@simplysm/sd-cli 13.0.99 → 14.0.1

package/dist/commands/publish.js

@@ -6,6 +6,7 @@ import { fsx } from "@simplysm/core-node";
 import { env, json } from "@simplysm/core-common";
 import "@simplysm/core-common";
 import { loadSdConfig } from "../utils/sd-config.js";
+import { validateTargets } from "../utils/package-utils.js";
 import { execa } from "execa";
 import { runBuild } from "./build.js";
 import { parseWorkspaceGlobs } from "../utils/replace-deps.js";
@@ -14,544 +15,670 @@ import fs from "fs";
 import ssh2 from "ssh2";
 import { password as passwordPrompt } from "@inquirer/prompts";
 const { Client: SshClient, utils } = ssh2;
+//#endregion
+//#region Utilities
+/**
+ * Replace environment variables (%VAR% format)
+ * @throws throws an error if any variable substitution is empty
+ */
 function replaceEnvVariables(str, version, projectPath) {
-  const result = str.replace(/%([^%]+)%/g, (match, envName) => {
-    if (envName === "VER") {
-      return version;
-    }
-    if (envName === "PROJECT") {
-      return projectPath;
-    }
-    return env[envName] ?? match;
-  });
-  if (/%[^%]+%/.test(result)) {
-    throw new Error(`Environment variable substitution failed: ${str} \u2192 ${result}`);
-  }
-  return result;
+    const result = str.replace(/%([^%]+)%/g, (match, envName) => {
+        if (envName === "VER") {
+            return version;
+        }
+        if (envName === "PROJECT") {
+            return projectPath;
+        }
+        return env[envName] ?? match;
+    });
+    // Throw error if any unsubstituted environment variables remain
+    if (/%[^%]+%/.test(result)) {
+        throw new Error(`Environment variable substitution failed: ${str} → ${result}`);
+    }
+    return result;
 }
+/**
+ * Wait with countdown
+ */
 async function waitWithCountdown(message, seconds) {
-  for (let i = seconds; i > 0; i--) {
-    if (i !== seconds && process.stdout.isTTY) {
-      process.stdout.cursorTo(0);
-    }
-    process.stdout.write(`${message} ${i}`);
-    await new Promise((resolve) => setTimeout(resolve, 1e3));
-  }
-  if (process.stdout.isTTY) {
-    process.stdout.cursorTo(0);
-    process.stdout.clearLine(0);
-  } else {
-    process.stdout.write("\n");
-  }
+    for (let i = seconds; i > 0; i--) {
+        if (i !== seconds && process.stdout.isTTY) {
+            process.stdout.cursorTo(0);
+        }
+        process.stdout.write(`${message} ${i}`);
+        await new Promise((resolve) => setTimeout(resolve, 1000));
+    }
+    if (process.stdout.isTTY) {
+        process.stdout.cursorTo(0);
+        process.stdout.clearLine(0);
+    }
+    else {
+        process.stdout.write("\n");
+    }
 }
+/**
+ * Pre-verify and configure SSH key authentication
+ *
+ * For SFTP servers without pass:
+ * 1. Generate SSH key file if it doesn't exist
+ * 2. Test key authentication, and if it fails, register public key using password
+ */
 async function ensureSshAuth(publishPackages, logger) {
-  const sshTargets = /* @__PURE__ */ new Map();
-  for (const pkg of publishPackages) {
-    if (pkg.config.type === "npm") continue;
-    if (pkg.config.type !== "sftp") continue;
-    if (pkg.config.password != null) continue;
-    if (pkg.config.user == null) {
-      throw new Error(`[${pkg.name}] SFTP config missing user.`);
-    }
-    const key = `${pkg.config.user}@${pkg.config.host}`;
-    sshTargets.set(key, {
-      host: pkg.config.host,
-      port: pkg.config.port,
-      user: pkg.config.user
-    });
-  }
-  if (sshTargets.size === 0) return;
-  const sshDir = path.join(os.homedir(), ".ssh");
-  const keyPath = path.join(sshDir, "id_ed25519");
-  const pubKeyPath = path.join(sshDir, "id_ed25519.pub");
-  if (!fs.existsSync(keyPath)) {
-    logger.info("SSH key not found. Creating one...");
-    if (!fs.existsSync(sshDir)) {
-      fs.mkdirSync(sshDir, { mode: 448 });
-    }
-    const keyPair = utils.generateKeyPairSync("ed25519");
-    fs.writeFileSync(keyPath, keyPair.private, { mode: 384 });
-    fs.writeFileSync(pubKeyPath, keyPair.public + "\n", { mode: 420 });
-    logger.info(`SSH key created: ${keyPath}`);
-  }
-  const privateKeyData = fs.readFileSync(keyPath);
-  const publicKey = fs.readFileSync(pubKeyPath, "utf-8").trim();
-  const parsed = utils.parseKey(privateKeyData);
-  const isKeyEncrypted = parsed instanceof Error;
-  const sshAgent = process.env["SSH_AUTH_SOCK"];
-  for (const [label, target] of sshTargets) {
-    const canAuth = await testSshKeyAuth(target, {
-      privateKey: isKeyEncrypted ? void 0 : privateKeyData,
-      agent: sshAgent
-    });
-    if (canAuth) {
-      logger.debug(`SSH key authentication verified: ${label}`);
-      continue;
+    // Collect SFTP servers without pass (deduplicate user@host)
+    const sshTargets = new Map();
+    for (const pkg of publishPackages) {
+        if (pkg.config.type === "npm")
+            continue;
+        if (pkg.config.type !== "sftp")
+            continue;
+        if (pkg.config.password != null)
+            continue;
+        if (pkg.config.user == null) {
+            throw new Error(`[${pkg.name}] SFTP config missing user.`);
+        }
+        const key = `${pkg.config.user}@${pkg.config.host}`;
+        sshTargets.set(key, {
+            host: pkg.config.host,
+            port: pkg.config.port,
+            user: pkg.config.user,
+        });
+    }
+    if (sshTargets.size === 0)
+        return;
+    // Check/create SSH key file
+    const sshDir = path.join(os.homedir(), ".ssh");
