@smoothbricks/cli 0.10.6 → 0.10.8

package/src/nx/index.test.ts

@@ -4,12 +4,12 @@ import {
   formatProjectTargetLines,
   nxCacheDirectories,
   nxResetCommand,
-  nxShowProjectCommand,
-  projectNamesFromNxShowProjectsOutput,
   projectNamesWithTarget,
   projectRootFromNxProjectJson,
+  projectTargetsFromNxProjects,
   targetDependenciesFromNxProjectJson,
   targetNamesFromNxProjectJson,
+  targetNamesFromProjects,
   targetOutputsFromNxProjectJson,
 } from './index.js';
 
@@ -18,10 +18,6 @@ describe('Nx helper command construction', () => {
     expect(nxResetCommand()).toEqual({ command: 'nx', args: ['reset'] });
   });
 
-  it('builds explicit nx project metadata invocation', () => {
-    expect(nxShowProjectCommand('cli')).toEqual({ command: 'nx', args: ['show', 'project', 'cli', '--json'] });
-  });
-
   it('selects only local Nx cache directories', () => {
     expect(nxCacheDirectories('/repo')).toEqual([
       join('/repo', '.nx/cache'),
@@ -54,14 +50,6 @@ describe('Nx helper output formatting', () => {
     ).toEqual(['cli', 'web']);
   });
 
-  it('parses JSON project lists from nx show projects', () => {
-    expect(projectNamesFromNxShowProjectsOutput('["web","cli"]\n')).toEqual(['cli', 'web']);
-  });
-
-  it('parses legacy newline project lists from nx show projects', () => {
-    expect(projectNamesFromNxShowProjectsOutput('web\ncli\n')).toEqual(['cli', 'web']);
-  });
-
   it('extracts sorted target names from Nx project JSON', () => {
     expect(targetNamesFromNxProjectJson({ targets: { test: {}, build: {}, lint: {} } })).toEqual([
       'build',
@@ -113,4 +101,47 @@ describe('Nx helper output formatting', () => {
   it('treats missing target metadata as an empty project', () => {
     expect(targetNamesFromNxProjectJson({ name: 'cli' })).toEqual([]);
   });
+
+  it('projects every resolved graph node without per-project CLI parsing', () => {
+    const projects = {
+      web: {
+        root: 'packages/web',
+        targets: {
+          test: {
+            executor: '@smoothbricks/nx-plugin:bounded-exec',
+            dependsOn: ['build'],
+            options: { command: 'bun test', timeoutMs: 120_000 },
+          },
+          build: { outputs: ['{projectRoot}/dist'] },
+        },
+      },
+      cli: { root: 'packages/cli', targets: { lint: {} } },
+    };
+
+    expect(targetNamesFromProjects(projects).sort()).toEqual(['build', 'lint', 'test']);
+    expect(projectTargetsFromNxProjects(projects)).toEqual([
+      {
+        project: 'cli',
+        root: 'packages/cli',
+        targets: ['lint'],
+        buildDependsOn: undefined,
+        targetDependencies: new Map(),
+        targetExecutors: new Map(),
+        targetOptions: new Map(),
+        targetOutputs: new Map(),
+        targetScripts: new Map(),
+      },
+      {
+        project: 'web',
+        root: 'packages/web',
+        targets: ['build', 'test'],
+        buildDependsOn: undefined,
+        targetDependencies: new Map([['test', ['build']]]),
+        targetExecutors: new Map([['test', '@smoothbricks/nx-plugin:bounded-exec']]),
+        targetOptions: new Map([['test', { command: 'bun test', timeoutMs: 120_000 }]]),
+        targetOutputs: new Map([['build', ['{projectRoot}/dist']]]),
+        targetScripts: new Map(),
+      },
+    ]);
+  });
 });

