fix(migrate): preserve protocol-prefixed vite-plus specs; gate vitest auto-add to migrations

Address review findings on the new vite-plus normalize path:

- Preserve protocol-prefixed specs (`catalog:named`, `workspace:*`, `link:`,
  `file:`, `npm:`, `github:`, `git+`/`git:`, `http(s)://`) so deliberate
  user pins survive `vp migrate`. Previously the new normalize rule
  rewrote anything that wasn't literally `catalog:` — silently clobbering
  named-catalog references, workspace and link protocols, and aliased pins.

- Split the vitest peer-dep auto-add back behind `needVitePlus` only. A
  pure normalize pass (sub-package only needed its pinned `^x.y.z`
  re-aligned to `catalog:`) must not also inject a `vitest` devDep just
  because the project happens to have a `vitest-browser-*` peer.

- Drop the now-redundant `const version = canonicalVitePlusSpec` alias.

Also update `snap-tests-global/new-vite-monorepo-bun/snap.txt` to drop the
stripped `"vite": "catalog:"` line in apps/website (matches the cleanup in
`executeMonorepoTemplate`), and add an existsSync guard to the workflow's
node -e assertion so a missing sub-package package.json surfaces with a
targeted message instead of an opaque ENOENT.

Test coverage: yarn + bun catalog normalize, protocol-prefix preservation,
and "pure normalize must not auto-add vitest". 410 passed.

Author: fengmk2

.github/workflows/test-vp-create.yml

@@ -291,6 +291,12 @@ jobs:
           node -e "
             const fs = require('fs');
             const pm = process.env.PACKAGE_MANAGER;
+            for (const f of ['apps/website/package.json', 'packages/utils/package.json']) {
+              if (!fs.existsSync(f)) {
+                console.error('✗ expected ' + f + ' to exist after vp create vite:monorepo');
+                process.exit(1);
+              }
+            }
             const app = JSON.parse(fs.readFileSync('apps/website/package.json', 'utf8'));
             const utils = JSON.parse(fs.readFileSync('packages/utils/package.json', 'utf8'));
             const appDev = app.devDependencies || {};

packages/cli/snap-tests-global/new-vite-monorepo-bun/snap.txt

@@ -67,7 +67,6 @@ website
   },
   "devDependencies": {
     "typescript": "~6.0.2",
-    "vite": "catalog:",
     "vite-plus": "catalog:"
   }
 }

packages/cli/src/migration/__tests__/migrator.spec.ts

@@ -183,6 +183,42 @@ describe('rewritePackageJson', () => {
     expect(pkg.devDependencies['vite-plus']).toBe('^0.1.20');
   });
 
+  it('normalizes a pre-existing pinned vite-plus on yarn/bun monorepo projects', async () => {
+    for (const pm of [PackageManager.yarn, PackageManager.bun]) {
+      const pkg = { devDependencies: { 'vite-plus': '^0.1.20' } };
+      rewritePackageJson(pkg, pm, true);
+      expect(pkg.devDependencies['vite-plus']).toBe('catalog:');
+    }
+  });
+
+  it('preserves protocol-prefixed vite-plus specs (catalog:named, workspace:, link:, github:) in catalog-supporting monorepos', async () => {
+    for (const existing of [
+      'catalog:next',
+      'workspace:*',
+      'link:../vite-plus',
+      'github:fork/vite-plus',
+      'npm:@scope/vite-plus@^1.0.0',
+    ]) {
+      const pkg = { devDependencies: { 'vite-plus': existing } };
+      rewritePackageJson(pkg, PackageManager.pnpm, true);
+      expect(pkg.devDependencies['vite-plus']).toBe(existing);
+    }
+  });
+
+  it('does not auto-add vitest on a pure normalize pass (only on actual vite/vitest/REMOVE migrations)', async () => {
+    const pkg = {
+      devDependencies: {
+        'vite-plus': '^0.1.20',
+        'vitest-browser-svelte': '^1.0.0',
+      },
+    };
+
+    rewritePackageJson(pkg, PackageManager.pnpm, true);
+
+    expect(pkg.devDependencies['vite-plus']).toBe('catalog:');
+    expect((pkg.devDependencies as Record<string, string>).vitest).toBeUndefined();
+  });
+
   it('uses default catalog specs for non-catalog dependency specs in monorepo projects', async () => {
     const pkg = {
       devDependencies: {

