@intentius/chant 0.124.34 → 0.124.36

package/src/lifecycle/compose-refs.ts

@@ -0,0 +1,125 @@
+/**
+ * Composed commits (#4168 4.3), as git holds them. A composed release lives
+ * on a pushed `chant/compose/<name>` branch whose commits each cherry-pick
+ * one trunk commit and name it in a `Chant-Composed-From: <sha>` trailer.
+ * The base is the commit the first composed commit was picked onto.
+ *
+ * Kept free of other chant imports, so the ci tick, the cut, the metrics
+ * and the compose command read composed commits the same way.
+ */
+
+import { execFileSync } from "node:child_process";
+
+/** The branch prefix a composed release lives under. */
+export const COMPOSE_BRANCH_PREFIX = "chant/compose/";
+
+/** The trailer naming the trunk commit a composed commit picks. */
+export const COMPOSED_FROM_TRAILER = "Chant-Composed-From";
+
+/** What a composed commit carries: its branch when one is known, its base, and the trunk commits picked onto the base, oldest first. */
+export interface Composition {
+  branch: string | null;
+  base: string;
+  sources: string[];
+}
+
+function tryGit(top: string, args: string[]): string | null {
+  try {
+    return execFileSync("git", args, { cwd: top, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Whether `branch` names a compose branch. */
+export function isComposeBranch(branch: unknown): branch is string {
+  return typeof branch === "string" && branch.startsWith(COMPOSE_BRANCH_PREFIX) && branch.length > COMPOSE_BRANCH_PREFIX.length;
+}
+
+/** The trunk commits one commit's `Chant-Composed-From` trailers name. */
+export function composedFrom(top: string, sha: string): string[] {
+  const out = tryGit(top, ["show", "-s", `--format=%(trailers:key=${COMPOSED_FROM_TRAILER},valueonly,separator=%x00)`, sha]);
+  return (out ?? "")
+    .split("\0")
+    .map((s) => s.trim())
+    .filter((s) => /^[0-9a-f]{40}$/.test(s));
+}
+
+/**
+ * The composition `sha` ends: walk its first parents while each commit
+ * carries a `Chant-Composed-From` trailer. Null when `sha` carries none.
+ */
+export function compositionOf(top: string, sha: string, branch: string | null = null): Composition | null {
+  const sources: string[] = [];
+  let at = sha;
+  for (;;) {
+    const from = composedFrom(top, at);
+    if (from.length === 0) break;
+    sources.unshift(...from);
+    const parent = tryGit(top, ["rev-parse", "--verify", "--quiet", `${at}^1`]);
+    if (!parent) break;
+    at = parent;
+  }
+  if (sources.length === 0) return null;
+  return { branch, base: at, sources };
+}
+
+/** The compose branches this clone knows on `remote`, as `{ branch, ref }`, by name. */
+export function remoteComposeBranches(top: string, remote = "origin"): Array<{ branch: string; ref: string }> {
+  const prefix = `refs/remotes/${remote}/`;
+  const out = tryGit(top, ["for-each-ref", "--format=%(refname)", `${prefix}${COMPOSE_BRANCH_PREFIX}`]);
+  return (out ?? "")
+    .split("\n")
+    .filter(Boolean)
+    .map((ref) => ({ branch: ref.slice(prefix.length), ref }))
+    .sort((a, b) => (a.branch < b.branch ? -1 : 1));
+}
+
+/**
+ * What a commit of a compose branch carries beyond trunk: walk its first
+ * parents back to the first commit `trunkRef` reaches, which is the base,
+ * collecting the `Chant-Composed-From` trailers on the way. A commit a
+ * person made on the branch, such as a resolved conflict, carries none and
+ * is walked past. Null when `sha` is on trunk or no trunk commit is found.
+ */
+export function compositionOnTrunk(top: string, sha: string, trunkRef: string, branch: string | null = null): Composition | null {
+  const onTrunk = (c: string) => tryGit(top, ["merge-base", "--is-ancestor", c, trunkRef]) !== null;
+  if (onTrunk(sha)) return null;
+  const sources: string[] = [];
+  let at: string | null = sha;
+  while (at && !onTrunk(at)) {
+    sources.unshift(...composedFrom(top, at));
+    at = tryGit(top, ["rev-parse", "--verify", "--quiet", `${at}^1`]);
+  }
+  return at ? { branch, base: at, sources } : null;
+}
+
+/** The pushed compose branch `sha` is a first-parent commit of, as this clone last fetched it, or null. */
+export function composeBranchContaining(top: string, sha: string, remote = "origin"): { branch: string; ref: string } | null {
+  for (const b of remoteComposeBranches(top, remote)) {
+    const line = tryGit(top, ["rev-list", "--first-parent", b.ref]);
+    if (line?.split("\n").includes(sha)) return b;
+  }
+  return null;
+}
+
+/** The composed commits on the pushed compose branches that pick `trunkSha`. */
+export function composedIncluding(top: string, trunkSha: string, remote = "origin"): Array<{ branch: string; commit: string }> {
+  const out: Array<{ branch: string; commit: string }> = [];
+  for (const b of remoteComposeBranches(top, remote)) {
+    const tip = tryGit(top, ["rev-parse", "--verify", "--quiet", `${b.ref}^{commit}`]);
+    if (!tip) continue;
+    const composition = compositionOf(top, tip, b.branch);
+    if (!composition?.sources.includes(trunkSha)) continue;
+    // The composed commit that picked it: walk the composed commits for its trailer.
+    let at: string | null = tip;
+    while (at && at !== composition.base) {
+      if (composedFrom(top, at).includes(trunkSha)) {
+        out.push({ branch: b.branch, commit: at });
+        break;
+      }
+      at = tryGit(top, ["rev-parse", "--verify", "--quiet", `${at}^1`]);
+    }
+  }
+  return out;
+}

