Repository navigation
[CROSS-PROJECT] DECISION REQUIRED: npm namespace & registry strategy blocks all publishing (@coderooz vs @coderooz_org vs GitHub Packages) #46
Description
Summary
Cross-project decision required: no approved npm namespace/registry strategy exists, blocking all publishing across the ecosystem (this repo's 16 @coderooz/* workspace packages + template, React-Code-Blocks, NextJs-Template).
Evidence
@coderoozscope: 404 on npm (not owned); local~/.npmrcroutes it to GitHub Packages; npmjs token returns 401 (expired) � verified 2026-10-12.@coderooz_orgscope: created 2026-10-11, unused, available.- This repo: 16 unpublished workspace packages (
@coderooz/ui,@coderooz/core,@coderooz/create-app, ...) + publishedexpo-template-coderooz@1.0.3(unscoped, stale vs repo 1.2.0). Related: Published npm template (1.0.3) is stale vs repository (1.2.0) #40, Version numbers inconsistent across files (1.2.0 vs 1.0.4 vs 1.0.3) #43, Docs advertise unpublished @coderooz/cli as the primary path #44, Auto-registered screens, base info screens (About/Licenses/Policies + Settings v2), and GitHub Packages registry config #45. - React-Code-Blocks#1:
@coderooz/code-blocksunpublished (404). - NextJs-Template#14: name
nextjs-templatetaken by third party. - Analysis:
.reports/ecosystem/INTEGRATION_GAP_ANALYSIS.md(G1),SOURCE_OF_TRUTH_ANALYSIS.md(Conflict 2),ECOSYSTEM_ROADMAP.md(Phase 0).
Impact
- Severity: Critical (ecosystem-wide).
- Blocks: Phase C (RCB distribution), Phase F (Next.js + RCB), Phase G (release hardening), any template CLI publishing. Without this decision no package can reach a consumer.
Root Cause
Namespace was never provisioned at creation time; GitHub Packages .npmrc routing masked the fact that npmjs @coderooz was never owned; token expired.
Proposed Resolution (decision needed � three options)
- Public npm under
@coderooz_org/*(analysis recommendation): zero rename cost today (nothing published under old scope), best discoverability, no consumer auth friction. Requires renaming@coderooz/*?@coderooz_org/*before first publish + refresh npm token + fix.npmrc. - GitHub Packages under
@coderooz/*: keeps current names, but consumers must authenticate and configure registry � high friction, poor discoverability. - Hybrid: public npm for user-facing packages (template CLIs, RCB), GitHub Packages for internal workspace packages � higher maintenance, two registries to secure.
Consumer impact, rename cost, and release-automation implications are evaluated in.reports/ecosystem/DISTRIBUTION_*reports (Phase 4 deliverables).
Acceptance Criteria
- One strategy explicitly approved by the project owner (human decision gate).
- Package-by-package rename/migration inventory produced (PACKAGE_INVENTORY).
- npm credentials refreshed and
npm whoamisucceeds (or GitHub Packages auth verified). -
.npmrcupdated to match the chosen strategy. - First publish performed under the approved name with verification.
Dependencies
- BLOCKS: React-Code-Blocks#1, React-Code-Blocks#2 (naming), NextJs-Template#14, EXT#40/Version numbers inconsistent across files (1.2.0 vs 1.0.4 vs 1.0.3) #43/Docs advertise unpublished @coderooz/cli as the primary path #44 release work, Phase C/F/G.
Risk and Rollback
Pre-first-publish rename is zero-cost. Publishing is irreversible per version � verify name ownership before any npm publish. Do not publish until this issue is resolved with explicit approval.
Execution Evidence
2026-10-12: registry checks (npmjs 404/200 responses), npm whoami ? 401, .npmrc inspection.
Activity
coderooz commentedon Oct 12, 2026
Evidence update (2026-10-12, later session) — premise correction
Re-verification this session disproves the core premise recorded under Evidence above
(「
@coderoozscope: 404 on npm (not owned)」).What was wrong
A 404 on
@coderooz/code-blocksonly means that package name was never published. It saysnothing about who owns the scope. The scope-ownership conclusion was inferred from
package-level 404s while the GitHub-Packages
.npmrcrouting masked npmjs state.New evidence
coderooz— maintainer field onexpo-template-coderooz@1.0.3,@uaif/core@0.1.0,@uaif/cli@0.1.0(packages this owner published) =coderooz.GET https://registry.npmjs.org/-/org/coderooz/user→200 {"coderooz":"owner"}(fabricated names return 404) → the npm account exists.
docs.npmjs.comscope page, fetched today): "Each npm user/organizationhas their own scope, and only you can add packages in your scope", with "Publishing to your
user scope (
@username/module)" as a standard path.scope:coderoozsearch → 0 hits;scope:coderooz_org→ 0 hits → both scopes have zeropackages published (rename cost remains zero under any option).
~/.npmrc(@coderooz:registry=https://npm.pkg.github.com/)and this repo's untracked
.npmrc(same line;npm config get @coderooz:registryconfirms).Consequence for the three options
A fourth option is now on the table and is the new analysis recommendation:
@coderooz/*on public npm: zero renames (all 35 package.json filesalready use
@coderooz/*), no consumer friction. Requires: refresh npm token (stillE401),remove both GitHub-Packages routing lines, then one authenticated confirmation
(
npm whoamimust printcoderooz).@coderooz_org/*: still fully viable (org exists, unused); becomesthe fallback if the authenticated confirmation fails, or the choice if team-permission
structure is desired.
@coderooz/*: unchanged analysis (high consumer friction,registry split with the already-published npmjs packages).
Unchanged
Nothing here authorizes publishing, renaming, or credential changes. The approval gate stands:
owner must pick A/B/C/D explicitly and refresh npm credentials.
Full brief:
.reports/ecosystem/EXT46_NAMESPACE_DECISION_BRIEF.md(also:
DISTRIBUTION_DECISIONS.md§ ADDENDUM preserves the original text with correction).