@payez/next-mvp 4.4.0 → 4.4.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@payez/next-mvp",
-  "version": "4.4.0",
+  "version": "4.4.1",
   "sideEffects": false,
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/scripts/check-publish-health.mjs

@@ -43,6 +43,10 @@ function run(args) {
   }).trim();
 }
 
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
 /** Numeric-aware semver compare. Returns >0 if a > b, 0 if equal, <0 if a < b. */
 function compareVersions(a, b) {
   const norm = (v) => String(v).split('-')[0].split('.').map((n) => parseInt(n, 10) || 0);
@@ -74,19 +78,57 @@ try {
   authUser = null;
 }
 
+// READ THE REGISTRY, NOT npm's CACHE (measured 2026-09-10, Nextpert-Scout).
+//
+// This script is wired as `postpublish` in package.json. postpublish runs ONLY after
+// a SUCCESSFUL upload — so the one moment it is guaranteed to run is the one moment
+// npm's metadata cache is guaranteed to be stale. Publishing 4.4.0 produced:
+//
+//     [publish-health] FAIL: the registry LAGS local by at least one version.
+//     [publish-health] 4.4.0 is built locally but the registry serves 4.1.21.
+//     npm error code 1
+//
+// 4.4.0 was already live. THE HONEST REACTION TO THAT OUTPUT IS TO PUBLISH AGAIN,
+// which is the dangerous action — and against a registry that refuses republication
+// it burns a version number, which is how a version string ends up naming two trees.
+//
+// `--prefer-online` forces revalidation. The bounded retry covers real propagation
+// delay, which is seconds, not weeks.
+//
+// THIS DOES NOT SOFTEN THE CHECK, and it must not be "helpfully" turned into a warning:
+// a genuine lag (the 171900 failure mode — a dead credential leaving versions
+// unpublished for WEEKS) still exhausts every attempt and still exits non-zero. The
+// retry changes how accurately we read the registry, never what counts as a failure.
+const REGISTRY_ATTEMPTS = 4;
+const REGISTRY_RETRY_MS = 2000;
+
 let registryVersion = null;
-try {
-  registryVersion = run(['view', name, 'version']);
-} catch (err) {
-  const msg = String(err.stderr || err.message || '');
-  if (/E404|404 Not Found/.test(msg)) {
-    console.error(`[publish-health] FAIL: ${name} has NEVER been published to the registry.`);
-    console.error(`[publish-health] local=${localVersion} registry=<absent>`);
-    process.exit(1);
+for (let attempt = 1; attempt <= REGISTRY_ATTEMPTS; attempt++) {
+  try {
+    registryVersion = run(['view', name, 'version', '--prefer-online']);
+  } catch (err) {
+    const msg = String(err.stderr || err.message || '');
+    if (/E404|404 Not Found/.test(msg)) {
+      console.error(`[publish-health] FAIL: ${name} has NEVER been published to the registry.`);
+      console.error(`[publish-health] local=${localVersion} registry=<absent>`);
+      process.exit(1);
+    }
+    console.error(`[publish-health] INCONCLUSIVE: could not query the registry: ${msg.split('\n')[0]}`);
+    console.error('[publish-health] Treat as UNKNOWN, not as a pass.');
+    process.exit(2);
+  }
+
+  // Stop as soon as the registry is at or ahead of local. Only an apparent lag is
+  // worth re-reading, and only because THIS script's own hook makes a stale read likely.
+  if (compareVersions(localVersion, registryVersion) <= 0) break;
+
+  if (attempt < REGISTRY_ATTEMPTS) {
+    console.log(
+      `[publish-health] registry says ${registryVersion}, local is ${localVersion} — ` +
+      `re-reading (${attempt}/${REGISTRY_ATTEMPTS - 1}) in case this is post-publish propagation lag.`,
+    );
+    sleepSync(REGISTRY_RETRY_MS);
   }
-  console.error(`[publish-health] INCONCLUSIVE: could not query the registry: ${msg.split('\n')[0]}`);
-  console.error('[publish-health] Treat as UNKNOWN, not as a pass.');
-  process.exit(2);
 }
 
 const delta = compareVersions(localVersion, registryVersion);