package/src/lifecycle/deep-observe.test.ts

@@ -108,6 +108,26 @@ describe("diffDeepObservation", () => {
     expect(result.unchanged).toEqual(["r"]);
   });
 
+  test("prepare rewrites each raw tree, both sides, before paths are taken (#4231)", () => {
+    const seen: string[] = [];
+    const rekey: DeepNormalizationHooks = {
+      prepare(tree, { side }) {
+        seen.push(side);
+        const ids = tree.ids as Record<string, unknown> | undefined;
+        if (!ids) return tree;
+        return { ...tree, ids: Object.fromEntries(Object.entries(ids).map(([k, v]) => [k.toLowerCase(), v])) };
+      },
+    };
+    const result = diffDeepObservation(
+      entities({ r: { entityType: "T", props: { ids: { "A/B": {} } } } }),
+      { resources: { r: { type: "T", properties: { ids: { "a/b": {} } } } }, unobserved: {} },
+      rekey,
+    );
+    expect(seen.sort()).toEqual(["declared", "live"]);
+    expect(result.drifted).toEqual([]);
+    expect(result.unchanged).toEqual(["r"]);
+  });
+
   test("a declared property at its default is still compared", () => {
     const result = diffDeepObservation(
       entities({ r: { entityType: "AWS::IAM::Role", props: { Path: "/" } } }),

package/src/lifecycle/deep-observe.ts

@@ -139,8 +139,10 @@ export function diffDeepObservation(
 
   for (const [name, entity] of entities) {
     const liveEntity = live.resources[name];
-    const declaredRaw = entity.props ?? {};
-    const liveRaw = liveEntity?.properties ?? {};
+    const prepare = (tree: Record<string, unknown>, side: "declared" | "live") =>
+      hooks?.prepare ? hooks.prepare(tree, { entityType: entity.entityType, side }) : tree;
+    const declaredRaw = prepare(entity.props ?? {}, "declared");
+    const liveRaw = prepare(liveEntity?.properties ?? {}, "live");
     const declaredPaths = deepPathSet(declaredRaw);
     const livePaths = deepPathSet(liveRaw);
 

