@kb-labs/release-manager-cli 2.82.0 → 2.88.0

package/dist/cli/commands/run.js

@@ -1,12 +1,10 @@
 import * as readline from 'readline/promises';
-import { defineCommand, findRepoRoot, useLoader, useConfig, useLLM, useEnv, useLogger } from '@kb-labs/sdk';
+import { defineCommand, findRepoRoot, useLoader, useConfig, useEnv, useLLM, useLogger } from '@kb-labs/sdk';
 import { resolveScopePath, planRelease, runReleasePipeline } from '@kb-labs/release-manager-core';
-import { join } from 'path';
-import 'fs/promises';
-import 'globby';
 import { generateChangelog, generateSimpleChangelog } from '@kb-labs/release-manager-changelog';
 import { spawn } from 'child_process';
 import { readFileSync, writeFileSync, existsSync, unlinkSync } from 'fs';
+import { join } from 'path';
 
 // src/cli/commands/run.ts
 function createChangelogGenerator(config, llm) {
@@ -52,6 +50,44 @@ function createChangelogGenerator(config, llm) {
     }
   };
 }
+function rewriteLinkDep(deps, depName, val, pkgPath, versionMap) {
+  const pinned = versionMap.get(depName);
+  if (pinned) {
+    deps[depName] = `^${pinned}`;
+    return;
+  }
+  try {
+    const linkPath = val.slice("link:".length);
+    const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, "package.json"), "utf-8"));
+    deps[depName] = `^${linked.version ?? "*"}`;
+  } catch {
+    deps[depName] = "*";
+  }
+}
+function rewriteWorkspaceDep(deps, depName, val, versionMap) {
+  const pinned = versionMap.get(depName);
+  if (!pinned) {
+    return false;
+  }
+  deps[depName] = val === "workspace:*" ? `^${pinned}` : val.replace("workspace:", "");
+  return true;
+}
+function rewriteDepsSection(deps, pkgPath, versionMap, packageManager) {
+  let modified = false;
+  for (const depName of Object.keys(deps)) {
+    const val = deps[depName];
+    if (typeof val !== "string") {
+      continue;
+    }
+    if (val.startsWith("link:")) {
+      rewriteLinkDep(deps, depName, val, pkgPath, versionMap);
+      modified = true;
+    } else if (val.startsWith("workspace:") && packageManager !== "pnpm" && rewriteWorkspaceDep(deps, depName, val, versionMap)) {
+      modified = true;
+    }
+  }
+  return modified;
+}
 function rewriteWorkspaceDeps(pkgPath, versionMap, packageManager) {
   const pkgJsonPath = join(pkgPath, "package.json");
   const original = readFileSync(pkgJsonPath, "utf-8");
@@ -62,32 +98,8 @@ function rewriteWorkspaceDeps(pkgPath, versionMap, packageManager) {
     if (!deps) {
       continue;
     }
-    for (const depName of Object.keys(deps)) {
-      const val = deps[depName];
-      if (typeof val !== "string") {
-        continue;
-      }
-      if (val.startsWith("link:")) {
-        const pinned = versionMap.get(depName);
-        if (pinned) {
-          deps[depName] = `^${pinned}`;
-        } else {
-          try {
-            const linkPath = val.slice("link:".length);
-            const linked = JSON.parse(readFileSync(join(pkgPath, linkPath, "package.json"), "utf-8"));
-            deps[depName] = `^${linked.version ?? "*"}`;
-          } catch {
-            deps[depName] = "*";
-          }
-        }
-        modified = true;
-      } else if (val.startsWith("workspace:") && packageManager !== "pnpm") {
-        const pinned = versionMap.get(depName);
-        if (pinned) {
-          deps[depName] = val === "workspace:*" ? `^${pinned}` : val.replace("workspace:", "");
-          modified = true;
-        }
-      }
+    if (rewriteDepsSection(deps, pkgPath, versionMap, packageManager)) {
+      modified = true;
     }
   }
   if (modified) {
@@ -95,8 +107,7 @@ function rewriteWorkspaceDeps(pkgPath, versionMap, packageManager) {
   }
   return () => writeFileSync(pkgJsonPath, original);
 }
-function topoSort(packages, packageManager) {
-  const nameSet = new Set(packages.map((p) => p.name));
+function buildIntraDeps(packages, nameSet) {
   const deps = /* @__PURE__ */ new Map();
   for (const pkg of packages) {
     const intra = /* @__PURE__ */ new Set();
@@ -113,12 +124,9 @@ function topoSort(packages, packageManager) {
     }
     deps.set(pkg.name, intra);
   }
-  const inDegree = new Map(packages.map((p) => [p.name, 0]));
-  for (const [, d] of deps) {
-    for (const dep of d) {
