{"record":{"id":"ad99bb0ad07d80fb","repo":"yarnpkg/yarn","slug":"invalidaccess","errorCode":null,"errorMessage":"invalidAccess","messagePattern":"invalidAccess","errorType":"exception","errorClass":"MessageError","httpStatus":null,"severity":"error","filePath":"src/cli/commands/publish.js","lineNumber":42,"sourceCode":"  commander.option('--tag [tag]', 'tag');\n}\n\nexport function hasWrapper(commander: Object, args: Array<string>): boolean {\n  return true;\n}\n\nasync function publish(config: Config, pkg: any, flags: Object, dir: string): Promise<void> {\n  let access = flags.access;\n\n  // if no access level is provided, check package.json for `publishConfig.access`\n  // see: https://docs.npmjs.com/files/package.json#publishconfig\n  if (!access && pkg && pkg.publishConfig && pkg.publishConfig.access) {\n    access = pkg.publishConfig.access;\n  }\n\n  // validate access argument\n  if (access && access !== 'public' && access !== 'restricted') {\n    throw new MessageError(config.reporter.lang('invalidAccess'));\n  }\n\n  // TODO this might modify package.json, do we need to reload it?\n  await config.executeLifecycleScript('prepublish');\n  await config.executeLifecycleScript('prepare');\n  await config.executeLifecycleScript('prepublishOnly');\n  await config.executeLifecycleScript('prepack');\n\n  // get tarball stream\n  const stat = await fs.lstat(dir);\n  let stream;\n  if (stat.isDirectory()) {\n    stream = await pack(config);\n  } else if (stat.isFile()) {\n    stream = fs2.createReadStream(dir);\n  } else {\n    throw new Error(\"Don't know how to handle this file type\");\n  }","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/yarnpkg/yarn/blob/c2dda503f3759b5be5f0e24ecd9cf5c97a540147/src/cli/commands/publish.js#L24-L60","documentation":"`yarn publish` accepts an `--access` flag (or package.json `publishConfig.access`) that must be exactly `public` or `restricted` for scoped packages on npm (publish.js:38-44). Anything else throws invalidAccess before lifecycle scripts run.","triggerScenarios":"Running `yarn publish --access private` (a common mistake—`private` is not a valid access level), or setting `publishConfig.access` to an arbitrary string in package.json.","commonSituations":"Confusing `private: true` with `--access private`; typo like `pubilc`; legacy config carrying an invalid value.","solutions":["Use `--access public` or `--access restricted` (restricted is the npm default for scoped packages).","Fix `publishConfig.access` in package.json to one of the two allowed values.","Remove the `--access` flag entirely to accept the registry default for your package scope."],"exampleFix":"// before\n$ yarn publish --access private\n// after\n$ yarn publish --access restricted","handlingStrategy":"validation","validationCode":"const VALID = new Set(['public', 'restricted']);\nfunction resolveAccess(flags, pkg) {\n  let access = flags.access || (pkg && pkg.publishConfig && pkg.publishConfig.access);\n  if (access && !VALID.has(access)) {\n    throw new Error(`Invalid --access '${access}'. Use 'public' or 'restricted'.`);\n  }\n  return access;\n}","typeGuard":"function isValidAccess(access) {\n  return access === undefined || access === 'public' || access === 'restricted';\n}","tryCatchPattern":"try {\n  await runYarn(['publish', '--access', access]);\n} catch (e) {\n  if (/invalidAccess/.test(e.message)) {\n    console.error('--access must be public or restricted.');\n    return;\n  }\n  throw e;\n}","preventionTips":["Remember only `public` and `restricted` are valid access levels.","Don't confuse `private: true` with `--access`.","Lint publishConfig.access in CI to one of the two allowed values."],"tags":["cli","publish","validation","access","registry"],"backgroundTag":null,"analyzedSha":"c2dda503f3759b5be5f0e24ecd9cf5c97a540147","analyzedAt":"2026-08-13T04:17:06.305Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}