@dbx-tools/projen 0.9.153 → 0.9.154

package/README.md

@@ -601,11 +601,14 @@ site. Install validation prerequisites through `releaseSetupSteps`.
 Publication jobs download the resulting artifacts rather than rebuilding the
 workspace. Each Python package retains its own publishing environment and waits
 for its package dependencies to publish. The npm job uses the bundled archive
-publisher without a checkout or workspace install. Pages deploys the already
-built site after registry publication succeeds. Local npm and Python registry publication remains available
-through the direct local publication tooling. Those local publishers run
-concurrently; a failure or release termination stops every live publisher before
-the command returns.
+publisher without a checkout or workspace install. After all selected public
+publishers finish, one verifier downloads the complete release artifact set and
+polls only unresolved packages concurrently. It validates npm tarball contents
+and PyPI distribution hashes before Pages deploys the already built site. Local
+npm and Python registry publication remains available through the direct local
+publication tooling and does not wait for registry propagation. Those local
+publishers run concurrently; a failure or release termination stops every live
+publisher before the command returns.
 
 The default release publishes npm, Python, and docs, then publishes to
 configured local registries. Use `bun run release --help` or the generated

package/index.ts

@@ -3,7 +3,7 @@
 // Hand edits are overwritten on the next watch; this file is read-only.
 
 export const PACKAGE_IDENTIFIER = "@dbx-tools/projen";
-export const PACKAGE_VERSION = "0.9.153";
+export const PACKAGE_VERSION = "0.9.154";
 export * as appkitWorkspace from "./src/appkit-workspace.ts";
 export * as barrels from "./src/barrels.ts";
 export * as bunApp from "./src/bun-app.ts";
@@ -69,7 +69,7 @@ export { PYTHON_NODE_RUNTIME_DISTRIBUTION, PYTHON_NODE_RUNTIME_MODULE, PYTHON_NO
 export type { PythonNodeRuntimeOptions } from "./src/python-node-runtime.ts";
 export { DBXToolsRelease } from "./src/release.ts";
 export type { ReleaseDocsOptions, DBXToolsReleaseOptions } from "./src/release.ts";
-export { RELEASE_VERSION, RELEASE_WORKFLOW_FILE } from "./src/release-context.ts";
+export { RELEASE_VERSION, RELEASE_WORKFLOW_FILE, PUBLIC_NPM_REGISTRY_URL, PUBLIC_PYPI_REGISTRY_URL } from "./src/release-context.ts";
 export { RELEASE_PUBLISH_TARGETS, RELEASE_INSTALL_MODES, ReleaseStepSelectionSchema } from "./src/release-options.ts";
 export type { ReleasePublishTarget, ReleaseInstallMode, ReleaseStepSelection, ReleaseSelectionOptions } from "./src/release-options.ts";
 export { SHARED_CORE_BINDING_EXPORTS } from "./src/shared-core-usage.ts";

package/package.json

@@ -30,11 +30,11 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.7.0",
-    "@dbx-tools/auth": "^0.9.153",
-    "@dbx-tools/cli-args": "^0.9.153",
-    "@dbx-tools/core": "^0.9.153",
-    "@dbx-tools/path": "^0.9.153",
-    "@dbx-tools/shared-core": "^0.9.153",
+    "@dbx-tools/auth": "^0.9.154",
+    "@dbx-tools/cli-args": "^0.9.154",
+    "@dbx-tools/core": "^0.9.154",
+    "@dbx-tools/path": "^0.9.154",
+    "@dbx-tools/shared-core": "^0.9.154",
     "commander": "^15.0.0",
     "concurrently": "^10.0.3",
     "constructs": "^10.6.0",
@@ -56,7 +56,7 @@
   },
   "main": "index.ts",
   "license": "Apache-2.0",
-  "version": "0.9.153",
+  "version": "0.9.154",
   "types": "index.ts",
   "type": "module",
   "exports": {

package/src/project-py.ts

@@ -19,6 +19,7 @@ import {
   PythonNodeRuntime,
 } from "./python-node-runtime.ts";
 import {
+  refreshPublicationVerification,
   refreshReleaseDocsDependencies,
   releaseCondition,
   releaseBuildSteps,
@@ -705,6 +706,7 @@ export class DBXToolsPythonWorkspace extends Component {
         ],
       });
     }
+    refreshPublicationVerification(project);
     refreshReleaseDocsDependencies(project);
   }
 

