@jsenv/package-publish 1.11.58 → 1.12.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/package-publish",
-  "version": "1.11.58",
+  "version": "1.12.0",
   "type": "module",
   "description": "Publish package to one or many registry.",
   "repository": {
@@ -23,8 +23,8 @@
     "/src/"
   ],
   "dependencies": {
-    "@jsenv/filesystem": "4.15.27",
-    "@jsenv/humanize": "1.8.5",
+    "@jsenv/filesystem": "4.15.28",
+    "@jsenv/humanize": "1.8.6",
     "semver": "7.8.5"
   },
   "devDependencies": {

package/src/internal/publish.js

@@ -4,7 +4,6 @@ import { exec } from "node:child_process";
 import { readFileSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { setNpmConfig } from "./set_npm_config.js";
-import { waitForStagedVersionToLand } from "./staged_version.js";
 
 export const publish = async ({
   logger,
@@ -16,12 +15,16 @@ export const publish = async ({
 }) => {
   const publishTask = createTaskLog(`publish ${packageSlug} on ${registryUrl}`);
   try {
-    // process.env.NODE_AUTH_TOKEN
-    const previousValue = process.env.NODE_AUTH_TOKEN;
-    const restoreProcessEnv = () => {
-      process.env.NODE_AUTH_TOKEN = previousValue;
-    };
-    process.env.NODE_AUTH_TOKEN = token;
+    // without a token npm authenticates by itself, for instance through
+    // trusted publishing (OIDC) in a GitHub workflow
+    let restoreProcessEnv = () => {};
+    if (token) {
+      const previousValue = process.env.NODE_AUTH_TOKEN;
+      restoreProcessEnv = () => {
+        process.env.NODE_AUTH_TOKEN = previousValue;
+      };
+      process.env.NODE_AUTH_TOKEN = token;
+    }
     // updating package.json to publish on the correct registry
     let restorePackageFile = () => {};
     const rootPackageFileUrl = new URL("./package.json", rootDirectoryUrl);
@@ -41,7 +44,7 @@ export const publish = async ({
         JSON.stringify(packageObject, null, "  "),
       );
     }
-    // updating .npmrc to add the token
+    // updating .npmrc to add the registry (and the token when there is one)
     const npmConfigFileUrl = new URL("./.npmrc", rootDirectoryUrl);
     let restoreNpmConfigFile;
     let npmConfigFileContent;
@@ -60,7 +63,7 @@ export const publish = async ({
     writeFileSync(
       npmConfigFileUrl,
       setNpmConfig(npmConfigFileContent, {
-        [computeRegistryTokenKey(registryUrl)]: token,
+        ...(token ? { [computeRegistryTokenKey(registryUrl)]: token } : {}),
         [computeRegistryKey(packageObject.name)]: registryUrl,
       }),
     );
@@ -108,6 +111,9 @@ export const publish = async ({
                   reason: "already-published",
                 });
               } else if (error.message.includes("previously staged version")) {
+                // an earlier publish of this version was accepted and the
+                // registry holds it (see version_in_registry.js): it exposes
+                // it later by itself, nothing more can be done from here
                 resolve({
                   success: true,
                   reason: "staged",
@@ -145,29 +151,21 @@ export const publish = async ({
           });
         }
       });
-      if (publishResult.reason === "already-published") {
-        publishTask.setRightText(`(already published)`);
-      } else if (publishResult.reason === "staged") {
-        publishTask.setRightText(`(staged)`);
+      if (publishResult.reason === "staged") {
+        publishTask.happen(
+          `${packageSlug} is staged on ${registryUrl}, an earlier publish handed it over and the registry exposes it later`,
+        );
+      } else {
+        if (publishResult.reason === "already-published") {
+          publishTask.setRightText(`(already published)`);
+        }
+        publishTask.done();
       }
-      publishTask.done();
     } finally {
       restoreProcessEnv();
       restorePackageFile();
       restoreNpmConfigFile();
     }
-    if (publishResult.reason === "staged") {
-      await waitForStagedVersionToLand({
-        registryUrl,
-        packageName: packageObject.name,
-        packageVersion: packageObject.version,
-        token,
-      });
-      return {
-        success: true,
-        reason: "already-published",
-      };
-    }
     return publishResult;
   } catch (e) {
     publishTask.fail();

package/src/internal/version_in_registry.js

@@ -0,0 +1,78 @@
+/*
+ * Whether the registry exposes a version, and waiting until it does.
+ *
+ * A version the registry accepted is not exposed right away: npm holds it
+ * ("staged") for minutes, sometimes hours. Nothing read from the registry tells
+ * a staged version apart from one that was never published, the packument
+ * ignores it and its tarball is a 404.
+ */
+
+import { createTaskLog } from "@jsenv/humanize";
+
+const POLL_INTERVAL_MS = 5_000;
+
+export const waitForVersionInRegistry = async ({
+  registryUrl,
+  packageName,
+  packageVersion,
+  token,
+  timeout,
+  timeoutErrorMessage,
+}) => {
+  const waitTask = createTaskLog(
+    `wait for ${packageName}@${packageVersion} to be published by ${registryUrl}`,
+  );
+  const msBeforeTimeout = Date.now() + timeout;
+  try {
+    while (true) {
+      const versionIsInRegistry = await checkVersionIsInRegistry({
+        registryUrl,
+        packageName,
+        packageVersion,
+        token,
+      });
+      if (versionIsInRegistry) {
+        waitTask.done();
+        return;
+      }
+      if (Date.now() > msBeforeTimeout) {
+        throw new Error(timeoutErrorMessage);
+      }
+      await new Promise((resolve) => {
+        setTimeout(resolve, POLL_INTERVAL_MS);
+      });
+    }
+  } catch (e) {
+    waitTask.fail();
+    throw e;
+  }
+};
+
+export const checkVersionIsInRegistry = async ({
+  registryUrl,
+  packageName,
+  packageVersion,
+  token,
+}) => {
+  let response;
+  try {
+    response = await fetch(`${registryUrl}/${packageName}`, {
+      headers: {
+        "accept":
+          "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*",
+        // the registry is served by a cache; without this a version can stay
+        // invisible long after it landed
+        "cache-control": "no-cache",
+        ...(token ? { authorization: `token ${token}` } : {}),
+      },
+    });
+  } catch {
+    // a network hiccup is one more reason for the version not to be there yet
+    return false;
+  }
+  if (response.status !== 200) {
+    return false;
+  }
+  const packageObject = await response.json();
+  return Boolean(packageObject.versions[packageVersion]);
+};

