fix: validate JSR token before publishing snapshots

[jumski]

Why

A snapshot run with a stale JSR_TOKEN gets past the script's auth pre-check
("✓ jsr: authenticated (via token)"), publishes the npm half successfully, and
then dies on the JSR half:

error: Failed to publish @pgflow/edge-worker@...
Caused by:
    1: The provided bearer token is invalid. (invalidBearerToken)

Root cause of the false positive: the pre-check runs
deno publish --dry-run, which never contacts the registry. Verified
locally — with a garbage token:

$ pnpm jsr publish --dry-run --allow-slow-types --allow-dirty --token jsrp_fakefakefake
Success Dry run complete
exit=0

The result is a half-published snapshot (npm version exists, JSR version
doesn't) and a worktree stuck on the versioned files.

Bonus leak: on publish failure the jsr npm wrapper console.logs the full
deno command line (dist/utils.js:272), including --token jsrp_…, so the
token ends up in terminal output, CI logs, and bug reports.

What

• When JSR_TOKEN is set: validate it up front with a real API call
  (GET https://api.jsr.io/user, expects 200) and exit 1 with a clear
  "rotate the token" message before any versioning/build/publishing happens
• No-token path: keep the dry-run + deno login browser flow; extend the
  failure grep with invalidBearerToken
• Redact jsrp_… tokens from the JSR publish output (stdout and stderr)

Verification

• bash -n scripts/snapshot-release.sh
• extracted auth block, run standalone:
  • JSR_TOKEN=jsrp_fake… → Error: JSR_TOKEN is invalid or expired (api.jsr.io: 401) + exit 1
  • no token → ✓ jsr: authenticated (existing session) + exit 0
• redaction on the real leaked line from the failing run:
  --token jsrp_dI7… → --token jsrp_[REDACTED]

[changeset-bot]

⚠️ No Changeset found

Latest commit: febc643

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[jumski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• fix: validate JSR token before publishing snapshots #642 👈 (View in Graphite)
• fix: drop commented import from flows index template #641
• fix: publish snapshots with pnpm #640
• fix: handle stop during startup with safe state transitions and hard-exit #639
• fix: preserve portable worker compatibility #633
• fix: make startOnlyOnce awaitable, deduplicate stop calls, and add packed-tarball smoke test #632
• feat: add portable runtime e2e tests and worker replacement on deprecation #631
• docs: add Node and Bun process worker deployment guide #630
• ci: add edge-worker Bun smoke test job #629
• feat: publish @pgflow/edge-worker to npm with Node/Bun process runtime support #628
• feat: add ProcessPlatformAdapter for Node.js process environments #627
• feat: add start_mode to worker functions to skip HTTP pings for process workers #626
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit febc643

Command	Status	Duration	Result
nx run edge-worker:e2e	✅ Succeeded	7m 36s	View ↗
nx run edge-worker:test:integration	✅ Succeeded	4m 28s	View ↗
nx run client:e2e	✅ Succeeded	1m 15s	View ↗
nx run edge-worker:e2e:portable-runtimes	✅ Succeeded	54s	View ↗
nx run cli:e2e	✅ Succeeded	4s	View ↗
nx affected -t verify-exports --base=origin/mai...	✅ Succeeded	3s	View ↗
nx affected -t build --configuration=production...	✅ Succeeded	3s	View ↗
nx affected -t lint typecheck test --parallel -...	✅ Succeeded	25s	View ↗
Additional runs (2)	✅ Succeeded	...	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-08-20 21:52:11 UTC

[graphite-app]

Process substitution race condition causing incomplete output

The process substitutions > >(sed...) and 2> >(sed...) spawn background processes. The if statement evaluates the exit code of the subshell immediately, but bash does not automatically wait for these background sed processes to complete. This creates a race condition where:

1. The script continues execution before output is fully redacted/written
2. Output may be truncated or appear out of order
3. The script could exit before redaction completes, losing output entirely

Fix: Store output to variables first, then redact:

OUTPUT=$(cd pkgs/edge-worker && $JSR_PUBLISH_CMD 2>&1)
EXIT_CODE=$?
echo "$OUTPUT" | sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g'
if [[ $EXIT_CODE -eq 0 ]]; then

Or use a temporary file to capture output, then cat it through sed synchronously.

Suggested change

	if ( cd pkgs/edge-worker && $JSR_PUBLISH_CMD ) \
	> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g') \
	2> >(sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g' >&2) ; then
	OUTPUT=$(cd pkgs/edge-worker && $JSR_PUBLISH_CMD 2>&1)
	EXIT_CODE=$?
	echo "$OUTPUT" | sed -E 's/jsrp_[A-Za-z0-9]+/jsrp_[REDACTED]/g'
	if [[ $EXIT_CODE -eq 0 ]]; then

Spotted by Graphite



Is this helpful? React 👍 or 👎 to let us know.

[github-actions]

🔍 Preview Deployment: Website

✅ Deployment successful!

🔗 Preview URL: https://pr-642.pgflow.pages.dev

📝 Details:

• Branch: portable-worker-jsr-auth
• Commit: 5e0ddb55b88b9d21deba7cac0bb6f1b9509c1269
• View Logs

_Last updated: _