package/src/nx/index.ts

@@ -1,15 +1,11 @@
 import { existsSync } from 'node:fs';
 import { lstat, rm } from 'node:fs/promises';
 import { join } from 'node:path';
-import { $ } from 'bun';
-import {
-  type NxDependsOn,
-  type NxProjectJson,
-  type NxTargetConfig,
-  parseNxProjectJsonText,
-  parseStringArrayText,
-} from '../lib/json.js';
-import { decode, run } from '../lib/run.js';
+// Nx package exports are CLI-oriented; this is the module the CLI uses for graph + daemon IPC.
+import { createProjectGraphAsync } from 'nx/src/project-graph/project-graph.js';
+import { workspaceRoot as primaryWorkspaceRoot } from 'nx/src/utils/workspace-root.js';
+import type { NxDependsOn, NxProjectJson, NxTargetConfig, NxTargetOptions } from '../lib/json.js';
+import { run, runResult } from '../lib/run.js';
 
 export interface ProjectTargets {
   project: string;
@@ -18,6 +14,7 @@ export interface ProjectTargets {
   buildDependsOn?: string[];
   targetDependencies?: Map<string, string[]>;
   targetExecutors?: Map<string, string>;
+  targetOptions?: Map<string, NxTargetOptions>;
   targetOutputs?: Map<string, string[]>;
   targetScripts?: Map<string, string>;
 }
@@ -31,10 +28,6 @@ export function nxResetCommand(): CommandInvocation {
   return { command: 'nx', args: ['reset'] };
 }
 
-export function nxShowProjectCommand(project: string): CommandInvocation {
-  return { command: 'nx', args: ['show', 'project', project, '--json'] };
-}
-
 export function nxCacheDirectories(root: string): string[] {
   return [join(root, '.nx/cache'), join(root, '.nx/workspace-data'), join(root, 'node_modules/.cache/nx')];
 }
@@ -48,10 +41,6 @@ export function projectRootFromNxProjectJson(value: NxProjectJson | null | undef
   return typeof value?.root === 'string' ? value.root : undefined;
 }
 
-export function buildDependsOnFromNxProjectJson(value: NxProjectJson | null | undefined): string[] | undefined {
-  return targetDependenciesFromNxProjectJson(value).get('build');
-}
-
 export function targetDependenciesFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]> {
   const targets = value?.targets;
   const dependencies = new Map<string, string[]>();
@@ -112,6 +101,20 @@ export function targetExecutorsFromNxProjectJson(value: NxProjectJson | null | u
   return executors;
 }
 
+export function targetOptionsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, NxTargetOptions> {
+  const targets = value?.targets;
+  const options = new Map<string, NxTargetOptions>();
+  if (!targets) {
+    return options;
+  }
+  for (const [targetName, target] of Object.entries(targets)) {
+    if (target.options) {
+      options.set(targetName, target.options);
+    }
+  }
+  return options;
+}
+
 export function targetOutputsFromNxProjectJson(value: NxProjectJson | null | undefined): Map<string, string[]> {
   return targetStringArraysFromNxProjectJson(value, 'outputs');
 }
@@ -168,30 +171,6 @@ export function projectNamesWithTarget(projects: ProjectTargets[], target: strin
     .sort((a, b) => a.localeCompare(b));
 }
 
-export function projectNamesFromNxShowProjectsOutput(output: string): string[] {
-  const trimmed = output.trim();
-  if (!trimmed) {
-    return [];
-  }
-
-  if (trimmed.startsWith('[')) {
-    try {
-      const parsed = parseStringArrayText(trimmed);
-      if (parsed) {
-        return parsed.sort((a, b) => a.localeCompare(b));
-      }
-    } catch {
-      // Fall through to legacy newline parsing for older Nx output shapes.
-    }
-  }
-
-  return trimmed
-    .split('\n')
-    .map((line) => line.trim())
-    .filter(Boolean)
-    .sort((a, b) => a.localeCompare(b));
-}
-
 export async function listTargets(root: string): Promise<void> {
   const output = formatProjectTargetLines(await readProjectTargets(root));
   if (output) {
@@ -229,34 +208,124 @@ export async function cleanCache(root: string): Promise<void> {
   }
 }
 