-      inDegree.set(dep, (inDegree.get(dep) ?? 0) + 1);
-    }
-  }
+  return deps;
+}
+function buildDependantsMap(packages, deps) {
   const dependants = /* @__PURE__ */ new Map();
   for (const pkg of packages) {
     for (const dep of deps.get(pkg.name) ?? []) {
@@ -128,10 +136,13 @@ function topoSort(packages, packageManager) {
       dependants.get(dep).add(pkg.name);
     }
   }
+  return dependants;
+}
+function computeWaves(packages, deps, dependants) {
+  const byName = new Map(packages.map((p) => [p.name, p]));
   const remaining = new Map(
     packages.map((p) => [p.name, (deps.get(p.name) ?? /* @__PURE__ */ new Set()).size])
   );
-  const byName = new Map(packages.map((p) => [p.name, p]));
   const waves = [];
   while (remaining.size > 0) {
     const wave = [...remaining.entries()].filter(([, count]) => count === 0).map(([name]) => byName.get(name));
@@ -151,6 +162,12 @@ function topoSort(packages, packageManager) {
   }
   return waves.filter((w) => w.length > 0);
 }
+function topoSort(packages, _packageManager) {
+  const nameSet = new Set(packages.map((p) => p.name));
+  const deps = buildIntraDeps(packages, nameSet);
+  const dependants = buildDependantsMap(packages, deps);
+  return computeWaves(packages, deps, dependants);
+}
 
 // src/shared/publish-programmatic.ts
 var MAX_RETRIES = 5;
@@ -292,7 +309,9 @@ async function publishOne(pkg, opts, logger) {
           logger.warn(
             `Transient error for ${pkg.name}@${pkg.version} (attempt ${attempt + 1}/${MAX_RETRIES}), retrying in ${(delay / 1e3).toFixed(1)}s: ${message.split("\n")[0]}`
           );
-          await new Promise((r) => setTimeout(r, delay));
+          await new Promise((r) => {
+            setTimeout(r, delay);
+          });
           continue;
         }
         logger.error(`Failed to publish ${pkg.name}@${pkg.version}`, void 0, { error: message });
@@ -309,6 +328,20 @@ async function publishOne(pkg, opts, logger) {
     restore();
   }
 }
+function skipRemainingWaves(waves, waveIdx, waveFailed, logger, allResults) {
+  const remaining = waves.slice(waveIdx + 1).reduce((acc, w) => acc + w.length, 0);
+  if (remaining === 0) {
+    return;
+  }
+  logger.warn(
+    `Wave ${waveIdx + 1} had ${waveFailed.length} failure(s) \u2014 skipping ${remaining} package(s) in later waves to avoid broken dependency chain`
+  );
+  for (const laterWave of waves.slice(waveIdx + 1)) {
+    for (const pkg of laterWave) {
+      allResults.push({ name: pkg.name, version: pkg.version, success: false, error: "Skipped: dependency wave failed" });
+    }
+  }
+}
 async function publishPackagesProgrammatic(options) {
   const {
     packages,
@@ -354,22 +387,7 @@ async function publishPackagesProgrammatic(options) {
     }
     const waveFailed = allResults.slice(-wave.length).filter((r) => !r.success);
     if (waveFailed.length > 0) {
-      const remaining = waves.slice(waveIdx + 1).reduce((acc, w) => acc + w.length, 0);
-      if (remaining > 0) {
-        logger.warn(
-          `Wave ${waveIdx + 1} had ${waveFailed.length} failure(s) \u2014 skipping ${remaining} package(s) in later waves to avoid broken dependency chain`
-        );
-        for (const laterWave of waves.slice(waveIdx + 1)) {
-          for (const pkg of laterWave) {
-            allResults.push({
-              name: pkg.name,
-              version: pkg.version,
-              success: false,
-              error: "Skipped: dependency wave failed"
-            });
-          }
-        }
-      }
+      skipRemainingWaves(waves, waveIdx, waveFailed, logger, allResults);
       break;
     }
   }
@@ -461,65 +479,125 @@ function publishSinglePackage(options) {
     child.on("error", (err) => reject(err));
   });
 }
-async function publishPackagesWithOTP(options) {
-  const { packages, packageManager = "pnpm", dryRun, tag, access, ui, logger } = options;
-  let otp = options.otp;
-  const results = [];
-  const versionMap = new Map(packages.map((p) => [p.name, p.version]));
-  const CONCURRENCY = Number(useEnv("KB_PUBLISH_CONCURRENCY") ?? 4);
-  const remaining = [];
-  let otpFailureDetected = false;
-  const fastPublishOne = async (pkg) => {
-    const restore = rewriteWorkspaceDeps(pkg.path, versionMap, packageManager);
