@smoothbricks/cli 0.10.7 → 0.10.8

package/src/monorepo/publish-workflow.ts

@@ -486,7 +486,7 @@ function deployProductionStep(step: PublishWorkflowStep, options: PublishWorkflo
     "          ${{ steps.version.outputs.mode != 'none' && inputs.deploy_environment == 'production' && inputs.dry_run !=",
     "          'true' }}",
     ...deployEnvLines(options),
-    '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+    '        run: smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
   ];
 }
 
@@ -940,7 +940,7 @@ function renderFinalLinuxPublishSteps(options: PublishWorkflowDefinitionOptions)
       "          ${{ needs.linux-release-candidate.outputs.mode != 'none' && inputs.deploy_environment == 'production' &&",
       "          inputs.dry_run != 'true' }}",
       ...deployEnvLines(options),
-      '        run: smoo github-ci nx-deploy --configuration production --mode run-many --verify --name "Deploy Production"',
+      '        run: smoo github-ci nx-deploy --environment production --mode run-many --verify --name "Deploy Production"',
     );
   }
   lines.push(

package/src/monorepo/tool-validation.test.ts

@@ -3,10 +3,12 @@ import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
 import {
+  applyDevenvPackageDefaults,
   applyRootDevDependencyDefaults,
   applyToolConfigDefaults,
   applyToolingPackageDefaults,
   readToolContext,
+  validateDevenvPackages,
   validateToolConfig,
 } from './tool-validation.js';
 
@@ -89,6 +91,88 @@ describe('tool configuration validation', () => {
       expect(devenv).toContain('nodejs_latest');
       expect(devenv).toContain('coreutils');
       expect(devenv).toContain('git-format-staged');
+      expect(devenv).toContain('go # Builds ttsc source plugins');
+      expect(devenv).not.toContain('sccache');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('requires Go for managed TypeScript source-plugin builds without forcing Rust tools', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
+    try {
+      const devenvPath = join(root, 'tooling/direnv/devenv.nix');
+      await mkdir(dirname(devenvPath), { recursive: true });
+      await writeFile(
+        devenvPath,
+        `{
+  pkgs,
+  ...
+}: {
+  packages = with pkgs; [
+    nodejs_latest
+    bun
+    git
+    git-format-staged
+    jq
+    alejandra
+    coreutils
+    gnutar
+  ];
+}
+`,
+      );
+
+      expect(validateDevenvPackages(root)).toBe(1);
+      applyDevenvPackageDefaults(root);
+      expect(validateDevenvPackages(root)).toBe(0);
+      const devenv = await readFile(devenvPath, 'utf8');
+      expect(devenv).toContain('go # Builds ttsc source plugins');
+      expect(devenv).not.toContain('sccache');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('requires Rust compiler helpers only when the workspace contains Cargo manifests', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-tool-validation-'));
+    try {
+      const crateRoot = join(root, 'packages/native');
+      await mkdir(crateRoot, { recursive: true });
+      await writeFile(join(crateRoot, 'Cargo.toml'), '[package]\nname = "native"\nversion = "0.0.0"\n');
+      const devenvPath = join(root, 'tooling/direnv/devenv.nix');
+      await mkdir(dirname(devenvPath), { recursive: true });
+      await writeFile(
+        devenvPath,
+        `{
+  pkgs,
+  lib,
+  ...
+}: {
+  packages = with pkgs; [
+    nodejs_latest
+    bun
+    git
+    git-format-staged
+    jq
+    alejandra
+    coreutils
+    gnutar
+    go
+    stdenv.cc.cc.lib
+  ];
+}
+`,
+      );
+
+      expect(validateDevenvPackages(root)).toBe(2);
+      applyDevenvPackageDefaults(root);
+      expect(validateDevenvPackages(root)).toBe(0);
+      const devenv = await readFile(devenvPath, 'utf8');
+      expect(devenv).toContain('sccache # Rust compiler wrapper and cache');
+      expect(devenv).toContain('++ lib.optionals pkgs.stdenv.isLinux [');
+      expect(devenv).toContain('pkgs.stdenv.cc');
+      expect(devenv).toContain('stdenv.cc.cc.lib');
     } finally {
       await rm(root, { recursive: true, force: true });
     }
@@ -141,6 +225,7 @@ describe('tool configuration validation', () => {
     alejandra
     coreutils
     gnutar
+    go
   ];
 }
 `,