+    const keyPath = path.join(sshDir, "id_ed25519");
+    const pubKeyPath = path.join(sshDir, "id_ed25519.pub");
+    if (!fs.existsSync(keyPath)) {
+        logger.info("SSH key not found. Creating one...");
+        if (!fs.existsSync(sshDir)) {
+            fs.mkdirSync(sshDir, { mode: 0o700 });
+        }
+        const keyPair = utils.generateKeyPairSync("ed25519");
+        fs.writeFileSync(keyPath, keyPair.private, { mode: 0o600 });
+        fs.writeFileSync(pubKeyPath, keyPair.public + "\n", { mode: 0o644 });
+        logger.info(`SSH key created: ${keyPath}`);
+    }
+    const privateKeyData = fs.readFileSync(keyPath);
+    const publicKey = fs.readFileSync(pubKeyPath, "utf-8").trim();
+    // Check if privateKey is encrypted
+    const parsed = utils.parseKey(privateKeyData);
+    const isKeyEncrypted = parsed instanceof Error;
+    const sshAgent = process.env["SSH_AUTH_SOCK"];
+    // Verify key authentication for each server
+    for (const [label, target] of sshTargets) {
+        const canAuth = await testSshKeyAuth(target, {
+            privateKey: isKeyEncrypted ? undefined : privateKeyData,
+            agent: sshAgent,
+        });
+        if (canAuth) {
+            logger.debug(`SSH key authentication verified: ${label}`);
+            continue;
+        }
+        // Key authentication failed → register public key using password
+        logger.info(`${label}: SSH key not registered on server.`);
+        const pass = await passwordPrompt({
+            message: `${label} password (to register public key):`,
+        });
+        await registerSshPublicKey(target, pass, publicKey);
+        logger.info(`SSH public key registered: ${label}`);
     }
-    logger.info(`${label}: SSH key not registered on server.`);
-    const pass = await passwordPrompt({
-      message: `${label} password (to register public key):`
-    });
-    await registerSshPublicKey(target, pass, publicKey);
-    logger.info(`SSH public key registered: ${label}`);
-  }
 }
+/**
+ * Test SSH key authentication (connect and immediately disconnect)
+ */
 function testSshKeyAuth(target, auth) {
-  if (auth.privateKey == null && auth.agent == null) {
-    return Promise.resolve(false);
-  }
-  return new Promise((resolve) => {
-    const conn = new SshClient();
-    conn.on("ready", () => {
-      conn.end();
-      resolve(true);
-    });
-    conn.on("error", () => {
-      resolve(false);
-    });
-    conn.connect({
-      host: target.host,
-      port: target.port ?? 22,
-      username: target.user,
-      ...auth.privateKey != null ? { privateKey: auth.privateKey } : {},
-      ...auth.agent != null ? { agent: auth.agent } : {},
-      readyTimeout: 1e4
+    if (auth.privateKey == null && auth.agent == null) {
+        return Promise.resolve(false);
+    }
+    return new Promise((resolve) => {
+        const conn = new SshClient();
+        conn.on("ready", () => {
+            conn.end();
+            resolve(true);
+        });
+        conn.on("error", () => {
+            resolve(false);
+        });
+        conn.connect({
+            host: target.host,
+            port: target.port ?? 22,
+            username: target.user,
+            ...(auth.privateKey != null ? { privateKey: auth.privateKey } : {}),
+            ...(auth.agent != null ? { agent: auth.agent } : {}),
+            readyTimeout: 10_000,
+        });
     });
-  });
 }
+/**
+ * Connect to server with password and register SSH public key
+ */
 function registerSshPublicKey(target, pass, publicKey) {
-  return new Promise((resolve, reject) => {
-    const conn = new SshClient();
-    conn.on("ready", () => {
-      const escapedKey = publicKey.replace(/'/g, "'\\''");
-      const cmd = [
-        "mkdir -p ~/.ssh",
-        "chmod 700 ~/.ssh",
-        `echo '${escapedKey}' >> ~/.ssh/authorized_keys`,
-        "chmod 600 ~/.ssh/authorized_keys"
-      ].join(" && ");
-      conn.exec(cmd, (err, stream) => {
-        if (err) {
-          conn.end();
-          reject(new Error(`Failed to execute SSH command: ${err.message}`));
-          return;
-        }
-        let stderr = "";
-        stream.on("data", () => {
+    return new Promise((resolve, reject) => {
+        const conn = new SshClient();
+        conn.on("ready", () => {
+            // Add public key to authorized_keys
+            const escapedKey = publicKey.replace(/'/g, "'\\''");
+            const cmd = [
+                "mkdir -p ~/.ssh",
+                "chmod 700 ~/.ssh",
+                `echo '${escapedKey}' >> ~/.ssh/authorized_keys`,
+                "chmod 600 ~/.ssh/authorized_keys",
+            ].join(" && ");
+            conn.exec(cmd, (err, stream) => {
+                if (err) {
+                    conn.end();
+                    reject(new Error(`Failed to execute SSH command: ${err.message}`));
+                    return;
+                }
+                let stderr = "";
+                stream.on("data", () => { }); // Consume stdout (unconsumed stream won't close)
+                stream.stderr.on("data", (data) => {
+                    stderr += data.toString();
+                });
+                stream.on("exit", (code) => {
+                    conn.end();
+                    if (code !== 0) {
+                        reject(new Error(`Failed to register SSH public key (exit code: ${code}): ${stderr}`));
+                    }
+                    else {
+                        resolve();
