@jsenv/package-publish 1.11.52 → 1.11.53

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/package-publish",
-  "version": "1.11.52",
+  "version": "1.11.53",
   "type": "module",
   "description": "Publish package to one or many registry.",
   "repository": {
@@ -23,8 +23,8 @@
     "/src/"
   ],
   "dependencies": {
-    "@jsenv/filesystem": "4.15.21",
-    "@jsenv/humanize": "1.8.0",
+    "@jsenv/filesystem": "4.15.22",
+    "@jsenv/humanize": "1.8.1",
     "semver": "7.8.5"
   },
   "devDependencies": {

package/src/internal/publish.js

@@ -4,6 +4,7 @@ import { exec } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { setNpmConfig } from "./set_npm_config.js";
+import { waitForStagedVersionToLand } from "./staged_version.js";
 
 export const publish = async ({
   logger,
@@ -63,8 +64,9 @@ export const publish = async ({
         [computeRegistryKey(packageObject.name)]: registryUrl,
       }),
     );
+    let publishResult;
     try {
-      const publishResult = await new Promise((resolve, reject) => {
+      publishResult = await new Promise((resolve, reject) => {
         const command = exec(
           "npm publish --no-workspaces",
           {
@@ -106,23 +108,10 @@ export const publish = async ({
                   reason: "already-published",
                 });
               } else if (error.message.includes("previously staged version")) {
-                // The registry accepted a tarball for that version (from a run
-                // interrupted before npm confirmed, or one whose PUT it took
-                // without exposing the version yet) and refuses any further
-                // publish of it until it becomes visible. The publish did go
-                // through, so wait for the version to land.
-                resolve(
-                  waitForStagedVersionToLand({
-                    logger,
-                    registryUrl,
-                    packageName: packageObject.name,
-                    packageVersion: packageObject.version,
-                    token,
-                  }).then(() => ({
-                    success: true,
-                    reason: "already-published",
-                  })),
-                );
+                resolve({
+                  success: true,
+                  reason: "staged",
+                });
               }
               // github publish conflict
               else if (
@@ -158,14 +147,28 @@ export const publish = async ({
       });
       if (publishResult.reason === "already-published") {
         publishTask.setRightText(`(already published)`);
+      } else if (publishResult.reason === "staged") {
+        publishTask.setRightText(`(staged)`);
       }
       publishTask.done();
-      return publishResult;
     } finally {
       restoreProcessEnv();
       restorePackageFile();
       restoreNpmConfigFile();
     }
+    if (publishResult.reason === "staged") {
+      await waitForStagedVersionToLand({
+        registryUrl,
+        packageName: packageObject.name,
+        packageVersion: packageObject.version,
+        token,
+      });
+      return {
+        success: true,
+        reason: "already-published",
+      };
+    }
+    return publishResult;
   } catch (e) {
     publishTask.fail();
     console.error(e.stack);
@@ -198,75 +201,3 @@ const computeRegistryKey = (packageName) => {
   }
   return `registry`;
 };
-
-// A version becomes available in two steps: npm stages it, then the registry
-// makes it visible. While it is staged the registry answers 409 to a publish of
-// that same version, and once staged that version can never be published again,
-// so waiting for it is the only way through.
-const STAGED_VERSION_TIMEOUT_MS = 120_000;
-const STAGED_VERSION_POLL_INTERVAL_MS = 5_000;
-
-const waitForStagedVersionToLand = async ({
-  logger,
-  registryUrl,
-  packageName,
-  packageVersion,
-  token,
-}) => {
-  logger.info(
-    `${packageName}@${packageVersion} is staged on ${registryUrl}, waiting for the registry to publish it`,
-  );
-  const msBeforeTimeout = Date.now() + STAGED_VERSION_TIMEOUT_MS;
-  while (true) {
-    const versionIsInRegistry = await checkVersionInRegistry({
-      registryUrl,
-      packageName,
-      packageVersion,
-      token,
-    });
-    if (versionIsInRegistry) {
-      return;
-    }
-    if (Date.now() > msBeforeTimeout) {
-      throw new Error(
-        `${packageName}@${packageVersion} is staged on ${registryUrl} but did not get published. Bump the version, a staged version cannot be published again.`,
-      );
-    }
-    await new Promise((resolve) => {
-      setTimeout(resolve, STAGED_VERSION_POLL_INTERVAL_MS);
-    });
-  }
-};
-
-const checkVersionInRegistry = async ({
-  registryUrl,
-  packageName,
-  packageVersion,
-  token,
-}) => {
-  let response;
-  try {
-    response = await fetch(`${registryUrl}/${packageName}`, {
-      headers: {
-        "accept":
-          "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*",
-        // the registry is served by a cache; without this the version can stay
-        // invisible long after it landed
-        "cache-control": "no-cache",
-        ...(token
-          ? {
-              authorization: `token ${token}`,
-            }
-          : {}),
-      },
-    });
-  } catch {
-    // a network hiccup is one more reason for the version not to be there yet
-    return false;
-  }
-  if (response.status !== 200) {
-    return false;
-  }
-  const packageObject = await response.json();
-  return Boolean(packageObject.versions[packageVersion]);
-};

