@kb-labs/release-manager-cli 2.105.0 → 2.107.0

package/dist/cli/commands/deliver.js

@@ -1,4 +1,4 @@
-import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
+import { readFileSync, appendFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
 import { join } from 'path';
 import { defineCommand, findRepoRoot, useConfig, useEnv, useLoader, useLogger } from '@kb-labs/sdk';
 import { mergeConfigWithFlow, resolvePublishTag, resolvePublishRegistry, verifyAgainstRegistry, resolveFlowFromTag } from '@kb-labs/release-manager-core';
@@ -156,6 +156,21 @@ function isRetryable(message) {
 function isAlreadyPublished(message) {
   return ALREADY_PUBLISHED_PATTERNS.some((p) => message.includes(p));
 }
+var NPM_ERROR_HINTS = {
+  E403: "npm rejected the publish (403). If other packages in the same run succeeded with the same token, this is almost certainly an npm-side restriction on this specific package/account entry (e.g. a security hold), not a token or code problem \u2014 check npmjs.com directly or contact npm support. Retrying will not help until that is resolved.",
+  E401: "Authentication failed (401) \u2014 NPM_TOKEN/NODE_AUTH_TOKEN is missing, expired, or invalid for this registry.",
+  E404: "Registry returned 404 \u2014 check the registry URL and that the package name/scope is correct and accessible with this token.",
+  EOTP: "npm requires a one-time password for this publish \u2014 programmatic (token-based) delivery cannot supply one; this package needs an interactive `npm publish` from a human, or a token exempt from OTP."
+};
+function extractNpmErrorCode(message) {
+  const match = message.match(/\bnpm error code (E[A-Z0-9]+)\b/);
+  return match?.[1];
+}
+function classifyPublishError(message) {
+  const code = extractNpmErrorCode(message);
+  const hint = code ? NPM_ERROR_HINTS[code] : void 0;
+  return { code, hint };
+}
 function retryDelay(attempt) {
   const base = RETRY_BASE_DELAYS_MS[Math.min(attempt, RETRY_BASE_DELAYS_MS.length - 1)];
   const jitter = 0.8 + Math.random() * 0.4;
@@ -281,8 +296,9 @@ async function publishOne(pkg, opts, logger) {
           });
           continue;
         }
-        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message });
-        return { name: pkg.name, version: pkg.version, success: false, error: message };
+        const { code, hint } = classifyPublishError(message);
+        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message, errorCode: code });
+        return { name: pkg.name, version: pkg.version, success: false, error: message, errorCode: code, errorHint: hint };
       }
     }
     return {
@@ -398,6 +414,33 @@ function loadManifest(artifactsDir) {
     return { error: `No manifest.json found at ${manifestPath} \u2014 run \`kb release stage\` first` };
   }
 }
+function writeGithubStepSummary(markdown) {
+  const summaryPath = useEnv("GITHUB_STEP_SUMMARY");
+  if (!summaryPath) {
+    return;
+  }
+  try {
+    appendFileSync(summaryPath, markdown.endsWith("\n") ? markdown : `${markdown}
+`);
+  } catch {
+  }
+}
+function buildFailureSummaryMarkdown(target, publishedCount, failed) {
+  const lines = [
+    `## \u274C \`release deliver --target ${target}\` \u2014 ${failed.length} package(s) failed`,
+    "",
+    `${publishedCount} package(s) delivered successfully; ${failed.length} did not.`,
+    ""
+  ];
+  for (const f of failed) {
+    lines.push(`### \`${f.name}@${f.version}\`${f.errorCode ? ` \u2014 \`${f.errorCode}\`` : ""}`);
+    if (f.errorHint) {
+      lines.push("", `**${f.errorHint}**`);
+    }
+    lines.push("", "```", f.error.slice(0, 2e3), "```", "");
+  }
+  return lines.join("\n");
+}
 var deliver_default = defineCommand({
   id: "release:deliver",
   description: "Ship the tarballs `release stage` already packed to a target (npm) \u2014 no packing, no rebuild",
@@ -473,18 +516,25 @@ var deliver_default = defineCommand({
       const failed = publishResult.results.filter((r) => !r.success);
       if (failed.length > 0) {
         publishLoader.fail(`${failed.length} package(s) failed to publish`);
-        const result2 = {
-          exitCode: 1,
-          target,
-          published: publishResult.results.filter((r) => r.success).map((r) => ({ name: r.name, version: r.version })),
-          failed: failed.map((r) => ({ name: r.name, version: r.version, error: r.error ?? "Unknown error" }))
-        };
+        const publishedList = publishResult.results.filter((r) => r.success).map((r) => ({ name: r.name, version: r.version }));
+        const failedList = failed.map((r) => ({
+          name: r.name,
+          version: r.version,
+          error: r.error ?? "Unknown error",
+          errorCode: r.errorCode,
+          errorHint: r.errorHint
+        }));
+        const result2 = { exitCode: 1, target, published: publishedList, failed: failedList };
+        writeGithubStepSummary(buildFailureSummaryMarkdown(target, publishedList.length, failedList));
         if (flags.json) {
           ctx.ui?.json?.(result2);
         } else {
           ctx.ui?.sideBox?.({
             title: "Deliver \u2014 npm",
-            sections: [{ header: "Failed", items: failed.map((r) => `${ctx.ui.symbols.error} ${r.name}@${r.version} \u2014 ${r.error}`) }],
+            sections: [{
+              header: `Failed (${publishedList.length} delivered ok)`,
+              items: failedList.map((r) => `${ctx.ui.symbols.error} ${r.name}@${r.version}${r.errorCode ? ` [${r.errorCode}]` : ""} \u2014 ${r.errorHint ?? r.error}`)
+            }],
             status: "error"
           });
         }
@@ -515,6 +565,13 @@ var deliver_default = defineCommand({
       };
       if (verifyIssues.length > 0) {
         verifyLoader.fail(`Delivery verification found ${verifyIssues.length} issue(s) \u2014 packages are published, verification failed`);
+        writeGithubStepSummary([
+          `## \u26A0\uFE0F \`release deliver --target ${target}\` \u2014 publish succeeded, verification found ${verifyIssues.length} issue(s)`,
+          "",
+          "Packages are already live on the registry \u2014 this is a verification problem, not a publish failure, and nothing was rolled back (npm unpublish is never attempted automatically).",
+          "",
+          ...verifyIssues.map((i) => `- ${i}`)
+        ].join("\n"));
       } else {
         verifyLoader.succeed("Delivery verified against the registry");
       }

package/dist/cli/commands/deliver.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/shared/dep-rewrite.ts","../../../src/shared/publish-programmatic.ts","../../../src/shared/resolve-flow.ts","../../../src/cli/commands/deliver.ts"],"names":["join","readFileSync","writeFileSync","useEnv","result"],"mappings":";;;;;;;AAyBA,SAAS,cAAA,CACP,IAAA,EACA,OAAA,EACA,GAAA,EACA,SACA,UAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA;AACrC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC1B,IAAA;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AACzC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,CAAK,SAAS,QAAA,EAAU,cAAc,CAAA,EAAG,OAAO,CAAC,CAAA;AACxF,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAA,CAAO,WAAW,GAAG,CAAA,CAAA;AAAA,EAC3C,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,GAAA;AAAA,EAClB;AACF;AAEA,SAAS,mBAAA,CACP,IAAA,EACA,OAAA,EACA,GAAA,EACA,UAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA;AACrC,EAAA,IAAI,CAAC,MAAA,EAAQ;AAAE,IAAA,OAAO,KAAA;AAAA,EAAO;AAC7B,EAAA,IAAA,CAAK,OAAO,CAAA,GAAI,GAAA,KAAQ,aAAA,GAAgB,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACnF,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,kBAAA,CACP,IAAA,EACA,OAAA,EACA,UAAA,EACA,cAAA,EACS;AACT,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,OAAA,IAAW,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AACxB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAAE,MAAA;AAAA,IAAU;AACzC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,MAAA,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AACtD,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAA,MAAA,IAAW,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,cAAA,KAAmB,MAAA,IAAU,mBAAA,CAAoB,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,UAAU,CAAA,EAAG;AAC3H,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAEO,SAAS,oBAAA,CACd,GAAA,EACA,UAAA,EACA,cAAA,EACY;AACZ,EAAA,MAAM,UAAU,GAAA,CAAI,IAAA;AACpB,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAChD,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAA,GAAW,KAAA;AAEf,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,GAAA,CAAI,OAAA,EAAS;AACnC,IAAA,OAAA,CAAQ,UAAU,GAAA,CAAI,OAAA;AACtB,IAAA,QAAA,GAAW,IAAA;AAAA,EACb;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,CAAC,cAAA,EAAgB,kBAAkB,CAAA,EAAY;AACnE,IAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM;AAAE,MAAA;AAAA,IAAU;AACvB,IAAA,IAAI,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA,EAAG;AAAE,MAAA,QAAA,GAAW,IAAA;AAAA,IAAM;AAAA,EACxF;AAEA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,aAAA,CAAc,aAAa,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,CAAC,IAAI,IAAI,CAAA;AAAA,EACpE;AAEA,EAAA,OAAO,MAAM,aAAA,CAAc,WAAA,EAAa,QAAQ,CAAA;AAClD;AAoBA,SAAS,cAAA,CAAe,UAAyB,OAAA,EAAgD;AAC/F,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAyB;AAC1C,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,CAAK,IAAI,IAAA,EAAM,cAAc,CAAA,EAAG,OAAO,CAAC,CAAA;AAIhF,MAAA,KAAA,MAAW,OAAA,IAAW,CAAC,cAAA,EAAgB,kBAAkB,CAAA,EAAY;AACnE,QAAA,KAAA,MAAW,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA,IAAK,EAAE,CAAA,EAAG;AACzD,UAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AAAE,YAAA,KAAA,CAAM,IAAI,OAAO,CAAA;AAAA,UAAG;AAAA,QAClD;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,UAAyB,IAAA,EAA0D;AAC7G,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAyB;AAChD,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,KAAA,MAAW,OAAO,IAAA,CAAK,GAAA,CAAI,IAAI,IAAI,CAAA,IAAK,EAAC,EAAG;AAC1C,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,QAAA,UAAA,CAAW,GAAA,CAAI,GAAA,kBAAK,IAAI,GAAA,EAAK,CAAA;AAAA,MAAG;AAC5D,MAAA,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,CAAG,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,UAAA;AACT;AAEA,SAAS,YAAA,CACP,QAAA,EACA,IAAA,EACA,UAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AACrD,EAAA,MAAM,YAAY,IAAI,GAAA;AAAA,IACpB,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,EAAE,IAAA,EAAA,CAAO,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,oBAAK,IAAI,GAAA,EAAI,EAAG,IAAI,CAAC;AAAA,GAClE;AACA,EAAA,MAAM,QAAyB,EAAC;AAEhC,EAAA,OAAO,SAAA,CAAU,OAAO,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,SAAA,CAAU,OAAA,EAAS,CAAA,CACjC,MAAA,CAAO,CAAC,GAAG,KAAK,MAAM,KAAA,KAAU,CAAC,CAAA,CACjC,GAAA,CAAI,CAAC,CAAC,IAAI,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,IAAI,CAAE,CAAA;AAEpC,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,KAAA,CAAM,IAAA,CAAK,CAAC,GAAG,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,MAAA,CAAO,GAAA,CAAI,CAAC,CAAE,CAAC,CAAA;AACzD,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AACf,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,SAAA,CAAU,MAAA,CAAO,IAAI,IAAI,CAAA;AACzB,MAAA,KAAA,MAAW,aAAa,UAAA,CAAW,GAAA,CAAI,IAAI,IAAI,CAAA,IAAK,EAAC,EAAG;AACtD,QAAA,IAAI,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA,EAAG;AAC5B,UAAA,SAAA,CAAU,IAAI,SAAA,EAAA,CAAY,SAAA,CAAU,IAAI,SAAS,CAAA,IAAK,KAAK,CAAC,CAAA;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,KAAA,CAAM,MAAA,CAAO,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC;AAEO,SAAS,QAAA,CAAS,UAAyB,eAAA,EAA0C;AAC1F,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAI,CAAC,CAAA;AACjD,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,QAAA,EAAU,OAAO,CAAA;AAC7C,EAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,QAAA,EAAU,IAAI,CAAA;AACpD,EAAA,OAAO,YAAA,CAAa,QAAA,EAAU,IAAA,EAAM,UAAU,CAAA;AAChD;;;AC5HA,IAAM,WAAA,GAAc,CAAA;AAGpB,IAAM,uBAAuB,CAAC,GAAA,EAAQ,GAAA,EAAQ,GAAA,EAAQ,KAAQ,IAAO,CAAA;AAGrE,IAAM,kBAAA,GAAqB;AAAA,EACzB,MAAA;AAAA,EACA,uBAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,0BAAA,GAA6B;AAAA,EACjC,2DAAA;AAAA,EACA,sDAAA;AAAA,EACA;AAAA;AAEF,CAAA;AAEA,SAAS,YAAY,OAAA,EAA0B;AAC7C,EAAA,OAAO,mBAAmB,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAC,CAAA;AACzD;AAEA,SAAS,mBAAmB,OAAA,EAA0B;AACpD,EAAA,OAAO,2BAA2B,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAC,CAAA;AACjE;AAGA,SAAS,WAAW,OAAA,EAAyB;AAC3C,EAAA,MAAM,IAAA,GAAO,qBAAqB,IAAA,CAAK,GAAA,CAAI,SAAS,oBAAA,CAAqB,MAAA,GAAS,CAAC,CAAC,CAAA;AACpF,EAAA,MAAM,MAAA,GAAS,GAAA,GAAM,IAAA,CAAK,MAAA,EAAO,GAAI,GAAA;AACrC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,MAAM,CAAA;AACjC;AAMA,SAAS,aAAa,KAAA,EAAoC;AACxD,EAAA,OAAO,KAAA,IAAS,MAAA,CAAO,WAAW,CAAA,IAAK,OAAO,iBAAiB,CAAA;AACjE;AAUA,SAAS,aAAa,OAAA,EAWJ;AAChB,EAAA,MAAM,EAAE,WAAA,EAAa,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,KAAK,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,QAAA,EAAS,GAAI,OAAA;AAEhG,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,IAAA,GAAO,CAAC,SAAS,CAAA;AACvB,IAAA,IAAI,WAAA,EAAa;AAAE,MAAA,IAAA,CAAK,KAAK,WAAW,CAAA;AAAA,IAAG;AAE3C,IAAA,IAAI,cAAA,KAAmB,MAAA,IAAU,CAAC,WAAA,EAAa;AAI7C,MAAA,IAAA,CAAK,KAAK,iBAAiB,CAAA;AAAA,IAC7B;AACA,IAAA,IAAI,MAAA,EAAU;AAAE,MAAA,IAAA,CAAK,KAAK,WAAW,CAAA;AAAA,IAAG;AACxC,IAAA,IAAI,GAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,MAAA,EAAS,GAAG,CAAA,CAAE,CAAA;AAAA,IAAG;AAC3C,IAAA,IAAI,MAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,SAAA,EAAY,MAAM,CAAA,CAAE,CAAA;AAAA,IAAG;AACjD,IAAA,IAAI,QAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,WAAA,EAAc,QAAQ,CAAA,CAAE,CAAA;AAAA,IAAG;AACrD,IAAA,IAAI,GAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,MAAA,EAAS,GAAG,CAAA,CAAE,CAAA;AAAA,IAAG;AAE3C,IAAA,MAAM,GAAA,GAAyB,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAI;AAChD,IAAA,IAAI,KAAA,EAAO;AAAE,MAAA,GAAA,CAAI,iBAAiB,CAAA,GAAI,KAAA;AAAA,IAAO;AAM7C,IAAA,MAAM,SAAA,GAAYA,IAAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,WAAW,SAAS,CAAA;AACzC,IAAA,MAAM,WAAA,GAAc,YAAA,GAAeC,YAAAA,CAAa,SAAA,EAAW,OAAO,CAAA,GAAI,IAAA;AACtE,IAAA,MAAM,eAAe,QAAA,GAAW,IAAI,GAAA,CAAI,QAAQ,EAAE,IAAA,GAAO,oBAAA;AACzD,IAAA,MAAM,QAAA,GAAW,KAAK,YAAY,CAAA;AAAA,CAAA;AAElC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,QAAA,GAAW,YAAA,GAAeA,YAAAA,CAAa,SAAA,EAAW,OAAO,CAAA,GAAI,EAAA;AACnE,MAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA,EAAG;AACpC,QAAAC,aAAAA,CAAc,SAAA,EAAW,QAAA,GAAW,QAAQ,CAAA;AAAA,MAC9C;AAAA,IACF;AAEA,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,CAAC,KAAA,EAAO;AAAE,QAAA;AAAA,MAAQ;AACtB,MAAA,IAAI;AACF,QAAA,IAAI,gBAAgB,IAAA,EAAM;AACxB,UAAAA,aAAAA,CAAc,WAAW,WAAW,CAAA;AAAA,QACtC,CAAA,MAAA,IAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AAChC,UAAA,UAAA,CAAW,SAAS,CAAA;AAAA,QACtB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAoB;AAAA,IAC9B,CAAA;AAEA,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,cAAA,EAAgB,IAAA,EAAM;AAAA,MACxC,GAAA,EAAK,WAAA;AAAA,MACL,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,MAChC,KAAA,EAAO,IAAA;AAAA,MACP;AAAA,KACD,CAAA;AAED,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AAEb,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AAAE,MAAA,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAAG,CAAC,CAAA;AACnE,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AAAE,MAAA,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAAG,CAAC,CAAA;AAEnE,