package/src/lifecycle/green-apply.ts

@@ -0,0 +1,71 @@
+/**
+ * Applied-green records (#4168 step 9): the green commit apply on merge last
+ * applied to an environment, kept on `chant/lifecycle` so the next apply
+ * measures its change from there.
+ *
+ *   _green-applies/<env>.json    one record per environment, rewritten by each apply that finishes
+ *
+ * Apply on merge applies green commits, not each merge. `pr-apply --green`
+ * plans at the green commit, measured from the one recorded here, and writes
+ * this record once everything applied. A workspace member's record sits under
+ * `_members/<member>/_green-applies/` through the same `ledgerDir` prefix the
+ * merge records use.
+ */
+
+import { sortedJsonReplacer } from "../utils";
+import { ledgerDir, readBlobFromPath, readPathSha, RefCASConflictError, writeLedgerFiles, type LedgerLocation } from "./git";
+
+/** The directory on `chant/lifecycle` that holds applied-green records. */
+export const GREEN_APPLIES_DIR = "_green-applies";
+
+export const GREEN_APPLY_CONTRACT = 1;
+
+export interface GreenApplyRecord {
+  contract: number;
+  env: string;
+  member?: string;
+  /** The green commit applied. */
+  commit: string;
+  /** The commit the change was measured from: the green commit applied before, or the first apply's base. */
+  base: string;
+  /** The change set's digest. */
+  digest: string;
+  /** `merges` when the merged changes' approvals covered the plan, `gate` when the combined plan was approved at its own gate. */
+  approval: "merges" | "gate";
+  approvedBy: string[];
+  /** The first-parent commits from `base` (exclusive) to `commit`, oldest first. */
+  merges: string[];
+  appliedAt: string;
+}
+
+function recordFile(env: string): string {
+  return `${env}.json`;
+}
+
+/** The last green commit applied to `env`, or null when none is recorded. Reads the local `chant/lifecycle` and never fetches. */
+export async function readGreenApply(env: string, opts?: LedgerLocation): Promise<GreenApplyRecord | null> {
+  const text = await readBlobFromPath(GREEN_APPLIES_DIR, recordFile(env), opts);
+  if (text === null) return null;
+  try {
+    const doc = JSON.parse(text) as GreenApplyRecord;
+    return doc?.contract === GREEN_APPLY_CONTRACT && typeof doc.commit === "string" ? doc : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Write `record` for its environment. Does not push: call `pushLifecycleReport` (./git.ts) after. */
+export async function writeGreenApply(record: GreenApplyRecord, opts?: LedgerLocation): Promise<string> {
+  const file = recordFile(record.env);
+  const content = `${JSON.stringify(record, sortedJsonReplacer)}\n`;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const prior = await readPathSha(GREEN_APPLIES_DIR, file, opts);
+    const dir = await ledgerDir(GREEN_APPLIES_DIR, opts);
+    try {
+      return await writeLedgerFiles([{ path: `${dir}/${file}`, content, expectPriorSha: prior }], `Applied green ${record.commit} to ${record.env}`, opts);
+    } catch (err) {
+      if (!(err instanceof RefCASConflictError)) throw err;
+    }
+  }
+  throw new Error(`could not write the applied-green record for ${record.env}: chant/lifecycle kept moving`);
+}

package/src/lifecycle/publish-declaration.ts

@@ -45,6 +45,27 @@ export const NpmPublishSchema = z
      * `sbom.cyclonedx.json` it holds. `false` publishes without one.
      */
     sbom: sbomField.optional(),
+    /**
+     * `false` publishes each package straight to the reveal tag (`latest`
+     * unless the publish names another), with no `next` stage and no
+     * `npm dist-tag` move (#4040). For credentials that may publish but not
+     * move a dist-tag, such as npm trusted publishing without "Allow npm
+     * dist-tag" on the package's record (#3904). Default `true`.
+     */
+    stage: z.boolean().optional(),
+    /**
+     * A variable holding an npm token to retry with when a package's publish
+     * fails to authenticate (#4040), as chant's own publish-packages.sh does:
+     * a package whose trusted-publisher record is broken publishes with the
+     * token rather than failing the release. Unset or empty, there is no retry.
+     */
+    tokenEnv: envName.optional(),
+    /**
+     * Seconds the reveal waits for the registry to serve every version it
+     * published before installing them to audit (#4244). A registry accepts a
+     * publish before it serves it. Default 600.
+     */
+    registryWait: z.number().int().min(0).optional(),
   })
   .strict();
 

