@@ -163,6 +163,11 @@ jobs:
     name: Publish (NPM)
     needs: ['build', 'test', 'browser']
     if: ${{ github.ref == 'refs/heads/main' || github.event_name == 'release' }}
+    # One canary publish at a time, so the check below reads the canary the previous one published.
+    concurrency:
+      group: ${{ github.event_name == 'release' && github.run_id || 'canary-publish' }}
+      cancel-in-progress: false
+      queue: max
     steps:
       - name: Setup node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -175,7 +180,37 @@ jobs:
         with:
           name: angularfire-${{ github.run_id }}
           path: dist
+      - name: Skip a canary that is not newer than npm's
+        id: canary_check
+        run: |
+          VERSION=$(node -p "require('./dist/packages-dist/package.json').version")
+          if [[ $VERSION == *-canary.* ]]; then
+            # The dist-tags endpoint is not CDN-cached, unlike the package data `npm view` reads.
+            DIST_TAGS=$(curl -fsS --retry 3 --max-time 30 https://registry.npmjs.org/-/package/@angular/fire/dist-tags)
+            NPM_CANARY=$(node -p "JSON.parse(process.argv[1]).canary" "$DIST_TAGS")
+            # Order by position on main, not by version, which can be higher for an older commit.
+            git clone --quiet --bare --filter=tree:0 "$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" history.git
+            HOW_TO_FIX="Every canary publish fails until the canary dist-tag points at a build of a commit on main. Publish rights are required to fix it with: npm dist-tag add @angular/fire@<version> canary"
+            if ! NPM_CANARY_COMMIT=$(git -C history.git rev-parse --verify --quiet "${NPM_CANARY##*[.-]}^{commit}"); then
+              echo "::error::Could not match the canary on npm, $NPM_CANARY, to a single commit in this repository. $HOW_TO_FIX"
+              exit 1
+            fi
+            # `npm publish` always moves a dist-tag, so a canary that is not newer must not publish at all.
+            if [[ $NPM_CANARY_COMMIT == "$GITHUB_SHA" ]]; then
+              if [[ $VERSION == "$NPM_CANARY" ]]; then
+                echo "::notice::Not publishing $VERSION, because it is already the canary on npm."
+                echo "skip=true" >> "$GITHUB_OUTPUT"
+              fi
+            elif git -C history.git merge-base --is-ancestor "$GITHUB_SHA" "$NPM_CANARY_COMMIT"; then
+              echo "::warning::Not publishing $VERSION, because the canary on npm, $NPM_CANARY, is from a later commit on main."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+            elif ! git -C history.git merge-base --is-ancestor "$NPM_CANARY_COMMIT" "$GITHUB_SHA"; then
+              echo "::error::Not publishing $VERSION, because its commit and the commit of the canary on npm, $NPM_CANARY, are not on the same line of history. One of them is not on main. $HOW_TO_FIX"
+              exit 1
+            fi
+          fi
       - name: Publish
+        if: steps.canary_check.outputs.skip != 'true'
         run: |
           cd ./dist/packages-dist
           chmod +x publish.sh
 
@@ -9,14 +9,12 @@ if [[ $GITHUB_REF =~ $TAG_TEST ]]; then
         NPM_TAG=next
     fi;
 else
-    FULL_VERSION=$(node -e "console.log(require('./package.json').version)")
-    # Name the canary after the release itself, never after a prerelease of it. A canary built on
-    # `21.0.0-rc.1` sorts above it, so the caret range `ng add` writes into a user's package.json
-    # resolves to the canary rather than to the release candidate they asked for.
-    BASE_VERSION=${FULL_VERSION%%-*}
-    if [[ $BASE_VERSION != "$FULL_VERSION" ]]; then
-        echo "package.json version is $FULL_VERSION. Naming this canary after $BASE_VERSION instead, so it does not outrank $FULL_VERSION on npm. Prereleases are published from their own git tag, so this field is meant to hold a plain release number." >&2
+    PACKAGE_VERSION=$(node -e "console.log(require('./package.json').version)")
+    if ! PUBLISHED_VERSIONS=$(npm view @angular/fire versions --json); then
+        echo "Could not read the published @angular/fire versions from npm, so the canary has no version to build on." >&2
+        exit 1
     fi
+    BASE_VERSION=$(node ./tools/canary-version.js "$PACKAGE_VERSION" "$PUBLISHED_VERSIONS") || exit 1
