@kb-labs/release-manager-cli 2.77.0 → 2.80.0

package/dist/cli/commands/publish.js

@@ -8,10 +8,142 @@ import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
 import * as readline from 'readline/promises';
 
 // src/cli/commands/publish.ts
+function rewriteWorkspaceDeps(pkgPath, versionMap, packageManager) {
+  const pkgJsonPath = join(pkgPath, "package.json");
+  const original = readFileSync(pkgJsonPath, "utf-8");
+  const pkgJson = JSON.parse(original);
+  let modified = false;
+  for (const section of ["dependencies", "peerDependencies"]) {
+    const deps = pkgJson[section];
+    if (!deps) {
+      continue;
+    }
+    for (const depName of Object.keys(deps)) {
+      const val = deps[depName];
+      if (typeof val !== "string") {
+        continue;
+      }
+      if (val.startsWith("link:")) {
+        const pinned = versionMap.get(depName);
+        if (pinned) {
+          deps[depName] = `^${pinned}`;
+        } else {
+          try {
+            const linkPath = val.slice("link:".length);
+            const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, "package.json"), "utf-8"));
+            deps[depName] = `^${linked.version ?? "*"}`;
+          } catch {
+            deps[depName] = "*";
+          }
+        }
+        modified = true;
+      } else if (val.startsWith("workspace:") && packageManager !== "pnpm") {
+        const pinned = versionMap.get(depName);
+        if (pinned) {
+          deps[depName] = val === "workspace:*" ? `^${pinned}` : val.replace("workspace:", "");
+          modified = true;
+        }
+      }
+    }
+  }
+  if (modified) {
+    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
+  }
+  return () => writeFileSync(pkgJsonPath, original);
+}
+function topoSort(packages, packageManager) {
+  const nameSet = new Set(packages.map((p) => p.name));
+  const deps = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    const intra = /* @__PURE__ */ new Set();
+    try {
+      const pkgJson = JSON.parse(readFileSync(join(pkg.path, "package.json"), "utf-8"));
+      for (const section of ["dependencies", "peerDependencies"]) {
+        for (const depName of Object.keys(pkgJson[section] ?? {})) {
+          if (nameSet.has(depName)) {
+            intra.add(depName);
+          }
+        }
+      }
+    } catch {
+    }
+    deps.set(pkg.name, intra);
+  }
+  const inDegree = new Map(packages.map((p) => [p.name, 0]));
+  for (const [, d] of deps) {
+    for (const dep of d) {
+      inDegree.set(dep, (inDegree.get(dep) ?? 0) + 1);
+    }
+  }
+  const dependants = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    for (const dep of deps.get(pkg.name) ?? []) {
+      if (!dependants.has(dep)) {
+        dependants.set(dep, /* @__PURE__ */ new Set());
+      }
+      dependants.get(dep).add(pkg.name);
+    }
+  }
+  const remaining = new Map(
+    packages.map((p) => [p.name, (deps.get(p.name) ?? /* @__PURE__ */ new Set()).size])
+  );
+  const byName = new Map(packages.map((p) => [p.name, p]));
+  const waves = [];
+  while (remaining.size > 0) {
+    const wave = [...remaining.entries()].filter(([, count]) => count === 0).map(([name]) => byName.get(name));
+    if (wave.length === 0) {
+      waves.push([...remaining.keys()].map((n) => byName.get(n)));
+      break;
+    }
+    waves.push(wave);
+    for (const pkg of wave) {
+      remaining.delete(pkg.name);
+      for (const dependant of dependants.get(pkg.name) ?? []) {
+        if (remaining.has(dependant)) {
+          remaining.set(dependant, (remaining.get(dependant) ?? 1) - 1);
+        }
+      }
+    }
+  }
+  return waves.filter((w) => w.length > 0);
+}
+
+// src/shared/publish-programmatic.ts
+var MAX_RETRIES = 5;
+var RETRY_BASE_DELAYS_MS = [1e4, 2e4, 4e4, 8e4, 16e4];
+var RETRYABLE_PATTERNS = [
+  "E429",
+  "429 Too Many Requests",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "socket hang up",
+  "network timeout",
+  "read ECONNRESET"
+];
+var ALREADY_PUBLISHED_PATTERNS = [
+  "You cannot publish over the previously published versions",
+  "cannot publish over the previously published version",
+  "EPUBLISHCONFLICT"
+  // Some registries return 403 for conflicts
+];
