fix(release): wait for npm to serve platform packages before publishing t3

.github/workflows/release.yml

@@ -709,7 +709,9 @@ jobs:
       ]
     if: ${{ !failure() && !cancelled() && needs.preflight.result == 'success' && needs.relay_public_config.result == 'success' && needs.quality.result == 'success' && needs.test.result == 'success' && needs.test_server.result == 'success' && needs.desktop_mac_arm64.result == 'success' && needs.desktop_linux_x64.result == 'success' && needs.desktop_linux_arm64.result == 'success' && needs.desktop_win_x64.result == 'success' && needs.desktop_win_arm64.result == 'success' }}
     runs-on: ubuntu-24.04 # blacksmith-8vcpu-ubuntu-2404
-    timeout-minutes: 15
+    # The publish step waits up to READY_DEADLINE (apps/server/scripts/publishOrder.ts)
+    # for npm to serve the platform packages before it publishes t3.
+    timeout-minutes: 35
     permissions:
       contents: read
       id-token: write

apps/server/scripts/cli.ts

@@ -6,7 +6,9 @@ import * as FileSystem from "effect/FileSystem";
 import * as Logger from "effect/Logger";
 import * as Option from "effect/Option";
 import * as Path from "effect/Path";
+import * as Stream from "effect/Stream";
 import { Command, Flag } from "effect/cli";
+import { FetchHttpClient } from "effect/http";
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 
 import { DEVELOPMENT_ICON_OVERRIDES } from "../../../scripts/lib/brand-assets.ts";
@@ -19,7 +21,12 @@ import {
   ServerCliDevelopmentIconTargetMissingError,
   ServerCliExecutableImportError,
 } from "./cliErrors.ts";
-import { publishPlatformsThenLauncher } from "./publishOrder.ts";
+import {
+  checkNpmVersionInstallable,
+  npmPublishRegistry,
+  publishPlatformsThenLauncher,
+  readLauncherPlatformPackages,
+} from "./publishOrder.ts";
 
 const RepoRoot = Effect.service(Path.Path).pipe(
   Effect.flatMap((path) => path.fromFileUrl(new URL("../../..", import.meta.url))),
@@ -40,6 +47,40 @@ const runCommand = Effect.fn("runCommand")(function* (command: ChildProcess.Stan
   }
 });
 
+// What `npm config get <keys>` prints in `cwd`, where `npm publish` runs, so
+// it reads the same .npmrc files and npm_config_* variables. npm exits non-zero
+// rather than print a protected value (a URL password, a UUID or an `npm_`
+// token), which stops the publish before any upload; configure such a registry
+// without them.
+const npmConfigGet = Effect.fn("npmConfigGet")(function* (
+  cwd: string,
+  keys: ReadonlyArray<string>,
+) {
+  const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+  const spawnCommand = yield* resolveSpawnCommand("npm", ["config", "get", ...keys]);
+  const child = yield* spawner.spawn(
+    ChildProcess.make(spawnCommand.command, spawnCommand.args, {
+      cwd,
+      stdin: "ignore",
+      stderr: "inherit",
+      shell: spawnCommand.shell,
+    }),
+  );
+  const [printed, exitCode] = yield* Effect.all(
+    [child.stdout.pipe(Stream.decodeText(), Stream.mkString), child.exitCode],
+    { concurrency: "unbounded" },
+  );
+  if (exitCode !== 0) {
+    return yield* new ServerCliCommandExitError({
+      command: spawnCommand.command,
+      args: spawnCommand.args,
+      cwd,
+      exitCode,
+    });
+  }
+  return printed;
+}, Effect.scoped);
+
 const applyDevelopmentIconOverrides = Effect.fn("applyDevelopmentIconOverrides")(function* (
   repoRoot: string,
   serverDir: string,
@@ -170,6 +211,9 @@ const buildExeCmd = Command.make(
  * Publishes the tarballs scripts/build-npm-platform-packages.ts produced:
  * every `@t3code/t3-<platform>.tgz` first, `t3.tgz` (the launcher) last, so
  * the launcher is never installable before the executables it depends on.
+ * Before the launcher, it waits up to `READY_DEADLINE` (publishOrder.ts) for
+ * npm to serve each platform version, since an upload can 404 for minutes
+ * after it succeeds.
  * Tarballs rather than directories because `npm publish <dir>` strips the
  * `node_modules/` the executable loads its native addons from.
  */
@@ -208,6 +252,21 @@ const publishCmd = Command.make(
       if (!(yield* fs.exists(launcherTarball))) {
         return yield* new ServerCliBuildAssetMissingError({ assetPath: launcherTarball });
       }
+      const platformPackages = yield* readLauncherPlatformPackages(
+        path.join(packagesDir, "t3", "package.json"),
+      );
+      for (const { name } of platformPackages) {
+        const tarball = path.join(packagesDir, `${name}.tgz`);
+        if (!platformTarballs.includes(tarball)) {
+          return yield* new ServerCliBuildAssetMissingError({ assetPath: tarball });
+        }
+      }
+
+      // A real run checks for the platform packages where npm publishes them,
+      // read before any upload. A dry run checks nothing.
+      const registry = config.dryRun
+        ? ""
+        : yield* npmPublishRegistry((keys) => npmConfigGet(packagesDir, keys));
 