package/src/internal/staged_version.js

@@ -0,0 +1,142 @@
+/*
+ * A version lands on the registry in two steps: the registry takes the tarball
+ * ("staged"), then it exposes the version. While a version is staged the
+ * registry answers 409 'Cannot publish over previously staged version "x.y.z"'
+ * to any publish of it, so waiting for it to be exposed is the only way through.
+ *
+ * The packument says nothing about a staged version, but its tarball is already
+ * served: that is what tells a staged version apart from one that was never
+ * published.
+ */
+
+import { createTaskLog } from "@jsenv/humanize";
+
+export const VERSION_STATUS = {
+  ABSENT: "absent",
+  STAGED: "staged",
+  PUBLISHED: "published",
+};
+
+const STAGED_VERSION_TIMEOUT_MS = 300_000;
+const STAGED_VERSION_POLL_INTERVAL_MS = 5_000;
+
+export const checkVersionStatusInRegistry = async ({
+  registryUrl,
+  packageName,
+  packageVersion,
+  token,
+}) => {
+  const versionIsInRegistry = await checkVersionIsInRegistry({
+    registryUrl,
+    packageName,
+    packageVersion,
+    token,
+  });
+  if (versionIsInRegistry) {
+    return VERSION_STATUS.PUBLISHED;
+  }
+  const tarballIsInRegistry = await checkTarballIsInRegistry({
+    registryUrl,
+    packageName,
+    packageVersion,
+    token,
+  });
+  if (tarballIsInRegistry) {
+    return VERSION_STATUS.STAGED;
+  }
+  return VERSION_STATUS.ABSENT;
+};
+
+export const waitForStagedVersionToLand = async ({
+  registryUrl,
+  packageName,
+  packageVersion,
+  token,
+}) => {
+  const waitTask = createTaskLog(
+    `wait for ${packageName}@${packageVersion} to be published by ${registryUrl}`,
+  );
+  const msBeforeTimeout = Date.now() + STAGED_VERSION_TIMEOUT_MS;
+  try {
+    while (true) {
+      const versionIsInRegistry = await checkVersionIsInRegistry({
+        registryUrl,
+        packageName,
+        packageVersion,
+        token,
+      });
+      if (versionIsInRegistry) {
+        waitTask.done();
+        return;
+      }
+      if (Date.now() > msBeforeTimeout) {
+        throw new Error(
+          `${packageName}@${packageVersion} is staged on ${registryUrl} but did not get published. Run the publish again to keep waiting; a staged version cannot be published again.`,
+        );
+      }
+      await new Promise((resolve) => {
+        setTimeout(resolve, STAGED_VERSION_POLL_INTERVAL_MS);
+      });
+    }
+  } catch (e) {
+    waitTask.fail();
+    throw e;
+  }
+};
+
+const checkVersionIsInRegistry = async ({
+  registryUrl,
+  packageName,
+  packageVersion,
+  token,
+}) => {
+  const response = await fetchRegistry(`${registryUrl}/${packageName}`, {
+    method: "GET",
+    token,
+  });
+  if (!response || response.status !== 200) {
+    return false;
+  }
+  const packageObject = await response.json();
+  return Boolean(packageObject.versions[packageVersion]);
+};
+
+const checkTarballIsInRegistry = async ({
+  registryUrl,
+  packageName,
+  packageVersion,
+  token,
+}) => {
+  const response = await fetchRegistry(
+    computeTarballUrl({ registryUrl, packageName, packageVersion }),
+    { method: "HEAD", token },
+  );
+  return Boolean(response) && response.status === 200;
+};
+
+const computeTarballUrl = ({ registryUrl, packageName, packageVersion }) => {
+  const packageBasename =
+    packageName[0] === "@"
+      ? packageName.slice(packageName.indexOf("/") + 1)
+      : packageName;
+  return `${registryUrl}/${packageName}/-/${packageBasename}-${packageVersion}.tgz`;
+};
+
+const fetchRegistry = async (url, { method, token }) => {
+  try {
+    return await fetch(url, {
+      method,
+      headers: {
+        "accept":
+          "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*",
+        // the registry is served by a cache; without this a version can stay
+        // invisible long after it landed
+        "cache-control": "no-cache",
+        ...(token ? { authorization: `token ${token}` } : {}),
+      },
+    });
+  } catch {
+    // a network hiccup is one more reason for the version not to be there yet
+    return null;
+  }
+};