package/src/lifecycle/publish-npm.ts

@@ -42,10 +42,13 @@
  * npm makes the first version of a new package `latest` whatever tag it is
  * published under, so a package's first release is visible when it stages.
  *
- * Credentials are npm's own. chant reads no npm token and writes no `.npmrc`:
- * npm authenticates with the registry's `_authToken` in the user's or the
- * CI's npm config (`actions/setup-node` writes one that reads
- * `NODE_AUTH_TOKEN`), or by trusted publishing. npm runs with the run's
+ * Credentials are npm's own: npm authenticates with the registry's
+ * `_authToken` in the user's or the CI's npm config (`actions/setup-node`
+ * writes one that reads `NODE_AUTH_TOKEN`), or by trusted publishing. The one
+ * exception is `tokenEnv` (#4040): when a publish fails to authenticate, the
+ * package is published again with that variable's token in a throwaway npm
+ * user config, never on the command line, and without `--provenance` if the
+ * registry refuses the attestation on the token path. npm runs with the run's
  * environment, and everything it prints is redacted before chant prints it.
  */
 
@@ -58,6 +61,9 @@ import type { NpmPublishDeclaration } from "./publish-declaration";
 import { checkReleaseDigest, fileDigest, isDir, memberFile, publishTargetKey } from "./publish-targets";
 import { NPM_STAGE_TAG, PublishTargetError, type PublishContext, type PublishDeps, type PublishItem, type PublishTarget } from "./release-publish";
 
+/** npm's output when a publish could not authenticate, as publish-packages.sh matches it. */
+const NPM_AUTH_FAILED = /ENEEDAUTH|E401|need auth/;
+
 interface NpmPackage {
   path: string;
   abs: string;
@@ -133,9 +139,9 @@ export function npmAuditSignaturesArgs(decl: Pick<NpmPublishDeclaration, "regist
   return ["audit", "signatures", ...(decl.registry ? ["--registry", decl.registry] : [])];
 }
 
-function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx.cwd): Promise<{ code: number; output: string[] }> {
+function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx.cwd, env: NodeJS.ProcessEnv = ctx.env): Promise<{ code: number; output: string[] }> {
   return new Promise((resolvePromise, reject) => {
-    const child = spawn(bin, args, { cwd, env: ctx.env, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn(bin, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
     const output: string[] = [];
     let partial = { out: "", err: "" };
     const take = (key: "out" | "err") => (chunk: Buffer) => {
@@ -154,14 +160,26 @@ function run(bin: string, args: string[], ctx: PublishContext, cwd: string = ctx
   });
 }
 