+                    }
+                });
+            });
         });
-        stream.stderr.on("data", (data) => {
-          stderr += data.toString();
+        conn.on("error", (err) => {
+            reject(new Error(`SSH connection failed (${target.host}): ${err.message}`));
         });
-        stream.on("exit", (code) => {
-          conn.end();
-          if (code !== 0) {
-            reject(new Error(`Failed to register SSH public key (exit code: ${code}): ${stderr}`));
-          } else {
-            resolve();
-          }
+        conn.connect({
+            host: target.host,
+            port: target.port ?? 22,
+            username: target.user,
+            password: pass,
+            readyTimeout: 10_000,
         });
-      });
-    });
-    conn.on("error", (err) => {
-      reject(new Error(`SSH connection failed (${target.host}): ${err.message}`));
     });
-    conn.connect({
-      host: target.host,
-      port: target.port ?? 22,
-      username: target.user,
-      password: pass,
-      readyTimeout: 1e4
-    });
-  });
 }
+//#endregion
+//#region Version Upgrade
+/**
+ * Upgrade project and package versions
+ * @param dryRun if true, only calculate new version without modifying files
+ */
 async function upgradeVersion(cwd, allPkgPaths, dryRun) {
-  const changedFiles = [];
-  const projPkgPath = path.resolve(cwd, "package.json");
-  const projPkg = await fsx.readJson(projPkgPath);
-  const currentVersion = projPkg.version;
-  const prereleaseInfo = semver.prerelease(currentVersion);
-  const newVersion = prereleaseInfo !== null ? semver.inc(currentVersion, "prerelease") : semver.inc(currentVersion, "patch");
-  if (dryRun) {
-    return { version: newVersion, changedFiles: [] };
-  }
-  projPkg.version = newVersion;
-  await fsx.write(projPkgPath, json.stringify(projPkg, { space: 2 }) + "\n");
-  changedFiles.push(projPkgPath);
-  for (const pkgPath of allPkgPaths) {
-    const pkgJsonPath = path.resolve(pkgPath, "package.json");
-    const pkgJson = await fsx.readJson(pkgJsonPath);
-    pkgJson.version = newVersion;
-    await fsx.write(pkgJsonPath, json.stringify(pkgJson, { space: 2 }) + "\n");
-    changedFiles.push(pkgJsonPath);
-  }
-  const templateFiles = await fsx.glob(path.resolve(cwd, "packages/sd-cli/templates/**/*.hbs"));
-  const versionRegex = /("@simplysm\/[^"]+"\s*:\s*)"~[^"]+"/g;
-  for (const templatePath of templateFiles) {
-    const content = await fsx.read(templatePath);
-    const newContent = content.replace(versionRegex, `$1"~${newVersion}"`);
-    if (content !== newContent) {
-      await fsx.write(templatePath, newContent);
-      changedFiles.push(templatePath);
-    }
-  }
-  return { version: newVersion, changedFiles };
+    const changedFiles = [];
+    const projPkgPath = path.resolve(cwd, "package.json");
+    const projPkg = await fsx.readJson(projPkgPath);
+    const currentVersion = projPkg.version;
+    const prereleaseInfo = semver.prerelease(currentVersion);
+    // Determine increment strategy based on prerelease status
+    const newVersion = prereleaseInfo !== null
+        ? semver.inc(currentVersion, "prerelease")
+        : semver.inc(currentVersion, "patch");
+    if (dryRun) {
+        // dry-run: return new version without modifying files
+        return { version: newVersion, changedFiles: [] };
+    }
+    projPkg.version = newVersion;
+    await fsx.write(projPkgPath, json.stringify(projPkg, { space: 2 }) + "\n");
+    changedFiles.push(projPkgPath);
+    // Set version in each package's package.json
+    for (const pkgPath of allPkgPaths) {
+        const pkgJsonPath = path.resolve(pkgPath, "package.json");
+        const pkgJson = await fsx.readJson(pkgJsonPath);
+        pkgJson.version = newVersion;
+        await fsx.write(pkgJsonPath, json.stringify(pkgJson, { space: 2 }) + "\n");
+        changedFiles.push(pkgJsonPath);
+    }
+    // Synchronize @simplysm package version in template files
+    const templateFiles = await fsx.glob(path.resolve(cwd, "packages/sd-cli/templates/**/*.hbs"));
+    const versionRegex = /("@simplysm\/[^"]+"\s*:\s*)"~[^"]+"/g;
+    for (const templatePath of templateFiles) {
+        const content = await fsx.read(templatePath);
+        const newContent = content.replace(versionRegex, `$1"~${newVersion}"`);
+        if (content !== newContent) {
+            await fsx.write(templatePath, newContent);
+            changedFiles.push(templatePath);
+        }
+    }
+    return { version: newVersion, changedFiles };
 }
+//#endregion
+//#region Package Publishing
+/**
+ * Publish individual package
+ * @param dryRun if true, simulate deployment without actually publishing
+ */
 async function publishPackage(pkgPath, publishConfig, version, projectPath, logger, dryRun) {
-  const pkgName = path.basename(pkgPath);
-  if (publishConfig.type === "npm") {
-    const prereleaseInfo = semver.prerelease(version);
-    const args = ["publish", "--access", "public", "--no-git-checks"];
-    if (prereleaseInfo !== null && typeof prereleaseInfo[0] === "string") {
-      args.push("--tag", prereleaseInfo[0]);
+    const pkgName = path.basename(pkgPath);
+    if (publishConfig.type === "npm") {
+        // npm publish
+        const prereleaseInfo = semver.prerelease(version);
+        const args = ["publish", "--access", "public", "--no-git-checks"];
+        if (prereleaseInfo !== null && typeof prereleaseInfo[0] === "string") {
+            args.push("--tag", prereleaseInfo[0]);