package/src/monorepo/tool-validation.ts

@@ -1,4 +1,4 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import typia from 'typia';
 import { cliPackageVersion, isSmoothBricksCodebasePackageName } from '../lib/cli-package.js';
@@ -67,12 +67,24 @@ const rootDevDependencies: RequiredDependency[] = [
 
 const cliPackageName = '@smoothbricks/cli';
 
-const requiredDevenvPackages = ['bun', 'git', 'git-format-staged', 'jq', 'alejandra', 'coreutils', 'gnutar'];
+const requiredDevenvPackages = ['bun', 'git', 'git-format-staged', 'jq', 'alejandra', 'coreutils', 'gnutar', 'go'];
 // Any explicit nodejs provider is fine — the pinned major is the repo's choice
 // (Lambda parity, org convergence, …). Whether the pins in package.json agree
 // with the runtime is validated against the live PATH (validateRootRuntimeVersions),
 // never against a version template here.
 const nodePackagePattern = /(^|\s)nodejs(_\d+|_latest)?(\s|#|$)/m;
+const requiredRustDevenvPackages = ['sccache'];
+const linuxCompilerPackage = 'pkgs.stdenv.cc';
+const ignoredNativeManifestDirectories = new Set([
+  '.devenv',
+  '.direnv',
+  '.git',
+  '.nx',
+  'dist',
+  'node_modules',
+  'target',
+  'vendor',
+]);
 
 const obsoleteTtscPatchedDependencyKey = 'ttsc@0.19.3';
 
@@ -201,7 +213,9 @@ export function applyDevenvPackageDefaults(root: string): void {
     changed = next !== content || changed;
     content = next;
   }
-  for (const name of requiredDevenvPackages) {
+  const compilesRust = workspaceCompilesRust(root);
+  const requiredPackages = [...requiredDevenvPackages, ...(compilesRust ? requiredRustDevenvPackages : [])];
+  for (const name of requiredPackages) {
     if (hasNixPackage(content, name)) {
       continue;
     }
@@ -209,6 +223,11 @@ export function applyDevenvPackageDefaults(root: string): void {
     changed = next !== content || changed;
     content = next;
   }
+  if (compilesRust && !hasLinuxCompilerPackage(content)) {
+    const next = addLinuxCompilerPackage(content);
+    changed = next !== content || changed;
+    content = next;
+  }
   if (changed) {
     writeFileSync(path, content);
     console.log('updated        tooling/direnv/devenv.nix packages');
@@ -316,12 +335,20 @@ export function validateDevenvPackages(root: string): number {
     );
     failures++;
   }
-  for (const name of requiredDevenvPackages) {
+  const compilesRust = workspaceCompilesRust(root);
+  const requiredPackages = [...requiredDevenvPackages, ...(compilesRust ? requiredRustDevenvPackages : [])];
+  for (const name of requiredPackages) {
     if (!hasNixPackage(content, name)) {
       console.error(`tooling/direnv/devenv.nix packages must include ${name}`);
       failures++;
     }
   }
+  if (compilesRust && !hasLinuxCompilerPackage(content)) {
+    console.error(
+      'tooling/direnv/devenv.nix packages must include pkgs.stdenv.cc in a Linux-only package block for Rust builds',
+    );
+    failures++;
+  }
   return failures;
 }
 
@@ -330,7 +357,9 @@ function addNixPackage(content: string, name: string, comment: string): string {
   if (hasNixPackage(content, name)) {
     return content;
   }
-  const packagesStart = content.indexOf('  packages = with pkgs; [');
+  const directPackagesStart = content.indexOf('  packages = with pkgs; [');
+  const groupedPackagesStart = content.indexOf('    (with pkgs; [');
+  const packagesStart = directPackagesStart === -1 ? groupedPackagesStart : directPackagesStart;
   if (packagesStart === -1) {
     return content;
   }
@@ -342,6 +371,60 @@ function hasNixPackage(content: string, name: string): boolean {
   return new RegExp(`(^|\\s)${escapeRegex(name)}(\\s|#|$)`, 'm').test(content);
 }
 
