npm cli tool should report name similarity problems in --dry-run

[msikma]

So you've just finished writing the code for your package, and now all that needs to be done is decide on a name and publish it to Github and then npm.

You check npmjs.com/package/repoinfo and see the wombat—great, that means it's free! You try npm publish --dry-run and everything looks good. So you make the repo on Github and dump your code there, maybe fix the few inevitable bugs you didn't see until after you pushed your code, and now it's time to publish.

Then suddenly it turns out you can't publish:

npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://registry.npmjs.org/repoinfo - Package name too similar to existing package repo-info; try renaming your package to '@msikma/repoinfo' and publishing with 'npm publish --access=public' instead
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.

Now, this is not a complaint about the naming system. I think it's a good idea to prevent too-similar package names from being taken, and renaming a package isn't the biggest deal. In my particular case it really doesn't matter because it's just a small package that probably no one besides me will ever use.

But it's a bit annoying that the only way to find out about this is by actually publishing. Now I need to delete the Github repo and remake it under another name.

The --dry-run option is described as the following:

[--dry-run]: As of npm@6, does everything publish would do except actually publishing to the registry. Reports the details of what would have been published.

With a description like this I think it's not unreasonable to expect it to check for things like name clashes or other things that can be verified ahead of time. (Actually, right now --dry-run doesn't even check if "private" is set to true, and that's even something that can be checked purely offline.)

There may potentially be additional useful things that could be checked by --dry-run that I'm not aware of, but at the very least I think doing a name check would be nice, especially since most good non-namespaced names are taken by now.

Thanks for reading, and I appreciate any thoughts.

[ljharb]

+1, this is super annoying. Additionally, since npm doesn't publish its criteria for "similar", I'm forced to infer it from past experience and manually search for all the variations i can think of. Sometimes I find it, sometimes not; most of the time when I find it, it's not actually a typo anyone is likely to make, which would mean it's "fine" to allow (but that's a different issue than the OP).

It would be very wonderful if npm publish --dry-run did indeed check name similarity, or alternatively, if there was another mechanism to test a name short of actually publishing.