+/** Seconds the reveal waits for the registry to serve what it published, by default (#4244). */
+export const NPM_REGISTRY_WAIT_SECONDS = 600;
+/** Between polls of the registry while it waits. */
+export const NPM_REGISTRY_POLL_MS = 10_000;
+/** npm's errors for a version the registry does not serve yet. */
+const NPM_NOT_SERVED = /\b(ETARGET|ERESOLVE|notarget)\b|No matching version found/;
+
 export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): PublishTarget {
   const bin = deps.npm ?? "npm";
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
   const registry = decl.registry ?? "the registry npm's config names";
   const shown = (tag: string) => `${registry}, dist-tag ${tag}`;
   const revealTag = (ctx: PublishContext) => ctx.tag ?? "latest";
-  const npm = async (ctx: PublishContext, args: string[], cwd?: string): Promise<{ code: number; output: string[] }> => {
+  // Under `stage: false` a package goes straight to the reveal tag, and the reveal moves no tag (#4040).
+  const staging = decl.stage !== false;
+  const stageTag = (ctx: PublishContext) => (staging ? NPM_STAGE_TAG : revealTag(ctx));
+  const npm = async (ctx: PublishContext, args: string[], cwd?: string, env?: NodeJS.ProcessEnv): Promise<{ code: number; output: string[] }> => {
     try {
-      return await run(bin, args, ctx, cwd);
+      return await run(bin, args, ctx, cwd, env);
     } catch (err) {
       throw new PublishTargetError("publish-npm-failed", ctx.redactor.redact(`npm could not be run: ${err instanceof Error ? err.message : String(err)}`), "Install npm, or put it on PATH.");
     }
@@ -171,24 +189,86 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
     const r = await npm(ctx, ["view", `${pkg.name}@${pkg.version}`, "version", ...(decl.registry ? ["--registry", decl.registry] : [])]);
     return r.code === 0 && r.output.some((l) => l.trim() === pkg.version || l.trim() === JSON.stringify(pkg.version));
   };
+  /**
+   * The `tokenEnv` retry (#4040): a publish that failed to authenticate runs
+   * again with the token in a throwaway user config, and once more without
+   * `--provenance` when the token path refuses the attestation.
+   */
+  const withToken = async (ctx: PublishContext, pkg: NpmPackage, args: string[], failed: { code: number; output: string[] }) => {
+    const token = decl.tokenEnv ? ctx.env[decl.tokenEnv] : undefined;
+    if (!token || !failed.output.some((l) => NPM_AUTH_FAILED.test(l))) return failed;
+    ctx.log(`${pkg.name}@${pkg.version} could not authenticate; publishing again with ${decl.tokenEnv}`);
+    const dir = mkdtempSync(join(tmpdir(), "chant-npm-token-"));
+    try {
+      const userconfig = join(dir, ".npmrc");
+      const host = (decl.registry ?? "https://registry.npmjs.org/").replace(/^https?:/, "").replace(/\/?$/, "/");
+      writeFileSync(userconfig, `${host}:_authToken=${token}\n`, { mode: 0o600 });
+      const env = { ...ctx.env, NPM_CONFIG_USERCONFIG: userconfig };
+      let result = await npm(ctx, args, undefined, env);
+      for (const line of result.output) ctx.log(`  ${line}`);
+      if (result.code !== 0 && args.includes("--provenance") && result.output.some((l) => /^npm (error|ERR!).*(provenance|attestation)/i.test(l))) {
+        ctx.log(`${pkg.name}@${pkg.version}: the registry refused provenance on the token path; publishing without an attestation`);
+        result = await npm(ctx, args.filter((a) => a !== "--provenance"), undefined, env);
+        for (const line of result.output) ctx.log(`  ${line}`);
+      }
+      return result;
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  };
   const read = (ctx: PublishContext) => decl.packages.map((p) => readPackage(ctx, p, decl.sbom));
   const extra = (pkg: NpmPackage) => ({ ...(pkg.digest ? { digest: pkg.digest } : {}), ...(pkg.sbom ? { sbom: pkg.sbom } : {}) });
   const plan = async (ctx: PublishContext): Promise<PublishItem[]> =>
-    read(ctx).map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: `${shown(NPM_STAGE_TAG)}, then ${revealTag(ctx)}`, ...extra(pkg) }));
+    read(ctx).map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: staging ? `${shown(NPM_STAGE_TAG)}, then ${revealTag(ctx)}` : shown(revealTag(ctx)), ...extra(pkg) }));
   /**
    * In CI, install what was published into an empty directory and run
    * `npm audit signatures` there (#4049), which checks each package's
    * registry signature and provenance attestation.
    */
+  /**
+   * Wait until the registry serves every version (#4244): npm accepts a
+   * publish minutes before `npm view` and `npm install` find it, so an
+   * install straight after fails with ETARGET or ERESOLVE.
+   */
+  const served = async (ctx: PublishContext, pkgs: NpmPackage[]): Promise<void> => {
+    const wait = (decl.registryWait ?? NPM_REGISTRY_WAIT_SECONDS) * 1000;