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAwB;AACzC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,CAAA,EAAG;AACd,QAAA,OAAA,EAAQ;AAAA,MACV,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,IAAI,MAAM,MAAA,IAAU,MAAA,IAAU,GAAG,cAAc,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAE,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AAChC,MAAA,YAAA,EAAa;AACb,MAAA,MAAA,CAAO,GAAG,CAAA;AAAA,IACZ,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAMA,eAAe,UAAA,CACb,GAAA,EACA,IAAA,EAUA,MAAA,EACwB;AAKxB,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,WAAA,IAAe,MAAM;AAAA,EAAC,KAAK,oBAAA,CAAqB,GAAA,EAAK,IAAA,CAAK,UAAA,EAAY,KAAK,cAAc,CAAA;AAE7G,EAAA,IAAI;AACF,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,WAAA,EAAa,OAAA,EAAA,EAAW;AACvD,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,CAAa;AAAA,UACjB,aAAa,GAAA,CAAI,IAAA;AAAA,UACjB,aAAa,GAAA,CAAI,WAAA;AAAA,UACjB,gBAAgB,IAAA,CAAK,cAAA;AAAA,UACrB,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,UAAU,IAAA,CAAK;AAAA,SAChB,CAAA;AAED,QAAA,MAAA,CAAO,KAAK,CAAA,UAAA,EAAa,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAClD,QAAA,OAAO,EAAE,MAAM,GAAA,CAAI,IAAA,EAAM,SAAS,GAAA,CAAI,OAAA,EAAS,SAAS,IAAA,EAAK;AAAA,MAE/D,SAAS,GAAA,EAAc;AACrB,QAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,QAAA,IAAI,kBAAA,CAAmB,OAAO,CAAA,EAAG;AAC/B,UAAA,MAAA,CAAO,KAAK,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,kCAAA,CAA+B,CAAA;AACrE,UAAA,OAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,IAAI,OAAA,EAAS,OAAA,EAAS,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAK;AAAA,QACvF;AAGA,QAAA,IAAI,WAAA,CAAY,OAAO,CAAA,IAAK,OAAA,GAAU,WAAA,EAAa;AACjD,UAAA,MAAM,KAAA,GAAQ,WAAW,OAAO,CAAA;AAChC,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,oBAAA,EAAuB,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,OAAO,CAAA,UAAA,EAAa,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,WAAW,mBACrE,KAAA,GAAQ,GAAA,EAAM,OAAA,CAAQ,CAAC,CAAC,CAAA,GAAA,EAAM,QAAQ,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,WACtE;AACA,UAAA,MAAM,IAAI,QAAc,CAAA,CAAA,KAAK;AAAE,YAAA,UAAA,CAAW,GAAG,KAAK,CAAA;AAAA,UAAG,CAAC,CAAA;AACtD,UAAA;AAAA,QACF;AAGA,QAAA,MAAA,CAAO,KAAA,CAAM,CAAA,kBAAA,EAAqB,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,CAAA,EAAI,KAAA,CAAA,EAAW,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAC1F,QAAA,OAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,IAAI,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,OAAA,EAAQ;AAAA,MAChF;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,wBAAwB,WAAW,CAAA,2BAAA;AAAA,KAC5C;AAAA,EACF,CAAA,SAAE;AACA,IAAA,OAAA,EAAQ;AAAA,EACV;AACF;AAMA,SAAS,kBAAA,CACP,KAAA,EACA,OAAA,EACA,UAAA,EACA,QACA,UAAA,EACM;AACN,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,GAAA,EAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AAC/E,EAAA,IAAI,cAAc,CAAA,EAAG;AAAE,IAAA;AAAA,EAAQ;AAC/B,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,QAAQ,OAAA,GAAU,CAAC,QAAQ,UAAA,CAAW,MAAM,+BAChC,SAAS,CAAA,2DAAA;AAAA,GACvB;AACA,EAAA,KAAA,MAAW,SAAA,IAAa,KAAA,CAAM,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA,EAAG;AAChD,IAAA,KAAA,MAAW,OAAO,SAAA,EAAW;AAC3B,MAAA,UAAA,CAAW,IAAA,CAAK,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,iCAAA,EAAmC,CAAA;AAAA,IACpH;AAAA,EACF;AACF;AAUA,eAAsB,4BACpB,OAAA,EACoC;AACpC,EAAA,MAAM;AAAA,IACJ,QAAA;AAAA,IACA,cAAA,GAAiB,MAAA;AAAA,IACjB,MAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AAExC,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,MAAA,EAAQ;AACrB,IAAA,MAAM,KAAA,GAAQ,wEAAA;AACd,IAAA,MAAA,CAAO,MAAM,KAAK,CAAA;AAClB,IAAA,OAAO;AAAA,MACL,SAAS,EAAC;AAAA,MACV,WAAW,EAAC;AAAA,MACZ,kBAAkB,EAAC;AAAA,MACnB,MAAA,EAAQ,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,MAClD,SAAS,EAAC;AAAA,MACV,MAAA,EAAQ,CAAC,KAAK;AAAA,KAChB;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAC,CAAA;AAGjE,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,wBAAwB,KAAK,CAAC,CAAA;AAGhE,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,QAAwB,CAAA;AAE/C,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,CAAA,WAAA,EAAc,QAAA,CAAS,MAAM,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAM,CAAA,kCAAA,EAC3C,WAAW,CAAA,SAAA,EAAY,MAAA,IAAU,KAAK,CAAA,CAAA;AAAA,GACxD;AAEA,EAAA,MAAM,aAA8B,EAAC;AAErC,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,KAAA,CAAM,QAAQ,OAAA,EAAA,EAAW;AACvD,IAAA,MAAM,IAAA,GAAO,MAAM,OAAO,CAAA;AAC1B,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,KAAA,EAAQ,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,MAAM,MAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,MAAM,CAAA,WAAA,CAAa,CAAA;AAGvF,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,EAAQ,KAAK,WAAA,EAAa;AACjD,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,IAAI,WAAW,CAAA;AAC3C,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,GAAA;AAAA,QACjC,KAAA,CAAM,GAAA;AAAA,UAAI,CAAA,GAAA,KACR,UAAA,CAAW,GAAA,EAAK,EAAE,cAAA,EAAgB,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,GAAA,EAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,IAAY,MAAM;AAAA;AACnG,OACF;AACA,MAAA,UAAA,CAAW,IAAA,CAAK,GAAG,YAAY,CAAA;AAAA,IACjC;AAIA,IAAA,MAAM,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,CAAC,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,OAAO,CAAA;AACxE,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,kBAAA,CAAmB,KAAA,EAAO,OAAA,EAAS,UAAA,EAAY,MAAA,EAAQ,UAAU,CAAA;AACjE,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,YAAoB,UAAA,CAAW,MAAA,CAAO,OAAK,CAAA,CAAE,OAAA,IAAW,CAAC,CAAA,CAAE,gBAAgB,CAAA,CAAE,GAAA,CAAI,OAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACpH,EAAA,MAAM,gBAAA,GAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,gBAAgB,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACtG,EAAA,MAAM,SAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC9F,EAAA,MAAM,SAAoB,UAAA,CAAW,MAAA,CAAO,OAAK,CAAC,CAAA,CAAE,WAAW,CAAA,CAAE,KAAK,CAAA,CAAE,GAAA,CAAI,OAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAExG,EAAA,IAAI,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,gBAAA,CAAiB,MAAM,CAAA,uDAAA,CAAoD,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA,EAAS,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,UAAA,CAAY,IAAI,EAAC;AAAA,IAC3E;AAAA,GACF;AACF;ACrZO,SAAS,eAAA,CAAgB,QAAuB,KAAA,EAAwD;AAC7G,EAAA,IAAI,MAAM,IAAA,EAAM;AAAE,IAAA,OAAO,KAAA,CAAM,IAAA;AAAA,EAAM;AACrC,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,MAAA,EAAQ,KAAA,CAAM,aAAa,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,KAAA,EAAO,CAAA,kDAAA,EAAqD,KAAA,CAAM,aAAa,CAAC,CAAA,CAAA,CAAA,EAAI;AAAA,IAC/F;AACA,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AACA,EAAA,OAAO,EAAE,OAAO,kCAAA,EAAmC;AACrD;;;ACSA,IAAM,uBAAA,GAA0B,CAAA;AAsBhC,SAAS,aAAa,YAAA,EAA4D;AAChF,EAAA,MAAM,YAAA,GAAeF,IAAAA,CAAK,YAAA,EAAc,eAAe,CAAA;AACvD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAMC,YAAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,0BAAA,EAA6B,YAAY,CAAA,sCAAA,CAAA,EAAoC;AAAA,EAC/F;AACF;AAEA,IAAO,kBAAQ,aAAA,CAAc;AAAA,EAC3B,EAAA,EAAI,iBAAA;AAAA,EACJ,WAAA,EAAa,kGAAA;AAAA,EAEb,OAAA,EAAS;AAAA,IACP,MAAM,OAAA,CAAQ,GAAA,EAAsB,KAAA,EAAuD;AACzF,MAAA,MAAM,EAAE,OAAM,GAAI,KAAA;AAClB,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,KAAA;AAE/B,MAAA,IAAI,WAAW,KAAA,EAAO;AACpB,QAAA,MAAM,GAAA,GAAM,4BAA4B,MAAM,CAAA,yHAAA,CAAA;AAC9C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AAEA,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACnC,MAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,GAAG,CAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,MAAM,SAAA,EAAyB;AAClD,MAAA,MAAM,UAAA,GAA4B,cAAc,EAAC;AAEjD,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,UAAA,EAAY,KAAK,CAAA;AACpD,MAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,QAAA,MAAM,GAAA,GAAM,CAAA,gBAAA,EAAmB,UAAA,CAAW,KAAK,CAAA,CAAA;AAC/C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AACA,MAAA,MAAM,MAAA,GAAwB,mBAAA,CAAoB,UAAA,EAAY,UAAU,CAAA;AAExE,MAAA,MAAM,eAAeD,IAAAA,CAAK,QAAA,EAAU,KAAA,CAAM,eAAe,KAAK,uBAAuB,CAAA;AACrF,MAAA,MAAM,QAAA,GAAW,aAAa,YAAY,CAAA;AAC1C,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AAC5B,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,IAAI,IAAA,GAAO,EAAE,KAAA,EAAO,QAAA,CAAS,OAAO,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,KAAA,GAAQ,QAAA,CAAS,KAAK,CAAA;AAAA,QAAG;AACvG,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AACA,MAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,QAAA,MAAM,GAAA,GAAM,oBAAoB,YAAY,CAAA,kBAAA,CAAA;AAC5C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,SAAS,CAAA;AAC9B,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,IAAO,iBAAA,CAAkB,QAAQ,QAAQ,CAAA;AAC9D,MAAA,MAAM,QAAA,GAAW,KAAA,CAAM,QAAA,IAAY,sBAAA,CAAuB,QAAQ,QAAQ,CAAA;AAC1E,MAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,IAASG,OAAO,WAAW,CAAA,IAAKA,OAAO,iBAAiB,CAAA;AAE5E,MAAA,MAAM,QAAA,GAA+B,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,QACtD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,IAAA,EAAM,YAAA;AAAA,QACN,WAAA,EAAaH,IAAAA,CAAK,YAAA,EAAc,CAAA,CAAE,OAAO;AAAA,OAC3C,CAAE,CAAA;AAEF,MAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,CAAA,WAAA,EAAc,QAAA,CAAS,MAAM,CAAA,qBAAA,CAAuB,CAAA;AACpF,MAAA,aAAA,CAAc,KAAA,EAAM;AAMpB,MAAA,MAAM,aAAA,GAAgB,MAAM,2BAAA,CAA4B;AAAA,QACtD,QAAA;AAAA,QACA,cAAA,EAAgB,KAAA;AAAA,QAChB,MAAA;AAAA,QACA,KAAK,KAAA,CAAM,GAAA;AAAA,QACX,GAAA,EAAK,MAAA;AAAA,QACL,MAAA,EAAS,KAAA,CAAM,MAAA,IAAkD,MAAA,CAAO,OAAA,EAAS,MAAA;AAAA,QACjF,QAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,SAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA;AAC3D,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,aAAA,CAAc,IAAA,CAAK,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,6BAAA,CAA+B,CAAA;AAClE,QAAA,MAAMI,OAAAA,GAAwB;AAAA,UAC5B,QAAA,EAAU,CAAA;AAAA,UACV,MAAA;AAAA,UACA,WAAW,aAAA,CAAc,OAAA,CAAQ,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,OAAO,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,OAAA,EAAS,CAAA,CAAE,SAAQ,CAAE,CAAA;AAAA,UACvG,MAAA,EAAQ,MAAA,CAAO,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,OAAA,EAAS,EAAE,OAAA,EAAS,KAAA,EAAO,CAAA,CAAE,KAAA,IAAS,iBAAgB,CAAE;AAAA,SACnG;AACA,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,OAAOA,OAAM,CAAA;AAAA,QAAG,CAAA,MAAO;AAC/C,UAAA,GAAA,CAAI,IAAI,OAAA,GAAU;AAAA,YAChB,KAAA,EAAO,oBAAA;AAAA,YACP,QAAA,EAAU,CAAC,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAO,MAAA,CAAO,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,QAAQ,KAAK,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,QAAA,EAAM,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA,EAAG,CAAA;AAAA,YACtH,MAAA,EAAQ;AAAA,WACT,CAAA;AAAA,QACH;AACA,QAAA,OAAOA,OAAAA;AAAA,MACT;AACA,MAAA,aAAA,CAAc,OAAA,CAAQ,CAAA,UAAA,EAAa,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA,kBAAA,CAAoB,CAAA;AAEnF,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAMA,UAAwB,EAAE,QAAA,EAAU,GAAG,MAAA,EAAQ,SAAA,EAAW,cAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,SAAS,CAAA,CAAE,OAAA,GAAU,CAAA,EAAE;AACvI,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,OAAOA,OAAM,CAAA;AAAA,QAAG;AAC1C,QAAA,OAAOA,OAAAA;AAAA,MACT;AAMA,MAAA,MAAM,YAAA,GAAe,UAAU,4CAA4C,CAAA;AAC3E,MAAA,YAAA,CAAa,KAAA,EAAM;AACnB,MAAA,MAAM,aAAA,GAAsC,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,IAAA,EAAM,cAAa,CAAE,CAAA;AACxH,MAAA,MAAM,aAAA,GAAgB,MAAM,qBAAA,CAAsB,aAAA,EAAe;AAAA,QAC/D,QAAA;AAAA,QACA,OAAA,EAAS,uBAAA;AAAA,QACT,MAAA,EAAQ,IAAI,QAAA,EAAU;AAAA,OACvB,CAAA;AACD,MAAA,MAAM,YAAA,GAAe,aAAA,CAAc,OAAA,CAAQ,CAAA,CAAA,KAAK,EAAE,MAAM,CAAA;AAExD,MAAA,MAAM,MAAA,GAAwB;AAAA,QAC5B,QAAA,EAAU,YAAA,CAAa,MAAA,KAAW,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,QAC1C,MAAA;AAAA,QACA,SAAA,EAAW,aAAA,CAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,CAAA;AAAA,QAChF;AAAA,OACF;AAEA,MAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAG3B,QAAA,YAAA,CAAa,IAAA,CAAK,CAAA,4BAAA,EAA+B,YAAA,CAAa,MAAM,CAAA,4DAAA,CAAyD,CAAA;AAAA,MAC/H,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,QAAQ,wCAAwC,CAAA;AAAA,MAC/D;AAEA,MAAA,IAAI,MAAM,IAAA,EAAM;AACd,QAAA,GAAA,CAAI,EAAA,EAAI,OAAO,MAAM,CAAA;AACrB,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,GAAA,CAAI,IAAI,OAAA,GAAU;AAAA,QAChB,KAAA,EAAO,oBAAA;AAAA,QACP,QAAA,EAAU;AAAA,UACR,EAAE,MAAA,EAAQ,CAAA,aAAA,EAAgB,QAAQ,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,CAAA,EAAK,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,EAAE;AAAA,UACjJ,GAAI,aAAa,MAAA,GAAS,CAAA,GAAI,CAAC,EAAE,MAAA,EAAQ,qBAAA,EAAuB,KAAA,EAAO,YAAA,CAAa,GAAA,CAAI,OAAK,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,EAAG,CAAA,GAAI;AAAC,SACrI;AAAA,QACA,MAAA,EAAQ,YAAA,CAAa,MAAA,KAAW,CAAA,GAAI,SAAA,GAAY;AAAA,OACjD,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT;AAAA;AAEJ,CAAC","file":"deliver.js","sourcesContent":["/**\n * Rewrite a package's own version and workspace:/link: dependency references\n * before `pnpm publish`, so the tarball on disk matches what's about to be\n * published even when that version was never persisted to package.json.\n *\n * - Own version: stable releases already have the target version on disk\n *   (written by updatePackageVersions() before this runs), so this is a\n *   no-op for them. Canary releases compute nextVersion in-memory only —\n *   never committed to package.json/git — so without this, `pnpm publish`\n *   would read the OLD on-disk version, and either fail outright or (worse)\n *   get misclassified as \"already published\" by the retry/idempotency\n *   patterns since that old version genuinely IS already on the registry.\n * - pnpm handles `workspace:*` natively during `pnpm publish` — no rewrite needed.\n * - npm/yarn do NOT — we must replace with `^version` before publish.\n * - `link:` references are never valid on the npm registry — always rewrite.\n *\n * Returns a restore function that reverts package.json to original content.\n * Call it in a finally block to guarantee cleanup.\n */\n\nimport { readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\n\n// ── rewriteWorkspaceDeps helpers ──────────────────────────────────────────\n\nfunction rewriteLinkDep(\n  deps: Record<string, string>,\n  depName: string,\n  val: string,\n  pkgPath: string,\n  versionMap: Map<string, string>,\n): void {\n  const pinned = versionMap.get(depName);\n  if (pinned) {\n    deps[depName] = `^${pinned}`;\n    return;\n  }\n  try {\n    const linkPath = val.slice('link:'.length);\n    const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, 'package.json'), 'utf-8')) as { version?: string };\n    deps[depName] = `^${linked.version ?? '*'}`;\n  } catch {\n    deps[depName] = '*';\n  }\n}\n\nfunction rewriteWorkspaceDep(\n  deps: Record<string, string>,\n  depName: string,\n  val: string,\n  versionMap: Map<string, string>,\n): boolean {\n  const pinned = versionMap.get(depName);\n  if (!pinned) { return false; }\n  deps[depName] = val === 'workspace:*' ? `^${pinned}` : val.replace('workspace:', '');\n  return true;\n}\n\nfunction rewriteDepsSection(\n  deps: Record<string, string>,\n  pkgPath: string,\n  versionMap: Map<string, string>,\n  packageManager: string,\n): boolean {\n  let modified = false;\n  for (const depName of Object.keys(deps)) {\n    const val = deps[depName];\n    if (typeof val !== 'string') { continue; }\n    if (val.startsWith('link:')) {\n      rewriteLinkDep(deps, depName, val, pkgPath, versionMap);\n      modified = true;\n    } else if (val.startsWith('workspace:') && packageManager !