+function isRetryable(message) {
+  return RETRYABLE_PATTERNS.some((p) => message.includes(p));
+}
+function isAlreadyPublished(message) {
+  return ALREADY_PUBLISHED_PATTERNS.some((p) => message.includes(p));
+}
+function retryDelay(attempt) {
+  const base = RETRY_BASE_DELAYS_MS[Math.min(attempt, RETRY_BASE_DELAYS_MS.length - 1)];
+  const jitter = 0.8 + Math.random() * 0.4;
+  return Math.round(base * jitter);
+}
 function resolveToken(token) {
   return token ?? useEnv("NPM_TOKEN") ?? useEnv("NODE_AUTH_TOKEN");
 }
-function publishSinglePackage(options) {
+function spawnPublish(options) {
   const { packagePath, packageManager, token, otp, dryRun, tag, access, registry } = options;
   return new Promise((resolve, reject) => {
     const args = ["publish"];
@@ -47,6 +179,19 @@ function publishSinglePackage(options) {
         writeFileSync(npmrcPath, existing + authLine);
       }
     }
+    const restoreNpmrc = () => {
+      if (!token) {
+        return;
+      }
+      try {
+        if (npmrcBackup !== null) {
+          writeFileSync(npmrcPath, npmrcBackup);
+        } else if (existsSync(npmrcPath)) {
+          unlinkSync(npmrcPath);
+        }
+      } catch {
+      }
+    };
     const child = spawn(packageManager, args, {
       cwd: packagePath,
       stdio: ["ignore", "pipe", "pipe"],
@@ -55,24 +200,14 @@ function publishSinglePackage(options) {
     });
     let stdout = "";
     let stderr = "";
-    child.stdout?.on("data", (data) => {
-      stdout += data.toString();
+    child.stdout?.on("data", (d) => {
+      stdout += d.toString();
     });
-    child.stderr?.on("data", (data) => {
-      stderr += data.toString();
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString();
     });
-    const cleanupNpmrc = () => {
-      if (!token) {
-        return;
-      }
-      if (npmrcBackup !== null) {
-        writeFileSync(npmrcPath, npmrcBackup);
-      } else if (existsSync(npmrcPath)) {
-        unlinkSync(npmrcPath);
-      }
-    };
     child.on("close", (code) => {
-      cleanupNpmrc();
+      restoreNpmrc();
       if (code === 0) {
         resolve();
       } else {
@@ -80,12 +215,66 @@ function publishSinglePackage(options) {
       }
     });
     child.on("error", (err) => {
+      restoreNpmrc();
       reject(err);
     });
   });
 }
+async function publishOne(pkg, opts, logger) {
+  const restore = rewriteWorkspaceDeps(pkg.path, opts.versionMap, opts.packageManager);
+  try {
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+      try {
+        await spawnPublish({
+          packagePath: pkg.path,
+          packageManager: opts.packageManager,
+          token: opts.token,
+          otp: opts.otp,
+          dryRun: opts.dryRun,
+          tag: opts.tag,
+          access: opts.access,
+          registry: opts.registry
+        });
+        logger.info(`Published ${pkg.name}@${pkg.version}`);
+        return { name: pkg.name, version: pkg.version, success: true };
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (isAlreadyPublished(message)) {
+          logger.info(`${pkg.name}@${pkg.version} already published \u2014 skipping`);
+          return { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true };
+        }
+        if (isRetryable(message) && attempt < MAX_RETRIES) {
+          const delay = retryDelay(attempt);
+          logger.warn(
+            `Transient error for ${pkg.name}@${pkg.version} (attempt ${attempt + 1}/${MAX_RETRIES}), retrying in ${(delay / 1e3).toFixed(1)}s: ${message.split("\n")[0]}`
+          );
+          await new Promise((r) => setTimeout(r, delay));
+          continue;
+        }
+        logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message });
+        return { name: pkg.name, version: pkg.version, success: false, error: message };
+      }
+    }
+    return {
+      name: pkg.name,
+      version: pkg.version,
+      success: false,
+      error: `Publish failed after ${MAX_RETRIES} retries (transient errors)`
+    };
+  } finally {
+    restore();
+  }
+}
 async function publishPackagesProgrammatic(options) {
-  const { packages, packageManager = "pnpm", dryRun, otp, tag, access, registry } = options;
+  const {