-    try {
-      for (let attempt = 0; attempt <= MAX_RETRIES2; attempt++) {
-        try {
-          await publishSinglePackage({ packagePath: pkg.path, packageManager, otp, dryRun, tag, access });
-          logger?.info("Published (fast-path)", { name: pkg.name, version: pkg.version });
-          return { name: pkg.name, version: pkg.version, success: true };
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          if (isAlreadyPublished2(msg)) {
-            logger?.info(`${pkg.name}@${pkg.version} already published \u2014 skipping`);
-            return { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true };
-          }
-          if (msg.includes("EOTP") || msg.includes("one-time password")) {
-            otpFailureDetected = true;
-            return null;
-          }
-          if (isRetryable2(msg) && attempt < MAX_RETRIES2) {
-            const delay = retryDelay2(attempt);
-            logger?.warn(
-              `Transient error for ${pkg.name} (attempt ${attempt + 1}/${MAX_RETRIES2}), retrying in ${(delay / 1e3).toFixed(1)}s`
-            );
-            await new Promise((r) => setTimeout(r, delay));
-            continue;
+async function fastPublishPkg(pkg, ctx, logger) {
+  const restore = rewriteWorkspaceDeps(pkg.path, ctx.versionMap, ctx.packageManager);
+  try {
+    for (let attempt = 0; attempt <= MAX_RETRIES2; attempt++) {
+      try {
+        await publishSinglePackage({ packagePath: pkg.path, packageManager: ctx.packageManager, otp: ctx.otp, dryRun: ctx.dryRun, tag: ctx.tag, access: ctx.access });
+        logger?.info("Published (fast-path)", { name: pkg.name, version: pkg.version });
+        return { result: { name: pkg.name, version: pkg.version, success: true }, otpFailed: false };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (isAlreadyPublished2(msg)) {
+          logger?.info(`${pkg.name}@${pkg.version} already published \u2014 skipping`);
+          return { result: { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true }, otpFailed: false };
+        }
+        if (msg.includes("EOTP") || msg.includes("one-time password")) {
+          return { result: null, otpFailed: true };
+        }
+        if (isRetryable2(msg) && attempt < MAX_RETRIES2) {
+          const delay = retryDelay2(attempt);
+          logger?.warn(`Transient error for ${pkg.name} (attempt ${attempt + 1}/${MAX_RETRIES2}), retrying in ${(delay / 1e3).toFixed(1)}s`);
+          await new Promise((r) => {
+            setTimeout(r, delay);
+          });
+          continue;
+        }
+        logger?.error("Publish failed (fast-path)", void 0, { name: pkg.name, error: msg });
+        return { result: { name: pkg.name, version: pkg.version, success: false, error: msg }, otpFailed: false };
+      }
+    }
+    return { result: { name: pkg.name, version: pkg.version, success: false, error: `Publish failed after ${MAX_RETRIES2} retries (transient errors)` }, otpFailed: false };
+  } finally {
+    restore();
+  }
+}
+async function promptForOtp(ui, loader, pkgName) {
+  loader.succeed(`\u{1F510} 2FA required for ${pkgName}`);
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    const entered = await rl.question("   Enter OTP code: ");
+    rl.close();
+    if (!entered || entered.trim().length !== 6) {
+      ui.write?.("   \u26A0\uFE0F  Invalid OTP (must be 6 digits)\n");
+      return void 0;
+    }
+    return entered.trim();
+  } catch (e) {
+    rl.close();
+    throw e;
+  }
+}
+async function sequentialPublishPkg(pkg, ctx, otpState, ui, logger) {
+  const loader = useLoader(`Publishing ${pkg.name}@${pkg.version}...`);
+  loader.start();
+  const restore = rewriteWorkspaceDeps(pkg.path, ctx.versionMap, ctx.packageManager);
+  try {
+    const MAX_OTP_ATTEMPTS = 3;
+    for (let otpAttempts = 0; otpAttempts < MAX_OTP_ATTEMPTS; otpAttempts++) {
+      try {
+        await publishSinglePackage({ packagePath: pkg.path, packageManager: ctx.packageManager, otp: otpState.otp, dryRun: ctx.dryRun, tag: ctx.tag, access: ctx.access });
+        loader.succeed(ctx.dryRun ? `Dry-run: ${pkg.name}@${pkg.version}` : `Published ${pkg.name}@${pkg.version}`);