+        }
+        if (dryRun) {
+            args.push("--dry-run");
+            logger.info(`[DRY-RUN] [${pkgName}] pnpm ${args.join(" ")}`);
+        }
+        else {
+            logger.debug(`[${pkgName}] pnpm ${args.join(" ")}`);
+        }
+        await execa("pnpm", args, { cwd: pkgPath });
+    }
+    else if (publishConfig.type === "local-directory") {
+        // Copy to local directory
+        const targetPath = replaceEnvVariables(publishConfig.path, version, projectPath);
+        const distPath = path.resolve(pkgPath, "dist");
+        if (dryRun) {
+            logger.info(`[DRY-RUN] [${pkgName}] copy to local: ${distPath} → ${targetPath}`);
+        }
+        else {
+            logger.debug(`[${pkgName}] copy to local: ${distPath} → ${targetPath}`);
+            await fsx.copy(distPath, targetPath);
+        }
+    }
+    else {
+        // Upload to storage
+        const distPath = path.resolve(pkgPath, "dist");
+        const remotePath = publishConfig.path ?? "/";
+        if (dryRun) {
+            logger.info(`[DRY-RUN] [${pkgName}] ${publishConfig.type} upload: ${distPath} → ${remotePath}`);
+        }
+        else {
+            logger.debug(`[${pkgName}] ${publishConfig.type} upload: ${distPath} → ${remotePath}`);
+            await StorageFactory.connect(publishConfig.type, {
+                host: publishConfig.host,
+                port: publishConfig.port,
+                user: publishConfig.user,
+                password: publishConfig.password,
+            }, async (storage) => {
+                await storage.uploadDir(distPath, remotePath);
+            });
+        }
     }
-    if (dryRun) {
-      args.push("--dry-run");
-      logger.info(`[DRY-RUN] [${pkgName}] pnpm ${args.join(" ")}`);
-    } else {
-      logger.debug(`[${pkgName}] pnpm ${args.join(" ")}`);
-    }
-    await execa("pnpm", args, { cwd: pkgPath });
-  } else if (publishConfig.type === "local-directory") {
-    const targetPath = replaceEnvVariables(publishConfig.path, version, projectPath);
-    const distPath = path.resolve(pkgPath, "dist");
-    if (dryRun) {
-      logger.info(`[DRY-RUN] [${pkgName}] copy to local: ${distPath} \u2192 ${targetPath}`);
-    } else {
-      logger.debug(`[${pkgName}] copy to local: ${distPath} \u2192 ${targetPath}`);
-      await fsx.copy(distPath, targetPath);
-    }
-  } else {
-    const distPath = path.resolve(pkgPath, "dist");
-    const remotePath = publishConfig.path ?? "/";
-    if (dryRun) {
-      logger.info(
-        `[DRY-RUN] [${pkgName}] ${publishConfig.type} upload: ${distPath} \u2192 ${remotePath}`
-      );
-    } else {
-      logger.debug(`[${pkgName}] ${publishConfig.type} upload: ${distPath} \u2192 ${remotePath}`);
-      await StorageFactory.connect(
-        publishConfig.type,
-        {
-          host: publishConfig.host,
-          port: publishConfig.port,
-          user: publishConfig.user,
-          password: publishConfig.password
-        },
-        async (storage) => {
-          await storage.uploadDir(distPath, remotePath);
-        }
-      );
-    }
-  }
 }
+//#endregion
+//#region Dependency Levels
+/**
+ * Calculate dependency levels for packages to publish.
+ * Packages with no dependencies → Level 0, depends only on Level 0 → Level 1, ...
+ */
 async function computePublishLevels(publishPkgs) {
-  const pkgNames = new Set(publishPkgs.map((p) => p.name));
-  const depsMap = /* @__PURE__ */ new Map();
-  for (const pkg of publishPkgs) {
-    const pkgJson = await fsx.readJson(path.resolve(pkg.path, "package.json"));
-    const allDeps = {
-      ...pkgJson.dependencies,
-      ...pkgJson.peerDependencies,
-      ...pkgJson.optionalDependencies
-    };
-    const workspaceDeps = /* @__PURE__ */ new Set();
-    for (const depName of Object.keys(allDeps)) {
-      const shortName = depName.replace(/^@simplysm\//, "");
-      if (shortName !== depName && pkgNames.has(shortName)) {
-        workspaceDeps.add(shortName);
-      }
-    }
-    depsMap.set(pkg.name, workspaceDeps);
-  }
-  const levels = [];
-  const assigned = /* @__PURE__ */ new Set();
-  const remaining = new Map(publishPkgs.map((p) => [p.name, p]));
-  while (remaining.size > 0) {
-    const level = [];
-    for (const [name, pkg] of remaining) {
-      const deps = depsMap.get(name);
-      if ([...deps].every((d) => assigned.has(d))) {
-        level.push(pkg);
-      }
-    }
-    if (level.length === 0) {
-      levels.push([...remaining.values()]);
-      break;
-    }
-    for (const pkg of level) {
-      assigned.add(pkg.name);
-      remaining.delete(pkg.name);
-    }
-    levels.push(level);
-  }
-  return levels;
+    const pkgNames = new Set(publishPkgs.map((p) => p.name));
+    // Collect workspace dependencies for each package
+    const depsMap = new Map();
+    for (const pkg of publishPkgs) {
+        const pkgJson = await fsx.readJson(path.resolve(pkg.path, "package.json"));
+        const allDeps = {
+            ...pkgJson.dependencies,
+            ...pkgJson.peerDependencies,
+            ...pkgJson.optionalDependencies,
+        };
+        const workspaceDeps = new Set();
+        for (const depName of Object.keys(allDeps)) {
+            const shortName = depName.replace(/^@simplysm\//, "");
+            if (shortName !== depName && pkgNames.has(shortName)) {
+                workspaceDeps.add(shortName);
+            }
+        }
+        depsMap.set(pkg.name, workspaceDeps);
+    }
