From 3d0b024651228190b73369b41cc2efc2691ffbce Mon Sep 17 00:00:00 2001
From: Jeremy McSpadden <jeremy@fluxlabs.net>
Date: Sun, 14 Jun 2026 18:16:28 -0500
Subject: [PATCH] fix: wait for trusted publish propagation

---
 .github/workflows/npm-publish.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml
index 6df6c93..4d093c4 100644
--- a/.github/workflows/npm-publish.yml
+++ b/.github/workflows/npm-publish.yml
@@ -717,7 +717,14 @@ jobs:
           unset NODE_AUTH_TOKEN
           npm config delete //registry.npmjs.org/:_authToken || true
           npm publish --access public --provenance --tag latest
-          TAGGED=$(npm view "@opengsd/gsd-browser" "dist-tags.latest" 2>/dev/null || true)
+          for ATTEMPT in $(seq 1 24); do
+            TAGGED=$(npm view "@opengsd/gsd-browser" "dist-tags.latest" 2>/dev/null || true)
+            if [ "${TAGGED}" = "${VERSION}" ]; then
+              break
+            fi
+            echo "Waiting for npm @latest propagation (${ATTEMPT}/24): currently '${TAGGED:-<unset>}'."
+            sleep 5
+          done
           if [ "${TAGGED}" != "${VERSION}" ]; then
             echo "::error::@latest points to '${TAGGED:-<unset>}' not ${VERSION} after trusted publish."
             exit 1