== 'pnpm' && rewriteWorkspaceDep(deps, depName, val, versionMap)) {\n      modified = true;\n    }\n  }\n  return modified;\n}\n\nexport function rewriteWorkspaceDeps(\n  pkg: { path: string; version: string },\n  versionMap: Map<string, string>,\n  packageManager: string,\n): () => void {\n  const pkgPath = pkg.path;\n  const pkgJsonPath = join(pkgPath, 'package.json');\n  const original = readFileSync(pkgJsonPath, 'utf-8');\n  const pkgJson = JSON.parse(original) as Record<string, unknown> & { version?: string };\n  let modified = false;\n\n  if (pkgJson.version !== pkg.version) {\n    pkgJson.version = pkg.version;\n    modified = true;\n  }\n\n  for (const section of ['dependencies', 'peerDependencies'] as const) {\n    const deps = pkgJson[section] as Record<string, string> | undefined;\n    if (!deps) { continue; }\n    if (rewriteDepsSection(deps, pkgPath, versionMap, packageManager)) { modified = true; }\n  }\n\n  if (modified) {\n    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n  }\n\n  return () => writeFileSync(pkgJsonPath, original);\n}\n\n// ── topoSort helpers ──────────────────────────────────────────────────────\n\n/**\n * Build a simple topological sort of packages for publish order.\n *\n * Packages are grouped into \"waves\": wave 0 has no intra-release deps,\n * wave 1 depends only on wave 0, etc. Within each wave publish order\n * is arbitrary (safe to parallelise).\n *\n * Cycles (should not exist in a well-formed monorepo) fall into a\n * \"remainder\" group appended at the end.\n */\nexport interface TopoPackage {\n  name: string;\n  path: string;\n  version: string;\n}\n\nfunction buildIntraDeps(packages: TopoPackage[], nameSet: Set<string>): Map<string, Set<string>> {\n  const deps = new Map<string, Set<string>>();\n  for (const pkg of packages) {\n    const intra = new Set<string>();\n    try {\n      const pkgJson = JSON.parse(readFileSync(join(pkg.path, 'package.json'), 'utf-8')) as {\n        dependencies?: Record<string, string>;\n        peerDependencies?: Record<string, string>;\n      };\n      for (const section of ['dependencies', 'peerDependencies'] as const) {\n        for (const depName of Object.keys(pkgJson[section] ?? {})) {\n          if (nameSet.has(depName)) { intra.add(depName); }\n        }\n      }\n    } catch {\n      // If we can't read package.json, treat as no deps\n    }\n    deps.set(pkg.name, intra);\n  }\n  return deps;\n}\n\nfunction buildDependantsMap(packages: TopoPackage[], deps: Map<string, Set<string>>): Map<string, Set<string>> {\n  const dependants = new Map<string, Set<string>>();\n  for (const pkg of packages) {\n    for (const dep of deps.get(pkg.name) ?? []) {\n      if (!dependants.has(dep)) { dependants.set(dep, new Set()); }\n      dependants.get(dep)!.add(pkg.name);\n    }\n  }\n  return dependants;\n}\n\nfunction computeWaves(\n  packages: TopoPackage[],\n  deps: Map<string, Set<string>>,\n  dependants: Map<string, Set<string>>,\n): TopoPackage[][] {\n  const byName = new Map(packages.map(p => [p.name, p]));\n  const remaining = new Map<string, number>(\n    packages.map(p => [p.name, (deps.get(p.name) ?? new Set()).size])\n  );\n  const waves: TopoPackage[][] = [];\n\n  while (remaining.size > 0) {\n    const wave = [...remaining.entries()]\n      .filter(([, count]) => count === 0)\n      .map(([name]) => byName.get(name)!);\n\n    if (wave.length === 0) {\n      waves.push([...remaining.keys()].map(n => byName.get(n)!));\n      break;\n    }\n\n    waves.push(wave);\n    for (const pkg of wave) {\n      remaining.delete(pkg.name);\n      for (const dependant of dependants.get(pkg.name) ?? []) {\n        if (remaining.has(dependant)) {\n          remaining.set(dependant, (remaining.get(dependant) ?? 1) - 1);\n        }\n      }\n    }\n  }\n\n  return waves.filter(w => w.length > 0);\n}\n\nexport function topoSort(packages: TopoPackage[], _packageManager: string): TopoPackage[][] {\n  const nameSet = new Set(packages.map(p => p.name));\n  const deps = buildIntraDeps(packages, nameSet);\n  const dependants = buildDependantsMap(packages, deps);\n  return computeWaves(packages, deps, dependants);\n}\n","/**\n * Programmatic npm publishing for REST handlers (non-interactive context).\n *\n * Uses `npm publish` CLI via spawn with NODE_AUTH_TOKEN env variable.\n * This is the correct approach for granular access tokens (classic tokens\n * were revoked by npm in December 2025).\n *\n * Token resolution order:\n * 1. options.token (explicit override)\n * 2. NPM_TOKEN env variable\n * 3. NODE_AUTH_TOKEN env variable\n *\n * Reliability guarantees:\n * - Already-published versions are treated as success (idempotent re-runs).\n * - 429 rate-limit: exponential back-off with jitter, up to MAX_RETRIES attempts.\n * - Transient network errors (ECONNRESET, ETIMEDOUT, etc.) are also retried.\n * - Packages are published in topological order (deps before dependants).\n * - Default concurrency is 4 — enough throughput, low enough to avoid rate limits.\n */\n\nimport { spawn } from 'node:child_process';\nimport { readFileSync, writeFileSync, existsSync, unlinkSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { useLogger, useEnv } from '@kb-labs/sdk';\nimport { rewriteWorkspaceDeps, topoSort } from './dep-rewrite';\n\nexport interface PackageToPublish {\n  name: string;\n  version: string;\n  path: string;\n  /**\n   * Pre-built tarball to publish instead of packing fresh from `path`\n   * (produced by `release stage` — see stage.ts). When set, `path` is\n   * only used as the cwd for npm's `.npmrc` auth lookup — no\n   * `rewriteWorkspaceDeps` mutation happens, since the tarball's\n   * package.json is already final and must ship byte-for-byte unchanged.\n   */\n  tarballPath?: string;\n}\n\nexport interface ProgrammaticPublishOptions {\n  packages: PackageToPublish[];\n  packageManager?: 'pnpm' | 'npm' | 'yarn';\n  dryRun?: boolean;\n  otp?: string;\n  tag?: string;\n  access?: 'public' | 'restricted';\n  registry?: string;\n  token?: string;\n}\n\nexport interface PublishResult {\n  name: string;\n  version: string;\n  success: boolean;\n  /** Package was already published at this version — counted as success. */\n  alreadyPublished?: boolean;\n  error?: string;\n}\n\nexport interface ProgrammaticPublishResult {\n  results: PublishResult[];\n  published: string[];\n  /** Versions that were already on npm (counted as success). */\n  alreadyPublished: string[];\n  failed: string[];\n  skipped: string[];\n  errors: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Retry configuration\n// ---------------------------------------------------------------------------\n\nconst MAX_RETRIES = 5;\n\n// Exponential base delays (ms). Actual delay = base * jitter(0.8–1.2).\nconst RETRY_BASE_DELAYS_MS = [10_000, 20_000, 40_000, 80_000, 160_000] as const;\n\n/** Retryable error patterns — all transient, not indicative of a bad package. */\nconst RETRYABLE_PATTERNS = [\n  'E429',\n  '429 Too Many Requests',\n  'ECONNRESET',\n  'ETIMEDOUT',\n  'ECONNREFUSED',\n  'ENOTFOUND',\n  'EAI_AGAIN',\n  'socket hang up',\n  'network timeout',\n  'read ECONNRESET',\n];\n\n/** \"Already published\" — treat as success so re-runs are idempotent. */\nconst ALREADY_PUBLISHED_PATTERNS = [\n  'You cannot publish over the previously published versions',\n  'cannot publish over the previously published version',\n  'EPUBLISHCONFLICT',\n  // Some registries return 403 for conflicts\n];\n\nfunction isRetryable(message: string): boolean {\n  return RETRYABLE_PATTERNS.some(p => message.includes(p));\n}\n\nfunction isAlreadyPublished(message: string): boolean {\n  return ALREADY_PUBLISHED_PATTERNS.some(p => message.includes(p));\n}\n\n/** Exponential back-off with ±20% jitter. */\nfunction retryDelay(attempt: number): number {\n  const base = RETRY_BASE_DELAYS_MS[Math.min(attempt, RETRY_BASE_DELAYS_MS.length - 1)]!;\n  const jitter = 0.8 + Math.random() * 0.4; // 0.8 – 1.2\n  return Math.round(base * jitter);\n}\n\n// ---------------------------------------------------------------------------\n// Token resolution\n// ---------------------------------------------------------------------------\n\nfunction resolveToken(token?: string): string | undefined {\n  return token ?? useEnv('NPM_TOKEN') ?? useEnv('NODE_AUTH_TOKEN');\n}\n\n// ---------------------------------------------------------------------------\n// Low-level spawn\n// ---------------------------------------------------------------------------\n\n/**\n * Spawn `packageManager publish` for a single package.\n * Writes a temporary .npmrc for NODE_AUTH_TOKEN auth, cleans it up on exit.\n */\nfunction spawnPublish(options: {\n  packagePath: string;\n  /** Publish this exact tarball instead of packing `packagePath` fresh. */\n  tarballPath?: string;\n  packageManager: string;\n  token: string | undefined;\n  otp?: string;\n  dryRun?: boolean;\n  tag?: string;\n  access?: string;\n  registry?: string;\n}): Promise<void> {\n  const { packagePath, tarballPath, packageManager, token, otp, dryRun, tag, access, registry } = options;\n\n  return new Promise((resolve, reject) => {\n    const args = ['publish'];\n    if (tarballPath) { args.push(tarballPath); }\n\n    if (packageManager === 'pnpm' && !tarballPath) {\n      // pnpm checks git cleanliness; we version-bump before publish which makes\n      // the tree dirty — bypass that check. N/A when publishing a pre-built\n      // tarball — there's no working-tree state for pnpm to check.\n      args.push('--no-git-checks');\n    }\n    if (dryRun)   { args.push('--dry-run'); }\n    if (tag)      { args.push(`--tag=${tag}`); }\n    if (access)   { args.push(`--access=${access}`); }\n    if (registry) { args.push(`--registry=${registry}`); }\n    if (otp)      { args.push(`--otp=${otp}`); }\n\n    const env: NodeJS.ProcessEnv = { ...process.env };\n    if (token) { env['NODE_AUTH_TOKEN'] = token; }\n\n    // Write a per-package .npmrc so npm picks up NODE_AUTH_TOKEN.\n    // The auth line's host must match the target registry — hardcoding\n    // registry.npmjs.org here would silently break token auth against\n    // Verdaccio or any other non-npmjs registry.\n    const npmrcPath = join(packagePath, '.npmrc');\n    const npmrcExisted = existsSync(npmrcPath);\n    const npmrcBackup = npmrcExisted ? readFileSync(npmrcPath, 'utf-8') : null;\n    const registryHost = registry ? new URL(registry).host : 'registry.npmjs.org';\n    const authLine = `//${registryHost}/:_authToken=\\${NODE_AUTH_TOKEN}\\n`;\n\n    if (token) {\n      const existing = npmrcExisted ? readFileSync(npmrcPath, 'utf-8') : '';\n      if (!existing.includes('_authToken')) {\n        writeFileSync(npmrcPath, existing + authLine);\n      }\n    }\n\n    const restoreNpmrc = () => {\n      if (!token) { return; }\n      try {\n        if (npmrcBackup !== null) {\n          writeFileSync(npmrcPath, npmrcBackup);\n        } else if (existsSync(npmrcPath)) {\n          unlinkSync(npmrcPath);\n        }\n      } catch { /* best-effort */ }\n    };\n\n    const child = spawn(packageManager, args, {\n      cwd: packagePath,\n      stdio: ['ignore', 'pipe', 'pipe'],\n      shell: true,\n      env,\n    });\n\n    let stdout = '';\n    let stderr = '';\n\n    child.stdout?.on('data', (d: Buffer) => { stdout += d.toString(); });\n    child.stderr?.on('data', (d: Buffer) => { stderr += d.toString(); });\n\n    child.on('close', (code: number | null) => {\n      restoreNpmrc();\n      if (code === 0) {\n        resolve();\n      } else {\n        reject(new Error(stderr || stdout || `${packageManager} publish exited with code ${code}`));\n      }\n    });\n\n    child.on('error', (err: Error) => {\n      restoreNpmrc();\n      reject(err);\n    });\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Per-package publish with retry\n// ---------------------------------------------------------------------------\n\nasync function publishOne(\n  pkg: PackageToPublish,\n  opts: {\n    packageManager: string;\n    token: string | undefined;\n    versionMap: Map<string, string>;\n    dryRun?: boolean;\n    otp?: string;\n    tag?: string;\n    access?: string;\n    registry?: string;\n  },\n  logger: ReturnType<typeof useLogger>,\n): Promise<PublishResult> {\n  // A pre-built tarball (see PackageToPublish.tarballPath) is already final\n  // — publishing it must ship those exact bytes, so skip the package.json\n  // rewrite entirely rather than mutating a directory whose content the\n  // tarball no longer reflects.\n  const restore = pkg.tarballPath ? (() => {}) : rewriteWorkspaceDeps(pkg, opts.versionMap, opts.packageManager);\n\n  try {\n    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {\n      try {\n        await spawnPublish({\n          packagePath: pkg.path,\n          tarballPath: pkg.tarballPath,\n          packageManager: opts.packageManager,\n          token: opts.token,\n          otp: opts.otp,\n          dryRun: opts.dryRun,\n          tag: opts.tag,\n          access: opts.access,\n          registry: opts.registry,\n        });\n\n        logger.info(`Published ${pkg.name}@${pkg.version}`);\n        return { name: pkg.name, version: pkg.version, success: true };\n\n      } catch (err: unknown) {\n        const message = err instanceof Error ? err.message : String(err);\n\n        // Idempotency: already published at this version → success.\n        if (isAlreadyPublished(message)) {\n          logger.info(`${pkg.name}@${pkg.version} already published — skipping`);\n          return { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true };\n        }\n\n        // Retryable transient error (rate-limit, network blip).\n        if (isRetryable(message) && attempt < MAX_RETRIES) {\n          const delay = retryDelay(attempt);\n          logger.warn(\n            `Transient error for ${pkg.name}@${pkg.version} (attempt ${attempt + 1}/${MAX_RETRIES}), ` +\n            `retrying in ${(delay / 1000).toFixed(1)}s: ${message.split('\\n')[0]}`,\n          );\n          await new Promise<void>(r => { setTimeout(r, delay); });\n          continue;\n        }\n\n        // Permanent failure.\n        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, undefined, { error: message });\n        return { name: pkg.name, version: pkg.version, success: false, error: message };\n      }\n    }\n\n    // Exhausted retries.\n    return {\n      name: pkg.name,\n      version: pkg.version,\n      success: false,\n      error: `Publish failed after ${MAX_RETRIES} retries (transient errors)`,\n    };\n  } finally {\n    restore();\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Main export\n// ---------------------------------------------------------------------------\n\nfunction skipRemainingWaves(\n  waves: ReturnType<typeof topoSort>,\n  waveIdx: number,\n  waveFailed: PublishResult[],\n  logger: ReturnType<typeof useLogger>,\n  allResults: PublishResult[],\n): void {\n  const remaining = waves.slice(waveIdx + 1).reduce((acc, w) => acc + w.length, 0);\n  if (remaining === 0) { return; }\n  logger.warn(\n    `Wave ${waveIdx + 1} had ${waveFailed.length} failure(s) — ` +\n    `skipping ${remaining} package(s) in later waves to avoid broken dependency chain`,\n  );\n  for (const laterWave of waves.slice(waveIdx + 1)) {\n    for (const pkg of laterWave) {\n      allResults.push({ name: pkg.name, version: pkg.version, success: false, error: 'Skipped: dependency wave failed' });\n    }\n  }\n}\n\n/**\n * Publish packages programmatically (non-interactive, for REST handlers / CI).