+function workspaceCompilesRust(root: string): boolean {
+  return containsCargoManifest(root);
+}
+
+function containsCargoManifest(directory: string): boolean {
+  for (const entry of readdirSync(directory, { withFileTypes: true })) {
+    if (entry.isFile() && entry.name === 'Cargo.toml') {
+      return true;
+    }
+    if (
+      entry.isDirectory() &&
+      entry.name.startsWith('.') === false &&
+      ignoredNativeManifestDirectories.has(entry.name) === false &&
+      containsCargoManifest(join(directory, entry.name))
+    ) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function hasLinuxCompilerPackage(content: string): boolean {
+  const linuxPackages = /\+\+\s+lib\.optionals\s+pkgs\.stdenv\.isLinux\s+\[([\s\S]*?)\]/g;
+  return [...content.matchAll(linuxPackages)].some((match) => hasNixPackage(match[1] ?? '', linuxCompilerPackage));
+}
+
+function addLinuxCompilerPackage(content: string): string {
+  if (hasLinuxCompilerPackage(content)) {
+    return content;
+  }
+  const directStart = content.indexOf('  packages = with pkgs; [');
+  if (directStart !== -1) {
+    const listEnd = content.indexOf('\n  ];', directStart);
+    if (listEnd === -1) {
+      return content;
+    }
+    const listBody = content.slice(directStart + '  packages = with pkgs; ['.length, listEnd);
+    const replacement = `  packages =\n    (with pkgs; [${listBody}\n    ])\n    ++ lib.optionals pkgs.stdenv.isLinux [\n      ${linuxCompilerPackage}\n    ];`;
+    return `${content.slice(0, directStart)}${replacement}${content.slice(listEnd + '\n  ];'.length)}`;
+  }
+
+  const packagesStart = content.indexOf('  packages =');
+  const nextOption = content.indexOf('\n\n  ', packagesStart);
+  if (packagesStart === -1 || nextOption === -1) {
+    return content;
+  }
+  const terminator = content.lastIndexOf(';', nextOption);
+  if (terminator < packagesStart) {
+    return content;
+  }
+  const linuxPackages = `\n    ++ lib.optionals pkgs.stdenv.isLinux [\n      ${linuxCompilerPackage}\n    ]`;
+  return `${content.slice(0, terminator)}${linuxPackages}${content.slice(terminator)}`;
+}
+
 function nixPackageComment(name: string): string {
   if (name === 'coreutils') {
     return '# Provides fmt for commit message wrapping';
@@ -352,6 +435,12 @@ function nixPackageComment(name: string): string {
   if (name === 'git') {
     return '# Git hooks and repository inspection';
   }
+  if (name === 'go') {
+    return '# Builds ttsc source plugins';
+  }
+  if (name === 'sccache') {
+    return '# Rust compiler wrapper and cache';
+  }
   return '';
 }
 

