feat: publish --access=private alias for restricted#9153
Merged
Conversation
7f83332 to
1155072
Compare
owlstronaut
previously approved these changes
Mar 31, 2026
Contributor
|
Looks like this just needs snapshots updated? |
Co-authored-by: Copilot <[email protected]>
1155072 to
032b144
Compare
owlstronaut
approved these changes
May 22, 2026
Contributor
|
🎉 Backport to |
reggi
added a commit
that referenced
this pull request
May 27, 2026
Backport of #9153 to `release/v11`. Co-authored-by: Tea Reggi <[email protected]> Co-authored-by: Copilot <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
privateas a valid value for--accessinnpm publish, as an alias forrestricted.Motivation
The
--accessflag onnpm publishcurrently acceptsrestrictedandpublic. However, in everyday usage, the npm community colloquially refers to non-public packages as "private packages" — not "restricted packages." The npm website, the npm registry, andnpm accessall use the term "private" to describe these packages.npm publish --accessvsnpm accessThese are two different commands that deal with package visibility in different ways:
npm publish --access=<public|restricted>sets the visibility of a package at publish time. This is only relevant for scoped packages, where the default for new packages ispublic.npm access set status=<public|private>changes the visibility of an already published package. Notably,npm accessalready usesprivate(notrestricted) as its term for non-public packages.This inconsistency means that a user who runs
npm access set status=privatemight naturally trynpm publish --access=privateand get an error. Since everyone already calls them "private packages," the CLI should accept that term too. This PR resolves that by acceptingprivateas a synonym forrestrictedduring publish.Changes
privateto the valid values for theaccessconfig definitionflattenfunction mapsprivate→restrictedso the registry always receivesrestrictedprivateis an alias forrestricted--access=privateflow