-export async function readProjectTargets(root: string): Promise<ProjectTargets[]> {
-  const projects = await readNxProjectNames(root);
-  return Promise.all(projects.map((project) => readProjectTarget(root, project)));
+export type NxProjects = Readonly<Record<string, NxProjectJson>>;
+
+/**
+ * Load the resolved project graph through Nx's API. The current workspace uses the
+ * daemon in-process; foreign roots use an isolated process because Nx snapshots its
+ * workspace cache paths when the module loads.
+ */
+let graphLoadTail: Promise<void> = Promise.resolve();
+
+export function loadNxProjects(root: string): Promise<NxProjects> {
+  const result = graphLoadTail.then(() => loadNxProjectsNow(root));
+  graphLoadTail = result.then(
+    () => undefined,
+    () => undefined,
+  );
+  return result;
 }
 
-async function readNxProjectNames(root: string): Promise<string[]> {
-  const result = await $`nx show projects`.cwd(root).quiet();
-  return projectNamesFromNxShowProjectsOutput(decode(result.stdout));
+async function loadNxProjectsNow(root: string): Promise<NxProjects> {
+  if (root !== primaryWorkspaceRoot) {
+    return loadForeignNxProjects(root);
+  }
+  const graph = await createProjectGraphAsync({ exitOnError: false });
+  return nxProjectsFromNodes(graph.nodes);
 }
 
-async function readProjectTarget(root: string, project: string): Promise<ProjectTargets> {
-  const command = nxShowProjectCommand(project);
-  const result = await $`${command.command} ${command.args}`.cwd(root).quiet();
-  const parsed = parseNxProjectJsonText(decode(result.stdout));
-  if (!parsed) {
-    throw new Error(`Unable to inspect Nx project ${project}.`);
+const FOREIGN_GRAPH_SCRIPT = `
+import('nx/src/project-graph/project-graph.js')
+  .then(async ({ createProjectGraphAsync }) => {
+    const graph = await createProjectGraphAsync({ exitOnError: false });
+    const projects = Object.fromEntries(
+      Object.entries(graph.nodes).map(([name, node]) => [
+        name,
+        { ...node.data, name: node.data?.name ?? name, targets: node.data?.targets ?? {} },
+      ]),
+    );
+    process.stdout.write(JSON.stringify(projects));
+  })
+  .catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  });
+`;
+
+async function loadForeignNxProjects(root: string): Promise<NxProjects> {
+  const result = await runResult(process.execPath, ['--eval', FOREIGN_GRAPH_SCRIPT], root, {
+    NX_DAEMON: 'false',
+    NX_ISOLATE_PLUGINS: 'false',
+    NX_WORKSPACE_ROOT_PATH: root,
+  });
+  if (result.exitCode !== 0) {
+    throw new Error(`Failed to load Nx project graph for ${root}: ${result.stderr.trim()}`);
+  }
+  const parsed: unknown = JSON.parse(result.stdout);
+  if (!isNxProjects(parsed)) {
+    throw new Error(`Nx returned an invalid project graph for ${root}`);
   }
-  const targetDependencies = targetDependenciesFromNxProjectJson(parsed);
-  return {
-    project,
-    root: projectRootFromNxProjectJson(parsed),
-    targets: targetNamesFromNxProjectJson(parsed),
-    buildDependsOn: targetDependencies.get('build'),
-    targetDependencies,
-    targetExecutors: targetExecutorsFromNxProjectJson(parsed),
-    targetOutputs: targetOutputsFromNxProjectJson(parsed),
-    targetScripts: targetScriptsFromNxProjectJson(parsed),
-  };
+  return parsed;
+}
+
+function nxProjectsFromNodes(nodes: Readonly<Record<string, { data: NxProjectJson }>>): NxProjects {
+  const projects: Record<string, NxProjectJson> = {};
+  for (const [name, node] of Object.entries(nodes)) {
+    projects[name] = {
+      ...node.data,
+      name: node.data.name ?? name,
+      targets: node.data.targets ?? {},
+    };
+  }
+  return projects;
+}
+
+function isNxProjects(value: unknown): value is NxProjects {
+  if (!isRecord(value)) return false;
+  return Object.values(value).every(
+    (project) =>
+      isRecord(project) &&
+      (project.name === undefined || typeof project.name === 'string') &&
+      (project.root === undefined || typeof project.root === 'string') &&
+      (project.targets === undefined || (isRecord(project.targets) && Object.values(project.targets).every(isRecord))),
+  );
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+export function targetNamesFromProjects(projects: NxProjects): string[] {
+  const names = new Set<string>();
+  for (const project of Object.values(projects)) {
+    for (const targetName of targetNamesFromNxProjectJson(project)) {
+      names.add(targetName);
+    }
+  }
+  return [...names];
+}
+
+export function projectTargetsFromNxProjects(projects: NxProjects): ProjectTargets[] {
+  return Object.entries(projects)
+    .sort(([left], [right]) => left.localeCompare(right))
+    .map(([project, metadata]) => {
+      const targetDependencies = targetDependenciesFromNxProjectJson(metadata);
+      return {
+        project,
+        root: projectRootFromNxProjectJson(metadata),
+        targets: targetNamesFromNxProjectJson(metadata),
+        buildDependsOn: targetDependencies.get('build'),
+        targetDependencies,
+        targetExecutors: targetExecutorsFromNxProjectJson(metadata),
+        targetOptions: targetOptionsFromNxProjectJson(metadata),
+        targetOutputs: targetOutputsFromNxProjectJson(metadata),
+        targetScripts: targetScriptsFromNxProjectJson(metadata),
+      };
+    });
+}
+
+export async function readProjectTargets(root: string): Promise<ProjectTargets[]> {
+  return projectTargetsFromNxProjects(await loadNxProjects(root));
 }
 
