fix(publish): skip already-published versions before type checking (#35134)

## Summary

`deno publish` previously type checked and prepared every package before
attempting to publish, only discovering that a version was already
published when the registry rejected the upload (the
`duplicateVersionPublish` path). For packages whose version is already
on the registry this wasted the entire — and expensive — type-check +
tarball step.

This adds the up-front check requested in #30280:

1. Probe the registry for each package's version concurrently.
2. Drop already-published versions before preparing anything. If
**every** version is already published, return early **without type
checking at all**.
3. Type check + prepare the remaining packages.
4. Publish — the existing post-prepare `duplicateVersionPublish`
handling still covers the race where another CI run lands the same
version in the meantime.

### Skip-and-continue, not bail

Following the feedback on the earlier #30347, already-published versions
are **skipped with a warning** (matching today's idempotent
`duplicateVersionPublish` behavior) rather than turned into a hard
error. This keeps workspace partial publishes and idempotent CI re-runs
working. Only a `200 OK` is treated as "already published"; a `404` (or
any other non-success status) is treated as "not published" so a
transient registry error never blocks a legitimate publish.

### Other changes

- Extracts shared helpers `registry::parse_package_name` and
`registry::get_package_version_api_url` (also used by
`publish_package`).
- Fixes a missing closing quote in the invalid-package-name error
message.

## Tests

- New spec test `tests/specs/publish/already_published` — publishing an
already-published version skips it and exits successfully without type
checking. The fake JSR registry now answers the version-existence `GET`
(404 by default; a reserved `already-published` scope simulates an
existing version).
- `registry::test_parse_package_name` unit test.
- Full `cargo test specs::publish` suite (64 tests) and `specs::init`
pass.

Closes #30280

Closes denoland/divybot#563

---------

Co-authored-by: divybot <divybot@users.noreply.github.com>
Co-authored-by: Divy Srivastava <me@littledivy.com>

Author: divybot

cli/registry.rs

@@ -1,5 +1,6 @@
 // Copyright 2018-2026 the Deno authors. MIT license.
 
+use deno_core::anyhow::bail;
 use deno_core::error::AnyError;
 use deno_core::serde_json;
 use deno_core::url::Url;
@@ -127,6 +128,26 @@ pub fn get_package_api_url(
   format!("{}scopes/{}/packages/{}", registry_api_url, scope, package)
 }
 
+pub fn get_package_version_api_url(
+  registry_api_url: &Url,
+  scope: &str,
+  package: &str,
+  version: &str,
+  params: Option<&str>,
+) -> String {
+  if let Some(params) = params {
+    format!(
+      "{}scopes/{}/packages/{}/versions/{}?{}",
+      registry_api_url, scope, package, version, params
+    )
+  } else {
+    format!(
+      "{}scopes/{}/packages/{}/versions/{}",
+      registry_api_url, scope, package, version
+    )
+  }
+}
+
 pub async fn get_package(
   client: &HttpClient,
   registry_api_url: &Url,
@@ -138,6 +159,43 @@ pub async fn get_package(
   Ok(response)
 }
 
+/// Splits a fully qualified JSR package name (e.g. `@scope/package`) into its
+/// `(scope, package)` parts.
+pub fn parse_package_name(name: &str) -> Result<(&str, &str), AnyError> {
+  let Some((scope, package)) = name
+    .strip_prefix('@')
+    .and_then(|no_at| no_at.split_once('/'))
+  else {
+    bail!("Invalid package name, use '@<scope_name>/<package_name>' format");
+  };
+  Ok((scope, package))
+}
+
+/// Returns `true` if the given package version is already published to the
+/// registry.
+///
+/// Only a `200 OK` response is treated as "already published". A `404` (and any
+/// other non-success status) is treated as "not published" so that this
+/// up-front optimization never blocks a legitimate publish because of a
+/// transient registry error.
+pub async fn check_version_exists(
+  client: &HttpClient,
+  registry_api_url: &Url,
+  scope: &str,
+  package: &str,
+  version: &str,
+) -> Result<bool, AnyError> {
+  let url = get_package_version_api_url(
+    registry_api_url,
+    scope,
+    package,
+    version,
+    None,
+  );
+  let response = client.get(url.parse()?)?.send().await?;
+  Ok(response.status() == 200)
+}
+
 pub fn get_jsr_alternative(imported: &Url) -> Option<String> {
   if matches!(imported.host_str(), Some("esm.sh")) {
     let mut segments = imported.path_segments()?;
@@ -197,4 +255,11 @@ mod test {
       Some("\"jsr:@std/path@1/something-underscore\""),
     );
   }
+
+  #[test]
+  fn test_parse_package_name() {
+    assert_eq!(parse_package_name("@deno/doc").unwrap(), ("deno", "doc"));
+    assert!(parse_package_name("deno/doc").is_err());
+    assert!(parse_package_name("@deno").is_err());
+  }
 }

cli/tools/publish/mod.rs

@@ -123,6 +123,28 @@ pub async fn publish(
     }
   }
 
+  // Bail out early if the version is already published, before doing the
+  // expensive type checking and tarball preparation. Already-published
+  // versions are skipped with a warning (rather than erroring) so that
+  // re-running `deno publish` after a partial or concurrent publish still
+  // succeeds, matching the idempotent behavior of the publish step itself.
+  if !publish_flags.dry_run {
+    publish_configs = filter_out_published_packages(
+      &cli_factory.http_client_provider().get_or_create()?,
+      jsr_api_url(),
+      publish_configs,
+    )
+    .await?;
+
+    if publish_configs.is_empty() {
+      log::info!(
+        "{} All packages are already published",
+        colors::green("Success"),
+      );
+      return Ok(());
+    }
+  }
+
   let specifier_unfurler = SpecifierUnfurler::new(
     cli_factory.node_resolver().await?.clone(),
     cli_factory.npm_req_resolver().await?.clone(),
@@ -205,6 +227,51 @@ pub async fn publish(
   Ok(())
 }
 