package/src/internal/staged_version.js

@@ -1,142 +0,0 @@
-/*
- * A version lands on the registry in two steps: the registry takes the tarball
- * ("staged"), then it exposes the version. While a version is staged the
- * registry answers 409 'Cannot publish over previously staged version "x.y.z"'
- * to any publish of it, so waiting for it to be exposed is the only way through.
- *
- * The packument says nothing about a staged version, but its tarball is already
- * served: that is what tells a staged version apart from one that was never
- * published.
- */
-
-import { createTaskLog } from "@jsenv/humanize";
-
-export const VERSION_STATUS = {
-  ABSENT: "absent",
-  STAGED: "staged",
-  PUBLISHED: "published",
-};
-
-const STAGED_VERSION_TIMEOUT_MS = 300_000;
-const STAGED_VERSION_POLL_INTERVAL_MS = 5_000;
-
-export const checkVersionStatusInRegistry = async ({
-  registryUrl,
-  packageName,
-  packageVersion,
-  token,
-}) => {
-  const versionIsInRegistry = await checkVersionIsInRegistry({
-    registryUrl,
-    packageName,
-    packageVersion,
-    token,
-  });
-  if (versionIsInRegistry) {
-    return VERSION_STATUS.PUBLISHED;
-  }
-  const tarballIsInRegistry = await checkTarballIsInRegistry({
-    registryUrl,
-    packageName,
-    packageVersion,
-    token,
-  });
-  if (tarballIsInRegistry) {
-    return VERSION_STATUS.STAGED;
-  }
-  return VERSION_STATUS.ABSENT;
-};
-
-export const waitForStagedVersionToLand = async ({
-  registryUrl,
-  packageName,
-  packageVersion,
-  token,
-}) => {
-  const waitTask = createTaskLog(
-    `wait for ${packageName}@${packageVersion} to be published by ${registryUrl}`,
-  );
-  const msBeforeTimeout = Date.now() + STAGED_VERSION_TIMEOUT_MS;
-  try {
-    while (true) {
-      const versionIsInRegistry = await checkVersionIsInRegistry({
-        registryUrl,
-        packageName,
-        packageVersion,
-        token,
-      });
-      if (versionIsInRegistry) {
-        waitTask.done();
-        return;
-      }
-      if (Date.now() > msBeforeTimeout) {
-        throw new Error(
-          `${packageName}@${packageVersion} is staged on ${registryUrl} but did not get published. Run the publish again to keep waiting; a staged version cannot be published again.`,
-        );
-      }
-      await new Promise((resolve) => {
-        setTimeout(resolve, STAGED_VERSION_POLL_INTERVAL_MS);
-      });
-    }
-  } catch (e) {
-    waitTask.fail();
-    throw e;
-  }
-};
-
-const checkVersionIsInRegistry = async ({
-  registryUrl,
-  packageName,
-  packageVersion,
-  token,
-}) => {
-  const response = await fetchRegistry(`${registryUrl}/${packageName}`, {
-    method: "GET",
-    token,
-  });
-  if (!response || response.status !== 200) {
-    return false;
-  }
-  const packageObject = await response.json();
-  return Boolean(packageObject.versions[packageVersion]);
-};
-
-const checkTarballIsInRegistry = async ({
-  registryUrl,
-  packageName,
-  packageVersion,
-  token,
-}) => {
-  const response = await fetchRegistry(
-    computeTarballUrl({ registryUrl, packageName, packageVersion }),
-    { method: "HEAD", token },
-  );
-  return Boolean(response) && response.status === 200;
-};
-
-const computeTarballUrl = ({ registryUrl, packageName, packageVersion }) => {
-  const packageBasename =
-    packageName[0] === "@"
-      ? packageName.slice(packageName.indexOf("/") + 1)
-      : packageName;
-  return `${registryUrl}/${packageName}/-/${packageBasename}-${packageVersion}.tgz`;
-};
-
-const fetchRegistry = async (url, { method, token }) => {
-  try {
-    return await fetch(url, {
-      method,
-      headers: {
-        "accept":
-          "application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*",
-        // the registry is served by a cache; without this a version can stay
-        // invisible long after it landed
-        "cache-control": "no-cache",
-        ...(token ? { authorization: `token ${token}` } : {}),
-      },
-    });
-  } catch {
-    // a network hiccup is one more reason for the version not to be there yet
-    return null;
-  }
-};