+    // Topological sort to classify into levels
+    const levels = [];
+    const assigned = new Set();
+    const remaining = new Map(publishPkgs.map((p) => [p.name, p]));
+    while (remaining.size > 0) {
+        const level = [];
+        for (const [name, pkg] of remaining) {
+            const deps = depsMap.get(name);
+            if ([...deps].every((d) => assigned.has(d))) {
+                level.push(pkg);
+            }
+        }
+        if (level.length === 0) {
+            // Circular dependency — place all remaining packages in final level
+            levels.push([...remaining.values()]);
+            break;
+        }
+        for (const pkg of level) {
+            assigned.add(pkg.name);
+            remaining.delete(pkg.name);
+        }
+        levels.push(level);
+    }
+    return levels;
 }
-async function runPublish(options) {
-  const { targets, noBuild, dryRun } = options;
-  const cwd = process.cwd();
-  const logger = consola.withTag("sd:cli:publish");
-  if (dryRun) {
-    logger.info("[DRY-RUN] Simulation mode - no actual deployment");
-  }
-  logger.debug("publish start", { targets, noBuild, dryRun });
-  let sdConfig;
-  try {
-    sdConfig = await loadSdConfig({ cwd, dev: false, options: options.options });
-    logger.debug("sd.config.ts loaded");
-  } catch (err) {
-    logger.error(`Failed to load sd.config.ts: ${err instanceof Error ? err.message : err}`);
-    process.exitCode = 1;
-    return;
-  }
-  const projPkgPath = path.resolve(cwd, "package.json");
-  const projPkg = await fsx.readJson(projPkgPath);
-  const workspaceYamlPath = path.resolve(cwd, "pnpm-workspace.yaml");
-  const workspaceGlobs = [];
-  if (await fsx.exists(workspaceYamlPath)) {
-    const yamlContent = await fsx.read(workspaceYamlPath);
-    workspaceGlobs.push(...parseWorkspaceGlobs(yamlContent));
-  }
-  const allPkgPaths = (await Promise.all(workspaceGlobs.map((item) => fsx.glob(path.resolve(cwd, item))))).flat().filter((item) => !path.basename(item).includes("."));
-  const publishPackages = [];
-  for (const [name, config] of Object.entries(sdConfig.packages)) {
-    if (config == null) continue;
-    const pkgConfig = config;
-    if (pkgConfig.publish == null) continue;
-    if (targets.length > 0 && !targets.includes(name)) continue;
-    const pkgPath = allPkgPaths.find((p) => path.basename(p) === name);
-    if (pkgPath == null) {
-      logger.warn(`Package not found: ${name}`);
-      continue;
-    }
-    publishPackages.push({
-      name,
-      path: pkgPath,
-      config: pkgConfig.publish
-    });
-  }
-  if (publishPackages.length === 0) {
-    process.stdout.write("\u2714 No packages to deploy.\n");
-    return;
-  }
-  logger.debug(
-    "Target packages to deploy",
-    publishPackages.map((p) => p.name)
-  );
-  const hasGit = await fsx.exists(path.resolve(cwd, ".git"));
-  if (publishPackages.some((p) => p.config.type === "npm")) {
-    logger.debug("Verifying npm authentication...");
-    try {
-      const { stdout: whoami } = await execa("npm", ["whoami"]);
-      if (whoami.trim() === "") {
-        throw new Error("npm login information not found.");
-      }
-      logger.debug(`npm login verified: ${whoami.trim()}`);
-    } catch (err) {
-      logger.error(`npm whoami failed:`, err);
-      process.exitCode = 1;
-      return;
-    }
-  }
-  try {
-    await ensureSshAuth(publishPackages, logger);
-  } catch (err) {
-    logger.error(`Failed to setup SSH authentication: ${err instanceof Error ? err.message : err}`);
-    process.exitCode = 1;
-    return;
-  }
-  if (!noBuild && hasGit) {
-    logger.debug("Checking git commit status...");
-    try {
-      const { stdout: diff } = await execa("git", ["diff", "--name-only"]);
-      const { stdout: stagedDiff } = await execa("git", ["diff", "--cached", "--name-only"]);
-      if (diff.trim() !== "" || stagedDiff.trim() !== "") {
-        logger.info("Uncommitted changes detected. Attempting auto-commit with claude...");
-        try {
-          await execa("claude", [
-            "-p",
-            "/sd-commit all",
-            "--dangerously-skip-permissions",
-            "--model",
-            "haiku"
-          ], { stdio: "inherit" });
-        } catch (e) {
-          throw new Error(
-            "Auto-commit failed. Please commit manually and try again.\n" + (e instanceof Error ? e.message : String(e))
-          );
-        }
-        const { stdout: recheckDiff } = await execa("git", ["diff", "--name-only"]);
-        const { stdout: recheckStaged } = await execa("git", ["diff", "--cached", "--name-only"]);
-        if (recheckDiff.trim() !== "" || recheckStaged.trim() !== "") {
-          throw new Error(
-            "Uncommitted changes still remain after auto-commit.\n" + recheckDiff + recheckStaged
-          );
-        }
-        logger.info("Auto-commit completed.");
-      }
-    } catch (err) {
-      logger.error(err instanceof Error ? err.message : err);
-      process.exitCode = 1;
-      return;
-    }
-  }
-  let version = projPkg.version;
-  if (noBuild) {
-    logger.warn("Deploying without building is quite dangerous.");
-    await waitWithCountdown("Press 'CTRL+C' to stop the process.", 5);
-  } else {
-    logger.debug("Upgrading version...");
-    const upgradeResult = await upgradeVersion(cwd, allPkgPaths, dryRun);
-    version = upgradeResult.version;
-    const _changedFiles = upgradeResult.changedFiles;
+//#endregion
+//#region Main
+/**
+ * Execute publish command.