+/// Queries the registry for each package's version concurrently and returns the
+/// subset of configs whose versions are not yet published. Already-published
+/// versions are reported with a warning and dropped from the returned list.
+async fn filter_out_published_packages(
+  client: &HttpClient,
+  registry_api_url: &Url,
+  publish_configs: Vec<JsrPackageConfig>,
+) -> Result<Vec<JsrPackageConfig>, AnyError> {
+  let checks = publish_configs.iter().map(|config| async move {
+    let Some(version) = config.config_file.json.version.as_deref() else {
+      // a missing version is reported with a better error later on
+      return Ok::<bool, AnyError>(false);
+    };
+    let Ok((scope, package)) = registry::parse_package_name(&config.name)
+    else {
+      // an invalid package name is reported with a better error later on
+      return Ok(false);
+    };
+    registry::check_version_exists(
+      client,
+      registry_api_url,
+      scope,
+      package,
+      version,
+    )
+    .await
+  });
+  let results = deno_core::futures::future::join_all(checks).await;
+
+  let mut remaining = Vec::with_capacity(publish_configs.len());
+  for (config, already_published) in publish_configs.into_iter().zip(results) {
+    if already_published? {
+      log::info!(
+        "{} {}@{}",
+        colors::yellow("Warning: Skipping, already published"),
+        config.name,
+        config.config_file.json.version.as_deref().unwrap_or(""),
+      );
+    } else {
+      remaining.push(config);
+    }
+  }
+  Ok(remaining)
+}
+
 struct PreparedPublishPackage {
   scope: String,
   package: String,
@@ -427,12 +494,7 @@ impl PublishPreparer {
         deno_json.specifier
       )
     })?;
-    let Some(name_no_at) = package.name.strip_prefix('@') else {
-      bail!("Invalid package name, use '@<scope_name>/<package_name> format");
-    };
-    let Some((scope, name_no_scope)) = name_no_at.split_once('/') else {
-      bail!("Invalid package name, use '@<scope_name>/<package_name> format");
-    };
+    let (scope, name_no_scope) = registry::parse_package_name(&package.name)?;
     let file_patterns = package.member_dir.to_publish_config()?.files;
 
     let tarball = deno_core::unsync::spawn_blocking({
@@ -925,13 +987,12 @@ async fn publish_package(
     package.version
   );
 
-  let url = format!(
-    "{}scopes/{}/packages/{}/versions/{}?config=/{}",
+  let url = registry::get_package_version_api_url(
     registry_api_url,
-    package.scope,
-    package.package,
-    package.version,
-    package.config
+    &package.scope,
+    &package.package,
+    &package.version,
+    Some(&format!("config=/{}", package.config)),
   );
 
   let body = deno_fetch::ReqBody::full(package.tarball.bytes.clone());

tests/specs/init/lib/dry_publish.out

@@ -4,4 +4,4 @@ Check [WILDCARD]mod.ts
 error: Failed preparing 'project'.
 
 Caused by:
-    Invalid package name, use '@<scope_name>/<package_name> format
+    Invalid package name, use '@<scope_name>/<package_name>' format

tests/specs/publish/already_published/__test__.jsonc

@@ -0,0 +1,4 @@
+{
+  "args": "publish --token 'sadfasdf'",
+  "output": "publish.out"
+}

tests/specs/publish/already_published/deno.json

@@ -0,0 +1,7 @@
+{
+  "name": "@already-published/pkg",
+  "version": "1.0.0",
+  "exports": {
+    ".": "./mod.ts"
+  }
+}

tests/specs/publish/already_published/mod.ts

@@ -0,0 +1,3 @@
+export function add(a: number, b: number): number {
+  return a + b;
+}

tests/specs/publish/already_published/publish.out

@@ -0,0 +1,2 @@
+Warning: Skipping, already published @already-published/pkg@1.0.0
+Success All packages are already published

tests/util/server/servers/jsr_registry.rs

@@ -13,6 +13,7 @@ use bytes::Bytes;
 use http_body_util::Empty;
 use http_body_util::Full;
 use http_body_util::combinators::UnsyncBoxBody;
+use hyper::Method;
 use hyper::Request;
 use hyper::Response;
 use hyper::StatusCode;
@@ -120,6 +121,28 @@ async fn registry_server_handler(
     let body = serde_json::to_string_pretty(&json!({})).unwrap();
     let res = Response::new(UnsyncBoxBody::new(Full::from(body)));
     return Ok(res);
+  } else if req.method() == Method::GET
+    && let Some(rest) = path.strip_prefix("/api/scopes/")
+    && let [scope, "packages", package, "versions", version] =
+      rest.split('/').collect::<Vec<_>>().as_slice()
+  {
+    // `deno publish` probes this endpoint up front to skip already-published
+    // versions. Report "not published" (404) by default; the reserved
+    // `already-published` scope lets tests simulate an existing version.
+    if *scope == "already-published" {
+      let body = serde_json::to_string_pretty(&json!({
+        "scope": scope,
+        "package": package,
+        "version": version,
+      }))
+      .unwrap();
+      let res = Response::new(UnsyncBoxBody::new(Full::from(body)));
+      return Ok(res);
+    }
+    let res = Response::builder()
+      .status(StatusCode::NOT_FOUND)
+      .body(UnsyncBoxBody::new(Empty::new()))?;
+    return Ok(res);
   } else if path.starts_with("/api/scopes/") {
     let body = serde_json::to_string_pretty(&json!({
       "id": "sdfwqer-sffg-qwerasdf",