package/src/release-context.ts

@@ -3,3 +3,7 @@
 export const RELEASE_VERSION = "${{ needs.build-release.outputs.release_version }}";
 /** Generated GitHub Actions workflow triggered by release tags. */
 export const RELEASE_WORKFLOW_FILE = "release.yml";
+/** Public npm registry queried after npm publication completes. */
+export const PUBLIC_NPM_REGISTRY_URL = "https://registry.npmjs.org";
+/** Public PyPI JSON API queried after Python publication completes. */
+export const PUBLIC_PYPI_REGISTRY_URL = "https://pypi.org/pypi";

package/src/release.ts

@@ -16,12 +16,17 @@ import { GithubWorkflow } from "projen/lib/github";
 import { JobPermission, type Job, type JobStep } from "projen/lib/github/workflows-model";
 import { BUN_VERSION } from "./bun-workflow.ts";
 import { projectReleaseBranch, taskCommand, type DBXToolsJavaScriptProject } from "./project-js.ts";
-import { RELEASE_VERSION, RELEASE_WORKFLOW_FILE } from "./release-context.ts";
+import {
+  PUBLIC_NPM_REGISTRY_URL,
+  RELEASE_VERSION,
+  RELEASE_WORKFLOW_FILE,
+} from "./release-context.ts";
 import type { ReleaseStepSelection } from "./release-options.ts";
 
 const NODE_VERSION = "24";
 const NPM_VERSION = "11.4.2";
-const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const PUBLICATION_VERIFIER_ARTIFACT = "release-publication-verifier";
+const PUBLICATION_VERIFIER_JOB = "verify-publications";
 const releaseTagPrefixes = new WeakMap<DBXToolsJavaScriptProject, string>();
 const releaseWorkflows = new WeakMap<DBXToolsJavaScriptProject, GithubWorkflow>();
 
@@ -95,7 +100,7 @@ export function nodeReleaseSetupSteps(): readonly JobStep[] {
       uses: github.ActionRefs.ACTIONS_SETUP_NODE,
       with: {
         "node-version": NODE_VERSION,
-        "registry-url": NPM_REGISTRY_URL,
+        "registry-url": PUBLIC_NPM_REGISTRY_URL,
         "package-manager-cache": false,
       },
     },
@@ -114,19 +119,14 @@ export function uvSetupStep(): JobStep {
 function refreshDocsRegistryDependencies(workflow: GithubWorkflow): void {
   const docs = workflow.getJob("deploy-docs") as Job | undefined;
   if (!docs) return;
-  const registryJobs = Object.keys(workflow.jobs).filter(
-    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
-  );
-  if (registryJobs.length > 0) {
+  if (workflow.getJob(PUBLICATION_VERIFIER_JOB)) {
     workflow.updateJob("deploy-docs", {
       ...docs,
-      needs: ["build-release", ...registryJobs],
+      needs: ["build-release", PUBLICATION_VERIFIER_JOB],
       if: releaseCondition([
         "needs['build-release'].result == 'success'",
         "needs['build-release'].outputs.docs == 'true'",
-        ...registryJobs.map(
-          (name) => `needs['${name}'].result == 'success' || needs['${name}'].result == 'skipped'`,
-        ),
+        `needs['${PUBLICATION_VERIFIER_JOB}'].result == 'success' || needs['${PUBLICATION_VERIFIER_JOB}'].result == 'skipped'`,
       ]),
     });
   }
@@ -140,6 +140,107 @@ export function refreshReleaseDocsDependencies(project: DBXToolsJavaScriptProjec
   }
 }
 