+ *
+ * **Deployment order (safety first):**
+ * 1. Pre-validation (npm auth, Git status)
+ * 2. Version upgrade (package.json + templates)
+ * 3. Build
+ * 4. Git commit/tag/push (explicitly stage only changed files)
+ * 5. pnpm deployment
+ * 6. postPublish (continue even if it fails)
+ */
+export async function runPublish(options) {
+    const { targets, noBuild, dryRun } = options;
+    const cwd = process.cwd();
+    const logger = consola.withTag("sd:cli:publish");
     if (dryRun) {
-      logger.info(`[DRY-RUN] Version upgrade: ${projPkg.version} \u2192 ${version} (files not modified)`);
-    } else {
-      logger.info(`Version upgrade: ${projPkg.version} \u2192 ${version}`);
+        logger.info("[DRY-RUN] Simulation mode - no actual deployment");
     }
-    if (dryRun) {
-      logger.info("[DRY-RUN] Starting build (validation only)...");
-    } else {
-      logger.debug("Starting build...");
+    logger.debug("publish start", { targets, noBuild, dryRun });
+    // Load sd.config.ts
+    let sdConfig;
+    try {
+        sdConfig = await loadSdConfig({ cwd, dev: false, options: options.options });
+        logger.debug("sd.config.ts loaded");
+    }
+    catch (err) {
+        logger.error(`Failed to load sd.config.ts: ${err instanceof Error ? err.message : err}`);
+        process.exitCode = 1;
+        return;
+    }
+    // Validate targets
+    validateTargets(targets, sdConfig.packages);
+    // Load package.json
+    const projPkgPath = path.resolve(cwd, "package.json");
+    const projPkg = await fsx.readJson(projPkgPath);
+    // Collect workspace package paths from pnpm-workspace.yaml
+    const workspaceYamlPath = path.resolve(cwd, "pnpm-workspace.yaml");
+    const workspaceGlobs = [];
+    if (await fsx.exists(workspaceYamlPath)) {
+        const yamlContent = await fsx.read(workspaceYamlPath);
+        workspaceGlobs.push(...parseWorkspaceGlobs(yamlContent));
+    }
+    const allPkgPaths = (await Promise.all(workspaceGlobs.map((item) => fsx.glob(path.resolve(cwd, item)))))
+        .flat()
+        .filter((item) => !path.basename(item).includes("."));
+    // Filter packages with publish configuration
+    const publishPackages = [];
+    for (const [name, config] of Object.entries(sdConfig.packages)) {
+        if (config == null)
+            continue;
+        const pkgConfig = config;
+        if (pkgConfig.publish == null)
+            continue;
+        // If targets is specified, include only those packages
+        if (targets.length > 0 && !targets.includes(name))
+            continue;
+        const pkgPath = allPkgPaths.find((p) => path.basename(p) === name);
+        if (pkgPath == null) {
+            logger.warn(`Package not found: ${name}`);
+            continue;
+        }
+        publishPackages.push({
+            name,
+            path: pkgPath,
+            config: pkgConfig.publish,
+        });
     }
+    if (publishPackages.length === 0) {
+        process.stdout.write("✔ No packages to deploy.\n");
+        return;
+    }
+    logger.debug("Target packages to deploy", publishPackages.map((p) => p.name));
+    // Check if Git is available
+    const hasGit = await fsx.exists(path.resolve(cwd, ".git"));
+    //#region Phase 1: Pre-validation
+    // Verify npm authentication (if npm publish config exists)
+    if (publishPackages.some((p) => p.config.type === "npm")) {
+        logger.debug("Verifying npm authentication...");
+        try {
+            const { stdout: whoami } = await execa("npm", ["whoami"]);
+            if (whoami.trim() === "") {
+                throw new Error("npm login information not found.");
+            }
+            logger.debug(`npm login verified: ${whoami.trim()}`);
+        }
+        catch (err) {
+            logger.error(`npm whoami failed:`, err);
+            /*logger.error(
+              "npm token is invalid or expired.\n" +
+                "Create a Granular Access Token at https://www.npmjs.com/settings/~/tokens, then:\n" +
+                "  npm config set //registry.npmjs.org/:_authToken <token>",
+            );*/
+            process.exitCode = 1;
+            return;
+        }
+    }
+    // Verify SSH key authentication (if SFTP publish config without pass exists)
     try {
-      await runBuild({
-        targets: publishPackages.map((p) => p.name),
-        options: options.options
-      });
-      if (process.exitCode === 1) {
-        throw new Error("Build failed");
-      }
-    } catch {
-      if (dryRun) {
-        logger.error("[DRY-RUN] Build failed");
-      } else {
-        logger.error(
-          "Build failed. Manual recovery may be necessary:\n  To revert version changes:\n    git checkout -- package.json packages/*/package.json packages/sd-cli/templates/"
-        );
-      }
-      process.exitCode = 1;
-      return;
-    }
-    if (hasGit) {
-      if (dryRun) {
-        logger.info("[DRY-RUN] Simulating Git commit/tag/push...");
-        logger.info(`[DRY-RUN] git add (${_changedFiles.length} files)`);
-        logger.info(`[DRY-RUN] git commit -m "v${version}"`);
-        logger.info(`[DRY-RUN] git tag -a v${version} -m "v${version}"`);
-        logger.info("[DRY-RUN] git push --dry-run");
-        await execa("git", ["push", "--dry-run"]);
-        logger.info("[DRY-RUN] git push --tags --dry-run");
-        await execa("git", ["push", "--tags", "--dry-run"]);
-        logger.info("[DRY-RUN] Git operations simulation completed");
-      } else {
-        logger.debug("Git commit/tag/push...");
+        await ensureSshAuth(publishPackages, logger);
+    }
+    catch (err) {
+        logger.error(`Failed to setup SSH authentication: ${err instanceof Error ? err.message : err}`);
+        process.exitCode = 1;
+        return;
+    }
+    // Check for uncommitted changes and attempt auto-commit (unless noBuild is set)
+    if (!noBuild && hasGit) {
+        logger.debug("Checking git commit status...");
         try {
-          await execa("git", ["add", ..._changedFiles]);
-          await execa("git", ["commit", "-m", `v${version}`]);
-          await execa("git", ["tag", "-a", `v${version}`, "-m", `v${version}`]);
-          await execa("git", ["push"]);
-          await execa("git", ["push", "--tags"]);
-          logger.debug("Git operations completed");
-        } catch (err) {
-          logger.error(
-            `Git operations failed: ${err instanceof Error ? err.message : err}
-Manual recovery may be necessary:
-  git revert HEAD  # Revert version commit
-  git tag -d v${version}  # Delete tag`
-          );
-          process.exitCode = 1;
-          return;
-        }
-      }
-    }
-  }