+        return { name: pkg.name, version: pkg.version, success: true };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (isAlreadyPublished2(msg)) {
+          loader.succeed(`${pkg.name}@${pkg.version} already published`);
+          return { name: pkg.name, version: pkg.version, success: true, alreadyPublished: true };
+        }
+        if (msg.includes("EOTP") || msg.includes("one-time password")) {
+          if (otpAttempts + 1 < MAX_OTP_ATTEMPTS) {
+            otpState.otp = await promptForOtp(ui, loader, pkg.name);
+            loader.update({ text: `Publishing ${pkg.name}@${pkg.version} with OTP...` });
+            loader.start();
+          } else {
+            loader.fail("Max OTP attempts reached");
+            return { name: pkg.name, version: pkg.version, success: false, error: "Max OTP attempts reached" };
           }
-          logger?.error("Publish failed (fast-path)", { name: pkg.name, error: msg });
+        } else if (isRetryable2(msg)) {
+          const delay = retryDelay2(MAX_RETRIES2 - 1);
+          loader.update({ text: `Rate limited \u2014 waiting ${(delay / 1e3).toFixed(0)}s\u2026` });
+          loader.start();
+          await new Promise((r) => {
+            setTimeout(r, delay);
+          });
+          otpAttempts--;
+        } else {
+          loader.fail(`Failed: ${msg.split("\n")[0]}`);
           return { name: pkg.name, version: pkg.version, success: false, error: msg };
         }
       }
-      return {
-        name: pkg.name,
-        version: pkg.version,
-        success: false,
-        error: `Publish failed after ${MAX_RETRIES2} retries (transient errors)`
-      };
-    } finally {
-      restore();
     }
-  };
+    return { name: pkg.name, version: pkg.version, success: false, error: "Publish failed after max OTP attempts" };
+  } finally {
+    restore();
+  }
+}
+async function publishPackagesWithOTP(options) {
+  const { packages, packageManager = "pnpm", dryRun, tag, access, ui, logger } = options;
+  const otpState = { otp: options.otp };
+  const versionMap = new Map(packages.map((p) => [p.name, p.version]));
+  const fastCtx = { packageManager, versionMap, otp: otpState.otp, dryRun, tag, access };
+  const seqCtx = { packageManager, versionMap, dryRun, tag, access };
+  const results = [];
+  const remaining = [];
+  const CONCURRENCY = Number(useEnv("KB_PUBLISH_CONCURRENCY") ?? 4);
+  let otpFailureDetected = false;
   ui.write?.(`  Publishing ${packages.length} package(s) in parallel (concurrency=${CONCURRENCY})...
 `);
   for (let i = 0; i < packages.length; i += CONCURRENCY) {
     const batch = packages.slice(i, i + CONCURRENCY);
-    const batchResults = await Promise.all(batch.map(fastPublishOne));
+    const outcomes = await Promise.all(batch.map((pkg) => fastPublishPkg(pkg, fastCtx, logger)));
     for (let j = 0; j < batch.length; j++) {
-      const res = batchResults[j];
-      if (res === null || res === void 0) {
+      const outcome = outcomes[j];
+      if (outcome.result === null) {
         remaining.push(batch[j]);
       } else {
-        results.push(res);
+        results.push(outcome.result);
+      }
+      if (outcome.otpFailed) {
+        otpFailureDetected = true;
       }
     }
     if (otpFailureDetected) {
@@ -534,68 +612,7 @@ async function publishPackagesWithOTP(options) {
 `);
   for (const pkg of remaining) {
     logger?.info("Publishing package (sequential)", { name: pkg.name, version: pkg.version });
-    const loader = useLoader(`Publishing ${pkg.name}@${pkg.version}...`);
-    loader.start();
-    const restore = rewriteWorkspaceDeps(pkg.path, versionMap, packageManager);
-    try {
-      let published = false;
-      let otpAttempts = 0;
-      const MAX_OTP_ATTEMPTS = 3;
-      while (!published && otpAttempts < MAX_OTP_ATTEMPTS) {
-        otpAttempts++;
-        try {
-          await publishSinglePackage({ packagePath: pkg.path, packageManager, otp, dryRun, tag, access });
-          published = true;
-          results.push({ name: pkg.name, version: pkg.version, success: true });
-          loader.succeed(dryRun ? `Dry-run: ${pkg.name}@${pkg.version}` : `Published ${pkg.name}@${pkg.version}`);
-        } catch (err) {
-          const msg = err instanceof Error ? err.message : String(err);
