Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/pnpm-registry-release-to-npm.yml:
- Around line 10-11: The workflow currently always passes "--tag latest" when
publishing, which will publish prerelease versions
(workflow_dispatch.inputs.version) to the latest dist-tag; change the publish
step to compute the tag instead of hard-coding "--tag latest": detect if the
provided version string contains a prerelease identifier (a hyphen / semver
prerelease like "-rc", "-alpha", "-beta") and if so use a non-latest tag (e.g.,
"next" or a provided inputs.tag), otherwise use "latest"; update the publish
command to use the computed tag variable instead of the literal "--tag latest"
so prereleases do not overwrite latest.
- Around line 194-203: Add a preflight guard before the publish loop that
verifies every target package can be published (e.g., using pnpm publish
--dry-run or an existence check like npm view <pkg>@<version>) and aborts the
job if any check fails; modify the script that currently iterates with for
package in registry/npm/pnpm-registry* and runs pnpm publish "$package/" --tag
latest --access public --provenance --no-git-checks so it first collects all
$package paths, performs the dry-run/exists check for each, and only proceeds to
the real pnpm publish loop if all checks pass.
- Around line 180-183: The "Unzip" step using
montudor/action-zip@0852c26906e00f8a315c704958823928d8018b28 fails to expand
*.zip because with.args is executed without a shell; change the Unzip step’s
with.args to invoke a shell that iterates over each ZIP and runs unzip on each
archive (or refactor to run unzip once per archive via a loop/matrix), ensuring
each archive is extracted separately; also while editing this workflow, avoid
publishing prereleases with the latest tag (do not use --tag latest for
prereleases) and make the publish loop idempotent so reruns don’t fail for
already-published package@version pairs.

In `@registry/npm/pnpm-registry/bin/pnpm-registry`:
- Around line 31-35: The child process result from spawnSync can have
result.status === null when terminated by a signal; instead of assigning
process.exitCode directly, detect the signaled exit (result.status === null &&
result.signal) and propagate it explicitly (e.g., re-emit the same signal for
the current process using process.kill(process.pid, result.signal) or otherwise
exit with a non-zero code), otherwise set process.exitCode = result.status as
before; keep the existing error throw for result.error. Use the existing result
variable and the properties result.status and result.signal to locate and
implement this logic where process.exitCode is currently assigned.

---

Nitpick comments:
In `@registry/npm/pnpm-registry/scripts/generate-packages.mjs`:
- Around line 19-20: Add a guard that validates rootManifest.version (read from
MANIFEST_PATH via JSON.parse) immediately after parsing rootManifest and before
any package manifest generation; if rootManifest.version is missing or falsy,
throw an Error or exit with a clear message so the script fails fast. Apply the
same check/guard before the code blocks that build package versions (the
sections around the previously noted ranges 36-46 and 78-79) so no
invalid/undefined versions get written into generated manifests.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/pnpr-release-to-npm.yml:
- Around line 139-147: The job-level permissions block currently only sets
id-token: write which prevents actions/checkout in the publish job from getting
the default contents: read scope; update the publish job's permissions to
include contents: read alongside id-token: write (i.e., add the contents: read
permission in the same permissions mapping) so that the actions/checkout step
(uses: actions/checkout..., with: persist-credentials: false) can operate
correctly with the GITHUB_TOKEN.

In `@registry/npm/pnpr/scripts/generate-packages.mjs`:
- Around line 82-83: The manifest is being written minified; change the write to
produce pretty-printed JSON by serializing manifestData with indentation (use
JSON.stringify(manifestData, null, 2)) and write that plus a trailing newline to
manifestPath when calling fs.writeFileSync in generate-packages.mjs so the
output matches the other manifest formatting (consistent with the earlier
JSON.stringify(manifest, null, 2) usage).

---

Duplicate comments:
In `@registry/npm/pnpr/bin/pnpr`:
- Around line 31-35: The code assigns result.status directly to process.exitCode
even when result.status === null (child terminated by signal), which masks the
failure; update the logic around result (from spawnSync) to detect result.status
=== null and instead set process.exitCode to a non-zero value (e.g., 1) or
derive a conventional code from the terminating signal by checking result.signal
(preferably set process.exitCode = 128 + signalNumber if you map signal names to
numbers), and ensure process.exitCode is only assigned the numeric status when
result.status is a non-null number; reference the variables result.status,
result.signal and the assignment to process.exitCode to locate the change.