+    const start = now();
+    let missing = pkgs;
+    for (;;) {
+      const still: NpmPackage[] = [];
+      for (const pkg of missing) if (!(await onRegistry(ctx, pkg))) still.push(pkg);
+      missing = still;
+      if (missing.length === 0) return;
+      const names = missing.map((p) => `${p.name}@${p.version}`).join(", ");
+      if (now() - start >= wait) {
+        throw new PublishTargetError(
+          "publish-npm-not-served",
+          `the registry did not serve ${names} within ${Math.round(wait / 1000)}s of the publish, so nothing was audited`,
+          "Each package was published. Once npm serves them, run the publish again: it publishes nothing twice and audits again. `registryWait` sets the wait.",
+        );
+      }
+      ctx.log(`waiting for the registry to serve ${names}`);
+      await sleep(NPM_REGISTRY_POLL_MS);
+    }
+  };
   const audit = async (ctx: PublishContext, pkgs: NpmPackage[]): Promise<void> => {
+    await served(ctx, pkgs);
     const dir = mkdtempSync(join(tmpdir(), "chant-npm-audit-"));
     try {
       const dependencies = Object.fromEntries(pkgs.map((p) => [p.name, p.version]));
       writeFileSync(join(dir, "package.json"), `${JSON.stringify({ name: "chant-publish-audit", version: "0.0.0", private: true, dependencies }, null, 2)}\n`);
       for (const args of [npmAuditInstallArgs(decl), npmAuditSignaturesArgs(decl)]) {
         ctx.log(`npm ${args.join(" ")}`);
-        const result = await npm(ctx, args, dir);
+        let result = await npm(ctx, args, dir);
         for (const line of result.output) ctx.log(`  ${line}`);
+        // `npm view` can answer before every mirror `npm install` reads does: wait once more, then install again.
+        if (result.code !== 0 && args[0] === "install" && result.output.some((l) => NPM_NOT_SERVED.test(l))) {
+          ctx.log("the registry does not serve every version to an install yet; waiting, then installing again");
+          await sleep(NPM_REGISTRY_POLL_MS);
+          await served(ctx, pkgs);
+          result = await npm(ctx, args, dir);
+          for (const line of result.output) ctx.log(`  ${line}`);
+        }
         if (result.code !== 0) {
           throw new PublishTargetError(
             "publish-npm-audit-failed",
@@ -212,21 +292,22 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
       const pkgs = read(ctx);
       const items: PublishItem[] = [];
       for (const pkg of pkgs) {
-        const item: PublishItem = { name: `${pkg.name}@${pkg.version}`, destination: shown(NPM_STAGE_TAG), ...extra(pkg) };
+        const item: PublishItem = { name: `${pkg.name}@${pkg.version}`, destination: shown(stageTag(ctx)), ...extra(pkg) };
         if (await onRegistry(ctx, pkg)) {
           ctx.log(`${item.name} is already on the registry; not published again`);
           items.push({ ...item, present: true });
           continue;
         }
-        const args = npmPublishArgs(decl, pkg.abs, ctx);
+        const args = npmPublishArgs(decl, pkg.abs, ctx, stageTag(ctx));
         ctx.log(`npm publish ${pkg.path} ${args.slice(2).join(" ")}`);
-        const result = await npm(ctx, args);
+        let result = await npm(ctx, args);
         for (const line of result.output) ctx.log(`  ${line}`);
+        if (result.code !== 0) result = await withToken(ctx, pkg, args, result);
         if (result.code !== 0) {
           const done = items.map((i) => i.name);
           throw new PublishTargetError(
             "publish-npm-failed",
-            `npm publish of ${item.name} exited ${result.code}${done.length > 0 ? `, after ${done.join(", ")} were staged under ${NPM_STAGE_TAG}` : ", before any package was staged"}: ${result.output.at(-1) ?? "npm printed nothing"}`,
+            `npm publish of ${item.name} exited ${result.code}${done.length > 0 ? `, after ${done.join(", ")} were ${staging ? "staged" : "published"} under ${stageTag(ctx)}` : `, before any package was ${staging ? "staged" : "published"}`}: ${result.output.at(-1) ?? "npm printed nothing"}`,
           );
         }
         items.push(item);
@@ -237,6 +318,11 @@ export function npmTarget(decl: NpmPublishDeclaration, deps: PublishDeps): Publi
       const tag = revealTag(ctx);
       const pkgs = read(ctx);
       const items: PublishItem[] = [];
+      if (!staging) {
+        // Already under the reveal tag since the stage; only the audit is left.
+        if (ctx.provenance.oidc) await audit(ctx, pkgs);
+        return { target: this.name, destination: this.destination, items: pkgs.map((pkg) => ({ name: `${pkg.name}@${pkg.version}`, destination: shown(tag), ...extra(pkg) })) };
+      }
       // The declared order: the first package is the set's core, and its tag moves first.
       for (const pkg of pkgs) {
         const args = npmDistTagArgs(decl, pkg.name, pkg.version, tag);

