fix(release): retry published verification on npm lag

Author: Gaubee

scripts/release/verify-published.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from "bun:test";
 
-import { selectPackageDirsForVerification } from "./verify-published";
+import { readPublishedPackageWithRetry, selectPackageDirsForVerification } from "./verify-published";
 import type { ReleasePublishReport } from "./publish-bundles";
 
 describe("Feature: published release verification scope", () => {
@@ -35,7 +35,7 @@ describe("Feature: published release verification scope", () => {
     ).toEqual(["bundle/agenter"]);
   });
 
-  test("Scenario: Given a report contains no newly published packages When verification scope is resolved Then the verifier falls back to the full release order", () => {
+  test("Scenario: Given a rerun report contains no newly published packages When verification scope is resolved Then the verifier keeps scope at the current attempt write set instead of widening to historical packages", () => {
     const report = {
       generatedAt: "2026-06-04T00:00:00.000Z",
       packages: [
@@ -48,9 +48,48 @@ describe("Feature: published release verification scope", () => {
       ],
     } satisfies ReleasePublishReport;
 
-    expect(selectPackageDirsForVerification(report, ["bundle/@jixo/ghostty-native", "bundle/agenter"])).toEqual([
-      "bundle/@jixo/ghostty-native",
-      "bundle/agenter",
-    ]);
+    expect(selectPackageDirsForVerification(report, ["bundle/@jixo/ghostty-native", "bundle/agenter"])).toEqual([]);
+  });
+
+  test("Scenario: Given npm registry propagation lags a newly published package When release verification reads package metadata Then bounded E404 retries wait for the visible version instead of failing immediately", async () => {
+    const calls: string[] = [];
+    const sleeps: number[] = [];
+    let attempts = 0;
+
+    const payload = await readPublishedPackageWithRetry("agenter", "0.0.12", {
+      retryDelaysMs: [10, 20],
+      runView: async () => {
+        calls.push("runView");
+        attempts += 1;
+        if (attempts < 3) {
+          throw new Error("npm view failed for agenter@0.0.12: npm error code E404\nnpm error 404 No match found for version 0.0.12");
+        }
+        return { version: "0.0.12" };
+      },
+      sleep: async (delayMs) => {
+        sleeps.push(delayMs);
+      },
+    });
+
+    expect(payload.version).toBe("0.0.12");
+    expect(calls).toHaveLength(3);
+    expect(sleeps).toEqual([10, 20]);
+  });
+
+  test("Scenario: Given npm view fails for a non-propagation reason When release verification reads package metadata Then the verifier fails immediately instead of masking the publish error", async () => {
+    const sleeps: number[] = [];
+
+    await expect(
+      readPublishedPackageWithRetry("agenter", "0.0.12", {
+        retryDelaysMs: [10, 20],
+        runView: async () => {
+          throw new Error("npm view failed for agenter@0.0.12: npm error code E403");
+        },
+        sleep: async (delayMs) => {
+          sleeps.push(delayMs);
+        },
+      }),
+    ).rejects.toThrow("npm error code E403");
+    expect(sleeps).toEqual([]);
   });
 });

scripts/release/verify-published.ts

@@ -9,6 +9,7 @@ type NpmViewPayload = Partial<
 >;
 
 const repoRoot = resolve(import.meta.dir, "../..");
+const verifyPublishedRetryDelaysMs = [2_000, 4_000, 8_000, 16_000] as const;
 
 const readPackageJson = async (packageDir: string): Promise<ReleasePackageJson> =>
   (await Bun.file(join(packageDir, "package.json")).json()) as ReleasePackageJson;
@@ -28,10 +29,12 @@ export const selectPackageDirsForVerification = (
   if (!report) {
     return packageDirs;
   }
-  const publishedPackageDirs = report.packages
+  // The publish report is the attempt-scoped truth. Verification only follows
+  // package writes performed by this attempt and must not widen itself back to
+  // historical packages on reruns where every package is already published.
+  return report.packages
     .filter((entry) => entry.status === "published")
     .map((entry) => entry.packageDir);
-  return publishedPackageDirs.length > 0 ? publishedPackageDirs : packageDirs;
 };
 
 const normalizeRecord = (record: Record<string, string> | undefined): Record<string, string> | undefined => {
@@ -78,6 +81,45 @@ const runNpmView = async (name: string, version: string): Promise<NpmViewPayload
   return typeof payload === "string" ? { version: payload } : payload;
 };
 
+const isRetryableNpmViewError = (error: unknown): error is Error => {
+  if (!(error instanceof Error)) {
+    return false;
+  }
+  return error.message.includes("npm error code E404") || error.message.includes("No match found for version");
+};
+
+type ReadPublishedPackageOptions = {
+  readonly retryDelaysMs?: readonly number[];
+  readonly runView?: typeof runNpmView;
+  readonly sleep?: (delayMs: number) => Promise<void>;
+};
+
+export const readPublishedPackageWithRetry = async (
+  name: string,
+  version: string,
+  options: ReadPublishedPackageOptions = {},
+): Promise<NpmViewPayload> => {
+  const retryDelaysMs = options.retryDelaysMs ?? verifyPublishedRetryDelaysMs;
+  const runView = options.runView ?? runNpmView;
+  const sleep = options.sleep ?? Bun.sleep;
+
+  for (const [attemptIndex, retryDelayMs] of retryDelaysMs.entries()) {
+    try {
+      return await runView(name, version);
+    } catch (error) {
+      if (!isRetryableNpmViewError(error)) {
+        throw error;
+      }
+      console.warn(
+        `npm view for ${name}@${version} is not visible yet; retrying in ${retryDelayMs}ms (${attemptIndex + 1}/${retryDelaysMs.length})`,
+      );
+      await sleep(retryDelayMs);
+    }
+  }
+
+  return await runView(name, version);
+};
+
 const verifyPackage = async (packageDir: string): Promise<void> => {
   const absolutePackageDir = join(repoRoot, packageDir);
   const packageJsonPath = join(absolutePackageDir, "package.json");
@@ -86,7 +128,7 @@ const verifyPackage = async (packageDir: string): Promise<void> => {
   }
 
   const expected = await readPackageJson(absolutePackageDir);
-  const actual = await runNpmView(expected.name, expected.version);
+  const actual = await readPublishedPackageWithRetry(expected.name, expected.version);
   if (actual.version !== expected.version) {
     throw new Error(
       `${expected.name} version mismatch: expected ${expected.version}, got ${actual.version ?? "<missing>"}`,