-          if (isAlreadyPublished2(msg)) {
-            published = true;
-            results.push({ name: pkg.name, version: pkg.version, success: true, alreadyPublished: true });
-            loader.succeed(`${pkg.name}@${pkg.version} already published`);
-            break;
-          }
-          if (msg.includes("EOTP") || msg.includes("one-time password")) {
-            if (otpAttempts < MAX_OTP_ATTEMPTS) {
-              loader.succeed(`\u{1F510} 2FA required for ${pkg.name}`);
-              const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-              try {
-                const entered = await rl.question("   Enter OTP code: ");
-                rl.close();
-                if (!entered || entered.trim().length !== 6) {
-                  ui.write?.("   \u26A0\uFE0F  Invalid OTP (must be 6 digits)\n");
-                  otp = void 0;
-                } else {
-                  otp = entered.trim();
-                }
-              } catch (e) {
-                rl.close();
-                throw e;
-              }
-              loader.update({ text: `Publishing ${pkg.name}@${pkg.version} with OTP...` });
-              loader.start();
-            } else {
-              loader.fail("Max OTP attempts reached");
-              results.push({ name: pkg.name, version: pkg.version, success: false, error: "Max OTP attempts reached" });
-              break;
-            }
-          } else if (isRetryable2(msg)) {
-            const delay = retryDelay2(MAX_RETRIES2 - 1);
-            loader.update({ text: `Rate limited \u2014 waiting ${(delay / 1e3).toFixed(0)}s\u2026` });
-            loader.start();
-            await new Promise((r) => setTimeout(r, delay));
-            otpAttempts--;
-          } else {
-            loader.fail(`Failed: ${msg.split("\n")[0]}`);
-            results.push({ name: pkg.name, version: pkg.version, success: false, error: msg });
-            break;
-          }
-        }
-      }
-    } finally {
-      restore();
-    }
+    results.push(await sequentialPublishPkg(pkg, seqCtx, otpState, ui));
   }
   return buildResult(results, packages, dryRun);
 }
@@ -617,6 +634,174 @@ var BUMP_SYMBOL = {
   patch: "\xB7",
   auto: "?"
 };
+function buildPlanRows(packages) {
+  return packages.map((pkg) => {
+    const bump = pkg.bump ?? "auto";
+    const sym = BUMP_SYMBOL[bump] ?? "?";
+    return `  ${sym}  ${pkg.name.padEnd(40)} ${pkg.currentVersion.padStart(8)}  \u2192  ${pkg.nextVersion}`;
+  });
+}
+function createPublisher(config, token, ctx) {
+  const packageManager = config.workspace?.type ?? config.publish?.packageManager ?? "pnpm";
+  return {
+    async publish(packages, opts) {
+      if (token) {
+        const r = await publishPackagesProgrammatic({
+          packages,
+          packageManager,
+          dryRun: opts.dryRun,
+          access: opts.access ?? "public",
+          registry: config.registry,
+          token
+        });
+        return { published: r.published, alreadyPublished: r.alreadyPublished, failed: r.failed, skipped: r.skipped, errors: r.errors };
+      }
+      return publishPackagesWithOTP({
+        packages,
+        packageManager,
+        dryRun: opts.dryRun,
+        access: opts.access ?? "public",
+        ui: ctx.ui,
+        logger: ctx.platform?.logger
+      });
+    }
+  };
+}
+function appendCheckDetails(c, checkItems) {
+  if (c.details?.packagePath) {
+    checkItems.push(`     package: ${c.details.packagePath}`);
+  }
+  if (c.details?.error) {
+    checkItems.push(`     reason:  ${c.details.error}`);
+  }
+  const output = (c.details?.stderr || c.details?.stdout || "").trim();
+  if (output) {
+    checkItems.push(`     output:`);
+    for (const line of output.split("\n").slice(0, 8)) {
+      checkItems.push(`       ${line}`);
+    }
+  }
+  const failedPkgs = (c.packages ?? []).filter((p) => !p.ok);
+  if (failedPkgs.length) {
+    checkItems.push(`     failed in ${failedPkgs.length}/${c.packages.length} package(s):`);
+    for (const pkg of failedPkgs.slice(0, 10)) {
+      checkItems.push(`       - ${pkg.path}${pkg.details?.error ? `: ${pkg.details.error}` : ""}`);
+    }
+  }
+}
+function buildCheckItems(checkEntries, symbols) {