+    packages,
+    packageManager = "pnpm",
+    dryRun,
+    otp,
+    tag,
+    access,
+    registry
+  } = options;
   const logger = useLogger();
   const token = resolveToken(options.token);
   if (!token && !dryRun) {
@@ -94,192 +283,184 @@ async function publishPackagesProgrammatic(options) {
     return {
       results: [],
       published: [],
+      alreadyPublished: [],
       failed: packages.map((p) => `${p.name}@${p.version}`),
       skipped: [],
       errors: [error]
     };
   }
   const versionMap = new Map(packages.map((p) => [p.name, p.version]));
-  const CONCURRENCY = Number(useEnv("KB_PUBLISH_CONCURRENCY") ?? 8);
-  const MAX_429_RETRIES = 3;
-  const RETRY_429_DELAYS = [15e3, 3e4, 6e4];
-  const publishOne = async (pkg) => {
-    logger.info(`Publishing ${pkg.name}@${pkg.version}`, { path: pkg.path, dryRun });
-    const pkgJsonPath = join(pkg.path, "package.json");
-    const originalPkgJson = readFileSync(pkgJsonPath, "utf-8");
-    let restored = false;
-    try {
-      const pkgJson = JSON.parse(originalPkgJson);
-      let modified = false;
-      for (const section of ["dependencies", "peerDependencies"]) {
-        const deps = pkgJson[section];
-        if (!deps) {
-          continue;
-        }
-        for (const [depName, depValue] of Object.entries(deps)) {
-          if (typeof depValue !== "string") {
-            continue;
-          }
-          const val = depValue;
-          if (val.startsWith("link:")) {
-            const planVersion = versionMap.get(depName);
-            if (planVersion) {
-              deps[depName] = `^${planVersion}`;
-              modified = true;
-            } else {
-              try {
-                const linkPath = val.replace("link:", "");
-                const linkedPkg = JSON.parse(readFileSync(join(pkg.path, linkPath, "package.json"), "utf-8"));
-                deps[depName] = `^${linkedPkg.version}`;
-                modified = true;
-              } catch {
-                deps[depName] = "*";
-                modified = true;
-              }
-            }
-          } else if (val.startsWith("workspace:") && packageManager !== "pnpm") {
-            const planVersion = versionMap.get(depName);
-            if (planVersion) {
-              deps[depName] = val === "workspace:*" ? `^${planVersion}` : val.replace("workspace:", "");
-              modified = true;
-            }
-          }
-        }
-      }
-      if (modified) {
-        writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
-      }
-      for (let attempt = 0; attempt <= MAX_429_RETRIES; attempt++) {
-        try {
-          await publishSinglePackage({
-            packagePath: pkg.path,
-            packageManager,
-            token,
-            otp,
-            dryRun,
-            tag,
-            access: access ?? "public",
-            registry
-          });
-          logger.info(`Published ${pkg.name}@${pkg.version}`);
-          return { name: pkg.name, version: pkg.version, success: true };
-        } catch (error) {
-          const message = error instanceof Error ? error.message : String(error);
-          if ((message.includes("E429") || message.includes("429 Too Many Requests")) && attempt < MAX_429_RETRIES) {
-            const delay = RETRY_429_DELAYS[attempt];
-            logger.warn(`429 rate limit for ${pkg.name}, retrying in ${delay / 1e3}s`, { attempt: attempt + 1 });
-            await new Promise((r) => setTimeout(r, delay));
-            continue;
+  const CONCURRENCY = Number(useEnv("KB_PUBLISH_CONCURRENCY") ?? 4);
+  const waves = topoSort(packages);
+  logger.info(
+    `Publishing ${packages.length} package(s) in ${waves.length} topological wave(s) (concurrency=${CONCURRENCY}, dryRun=${dryRun ?? false})`
+  );
+  const allResults = [];
+  for (let waveIdx = 0; waveIdx < waves.length; waveIdx++) {
+    const wave = waves[waveIdx];
+    logger.info(`Wave ${waveIdx + 1}/${waves.length}: publishing ${wave.length} package(s)`);
+    for (let i = 0; i < wave.length; i += CONCURRENCY) {
+      const batch = wave.slice(i, i + CONCURRENCY);
+      const batchResults = await Promise.all(
+        batch.map(