-  const levels = await computePublishLevels(publishPackages);
-  const publishedPackages = [];
-  let publishFailed = false;
-  for (let levelIdx = 0; levelIdx < levels.length; levelIdx++) {
-    if (publishFailed) break;
-    const levelPkgs = levels[levelIdx];
-    logger.start(`Level ${levelIdx + 1}/${levels.length}`);
-    const publishPromises = levelPkgs.map(async (pkg) => {
-      const maxRetries = 3;
-      for (let attempt = 1; attempt <= maxRetries; attempt++) {
+            const { stdout: diff } = await execa("git", ["diff", "--name-only"]);
+            const { stdout: stagedDiff } = await execa("git", ["diff", "--cached", "--name-only"]);
+            if (diff.trim() !== "" || stagedDiff.trim() !== "") {
+                logger.info("Uncommitted changes detected. Attempting auto-commit with claude...");
+                try {
+                    await execa("claude", [
+                        "-p",
+                        "/sd-commit all",
+                        "--dangerously-skip-permissions",
+                        "--model",
+                        "haiku",
+                    ], { stdio: "inherit" });
+                }
+                catch (e) {
+                    throw new Error("Auto-commit failed. Please commit manually and try again.\n" +
+                        (e instanceof Error ? e.message : String(e)));
+                }
+                // Re-verify after commit
+                const { stdout: recheckDiff } = await execa("git", ["diff", "--name-only"]);
+                const { stdout: recheckStaged } = await execa("git", ["diff", "--cached", "--name-only"]);
+                if (recheckDiff.trim() !== "" || recheckStaged.trim() !== "") {
+                    throw new Error("Uncommitted changes still remain after auto-commit.\n" + recheckDiff + recheckStaged);
+                }
+                logger.info("Auto-commit completed.");
+            }
+        }
+        catch (err) {
+            logger.error(err instanceof Error ? err.message : err);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    //#endregion
+    //#region Phase 2 & 3: Build or noBuild warning
+    let version = projPkg.version;
+    if (noBuild) {
+        // noBuild warning
+        logger.warn("Deploying without building is quite dangerous.");
+        await waitWithCountdown("Press 'CTRL+C' to stop the process.", 5);
+    }
+    else {
+        // Version upgrade
+        logger.debug("Upgrading version...");
+        const upgradeResult = await upgradeVersion(cwd, allPkgPaths, dryRun);
+        version = upgradeResult.version;
+        const _changedFiles = upgradeResult.changedFiles;
+        if (dryRun) {
+            logger.info(`[DRY-RUN] Version upgrade: ${projPkg.version} → ${version} (files not modified)`);
+        }
+        else {
+            logger.info(`Version upgrade: ${projPkg.version} → ${version}`);
+        }
+        // Run build
+        if (dryRun) {
+            logger.info("[DRY-RUN] Starting build (validation only)...");
+        }
+        else {
+            logger.debug("Starting build...");
+        }
         try {
-          await publishPackage(pkg.path, pkg.config, version, cwd, logger, dryRun);
-          logger.debug(dryRun ? `[DRY-RUN] ${pkg.name}` : pkg.name);
-          publishedPackages.push(pkg.name);
-          return { status: "success", name: pkg.name };
-        } catch (err) {
-          if (attempt < maxRetries) {
-            const delay = attempt * 5e3;
-            logger.debug(
-              dryRun ? `[DRY-RUN] ${pkg.name} (retry ${attempt + 1}/${maxRetries})` : `${pkg.name} (retry ${attempt + 1}/${maxRetries})`
-            );
-            await new Promise((resolve) => setTimeout(resolve, delay));
-          } else {
-            throw err;
-          }
-        }
-      }
-      return { status: "error", name: pkg.name, error: new Error("Unknown error") };
-    });
-    const results = await Promise.allSettled(publishPromises);
-    const rejectedResults = results.filter(
-      (r) => r.status === "rejected"
-    );
-    if (rejectedResults.length > 0) {
-      publishFailed = true;
-      for (const r of rejectedResults) {
-        logger.error(r.reason instanceof Error ? r.reason.message : r.reason);
-      }
-      logger.fail(`Level ${levelIdx + 1}/${levels.length}`);
-    } else {
-      logger.success(`Level ${levelIdx + 1}/${levels.length}`);
-    }
-  }
-  const allPkgNames = publishPackages.map((p) => p.name);
-  const failedPkgNames = allPkgNames.filter((n) => !publishedPackages.includes(n));
-  if (failedPkgNames.length > 0) {
-    if (publishedPackages.length > 0) {
-      logger.error(
-        "Error during deployment.\nAlready deployed packages:\n" + publishedPackages.map((n) => `  - ${n}`).join("\n") + "\n\nManual recovery may be necessary.\nnpm packages can be deleted within 72 hours with `npm unpublish <pkg>@<version>`."
-      );
-    }
-    for (const name of failedPkgNames) {
-      logger.error(`[${name}] Deployment failed`);
-    }
-    process.exitCode = 1;
-    return;
-  }
-  if (sdConfig.postPublish != null && sdConfig.postPublish.length > 0) {
-    if (dryRun) {
-      logger.info("[DRY-RUN] Simulating postPublish scripts...");
-    } else {
-      logger.debug("Running postPublish scripts...");
-    }
-    for (const script of sdConfig.postPublish) {
-      try {
-        const cmd = replaceEnvVariables(script.cmd, version, cwd);
-        const args = script.args.map((arg) => replaceEnvVariables(arg, version, cwd));
+            await runBuild({
+                targets: publishPackages.map((p) => p.name),
+                options: options.options,
+            });
+            // Check build failure
+            if (process.exitCode === 1) {
+                throw new Error("Build failed");
+            }
+        }
+        catch {
+            if (dryRun) {
+                logger.error("[DRY-RUN] Build failed");
+            }
+            else {
+                logger.error("Build failed. Manual recovery may be necessary:\n" +
+                    "  To revert version changes:\n" +
+                    "    git checkout -- package.json packages/*/package.json packages/sd-cli/templates/");
+            }
+            process.exitCode = 1;
+            return;
+        }
+        //#region Phase 3: Git commit/tag/push
+        if (hasGit) {
+            if (dryRun) {
+                logger.info("[DRY-RUN] Simulating Git commit/tag/push...");
+                logger.info(`[DRY-RUN] git add (${_changedFiles.length} files)`);
+                logger.info(`[DRY-RUN] git commit -m "v${version}"`);
+                logger.info(`[DRY-RUN] git tag -a v${version} -m "v${version}"`);