package/src/playwright/index.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, it } from 'bun:test';
+import { type ChromiumSetupDependencies, ensureChromium } from './index.js';
+
+interface RunCall {
+  readonly command: string;
+  readonly args: string[];
+  readonly cwd: string;
+  readonly env?: Record<string, string>;
+}
+
+function setupDependencies(
+  env: ChromiumSetupDependencies['env'],
+  existingPaths: readonly string[],
+  calls: RunCall[],
+): ChromiumSetupDependencies {
+  const existing = new Set(existingPaths);
+  return {
+    env,
+    exists: (path) => existing.has(path),
+    run: async (command, args, cwd, runEnv) => {
+      calls.push({ command, args, cwd, ...(runEnv ? { env: runEnv } : {}) });
+    },
+  };
+}
+
+describe('ensureChromium', () => {
+  it('uses preinstalled Chrome without invoking Playwright install on an ephemeral GitHub runner', async () => {
+    const calls: RunCall[] = [];
+    const executablePath = '/fixture/google-chrome';
+
+    const result = await ensureChromium(
+      '/workspace/package',
+      setupDependencies(
+        { GITHUB_ACTIONS: 'true', PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH: executablePath },
+        [executablePath],
+        calls,
+      ),
+    );
+
+    expect(result).toEqual({ mode: 'system', executablePath });
+    expect(calls).toEqual([]);
+  });
+
+  it('installs Chromium into the persistent host-runner cache', async () => {
+    const calls: RunCall[] = [];
+
+    const result = await ensureChromium(
+      '/workspace/package',
+      setupDependencies({ GITHUB_ACTIONS: 'true' }, ['/var/cache/ci'], calls),
+    );
+
+    expect(result).toEqual({ mode: 'persistent-cache', browserCachePath: '/var/cache/ci/ms-playwright' });
+    expect(calls).toEqual([
+      {
+        command: 'playwright',
+        args: ['install', 'chromium', '--only-shell'],
+        cwd: '/workspace/package',
+        env: { PLAYWRIGHT_BROWSERS_PATH: '/var/cache/ci/ms-playwright' },
+      },
+    ]);
+  });
+
+  it('fails rather than downloading when an ephemeral GitHub runner has no system Chrome', async () => {
+    const calls: RunCall[] = [];
+
+    await expect(
+      ensureChromium('/workspace/package', setupDependencies({ GITHUB_ACTIONS: 'true' }, [], calls)),
+    ).rejects.toThrow('Refusing to download');
+    expect(calls).toEqual([]);
+  });
+
+  it('honors an explicit developer cache outside GitHub Actions', async () => {
+    const calls: RunCall[] = [];
+
+    const result = await ensureChromium(
+      '/workspace/package',
+      setupDependencies({ PLAYWRIGHT_BROWSERS_PATH: '/tmp/browser-cache' }, [], calls),
+    );
+
+    expect(result).toEqual({ mode: 'developer-cache', browserCachePath: '/tmp/browser-cache' });
+    expect(calls).toEqual([
+      {
+        command: 'playwright',
+        args: ['install', 'chromium', '--only-shell'],
+        cwd: '/workspace/package',
+        env: { PLAYWRIGHT_BROWSERS_PATH: '/tmp/browser-cache' },
+      },
+    ]);
+  });
+});