+          (pkg) => publishOne(pkg, { packageManager, token, versionMap, dryRun, otp, tag, access, registry }, logger)
+        )
+      );
+      allResults.push(...batchResults);
+    }
+    const waveFailed = allResults.slice(-wave.length).filter((r) => !r.success);
+    if (waveFailed.length > 0) {
+      const remaining = waves.slice(waveIdx + 1).reduce((acc, w) => acc + w.length, 0);
+      if (remaining > 0) {
+        logger.warn(
+          `Wave ${waveIdx + 1} had ${waveFailed.length} failure(s) \u2014 skipping ${remaining} package(s) in later waves to avoid broken dependency chain`
+        );
+        for (const laterWave of waves.slice(waveIdx + 1)) {
+          for (const pkg of laterWave) {
+            allResults.push({
+              name: pkg.name,
+              version: pkg.version,
+              success: false,
+              error: "Skipped: dependency wave failed"
+            });
           }
-          logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message });
-          return { name: pkg.name, version: pkg.version, success: false, error: message };
         }
       }
-      return { name: pkg.name, version: pkg.version, success: false, error: "429 rate limit: max retries exceeded" };
-    } finally {
-      if (!restored) {
-        writeFileSync(pkgJsonPath, originalPkgJson);
-        restored = true;
-      }
+      break;
     }
-  };
-  const results = [];
-  for (let i = 0; i < packages.length; i += CONCURRENCY) {
-    const batch = packages.slice(i, i + CONCURRENCY);
-    const batchResults = await Promise.all(batch.map(publishOne));
-    results.push(...batchResults);
   }
-  const published = results.filter((r) => r.success).map((r) => `${r.name}@${r.version}`);
-  const failed = results.filter((r) => !r.success).map((r) => `${r.name}@${r.version}`);
-  const errors = results.filter((r) => !r.success && r.error).map((r) => `${r.name}: ${r.error}`);
+  const published = allResults.filter((r) => r.success && !r.alreadyPublished).map((r) => `${r.name}@${r.version}`);
+  const alreadyPublished = allResults.filter((r) => r.alreadyPublished).map((r) => `${r.name}@${r.version}`);
+  const failed = allResults.filter((r) => !r.success).map((r) => `${r.name}@${r.version}`);
+  const errors = allResults.filter((r) => !r.success && r.error).map((r) => `${r.name}: ${r.error}`);
+  if (alreadyPublished.length > 0) {
+    logger.info(`${alreadyPublished.length} package(s) already published \u2014 counted as success`);
+  }
   return {
-    results,
+    results: allResults,
     published,
+    alreadyPublished,
     failed,
     skipped: dryRun ? packages.map((p) => `${p.name}@${p.version} (dry-run)`) : [],
     errors
   };
 }
+var MAX_RETRIES2 = 5;
+var RETRY_BASE_DELAYS_MS2 = [1e4, 2e4, 4e4, 8e4, 16e4];
+var RETRYABLE_PATTERNS2 = [
+  "E429",
+  "429 Too Many Requests",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ECONNREFUSED",
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "socket hang up",
+  "network timeout",
+  "read ECONNRESET"
+];
+var ALREADY_PUBLISHED_PATTERNS2 = [
+  "You cannot publish over the previously published versions",
+  "cannot publish over the previously published version",
+  "EPUBLISHCONFLICT"
+];
+function isRetryable2(msg) {
+  return RETRYABLE_PATTERNS2.some((p) => msg.includes(p));
+}
+function isAlreadyPublished2(msg) {
+  return ALREADY_PUBLISHED_PATTERNS2.some((p) => msg.includes(p));
+}
+function retryDelay2(attempt) {
+  const base = RETRY_BASE_DELAYS_MS2[Math.min(attempt, RETRY_BASE_DELAYS_MS2.length - 1)];
+  const jitter = 0.8 + Math.random() * 0.4;
+  return Math.round(base * jitter);
+}
+function publishSinglePackage(options) {
+  const { packagePath, packageManager = "pnpm", otp, dryRun, tag, access } = options;
+  return new Promise((resolve, reject) => {
+    const args = ["publish"];
+    if (packageManager === "pnpm") {
+      args.push("--no-git-checks");
+    }
+    if (dryRun) {
+      args.push("--dry-run");
+    }
+    if (otp) {
+      args.push(`--otp=${otp}`);
+    }
+    if (tag) {
+      args.push(`--tag=${tag}`);
+    }
+    if (access) {
+      args.push(`--access=${access}`);
+    }
+    const child = spawn(packageManager, args, {