\n *\n * Packages are published in topological order (deps before dependants) to\n * avoid \"package not found\" errors when a dependent is installed right after\n * release. Within each topological wave, publishes run in parallel up to\n * CONCURRENCY.\n */\nexport async function publishPackagesProgrammatic(\n  options: ProgrammaticPublishOptions,\n): Promise<ProgrammaticPublishResult> {\n  const {\n    packages,\n    packageManager = 'pnpm',\n    dryRun,\n    otp,\n    tag,\n    access,\n    registry,\n  } = options;\n\n  const logger = useLogger();\n  const token = resolveToken(options.token);\n\n  if (!token && !dryRun) {\n    const error = 'No npm token found. Set NPM_TOKEN (or NODE_AUTH_TOKEN) in environment.';\n    logger.error(error);\n    return {\n      results: [],\n      published: [],\n      alreadyPublished: [],\n      failed: packages.map(p => `${p.name}@${p.version}`),\n      skipped: [],\n      errors: [error],\n    };\n  }\n\n  // Version map for dep rewriting (workspace:/link: → ^version).\n  const versionMap = new Map(packages.map(p => [p.name, p.version]));\n\n  // Concurrency: default 4 — enough throughput, below npm's sustained rate limit.\n  const CONCURRENCY = Number(useEnv('KB_PUBLISH_CONCURRENCY') ?? 4);\n\n  // Sort packages into topological waves so deps are always published first.\n  const waves = topoSort(packages, packageManager);\n\n  logger.info(\n    `Publishing ${packages.length} package(s) in ${waves.length} topological wave(s) ` +\n    `(concurrency=${CONCURRENCY}, dryRun=${dryRun ?? false})`,\n  );\n\n  const allResults: PublishResult[] = [];\n\n  for (let waveIdx = 0; waveIdx < waves.length; waveIdx++) {\n    const wave = waves[waveIdx]!;\n    logger.info(`Wave ${waveIdx + 1}/${waves.length}: publishing ${wave.length} package(s)`);\n\n    // Publish wave in parallel batches.\n    for (let i = 0; i < wave.length; i += CONCURRENCY) {\n      const batch = wave.slice(i, i + CONCURRENCY);\n      const batchResults = await Promise.all(\n        batch.map(pkg =>\n          publishOne(pkg, { packageManager, token, versionMap, dryRun, otp, tag, access, registry }, logger),\n        ),\n      );\n      allResults.push(...batchResults);\n    }\n\n    // If any package in this wave genuinely failed (not alreadyPublished), stop\n    // publishing the next wave — it may depend on the failed packages.\n    const waveFailed = allResults.slice(-wave.length).filter(r => !r.success);\n    if (waveFailed.length > 0) {\n      skipRemainingWaves(waves, waveIdx, waveFailed, logger, allResults);\n      break;\n    }\n  }\n\n  const published         = allResults.filter(r => r.success && !r.alreadyPublished).map(r => `${r.name}@${r.version}`);\n  const alreadyPublished  = allResults.filter(r => r.alreadyPublished).map(r => `${r.name}@${r.version}`);\n  const failed            = allResults.filter(r => !r.success).map(r => `${r.name}@${r.version}`);\n  const errors            = allResults.filter(r => !r.success && r.error).map(r => `${r.name}: ${r.error}`);\n\n  if (alreadyPublished.length > 0) {\n    logger.info(`${alreadyPublished.length} package(s) already published — counted as success`);\n  }\n\n  return {\n    results: allResults,\n    published,\n    alreadyPublished,\n    failed,\n    skipped: dryRun ? packages.map(p => `${p.name}@${p.version} (dry-run)`) : [],\n    errors,\n  };\n}\n","/**\n * Shared `--release-tag` / `--flow` resolution for commands that operate\n * on an already-decided release (`stage`, `deliver`) — mirrors the tag\n * grammar in `@kb-labs/release-manager-core`'s `resolveFlowFromTag` so CI\n * can pass just the tag and the plugin decides the flow, per the\n * \"plugin prepares, CI delivers\" release plan.\n */\n\nimport { resolveFlowFromTag, type ReleaseConfig } from '@kb-labs/release-manager-core';\n\nexport interface FlowResolvableFlags {\n  flow?: string;\n  'release-tag'?: string;\n}\n\nexport function resolveFlowName(config: ReleaseConfig, flags: FlowResolvableFlags): string | { error: string } {\n  if (flags.flow) { return flags.flow; }\n  if (flags['release-tag']) {\n    const resolved = resolveFlowFromTag(config, flags['release-tag']);\n    if (!resolved) {\n      return { error: `Could not resolve a release.flows entry from tag \"${flags['release-tag']}\"` };\n    }\n    return resolved.flowName;\n  }\n  return { error: 'requires --flow or --release-tag' };\n}\n","/**\n * Deliver command — ships the tarballs `release stage` already packed to a\n * destination (\"target\"), by name. This is the thin-CI half of the\n * \"plugin prepares, CI delivers\" release plan: CI's only job is to have\n * the right target credentials and call this one command with the tag —\n * package selection, tag→flow resolution, retry/backoff, and post-delivery\n * verification all live here, not in CI YAML.\n *\n * Deliberately reads `manifest.json` from `--artifacts-dir` (written by\n * `release stage`) instead of rediscovering or rebuilding packages — the\n * whole point is to ship the exact bytes that were already packed and\n * validated, not a fresh equivalent pack.\n *\n * Not to be confused with `release promote` (`promote.ts`) — that command\n * still re-packs from the working tree at publish time (the older,\n * Verdaccio-pre-flight flow from ADR-0001) and remains in place unchanged.\n */\n\nimport { readFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { defineCommand, type CLIInput, type PluginContextV3, useLoader, useConfig, useEnv } from '@kb-labs/sdk';\nimport {\n  mergeConfigWithFlow,\n  resolvePublishTag,\n  resolvePublishRegistry,\n  verifyAgainstRegistry,\n  type ReleaseConfig,\n  type PublishablePackage,\n} from '@kb-labs/release-manager-core';\nimport { findRepoRoot } from '../../shared/utils';\nimport { publishPackagesProgrammatic, type PackageToPublish } from '../../shared/publish-programmatic';\nimport { resolveFlowName, type FlowResolvableFlags } from '../../shared/resolve-flow';\nimport type { StagedArtifact } from './stage';\n\nconst REGISTRY_VERIFY_RETRIES = 5;\n\ninterface DeliverFlags extends FlowResolvableFlags {\n  target?: string;\n  'artifacts-dir'?: string;\n  tag?: string;\n  registry?: string;\n  otp?: string;\n  access?: string;\n  token?: string;\n  'dry-run'?: boolean;\n  json?: boolean;\n}\n\ninterface DeliverResult {\n  exitCode: number;\n  target?: string;\n  published?: Array<{ name: string; version: string }>;\n  failed?: Array<{ name: string; version: string; error: string }>;\n  verifyIssues?: string[];\n}\n\nfunction loadManifest(artifactsDir: string): StagedArtifact[] | { error: string } {\n  const manifestPath = join(artifactsDir, 'manifest.json');\n  try {\n    return JSON.parse(readFileSync(manifestPath, 'utf-8')) as StagedArtifact[];\n  } catch {\n    return { error: `No manifest.json found at ${manifestPath} — run \\`kb release stage\\` first` };\n  }\n}\n\nexport default defineCommand({\n  id: 'release:deliver',\n  description: 'Ship the tarballs `release stage` already packed to a target (npm) — no packing, no rebuild',\n\n  handler: {\n    async execute(ctx: PluginContextV3, input: CLIInput<DeliverFlags>): Promise<DeliverResult> {\n      const { flags } = input;\n      const target = flags.target ?? 'npm';\n\n      if (target !== 'npm') {\n        const msg = `release:deliver --target ${target} is not implemented — only \"npm\" ships this pass (see release plan's out-of-scope section for github-release/mirror)`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n\n      const cwd = ctx.cwd || process.cwd();\n      const repoRoot = await findRepoRoot(cwd);\n\n      const fileConfig = await useConfig<ReleaseConfig>();\n      const baseConfig: ReleaseConfig = fileConfig ?? {};\n\n      const flowResult = resolveFlowName(baseConfig, flags);\n      if (typeof flowResult !== 'string') {\n        const msg = `release:deliver ${flowResult.error}`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n      const config: ReleaseConfig = mergeConfigWithFlow(baseConfig, flowResult);\n\n      const artifactsDir = join(repoRoot, flags['artifacts-dir'] ?? '.kb/release/artifacts');\n      const manifest = loadManifest(artifactsDir);\n      if (!Array.isArray(manifest)) {\n        if (flags.json) { ctx.ui?.json?.({ error: manifest.error }); } else { ctx.ui?.error?.(manifest.error); }\n        return { exitCode: 1 };\n      }\n      if (manifest.length === 0) {\n        const msg = `manifest.json at ${artifactsDir} lists no packages`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n\n      const dryRun = flags['dry-run'];\n      const npmTag = flags.tag ?? resolvePublishTag(config, 'stable');\n      const registry = flags.registry ?? resolvePublishRegistry(config, 'stable');\n      const token = flags.token ?? useEnv('NPM_TOKEN') ?? useEnv('NODE_AUTH_TOKEN');\n\n      const packages: PackageToPublish[] = manifest.map(a => ({\n        name: a.name,\n        version: a.version,\n        path: artifactsDir,\n        tarballPath: join(artifactsDir, a.tarball),\n      }));\n\n      const publishLoader = useLoader(`Delivering ${packages.length} package(s) to npm...`);\n      publishLoader.start();\n\n      // Publishing pre-built tarballs via `npm publish <tarball>` specifically\n      // (not pnpm/yarn) — these were packed with `npm pack` in `release\n      // stage`, and npm's tarball-argument publish is the well-established\n      // path; no need to introduce pnpm/yarn tarball-publish behavior here.\n      const publishResult = await publishPackagesProgrammatic({\n        packages,\n        packageManager: 'npm',\n        dryRun,\n        otp: flags.otp,\n        tag: npmTag,\n        access: (flags.access as 'public' | 'restricted' | undefined) ?? config.publish?.access,\n        registry,\n        token,\n      });\n\n      const failed = publishResult.results.filter(r => !r.success);\n      if (failed.length > 0) {\n        publishLoader.fail(`${failed.length} package(s) failed to publish`);\n        const result: DeliverResult = {\n          exitCode: 1,\n          target,\n          published: publishResult.results.filter(r => r.success).map(r => ({ name: r.name, version: r.version })),\n          failed: failed.map(r => ({ name: r.name, version: r.version, error: r.error ?? 'Unknown error' })),\n        };\n        if (flags.json) { ctx.ui?.json?.(result); } else {\n          ctx.ui?.sideBox?.({\n            title: 'Deliver — npm',\n            sections: [{ header: 'Failed', items: failed.map(r => `${ctx.ui.symbols.error} ${r.name}@${r.version} — ${r.error}`) }],\n            status: 'error',\n          });\n        }\n        return result;\n      }\n      publishLoader.succeed(`Delivered ${publishResult.results.length} package(s) to npm`);\n\n      if (dryRun) {\n        const result: DeliverResult = { exitCode: 0, target, published: publishResult.results.map(r => ({ name: r.name, version: r.version })) };\n        if (flags.json) { ctx.ui?.json?.(result); }\n        return result;\n      }\n\n      // Post-delivery verification against the real registry — this is the\n      // gap `release promote` always had (it never verified anything after\n      // publishing). Real npm has propagation lag Verdaccio doesn't, hence\n      // the retry budget here instead of a single-shot check.\n      const verifyLoader = useLoader('Verifying delivery against the registry...');\n      verifyLoader.start();\n      const verifyTargets: PublishablePackage[] = manifest.map(a => ({ name: a.name, version: a.version, path: artifactsDir }));\n      const verifyResults = await verifyAgainstRegistry(verifyTargets, {\n        registry,\n        retries: REGISTRY_VERIFY_RETRIES,\n        logger: ctx.platform?.logger,\n      });\n      const verifyIssues = verifyResults.flatMap(r => r.issues);\n\n      const result: DeliverResult = {\n        exitCode: verifyIssues.length === 0 ? 0 : 1,\n        target,\n        published: publishResult.results.map(r => ({ name: r.name, version: r.version })),\n        verifyIssues,\n      };\n\n      if (verifyIssues.length > 0) {\n        // The publish already succeeded and is live — never attempt\n        // npm unpublish here. Surface loudly and let a human decide.\n        verifyLoader.fail(`Delivery verification found ${verifyIssues.length} issue(s) — packages are published, verification failed`);\n      } else {\n        verifyLoader.succeed('Delivery verified against the registry');\n      }\n\n      if (flags.json) {\n        ctx.ui?.json?.(result);\n        return result;\n      }\n\n      ctx.ui?.sideBox?.({\n        title: 'Deliver — npm',\n        sections: [\n          { header: `Delivered to ${registry} (tag: ${npmTag})`, items: publishResult.results.map(r => `${ctx.ui.symbols.success} ${r.name}@${r.version}`) },\n          ...(verifyIssues.length > 0 ? [{ header: 'Verification issues', items: verifyIssues.map(i => `${ctx.ui.symbols.error} ${i}`) }] : []),\n        ],\n        status: verifyIssues.length === 0 ? 'success' : 'error',\n      });\n\n      return result;\n    },\n  },\n});\n"]}