package/src/playwright/index.ts

@@ -0,0 +1,73 @@
+import { existsSync } from 'node:fs';
+import { run } from '../lib/run.js';
+
+const HOST_CACHE_ROOT = '/var/cache/ci';
+const HOST_BROWSER_CACHE = `${HOST_CACHE_ROOT}/ms-playwright`;
+const SYSTEM_CHROME_PATHS = [
+  '/usr/bin/google-chrome',
+  '/usr/bin/chromium-browser',
+  '/usr/bin/chromium',
+  '/Applications/Google Chrome.app/Contents/MacOS/Google Chrome',
+] as const;
+
+export interface ChromiumSetupDependencies {
+  readonly env: Readonly<Record<string, string | undefined>>;
+  readonly exists: (path: string) => boolean;
+  readonly run: (command: string, args: string[], cwd: string, env?: Record<string, string>) => Promise<void>;
+}
+
+export type ChromiumSetupResult =
+  | { readonly mode: 'persistent-cache'; readonly browserCachePath: string }
+  | { readonly mode: 'system'; readonly executablePath: string }
+  | { readonly mode: 'developer-cache'; readonly browserCachePath?: string };
+
+const defaultDependencies: ChromiumSetupDependencies = {
+  env: process.env,
+  exists: existsSync,
+  run,
+};
+
+/**
+ * Ensure Chromium is available without polluting ephemeral GitHub runners.
+ * Persistent host runners and developer machines may install into their
+ * respective caches; ephemeral GitHub runners must use their image's browser.
+ */
+export async function ensureChromium(
+  cwd = process.cwd(),
+  dependencies: ChromiumSetupDependencies = defaultDependencies,
+): Promise<ChromiumSetupResult> {
+  const { env, exists, run: runCommand } = dependencies;
+  const githubActions = env.GITHUB_ACTIONS === 'true';
+
+  if (githubActions && exists(HOST_CACHE_ROOT)) {
+    await runCommand('playwright', ['install', 'chromium', '--only-shell'], cwd, {
+      PLAYWRIGHT_BROWSERS_PATH: HOST_BROWSER_CACHE,
+    });
+    console.log(`Chromium ready in persistent cache: ${HOST_BROWSER_CACHE}`);
+    return { mode: 'persistent-cache', browserCachePath: HOST_BROWSER_CACHE };
+  }
+
+  if (githubActions) {
+    const candidates = [env.PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH, ...SYSTEM_CHROME_PATHS].filter(
+      (path): path is string => typeof path === 'string' && path.length > 0,
+    );
+    const executablePath = candidates.find(exists);
+    if (!executablePath) {
+      throw new Error(
+        `GitHub-hosted runner has no preinstalled Chromium. Refusing to download; searched: ${candidates.join(', ')}`,
+      );
+    }
+    console.log(`Using preinstalled Chromium: ${executablePath}`);
+    return { mode: 'system', executablePath };
+  }
+
+  const browserCachePath = env.PLAYWRIGHT_BROWSERS_PATH;
+  await runCommand(
+    'playwright',
+    ['install', 'chromium', '--only-shell'],
+    cwd,
+    browserCachePath ? { PLAYWRIGHT_BROWSERS_PATH: browserCachePath } : undefined,
+  );
+  console.log(browserCachePath ? `Chromium ready in configured cache: ${browserCachePath}` : 'Chromium ready.');
+  return browserCachePath ? { mode: 'developer-cache', browserCachePath } : { mode: 'developer-cache' };
+}

package/src/release/__tests__/bootstrap-npm-packages.test.ts

@@ -4,6 +4,7 @@ import {
   bootstrapNpmPackages,
   NPM_BOOTSTRAP_DIST_TAG,
   NPM_BOOTSTRAP_VERSION,
+  NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS,
 } from '../bootstrap-npm-packages.js';
 import type { ReleasePackageInfo } from '../core.js';
 
@@ -70,6 +71,45 @@ describe('bootstrap npm packages', () => {
     expect(shell.prompts).toEqual([]);
   });
 
+  it('uploads every placeholder before polling all pending packages with backoff', async () => {
+    const shell = new RecordingBootstrapShell({
+      packages: [stable, missing],
+      existing: [],
+      visibleAfterChecks: { [stable.name]: 2, [missing.name]: 3 },
+    });
+
+    await bootstrapNpmPackages(shell, { dryRun: false, skipLogin: true, packages: [], otp: '111222' });
+
+    expect(shell.events).toEqual([
+      `publish:${stable.name}`,
+      `publish:${missing.name}`,
+      `view:${stable.name}:${NPM_BOOTSTRAP_VERSION}`,
+      `view:${missing.name}:${NPM_BOOTSTRAP_VERSION}`,
+      'wait:1000',
+      `view:${stable.name}:${NPM_BOOTSTRAP_VERSION}`,
+      `view:${missing.name}:${NPM_BOOTSTRAP_VERSION}`,
+      'wait:2000',
+      `view:${missing.name}:${NPM_BOOTSTRAP_VERSION}`,
+    ]);
+  });
+
+  it('times out after bounded backoff without suggesting another bootstrap', async () => {
+    const shell = new RecordingBootstrapShell({
+      packages: [missing],
+      existing: [],
+      visibleAfterChecks: { [missing.name]: Number.POSITIVE_INFINITY },
+    });
+
+    await expect(
+      bootstrapNpmPackages(shell, { dryRun: false, skipLogin: true, packages: [], otp: '111222' }),
+    ).rejects.toThrow('Retry smoo release trust-publisher later; do not bootstrap again.');
+
+    const waited = shell.events
+      .filter((event) => event.startsWith('wait:'))
+      .reduce((total, event) => total + Number(event.slice('wait:'.length)), 0);
+    expect(waited).toBe(NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS);
+  });
+
   it('rejects unknown package selections before npm login', async () => {
     const shell = new RecordingBootstrapShell({ packages: [stable], existing: [] });
 
