[betimd]

The red publish-npm run on 0.2.1 is a duplicate run, not a failed release. All three packages are on npm at 0.2.1, published by the first run, and the bundle fix is in the tarball.

What happened. release-please published three GitHub releases at 22:30, one per linked package, so publish-npm was triggered three times:

1. 22:30:03 — success. It published voice-client-core, voice-client and voice-client-react 0.2.1 over OIDC. This is the first automatic trusted publish that worked.
2. 22:30:04 — cancelled. It was the pending run, replaced by the third under the publish-npm concurrency group.
3. 22:30:06 — failure. It ran after the first finished. npm view still answered "not published" for voice-client-core@0.2.1, because the registry lagged, so it tried to publish and npm refused with E409 Cannot publish over previously staged version.

Fix:

• publish-npm.yml: only voice-client's release runs the job; the other two show as skipped. That's enough because the three share one version and bin/publish-npm publishes every package whose version is new. The concurrency group stays, for a manual run that overlaps one.
• bin/publish-npm:
  • the already-published check uses --prefer-online;
  • when a publish fails, it checks again for up to 30 s before failing. A version that is there counts as published, and the loop moves on to the next package.

I tested the loop with stubbed npm and pnpm: the first package fails with E409 and is found on the second check, then the second package publishes, and the run exits 0.

The ci: commit makes no release.