+{"version":3,"sources":["../../../src/shared/dep-rewrite.ts","../../../src/shared/publish-programmatic.ts","../../../src/shared/resolve-flow.ts","../../../src/cli/commands/deliver.ts"],"names":["join","readFileSync","writeFileSync","useEnv","result"],"mappings":";;;;;;;AAyBA,SAAS,cAAA,CACP,IAAA,EACA,OAAA,EACA,GAAA,EACA,SACA,UAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA;AACrC,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC1B,IAAA;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AACzC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,CAAK,SAAS,QAAA,EAAU,cAAc,CAAA,EAAG,OAAO,CAAC,CAAA;AACxF,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,CAAA,CAAA,EAAI,MAAA,CAAO,WAAW,GAAG,CAAA,CAAA;AAAA,EAC3C,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,CAAK,OAAO,CAAA,GAAI,GAAA;AAAA,EAClB;AACF;AAEA,SAAS,mBAAA,CACP,IAAA,EACA,OAAA,EACA,GAAA,EACA,UAAA,EACS;AACT,EAAA,MAAM,MAAA,GAAS,UAAA,CAAW,GAAA,CAAI,OAAO,CAAA;AACrC,EAAA,IAAI,CAAC,MAAA,EAAQ;AAAE,IAAA,OAAO,KAAA;AAAA,EAAO;AAC7B,EAAA,IAAA,CAAK,OAAO,CAAA,GAAI,GAAA,KAAQ,aAAA,GAAgB,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,YAAA,EAAc,EAAE,CAAA;AACnF,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,kBAAA,CACP,IAAA,EACA,OAAA,EACA,UAAA,EACA,cAAA,EACS;AACT,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,KAAA,MAAW,OAAA,IAAW,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACvC,IAAA,MAAM,GAAA,GAAM,KAAK,OAAO,CAAA;AACxB,IAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAAE,MAAA;AAAA,IAAU;AACzC,IAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,MAAA,cAAA,CAAe,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,OAAA,EAAS,UAAU,CAAA;AACtD,MAAA,QAAA,GAAW,IAAA;AAAA,IACb,CAAA,MAAA,IAAW,GAAA,CAAI,UAAA,CAAW,YAAY,CAAA,IAAK,cAAA,KAAmB,MAAA,IAAU,mBAAA,CAAoB,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,UAAU,CAAA,EAAG;AAC3H,MAAA,QAAA,GAAW,IAAA;AAAA,IACb;AAAA,EACF;AACA,EAAA,OAAO,QAAA;AACT;AAEO,SAAS,oBAAA,CACd,GAAA,EACA,UAAA,EACA,cAAA,EACY;AACZ,EAAA,MAAM,UAAU,GAAA,CAAI,IAAA;AACpB,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAChD,EAAA,MAAM,QAAA,GAAW,YAAA,CAAa,WAAA,EAAa,OAAO,CAAA;AAClD,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA;AACnC,EAAA,IAAI,QAAA,GAAW,KAAA;AAEf,EAAA,IAAI,OAAA,CAAQ,OAAA,KAAY,GAAA,CAAI,OAAA,EAAS;AACnC,IAAA,OAAA,CAAQ,UAAU,GAAA,CAAI,OAAA;AACtB,IAAA,QAAA,GAAW,IAAA;AAAA,EACb;AAEA,EAAA,KAAA,MAAW,OAAA,IAAW,CAAC,cAAA,EAAgB,kBAAkB,CAAA,EAAY;AACnE,IAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,CAAA;AAC5B,IAAA,IAAI,CAAC,IAAA,EAAM;AAAE,MAAA;AAAA,IAAU;AACvB,IAAA,IAAI,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,UAAA,EAAY,cAAc,CAAA,EAAG;AAAE,MAAA,QAAA,GAAW,IAAA;AAAA,IAAM;AAAA,EACxF;AAEA,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,aAAA,CAAc,aAAa,IAAA,CAAK,SAAA,CAAU,SAAS,IAAA,EAAM,CAAC,IAAI,IAAI,CAAA;AAAA,EACpE;AAEA,EAAA,OAAO,MAAM,aAAA,CAAc,WAAA,EAAa,QAAQ,CAAA;AAClD;AAoBA,SAAS,cAAA,CAAe,UAAyB,OAAA,EAAgD;AAC/F,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAyB;AAC1C,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,MAAM,KAAA,uBAAY,GAAA,EAAY;AAC9B,IAAA,IAAI;AACF,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,CAAK,IAAI,IAAA,EAAM,cAAc,CAAA,EAAG,OAAO,CAAC,CAAA;AAIhF,MAAA,KAAA,MAAW,OAAA,IAAW,CAAC,cAAA,EAAgB,kBAAkB,CAAA,EAAY;AACnE,QAAA,KAAA,MAAW,OAAA,IAAW,OAAO,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAA,IAAK,EAAE,CAAA,EAAG;AACzD,UAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG;AAAE,YAAA,KAAA,CAAM,IAAI,OAAO,CAAA;AAAA,UAAG;AAAA,QAClD;AAAA,MACF;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,IAAA,EAAM,KAAK,CAAA;AAAA,EAC1B;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,kBAAA,CAAmB,UAAyB,IAAA,EAA0D;AAC7G,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAyB;AAChD,EAAA,KAAA,MAAW,OAAO,QAAA,EAAU;AAC1B,IAAA,KAAA,MAAW,OAAO,IAAA,CAAK,GAAA,CAAI,IAAI,IAAI,CAAA,IAAK,EAAC,EAAG;AAC1C,MAAA,IAAI,CAAC,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,EAAG;AAAE,QAAA,UAAA,CAAW,GAAA,CAAI,GAAA,kBAAK,IAAI,GAAA,EAAK,CAAA;AAAA,MAAG;AAC5D,MAAA,UAAA,CAAW,GAAA,CAAI,GAAG,CAAA,CAAG,GAAA,CAAI,IAAI,IAAI,CAAA;AAAA,IACnC;AAAA,EACF;AACA,EAAA,OAAO,UAAA;AACT;AAEA,SAAS,YAAA,CACP,QAAA,EACA,IAAA,EACA,UAAA,EACiB;AACjB,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,IAAA,EAAM,CAAC,CAAC,CAAC,CAAA;AACrD,EAAA,MAAM,YAAY,IAAI,GAAA;AAAA,IACpB,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,EAAE,IAAA,EAAA,CAAO,IAAA,CAAK,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,oBAAK,IAAI,GAAA,EAAI,EAAG,IAAI,CAAC;AAAA,GAClE;AACA,EAAA,MAAM,QAAyB,EAAC;AAEhC,EAAA,OAAO,SAAA,CAAU,OAAO,CAAA,EAAG;AACzB,IAAA,MAAM,IAAA,GAAO,CAAC,GAAG,SAAA,CAAU,OAAA,EAAS,CAAA,CACjC,MAAA,CAAO,CAAC,GAAG,KAAK,MAAM,KAAA,KAAU,CAAC,CAAA,CACjC,GAAA,CAAI,CAAC,CAAC,IAAI,CAAA,KAAM,MAAA,CAAO,GAAA,CAAI,IAAI,CAAE,CAAA;AAEpC,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,KAAA,CAAM,IAAA,CAAK,CAAC,GAAG,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,MAAA,CAAO,GAAA,CAAI,CAAC,CAAE,CAAC,CAAA;AACzD,MAAA;AAAA,IACF;AAEA,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AACf,IAAA,KAAA,MAAW,OAAO,IAAA,EAAM;AACtB,MAAA,SAAA,CAAU,MAAA,CAAO,IAAI,IAAI,CAAA;AACzB,MAAA,KAAA,MAAW,aAAa,UAAA,CAAW,GAAA,CAAI,IAAI,IAAI,CAAA,IAAK,EAAC,EAAG;AACtD,QAAA,IAAI,SAAA,CAAU,GAAA,CAAI,SAAS,CAAA,EAAG;AAC5B,UAAA,SAAA,CAAU,IAAI,SAAA,EAAA,CAAY,SAAA,CAAU,IAAI,SAAS,CAAA,IAAK,KAAK,CAAC,CAAA;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,KAAA,CAAM,MAAA,CAAO,CAAA,CAAA,KAAK,CAAA,CAAE,SAAS,CAAC,CAAA;AACvC;AAEO,SAAS,QAAA,CAAS,UAAyB,eAAA,EAA0C;AAC1F,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,IAAI,CAAC,CAAA;AACjD,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,QAAA,EAAU,OAAO,CAAA;AAC7C,EAAA,MAAM,UAAA,GAAa,kBAAA,CAAmB,QAAA,EAAU,IAAI,CAAA;AACpD,EAAA,OAAO,YAAA,CAAa,QAAA,EAAU,IAAA,EAAM,UAAU,CAAA;AAChD;;;ACxHA,IAAM,WAAA,GAAc,CAAA;AAGpB,IAAM,uBAAuB,CAAC,GAAA,EAAQ,GAAA,EAAQ,GAAA,EAAQ,KAAQ,IAAO,CAAA;AAGrE,IAAM,kBAAA,GAAqB;AAAA,EACzB,MAAA;AAAA,EACA,uBAAA;AAAA,EACA,YAAA;AAAA,EACA,WAAA;AAAA,EACA,cAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,gBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACF,CAAA;AAGA,IAAM,0BAAA,GAA6B;AAAA,EACjC,2DAAA;AAAA,EACA,sDAAA;AAAA,EACA;AAAA;AAEF,CAAA;AAEA,SAAS,YAAY,OAAA,EAA0B;AAC7C,EAAA,OAAO,mBAAmB,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAC,CAAA;AACzD;AAEA,SAAS,mBAAmB,OAAA,EAA0B;AACpD,EAAA,OAAO,2BAA2B,IAAA,CAAK,CAAA,CAAA,KAAK,OAAA,CAAQ,QAAA,CAAS,CAAC,CAAC,CAAA;AACjE;AASA,IAAM,eAAA,GAA0C;AAAA,EAC9C,IAAA,EAAM,qVAAA;AAAA,EACN,IAAA,EAAM,iHAAA;AAAA,EACN,IAAA,EAAM,gIAAA;AAAA,EACN,IAAA,EAAM;AACR,CAAA;AAGA,SAAS,oBAAoB,OAAA,EAAqC;AAChE,EAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,KAAA,CAAM,iCAAiC,CAAA;AAC7D,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAGA,SAAS,qBAAqB,OAAA,EAAmD;AAC/E,EAAA,MAAM,IAAA,GAAO,oBAAoB,OAAO,CAAA;AACxC,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,eAAA,CAAgB,IAAI,CAAA,GAAI,MAAA;AAC5C,EAAA,OAAO,EAAE,MAAM,IAAA,EAAK;AACtB;AAGA,SAAS,WAAW,OAAA,EAAyB;AAC3C,EAAA,MAAM,IAAA,GAAO,qBAAqB,IAAA,CAAK,GAAA,CAAI,SAAS,oBAAA,CAAqB,MAAA,GAAS,CAAC,CAAC,CAAA;AACpF,EAAA,MAAM,MAAA,GAAS,GAAA,GAAM,IAAA,CAAK,MAAA,EAAO,GAAI,GAAA;AACrC,EAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,MAAM,CAAA;AACjC;AAMA,SAAS,aAAa,KAAA,EAAoC;AACxD,EAAA,OAAO,KAAA,IAAS,MAAA,CAAO,WAAW,CAAA,IAAK,OAAO,iBAAiB,CAAA;AACjE;AAUA,SAAS,aAAa,OAAA,EAWJ;AAChB,EAAA,MAAM,EAAE,WAAA,EAAa,WAAA,EAAa,cAAA,EAAgB,KAAA,EAAO,KAAK,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,QAAA,EAAS,GAAI,OAAA;AAEhG,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,IAAA,GAAO,CAAC,SAAS,CAAA;AACvB,IAAA,IAAI,WAAA,EAAa;AAAE,MAAA,IAAA,CAAK,KAAK,WAAW,CAAA;AAAA,IAAG;AAE3C,IAAA,IAAI,cAAA,KAAmB,MAAA,IAAU,CAAC,WAAA,EAAa;AAI7C,MAAA,IAAA,CAAK,KAAK,iBAAiB,CAAA;AAAA,IAC7B;AACA,IAAA,IAAI,MAAA,EAAU;AAAE,MAAA,IAAA,CAAK,KAAK,WAAW,CAAA;AAAA,IAAG;AACxC,IAAA,IAAI,GAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,MAAA,EAAS,GAAG,CAAA,CAAE,CAAA;AAAA,IAAG;AAC3C,IAAA,IAAI,MAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,SAAA,EAAY,MAAM,CAAA,CAAE,CAAA;AAAA,IAAG;AACjD,IAAA,IAAI,QAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,WAAA,EAAc,QAAQ,CAAA,CAAE,CAAA;AAAA,IAAG;AACrD,IAAA,IAAI,GAAA,EAAU;AAAE,MAAA,IAAA,CAAK,IAAA,CAAK,CAAA,MAAA,EAAS,GAAG,CAAA,CAAE,CAAA;AAAA,IAAG;AAE3C,IAAA,MAAM,GAAA,GAAyB,EAAE,GAAG,OAAA,CAAQ,GAAA,EAAI;AAChD,IAAA,IAAI,KAAA,EAAO;AAAE,MAAA,GAAA,CAAI,iBAAiB,CAAA,GAAI,KAAA;AAAA,IAAO;AAM7C,IAAA,MAAM,SAAA,GAAYA,IAAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAC5C,IAAA,MAAM,YAAA,GAAe,WAAW,SAAS,CAAA;AACzC,IAAA,MAAM,WAAA,GAAc,YAAA,GAAeC,YAAAA,CAAa,SAAA,EAAW,OAAO,CAAA,GAAI,IAAA;AACtE,IAAA,MAAM,eAAe,QAAA,GAAW,IAAI,GAAA,CAAI,QAAQ,EAAE,IAAA,GAAO,oBAAA;AACzD,IAAA,MAAM,QAAA,GAAW,KAAK,YAAY,CAAA;AAAA,CAAA;AAElC,IAAA,IAAI,KAAA,EAAO;AACT,MAAA,MAAM,QAAA,GAAW,YAAA,GAAeA,YAAAA,CAAa,SAAA,EAAW,OAAO,CAAA,GAAI,EAAA;AACnE,MAAA,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,YAAY,CAAA,EAAG;AACpC,QAAAC,aAAAA,CAAc,SAAA,EAAW,QAAA,GAAW,QAAQ,CAAA;AAAA,MAC9C;AAAA,IACF;AAEA,IAAA,MAAM,eAAe,MAAM;AACzB,MAAA,IAAI,CAAC,KAAA,EAAO;AAAE,QAAA;AAAA,MAAQ;AACtB,MAAA,IAAI;AACF,QAAA,IAAI,gBAAgB,IAAA,EAAM;AACxB,UAAAA,aAAAA,CAAc,WAAW,WAAW,CAAA;AAAA,QACtC,CAAA,MAAA,IAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AAChC,UAAA,UAAA,CAAW,SAAS,CAAA;AAAA,QACtB;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAAoB;AAAA,IAC9B,CAAA;AAEA,IAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,cAAA,EAAgB,IAAA,EAAM;AAAA,MACxC,GAAA,EAAK,WAAA;AAAA,MACL,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,MAAM,CAAA;AAAA,MAChC,KAAA,EAAO,IAAA;AAAA,MACP;AAAA,KACD,CAAA;AAED,IAAA,IAAI,MAAA,GAAS,EAAA;AACb,IAAA,IAAI,MAAA,GAAS,EAAA;AAEb,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AAAE,MAAA,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAAG,CAAC,CAAA;AACnE,IAAA,KAAA,CAAM,MAAA,EAAQ,EAAA,CAAG,MAAA,EAAQ,CAAC,CAAA,KAAc;AAAE,MAAA,MAAA,IAAU,EAAE,QAAA,EAAS;AAAA,IAAG,CAAC,CAAA;AAEnE,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,IAAA,KAAwB;AACzC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,CAAA,EAAG;AACd,QAAA,OAAA,EAAQ;AAAA,MACV,CAAA,MAAO;AACL,QAAA,MAAA,CAAO,IAAI,MAAM,MAAA,IAAU,MAAA,IAAU,GAAG,cAAc,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAE,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF,CAAC,CAAA;AAED,IAAA,KAAA,CAAM,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAe;AAChC,MAAA,YAAA,EAAa;AACb,MAAA,MAAA,CAAO,GAAG,CAAA;AAAA,IACZ,CAAC,CAAA;AAAA,EACH,CAAC,CAAA;AACH;AAMA,eAAe,UAAA,CACb,GAAA,EACA,IAAA,EAUA,MAAA,EACwB;AAKxB,EAAA,MAAM,OAAA,GAAU,GAAA,CAAI,WAAA,IAAe,MAAM;AAAA,EAAC,KAAK,oBAAA,CAAqB,GAAA,EAAK,IAAA,CAAK,UAAA,EAAY,KAAK,cAAc,CAAA;AAE7G,EAAA,IAAI;AACF,IAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,WAAA,EAAa,OAAA,EAAA,EAAW;AACvD,MAAA,IAAI;AACF,QAAA,MAAM,YAAA,CAAa;AAAA,UACjB,aAAa,GAAA,CAAI,IAAA;AAAA,UACjB,aAAa,GAAA,CAAI,WAAA;AAAA,UACjB,gBAAgB,IAAA,CAAK,cAAA;AAAA,UACrB,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,KAAK,IAAA,CAAK,GAAA;AAAA,UACV,QAAQ,IAAA,CAAK,MAAA;AAAA,UACb,UAAU,IAAA,CAAK;AAAA,SAChB,CAAA;AAED,QAAA,MAAA,CAAO,KAAK,CAAA,UAAA,EAAa,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,CAAE,CAAA;AAClD,QAAA,OAAO,EAAE,MAAM,GAAA,CAAI,IAAA,EAAM,SAAS,GAAA,CAAI,OAAA,EAAS,SAAS,IAAA,EAAK;AAAA,MAE/D,SAAS,GAAA,EAAc;AACrB,QAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,QAAA,IAAI,kBAAA,CAAmB,OAAO,CAAA,EAAG;AAC/B,UAAA,MAAA,CAAO,KAAK,CAAA,EAAG,GAAA,CAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,CAAA,kCAAA,CAA+B,CAAA;AACrE,UAAA,OAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,IAAI,OAAA,EAAS,OAAA,EAAS,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAK;AAAA,QACvF;AAGA,QAAA,IAAI,WAAA,CAAY,OAAO,CAAA,IAAK,OAAA,GAAU,WAAA,EAAa;AACjD,UAAA,MAAM,KAAA,GAAQ,WAAW,OAAO,CAAA;AAChC,UAAA,MAAA,CAAO,IAAA;AAAA,YACL,CAAA,oBAAA,EAAuB,IAAI,IAAI,CAAA,CAAA,EAAI,IAAI,OAAO,CAAA,UAAA,EAAa,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,WAAW,mBACrE,KAAA,GAAQ,GAAA,EAAM,OAAA,CAAQ,CAAC,CAAC,CAAA,GAAA,EAAM,QAAQ,KAAA,CAAM,IAAI,CAAA,CAAE,CAAC,CAAC,CAAA;AAAA,WACtE;AACA,UAAA,MAAM,IAAI,QAAc,CAAA,CAAA,KAAK;AAAE,YAAA,UAAA,CAAW,GAAG,KAAK,CAAA;AAAA,UAAG,CAAC,CAAA;AACtD,UAAA;AAAA,QACF;AAGA,QAAA,MAAM,EAAE,IAAA,EAAM,IAAA,EAAK,GAAI,qBAAqB,OAAO,CAAA;AACnD,QAAA,MAAA,CAAO,KAAA,CAAM,CAAA,kBAAA,EAAqB,GAAA,CAAI,IAAI,IAAI,GAAA,CAAI,OAAO,CAAA,CAAA,EAAI,KAAA,CAAA,EAAW,EAAE,KAAA,EAAO,OAAA,EAAS,SAAA,EAAW,MAAM,CAAA;AAC3G,QAAA,OAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,SAAS,GAAA,CAAI,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,OAAA,EAAS,SAAA,EAAW,IAAA,EAAM,WAAW,IAAA,EAAK;AAAA,MAClH;AAAA,IACF;AAGA,IAAA,OAAO;AAAA,MACL,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,SAAS,GAAA,CAAI,OAAA;AAAA,MACb,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,wBAAwB,WAAW,CAAA,2BAAA;AAAA,KAC5C;AAAA,EACF,CAAA,SAAE;AACA,IAAA,OAAA,EAAQ;AAAA,EACV;AACF;AAMA,SAAS,kBAAA,CACP,KAAA,EACA,OAAA,EACA,UAAA,EACA,QACA,UAAA,EACM;AACN,EAAA,MAAM,SAAA,GAAY,KAAA,CAAM,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,GAAA,EAAK,CAAA,KAAM,GAAA,GAAM,CAAA,CAAE,QAAQ,CAAC,CAAA;AAC/E,EAAA,IAAI,cAAc,CAAA,EAAG;AAAE,IAAA;AAAA,EAAQ;AAC/B,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,QAAQ,OAAA,GAAU,CAAC,QAAQ,UAAA,CAAW,MAAM,+BAChC,SAAS,CAAA,2DAAA;AAAA,GACvB;AACA,EAAA,KAAA,MAAW,SAAA,IAAa,KAAA,CAAM,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA,EAAG;AAChD,IAAA,KAAA,MAAW,OAAO,SAAA,EAAW;AAC3B,MAAA,UAAA,CAAW,IAAA,CAAK,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,GAAA,CAAI,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,iCAAA,EAAmC,CAAA;AAAA,IACpH;AAAA,EACF;AACF;AAUA,eAAsB,4BACpB,OAAA,EACoC;AACpC,EAAA,MAAM;AAAA,IACJ,QAAA;AAAA,IACA,cAAA,GAAiB,MAAA;AAAA,IACjB,MAAA;AAAA,IACA,GAAA;AAAA,IACA,GAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACF,GAAI,OAAA;AAEJ,EAAA,MAAM,SAAS,SAAA,EAAU;AACzB,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAA;AAExC,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,MAAA,EAAQ;AACrB,IAAA,MAAM,KAAA,GAAQ,wEAAA;AACd,IAAA,MAAA,CAAO,MAAM,KAAK,CAAA;AAClB,IAAA,OAAO;AAAA,MACL,SAAS,EAAC;AAAA,MACV,WAAW,EAAC;AAAA,MACZ,kBAAkB,EAAC;AAAA,MACnB,MAAA,EAAQ,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAAA,MAClD,SAAS,EAAC;AAAA,MACV,MAAA,EAAQ,CAAC,KAAK;AAAA,KAChB;AAAA,EACF;AAGA,EAAA,MAAM,UAAA,GAAa,IAAI,GAAA,CAAI,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,OAAO,CAAC,CAAC,CAAA;AAGjE,EAAA,MAAM,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,wBAAwB,KAAK,CAAC,CAAA;AAGhE,EAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,QAAwB,CAAA;AAE/C,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,CAAA,WAAA,EAAc,QAAA,CAAS,MAAM,CAAA,eAAA,EAAkB,KAAA,CAAM,MAAM,CAAA,kCAAA,EAC3C,WAAW,CAAA,SAAA,EAAY,MAAA,IAAU,KAAK,CAAA,CAAA;AAAA,GACxD;AAEA,EAAA,MAAM,aAA8B,EAAC;AAErC,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,GAAU,KAAA,CAAM,QAAQ,OAAA,EAAA,EAAW;AACvD,IAAA,MAAM,IAAA,GAAO,MAAM,OAAO,CAAA;AAC1B,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,KAAA,EAAQ,OAAA,GAAU,CAAC,CAAA,CAAA,EAAI,MAAM,MAAM,CAAA,aAAA,EAAgB,IAAA,CAAK,MAAM,CAAA,WAAA,CAAa,CAAA;AAGvF,IAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,MAAA,EAAQ,KAAK,WAAA,EAAa;AACjD,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,IAAI,WAAW,CAAA;AAC3C,MAAA,MAAM,YAAA,GAAe,MAAM,OAAA,CAAQ,GAAA;AAAA,QACjC,KAAA,CAAM,GAAA;AAAA,UAAI,CAAA,GAAA,KACR,UAAA,CAAW,GAAA,EAAK,EAAE,cAAA,EAAgB,KAAA,EAAO,UAAA,EAAY,MAAA,EAAQ,GAAA,EAAK,GAAA,EAAK,MAAA,EAAQ,QAAA,IAAY,MAAM;AAAA;AACnG,OACF;AACA,MAAA,UAAA,CAAW,IAAA,CAAK,GAAG,YAAY,CAAA;AAAA,IACjC;AAIA,IAAA,MAAM,UAAA,GAAa,UAAA,CAAW,KAAA,CAAM,CAAC,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,OAAO,CAAA;AACxE,IAAA,IAAI,UAAA,CAAW,SAAS,CAAA,EAAG;AACzB,MAAA,kBAAA,CAAmB,KAAA,EAAO,OAAA,EAAS,UAAA,EAAY,MAAA,EAAQ,UAAU,CAAA;AACjE,MAAA;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,YAAoB,UAAA,CAAW,MAAA,CAAO,OAAK,CAAA,CAAE,OAAA,IAAW,CAAC,CAAA,CAAE,gBAAgB,CAAA,CAAE,GAAA,CAAI,OAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACpH,EAAA,MAAM,gBAAA,GAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,gBAAgB,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AACtG,EAAA,MAAM,SAAoB,UAAA,CAAW,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA;AAC9F,EAAA,MAAM,SAAoB,UAAA,CAAW,MAAA,CAAO,OAAK,CAAC,CAAA,CAAE,WAAW,CAAA,CAAE,KAAK,CAAA,CAAE,GAAA,CAAI,OAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,EAAA,EAAK,CAAA,CAAE,KAAK,CAAA,CAAE,CAAA;AAExG,EAAA,IAAI,gBAAA,CAAiB,SAAS,CAAA,EAAG;AAC/B,IAAA,MAAA,CAAO,IAAA,CAAK,CAAA,EAAG,gBAAA,CAAiB,MAAM,CAAA,uDAAA,CAAoD,CAAA;AAAA,EAC5F;AAEA,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,UAAA;AAAA,IACT,SAAA;AAAA,IACA,gBAAA;AAAA,IACA,MAAA;AAAA,IACA,OAAA,EAAS,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,UAAA,CAAY,IAAI,EAAC;AAAA,IAC3E;AAAA,GACF;AACF;ACrbO,SAAS,eAAA,CAAgB,QAAuB,KAAA,EAAwD;AAC7G,EAAA,IAAI,MAAM,IAAA,EAAM;AAAE,IAAA,OAAO,KAAA,CAAM,IAAA;AAAA,EAAM;AACrC,EAAA,IAAI,KAAA,CAAM,aAAa,CAAA,EAAG;AACxB,IAAA,MAAM,QAAA,GAAW,kBAAA,CAAmB,MAAA,EAAQ,KAAA,CAAM,aAAa,CAAC,CAAA;AAChE,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,OAAO,EAAE,KAAA,EAAO,CAAA,kDAAA,EAAqD,KAAA,CAAM,aAAa,CAAC,CAAA,CAAA,CAAA,EAAI;AAAA,IAC/F;AACA,IAAA,OAAO,QAAA,CAAS,QAAA;AAAA,EAClB;AACA,EAAA,OAAO,EAAE,OAAO,kCAAA,EAAmC;AACrD;;;ACSA,IAAM,uBAAA,GAA0B,CAAA;AA8BhC,SAAS,aAAa,YAAA,EAA4D;AAChF,EAAA,MAAM,YAAA,GAAeF,IAAAA,CAAK,YAAA,EAAc,eAAe,CAAA;AACvD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAMC,YAAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,KAAA,EAAO,CAAA,0BAAA,EAA6B,YAAY,CAAA,sCAAA,CAAA,EAAoC;AAAA,EAC/F;AACF;AASA,SAAS,