impel-cli 0.20.63-canary.5 → 0.20.63-canary.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63-canary.5",
+  "version": "0.20.63-canary.6",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/scripts/npm-dist-tags.mjs

@@ -5,6 +5,15 @@ import { fileURLToPath } from "node:url";
 
 const DIST_TAGS_URL = "https://registry.npmjs.org/-/package/impel-cli/dist-tags";
 
+// npm accepts a version and returns success before every registry edge exposes
+// its new dist-tag. The post-publish verifier therefore treats a stale canary
+// tag as propagation, not proof that npm publish failed. Five minutes stays
+// comfortably inside the publish job's 15-minute timeout.
+const CANARY_TAG_VERIFY_ATTEMPTS = 20;
+const CANARY_TAG_VERIFY_DELAY_MS = 15_000;
+
+class CanaryDistTagMismatchError extends Error {}
+
 export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
   const latest = tags.latest ?? "";
   const canary = tags.canary ?? "";
@@ -15,11 +24,46 @@ export function assertCanaryDistTags({ beforeLatest, expectedCanary, tags }) {
     );
   }
   if (canary !== expectedCanary) {
-    throw new Error(`dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`);
+    throw new CanaryDistTagMismatchError(
+      `dist-tags.canary is ${canary || "<none>"}, expected ${expectedCanary}.`,
+    );
   }
   return { latest, canary };
 }
 
+/**
+ * Verify npm's public dist-tags after publish while allowing the canary tag to
+ * propagate. A moved `latest` remains an immediate failure: that is a release
+ * invariant violation, not ordinary registry propagation.
+ */
+export async function verifyCanaryDistTags({
+  beforeLatest,
+  expectedCanary,
+  readTags = readDistTags,
+  attempts = CANARY_TAG_VERIFY_ATTEMPTS,
+  delayMs = CANARY_TAG_VERIFY_DELAY_MS,
+  sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+}) {
+  let lastObservedCanary = "";
+  let lastError;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const tags = await readTags({ bustCache: true });
+    try {
+      return assertCanaryDistTags({ beforeLatest, expectedCanary, tags });
+    } catch (error) {
+      if (!(error instanceof CanaryDistTagMismatchError)) throw error;
+      lastObservedCanary = tags.canary ?? "";
+      lastError = error;
+      if (attempt < attempts) await sleep(delayMs);
+    }
+  }
+  throw new Error(
+    `npm accepted the canary publish but did not expose it after ${attempts} dist-tag checks: `
+    + `${lastError?.message || `last dist-tags.canary was ${lastObservedCanary || "<none>"}.`} `
+    + "This is registry propagation lag, not an unpublished tarball.",
+  );
+}
+
 async function readDistTags({ allowMissing, bustCache = false } = {}) {
   const url = bustCache ? `${DIST_TAGS_URL}?t=${Date.now()}` : DIST_TAGS_URL;
   let lastError;
@@ -67,8 +111,7 @@ async function main([command, ...args]) {
   }
   if (command === "assert-canary" && args.length === 2) {
     const [expectedCanary, beforeLatest] = args;
-    const tags = await readDistTags({ bustCache: true });
-    const { latest } = assertCanaryDistTags({ expectedCanary, beforeLatest, tags });
+    const { latest } = await verifyCanaryDistTags({ expectedCanary, beforeLatest });
     appendSummary([
       "## Canary published",
       "",