+  const checkItems = [];
+  for (const c of checkEntries) {
+    const sym = c.ok ? symbols.success : c.hint === "optional" ? symbols.warning : symbols.error;
+    const timing = c.timingMs ? ` (${(c.timingMs / 1e3).toFixed(1)}s)` : "";
+    checkItems.push(`${sym} ${c.id}${timing}`);
+    if (!c.ok && c.hint !== "optional") {
+      appendCheckDetails(c, checkItems);
+    }
+  }
+  return checkItems;
+}
+function buildReleaseSections(report, dryRun, ctx) {
+  const sections = [];
+  if (!dryRun && report.result.published?.length) {
+    sections.push({
+      header: "Published",
+      items: report.result.published.map((p) => `${ctx.ui.symbols.success} ${p}`)
+    });
+  }
+  if (!dryRun && report.result.alreadyPublished?.length) {
+    sections.push({
+      header: "Already published (skipped)",
+      items: report.result.alreadyPublished.map((p) => `${ctx.ui.symbols.info} ${p}`)
+    });
+  }
+  if (dryRun && report.result.skipped?.length) {
+    sections.push({
+      header: "Would publish (dry-run)",
+      items: report.result.skipped.map((p) => `${ctx.ui.symbols.info} ${p.replace(" (dry-run)", "")}`)
+    });
+  }
+  if (report.result.checks) {
+    const checkEntries = Object.values(report.result.checks).filter(Boolean);
+    const passed = checkEntries.filter((c) => c.ok);
+    const failed = checkEntries.filter((c) => !c.ok && c.hint !== "optional");
+    const skipped = checkEntries.filter((c) => !c.ok && c.hint === "optional");
+    if (checkEntries.length > 0) {
+      sections.push({
+        header: `Checks \u2014 ${passed.length} passed, ${failed.length} failed${skipped.length ? `, ${skipped.length} skipped` : ""}`,
+        items: buildCheckItems(checkEntries, ctx.ui.symbols)
+      });
+    }
+  }
+  if (report.result.errors?.length && !report.result.checks) {
+    sections.push({
+      header: "Errors",
+      items: report.result.errors.map((e) => `${ctx.ui.symbols.error} ${e}`)
+    });
+  }
+  if (report.result.git) {
+    const g = report.result.git;
+    sections.push({
+      header: "Git",
+      items: [
+        `Committed: ${g.committed}`,
+        `Tags: ${g.tagged?.join(", ") || "none"}`,
+        `Pushed: ${g.pushed}`
+      ]
+    });
+  }
+  return sections;
+}
+function resolveChecks(flags, config) {
+  if (flags.flow) {
+    return config.flows?.[flags.flow]?.checks ?? config.checks ?? [];
+  }
+  if (flags.scope) {
+    return config.scopes?.[flags.scope]?.checks ?? config.checks ?? [];
+  }
+  return config.checks ?? [];
+}
+async function confirmRelease() {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  let answer;
+  try {
+    answer = await rl.question("\nProceed with release? [y/N] ");
+  } finally {
+    rl.close();
+  }
+  return answer.trim().toLowerCase() === "y";
+}
+function showPlanBox(ctx, flags, plan, config, dryRun) {
+  if (flags.json) {
+    return;
+  }
+  ctx.ui.sideBox({
+    title: dryRun ? "Release Plan (dry-run)" : "Release Plan",
+    sections: [
+      {
+        header: `${plan.packages.length} package(s) \xB7 strategy: ${config.versioningStrategy ?? "independent"}${flags.flow ? ` \xB7 flow: ${flags.flow}` : ""}`,
+        items: buildPlanRows(plan.packages)
+      }
+    ],
+    status: "info"
+  });
+  if (flags["no-verify"]) {
+    ctx.ui.write?.(`  \u26A0\uFE0F  --no-verify: git pre-push hooks will be skipped
+`);
+  }
+}
+function reportPipelineResult(ctx, flags, result, dryRun) {
+  if (flags.json) {
+    ctx.ui?.json?.(result.report);
+    return;
+  }
+  ctx.ui.sideBox({
+    title: "Release",
+    sections: buildReleaseSections(result.report, dryRun, ctx),
+    status: result.success ? "success" : "error",
+    timing: result.report.result.timingMs
+  });
+}
 var run_default = defineCommand({
   id: "release:run",
   description: "Execute release process (plan, check, publish)",
@@ -636,6 +821,37 @@ var run_default = defineCommand({
         ...flags.strict !== void 0 && { strict: flags.strict }
       };
       configLoader.succeed("Configuration loaded");
+      const token = useEnv("NPM_TOKEN") ?? useEnv("NODE_AUTH_TOKEN");
+      if (!dryRun) {
+        const preErrors = [];
+        const registry = config.registry ?? "https://registry.npmjs.org";