+function publicationRegistryJobs(workflow: GithubWorkflow): string[] {
+  return Object.keys(workflow.jobs).filter(
+    (name) => name === "publish-node" || name.startsWith("publish-pypi-"),
+  );
+}
+
+/** Keep one public availability barrier behind every configured registry publisher. */
+export function refreshPublicationVerification(project: DBXToolsJavaScriptProject): void {
+  const workflow = releaseWorkflows.get(project);
+  if (!workflow) return;
+  const registryJobs = publicationRegistryJobs(workflow);
+  if (registryJobs.length === 0) return;
+  const hasNpm = registryJobs.includes("publish-node");
+  const hasPypi = registryJobs.some((name) => name.startsWith("publish-pypi-"));
+  const selected = [
+    ...(hasNpm ? ["needs['build-release'].outputs.npm == 'true'"] : []),
+    ...(hasPypi ? ["needs['build-release'].outputs.pypi == 'true'"] : []),
+  ].join(" || ");
+  const prerequisites = registryJobs.map((name) => {
+    const output = name === "publish-node" ? "npm" : "pypi";
+    return `needs['build-release'].outputs.${output} != 'true' || needs['${name}'].result == 'success'`;
+  });
+  const job: Job = {
+    if: releaseCondition([
+      "needs['build-release'].result == 'success'",
+      selected,
+      ...prerequisites,
+    ]),
+    needs: ["build-release", ...registryJobs],
+    runsOn: ["ubuntu-latest"],
+    permissions: { contents: JobPermission.READ },
+    timeoutMinutes: 15,
+    steps: [
+      {
+        name: "Download publication verifier",
+        uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+        with: { name: PUBLICATION_VERIFIER_ARTIFACT, path: ".release/verifier" },
+      },
+      ...(hasNpm
+        ? [
+            {
+              name: "Download npm archives",
+              if: "${{ needs.build-release.outputs.npm == 'true' }}",
+              uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+              with: { name: "release-npm", path: ".release/npm" },
+            },
+          ]
+        : []),
+      ...(hasPypi
+        ? [
+            {
+              name: "Download Python distributions",
+              if: "${{ needs.build-release.outputs.pypi == 'true' }}",
+              uses: github.ActionRefs.ACTIONS_DOWNLOAD_ARTIFACT,
+              with: {
+                pattern: "release-python-*",
+                path: ".release/python",
+                "merge-multiple": true,
+              },
+            },
+          ]
+        : []),
+      {
+        name: "Setup Bun",
+        uses: github.ActionRefs.OVEN_SH_SETUP_BUN,
+        with: { "bun-version": BUN_VERSION },
+      },
+      {
+        name: "Wait for public package availability",
+        shell: "bash",
+        env: {
+          RELEASE_VERSION,
+          VERIFY_NPM: hasNpm ? "${{ needs.build-release.outputs.npm }}" : "false",
+          VERIFY_PYPI: hasPypi ? "${{ needs.build-release.outputs.pypi }}" : "false",
+        },
+        // prettier-ignore
+        run: stringUtils.dedent(
+          // ============================================================================
+          /*bash*/`
+            args=(--version "$RELEASE_VERSION")
+            if [[ "$VERIFY_NPM" == "true" ]]; then
+              args+=(--npm-directory .release/npm)
+            fi
+            if [[ "$VERIFY_PYPI" == "true" ]]; then
+              args+=(--pypi-directory .release/python)
+            fi
+            bun .release/verifier/verify-publications.mjs "\${args[@]}"
+          `
+          // ============================================================================
+        ),
+      },
+    ],
+  };
+  if (workflow.getJob(PUBLICATION_VERIFIER_JOB)) {
+    workflow.updateJob(PUBLICATION_VERIFIER_JOB, job);
+  } else {
+    workflow.addJob(PUBLICATION_VERIFIER_JOB, job);
+  }
+  refreshDocsRegistryDependencies(workflow);
+}
+
 function releaseBuildJob(
   project: DBXToolsJavaScriptProject,
   tagPrefix: string,
@@ -229,6 +330,24 @@ function releaseBuildJob(
               with: { name: "release-npm", path: ".release/npm", "if-no-files-found": "error" },
             },
           ])),
+      {
+        name: "Build publication verifier",
+        if: "${{ success() && (steps.release.outputs.npm == 'true' || steps.release.outputs.pypi == 'true') }}",
+        run: [
+          "mkdir -p .release/verifier",
+          "bun build node_modules/@dbx-tools/projen/tasks/verify-publications.ts --target=bun --outfile=.release/verifier/verify-publications.mjs",
+        ].join("\n"),
+      },
+      {
+        name: "Upload publication verifier",
+        if: "${{ success() && (steps.release.outputs.npm == 'true' || steps.release.outputs.pypi == 'true') }}",
+        uses: github.ActionRefs.ACTIONS_UPLOAD_ARTIFACT,
+        with: {
+          name: PUBLICATION_VERIFIER_ARTIFACT,
+          path: ".release/verifier/verify-publications.mjs",
+          "if-no-files-found": "error",
+        },
+      },
       ...(options.docs
         ? releaseBuildSteps("docs", [
             ...options.docs.prepareSteps,
@@ -356,6 +475,7 @@ export class DBXToolsRelease extends Component {
     if (options.nodeRelease !== false) {
       workflow.addJob("publish-node", nodePublishJob());
     }
+    refreshPublicationVerification(project);
     if (options.docs) {
       addDocsJobs(workflow);
     }

