yarnpkg/yarn · error · MessageError

invalidAccess

Error message

invalidAccess

What it means

`yarn publish` accepts an `--access` flag (or package.json `publishConfig.access`) that must be exactly `public` or `restricted` for scoped packages on npm (publish.js:38-44). Anything else throws invalidAccess before lifecycle scripts run.

Source

Thrown at src/cli/commands/publish.js:42

  commander.option('--tag [tag]', 'tag');
}

export function hasWrapper(commander: Object, args: Array<string>): boolean {
  return true;
}

async function publish(config: Config, pkg: any, flags: Object, dir: string): Promise<void> {
  let access = flags.access;

  // if no access level is provided, check package.json for `publishConfig.access`
  // see: https://docs.npmjs.com/files/package.json#publishconfig
  if (!access && pkg && pkg.publishConfig && pkg.publishConfig.access) {
    access = pkg.publishConfig.access;
  }

  // validate access argument
  if (access && access !== 'public' && access !== 'restricted') {
    throw new MessageError(config.reporter.lang('invalidAccess'));
  }

  // TODO this might modify package.json, do we need to reload it?
  await config.executeLifecycleScript('prepublish');
  await config.executeLifecycleScript('prepare');
  await config.executeLifecycleScript('prepublishOnly');
  await config.executeLifecycleScript('prepack');

  // get tarball stream
  const stat = await fs.lstat(dir);
  let stream;
  if (stat.isDirectory()) {
    stream = await pack(config);
  } else if (stat.isFile()) {
    stream = fs2.createReadStream(dir);
  } else {
    throw new Error("Don't know how to handle this file type");
  }

View on GitHub (pinned to c2dda503f3)

Solutions

1. Use `--access public` or `--access restricted` (restricted is the npm default for scoped packages).
2. Fix `publishConfig.access` in package.json to one of the two allowed values.
3. Remove the `--access` flag entirely to accept the registry default for your package scope.

Example fix

// before
$ yarn publish --access private
// after
$ yarn publish --access restricted

const VALID = new Set(['public', 'restricted']);
function resolveAccess(flags, pkg) {
  let access = flags.access || (pkg && pkg.publishConfig && pkg.publishConfig.access);
  if (access && !VALID.has(access)) {
    throw new Error(`Invalid --access '${access}'. Use 'public' or 'restricted'.`);
  }
  return access;
}

function isValidAccess(access) {
  return access === undefined || access === 'public' || access === 'restricted';
}

try {
  await runYarn(['publish', '--access', access]);
} catch (e) {
  if (/invalidAccess/.test(e.message)) {
    console.error('--access must be public or restricted.');
    return;
  }
  throw e;
}

When it happens

Trigger: Running `yarn publish --access private` (a common mistake—`private` is not a valid access level), or setting `publishConfig.access` to an arbitrary string in package.json.

Common situations: Confusing `private: true` with `--access private`; typo like `pubilc`; legacy config carrying an invalid value.

Related errors

• publishFail
• tooManyArguments
• unknownFolderOrTarball
• nonInteractiveNoToken
• invalidPackageName

AI-assisted analysis of yarnpkg/yarn@c2dda503f3 (2026-08-13). Data as JSON: /api/errors/ad99bb0ad07d80fb. Report an issue: GitHub.