Note the existence of publishConfig when a scoped package is first published and fails

[orta]

I use a tool to publish npm builds to ensure I don't have access to the API keys, which means that re-running a command with --access public isn't really feasible. I started improving the upstream tooling to try and determine automatically if I could publish the package at runtime but private != a way to describe restricted realistically. Which is when I discovered:

"publishConfig": {
    "access": "public"
},

I get the current message and defaults were created back when npm was trying to figure out how to not implode:

npm ERR! 402 Payment Required - PUT https://registry.npmjs.org/@typescript%2fata - You must sign up for private packages

But I'd assume at this point most folks are using scoped packages with public packages, and npm isn't in quite an existential position anymore. Providing a helpful hand rather than forcing a few internet searches to discover how to publish a public scoped package for the first time could make more sense now.

Perhaps?

npm ERR! 402 Payment Required - PUT https://registry.npmjs.org/@typescript%2fata - You must sign up for private packages or set up publishConfig in your package.json

Full log for reference:

Run yarn pleb publish
# @typescript/ata: fetching versions...
# @typescript/ata: got 0 published versions.
# @typescript/ata: package was never published.
# @typescript/ata: npm publish --registry https://registry.npmjs.org/
npm notice 
npm notice 📦  @typescript/ata@0.0.1
npm notice === Tarball Contents === 
npm notice 10.9kB dist/index.js              
npm notice 9.6kB  src/index.ts            
npm notice 1.6kB  src/userFacingTypes.d.ts
npm notice === Tarball Details === 
npm notice name:          @typescript/ata                         
npm notice version:       0.0.1                                   
npm notice package size:  8.1 kB                                  
npm notice unpacked size: 31.4 kB                                 
npm notice shasum:        5e0d0a8819cda3b56ae1ae9b1fbae687235c15de
npm notice integrity:     sha512-vIoZO3CwghhKZ[...]moLOQg+5N02hg==
npm notice total files:   12                                      
npm notice 
npm ERR! code E402
npm ERR! 402 Payment Required - PUT https://registry.npmjs.org/@typescript%2fata - You must sign up for private packages

[MylesBorins]

hey @orta I've pinged @npm/cli to chime in about next steps.

[darcyclarke]

This is technically an error message coming back from the server, so the registry team would have to change this.

That said, I'm not sure what we'd be trying to say by adding " or set up publishConfig in your package.json" to this error message. If we're trying to provide someone with the recommendation/option to make a private package public, I think that could be dangerous. I don't think there's enough information to grok the user's intent & provide a meaningful recommendation here fwiw. A failed private package publish may also mean someone is misconfigured/auth'd & did not intend to try to publish as that user or to that scope OR that they're account was downgraded. If the intent is to recommend changing a package's access to "public", because we think that's an acceptable outcome, we should be very explicit about what will happen.

[fritzy]

From reading the documentation, it looks like we could make improvements there to include mention of publishConfig. We could also expand the documentation to be clear about the exact nature of public and private scoped packages.

In all the docs could use the following updates:

• how to manually create a scoped package without tools for generating config (or links to the appropriate package.json / npmrc docs)
• inclusion of publishConfig or links to it
• definition of private scoped and public scoped

We could link to the docs in the 402 -- is that something that we do elsewhere? It could also be changed to a different error type with a more accurate response message.

[wraithgar]

We could link to the docs in the 402 -- is that something that we do elsewhere? It could also be changed to a different error type with a more accurate response message.

Yes! The OTP prompt does this

This command requires a one-time password (OTP) from your authenticator app.
Enter one below. You can also pass one on the command line by appending --otp=123456.
For more information, see:
https://docs.npmjs.com/getting-started/using-two-factor-authentication
Enter OTP:

[fritzy]

The more I think about this, the more I think 402 is appropriate when they publish a private package without an account/org that supports that. But I do think we should link to that particular document and improve it.

[orta]

Yeah, I agree it could be as simple as something like:

npm ERR! 402 Payment Required - PUT https://registry.npmjs.org/@typescript%2fata - You must sign up for private packages or declare the package public: https://docs.npmjs.com/creating-and-publishing-scoped-public-packages