package/tasks/publish-npm.ts

@@ -20,11 +20,11 @@ import { z } from "zod";
 import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
 import { TaskConcurrencyOptionSchema, TaskDryRunOptionSchema } from "./options.ts";
 import { runTaskCommandAsync } from "../src/_task-command.ts";
+import { PUBLIC_NPM_REGISTRY_URL } from "../src/release-context.ts";
 import { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
 
 export { materializeWorkspaceManifest } from "../src/workspace-manifest.ts";
 
-const DEFAULT_REGISTRY = "https://registry.npmjs.org";
 const DEFAULT_PUBLISH_CONCURRENCY = 4;
 const logger = log.logger("projen:publish-npm");
 
@@ -132,10 +132,12 @@ export function npmReleaseMatches(
 export async function publishedNpmRelease(
   name: string,
   version: string,
-  registry = process.env.NPM_CONFIG_REGISTRY ?? DEFAULT_REGISTRY,
+  registry = process.env.NPM_CONFIG_REGISTRY ?? PUBLIC_NPM_REGISTRY_URL,
+  signal?: AbortSignal,
 ): Promise<NpmReleaseIdentity | undefined> {
   const response = await fetch(registryUrl(registry, name, version), {
     headers: { accept: "application/json" },
+    signal,
   });
   if (response.status === 404) return undefined;
   if (!response.ok) {
@@ -152,7 +154,7 @@ export async function publishedNpmRelease(
   }
   let contentDigest: string | undefined;
   if (metadata.dist?.tarball) {
-    const archive = await fetch(metadata.dist.tarball);
+    const archive = await fetch(metadata.dist.tarball, { signal });
     if (!archive.ok) {
       throw new Error(`npm tarball lookup failed for ${name}@${version}: ${archive.status}`);
     }

