fix(create): make the tarball manifest probe best-effort

A probe failure (download, size cap, integrity, parse) on a normal
@scope/create package without a manifest must not block the passthrough
path that previously handled it — degrade to 'no manifest' instead.
Schema errors stay loud: validateManifest runs outside the try, so a
manifest that is present but malformed still throws.

Author: hiro-daikin

packages/cli/src/create/__tests__/org-manifest.spec.ts

@@ -258,6 +258,23 @@ describe('readOrgManifest', () => {
     expect(spy).toHaveBeenCalledTimes(1);
   });
 
+  it('treats a tarball probe failure as "no manifest" so passthrough still works', async () => {
+    // A normal @scope/create package (no manifest anywhere) whose tarball
+    // cannot be probed — e.g. a download error — must not turn into a hard
+    // failure; `null` lets the caller fall through to the passthrough path.
+    vi.spyOn(globalThis, 'fetch').mockImplementation(async (input) => {
+      const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;
+      if (url.endsWith('.tgz')) {
+        throw new Error('network unreachable');
+      }
+      return new Response(
+        JSON.stringify(packument(undefined, { dist: { tarball: TARBALL_URL } })),
+        { status: 200 },
+      );
+    });
+    expect(await readOrgManifest('@your-org')).toBeNull();
+  });
+
   it('returns null when createConfig.templates is an empty array', async () => {
     mockFetchJson(packument([]));
     expect(await readOrgManifest('@your-org')).toBeNull();

packages/cli/src/create/org-manifest.ts

@@ -339,10 +339,22 @@ export async function readOrgManifest(
   }
   let templates = validateManifest(meta, packageName);
   if (!templates && meta.createConfig === undefined && meta.dist?.tarball) {
-    // `createConfig` absent (not merely empty) → the registry stripped it from
-    // the version metadata; recover it from the published tarball. See
+    // `createConfig` absent (not merely empty) → either the registry stripped
+    // it from the version metadata, or the package simply has no manifest.
+    // Probe the published tarball to tell the two apart. See
     // `readPackageJsonFromTarball` for the full rationale.
-    const packageJson = await readPackageJsonFromTarball(meta.dist.tarball, meta.dist.integrity);
+    //
+    // The probe is best-effort: a download/size/integrity/parse failure must
+    // not block normal `@scope/create` packages that never had a manifest
+    // from reaching the passthrough path, so it degrades to "no manifest".
+    // A manifest that IS present but malformed still throws below —
+    // `validateManifest` runs outside the try so schema errors stay loud.
+    let packageJson: unknown = null;
+    try {
+      packageJson = await readPackageJsonFromTarball(meta.dist.tarball, meta.dist.integrity);
+    } catch {
+      packageJson = null;
+    }
     templates = validateManifest(packageJson, packageName);
   }
   if (!templates) {