 export type { NxProjectJson, NxTargetConfig };

package/src/playwright/index.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'bun:test';
+import { type ChromiumSetupDependencies, ensureChromium } from './index.js';
+
+interface RunCall {
+  readonly command: string;
+  readonly args: string[];
+  readonly cwd: string;
+  readonly env?: Record<string, string>;
+}
+
+function setupDependencies(
+  env: ChromiumSetupDependencies['env'],
+  existingPaths: readonly string[],
+  calls: RunCall[],
+): ChromiumSetupDependencies {
+  const existing = new Set(existingPaths);
+  return {
+    env,
+    exists: (path) => existing.has(path),
+    run: async (command, args, cwd, runEnv) => {
+      calls.push({ command, args, cwd, ...(runEnv ? { env: runEnv } : {}) });
+    },
+  };
+}
+
+describe('ensureChromium', () => {
+  it('uses preinstalled Chrome without invoking Playwright install on an ephemeral GitHub runner', async () => {
+    const calls: RunCall[] = [];
+    const executablePath = '/fixture/google-chrome';
+
+    const result = await ensureChromium(
+      '/workspace/package',
+      setupDependencies(
+        { GITHUB_ACTIONS: 'true', PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH: executablePath },
+        [executablePath],
+        calls,
+      ),
+    );
+
+    expect(result).toEqual({ mode: 'system', executablePath });
+    expect(calls).toEqual([]);
+  });
+
+  it('installs Chromium into the persistent host-runner cache', async () => {
+    const calls: RunCall[] = [];
+
+    const result = await ensureChromium(
+      '/workspace/package',
+      setupDependencies({ GITHUB_ACTIONS: 'true' }, ['/var/cache/ci'], calls),
+    );
+
+    expect(result).toEqual({ mode: 'persistent-cache', browserCachePath: '/var/cache/ci/ms-playwright' });
+    expect(calls).toEqual([
+      {
+        command: 'playwright',
+        args: ['install', 'chromium', '--only-shell'],
+        cwd: '/workspace/package',
+        env: { PLAYWRIGHT_BROWSERS_PATH: '/var/cache/ci/ms-playwright' },
+      },
+    ]);
+  });
+
+  it('fails rather than downloading when an ephemeral GitHub runner has no system Chrome', async () => {
+    const calls: RunCall[] = [];
+
+    await expect(
+      ensureChromium('/workspace/package', setupDependencies({ GITHUB_ACTIONS: 'true' }, [], calls)),
+    ).rejects.toThrow('Refusing to download');
+    expect(calls).toEqual([]);
+  });
+
+  it('honors an explicit developer cache outside GitHub Actions', async () => {
+    const calls: RunCall[] = [];
+
+    const result = await ensureChromium(
+      '/workspace/package',
+      setupDependencies({ PLAYWRIGHT_BROWSERS_PATH: '/tmp/browser-cache' }, [], calls),
+    );
+
+    expect(result).toEqual({ mode: 'developer-cache', browserCachePath: '/tmp/browser-cache' });
+    expect(calls).toEqual([
+      {
+        command: 'playwright',
+        args: ['install', 'chromium', '--only-shell'],
+        cwd: '/workspace/package',
+        env: { PLAYWRIGHT_BROWSERS_PATH: '/tmp/browser-cache' },
+      },
+    ]);
+  });
+});