+        if (!token) {
+          preErrors.push("NPM_TOKEN or NODE_AUTH_TOKEN is not set");
+        } else {
+          try {
+            const res = await fetch(`${registry}/-/whoami`, {
+              headers: { Authorization: `Bearer ${token}` },
+              signal: AbortSignal.timeout(8e3)
+            });
+            if (!res.ok) {
+              preErrors.push(`npm token invalid or expired (HTTP ${res.status} from ${registry})`);
+            }
+          } catch (e) {
+            preErrors.push(`npm registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
+          }
+        }
+        if (flags.flow && config.flows && !(flags.flow in config.flows)) {
+          preErrors.push(`Flow "${flags.flow}" is not defined in release.flows config`);
+        }
+        if (preErrors.length > 0) {
+          ctx.ui.sideBox({
+            title: "Release \u2014 pre-flight failed",
+            sections: [{ items: preErrors.map((e) => `${ctx.ui.symbols.error} ${e}`) }],
+            status: "error"
+          });
+          return { exitCode: 1 };
+        }
+      }
       const scopeCwd = await resolveScopePath(repoRoot, flags.scope || "root");
       const planLoader = useLoader("Discovering packages...");
       planLoader.start();
@@ -655,36 +871,10 @@ var run_default = defineCommand({
         });
         return { exitCode: 0 };
       }
-      if (!flags.json) {
-        const rows = plan.packages.map((pkg) => {
-          const bump = pkg.bump ?? "auto";
-          const sym = BUMP_SYMBOL[bump] ?? "?";
-          return `  ${sym}  ${pkg.name.padEnd(40)} ${pkg.currentVersion.padStart(8)}  \u2192  ${pkg.nextVersion}`;
-        });
-        ctx.ui.sideBox({
-          title: dryRun ? "Release Plan (dry-run)" : "Release Plan",
-          sections: [
-            {
-              header: `${plan.packages.length} package(s) \xB7 strategy: ${config.versioningStrategy ?? "independent"}${flags.flow ? ` \xB7 flow: ${flags.flow}` : ""}`,
-              items: rows
-            }
-          ],
-          status: "info"
-        });
-        if (flags["no-verify"]) {
-          ctx.ui.write?.(`  \u26A0\uFE0F  --no-verify: git pre-push hooks will be skipped
-`);
-        }
-      }
+      showPlanBox(ctx, flags, plan, config, dryRun);
       if (!skipYes) {
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-        let answer;
-        try {
-          answer = await rl.question("\nProceed with release? [y/N] ");
-        } finally {
-          rl.close();
-        }
-        if (answer.trim().toLowerCase() !== "y") {
+        const confirmed = await confirmRelease();
+        if (!confirmed) {
           ctx.ui.sideBox({
             title: "Release",
             sections: [{ items: [`${ctx.ui.symbols.info} Cancelled`] }],
@@ -695,23 +885,7 @@ var run_default = defineCommand({
       }
       const llm = useLLM();
       const changelog = createChangelogGenerator(config, llm ?? void 0);
-      const token = useEnv("NPM_TOKEN") ?? useEnv("NODE_AUTH_TOKEN");
-      const packageManager = config.workspace?.type ?? config.publish?.packageManager ?? "pnpm";
-      const publisher = {
-        async publish(packages, opts) {
-          if (token) {
-            return publishPackagesProgrammatic({ packages, packageManager, dryRun: opts.dryRun });
-          }
-          return publishPackagesWithOTP({
-            packages,
-            packageManager,
-            dryRun: opts.dryRun,
-            access: opts.access ?? "public",
-            ui: ctx.ui,
-            logger: ctx.platform?.logger
-          });
-        }
-      };
+      const publisher = createPublisher(config, token, ctx);
       const pipelineLoader = useLoader("Running release pipeline...");
       pipelineLoader.start();
       const pipelineStart = Date.now();
@@ -727,7 +901,7 @@ var run_default = defineCommand({
         skipBuild: flags["skip-build"],
         skipVerify: flags["skip-verify"],
         noVerify: flags["no-verify"],
-        checks: (flags.flow ? config.flows?.[flags.flow]?.checks : void 0) ?? (flags.scope ? config.scopes?.[flags.scope]?.checks : void 0) ?? config.checks ?? [],
+        checks: resolveChecks(flags, config),
         publisher,
         changelog,