package/tasks/verify-publications.ts

@@ -0,0 +1,269 @@
+#!/usr/bin/env -S bun
+/** Wait for one release batch to become available from public package registries. */
+import { createHash } from "node:crypto";
+import { readFileSync, readdirSync } from "node:fs";
+import { basename, join, resolve } from "node:path";
+import { asyncUtils, errorUtils, log } from "@dbx-tools/shared-core";
+import { z } from "zod";
+import { runTaskMain, taskCommand, taskOptions } from "./cli.ts";
+import { npmReleaseMatches, publishedNpmRelease, readNpmArchiveIdentity } from "./publish-npm.ts";
+import { PUBLIC_NPM_REGISTRY_URL, PUBLIC_PYPI_REGISTRY_URL } from "../src/release-context.ts";
+
+const DEFAULT_CONCURRENCY = 8;
+const DEFAULT_INTERVAL_SECONDS = 5;
+const DEFAULT_TIMEOUT_SECONDS = 10 * 60;
+const logger = log.logger("projen:verify-publications");
+
+const PypiReleaseSchema = z
+  .object({
+    urls: z
+      .array(
+        z
+          .object({
+            filename: z.string().describe("Published distribution filename"),
+            digests: z
+              .object({
+                sha256: z.string().describe("Published distribution SHA-256 digest"),
+              })
+              .describe("Published distribution digests"),
+          })
+          .describe("One published Python distribution"),
+      )
+      .describe("Published Python distributions"),
+  })
+  .describe("PyPI release metadata");
+
+interface PypiReleaseIdentity {
+  readonly files: ReadonlyMap<string, string>;
+  readonly name: string;
+  readonly version: string;
+}
+
+/** One public artifact group checked during the shared availability barrier. */
+export interface PublicationProbe {
+  /** Human-readable package identity used in progress and timeout messages. */
+  readonly label: string;
+  /** Return true only when the exact expected public artifact is available. */
+  available(signal: AbortSignal): boolean | PromiseLike<boolean>;
+}
+
+/** Timing and concurrency controls for the shared publication barrier. */
+export interface PublicationWaitOptions {
+  readonly concurrency?: number;
+  readonly intervalMs?: number;
+  readonly timeoutMs?: number;
+}
+
+/** Poll every unresolved publication concurrently and stop after one shared timeout. */
+export async function waitForPublications(
+  probes: readonly PublicationProbe[],
+  options: PublicationWaitOptions = {},
+): Promise<void> {
+  if (probes.length === 0) throw new Error("No public publications were provided");
+  const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
+  const errors = new Map<string, Error>();
+  let pending = [...probes];
+  let previousCount: number | undefined;
+  try {
+    for await (const unavailable of asyncUtils.poll<PublicationProbe[]>(
+      async ({ signal }) => {
+        const results = await asyncUtils.mapConcurrent(
+          pending,
+          async (probe) => {
+            try {
+              const available = await probe.available(signal);
+              if (available) errors.delete(probe.label);
+              return { available, probe };
+            } catch (error) {
+              errors.set(probe.label, errorUtils.toError(error));
+              return { available: false, probe };
+            }
+          },
+          { concurrency },
+        );
+        return results.filter(({ available }) => !available).map(({ probe }) => probe);
+      },
+      {
+        intervalMs: options.intervalMs ?? DEFAULT_INTERVAL_SECONDS * 1_000,
+        timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_SECONDS * 1_000,
+        predicate: (unavailable) => unavailable.length > 0,
+      },
+    )) {
+      pending = unavailable;
+      if (pending.length > 0 && pending.length !== previousCount) {
+        logger.info(
+          `waiting for ${pending.length} public publication${pending.length === 1 ? "" : "s"}`,
+        );
+      }
+      previousCount = pending.length;
+    }
+  } catch (error) {
+    if (pending.length === 0) throw error;
+    const details = pending
+      .map((probe) => {
+        const failure = errors.get(probe.label);
+        return failure ? `${probe.label}: ${failure.message}` : probe.label;
+      })
+      .join("\n");
+    throw new Error(`Publications did not become available:\n${details}`, { cause: error });
+  }
+  logger.info(`verified ${probes.length} public publication${probes.length === 1 ? "" : "s"}`);
+}
+
+function npmPublicationProbes(directory: string, version: string): PublicationProbe[] {
+  return readdirSync(directory)
+    .filter((file) => file.endsWith(".tgz"))
+    .sort()
+    .map((file) => {
+      const local = readNpmArchiveIdentity(join(directory, file));
+      if (local.version !== version) {
+        throw new Error(`${local.name} archive carries ${local.version}, expected ${version}`);
+      }
+      return {
+        label: `${local.name}@${local.version}`,
+        available: async (signal: AbortSignal) =>
+          npmReleaseMatches(
+            local,
+            await publishedNpmRelease(local.name, local.version, PUBLIC_NPM_REGISTRY_URL, signal),