uBAAuB,QAAA,EAAwB;AACtD,EAAA,MAAM,WAAA,GAAcE,OAAO,qBAAqB,CAAA;AAChD,EAAA,IAAI,CAAC,WAAA,EAAa;AAAE,IAAA;AAAA,EAAQ;AAC5B,EAAA,IAAI;AACF,IAAA,cAAA,CAAe,aAAa,QAAA,CAAS,QAAA,CAAS,IAAI,CAAA,GAAI,QAAA,GAAW,GAAG,QAAQ;AAAA,CAAI,CAAA;AAAA,EAClF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,2BAAA,CAA4B,MAAA,EAAgB,cAAA,EAAwB,MAAA,EAAkC;AAC7G,EAAA,MAAM,KAAA,GAAkB;AAAA,IACtB,CAAA,qCAAA,EAAmC,MAAM,CAAA,UAAA,EAAQ,MAAA,CAAO,MAAM,CAAA,kBAAA,CAAA;AAAA,IAC9D,EAAA;AAAA,IACA,CAAA,EAAG,cAAc,CAAA,oCAAA,EAAuC,MAAA,CAAO,MAAM,CAAA,SAAA,CAAA;AAAA,IACrE;AAAA,GACF;AACA,EAAA,KAAA,MAAW,KAAK,MAAA,EAAQ;AACtB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,MAAA,EAAS,CAAA,CAAE,IAAI,IAAI,CAAA,CAAE,OAAO,CAAA,EAAA,EAAK,CAAA,CAAE,YAAY,CAAA,UAAA,EAAQ,CAAA,CAAE,SAAS,CAAA,EAAA,CAAA,GAAO,EAAE,CAAA,CAAE,CAAA;AACxF,IAAA,IAAI,EAAE,SAAA,EAAW;AAAE,MAAA,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,CAAA,EAAA,EAAK,CAAA,CAAE,SAAS,CAAA,EAAA,CAAI,CAAA;AAAA,IAAG;AACzD,IAAA,KAAA,CAAM,IAAA,CAAK,EAAA,EAAI,KAAA,EAAO,CAAA,CAAE,KAAA,CAAM,MAAM,CAAA,EAAG,GAAI,CAAA,EAAG,KAAA,EAAO,EAAE,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,IAAO,kBAAQ,aAAA,CAAc;AAAA,EAC3B,EAAA,EAAI,iBAAA;AAAA,EACJ,WAAA,EAAa,kGAAA;AAAA,EAEb,OAAA,EAAS;AAAA,IACP,MAAM,OAAA,CAAQ,GAAA,EAAsB,KAAA,EAAuD;AACzF,MAAA,MAAM,EAAE,OAAM,GAAI,KAAA;AAClB,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,IAAU,KAAA;AAE/B,MAAA,IAAI,WAAW,KAAA,EAAO;AACpB,QAAA,MAAM,GAAA,GAAM,4BAA4B,MAAM,CAAA,yHAAA,CAAA;AAC9C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AAEA,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACnC,MAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,GAAG,CAAA;AAEvC,MAAA,MAAM,UAAA,GAAa,MAAM,SAAA,EAAyB;AAClD,MAAA,MAAM,UAAA,GAA4B,cAAc,EAAC;AAEjD,MAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,UAAA,EAAY,KAAK,CAAA;AACpD,MAAA,IAAI,OAAO,eAAe,QAAA,EAAU;AAClC,QAAA,MAAM,GAAA,GAAM,CAAA,gBAAA,EAAmB,UAAA,CAAW,KAAK,CAAA,CAAA;AAC/C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AACA,MAAA,MAAM,MAAA,GAAwB,mBAAA,CAAoB,UAAA,EAAY,UAAU,CAAA;AAExE,MAAA,MAAM,eAAeH,IAAAA,CAAK,QAAA,EAAU,KAAA,CAAM,eAAe,KAAK,uBAAuB,CAAA;AACrF,MAAA,MAAM,QAAA,GAAW,aAAa,YAAY,CAAA;AAC1C,MAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,QAAQ,CAAA,EAAG;AAC5B,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,IAAI,IAAA,GAAO,EAAE,KAAA,EAAO,QAAA,CAAS,OAAO,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,KAAA,GAAQ,QAAA,CAAS,KAAK,CAAA;AAAA,QAAG;AACvG,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AACA,MAAA,IAAI,QAAA,CAAS,WAAW,CAAA,EAAG;AACzB,QAAA,MAAM,GAAA,GAAM,oBAAoB,YAAY,CAAA,kBAAA,CAAA;AAC5C,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,IAAA,GAAO,EAAE,KAAA,EAAO,KAAK,CAAA;AAAA,QAAG,CAAA,MAAO;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,QAAQ,GAAG,CAAA;AAAA,QAAG;AACjF,QAAA,OAAO,EAAE,UAAU,CAAA,EAAE;AAAA,MACvB;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,SAAS,CAAA;AAC9B,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,IAAO,iBAAA,CAAkB,QAAQ,QAAQ,CAAA;AAC9D,MAAA,MAAM,QAAA,GAAW,KAAA,CAAM,QAAA,IAAY,sBAAA,CAAuB,QAAQ,QAAQ,CAAA;AAC1E,MAAA,MAAM,QAAQ,KAAA,CAAM,KAAA,IAASG,OAAO,WAAW,CAAA,IAAKA,OAAO,iBAAiB,CAAA;AAE5E,MAAA,MAAM,QAAA,GAA+B,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,QACtD,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,IAAA,EAAM,YAAA;AAAA,QACN,WAAA,EAAaH,IAAAA,CAAK,YAAA,EAAc,CAAA,CAAE,OAAO;AAAA,OAC3C,CAAE,CAAA;AAEF,MAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,CAAA,WAAA,EAAc,QAAA,CAAS,MAAM,CAAA,qBAAA,CAAuB,CAAA;AACpF,MAAA,aAAA,CAAc,KAAA,EAAM;AAMpB,MAAA,MAAM,aAAA,GAAgB,MAAM,2BAAA,CAA4B;AAAA,QACtD,QAAA;AAAA,QACA,cAAA,EAAgB,KAAA;AAAA,QAChB,MAAA;AAAA,QACA,KAAK,KAAA,CAAM,GAAA;AAAA,QACX,GAAA,EAAK,MAAA;AAAA,QACL,MAAA,EAAS,KAAA,CAAM,MAAA,IAAkD,MAAA,CAAO,OAAA,EAAS,MAAA;AAAA,QACjF,QAAA;AAAA,QACA;AAAA,OACD,CAAA;AAED,MAAA,MAAM,SAAS,aAAA,CAAc,OAAA,CAAQ,OAAO,CAAA,CAAA,KAAK,CAAC,EAAE,OAAO,CAAA;AAC3D,MAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,QAAA,aAAA,CAAc,IAAA,CAAK,CAAA,EAAG,MAAA,CAAO,MAAM,CAAA,6BAAA,CAA+B,CAAA;AAClE,QAAA,MAAM,gBAAgB,aAAA,CAAc,OAAA,CAAQ,MAAA,CAAO,CAAA,CAAA,KAAK,EAAE,OAAO,CAAA,CAAE,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,MAAM,OAAA,EAAS,CAAA,CAAE,SAAQ,CAAE,CAAA;AAClH,QAAA,MAAM,UAAA,GAA+B,MAAA,CAAO,GAAA,CAAI,CAAA,CAAA,MAAM;AAAA,UACpD,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,SAAS,CAAA,CAAE,OAAA;AAAA,UACX,KAAA,EAAO,EAAE,KAAA,IAAS,eAAA;AAAA,UAClB,WAAW,CAAA,CAAE,SAAA;AAAA,UACb,WAAW,CAAA,CAAE;AAAA,SACf,CAAE,CAAA;AACF,QAAA,MAAMI,OAAAA,GAAwB,EAAE,QAAA,EAAU,CAAA,EAAG,QAAQ,SAAA,EAAW,aAAA,EAAe,QAAQ,UAAA,EAAW;AAElG,QAAA,sBAAA,CAAuB,2BAAA,CAA4B,MAAA,EAAQ,aAAA,CAAc,MAAA,EAAQ,UAAU,CAAC,CAAA;AAE5F,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,OAAOA,OAAM,CAAA;AAAA,QAAG,CAAA,MAAO;AAC/C,UAAA,GAAA,CAAI,IAAI,OAAA,GAAU;AAAA,YAChB,KAAA,EAAO,oBAAA;AAAA,YACP,UAAU,CAAC;AAAA,cACT,MAAA,EAAQ,CAAA,QAAA,EAAW,aAAA,CAAc,MAAM,CAAA,cAAA,CAAA;AAAA,cACvC,KAAA,EAAO,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ,KAAK,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,EAAG,CAAA,CAAE,SAAA,GAAY,CAAA,EAAA,EAAK,CAAA,CAAE,SAAS,CAAA,CAAA,CAAA,GAAM,EAAE,CAAA,QAAA,EAAM,CAAA,CAAE,SAAA,IAAa,CAAA,CAAE,KAAK,CAAA,CAAE;AAAA,aACjJ,CAAA;AAAA,YACD,MAAA,EAAQ;AAAA,WACT,CAAA;AAAA,QACH;AACA,QAAA,OAAOA,OAAAA;AAAA,MACT;AACA,MAAA,aAAA,CAAc,OAAA,CAAQ,CAAA,UAAA,EAAa,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA,kBAAA,CAAoB,CAAA;AAEnF,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAMA,UAAwB,EAAE,QAAA,EAAU,GAAG,MAAA,EAAQ,SAAA,EAAW,cAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,SAAS,CAAA,CAAE,OAAA,GAAU,CAAA,EAAE;AACvI,QAAA,IAAI,MAAM,IAAA,EAAM;AAAE,UAAA,GAAA,CAAI,EAAA,EAAI,OAAOA,OAAM,CAAA;AAAA,QAAG;AAC1C,QAAA,OAAOA,OAAAA;AAAA,MACT;AAMA,MAAA,MAAM,YAAA,GAAe,UAAU,4CAA4C,CAAA;AAC3E,MAAA,YAAA,CAAa,KAAA,EAAM;AACnB,MAAA,MAAM,aAAA,GAAsC,QAAA,CAAS,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAS,IAAA,EAAM,cAAa,CAAE,CAAA;AACxH,MAAA,MAAM,aAAA,GAAgB,MAAM,qBAAA,CAAsB,aAAA,EAAe;AAAA,QAC/D,QAAA;AAAA,QACA,OAAA,EAAS,uBAAA;AAAA,QACT,MAAA,EAAQ,IAAI,QAAA,EAAU;AAAA,OACvB,CAAA;AACD,MAAA,MAAM,YAAA,GAAe,aAAA,CAAc,OAAA,CAAQ,CAAA,CAAA,KAAK,EAAE,MAAM,CAAA;AAExD,MAAA,MAAM,MAAA,GAAwB;AAAA,QAC5B,QAAA,EAAU,YAAA,CAAa,MAAA,KAAW,CAAA,GAAI,CAAA,GAAI,CAAA;AAAA,QAC1C,MAAA;AAAA,QACA,SAAA,EAAW,aAAA,CAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,MAAM,EAAE,IAAA,EAAM,CAAA,CAAE,IAAA,EAAM,OAAA,EAAS,CAAA,CAAE,OAAA,EAAQ,CAAE,CAAA;AAAA,QAChF;AAAA,OACF;AAEA,MAAA,IAAI,YAAA,CAAa,SAAS,CAAA,EAAG;AAG3B,QAAA,YAAA,CAAa,IAAA,CAAK,CAAA,4BAAA,EAA+B,YAAA,CAAa,MAAM,CAAA,4DAAA,CAAyD,CAAA;AAC7H,QAAA,sBAAA,CAAuB;AAAA,UACrB,CAAA,2CAAA,EAAoC,MAAM,CAAA,gDAAA,EAA8C,YAAA,CAAa,MAAM,CAAA,SAAA,CAAA;AAAA,UAC3G,EAAA;AAAA,UACA,uLAAA;AAAA,UACA,EAAA;AAAA,UACA,GAAG,YAAA,CAAa,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,EAAA,EAAK,CAAC,CAAA,CAAE;AAAA,SACnC,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,MACd,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,QAAQ,wCAAwC,CAAA;AAAA,MAC/D;AAEA,MAAA,IAAI,MAAM,IAAA,EAAM;AACd,QAAA,GAAA,CAAI,EAAA,EAAI,OAAO,MAAM,CAAA;AACrB,QAAA,OAAO,MAAA;AAAA,MACT;AAEA,MAAA,GAAA,CAAI,IAAI,OAAA,GAAU;AAAA,QAChB,KAAA,EAAO,oBAAA;AAAA,QACP,QAAA,EAAU;AAAA,UACR,EAAE,MAAA,EAAQ,CAAA,aAAA,EAAgB,QAAQ,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA,CAAA,EAAK,KAAA,EAAO,aAAA,CAAc,OAAA,CAAQ,GAAA,CAAI,CAAA,CAAA,KAAK,GAAG,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ,OAAO,CAAA,CAAA,EAAI,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,EAAE;AAAA,UACjJ,GAAI,aAAa,MAAA,GAAS,CAAA,GAAI,CAAC,EAAE,MAAA,EAAQ,qBAAA,EAAuB,KAAA,EAAO,YAAA,CAAa,GAAA,CAAI,OAAK,CAAA,EAAG,GAAA,CAAI,EAAA,CAAG,OAAA,CAAQ,KAAK,CAAA,CAAA,EAAI,CAAC,CAAA,CAAE,CAAA,EAAG,CAAA,GAAI;AAAC,SACrI;AAAA,QACA,MAAA,EAAQ,YAAA,CAAa,MAAA,KAAW,CAAA,GAAI,SAAA,GAAY;AAAA,OACjD,CAAA;AAED,MAAA,OAAO,MAAA;AAAA,IACT;AAAA;AAEJ,CAAC","file":"deliver.js","sourcesContent":["/**\n * Rewrite a package's own version and workspace:/link: dependency references\n * before `pnpm publish`, so the tarball on disk matches what's about to be\n * published even when that version was never persisted to package.json.\n *\n * - Own version: stable releases already have the target version on disk\n *   (written by updatePackageVersions() before this runs), so this is a\n *   no-op for them. Canary releases compute nextVersion in-memory only —\n *   never committed to package.json/git — so without this, `pnpm publish`\n *   would read the OLD on-disk version, and either fail outright or (worse)\n *   get misclassified as \"already published\" by the retry/idempotency\n *   patterns since that old version genuinely IS already on the registry.\n * - pnpm handles `workspace:*` natively during `pnpm publish` — no rewrite needed.\n * - npm/yarn do NOT — we must replace with `^version` before publish.\n * - `link:` references are never valid on the npm registry — always rewrite.\n *\n * Returns a restore function that reverts package.json to original content.\n * Call it in a finally block to guarantee cleanup.\n */\n\nimport { readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\n\n// ── rewriteWorkspaceDeps helpers ──────────────────────────────────────────\n\nfunction rewriteLinkDep(\n  deps: Record<string, string>,\n  depName: string,\n  val: string,\n  pkgPath: string,\n  versionMap: Map<string, string>,\n): void {\n  const pinned = versionMap.get(depName);\n  if (pinned) {\n    deps[depName] = `^${pinned}`;\n    return;\n  }\n  try {\n    const linkPath = val.slice('link:'.length);\n    const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, 'package.json'), 'utf-8')) as { version?: string };\n    deps[depName] = `^${linked.version ?? '*'}`;\n  } catch {\n    deps[depName] = '*';\n  }\n}\n\nfunction rewriteWorkspaceDep(\n  deps: Record<string, string>,\n  depName: string,\n  val: string,\n  versionMap: Map<string, string>,\n): boolean {\n  const pinned = versionMap.get(depName);\n  if (!pinned) { return false; }\n  deps[depName] = val === 'workspace:*' ? `^${pinned}` : val.replace('workspace:', '');\n  return true;\n}\n\nfunction rewriteDepsSection(\n  deps: Record<string, string>,\n  pkgPath: string,\n  versionMap: Map<string, string>,\n  packageManager: string,\n): boolean {\n  let modified = false;\n  for (const depName of Object.keys(deps)) {\n    const val = deps[depName];\n    if (typeof val !== 'string') { continue; }\n    if (val.startsWith('link:')) {\n      rewriteLinkDep(deps, depName, val, pkgPath, versionMap);\n      modified = true;\n    } else if (val.startsWith('workspace:') && packageManager !== 'pnpm' && rewriteWorkspaceDep(deps, depName, val, versionMap)) {\n      modified = true;\n    }\n  }\n  return modified;\n}\n\nexport function rewriteWorkspaceDeps(\n  pkg: { path: string; version: string },\n  versionMap: Map<string, string>,\n  packageManager: string,\n): () => void {\n  const pkgPath = pkg.path;\n  const pkgJsonPath = join(pkgPath, 'package.json');\n  const original = readFileSync(pkgJsonPath, 'utf-8');\n  const pkgJson = JSON.parse(original) as Record<string, unknown> & { version?: string };\n  let modified = false;\n\n  if (pkgJson.version !== pkg.version) {\n    pkgJson.version = pkg.version;\n    modified = true;\n  }\n\n  for (const section of ['dependencies', 'peerDependencies'] as const) {\n    const deps = pkgJson[section] as Record<string, string> | undefined;\n    if (!deps) { continue; }\n    if (rewriteDepsSection(deps, pkgPath, versionMap, packageManager)) { modified = true; }\n  }\n\n  if (modified) {\n    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\\n');\n  }\n\n  return () => writeFileSync(pkgJsonPath, original);\n}\n\n// ── topoSort helpers ──────────────────────────────────────────────────────\n\n/**\n * Build a simple topological sort of packages for publish order.\n *\n * Packages are grouped into \"waves\": wave 0 has no intra-release deps,\n * wave 1 depends only on wave 0, etc. Within each wave publish order\n * is arbitrary (safe to parallelise).\n *\n * Cycles (should not exist in a well-formed monorepo) fall into a\n * \"remainder\" group appended at the end.\n */\nexport interface TopoPackage {\n  name: string;\n  path: string;\n  version: string;\n}\n\nfunction buildIntraDeps(packages: TopoPackage[], nameSet: Set<string>): Map<string, Set<string>> {\n  const deps = new Map<string, Set<string>>();\n  for (const pkg of packages) {\n    const intra = new Set<string>();\n    try {\n      const pkgJson = JSON.parse(readFileSync(join(pkg.path, 'package.json'), 'utf-8')) as {\n        dependencies?: Record<string, string>;\n        peerDependencies?: Record<string, string>;\n      };\n      for (const section of ['dependencies', 'peerDependencies'] as const) {\n        for (const depName of Object.keys(pkgJson[section] ?? {})) {\n          if (nameSet.has(depName)) { intra.add(depName); }\n        }\n      }\n    } catch {\n      // If we can't read package.json, treat as no deps\n    }\n    deps.set(pkg.name, intra);\n  }\n  return deps;\n}\n\nfunction buildDependantsMap(packages: TopoPackage[], deps: Map<string, Set<string>>): Map<string, Set<string>> {\n  const dependants = new Map<string, Set<string>>();\n  for (const pkg of packages) {\n    for (const dep of deps.get(pkg.name) ?? []) {\n      if (!dependants.has(dep)) { dependants.set(dep, new Set()); }\n      dependants.get(dep)!.add(pkg.name);\n    }\n  }\n  return dependants;\n}\n\nfunction computeWaves(\n  packages: TopoPackage[],\n  deps: Map<string, Set<string>>,\n  dependants: Map<string, Set<string>>,\n): TopoPackage[][] {\n  const byName = new Map(packages.map(p => [p.name, p]));\n  const remaining = new Map<string, number>(\n    packages.map(p => [p.name, (deps.get(p.name) ?? new Set()).size])\n  );\n  const waves: TopoPackage[][] = [];\n\n  while (remaining.size > 0) {\n    const wave = [...remaining.entries()]\n      .filter(([, count]) => count === 0)\n      .map(([name]) => byName.get(name)!);\n\n    if (wave.length === 0) {\n      waves.push([...remaining.keys()].map(n => byName.get(n)!));\n      break;\n    }\n\n    waves.push(wave);\n    for (const pkg of wave) {\n      remaining.delete(pkg.name);\n      for (const dependant of dependants.get(pkg.name) ?? []) {\n        if (remaining.has(dependant)) {\n          remaining.set(dependant, (remaining.get(dependant) ?? 1) - 1);\n        }\n      }\n    }\n  }\n\n  return waves.filter(w => w.length > 0);\n}\n\nexport function topoSort(packages: TopoPackage[], _packageManager: string): TopoPackage[][] {\n  const nameSet = new Set(packages.map(p => p.name));\n  const deps = buildIntraDeps(packages, nameSet);\n  const dependants = buildDependantsMap(packages, deps);\n  return computeWaves(packages, deps, dependants);\n}\n","/**\n * Programmatic npm publishing for REST handlers (non-interactive context).\n *\n * Uses `npm publish` CLI via spawn with NODE_AUTH_TOKEN env variable.\n * This is the correct approach for granular access tokens (classic tokens\n * were revoked by npm in December 2025).\n *\n * Token resolution order:\n * 1. options.token (explicit override)\n * 2. NPM_TOKEN env variable\n * 3. NODE_AUTH_TOKEN env variable\n *\n * Reliability guarantees:\n * - Already-published versions are treated as success (idempotent re-runs).\n * - 429 rate-limit: exponential back-off with jitter, up to MAX_RETRIES attempts.\n * - Transient network errors (ECONNRESET, ETIMEDOUT, etc.) are also retried.