+                logger.info("[DRY-RUN] git push --dry-run");
+                await execa("git", ["push", "--dry-run"]);
+                logger.info("[DRY-RUN] git push --tags --dry-run");
+                await execa("git", ["push", "--tags", "--dry-run"]);
+                logger.info("[DRY-RUN] Git operations simulation completed");
+            }
+            else {
+                logger.debug("Git commit/tag/push...");
+                try {
+                    await execa("git", ["add", ..._changedFiles]);
+                    await execa("git", ["commit", "-m", `v${version}`]);
+                    await execa("git", ["tag", "-a", `v${version}`, "-m", `v${version}`]);
+                    await execa("git", ["push"]);
+                    await execa("git", ["push", "--tags"]);
+                    logger.debug("Git operations completed");
+                }
+                catch (err) {
+                    logger.error(`Git operations failed: ${err instanceof Error ? err.message : err}\n` +
+                        "Manual recovery may be necessary:\n" +
+                        `  git revert HEAD  # Revert version commit\n` +
+                        `  git tag -d v${version}  # Delete tag`);
+                    process.exitCode = 1;
+                    return;
+                }
+            }
+        }
+        //#endregion
+    }
+    //#endregion
+    //#region Phase 4: Deployment (sequential by dependency level, parallel within level)
+    const levels = await computePublishLevels(publishPackages);
+    const publishedPackages = [];
+    let publishFailed = false;
+    // Sequential execution per level
+    for (let levelIdx = 0; levelIdx < levels.length; levelIdx++) {
+        if (publishFailed)
+            break;
+        const levelPkgs = levels[levelIdx];
+        logger.start(`Level ${levelIdx + 1}/${levels.length}`);
+        // Parallel execution within level (Promise.allSettled)
+        const publishPromises = levelPkgs.map(async (pkg) => {
+            const maxRetries = 3;
+            for (let attempt = 1; attempt <= maxRetries; attempt++) {
+                try {
+                    await publishPackage(pkg.path, pkg.config, version, cwd, logger, dryRun);
+                    logger.debug(dryRun ? `[DRY-RUN] ${pkg.name}` : pkg.name);
+                    publishedPackages.push(pkg.name);
+                    return { status: "success", name: pkg.name };
+                }
+                catch (err) {
+                    if (attempt < maxRetries) {
+                        const delay = attempt * 5_000;
+                        logger.debug(dryRun
+                            ? `[DRY-RUN] ${pkg.name} (retry ${attempt + 1}/${maxRetries})`
+                            : `${pkg.name} (retry ${attempt + 1}/${maxRetries})`);
+                        await new Promise((resolve) => setTimeout(resolve, delay));
+                    }
+                    else {
+                        throw err;
+                    }
+                }
+            }
+            // Fallback for TypeScript type checker (actually unreachable)
+            return { status: "error", name: pkg.name, error: new Error("Unknown error") };
+        });
+        const results = await Promise.allSettled(publishPromises);
+        // Check for failures within level
+        const rejectedResults = results.filter((r) => r.status === "rejected");
+        if (rejectedResults.length > 0) {
+            publishFailed = true;
+            for (const r of rejectedResults) {
+                logger.error(r.reason instanceof Error ? r.reason.message : r.reason);
+            }
+            logger.fail(`Level ${levelIdx + 1}/${levels.length}`);
+        }
+        else {
+            logger.success(`Level ${levelIdx + 1}/${levels.length}`);
+        }
+    }
+    // Check failed packages
+    const allPkgNames = publishPackages.map((p) => p.name);
+    const failedPkgNames = allPkgNames.filter((n) => !publishedPackages.includes(n));
+    if (failedPkgNames.length > 0) {
+        if (publishedPackages.length > 0) {
+            logger.error("Error during deployment.\n" +
+                "Already deployed packages:\n" +
+                publishedPackages.map((n) => `  - ${n}`).join("\n") +
+                "\n\nManual recovery may be necessary.\n" +
+                "npm packages can be deleted within 72 hours with `npm unpublish <pkg>@<version>`.");
+        }
+        for (const name of failedPkgNames) {
+            logger.error(`[${name}] Deployment failed`);
+        }
+        process.exitCode = 1;
+        return;
+    }
+    //#endregion
+    //#region Phase 5: postPublish
+    if (sdConfig.postPublish != null && sdConfig.postPublish.length > 0) {
         if (dryRun) {
-          logger.info(`[DRY-RUN] Will execute: ${cmd} ${args.join(" ")}`);
-        } else {
-          logger.debug(`Executing: ${cmd} ${args.join(" ")}`);
-          await execa(cmd, args, { cwd });
-        }
-      } catch (err) {
-        logger.warn(
-          `postPublish script failed (continuing): ${err instanceof Error ? err.message : err}`
-        );
-      }
-    }
-  }
-  if (dryRun) {
-    logger.info(`[DRY-RUN] Simulation completed. Actual deployment version: v${version}`);
-  } else {
-    logger.info(`All deployments completed. (v${version})`);
-  }
+            logger.info("[DRY-RUN] Simulating postPublish scripts...");
+        }
+        else {
+            logger.debug("Running postPublish scripts...");
+        }
+        for (const script of sdConfig.postPublish) {
+            try {
+                const cmd = replaceEnvVariables(script.cmd, version, cwd);
+                const args = script.args.map((arg) => replaceEnvVariables(arg, version, cwd));
+                if (dryRun) {
+                    logger.info(`[DRY-RUN] Will execute: ${cmd} ${args.join(" ")}`);
+                }
+                else {
+                    logger.debug(`Executing: ${cmd} ${args.join(" ")}`);
+                    await execa(cmd, args, { cwd });
+                }
+            }
+            catch (err) {
+                // On postPublish failure, only warn (no deployment rollback possible)
+                logger.warn(`postPublish script failed (continuing): ${err instanceof Error ? err.message : err}`);
+            }
+        }
+    }
+    //#endregion
+    if (dryRun) {
+        logger.info(`[DRY-RUN] Simulation completed. Actual deployment version: v${version}`);
+    }
+    else {
+        logger.info(`All deployments completed. (v${version})`);
+    }
 }
-export {
-  runPublish
-};
-//# sourceMappingURL=publish.js.map
+//#endregion
+//# sourceMappingURL=publish.js.map