     # `sha-` stops npm dropping an all-digit sha's leading zero.
     CANARY_ID=$(TZ=UTC git show -s --date=format-local:%Y%m%d%H%M%S --format=%cd.sha-%h $GITHUB_SHA)
     OVERRIDE_VERSION=$BASE_VERSION-canary.$CANARY_ID
 
@@ -0,0 +1,74 @@
+import { maxSatisfying as semverMaxSatisfying } from 'semver';
+import { canaryBaseVersion } from './canary-version.js';
+import 'jasmine';
+
+/* What's on npm today: a placeholder, v20 releases, rc.1, canaries named after the rc series
+ * (deprecated), and canaries named after 21.0.0. */
+const publishedToday = [
+  '0.0.0',
+  '20.0.0',
+  '20.1.0',
+  '21.0.0-rc.0',
+  '21.0.0-rc.0-canary.fb6796b',
+  '21.0.0-rc.1',
+  '21.0.0-rc.1-canary.95b3de1',
+  '21.0.0-canary.a2662fe',
+  '21.0.0-canary.20260930011755.sha-59d44e7',
+];
+
+const canaryNamedAfter = (base: string) => `${base}-canary.20261001000000.sha-abcdef0`;
+
+describe('canaryBaseVersion', () => {
+
+  it('names the canary one patch above the release candidate', () => {
+    expect(canaryBaseVersion('21.0.0', publishedToday)).toBe('21.0.1');
+  });
+
+  it('names the canary one patch above the release once it ships', () => {
+    expect(canaryBaseVersion('21.0.0', [...publishedToday, '21.0.0'])).toBe('21.0.1');
+    expect(canaryBaseVersion('21.0.0', [...publishedToday, '21.0.0', '21.0.1'])).toBe('21.0.2');
+  });
+
+  it('names the canary above a minor or patch release candidate', () => {
+    expect(canaryBaseVersion('21.0.0', [...publishedToday, '21.0.0', '21.1.0-rc.0'])).toBe('21.1.1');
+    expect(canaryBaseVersion('21.0.0', [...publishedToday, '21.0.0', '21.0.1-rc.0'])).toBe('21.0.2');
+  });
+
+  it('does not count earlier canaries', () => {
+    const published = [...publishedToday, canaryNamedAfter('21.0.1'), canaryNamedAfter('21.0.1')];
+    expect(canaryBaseVersion('21.0.0', published)).toBe('21.0.1');
+  });
+
+  it('ignores releases from other majors', () => {
+    expect(canaryBaseVersion('21.0.0', [...publishedToday, '21.0.0', '20.0.4'])).toBe('21.0.1');
+    expect(canaryBaseVersion('21.0.0', [...publishedToday, '21.0.0', '22.0.0-rc.0'])).toBe('21.0.1');
+  });
+
+  it('uses the package.json version when nothing in its major is published yet', () => {
+    expect(canaryBaseVersion('22.0.0-rc.0', publishedToday)).toBe('22.0.0');
+    expect(canaryBaseVersion('22.0.0-rc.0', [...publishedToday, '22.0.0-rc.0'])).toBe('22.0.1');
+  });
+
+  it('throws when the package.json version has no version number in it', () => {
+    expect(() => canaryBaseVersion('abc', publishedToday)).toThrowError(TypeError);
+  });
+
+  it('gives a canary that its own caret range selects, and that release ranges never select', () => {
+    const states = [
+      publishedToday,
+      [...publishedToday, '21.0.0'],
+      [...publishedToday, '21.0.0', '21.0.1'],
+      [...publishedToday, '21.0.0', '21.1.0-rc.0'],
+      [...publishedToday, '21.0.0', '21.0.1-rc.0'],
+    ];
+    for (const published of states) {
+      const canary = canaryNamedAfter(canaryBaseVersion('21.0.0', published));
+      const versions = [...published, canary];
+      expect(semverMaxSatisfying(versions, `^${canary}`)).toBe(canary);
+      for (const range of ['^21.0.0', '~21.0.0', '^21.0.0-rc.1', '^20.0.0']) {
+        expect(semverMaxSatisfying(versions, range)).not.toBe(canary);
+      }
+    }
+  });
+
+});
@@ -0,0 +1,29 @@
+const semver = require('semver');
+
+/**
+ * Picks the version a canary build is named after, as in `<base>-canary.<time>.sha-<sha>`.
+ *
+ * `ng add @angular/fire@canary` saves `^<canary>`, and npm installs the highest version in that
+ * range, so the canary must rank above every release and release candidate already published
+ * in its major.
+ *
+ * @param {string} packageVersion The `version` field of the repository's package.json.
+ * @param {string[]} publishedVersions Every @angular/fire version on npm.
+ * @returns {string} One patch above the highest published version of the same major, or the
+ *   package.json version without its prerelease part if that is higher.
+ */
+function canaryBaseVersion(packageVersion, publishedVersions) {
+  const packageBase = semver.coerce(packageVersion);
+  // Published canaries don't count, or every canary would be named one patch above the one before it.
+  const releases = publishedVersions.filter(
+    version => !version.includes('canary') && semver.major(version) === packageBase.major,
+  );
+  const nextPatch = releases.length ? semver.coerce(semver.rsort(releases)[0]).inc('patch') : packageBase;
+  return semver.gt(packageBase, nextPatch) ? packageBase.version : nextPatch.version;
+}
+
+module.exports = { canaryBaseVersion };
+
+if (require.main === module) {
+  console.log(canaryBaseVersion(process.argv[2], JSON.parse(process.argv[3])));
+}
@@ -14,6 +14,7 @@
     },
     "include": [
         "tools/jasmine.ts",
+        "tools/**/*.jasmine.ts",
         "src/**/*.jasmine.ts",
         // Not sure what is wrong here, but since upgrading karma it's fallen apart
         // "src/**/*.spec.ts",