package/src/lifecycle/publish-targets.test.ts

@@ -136,6 +136,10 @@ describe("npm", () => {
       ["dist-tag", "add", "@acme/core@1.4.0", "latest"],
       ["dist-tag", "add", "@acme/cli@1.4.0", "latest"],
       ["dist-tag", "add", "@acme/kit@1.4.0", "latest"],
+      // #4244: it first asks the registry for each version it published.
+      ["view", "@acme/core@1.4.0", "version"],
+      ["view", "@acme/cli@1.4.0", "version"],
+      ["view", "@acme/kit@1.4.0", "version"],
       // #4049: with an OIDC token, what was published is installed in an empty directory and its signatures audited.
       ["install", "--ignore-scripts", "--no-audit", "--no-fund"],
       ["audit", "signatures"],
@@ -166,6 +170,51 @@ describe("npm", () => {
     expect(readFakeNpmRegistry(log).packages["@acme/kit"]!.distTags).toEqual({ latest: "1.3.0", next: "1.4.0", beta: "1.4.0" });
   });
 
+  test("stage: false publishes each package straight to latest in the order declared and moves no dist-tag (#4040)", async () => {
+    const { dir, npm, log } = setup();
+    const [target] = await createPublishTargets([decl({ type: "npm", packages: ["packages/core", "kit.tgz"], access: "public", stage: false })], { npm });
+    const ctx = context(dir, { env: { PATH: process.env.PATH }, provenance: OIDC });
+    expect((await target!.plan(ctx))[0]!.destination).toBe("the registry npm's config names, dist-tag latest");
+    const staged = await target!.stage(ctx);
+    expect(latest(log)).toEqual({ "@acme/core": "1.4.0", "@acme/cli": "1.3.0", "@acme/kit": "1.4.0" });
+    const before = calls(log).length;
+    const done = await target!.reveal(ctx, staged);
+    expect(calls(log).filter((c) => c.args[0] === "publish").map((c) => c.args)).toEqual([
+      ["publish", join(dir, "packages/core"), "--tag", "latest", "--access", "public", "--provenance"],
+      ["publish", join(dir, "kit.tgz"), "--tag", "latest", "--access", "public", "--provenance"],
+    ]);
+    // The reveal only audits, once the registry serves both (#4244).
+    expect(calls(log).slice(before).map((c) => c.args[0])).toEqual(["view", "view", "install", "audit"]);
+    expect(done.items.map((i) => i.destination)).toEqual(Array(2).fill("the registry npm's config names, dist-tag latest"));
+    expect(readFakeNpmRegistry(log).packages["@acme/core"]!.distTags.next).toBeUndefined();
+  });
+
+  test("tokenEnv: a package that can't authenticate publishes again with the token from a throwaway user config, then without provenance if the token path refuses it (#4040)", async () => {
+    const { dir, npm, log } = setup();
+    const [target] = await createPublishTargets([decl({ type: "npm", packages: ["packages/core", "kit.tgz"], stage: false, tokenEnv: "NPM_TOKEN" })], { npm });
+    const env = { PATH: process.env.PATH, NPM_TOKEN: "npm_fallback99", FAKE_NPM_NEEDAUTH: "kit.tgz", FAKE_NPM_TOKEN_NO_PROVENANCE: "1" };
+    const ctx = context(dir, { env, provenance: OIDC });
+    await target!.stage(ctx);
+    const publishes = calls(log).filter((c) => c.args[0] === "publish") as Array<{ args: string[]; userconfig?: string }>;
+    expect(publishes.map((c) => [c.args[1], c.args.includes("--provenance"), Boolean(c.userconfig)])).toEqual([
+      [join(dir, "packages/core"), true, false],
+      [join(dir, "kit.tgz"), true, false],
+      [join(dir, "kit.tgz"), true, true],
+      [join(dir, "kit.tgz"), false, true],
+    ]);
+    expect(publishes[2]!.userconfig).toBe("//registry.npmjs.org/:_authToken=npm_fallback99\n");
+    expect(latest(log)["@acme/kit"]).toBe("1.4.0");
+    expect(ctx.lines.join("\n")).not.toContain("npm_fallback99");
+  });
+
+  test("tokenEnv: with the variable unset, or a failure that is not authentication, there is no retry", async () => {
+    const { dir, npm, log } = setup();
+    const [target] = await createPublishTargets([decl({ type: "npm", packages: ["kit.tgz"], stage: false, tokenEnv: "NPM_TOKEN" })], { npm });
+    await expect(target!.stage(context(dir, { env: { PATH: process.env.PATH, FAKE_NPM_NEEDAUTH: "kit.tgz" } }))).rejects.toThrow(/exited 1/);
+    await expect(target!.stage(context(dir, { env: { PATH: process.env.PATH, NPM_TOKEN: "t", FAKE_NPM_FAIL: "kit.tgz" } }))).rejects.toThrow(/403/);
+    expect(calls(log).filter((c) => c.args[0] === "publish")).toHaveLength(2);
+  });
+
   test("a stage that failed part way names what it staged and, run again, publishes only the rest; a tag move that fails names what moved", async () => {
     const { dir, npm, log } = setup();
     const [target] = await createPublishTargets([decl({ type: "npm", packages: ["packages/core", "packages/cli", "packages/kit"] })], { npm });
@@ -436,6 +485,65 @@ describe("SBOMs and provenance (#4049)", () => {
     expect(readFileSync(log, "utf-8")).toContain(`"args":["audit","signatures"]`);
   });
 