@@ -82,6 +122,7 @@ describe('bootstrap npm packages', () => {
 });
 
 class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackageInfo> {
+  readonly events: string[] = [];
   readonly logs: string[] = [];
   readonly published: Array<{ name: string; otp: string }> = [];
   readonly prompts: string[] = [];
@@ -89,11 +130,19 @@ class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackag
   private readonly packages: ReleasePackageInfo[];
   private readonly existing: Set<string>;
   private readonly otps: string[];
-
-  constructor(options: { packages: ReleasePackageInfo[]; existing: string[]; otps?: string[] }) {
+  private readonly visibilityChecks = new Map<string, number>();
+  private readonly visibleAfterChecks: Readonly<Record<string, number>>;
+
+  constructor(options: {
+    packages: ReleasePackageInfo[];
+    existing: string[];
+    otps?: string[];
+    visibleAfterChecks?: Record<string, number>;
+  }) {
     this.packages = options.packages;
     this.existing = new Set(options.existing);
     this.otps = [...(options.otps ?? [])];
+    this.visibleAfterChecks = options.visibleAfterChecks ?? {};
   }
 
   listReleasePackages(): ReleasePackageInfo[] {
@@ -104,11 +153,19 @@ class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackag
     return this.existing.has(name);
   }
 
+  async packageVersionExists(name: string, version: string): Promise<boolean> {
+    this.events.push(`view:${name}:${version}`);
+    const checks = (this.visibilityChecks.get(name) ?? 0) + 1;
+    this.visibilityChecks.set(name, checks);
+    return checks >= (this.visibleAfterChecks[name] ?? 1);
+  }
+
   async login(): Promise<void> {
     this.logins += 1;
   }
 
   async publishPlaceholder(pkg: ReleasePackageInfo, env?: Record<string, string>): Promise<void> {
+    this.events.push(`publish:${pkg.name}`);
     this.published.push({ name: pkg.name, otp: env?.NPM_CONFIG_OTP ?? '' });
   }
 
@@ -121,6 +178,10 @@ class RecordingBootstrapShell implements BootstrapNpmPackagesShell<ReleasePackag
     return otp;
   }
 
+  async wait(milliseconds: number): Promise<void> {
+    this.events.push(`wait:${milliseconds}`);
+  }
+
   log(message: string): void {
     this.logs.push(message);
   }

package/src/release/bootstrap-npm-packages.ts

@@ -2,6 +2,9 @@ import type { ReleasePackageInfo } from './core.js';
 
 export const NPM_BOOTSTRAP_VERSION = '0.0.0-bootstrap.0';
 export const NPM_BOOTSTRAP_DIST_TAG = 'bootstrap';
+export const NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS = 120_000;
+
+const NPM_BOOTSTRAP_POLL_DELAYS_MS = [0, 1_000, 2_000, 4_000, 8_000, 15_000, 30_000, 30_000, 30_000] as const;
 
 export interface BootstrapNpmPackagesOptions {
   dryRun: boolean;
@@ -13,9 +16,11 @@ export interface BootstrapNpmPackagesOptions {
 export interface BootstrapNpmPackagesShell<Package extends ReleasePackageInfo = ReleasePackageInfo> {
   listReleasePackages(): Package[];
   packageExists(name: string): Promise<boolean>;
+  packageVersionExists(name: string, version: string): Promise<boolean>;
   login(): Promise<void>;
   publishPlaceholder(pkg: Package, env?: Record<string, string>): Promise<void>;
   promptOtp(packageName: string): Promise<string>;
+  wait(milliseconds: number): Promise<void>;
   log(message: string): void;
 }
 
