ci: gate npm publishes on dependency propagation

[fengmk2]

Summary

• publish native packages, core, and vite-plus in explicit dependency tiers
• poll npm install metadata and tarballs before moving to dependent tiers
• add a post-propagation settle period for other registry CDN edges
• make every publish idempotent so failed release jobs can be retried safely

Why

npm publish-time scanning means a successful publish command no longer guarantees that the version and tarball are immediately installable. Since Vite+ packages pin workspace and platform dependencies to exact versions, publishing a dependent before those versions propagate can temporarily break installs.

The release now waits for each dependency tier to become installable. On retry, versions already visible in npm are skipped; versions accepted by npm but still hidden by scanning are recognized through npm immutable-version errors. Genuine authentication and publish failures still stop the release.

Validation

• 13 focused script tests passed
• Oxlint passed with warnings denied
• TypeScript syntax and workflow YAML checks passed
• live read-only npm probes passed for visible-version skipping and hidden-version retry handling

References

• [ci] Publish packages in dependency-tier order with propagation gates cloudflare/workers-sdk#15166
• https://github.com/orgs/community/discussions/203413

[netlify]

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	71483c9
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a98d8b0df2d730008fdd32a

[cloudflare-workers-and-pages]

🚀 Deploying Preview to Cloudflare 🚀

Preview Deployments by commit

Status	Deployment URL	Commit	Updated (UTC)	See this deployment's details
Build: Failed ❌ View logs ↗		71483c9	2026-09-03T02:17:37.101Z	View logs ↗