+      cwd: packagePath,
+      stdio: ["inherit", "pipe", "pipe"],
+      shell: true
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout?.on("data", (d) => {
+      stdout += d.toString();
+    });
+    child.stderr?.on("data", (d) => {
+      stderr += d.toString();
+    });
+    child.on("close", (code) => {
+      if (code === 0) {
+        resolve();
+      } else {
+        reject(new Error(stderr || stdout || `${packageManager} publish exited with code ${code}`));
+      }
+    });
+    child.on("error", (err) => reject(err));
+  });
+}
 async function publishPackagesWithOTP(options) {
   const { packages, packageManager = "pnpm", dryRun, tag, access, ui, logger } = options;
   let otp = options.otp;
   const results = [];
   const versionMap = new Map(packages.map((p) => [p.name, p.version]));
-  const preparePackage = (pkg) => {
-    const pkgJsonPath = join(pkg.path, "package.json");
-    const originalPkgJson = readFileSync(pkgJsonPath, "utf-8");
-    const pkgJson = JSON.parse(originalPkgJson);
-    let modified = false;
-    for (const section of ["dependencies", "peerDependencies"]) {
-      const deps = pkgJson[section];
-      if (!deps) {
-        continue;
-      }
-      for (const [depName, depValue] of Object.entries(deps)) {
-        if (typeof depValue !== "string") {
-          continue;
-        }
-        const val = depValue;
-        if (val.startsWith("link:")) {
-          const planVersion = versionMap.get(depName);
-          if (planVersion) {
-            deps[depName] = `^${planVersion}`;
-            modified = true;
-          } else {
-            try {
-              const linkPath = val.replace("link:", "");
-              const linkedPkg = JSON.parse(readFileSync(join(pkg.path, linkPath, "package.json"), "utf-8"));
-              deps[depName] = `^${linkedPkg.version}`;
-              modified = true;
-            } catch {
-              deps[depName] = "*";
-              modified = true;
-            }
-          }
-        } else if (val.startsWith("workspace:") && packageManager !== "pnpm") {
-          const planVersion = versionMap.get(depName);
-          if (planVersion) {
-            deps[depName] = val === "workspace:*" ? `^${planVersion}` : val.replace("workspace:", "");
-            modified = true;
-          }
-        }
-      }
-    }
-    if (modified) {
-      writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
-    }
-    return () => writeFileSync(pkgJsonPath, originalPkgJson);
-  };
-  const CONCURRENCY = Number(useEnv("KB_PUBLISH_CONCURRENCY") ?? 8);
+  const CONCURRENCY = Number(useEnv("KB_PUBLISH_CONCURRENCY") ?? 4);
   const remaining = [];
   let otpFailureDetected = false;
-  const MAX_429_RETRIES = 3;
-  const RETRY_429_DELAYS = [15e3, 3e4, 6e4];
   const fastPublishOne = async (pkg) => {
-    const restore = preparePackage(pkg);
+    const restore = rewriteWorkspaceDeps(pkg.path, versionMap, packageManager);
     try {
-      for (let attempt = 0; attempt <= MAX_429_RETRIES; attempt++) {
+      for (let attempt = 0; attempt <= MAX_RETRIES2; attempt++) {
         try {
-          await publishSinglePackage2({ packagePath: pkg.path, packageManager, otp, dryRun, tag, access });
-          logger?.info("Package published successfully (fast-path)", { name: pkg.name, version: pkg.version, dryRun });
+          await publishSinglePackage({ packagePath: pkg.path, packageManager, otp, dryRun, tag, access });
+          logger?.info("Published (fast-path)", { name: pkg.name, version: pkg.version });
           return { name: pkg.name, version: pkg.version, success: true };
-        } catch (error) {
-          const msg = error.message || String(error);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (isAlreadyPublished2(msg)) {
+            logger?.info(`${pkg.name}@${pkg.version} already published \u2014 skipping`);
+            return { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true };
+          }
           if (msg.includes("EOTP") || msg.includes("one-time password")) {
             otpFailureDetected = true;
             return null;
           }
-          if ((msg.includes("E429") || msg.includes("429 Too Many Requests")) && attempt < MAX_429_RETRIES) {