@@ -54,15 +59,44 @@ export async function bootstrapNpmPackages<Package extends ReleasePackageInfo>(
   if (!options.skipLogin) {
     await shell.login();
   }
+  // Upload every placeholder before waiting for npm registry propagation. Keeping the
+  // phases separate prevents one slow package from blocking the remaining uploads.
   for (const pkg of missing) {
     shell.log(`${pkg.name}: publishing npm placeholder.`);
     const otp = options.otp ?? (await shell.promptOtp(pkg.name));
     await shell.publishPlaceholder(pkg, { NPM_CONFIG_OTP: otp });
   }
+
+  await waitForPublishedPackages(shell, missing);
   shell.log('Bootstrap complete. Run smoo release trust-publisher before the first CI publish.');
   return missing;
 }
 
+async function waitForPublishedPackages<Package extends ReleasePackageInfo>(
+  shell: BootstrapNpmPackagesShell<Package>,
+  packages: readonly Package[],
+): Promise<void> {
+  let pending = [...packages];
+  for (const delayMs of NPM_BOOTSTRAP_POLL_DELAYS_MS) {
+    if (delayMs > 0) {
+      await shell.wait(delayMs);
+    }
+    const visible = await Promise.all(
+      pending.map((pkg) => shell.packageVersionExists(pkg.name, NPM_BOOTSTRAP_VERSION)),
+    );
+    pending = pending.filter((_, index) => !visible[index]);
+    if (pending.length === 0) {
+      return;
+    }
+  }
+
+  throw new Error(
+    `Bootstrap uploads succeeded, but npm did not expose these packages after ${NPM_BOOTSTRAP_VISIBILITY_TIMEOUT_MS / 1_000} seconds: ${pending
+      .map((pkg) => pkg.name)
+      .join(', ')}. Retry smoo release trust-publisher later; do not bootstrap again.`,
+  );
+}
+
 function selectedReleasePackages<Package extends ReleasePackageInfo>(
   packages: Package[],
   selections: string[],

package/src/release/index.ts

@@ -4,6 +4,7 @@ import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
+import { setTimeout as delay } from 'node:timers/promises';
 import { $ } from 'bun';
 import typia from 'typia';
 import { githubCiApplyOutputs, githubCiNxRunMany } from '../github-ci/index.js';
@@ -251,9 +252,11 @@ export async function releaseTrustPublisher(root: string, options: ReleaseTrustP
           {
             listReleasePackages: () => listReleasePackages(root),
             packageExists: (name) => npmPackageExists(root, name),
+            packageVersionExists: (name, version) => npmPublishedVersionExists(root, name, version),
             login: () => runLatestNpm(root, ['login', '--auth-type=web']),
             publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
             promptOtp: (packageName) => promptForNpmOtp(packageName),
+            wait: delay,
             log: (message) => console.log(message),
           },
           bootstrapOptions,
@@ -460,9 +463,11 @@ export async function releaseBootstrapNpmPackages(
     {
       listReleasePackages: () => listReleasePackages(root),
       packageExists: (name) => npmPackageExists(root, name),
+      packageVersionExists: (name, version) => npmPublishedVersionExists(root, name, version),
       login: () => runLatestNpm(root, ['login', '--auth-type=web']),
       publishPlaceholder: (pkg, env) => publishPlaceholderPackage(root, pkg, env),
       promptOtp: (packageName) => promptForNpmOtp(packageName),
+      wait: delay,
       log: (message) => console.log(message),
     },
     {
@@ -1506,6 +1511,19 @@ async function npmPackageExists(root: string, name: string): Promise<boolean> {
   return result.exitCode === 0;
 }
 
+async function npmPublishedVersionExists(root: string, name: string, version: string): Promise<boolean> {
+  const spec = `${name}@${version}`;
+  const args = ['view', spec, 'version', '--json'];
+  const result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
+  if (result.exitCode === 0) {
+    return true;
+  }
+  if (/\bE404\b|404 Not Found/i.test(`${result.stdout}\n${result.stderr}`)) {
+    return false;
+  }
+  throw new Error(npmCommandFailedMessage(args, result.exitCode, result.stdout, result.stderr));
+}
+
 async function assertCleanGitTree(root: string): Promise<void> {
   const result = await $`git status --porcelain --untracked-files=no`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {