fix(create): align package manager versions and pnpm workspace config

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_approve_builds_migrate_pnpm11/snapshots/create_approve_builds_migrate_pnpm11.md

@@ -17,6 +17,8 @@ template ships Prettier, so create installs+migrates before the main install; th
 approval recorded under allowBuilds despite the migration pre-install
 
 ```
+packages:
+  - .
 allowBuilds:
   core-js: true
 catalog:
@@ -62,6 +64,8 @@ peerDependencyRules:
     - vite
   allowedVersions:
     vite: "*"
+packages:
+  - .
 ```
 
 ## `cd default-app && vp pm approve-builds core-js`
@@ -77,6 +81,8 @@ node_modules/.pnpm/core-js@3.39.0/node_modules/core-js: Running postinstall scri
 core-js is now allowed under allowBuilds
 
 ```
+packages:
+  - .
 allowBuilds:
   core-js: true
 catalog:

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_approve_builds_pnpm11/snapshots/create_approve_builds_pnpm11.md

@@ -16,6 +16,8 @@
 approval recorded under allowBuilds
 
 ```
+packages:
+  - .
 allowBuilds:
   core-js: true
 catalog:
@@ -48,6 +50,8 @@ default run surfaces the gated build with guidance, leaving it unapproved
 no allowBuilds, the build was not run
 
 ```
+packages:
+  - .
 allowBuilds:
   core-js: set this to true or false
 catalog:
@@ -75,6 +79,8 @@ node_modules/.pnpm/core-js@3.39.0/node_modules/core-js: Running postinstall scri
 core-js is now allowed under allowBuilds
 
 ```
+packages:
+  - .
 allowBuilds:
   core-js: true
 catalog:

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_next_command_library/snapshots.toml

@@ -3,4 +3,5 @@ name = "create_next_command_library"
 vp = "global"
 steps = [
   { argv = ["vp", "create", "vite:library", "--no-interactive"], comment = "verify next command suggests vp run", timeout = 120000, continue-on-failure = true },
+  { argv = ["vpt", "print-file", "vite-plus-library/pnpm-workspace.yaml"], comment = "standalone library workspace includes the root package", continue-on-failure = true },
 ]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_next_command_library/snapshots/create_next_command_library.md

@@ -10,3 +10,22 @@ verify next command suggests vp run
 • Node <version>  pnpm <version>
 → Next: cd vite-plus-library && vp run
 ```
+
+## `vpt print-file vite-plus-library/pnpm-workspace.yaml`
+
+standalone library workspace includes the root package
+
+```
+catalog:
+  vite: npm:@voidzero-dev/vite-plus-core@<version>
+  vite-plus: <version>
+overrides:
+  vite@*: "catalog:"
+peerDependencyRules:
+  allowAny:
+    - vite
+  allowedVersions:
+    vite: "*"
+packages:
+  - .
+```

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/.node-version

@@ -0,0 +1 @@
+22.23.4

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/capture-create.mjs

@@ -0,0 +1,21 @@
+import { spawnSync } from 'node:child_process';
+import { writeFileSync } from 'node:fs';
+import { stripVTControlCharacters } from 'node:util';
+
+const args = ['create', ...process.argv.slice(2)];
+// Windows needs cmd to launch the local CLI's .cmd shim. All arguments are fixture literals.
+const result =
+  process.platform === 'win32'
+    ? spawnSync('cmd.exe', ['/d', '/s', '/c', `vp ${args.join(' ')}`], { encoding: 'utf8' })
+    : spawnSync('vp', args, { encoding: 'utf8' });
+const output = stripVTControlCharacters(`${result.stdout ?? ''}${result.stderr ?? ''}`);
+process.stdout.write(output);
+
+// Keep the summary's exact package-manager version visible despite banner version redaction.
+const summary = output.match(/• Node \S+\s+(\S+) (\S+)/);
+writeFileSync(
+  'create-summary.json',
+  JSON.stringify({ packageManager: summary?.[1] ?? null, version: summary?.[2] ?? null }, null, 2) + '\n',
+);
+if (result.error) throw result.error;
+process.exitCode = result.status ?? 1;

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/mock-manifest.json

@@ -0,0 +1,27 @@
+{
+  "@override/create": {
+    "name": "@override/create",
+    "dist-tags": {
+      "latest": "1.0.0"
+    },
+    "versions": {
+      "1.0.0": {
+        "name": "@override/create",
+        "version": "1.0.0",
+        "createConfig": {
+          "templates": [
+            {
+              "name": "demo",
+              "description": "Package manager override fixture",
+              "template": "./template"
+            }
+          ]
+        },
+        "dist": {
+          "tarball": "{REGISTRY}/@override/create/-/create-1.0.0.tgz",
+          "integrity": "sha512-BtnLAbJfxjm1whROR0IFq3HsDYEvBsV9IUGLvVHGmzZ63TYs6By4DehJouH2jN1q0H9dIJPBkiLds1DGmzxTqg=="
+        }
+      }
+    }
+  }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/pack.mjs

@@ -0,0 +1,54 @@
+// Run with node to regenerate this fixture's local template tarball and metadata.
+import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+
+import { createTarball } from '../../registry/archive.mjs';
+
+const root = import.meta.dirname;
+const pkg = {
+  name: '@override/create',
+  version: '1.0.0',
+  createConfig: {
+    templates: [
+      { name: 'demo', description: 'Package manager override fixture', template: './template' },
+    ],
+  },
+};
+const tarball = createTarball([
+  { name: 'package/package.json', contents: Buffer.from(JSON.stringify(pkg)), mode: 0o644 },
+  {
+    name: 'package/template/package.json',
+    contents: readFileSync(path.join(root, 'template/package.json')),
+    mode: 0o644,
+  },
+  {
+    name: 'package/template/record-install.cjs',
+    contents: readFileSync(path.join(root, 'record-install.cjs')),
+    mode: 0o644,
+  },
+]);
+mkdirSync(path.join(root, 'tarballs'), { recursive: true });
+writeFileSync(path.join(root, 'tarballs/create-1.0.0.tgz'), tarball);
+writeFileSync(
+  path.join(root, 'mock-manifest.json'),
+  JSON.stringify(
+    {
+      [pkg.name]: {
+        name: pkg.name,
+        'dist-tags': { latest: pkg.version },
+        versions: {
+          [pkg.version]: {
+            ...pkg,
+            dist: {
+              tarball: '{REGISTRY}/@override/create/-/create-1.0.0.tgz',
+              integrity: `sha512-${createHash('sha512').update(tarball).digest('base64')}`,
+            },
+          },
+        },
+      },
+    },
+    null,
+    2,
+  ) + '\n',
+);

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "create-override-parent",
+  "private": true,
+  "devEngines": {
+    "packageManager": { "name": "pnpm", "version": "12.11.2", "onFail": "download" }
+  },
+  "scripts": { "postinstall": "node record-install.cjs" }
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/record-install.cjs

@@ -0,0 +1,6 @@
+const [packageManager, version] = process.env.npm_config_user_agent.split(' ')[0].split('/');
+
+require('node:fs').writeFileSync(
+  'installed-with.json',
+  JSON.stringify({ packageManager, version }, null, 2) + '\n',
+);

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/snapshots.toml

@@ -0,0 +1,47 @@
+[[case]]
+name = "create_package_manager_override_version"
+vp = ["global", "local"]
+local-registry = true
+unset-env = ["VP_SKIP_INSTALL", "CI"]
+env = { VP_PACKAGE_MANAGER = "pnpm@10.6.1" }
+steps = [
+  { argv = ["node", "capture-create.mjs", "@override:demo", "--directory", "demo", "--package-manager", "pnpm", "--no-interactive", "--no-agent", "--no-editor", "--no-hooks"], timeout = 180000 },
+  { argv = ["vpt", "print-file", "create-summary.json"], comment = "the exact package-manager version reported in the summary" },
+  { argv = ["vpt", "print-file", "demo/package.json"], comment = "pnpm 10.6.1 reads settings from package.json" },
+  { argv = ["node", "-p", "require('./demo/package.json').devEngines.packageManager.version"], comment = "record the exact pin separately from manifest version redaction" },
+  { argv = ["vpt", "print-file", "demo/installed-with.json"], comment = "package manager recorded by the install lifecycle script" },
+  { argv = ["vpt", "print-file", "demo/pnpm-workspace.yaml"] },
+  { argv = ["vpt", "stat-file", "demo/pnpm-lock.yaml"] },
+]
+
+[[case]]
+name = "create_package_manager_override_family"
+vp = ["global", "local"]
+local-registry = true
+unset-env = ["VP_SKIP_INSTALL", "CI"]
+env = { VP_PACKAGE_MANAGER = "npm@10.9.2" }
+steps = [
+  { argv = ["node", "capture-create.mjs", "@override:demo", "--directory", "demo", "--package-manager", "pnpm", "--no-interactive", "--no-agent", "--no-editor", "--no-hooks"], timeout = 180000 },
+  { argv = ["vpt", "print-file", "create-summary.json"], comment = "the exact package-manager version reported in the summary" },
+  { argv = ["vpt", "print-file", "demo/package.json"], comment = "the npm override takes precedence over the pnpm selection" },
+  { argv = ["node", "-p", "require('./demo/package.json').devEngines.packageManager.version"], comment = "record the exact pin separately from manifest version redaction" },
+  { argv = ["vpt", "print-file", "demo/installed-with.json"], comment = "package manager recorded by the install lifecycle script" },
+  { argv = ["vpt", "stat-file", "demo/package-lock.json", "demo/pnpm-workspace.yaml"] },
+]
+
+[[case]]
+name = "create_package_manager_override_monorepo"
+vp = ["global", "local"]
+local-registry = true
+unset-env = ["VP_SKIP_INSTALL", "CI"]
+env = { VP_PACKAGE_MANAGER = "pnpm@10.6.1" }
+steps = [
+  { argv = ["vpt", "write-file", "pnpm-workspace.yaml", "packages:\n  - packages/*\n"], snapshot = false },
+  { argv = ["node", "capture-create.mjs", "@override:demo", "--directory", "packages/demo", "--package-manager", "pnpm", "--no-interactive", "--no-agent", "--no-editor", "--no-hooks"], timeout = 180000 },
+  { argv = ["vpt", "print-file", "create-summary.json"], comment = "the exact package-manager version reported in the summary" },
+  { argv = ["vpt", "print-file", "package.json"], comment = "the session override preserves the existing project pin" },
+  { argv = ["node", "-p", "require('./package.json').devEngines.packageManager.version"], comment = "record the exact existing pin separately from manifest version redaction" },
+  { argv = ["vpt", "print-file", "installed-with.json"], comment = "the install uses the session override" },
+  { argv = ["vpt", "print-file", "pnpm-workspace.yaml"], comment = "preserve the workspace patterns without adding a standalone root" },
+  { argv = ["vpt", "stat-file", "pnpm-lock.yaml"] },
+]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/create_package_manager_override/snapshots/create_package_manager_override_family.global.md

@@ -0,0 +1,74 @@
+# create_package_manager_override_family
+
+## `node capture-create.mjs @override:demo --directory demo --package-manager pnpm --no-interactive --no-agent --no-editor --no-hooks`
+
+```
+◇ Scaffolded demo
+• Node <version>  npm <version>
+✓ Dependencies installed in <duration>
+→ Next: cd demo && vp run
+```
+
+## `vpt print-file create-summary.json`
+
+the exact package-manager version reported in the summary
+
+```
+{
+  "packageManager": "npm",
+  "version": "10.9.2"
+}
+```
+
+## `vpt print-file demo/package.json`
+
+the npm override takes precedence over the pnpm selection
+
+```
+{
+  "name": "demo",
+  "version": "0.0.0",
+  "scripts": {
+    "postinstall": "node record-install.cjs"
+  },
+  "devDependencies": {
+    "vite-plus": "<version>"
+  },
+  "overrides": {
+    "vite": "npm:@voidzero-dev/vite-plus-core@<version>"
+  },
+  "devEngines": {
+    "packageManager": {
+      "name": "npm",
+      "version": "<version>",
+      "onFail": "download"
+    }
+  }
+}
+```
+
+## `node -p require('./demo/package.json').devEngines.packageManager.version`
+
+record the exact pin separately from manifest version redaction
+
+```
+10.9.2
+```
+
+## `vpt print-file demo/installed-with.json`
+
+package manager recorded by the install lifecycle script
+
+```
+{
+  "packageManager": "npm",
+  "version": "10.9.2"
+}
+```
+
+## `vpt stat-file demo/package-lock.json demo/pnpm-workspace.yaml`
+
+```
+demo/package-lock.json: file
+demo/pnpm-workspace.yaml: missing
+```