\n * - Packages are published in topological order (deps before dependants).\n * - Default concurrency is 4 — enough throughput, low enough to avoid rate limits.\n */\n\nimport { spawn } from 'node:child_process';\nimport { readFileSync, writeFileSync, existsSync, unlinkSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { useLogger, useEnv } from '@kb-labs/sdk';\nimport { rewriteWorkspaceDeps, topoSort } from './dep-rewrite';\n\nexport interface PackageToPublish {\n  name: string;\n  version: string;\n  path: string;\n  /**\n   * Pre-built tarball to publish instead of packing fresh from `path`\n   * (produced by `release stage` — see stage.ts). When set, `path` is\n   * only used as the cwd for npm's `.npmrc` auth lookup — no\n   * `rewriteWorkspaceDeps` mutation happens, since the tarball's\n   * package.json is already final and must ship byte-for-byte unchanged.\n   */\n  tarballPath?: string;\n}\n\nexport interface ProgrammaticPublishOptions {\n  packages: PackageToPublish[];\n  packageManager?: 'pnpm' | 'npm' | 'yarn';\n  dryRun?: boolean;\n  otp?: string;\n  tag?: string;\n  access?: 'public' | 'restricted';\n  registry?: string;\n  token?: string;\n}\n\nexport interface PublishResult {\n  name: string;\n  version: string;\n  success: boolean;\n  /** Package was already published at this version — counted as success. */\n  alreadyPublished?: boolean;\n  error?: string;\n  /** npm's own error code (e.g. \"E403\"), extracted from its stderr, when recognizable. */\n  errorCode?: string;\n  /** Actionable, human-readable explanation for errorCode — see NPM_ERROR_HINTS. */\n  errorHint?: string;\n}\n\nexport interface ProgrammaticPublishResult {\n  results: PublishResult[];\n  published: string[];\n  /** Versions that were already on npm (counted as success). */\n  alreadyPublished: string[];\n  failed: string[];\n  skipped: string[];\n  errors: string[];\n}\n\n// ---------------------------------------------------------------------------\n// Retry configuration\n// ---------------------------------------------------------------------------\n\nconst MAX_RETRIES = 5;\n\n// Exponential base delays (ms). Actual delay = base * jitter(0.8–1.2).\nconst RETRY_BASE_DELAYS_MS = [10_000, 20_000, 40_000, 80_000, 160_000] as const;\n\n/** Retryable error patterns — all transient, not indicative of a bad package. */\nconst RETRYABLE_PATTERNS = [\n  'E429',\n  '429 Too Many Requests',\n  'ECONNRESET',\n  'ETIMEDOUT',\n  'ECONNREFUSED',\n  'ENOTFOUND',\n  'EAI_AGAIN',\n  'socket hang up',\n  'network timeout',\n  'read ECONNRESET',\n];\n\n/** \"Already published\" — treat as success so re-runs are idempotent. */\nconst ALREADY_PUBLISHED_PATTERNS = [\n  'You cannot publish over the previously published versions',\n  'cannot publish over the previously published version',\n  'EPUBLISHCONFLICT',\n  // Some registries return 403 for conflicts\n];\n\nfunction isRetryable(message: string): boolean {\n  return RETRYABLE_PATTERNS.some(p => message.includes(p));\n}\n\nfunction isAlreadyPublished(message: string): boolean {\n  return ALREADY_PUBLISHED_PATTERNS.some(p => message.includes(p));\n}\n\n/**\n * Human-readable hints per npm error code — surfaced directly in the\n * delivery report so a permanent failure doesn't require digging through\n * raw CI logs to tell \"our token is broken\" apart from \"npm has flagged\n * this specific package,\" which look identical (both E403) but need\n * completely different fixes.\n */\nconst NPM_ERROR_HINTS: Record<string, string> = {\n  E403: 'npm rejected the publish (403). If other packages in the same run succeeded with the same token, this is almost certainly an npm-side restriction on this specific package/account entry (e.g. a security hold), not a token or code problem — check npmjs.com directly or contact npm support. Retrying will not help until that is resolved.',\n  E401: 'Authentication failed (401) — NPM_TOKEN/NODE_AUTH_TOKEN is missing, expired, or invalid for this registry.',\n  E404: 'Registry returned 404 — check the registry URL and that the package name/scope is correct and accessible with this token.',\n  EOTP: 'npm requires a one-time password for this publish — programmatic (token-based) delivery cannot supply one; this package needs an interactive `npm publish` from a human, or a token exempt from OTP.',\n};\n\n/** Extract the npm CLI's own error code (e.g. \"E403\") from its stderr, if present. */\nfunction extractNpmErrorCode(message: string): string | undefined {\n  const match = message.match(/\\bnpm error code (E[A-Z0-9]+)\\b/);\n  return match?.[1];\n}\n\n/** Classify a permanent publish failure into a code + actionable hint, when recognizable. */\nfunction classifyPublishError(message: string): { code?: string; hint?: string } {\n  const code = extractNpmErrorCode(message);\n  const hint = code ? NPM_ERROR_HINTS[code] : undefined;\n  return { code, hint };\n}\n\n/** Exponential back-off with ±20% jitter. */\nfunction retryDelay(attempt: number): number {\n  const base = RETRY_BASE_DELAYS_MS[Math.min(attempt, RETRY_BASE_DELAYS_MS.length - 1)]!;\n  const jitter = 0.8 + Math.random() * 0.4; // 0.8 – 1.2\n  return Math.round(base * jitter);\n}\n\n// ---------------------------------------------------------------------------\n// Token resolution\n// ---------------------------------------------------------------------------\n\nfunction resolveToken(token?: string): string | undefined {\n  return token ?? useEnv('NPM_TOKEN') ?? useEnv('NODE_AUTH_TOKEN');\n}\n\n// ---------------------------------------------------------------------------\n// Low-level spawn\n// ---------------------------------------------------------------------------\n\n/**\n * Spawn `packageManager publish` for a single package.\n * Writes a temporary .npmrc for NODE_AUTH_TOKEN auth, cleans it up on exit.\n */\nfunction spawnPublish(options: {\n  packagePath: string;\n  /** Publish this exact tarball instead of packing `packagePath` fresh. */\n  tarballPath?: string;\n  packageManager: string;\n  token: string | undefined;\n  otp?: string;\n  dryRun?: boolean;\n  tag?: string;\n  access?: string;\n  registry?: string;\n}): Promise<void> {\n  const { packagePath, tarballPath, packageManager, token, otp, dryRun, tag, access, registry } = options;\n\n  return new Promise((resolve, reject) => {\n    const args = ['publish'];\n    if (tarballPath) { args.push(tarballPath); }\n\n    if (packageManager === 'pnpm' && !tarballPath) {\n      // pnpm checks git cleanliness; we version-bump before publish which makes\n      // the tree dirty — bypass that check. N/A when publishing a pre-built\n      // tarball — there's no working-tree state for pnpm to check.\n      args.push('--no-git-checks');\n    }\n    if (dryRun)   { args.push('--dry-run'); }\n    if (tag)      { args.push(`--tag=${tag}`); }\n    if (access)   { args.push(`--access=${access}`); }\n    if (registry) { args.push(`--registry=${registry}`); }\n    if (otp)      { args.push(`--otp=${otp}`); }\n\n    const env: NodeJS.ProcessEnv = { ...process.env };\n    if (token) { env['NODE_AUTH_TOKEN'] = token; }\n\n    // Write a per-package .npmrc so npm picks up NODE_AUTH_TOKEN.\n    // The auth line's host must match the target registry — hardcoding\n    // registry.npmjs.org here would silently break token auth against\n    // Verdaccio or any other non-npmjs registry.\n    const npmrcPath = join(packagePath, '.npmrc');\n    const npmrcExisted = existsSync(npmrcPath);\n    const npmrcBackup = npmrcExisted ? readFileSync(npmrcPath, 'utf-8') : null;\n    const registryHost = registry ? new URL(registry).host : 'registry.npmjs.org';\n    const authLine = `//${registryHost}/:_authToken=\\${NODE_AUTH_TOKEN}\\n`;\n\n    if (token) {\n      const existing = npmrcExisted ? readFileSync(npmrcPath, 'utf-8') : '';\n      if (!existing.includes('_authToken')) {\n        writeFileSync(npmrcPath, existing + authLine);\n      }\n    }\n\n    const restoreNpmrc = () => {\n      if (!token) { return; }\n      try {\n        if (npmrcBackup !== null) {\n          writeFileSync(npmrcPath, npmrcBackup);\n        } else if (existsSync(npmrcPath)) {\n          unlinkSync(npmrcPath);\n        }\n      } catch { /* best-effort */ }\n    };\n\n    const child = spawn(packageManager, args, {\n      cwd: packagePath,\n      stdio: ['ignore', 'pipe', 'pipe'],\n      shell: true,\n      env,\n    });\n\n    let stdout = '';\n    let stderr = '';\n\n    child.stdout?.on('data', (d: Buffer) => { stdout += d.toString(); });\n    child.stderr?.on('data', (d: Buffer) => { stderr += d.toString(); });\n\n    child.on('close', (code: number | null) => {\n      restoreNpmrc();\n      if (code === 0) {\n        resolve();\n      } else {\n        reject(new Error(stderr || stdout || `${packageManager} publish exited with code ${code}`));\n      }\n    });\n\n    child.on('error', (err: Error) => {\n      restoreNpmrc();\n      reject(err);\n    });\n  });\n}\n\n// ---------------------------------------------------------------------------\n// Per-package publish with retry\n// ---------------------------------------------------------------------------\n\nasync function publishOne(\n  pkg: PackageToPublish,\n  opts: {\n    packageManager: string;\n    token: string | undefined;\n    versionMap: Map<string, string>;\n    dryRun?: boolean;\n    otp?: string;\n    tag?: string;\n    access?: string;\n    registry?: string;\n  },\n  logger: ReturnType<typeof useLogger>,\n): Promise<PublishResult> {\n  // A pre-built tarball (see PackageToPublish.tarballPath) is already final\n  // — publishing it must ship those exact bytes, so skip the package.json\n  // rewrite entirely rather than mutating a directory whose content the\n  // tarball no longer reflects.\n  const restore = pkg.tarballPath ? (() => {}) : rewriteWorkspaceDeps(pkg, opts.versionMap, opts.packageManager);\n\n  try {\n    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {\n      try {\n        await spawnPublish({\n          packagePath: pkg.path,\n          tarballPath: pkg.tarballPath,\n          packageManager: opts.packageManager,\n          token: opts.token,\n          otp: opts.otp,\n          dryRun: opts.dryRun,\n          tag: opts.tag,\n          access: opts.access,\n          registry: opts.registry,\n        });\n\n        logger.info(`Published ${pkg.name}@${pkg.version}`);\n        return { name: pkg.name, version: pkg.version, success: true };\n\n      } catch (err: unknown) {\n        const message = err instanceof Error ? err.message : String(err);\n\n        // Idempotency: already published at this version → success.\n        if (isAlreadyPublished(message)) {\n          logger.info(`${pkg.name}@${pkg.version} already published — skipping`);\n          return { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true };\n        }\n\n        // Retryable transient error (rate-limit, network blip).\n        if (isRetryable(message) && attempt < MAX_RETRIES) {\n          const delay = retryDelay(attempt);\n          logger.warn(\n            `Transient error for ${pkg.name}@${pkg.version} (attempt ${attempt + 1}/${MAX_RETRIES}), ` +\n            `retrying in ${(delay / 1000).toFixed(1)}s: ${message.split('\\n')[0]}`,\n          );\n          await new Promise<void>(r => { setTimeout(r, delay); });\n          continue;\n        }\n\n        // Permanent failure.\n        const { code, hint } = classifyPublishError(message);\n        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, undefined, { error: message, errorCode: code });\n        return { name: pkg.name, version: pkg.version, success: false, error: message, errorCode: code, errorHint: hint };\n      }\n    }\n\n    // Exhausted retries.\n    return {\n      name: pkg.name,\n      version: pkg.version,\n      success: false,\n      error: `Publish failed after ${MAX_RETRIES} retries (transient errors)`,\n    };\n  } finally {\n    restore();\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Main export\n// ---------------------------------------------------------------------------\n\nfunction skipRemainingWaves(\n  waves: ReturnType<typeof topoSort>,\n  waveIdx: number,\n  waveFailed: PublishResult[],\n  logger: ReturnType<typeof useLogger>,\n  allResults: PublishResult[],\n): void {\n  const remaining = waves.slice(waveIdx + 1).reduce((acc, w) => acc + w.length, 0);\n  if (remaining === 0) { return; }\n  logger.warn(\n    `Wave ${waveIdx + 1} had ${waveFailed.length} failure(s) — ` +\n    `skipping ${remaining} package(s) in later waves to avoid broken dependency chain`,\n  );\n  for (const laterWave of waves.slice(waveIdx + 1)) {\n    for (const pkg of laterWave) {\n      allResults.push({ name: pkg.name, version: pkg.version, success: false, error: 'Skipped: dependency wave failed' });\n    }\n  }\n}\n\n/**\n * Publish packages programmatically (non-interactive, for REST handlers / CI).\n *\n * Packages are published in topological order (deps before dependants) to\n * avoid \"package not found\" errors when a dependent is installed right after\n * release. Within each topological wave, publishes run in parallel up to\n * CONCURRENCY.\n */\nexport async function publishPackagesProgrammatic(\n  options: ProgrammaticPublishOptions,\n): Promise<ProgrammaticPublishResult> {\n  const {\n    packages,\n    packageManager = 'pnpm',\n    dryRun,\n    otp,\n    tag,\n    access,\n    registry,\n  } = options;\n\n  const logger = useLogger();\n  const token = resolveToken(options.token);\n\n  if (!token && !dryRun) {\n    const error = 'No npm token found. Set NPM_TOKEN (or NODE_AUTH_TOKEN) in environment.';\n    logger.error(error);\n    return {\n      results: [],\n      published: [],\n      alreadyPublished: [],\n      failed: packages.map(p => `${p.name}@${p.version}`),\n      skipped: [],\n      errors: [error],\n    };\n  }\n\n  // Version map for dep rewriting (workspace:/link: → ^version).\n  const versionMap = new Map(packages.map(p => [p.name, p.version]));\n\n  // Concurrency: default 4 — enough throughput, below npm's sustained rate limit.\n  const CONCURRENCY = Number(useEnv('KB_PUBLISH_CONCURRENCY') ?? 4);\n\n  // Sort packages into topological waves so deps are always published first.\n  const waves = topoSort(packages, packageManager);\n\n  logger.info(\n    `Publishing ${packages.length} package(s) in ${waves.length} topological wave(s) ` +\n    `(concurrency=${CONCURRENCY}, dryRun=${dryRun ?? false})`,\n  );\n\n  const allResults: PublishResult[] = [];\n\n  for (let waveIdx = 0; waveIdx < waves.length; waveIdx++) {\n    const wave = waves[waveIdx]!;\n    logger.info(`Wave ${waveIdx + 1}/${waves.length}: publishing ${wave.length} package(s)`);\n\n    // Publish wave in parallel batches.\n    for (let i = 0; i < wave.length; i += CONCURRENCY) {\n      const batch = wave.slice(i, i + CONCURRENCY);\n      const batchResults = await Promise.all(\n        batch.map(pkg =>\n          publishOne(pkg, { packageManager, token, versionMap, dryRun, otp, tag, access, registry }, logger),\n        ),\n      );\n      allResults.push(...batchResults);\n    }\n\n    // If any package in this wave genuinely failed (not alreadyPublished), stop\n    // publishing the next wave — it may depend on the failed packages.