-            const delay = RETRY_429_DELAYS[attempt];
-            logger?.warn(`429 rate limit for ${pkg.name}, retrying in ${delay / 1e3}s`, { attempt: attempt + 1 });
+          if (isRetryable2(msg) && attempt < MAX_RETRIES2) {
+            const delay = retryDelay2(attempt);
+            logger?.warn(
+              `Transient error for ${pkg.name} (attempt ${attempt + 1}/${MAX_RETRIES2}), retrying in ${(delay / 1e3).toFixed(1)}s`
+            );
             await new Promise((r) => setTimeout(r, delay));
             continue;
           }
-          logger?.error("Package publish failed (fast-path)", { name: pkg.name, error: msg });
+          logger?.error("Publish failed (fast-path)", { name: pkg.name, error: msg });
           return { name: pkg.name, version: pkg.version, success: false, error: msg };
         }
       }
-      return { name: pkg.name, version: pkg.version, success: false, error: "429 rate limit: max retries exceeded" };
+      return {
+        name: pkg.name,
+        version: pkg.version,
+        success: false,
+        error: `Publish failed after ${MAX_RETRIES2} retries (transient errors)`
+      };
     } finally {
       restore();
     }
@@ -303,231 +484,87 @@ async function publishPackagesWithOTP(options) {
     }
   }
   if (remaining.length === 0) {
-    const published2 = results.filter((r) => r.success).map((r) => `${r.name}@${r.version}`);
-    const failed2 = results.filter((r) => !r.success).map((r) => `${r.name}@${r.version}`);
-    const errors2 = results.filter((r) => !r.success && r.error).map((r) => `${r.name}: ${r.error}`);
-    return {
-      results,
-      published: published2,
-      failed: failed2,
-      skipped: dryRun ? packages.map((p) => `${p.name}@${p.version} (dry-run)`) : [],
-      errors: errors2
-    };
+    return buildResult(results, packages, dryRun);
   }
   ui.write?.(`  OTP required \u2014 falling back to sequential publish for ${remaining.length} package(s)
 `);
   for (const pkg of remaining) {
-    logger?.info("Publishing package", { name: pkg.name, version: pkg.version });
-    const pkgJsonPath = join(pkg.path, "package.json");
-    const originalPkgJson = readFileSync(pkgJsonPath, "utf-8");
-    let restored = false;
+    logger?.info("Publishing package (sequential)", { name: pkg.name, version: pkg.version });
+    const loader = useLoader(`Publishing ${pkg.name}@${pkg.version}...`);
+    loader.start();
+    const restore = rewriteWorkspaceDeps(pkg.path, versionMap, packageManager);
     try {
-      const pkgJson = JSON.parse(originalPkgJson);
-      let modified = false;
-      for (const section of ["dependencies", "peerDependencies"]) {
-        const deps = pkgJson[section];
-        if (!deps) {
-          continue;
-        }
-        for (const [depName, depValue] of Object.entries(deps)) {
-          if (typeof depValue !== "string") {
-            continue;
-          }
-          const val = depValue;
-          if (val.startsWith("link:")) {
-            const planVersion = versionMap.get(depName);
-            if (planVersion) {
-              deps[depName] = `^${planVersion}`;
-              modified = true;
-            } else {
-              try {
-                const linkPath = val.replace("link:", "");
-                const linkedPkg = JSON.parse(readFileSync(join(pkg.path, linkPath, "package.json"), "utf-8"));
-                deps[depName] = `^${linkedPkg.version}`;
-                modified = true;
-              } catch {
-                deps[depName] = "*";
-                modified = true;
-              }
-            }
-          } else if (val.startsWith("workspace:") && packageManager !== "pnpm") {
-            const planVersion = versionMap.get(depName);
-            if (planVersion) {
-              deps[depName] = val === "workspace:*" ? `^${planVersion}` : val.replace("workspace:", "");
-              modified = true;
-            }
-          }
-        }
-      }
-      if (modified) {
-        writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + "\n");
-        logger?.info(`Replaced link: deps for ${pkg.name}`);
-      }
