feat(pm): resolve workspace:/catalog: protocols in packed manifests

[elrrrrrrr]

Summary

Closes #3094.

ut pm-pack / utoo publish emitted tarballs whose package.json kept the literal workspace:* and catalog: specifiers. Any downstream npm install of such a tarball fails immediately with EUNSUPPORTEDPROTOCOL, which forced monorepos migrating to utoo (e.g. eggjs/egg#5959) to keep pnpm around just for the pack step.

This rewrites both protocols at pack/publish time the way pnpm/bun do:

spec	result (member version 1.2.3)
workspace:* / workspace:	1.2.3
workspace:~	~1.2.3
workspace:^	^1.2.3
workspace:^1.2.0	^1.2.0 (prefix stripped)
workspace:./path	1.2.3
catalog: / catalog:<name>	version pinned in the catalog

Design

• New resolve_workspace_spec in crates/ruborist/src/spec/mod.rs, symmetric to the existing resolve_catalog_spec.
• New crates/pm/src/service/publish_manifest.rs orchestrates the rewrite:
  • No-op (returns None) when the manifest has neither protocol, so standalone packages are packed byte-for-byte.
  • Resolves against the discovered workspace root — pm-pack runs inside a member dir, so workspace: versions come from sibling members and catalog: from the root .utoo.toml (migrated from pnpm-workspace.yaml), not the cwd.
  • Unresolvable specifiers bail with an actionable message rather than shipping a broken tarball.
• pm_pack::pack substitutes the rewritten manifest into the tarball entry (append_override); the on-disk package.json is never mutated (pnpm parity).
• publish now builds the payload from pack_result.manifest, so registry metadata and tarball contents can't drift.

Test plan

• Unit: resolve_workspace_spec (all forms), rewrite_dep_specs across all four dependency kinds, unresolvable workspace/catalog errors, protocol detection. — pm publish_manifest (5) + ruborist spec pass.
• Existing pm_pack (11) and full utoo-pm (248) suites green; cargo fmt --check + cargo clippy --all-targets -D warnings clean.
• Manual E2E: a 2-member workspace with workspace:^/workspace:* + catalog: → tarball package.json rewritten to concrete ranges, unknown fields (repository/keywords) preserved, source manifest unchanged.

Follow-ups (out of scope)

• workspace:<name>@<range> aliasing (npm: rewrite) — rare; not handled yet.
• ut pm-pack -r / --pack-destination are tracked separately (ut pm-pack: support recursive / workspace-wide pack (-r, --filter) #3095 / ut pm-pack: add --pack-destination <dir> to control output location #3096).

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces a new publish_manifest service to normalize package manifests by rewriting workspace: and catalog: dependency protocols to concrete semver ranges during packing and publishing. Feedback focuses on improving error handling by propagating I/O and configuration loading errors instead of silently ignoring them, and refactoring the protocol detection to utilize the existing Protocol abstraction rather than relying on raw string prefix checks.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

Silently ignoring config loading errors with unwrap_or_default() can hide syntax or permission errors in .utoo.toml. We should check if the file exists using try_exists and propagate any other I/O or parsing errors.

async fn load_catalogs(root: &Path) -> Result<Catalogs> {
    let path = root.join(".utoo.toml");
    if path.try_exists()? {
        let config = Config::load_from_path(&path)
            .await
            .context("failed to load .utoo.toml")?;
        Ok(config.catalogs())
    } else {
        Ok(Catalogs::new())
    }
}

References

1. Propagate I/O errors (e.g., from try_exists) using ? rather than silently ignoring them with unwrap_or(false), to ensure permission or other critical errors fail early and clearly.

[gemini-code-assist]

Import Protocol from utoo_ruborist::spec to use the established codebase abstraction instead of raw string prefix checks.

Suggested change

	use utoo_ruborist::manifest::PackageJson;
	use utoo_ruborist::spec::{Catalogs, resolve_catalog_spec, resolve_workspace_spec};
	use utoo_ruborist::manifest::PackageJson;
	use utoo_ruborist::spec::{Catalogs, Protocol, resolve_catalog_spec, resolve_workspace_spec};

[gemini-code-assist]

Use the established Protocol abstraction to check for workspace and catalog dependencies instead of raw string prefix checks.

Suggested change

	let needs_workspace = has_spec_with_prefix(pkg, WORKSPACE_PREFIX);
	let needs_catalog = has_spec_with_prefix(pkg, CATALOG_PREFIX);
	if !needs_workspace && !needs_catalog {
	return Ok(None);
	}
	let needs_workspace = has_protocol(pkg, Protocol::Workspace);
	let needs_catalog = has_protocol(pkg, Protocol::Catalog);
	if !needs_workspace && !needs_catalog {
	return Ok(None);
	}

References

1. Prefer using established codebase abstractions (such as Protocol parsing) over raw string prefix checks (like starts_with) for classifying URLs to maintain consistency across the codebase.

[gemini-code-assist]

Refactor has_spec_with_prefix to has_protocol using the established Protocol abstraction to avoid raw string prefix checks.

fn has_protocol(pkg: &PackageJson, target_proto: Protocol) -> bool {
    [
        &pkg.dependencies,
        &pkg.dev_dependencies,
        &pkg.peer_dependencies,
        &pkg.optional_dependencies,
    ]
    .into_iter()
    .flatten()
    .flat_map(|m| m.values())
    .any(|spec| {
        Protocol::strip_prefix(spec)
            .map(|(proto, _)| proto == target_proto)
            .unwrap_or(false)
    })
}

References

1. Prefer using established codebase abstractions (such as Protocol parsing) over raw string prefix checks (like starts_with) for classifying URLs to maintain consistency across the codebase.

[killagu]

LGTM