package/src/playwright/index.ts

@@ -0,0 +1,73 @@
+import { existsSync } from 'node:fs';
+import { run } from '../lib/run.js';
+
+const HOST_CACHE_ROOT = '/var/cache/ci';
+const HOST_BROWSER_CACHE = `${HOST_CACHE_ROOT}/ms-playwright`;
+const SYSTEM_CHROME_PATHS = [
+  '/usr/bin/google-chrome',
+  '/usr/bin/chromium-browser',
+  '/usr/bin/chromium',
+  '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+] as const;
+
+export interface ChromiumSetupDependencies {
+  readonly env: Readonly<Record<string, string | undefined>>;
+  readonly exists: (path: string) => boolean;
+  readonly run: (command: string, args: string[], cwd: string, env?: Record<string, string>) => Promise<void>;
+}
+
+export type ChromiumSetupResult =
+  | { readonly mode: 'persistent-cache'; readonly browserCachePath: string }
+  | { readonly mode: 'system'; readonly executablePath: string }
+  | { readonly mode: 'developer-cache'; readonly browserCachePath?: string };
+
+const defaultDependencies: ChromiumSetupDependencies = {
+  env: process.env,
+  exists: existsSync,
+  run,
+};
+
+/**
+ * Ensure Chromium is available without polluting ephemeral GitHub runners.
+ * Persistent host runners and developer machines may install into their
+ * respective caches; ephemeral GitHub runners must use their image's browser.
+ */
+export async function ensureChromium(
+  cwd = process.cwd(),
+  dependencies: ChromiumSetupDependencies = defaultDependencies,
+): Promise<ChromiumSetupResult> {
+  const { env, exists, run: runCommand } = dependencies;
+  const githubActions = env.GITHUB_ACTIONS === 'true';
+
+  if (githubActions && exists(HOST_CACHE_ROOT)) {
+    await runCommand('playwright', ['install', 'chromium', '--only-shell'], cwd, {
+      PLAYWRIGHT_BROWSERS_PATH: HOST_BROWSER_CACHE,
+    });
+    console.log(`Chromium ready in persistent cache: ${HOST_BROWSER_CACHE}`);
+    return { mode: 'persistent-cache', browserCachePath: HOST_BROWSER_CACHE };
+  }
+
+  if (githubActions) {
+    const candidates = [env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, ...SYSTEM_CHROME_PATHS].filter(
+      (path): path is string => typeof path === 'string' && path.length > 0,
+    );
+    const executablePath = candidates.find(exists);
+    if (!executablePath) {
+      throw new Error(
+        `GitHub-hosted runner has no preinstalled Chromium. Refusing to download; searched: ${candidates.join(', ')}`,
+      );
+    }
+    console.log(`Using preinstalled Chromium: ${executablePath}`);
+    return { mode: 'system', executablePath };
+  }
+
+  const browserCachePath = env.PLAYWRIGHT_BROWSERS_PATH;
+  await runCommand(
+    'playwright',
+    ['install', 'chromium', '--only-shell'],
+    cwd,
+    browserCachePath ? { PLAYWRIGHT_BROWSERS_PATH: browserCachePath } : undefined,
+  );
+  console.log(browserCachePath ? `Chromium ready in configured cache: ${browserCachePath}` : 'Chromium ready.');
+  return browserCachePath ? { mode: 'developer-cache', browserCachePath } : { mode: 'developer-cache' };
+}

