, or else the sibling directory named after the package (the `file:../<name>` convention), accepted only when its `package.json` carries that exact name. A range whose local source cannot be found either way is reported and left alone. Nothing is asked. A package with `"files": false` in its `.globalize.json5` keeps npm refs on purpose and is not touched. Each outcome (rewritten, or not found) is repeated as one line in the end-of-run **Issues Summary**. A failed `npm install` stops the run unless `-force`. `-dry-run` prints what would be rewritten. (2026-09-21, fixer 2026-09-23)
 
 **A `file:` dependency declared under the wrong key.** `"ubntdefs": "file:../ubntdefs"` links fine locally even when that package's own `package.json` says `@bobfrankston/ubntdefs`, because npm links a `file:` dep under whatever key you wrote. But the published `package.json` carries the version range under that key, so the registry copy of the consumer says `"ubntdefs": "^1.0.5"`, a name that is not on npm, and every registry install of it or of anything depending on it dies with E404 (dbx10 → setcolor, 2026-09-24). The prescan compares every `file:` key with the target's own name and **fixes** a mismatch: the key is renamed to the real name in the consumer's `package.json` (the `file:` path is kept), `npm uninstall <old key>` drops the link under the old name, and `npm install` links it under the real one. Nothing is asked; `-dry-run` prints what would change; each rename and any failed uninstall is repeated in the **Issues Summary**; a failed install stops the run unless `-force`. Imports in the consumer's code are not touched, so if anything imported by the old key, fix that by hand. A run with `-no-prescan` that reaches such a key stops in the transform with the same explanation rather than publishing a broken `package.json`. (2026-09-24)
 

package/lib.js

@@ -1735,6 +1735,7 @@ export function verifyDepPathCase(cwd, pkg) {
 export function transformDeps(pkg, baseDir, verbose = false, forcePublish = false) {
     let transformed = false;
     const unpublished = [];
+    let fileRefCount = 0; // 2026-09-24: for the one-line summary below
     // If re-running on a previously-transformed pkg, merge-restore first.
     // This preserves any external modifications (AI tools, npm install, manual edits)
     // made since the last transform, then proceeds to re-transform from a clean slate.
@@ -1754,7 +1755,14 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
         for (const [name, value] of Object.entries(pkg[key])) {
             if (isFileRef(value)) {
                 const targetPath = resolveFilePath(value, baseDir);
-                console.log(colors.blue(`  + ${name} → ${value}`));
+                fileRefCount++;
+                // 2026-09-24 16:35 EDT — Claude Code (Fable 5.1), at Bob's direction: the blue
+                // "+ name → file:…" line per dep is -verbose only now. Bob: "when the packages
+                // are fine no need to list them — screen output is clutter so it's hard to see
+                // all that is happening when things are working." Deps that need work still get
+                // their ⟳ line; the rest are one summary line after the loop.
+                if (verbose)
+                    console.log(colors.blue(`  + ${name} → ${value}`));
                 try {
                     const targetPkg = readPackageJson(targetPath);
                     // 2026-09-24 — Claude Code (Fable 5.1), at Bob's direction: the range below goes
@@ -1807,6 +1815,10 @@ export function transformDeps(pkg, baseDir, verbose = false, forcePublish = fals
             }
         }
     }
+    if (fileRefCount && !verbose) {
+        const fine = fileRefCount - unpublished.length;
+        console.log(colors.dim(`  ${fileRefCount} file: dependenc${fileRefCount === 1 ? "y" : "ies"}${unpublished.length ? `: ${unpublished.length} to publish (⟳ above), ${fine} on npm` : ", all on npm"}`));
+    }
     // Record snapshot of transform output so restore can distinguish untouched
     // entries from those modified externally since the transform ran.
     if (transformed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.240",
+  "version": "1.0.241",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",