fix: Guard against unresolved catalog:/workspace: protocols

[davedbase]

Before writing a fix I checked the actual scope and cause directly against the npm registry, rather than assuming this affects every package that uses the catalog:peer pattern (it doesn't — ~97 packages use that pattern in source, but most haven't been re-published since the catalog migration and were never at risk):

• Confirmed exactly two published versions are broken: event-listener@3.0.0-next.4 and pagination@1.0.0-next.7, both bumped in the same "Version Packages" commit — the most recent one on next. Nothing else has published since.
• Reproduced the exact same tooling locally (pnpm 11.9.0, pinned via packageManager, unchanged since that commit) — both pnpm pack and pnpm publish --dry-run correctly resolve catalog:peer → ^2.0.0-rc.0 today, from the exact same source files. This isn't a currently-reproducible bug in the repo's config.
• Ruled out the obvious CI suspect: a npm install -g npm@latest step (for npm OIDC trusted publishing) sitting right before the publish step. Confirmed via git history that this step didn't exist yet at the commit that produced the broken publish — it postdates the incident, so it can't be the cause.
• Conclusion: root cause isn't conclusively provable after the fact — this looks like a one-off CI/environment flake in that specific run. Rather than chase an unprovable cause further, the fix targets the failure mode itself: an unresolved protocol string reaching a published manifest, regardless of why.

Fix

1. scripts/verify-published-manifests.ts (new) — packs the entire workspace in one call (pnpm pack -r --json), reads every packed package/package.json (the manifest exactly as it would land on npm, not the source file), and fails with a precise package@version field.dep = "value" message if any dependency field still contains an unresolved catalog:/workspace: string.
2. Wired into pnpm run release / release-tagged (right after pnpm build, before changeset publish) — fails closed, so a bad manifest never reaches npm publish.
3. Also added to tests.yml so this is checked on every PR, not just at release time (this PR itself exercises it in CI).
4. Changeset republishes event-listener (next.4 → next.5) and pagination (next.7 → next.8) with peerDependencies correctly resolved. No functional changes in either package.

Testing

• Ran the script against the real current workspace (102 packages): passes clean, 0 unresolved protocol strings.
• Tested the detection logic in isolation against a synthetic manifest matching the exact broken shape from this issue — correctly flags it — and against a correctly-resolved manifest — no false positive.
• Could not force a live repro of the original failure (pnpm resolves correctly for me locally with matching tooling), so verification is necessarily "the guard is correct and fires on the known-bad shape," not "reproduced and fixed the exact original trigger."

Notes

• The npm OIDC step mentioned above is unrelated to this fix (confirmed to postdate the incident) — not touched here, and shouldn't be read as related if it comes up in review.
• Once merged, the changeset triggers the normal "Version Packages (next)" PR; merging that runs release-tagged.yml with the new guard in place. If resolution behaves as it does locally, it publishes cleanly; if not, the job fails before changeset publish ever runs, with an exact error instead of silently shipping broken again.

Closes #1052

Summary by CodeRabbit

• Bug Fixes

  • Republished @solid-primitives/event-listener and @solid-primitives/pagination with corrected dependency metadata.
  • Fixed installation failures in npm and Yarn caused by unresolved workspace protocol references.
  • No functional behavior changes are included in these releases.

• Chores

  • Added automated checks to prevent unresolved dependency protocols from being included in future published packages.

[changeset-bot]

🦋 Changeset detected

Latest commit: a47cf15

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
@solid-primitives/event-listener	Patch
@solid-primitives/pagination	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[netlify]

✅ Deploy Preview for solid-primitives-v2 ready!

Name	Link
🔨 Latest commit	a47cf15
🔍 Latest deploy log	https://app.netlify.com/projects/solid-primitives-v2/deploys/6a9c211a3476cc000839945b
😎 Deploy Preview	https://deploy-preview-1053--solid-primitives-v2.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: d3d34491-d2f6-4d3a-a212-c47aabcb5c16

📥 Commits

Reviewing files that changed from the base of the PR and between 3447428 and a47cf15.

📒 Files selected for processing (4)

• .changeset/fix-catalog-protocol-republish.md
• .github/workflows/tests.yml
• package.json
• scripts/verify-published-manifests.ts

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The changes add a script that checks packed package manifests for unresolved catalog: and workspace: dependency ranges. CI and release scripts run the check after building. A changeset declares patch republish releases for two affected packages.

Changes

Published manifest verification

Layer / File(s)	Summary
Packed manifest checker scripts/verify-published-manifests.ts	The new script packs all packages, extracts each packed package.json, scans dependency fields for unresolved protocols, reports failures, and cleans up temporary files.
CI and release enforcement package.json, .github/workflows/tests.yml, .changeset/fix-catalog-protocol-republish.md	The verification command runs after builds in CI and release scripts. The changeset declares patch republish releases for @solid-primitives/event-listener and @solid-primitives/pagination.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to a47cf

This adds packed-manifest validation before release publishing and in CI, while republishing the affected packages with resolved dependency ranges. No merge-blocking risk is identified.

Sequence Diagram(s)

sequenceDiagram
  participant CI_or_release
  participant verify_manifests
  participant pnpm_pack
  participant tar
  CI_or_release->>verify_manifests: Run verification after build
  verify_manifests->>pnpm_pack: Pack all packages
  pnpm_pack-->>verify_manifests: Return packed archives
  verify_manifests->>tar: Extract package/package.json
  tar-->>verify_manifests: Return packed manifest
  verify_manifests->>verify_manifests: Scan dependency fields
  verify_manifests-->>CI_or_release: Pass or exit with failure

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: preventing unresolved catalog: and workspace: protocols in published manifests.
Linked Issues check	✅ Passed	The pull request addresses issue #1052 by republishing the affected packages with resolved peer dependency ranges and adding validation for packed manifests before publication and in CI. The guard als…
Out of Scope Changes check	✅ Passed	All changes support the stated objective. The changeset, manifest verification script, release-script updates, and CI step are directly related to preventing unresolved dependency protocols and republ…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}