       const args = ["publish", "--access", config.access, "--tag", config.tag];
       if (config.provenance) args.push("--provenance");
@@ -227,7 +286,14 @@ const publishCmd = Command.make(
       });
 
       // Each publish takes about 17s, so the platform packages go at once.
-      yield* publishPlatformsThenLauncher({ platformTarballs, launcherTarball, publish });
+      yield* publishPlatformsThenLauncher({
+        platformTarballs,
+        launcherTarball,
+        publish,
+        dryRun: config.dryRun,
+        platformPackages,
+        checkInstallable: (pkg) => checkNpmVersionInstallable(registry, pkg),
+      }).pipe(Effect.provide(FetchHttpClient.layer));
     }),
 ).pipe(
   Command.withDescription(

apps/server/scripts/cliErrors.ts

@@ -40,13 +40,64 @@ export class ServerCliBuildAssetMissingError extends Schema.TaggedError<ServerCl
   "ServerCliBuildAssetMissingError",
   {
     assetPath: Schema.String,
+    cause: Schema.optional(Schema.Defect()),
   },
 ) {
   override get message(): string {
     return `Missing build asset: ${this.assetPath}. Run the build subcommand first.`;
   }
 }
 
+export class ServerCliLauncherManifestInvalidError extends Schema.TaggedError<ServerCliLauncherManifestInvalidError>()(
+  "ServerCliLauncherManifestInvalidError",
+  {
+    assetPath: Schema.String,
+    cause: Schema.Defect(),
+  },
+) {
+  override get message(): string {
+    return `Invalid launcher package manifest: ${this.assetPath}`;
+  }
+}
+
+export class ServerCliNpmRegistryInvalidError extends Schema.TaggedError<ServerCliNpmRegistryInvalidError>()(
+  "ServerCliNpmRegistryInvalidError",
+  {
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return "Cannot tell which http or https registry npm publishes @t3code packages to. Check the registry settings in `npm config list`.";
+  }
+}
+
+export class ServerCliNpmPackageNotReadyError extends Schema.TaggedError<ServerCliNpmPackageNotReadyError>()(
+  "ServerCliNpmPackageNotReadyError",
+  {
+    packageSpec: Schema.String,
+    reason: Schema.String,
+    cause: Schema.optional(Schema.Defect()),
+  },
+) {
+  override get message(): string {
+    return `${this.packageSpec} is not installable yet: ${this.reason}`;
+  }
+}
+
+export class ServerCliNpmPackagesNotInstallableError extends Schema.TaggedError<ServerCliNpmPackagesNotInstallableError>()(
+  "ServerCliNpmPackagesNotInstallableError",
+  {
+    pending: Schema.Array(Schema.String),
+    launcherTarball: Schema.String,
+    deadline: Schema.String,
+  },
+) {
+  override get message(): string {
+    const launcher = this.launcherTarball.split(/[\\/]/).at(-1);
+    return `npm did not serve these platform packages within ${this.deadline}: ${this.pending.join("; ")}. ${launcher} was not published. The platform versions are already published and npm will not accept them again, so re-running this job fails. See "CLI publish timeout" in docs/operations/release.md.`;
+  }
+}
+
 export class ServerCliExecutableImportError extends Schema.TaggedError<ServerCliExecutableImportError>()(
   "ServerCliExecutableImportError",
   {