package/src/release/__tests__/bootstrap-npm-packages.test.ts

@@ -4,6 +4,7 @@ import {
   bootstrapNpmPackages,
   NPM_BOOTSTRAP_DIST_TAG,
   NPM_BOOTSTRAP_VERSION,
+  NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS,
 } from '../bootstrap-npm-packages.js';
 import type { ReleasePackageInfo } from '../core.js';
 
@@ -70,6 +71,45 @@ describe('bootstrap npm packages', () => {
     expect(shell.prompts).toEqual([]);
   });
 
+  it('uploads every placeholder before polling all pending packages with backoff', async () => {
+    const shell = new RecordingBootstrapShell({
+      packages: [stable, missing],
+      existing: [],
+      visibleAfterChecks: { [stable.name]: 2, [missing.name]: 3 },
+    });
+
+    await bootstrapNpmPackages(shell, { dryRun: false, skipLogin: true, packages: [], otp: '111222' });
+
+    expect(shell.events).toEqual([
+      `publish:${stable.name}`,
+      `publish:${missing.name}`,
+      `view:${stable.name}:${NPM_BOOTSTRAP_VERSION}`,
+      `view:${missing.name}:${NPM_BOOTSTRAP_VERSION}`,
+      'wait:1000',
+      `view:${stable.name}:${NPM_BOOTSTRAP_VERSION}`,
+      `view:${missing.name}:${NPM_BOOTSTRAP_VERSION}`,
+      'wait:2000',
+      `view:${missing.name}:${NPM_BOOTSTRAP_VERSION}`,
+    ]);
+  });
+
+  it('times out after bounded backoff without suggesting another bootstrap', async () => {
+    const shell = new RecordingBootstrapShell({
+      packages: [missing],
+      existing: [],
+      visibleAfterChecks: { [missing.name]: Number.POSITIVE_INFINITY },
+    });
+
+    await expect(
+      bootstrapNpmPackages(shell, { dryRun: false, skipLogin: true, packages: [], otp: '111222' }),
+    ).rejects.toThrow('Retry smoo release trust-publisher later; do not bootstrap again.');
+
+    const waited = shell.events
+      .filter((event) => event.startsWith('wait:'))
+      .reduce((total, event) => total + Number(event.slice('wait:'.length)), 0);
+    expect(waited).toBe(NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS);
+  });
+
   it('rejects unknown package selections before npm login', async () => {
     const shell = new RecordingBootstrapShell({ packages: [stable], existing: [] });
 
@@ -82,6 +122,7 @@ describe('bootstrap npm packages', () => {
 });
 
 class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackageInfo> {
+  readonly events: string[] = [];
   readonly logs: string[] = [];
   readonly published: Array<{ name: string; otp: string }> = [];
   readonly prompts: string[] = [];
@@ -89,11 +130,19 @@ class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackag
   private readonly packages: ReleasePackageInfo[];
   private readonly existing: Set<string>;
   private readonly otps: string[];
-
-  constructor(options: { packages: ReleasePackageInfo[]; existing: string[]; otps?: string[] }) {
+  private readonly visibilityChecks = new Map<string, number>();
+  private readonly visibleAfterChecks: Readonly<Record<string, number>>;
+
+  constructor(options: {
+    packages: ReleasePackageInfo[];
+    existing: string[];
+    otps?: string[];
+    visibleAfterChecks?: Record<string, number>;
+  }) {
     this.packages = options.packages;
     this.existing = new Set(options.existing);
     this.otps = [...(options.otps ?? [])];
+    this.visibleAfterChecks = options.visibleAfterChecks ?? {};
   }
 
   listReleasePackages(): ReleasePackageInfo[] {
@@ -104,11 +153,19 @@ class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackag
     return this.existing.has(name);
   }
 