+  describe("npm: the reveal waits for the registry to serve what it published (#4244)", () => {
+    function lagged(env: Record<string, string>, registryWait?: number) {
+      const dir = temp();
+      writePackage(join(dir, "core"), "@acme/core", "1.0.0");
+      writePackage(join(dir, "cli"), "@acme/cli", "1.0.0");
+      const log = join(dir, "npm.log");
+      const npm = writeFakeNpm(join(dir, "bin"), log);
+      let clock = 0;
+      const sleeps: number[] = [];
+      const deps = { npm, now: () => clock, sleep: async (ms: number) => { sleeps.push(ms); clock += ms; } };
+      const ctx = context(dir, { env: { PATH: process.env.PATH, ...env }, provenance: OIDC });
+      const d = decl({ type: "npm", packages: ["core", "cli"], stage: false, ...(registryWait !== undefined ? { registryWait } : {}) });
+      return { log, deps, ctx, d, sleeps };
+    }
+    const installs = (log: string) => readFileSync(log, "utf-8").split("\n").filter((l) => l.includes(`"args":["install"`)).length;
+
+    test("every version served at once: no wait, one install", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({});
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(sleeps).toEqual([]);
+      expect(installs(log)).toBe(1);
+    });
+
+    test("one version served late: it waits, names it, then installs once", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_LAG: "@acme/cli=2" });
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(sleeps).toEqual([10_000, 10_000]);
+      expect(ctx.lines).toContain("waiting for the registry to serve @acme/cli@1.0.0");
+      expect(installs(log)).toBe(1);
+    });
+
+    test("a version never served: the wait ends with an error naming it, before any install", async () => {
+      const { log, deps, ctx, d } = lagged({ FAKE_NPM_LAG: "@acme/core=1000" }, 30);
+      const [target] = await createPublishTargets([d], deps);
+      const err = await refused(target!.reveal(ctx, await target!.stage(ctx)));
+      expect(err.code).toBe("publish-npm-not-served");
+      expect(err.message).toBe("the registry did not serve @acme/core@1.0.0 within 30s of the publish, so nothing was audited");
+      expect(installs(log)).toBe(0);
+    });
+
+    test("an install that fails with ETARGET waits and installs once more", async () => {
+      const { log, deps, ctx, d, sleeps } = lagged({ FAKE_NPM_INSTALL_ETARGET: "1" });
+      const [target] = await createPublishTargets([d], deps);
+      await target!.reveal(ctx, await target!.stage(ctx));
+      expect(installs(log)).toBe(2);
+      expect(sleeps).toEqual([10_000]);
+    });
+
+    test("a second ETARGET is the audit's failure, not a third install", async () => {
+      const { log, deps, ctx, d } = lagged({ FAKE_NPM_INSTALL_ETARGET: "2" });
+      const [target] = await createPublishTargets([d], deps);
+      const err = await refused(target!.reveal(ctx, await target!.stage(ctx)));
+      expect(err.code).toBe("publish-npm-audit-failed");
+      expect(installs(log)).toBe(2);
+    });
+  });
+
   test("OCI: the provenance statement carries the cut's signature, says a workstation's provenance is the signature, and is the same bytes every run; a declared SBOM is pushed as it is", async () => {
     const reg = await startFakeRegistry({ username: "robot", password: "pw-attach", token: "tok-attach" });
     try {