packages/cli/src/migration/migrator.ts

@@ -1985,24 +1985,31 @@ export function rewritePackageJson(
   }
   // Normalize a pre-existing pinned vite-plus so sub-packages don't drift
   // from siblings: in catalog-supporting monorepos that's `catalog:`, under
-  // force-override (file:) it's the tgz path. Scoped to catalog-supporting
-  // PMs so npm/standalone keep their pinned spec under `vp migrate`.
+  // force-override (file:) it's the tgz path. Preserve protocol-prefixed
+  // specs (catalog:named, workspace:*, link:, file:, npm:, github:, git+/git:,
+  // http(s)://) so deliberate user pins survive; only vanilla version ranges
+  // (e.g. `^0.1.20`, `latest`) are rewritten.
   const canonicalVitePlusSpec =
     supportCatalog && !VITE_PLUS_VERSION.startsWith('file:') ? 'catalog:' : VITE_PLUS_VERSION;
   const existingVitePlus = pkg.devDependencies?.[VITE_PLUS_NAME];
   const shouldNormalizeExistingVitePlus =
-    !!existingVitePlus && supportCatalog && existingVitePlus !== canonicalVitePlusSpec;
+    !!existingVitePlus &&
+    supportCatalog &&
+    existingVitePlus !== canonicalVitePlusSpec &&
+    !isProtocolPinnedSpec(existingVitePlus);
   if (needVitePlus || shouldNormalizeExistingVitePlus) {
-    // add vite-plus to devDependencies
-    const version = canonicalVitePlusSpec;
     pkg.devDependencies = {
       ...pkg.devDependencies,
-      [VITE_PLUS_NAME]: version,
+      [VITE_PLUS_NAME]: canonicalVitePlusSpec,
     };
-    // Add vitest to devDependencies when a remaining dependency likely peer-depends
-    // on vitest (e.g., vitest-browser-svelte). Without this, pnpm resolves the real
-    // vitest for peer deps instead of @voidzero-dev/vite-plus-test, causing
-    // third-party type augmentations to target the wrong module.
+  }
+  // Add vitest to devDependencies when a remaining dependency likely peer-depends
+  // on vitest (e.g., vitest-browser-svelte). Without this, pnpm resolves the real
+  // vitest for peer deps instead of @voidzero-dev/vite-plus-test, causing
+  // third-party type augmentations to target the wrong module. Gated by
+  // needVitePlus (something actually changed) — a pure normalize pass must not
+  // mutate the project beyond the vite-plus spec.
+  if (needVitePlus) {
     const installableDeps = {
       ...pkg.dependencies,
       ...pkg.devDependencies,
@@ -2013,12 +2020,20 @@ export function rewritePackageJson(
       Object.keys(installableDeps).some((name) => name.includes('vitest'))
     ) {
       const ver = VITE_PLUS_OVERRIDE_PACKAGES.vitest;
+      pkg.devDependencies ??= {};
       pkg.devDependencies.vitest = getCatalogDependencySpec(undefined, ver, supportCatalog);
     }
   }
   return extractedStagedConfig;
 }
 
+// Returns true if the spec uses a known protocol prefix (catalog:, workspace:,
+// link:, file:, npm:, github:, git+/git:, http(s)://) and so represents a
+// deliberate user choice that should not be silently rewritten.
+function isProtocolPinnedSpec(spec: string): boolean {
+  return /^(catalog:|workspace:|link:|file:|npm:|github:|git[+:]|https?:\/\/)/.test(spec);
+}
+
 // Remove the "lint-staged" key from package.json after config has been
 // successfully merged into vite.config.ts.
 function removeLintStagedFromPackageJson(packageJsonPath: string): void {