         logger: ctx.platform?.logger,
@@ -737,94 +911,7 @@ var run_default = defineCommand({
         }
       });
       pipelineLoader.succeed(result.success ? "Release completed" : "Release failed");
-      if (flags.json) {
-        ctx.ui?.json?.(result.report);
-      } else {
-        const report = result.report;
-        const sections = [];
-        if (!dryRun && report.result.published?.length) {
-          sections.push({
-            header: "Published",
-            items: report.result.published.map((p) => `${ctx.ui.symbols.success} ${p}`)
-          });
-        }
-        if (!dryRun && report.result.alreadyPublished?.length) {
-          sections.push({
-            header: "Already published (skipped)",
-            items: report.result.alreadyPublished.map((p) => `${ctx.ui.symbols.info} ${p}`)
-          });
-        }
-        if (dryRun && report.result.skipped?.length) {
-          sections.push({
-            header: "Would publish (dry-run)",
-            items: report.result.skipped.map((p) => `${ctx.ui.symbols.info} ${p.replace(" (dry-run)", "")}`)
-          });
-        }
-        if (report.result.checks) {
-          const checkEntries = Object.values(report.result.checks).filter(Boolean);
-          const passed = checkEntries.filter((c) => c.ok);
-          const failed = checkEntries.filter((c) => !c.ok && c.hint !== "optional");
-          const skipped = checkEntries.filter((c) => !c.ok && c.hint === "optional");
-          if (checkEntries.length > 0) {
-            const checkItems = [];
-            for (const c of checkEntries) {
-              const sym = c.ok ? ctx.ui.symbols.success : c.hint === "optional" ? ctx.ui.symbols.warning : ctx.ui.symbols.error;
-              const timing = c.timingMs ? ` (${(c.timingMs / 1e3).toFixed(1)}s)` : "";
-              checkItems.push(`${sym} ${c.id}${timing}`);
-              if (!c.ok && c.hint !== "optional") {
-                if (c.details?.packagePath) {
-                  checkItems.push(`     package: ${c.details.packagePath}`);
-                }
-                if (c.details?.error) {
-                  checkItems.push(`     reason:  ${c.details.error}`);
-                }
-                const output = (c.details?.stderr || c.details?.stdout || "").trim();
-                if (output) {
-                  const lines = output.split("\n").slice(0, 8);
-                  checkItems.push(`     output:`);
-                  for (const line of lines) {
-                    checkItems.push(`       ${line}`);
-                  }
-                }
-                if (c.packages?.filter((p) => !p.ok).length) {
-                  const failedPkgs = c.packages.filter((p) => !p.ok);
-                  checkItems.push(`     failed in ${failedPkgs.length}/${c.packages.length} package(s):`);
-                  for (const pkg of failedPkgs.slice(0, 10)) {
-                    checkItems.push(`       - ${pkg.path}${pkg.details?.error ? `: ${pkg.details.error}` : ""}`);
-                  }
-                }
-              }
-            }
-            sections.push({
-              header: `Checks \u2014 ${passed.length} passed, ${failed.length} failed${skipped.length ? `, ${skipped.length} skipped` : ""}`,
-              items: checkItems
-            });
-          }
-        }
-        if (report.result.errors?.length && !report.result.checks) {
-          sections.push({
-            header: "Errors",
-            items: report.result.errors.map((e) => `${ctx.ui.symbols.error} ${e}`)
-          });
-        }
-        if (report.result.git) {
-          const g = report.result.git;
-          sections.push({
-            header: "Git",
-            items: [
-              `Committed: ${g.committed}`,
-              `Tags: ${g.tagged?.join(", ") || "none"}`,
-              `Pushed: ${g.pushed}`
-            ]
-          });
-        }
-        ctx.ui.sideBox({
-          title: "Release",
-          sections,
-          status: result.success ? "success" : "error",
-          timing: report.result.timingMs
-        });
-      }
+      reportPipelineResult(ctx, flags, result, dryRun);
       return { exitCode: result.success ? 0 : 1, report: result.report };
     }
   }