+          ),
+      };
+    });
+}
+
+function distributionFiles(directory: string): string[] {
+  return readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    const path = join(directory, entry.name);
+    if (entry.isDirectory()) return distributionFiles(path);
+    return entry.name.endsWith(".whl") || entry.name.endsWith(".tar.gz") ? [path] : [];
+  });
+}
+
+function pythonDistributionName(file: string, version: string): string {
+  const name = basename(file);
+  const sourceSuffix = `-${version}.tar.gz`;
+  if (name.endsWith(sourceSuffix)) {
+    return name.slice(0, -sourceSuffix.length).replaceAll("_", "-").toLowerCase();
+  }
+  if (name.endsWith(".whl")) {
+    const marker = `-${version}-`;
+    const markerIndex = name.lastIndexOf(marker);
+    if (markerIndex > 0) {
+      return name.slice(0, markerIndex).replaceAll("_", "-").toLowerCase();
+    }
+  }
+  throw new Error(`Python distribution ${name} does not carry release version ${version}`);
+}
+
+function pypiReleaseIdentities(directory: string, version: string): PypiReleaseIdentity[] {
+  const releases = new Map<string, Map<string, string>>();
+  for (const path of distributionFiles(directory)) {
+    const name = pythonDistributionName(path, version);
+    const files = releases.get(name) ?? new Map<string, string>();
+    const filename = basename(path);
+    files.set(filename, createHash("sha256").update(readFileSync(path)).digest("hex"));
+    releases.set(name, files);
+  }
+  return [...releases]
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([name, files]) => ({ files, name, version }));
+}
+
+function pypiPublicationProbes(directory: string, version: string): PublicationProbe[] {
+  return pypiReleaseIdentities(directory, version).map((local) => ({
+    label: `${local.name}==${local.version}`,
+    available: async (signal: AbortSignal) => {
+      const response = await fetch(
+        `${PUBLIC_PYPI_REGISTRY_URL}/${encodeURIComponent(local.name)}/${encodeURIComponent(local.version)}/json`,
+        {
+          headers: { accept: "application/json" },
+          signal,
+        },
+      );
+      if (response.status === 404) return false;
+      if (!response.ok) {
+        throw new Error(
+          `PyPI lookup failed for ${local.name}==${local.version}: ${response.status}`,
+        );
+      }
+      const published = PypiReleaseSchema.parse(await response.json());
+      const publishedFiles = new Map(
+        published.urls.map(({ filename, digests }) => [filename, digests.sha256]),
+      );
+      for (const [filename, digest] of local.files) {
+        const publishedDigest = publishedFiles.get(filename);
+        if (!publishedDigest) return false;
+        if (publishedDigest !== digest) {
+          throw new Error(
+            `PyPI content does not match ${local.name}==${local.version} ${filename}`,
+          );
+        }
+      }
+      return true;
+    },
+  }));
+}
+
+export const VerifyPublicationsOptionsSchema = z
+  .object({
+    version: z.string().trim().min(1).describe("Expected public release version"),
+    npmDirectory: z
+      .string()
+      .trim()
+      .min(1)
+      .optional()
+      .describe("Directory containing released npm archives"),
+    pypiDirectory: z
+      .string()
+      .trim()
+      .min(1)
+      .optional()
+      .describe("Directory containing released Python distributions"),
+    concurrency: z.coerce
+      .number()
+      .int()
+      .positive()
+      .default(DEFAULT_CONCURRENCY)
+      .describe("Maximum concurrent public registry checks"),
+    intervalSeconds: z.coerce
+      .number()
+      .positive()
+      .default(DEFAULT_INTERVAL_SECONDS)
+      .describe("Delay between shared publication checks"),
+    timeoutSeconds: z.coerce
+      .number()
+      .positive()
+      .default(DEFAULT_TIMEOUT_SECONDS)
+      .describe("Maximum time to wait for the complete publication batch"),
+  })
+  .refine((options) => options.npmDirectory || options.pypiDirectory, {
+    message: "At least one publication directory is required",
+  })
+  .describe("Options for the public package availability barrier");
+
+/** Parse expected release artifacts and wait for their public registry records. */
+export async function main(args: readonly string[] = process.argv.slice(2)): Promise<void> {
+  const options = await taskOptions(
+    taskCommand(
+      import.meta.url,
+      "Wait for released packages to become publicly available",
+      VerifyPublicationsOptionsSchema,
+    ),
+    VerifyPublicationsOptionsSchema,
+    args,
+  );
+  const probes = [
+    ...(options.npmDirectory
+      ? npmPublicationProbes(resolve(options.npmDirectory), options.version)
+      : []),
+    ...(options.pypiDirectory
+      ? pypiPublicationProbes(resolve(options.pypiDirectory), options.version)
+      : []),
+  ];
+  await waitForPublications(probes, {
+    concurrency: options.concurrency,
+    intervalMs: options.intervalSeconds * 1_000,
+    timeoutMs: options.timeoutSeconds * 1_000,
+  });
+}
+
+await runTaskMain(import.meta, main);