-      const loader = useLoader(`Publishing ${pkg.name}@${pkg.version}...`);
-      loader.start();
-      let attempts = 0;
-      const maxAttempts = 3;
-      let published2 = false;
-      while (!published2 && attempts < maxAttempts) {
-        attempts++;
+      let published = false;
+      let otpAttempts = 0;
+      const MAX_OTP_ATTEMPTS = 3;
+      while (!published && otpAttempts < MAX_OTP_ATTEMPTS) {
+        otpAttempts++;
         try {
-          await publishSinglePackage2({
-            packagePath: pkg.path,
-            packageManager,
-            otp,
-            dryRun,
-            tag,
-            access
-          });
-          published2 = true;
+          await publishSinglePackage({ packagePath: pkg.path, packageManager, otp, dryRun, tag, access });
+          published = true;
           results.push({ name: pkg.name, version: pkg.version, success: true });
-          const successMsg = dryRun ? `Dry-run succeeded for ${pkg.name}@${pkg.version}` : `Published ${pkg.name}@${pkg.version}`;
-          loader.succeed(successMsg);
-          logger?.info("Package published successfully", {
-            name: pkg.name,
-            version: pkg.version,
-            dryRun
-          });
-        } catch (error) {
-          const errorMessage = error.message || String(error);
-          if (errorMessage.includes("EOTP") || errorMessage.includes("one-time password")) {
-            if (attempts < maxAttempts) {
+          loader.succeed(dryRun ? `Dry-run: ${pkg.name}@${pkg.version}` : `Published ${pkg.name}@${pkg.version}`);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          if (isAlreadyPublished2(msg)) {
+            published = true;
+            results.push({ name: pkg.name, version: pkg.version, success: true, alreadyPublished: true });
+            loader.succeed(`${pkg.name}@${pkg.version} already published`);
+            break;
+          }
+          if (msg.includes("EOTP") || msg.includes("one-time password")) {
+            if (otpAttempts < MAX_OTP_ATTEMPTS) {
               loader.succeed(`\u{1F510} 2FA required for ${pkg.name}`);
-              logger?.info("OTP required for publishing", {
-                name: pkg.name,
-                attempt: attempts
-              });
-              const rl = readline.createInterface({
-                input: process.stdin,
-                output: process.stdout
-              });
+              const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
               try {
-                otp = await rl.question("   Enter OTP code: ");
+                const entered = await rl.question("   Enter OTP code: ");
                 rl.close();
-                if (!otp || otp.trim().length !== 6) {
-                  ui.write?.("   \u26A0\uFE0F  Invalid OTP code (must be 6 digits)\n");
-                  logger?.warn("Invalid OTP code provided", { length: otp?.trim().length });
+                if (!entered || entered.trim().length !== 6) {
+                  ui.write?.("   \u26A0\uFE0F  Invalid OTP (must be 6 digits)\n");
                   otp = void 0;
-                  continue;
+                } else {
+                  otp = entered.trim();
                 }
-                loader.update({ text: `Publishing ${pkg.name}@${pkg.version} with OTP...` });
-                loader.start();
-                logger?.debug("Retrying with OTP");
               } catch (e) {
                 rl.close();
                 throw e;
               }
-            } else {
-              loader.fail("Max OTP attempts reached");
-              logger?.error("Max OTP attempts reached", {
-                name: pkg.name,
-                attempts: maxAttempts
-              });
-              results.push({
-                name: pkg.name,
-                version: pkg.version,
-                success: false,
-                error: "Max OTP attempts reached"
-              });
-              break;
-            }
-          } else if (errorMessage.includes("E429") || errorMessage.includes("429 Too Many Requests")) {
-            if (attempts < maxAttempts) {
-              const delay = RETRY_429_DELAYS[Math.min(attempts - 1, RETRY_429_DELAYS.length - 1)];