+  async packageVersionExists(name: string, version: string): Promise<boolean> {
+    this.events.push(`view:${name}:${version}`);
+    const checks = (this.visibilityChecks.get(name) ?? 0) + 1;
+    this.visibilityChecks.set(name, checks);
+    return checks >= (this.visibleAfterChecks[name] ?? 1);
+  }
+
   async login(): Promise<void> {
     this.logins += 1;
   }
 
   async publishPlaceholder(pkg: ReleasePackageInfo, env?: Record<string, string>): Promise<void> {
+    this.events.push(`publish:${pkg.name}`);
     this.published.push({ name: pkg.name, otp: env?.NPM_CONFIG_OTP ?? '' });
   }
 
@@ -121,6 +178,10 @@ class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackag
     return otp;
   }
 
+  async wait(milliseconds: number): Promise<void> {
+    this.events.push(`wait:${milliseconds}`);
+  }
+
   log(message: string): void {
     this.logs.push(message);
   }

package/src/release/bootstrap-npm-packages.ts

@@ -2,6 +2,9 @@ import type { ReleasePackageInfo } from './core.js';
 
 export const NPM_BOOTSTRAP_VERSION = '0.0.0-bootstrap.0';
 export const NPM_BOOTSTRAP_DIST_TAG = 'bootstrap';
+export const NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS = 120_000;
+
+const NPM_BOOTSTRAP_POLL_DELAYS_MS = [0, 1_000, 2_000, 4_000, 8_000, 15_000, 30_000, 30_000, 30_000] as const;
 
 export interface BootstrapNpmPackagesOptions {
   dryRun: boolean;
@@ -13,9 +16,11 @@ export interface BootstrapNpmPackagesOptions {
 export interface BootstrapNpmPackagesShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   listReleasePackages(): Package[];
   packageExists(name: string): Promise<boolean>;
+  packageVersionExists(name: string, version: string): Promise<boolean>;
   login(): Promise<void>;
   publishPlaceholder(pkg: Package, env?: Record<string, string>): Promise<void>;
   promptOtp(packageName: string): Promise<string>;
+  wait(milliseconds: number): Promise<void>;
   log(message: string): void;
 }
 
@@ -54,15 +59,44 @@ export async function bootstrapNpmPackages<Package extends ReleasePackageInfo>(
   if (!options.skipLogin) {
     await shell.login();
   }
+  // Upload every placeholder before waiting for npm registry propagation. Keeping the
+  // phases separate prevents one slow package from blocking the remaining uploads.
   for (const pkg of missing) {
     shell.log(`${pkg.name}: publishing npm placeholder.`);
     const otp = options.otp ?? (await shell.promptOtp(pkg.name));
     await shell.publishPlaceholder(pkg, { NPM_CONFIG_OTP: otp });
   }
+
+  await waitForPublishedPackages(shell, missing);
   shell.log('Bootstrap complete. Run smoo release trust-publisher before the first CI publish.');
   return missing;
 }
 
+async function waitForPublishedPackages<Package extends ReleasePackageInfo>(
+  shell: BootstrapNpmPackagesShell<Package>,
+  packages: readonly Package[],
+): Promise<void> {
+  let pending = [...packages];
+  for (const delayMs of NPM_BOOTSTRAP_POLL_DELAYS_MS) {
+    if (delayMs > 0) {
+      await shell.wait(delayMs);
+    }
+    const visible = await Promise.all(
+      pending.map((pkg) => shell.packageVersionExists(pkg.name, NPM_BOOTSTRAP_VERSION)),
+    );
+    pending = pending.filter((_, index) => !visible[index]);
+    if (pending.length === 0) {
+      return;
+    }
+  }
+
+  throw new Error(
+    `Bootstrap uploads succeeded, but npm did not expose these packages after ${NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS / 1_000} seconds: ${pending
+      .map((pkg) => pkg.name)
+      .join(', ')}. Retry smoo release trust-publisher later; do not bootstrap again.`,
+  );
+}
+
 function selectedReleasePackages<Package extends ReleasePackageInfo>(
   packages: Package[],
   selections: string[],