\n    const waveFailed = allResults.slice(-wave.length).filter(r => !r.success);\n    if (waveFailed.length > 0) {\n      skipRemainingWaves(waves, waveIdx, waveFailed, logger, allResults);\n      break;\n    }\n  }\n\n  const published         = allResults.filter(r => r.success && !r.alreadyPublished).map(r => `${r.name}@${r.version}`);\n  const alreadyPublished  = allResults.filter(r => r.alreadyPublished).map(r => `${r.name}@${r.version}`);\n  const failed            = allResults.filter(r => !r.success).map(r => `${r.name}@${r.version}`);\n  const errors            = allResults.filter(r => !r.success && r.error).map(r => `${r.name}: ${r.error}`);\n\n  if (alreadyPublished.length > 0) {\n    logger.info(`${alreadyPublished.length} package(s) already published — counted as success`);\n  }\n\n  return {\n    results: allResults,\n    published,\n    alreadyPublished,\n    failed,\n    skipped: dryRun ? packages.map(p => `${p.name}@${p.version} (dry-run)`) : [],\n    errors,\n  };\n}\n","/**\n * Shared `--release-tag` / `--flow` resolution for commands that operate\n * on an already-decided release (`stage`, `deliver`) — mirrors the tag\n * grammar in `@kb-labs/release-manager-core`'s `resolveFlowFromTag` so CI\n * can pass just the tag and the plugin decides the flow, per the\n * \"plugin prepares, CI delivers\" release plan.\n */\n\nimport { resolveFlowFromTag, type ReleaseConfig } from '@kb-labs/release-manager-core';\n\nexport interface FlowResolvableFlags {\n  flow?: string;\n  'release-tag'?: string;\n}\n\nexport function resolveFlowName(config: ReleaseConfig, flags: FlowResolvableFlags): string | { error: string } {\n  if (flags.flow) { return flags.flow; }\n  if (flags['release-tag']) {\n    const resolved = resolveFlowFromTag(config, flags['release-tag']);\n    if (!resolved) {\n      return { error: `Could not resolve a release.flows entry from tag \"${flags['release-tag']}\"` };\n    }\n    return resolved.flowName;\n  }\n  return { error: 'requires --flow or --release-tag' };\n}\n","/**\n * Deliver command — ships the tarballs `release stage` already packed to a\n * destination (\"target\"), by name. This is the thin-CI half of the\n * \"plugin prepares, CI delivers\" release plan: CI's only job is to have\n * the right target credentials and call this one command with the tag —\n * package selection, tag→flow resolution, retry/backoff, and post-delivery\n * verification all live here, not in CI YAML.\n *\n * Deliberately reads `manifest.json` from `--artifacts-dir` (written by\n * `release stage`) instead of rediscovering or rebuilding packages — the\n * whole point is to ship the exact bytes that were already packed and\n * validated, not a fresh equivalent pack.\n *\n * Not to be confused with `release promote` (`promote.ts`) — that command\n * still re-packs from the working tree at publish time (the older,\n * Verdaccio-pre-flight flow from ADR-0001) and remains in place unchanged.\n */\n\nimport { readFileSync, appendFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { defineCommand, type CLIInput, type PluginContextV3, useLoader, useConfig, useEnv } from '@kb-labs/sdk';\nimport {\n  mergeConfigWithFlow,\n  resolvePublishTag,\n  resolvePublishRegistry,\n  verifyAgainstRegistry,\n  type ReleaseConfig,\n  type PublishablePackage,\n} from '@kb-labs/release-manager-core';\nimport { findRepoRoot } from '../../shared/utils';\nimport { publishPackagesProgrammatic, type PackageToPublish } from '../../shared/publish-programmatic';\nimport { resolveFlowName, type FlowResolvableFlags } from '../../shared/resolve-flow';\nimport type { StagedArtifact } from './stage';\n\nconst REGISTRY_VERIFY_RETRIES = 5;\n\ninterface DeliverFlags extends FlowResolvableFlags {\n  target?: string;\n  'artifacts-dir'?: string;\n  tag?: string;\n  registry?: string;\n  otp?: string;\n  access?: string;\n  token?: string;\n  'dry-run'?: boolean;\n  json?: boolean;\n}\n\ninterface DeliverFailure {\n  name: string;\n  version: string;\n  error: string;\n  errorCode?: string;\n  errorHint?: string;\n}\n\ninterface DeliverResult {\n  exitCode: number;\n  target?: string;\n  published?: Array<{ name: string; version: string }>;\n  failed?: DeliverFailure[];\n  verifyIssues?: string[];\n}\n\nfunction loadManifest(artifactsDir: string): StagedArtifact[] | { error: string } {\n  const manifestPath = join(artifactsDir, 'manifest.json');\n  try {\n    return JSON.parse(readFileSync(manifestPath, 'utf-8')) as StagedArtifact[];\n  } catch {\n    return { error: `No manifest.json found at ${manifestPath} — run \\`kb release stage\\` first` };\n  }\n}\n\n/**\n * Append a markdown summary to the GitHub Actions job summary panel, when\n * running under Actions (`GITHUB_STEP_SUMMARY` is set) — otherwise a no-op.\n * This is what actually makes a failure diagnosable without digging through\n * raw step logs: the exact npm error, per package, rendered right in the\n * run's UI instead of buried in thousands of log lines.\n */\nfunction writeGithubStepSummary(markdown: string): void {\n  const summaryPath = useEnv('GITHUB_STEP_SUMMARY');\n  if (!summaryPath) { return; }\n  try {\n    appendFileSync(summaryPath, markdown.endsWith('\\n') ? markdown : `${markdown}\\n`);\n  } catch {\n    // Best-effort — never let summary writing fail the actual delivery.\n  }\n}\n\nfunction buildFailureSummaryMarkdown(target: string, publishedCount: number, failed: DeliverFailure[]): string {\n  const lines: string[] = [\n    `## ❌ \\`release deliver --target ${target}\\` — ${failed.length} package(s) failed`,\n    '',\n    `${publishedCount} package(s) delivered successfully; ${failed.length} did not.`,\n    '',\n  ];\n  for (const f of failed) {\n    lines.push(`### \\`${f.name}@${f.version}\\`${f.errorCode ? ` — \\`${f.errorCode}\\`` : ''}`);\n    if (f.errorHint) { lines.push('', `**${f.errorHint}**`); }\n    lines.push('', '```', f.error.slice(0, 2000), '```', '');\n  }\n  return lines.join('\\n');\n}\n\nexport default defineCommand({\n  id: 'release:deliver',\n  description: 'Ship the tarballs `release stage` already packed to a target (npm) — no packing, no rebuild',\n\n  handler: {\n    async execute(ctx: PluginContextV3, input: CLIInput<DeliverFlags>): Promise<DeliverResult> {\n      const { flags } = input;\n      const target = flags.target ?? 'npm';\n\n      if (target !== 'npm') {\n        const msg = `release:deliver --target ${target} is not implemented — only \"npm\" ships this pass (see release plan's out-of-scope section for github-release/mirror)`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n\n      const cwd = ctx.cwd || process.cwd();\n      const repoRoot = await findRepoRoot(cwd);\n\n      const fileConfig = await useConfig<ReleaseConfig>();\n      const baseConfig: ReleaseConfig = fileConfig ?? {};\n\n      const flowResult = resolveFlowName(baseConfig, flags);\n      if (typeof flowResult !== 'string') {\n        const msg = `release:deliver ${flowResult.error}`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n      const config: ReleaseConfig = mergeConfigWithFlow(baseConfig, flowResult);\n\n      const artifactsDir = join(repoRoot, flags['artifacts-dir'] ?? '.kb/release/artifacts');\n      const manifest = loadManifest(artifactsDir);\n      if (!Array.isArray(manifest)) {\n        if (flags.json) { ctx.ui?.json?.({ error: manifest.error }); } else { ctx.ui?.error?.(manifest.error); }\n        return { exitCode: 1 };\n      }\n      if (manifest.length === 0) {\n        const msg = `manifest.json at ${artifactsDir} lists no packages`;\n        if (flags.json) { ctx.ui?.json?.({ error: msg }); } else { ctx.ui?.error?.(msg); }\n        return { exitCode: 1 };\n      }\n\n      const dryRun = flags['dry-run'];\n      const npmTag = flags.tag ?? resolvePublishTag(config, 'stable');\n      const registry = flags.registry ?? resolvePublishRegistry(config, 'stable');\n      const token = flags.token ?? useEnv('NPM_TOKEN') ?? useEnv('NODE_AUTH_TOKEN');\n\n      const packages: PackageToPublish[] = manifest.map(a => ({\n        name: a.name,\n        version: a.version,\n        path: artifactsDir,\n        tarballPath: join(artifactsDir, a.tarball),\n      }));\n\n      const publishLoader = useLoader(`Delivering ${packages.length} package(s) to npm...`);\n      publishLoader.start();\n\n      // Publishing pre-built tarballs via `npm publish <tarball>` specifically\n      // (not pnpm/yarn) — these were packed with `npm pack` in `release\n      // stage`, and npm's tarball-argument publish is the well-established\n      // path; no need to introduce pnpm/yarn tarball-publish behavior here.\n      const publishResult = await publishPackagesProgrammatic({\n        packages,\n        packageManager: 'npm',\n        dryRun,\n        otp: flags.otp,\n        tag: npmTag,\n        access: (flags.access as 'public' | 'restricted' | undefined) ?? config.publish?.access,\n        registry,\n        token,\n      });\n\n      const failed = publishResult.results.filter(r => !r.success);\n      if (failed.length > 0) {\n        publishLoader.fail(`${failed.length} package(s) failed to publish`);\n        const publishedList = publishResult.results.filter(r => r.success).map(r => ({ name: r.name, version: r.version }));\n        const failedList: DeliverFailure[] = failed.map(r => ({\n          name: r.name,\n          version: r.version,\n          error: r.error ?? 'Unknown error',\n          errorCode: r.errorCode,\n          errorHint: r.errorHint,\n        }));\n        const result: DeliverResult = { exitCode: 1, target, published: publishedList, failed: failedList };\n\n        writeGithubStepSummary(buildFailureSummaryMarkdown(target, publishedList.length, failedList));\n\n        if (flags.json) { ctx.ui?.json?.(result); } else {\n          ctx.ui?.sideBox?.({\n            title: 'Deliver — npm',\n            sections: [{\n              header: `Failed (${publishedList.length} delivered ok)`,\n              items: failedList.map(r => `${ctx.ui.symbols.error} ${r.name}@${r.version}${r.errorCode ? ` [${r.errorCode}]` : ''} — ${r.errorHint ?? r.error}`),\n            }],\n            status: 'error',\n          });\n        }\n        return result;\n      }\n      publishLoader.succeed(`Delivered ${publishResult.results.length} package(s) to npm`);\n\n      if (dryRun) {\n        const result: DeliverResult = { exitCode: 0, target, published: publishResult.results.map(r => ({ name: r.name, version: r.version })) };\n        if (flags.json) { ctx.ui?.json?.(result); }\n        return result;\n      }\n\n      // Post-delivery verification against the real registry — this is the\n      // gap `release promote` always had (it never verified anything after\n      // publishing). Real npm has propagation lag Verdaccio doesn't, hence\n      // the retry budget here instead of a single-shot check.\n      const verifyLoader = useLoader('Verifying delivery against the registry...');\n      verifyLoader.start();\n      const verifyTargets: PublishablePackage[] = manifest.map(a => ({ name: a.name, version: a.version, path: artifactsDir }));\n      const verifyResults = await verifyAgainstRegistry(verifyTargets, {\n        registry,\n        retries: REGISTRY_VERIFY_RETRIES,\n        logger: ctx.platform?.logger,\n      });\n      const verifyIssues = verifyResults.flatMap(r => r.issues);\n\n      const result: DeliverResult = {\n        exitCode: verifyIssues.length === 0 ? 0 : 1,\n        target,\n        published: publishResult.results.map(r => ({ name: r.name, version: r.version })),\n        verifyIssues,\n      };\n\n      if (verifyIssues.length > 0) {\n        // The publish already succeeded and is live — never attempt\n        // npm unpublish here. Surface loudly and let a human decide.\n        verifyLoader.fail(`Delivery verification found ${verifyIssues.length} issue(s) — packages are published, verification failed`);\n        writeGithubStepSummary([\n          `## ⚠️ \\`release deliver --target ${target}\\` — publish succeeded, verification found ${verifyIssues.length} issue(s)`,\n          '',\n          'Packages are already live on the registry — this is a verification problem, not a publish failure, and nothing was rolled back (npm unpublish is never attempted automatically).',\n          '',\n          ...verifyIssues.map(i => `- ${i}`),\n        ].join('\\n'));\n      } else {\n        verifyLoader.succeed('Delivery verified against the registry');\n      }\n\n      if (flags.json) {\n        ctx.ui?.json?.(result);\n        return result;\n      }\n\n      ctx.ui?.sideBox?.({\n        title: 'Deliver — npm',\n        sections: [\n          { header: `Delivered to ${registry} (tag: ${npmTag})`, items: publishResult.results.map(r => `${ctx.ui.symbols.success} ${r.name}@${r.version}`) },\n          ...(verifyIssues.length > 0 ? [{ header: 'Verification issues', items: verifyIssues.map(i => `${ctx.ui.symbols.error} ${i}`) }] : []),\n        ],\n        status: verifyIssues.length === 0 ? 'success' : 'error',\n      });\n\n      return result;\n    },\n  },\n});\n"]}

package/dist/cli/commands/promote.js

@@ -157,6 +157,21 @@ function isRetryable(message) {
 function isAlreadyPublished(message) {
   return ALREADY_PUBLISHED_PATTERNS.some((p) => message.includes(p));
 }
+var NPM_ERROR_HINTS = {
+  E403: "npm rejected the publish (403). If other packages in the same run succeeded with the same token, this is almost certainly an npm-side restriction on this specific package/account entry (e.g. a security hold), not a token or code problem \u2014 check npmjs.com directly or contact npm support. Retrying will not help until that is resolved.",
+  E401: "Authentication failed (401) \u2014 NPM_TOKEN/NODE_AUTH_TOKEN is missing, expired, or invalid for this registry.",
+  E404: "Registry returned 404 \u2014 check the registry URL and that the package name/scope is correct and accessible with this token.",
+  EOTP: "npm requires a one-time password for this publish \u2014 programmatic (token-based) delivery cannot supply one; this package needs an interactive `npm publish` from a human, or a token exempt from OTP."
+};
+function extractNpmErrorCode(message) {
+  const match = message.match(/\bnpm error code (E[A-Z0-9]+)\b/);
+  return match?.[1];
+}
+function classifyPublishError(message) {
+  const code = extractNpmErrorCode(message);
+  const hint = code ? NPM_ERROR_HINTS[code] : void 0;
+  return { code, hint };
+}
 function retryDelay(attempt) {
   const base = RETRY_BASE_DELAYS_MS[Math.min(attempt, RETRY_BASE_DELAYS_MS.length - 1)];
   const jitter = 0.8 + Math.random() * 0.4;
@@ -282,8 +297,9 @@ async function publishOne(pkg, opts, logger) {
           });
           continue;
         }
-        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message });
-        return { name: pkg.name, version: pkg.version, success: false, error: message };
+        const { code, hint } = classifyPublishError(message);
+        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message, errorCode: code });
+        return { name: pkg.name, version: pkg.version, success: false, error: message, errorCode: code, errorHint: hint };
       }
     }
     return {