-              loader.update({ text: `429 rate limit \u2014 waiting ${delay / 1e3}s before retry...` });
+              loader.update({ text: `Publishing ${pkg.name}@${pkg.version} with OTP...` });
               loader.start();
-              logger?.warn(`429 rate limit for ${pkg.name}, retrying in ${delay / 1e3}s`, { attempt: attempts });
-              await new Promise((r) => setTimeout(r, delay));
             } else {
-              loader.fail("Max retries exceeded (429 rate limit)");
-              results.push({
-                name: pkg.name,
-                version: pkg.version,
-                success: false,
-                error: "429 rate limit: max retries exceeded"
-              });
+              loader.fail("Max OTP attempts reached");
+              results.push({ name: pkg.name, version: pkg.version, success: false, error: "Max OTP attempts reached" });
               break;
             }
+          } else if (isRetryable2(msg)) {
+            const delay = retryDelay2(MAX_RETRIES2 - 1);
+            loader.update({ text: `Rate limited \u2014 waiting ${(delay / 1e3).toFixed(0)}s\u2026` });
+            loader.start();
+            await new Promise((r) => setTimeout(r, delay));
+            otpAttempts--;
           } else {
-            loader.fail(`Failed: ${errorMessage}`);
-            logger?.error("Package publish failed", {
-              name: pkg.name,
-              version: pkg.version,
-              error: errorMessage
-            });
-            results.push({
-              name: pkg.name,
-              version: pkg.version,
-              success: false,
-              error: errorMessage
-            });
+            loader.fail(`Failed: ${msg.split("\n")[0]}`);
+            results.push({ name: pkg.name, version: pkg.version, success: false, error: msg });
             break;
           }
         }
       }
     } finally {
-      if (!restored) {
-        writeFileSync(pkgJsonPath, originalPkgJson);
-        restored = true;
-      }
+      restore();
     }
   }
-  const published = results.filter((r) => r.success).map((r) => `${r.name}@${r.version}`);
-  const failed = results.filter((r) => !r.success).map((r) => `${r.name}@${r.version}`);
-  const errors = results.filter((r) => !r.success && r.error).map((r) => `${r.name}: ${r.error}`);
+  return buildResult(results, packages, dryRun);
+}
+function buildResult(results, packages, dryRun) {
   return {
     results,
-    published,
-    failed,
+    published: results.filter((r) => r.success && !r.alreadyPublished).map((r) => `${r.name}@${r.version}`),
+    alreadyPublished: results.filter((r) => r.alreadyPublished).map((r) => `${r.name}@${r.version}`),
+    failed: results.filter((r) => !r.success).map((r) => `${r.name}@${r.version}`),
     skipped: dryRun ? packages.map((p) => `${p.name}@${p.version} (dry-run)`) : [],
-    errors
+    errors: results.filter((r) => !r.success && r.error).map((r) => `${r.name}: ${r.error}`)
   };
 }
-function publishSinglePackage2(options) {
-  const { packagePath, packageManager = "pnpm", otp, dryRun, tag, access } = options;
-  return new Promise((resolve, reject) => {
-    const args = ["publish"];
-    if (packageManager === "pnpm") {
-      args.push("--no-git-checks");
-    }
-    if (dryRun) {
-      args.push("--dry-run");
-    }
-    if (otp) {
-      args.push(`--otp=${otp}`);
-    }
-    if (tag) {
-      args.push(`--tag=${tag}`);
-    }
-    if (access) {
-      args.push(`--access=${access}`);
-    }
-    const child = spawn(packageManager, args, {
-      cwd: packagePath,
-      stdio: ["inherit", "pipe", "pipe"],
-      shell: true
-    });
-    let stdout = "";
-    let stderr = "";
-    child.stdout?.on("data", (data) => {
-      stdout += data.toString();
-    });
-    child.stderr?.on("data", (data) => {
-      stderr += data.toString();
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve();
-      } else {
-        const errorOutput = stderr || stdout;
-        reject(new Error(errorOutput));
-      }
-    });
-    child.on("error", (err) => {
-      reject(err);
-    });
-  });
-}
 
 // src/cli/commands/publish.ts
 var publish_default = defineCommand({