fix(migrate): keep catalog: specs intact through vp up under pnpm

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_legacy_key/.gitignore

@@ -0,0 +1 @@
+node_modules/

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_legacy_key/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "command-update-catalog-protocol-legacy-key",
+  "private": true,
+  "devDependencies": {
+    "vite": "^7.0.0"
+  },
+  "packageManager": "pnpm@11.20.0"
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_legacy_key/snapshots.toml

@@ -0,0 +1,58 @@
+[[case]]
+name = "command_update_catalog_protocol_legacy_key"
+vp = "global"
+skip-platforms = ["windows"]
+unset-env = ["CI", "VP_SKIP_INSTALL"]
+local-registry = true
+comment = "#2309 repair path. Migrate first so the catalog holds a real PINNED toolchain version (the reporter's shape), then downgrade the override key to the pre-fix bare spelling a project migrated by an older Vite+ still carries."
+steps = [
+  { argv = [
+    "vp",
+    "migrate",
+    "--no-interactive",
+    "--no-hooks",
+    "--package-manager",
+    "pnpm",
+  ], comment = "migrate pins the toolchain through the workspace catalog", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "replace-file-content",
+    "pnpm-workspace.yaml",
+    "vite@*:",
+    "vite:",
+  ], comment = "rewind the override key to the pre-#2309 bare spelling (fails if migrate stopped writing the ranged key)", snapshot = false, continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "pnpm-workspace.yaml",
+  ], comment = "the pre-fix shape: bare override key over an exactly pinned catalog alias", continue-on-failure = true },
+  { argv = [
+    "vp",
+    "up",
+  ], comment = "nothing to update, yet the bare key still resolves the catalog reference away", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "package.json",
+  ], comment = "`vite` lost `catalog:` for the pinned alias; `vite-plus` (no override) kept it", continue-on-failure = true },
+  { argv = [
+    "vp",
+    "migrate",
+    "--no-interactive",
+    "--no-hooks",
+  ], comment = "the bare key reads as pending, so one migrate repairs it", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "pnpm-workspace.yaml",
+  ], comment = "the bare key is replaced by the range-qualified one", continue-on-failure = true },
+  { argv = [
+    "vp",
+    "up",
+  ], comment = "update is now a no-op on the catalog reference", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "package.json",
+  ], comment = "`vite` stays `catalog:` across the update", continue-on-failure = true },
+]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_legacy_key/snapshots/command_update_catalog_protocol_legacy_key.md

@@ -0,0 +1,128 @@
+# command_update_catalog_protocol_legacy_key
+
+#2309 repair path. Migrate first so the catalog holds a real PINNED toolchain version (the reporter's shape), then downgrade the override key to the pre-fix bare spelling a project migrated by an older Vite+ still carries.
+
+## `vp migrate --no-interactive --no-hooks --package-manager pnpm`
+
+migrate pins the toolchain through the workspace catalog
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+Formatting code...
+
+Code formatted
+◇ Migrated . to Vite+ <version>
+• Node <version>  pnpm <version>
+✓ Dependencies installed in <duration>
+• 1 config update applied
+```
+
+## `vpt replace-file-content pnpm-workspace.yaml vite@*: vite:`
+
+rewind the override key to the pre-#2309 bare spelling (fails if migrate stopped writing the ranged key)
+
+
+## `vpt print-file pnpm-workspace.yaml`
+
+the pre-fix shape: bare override key over an exactly pinned catalog alias
+
+```
+catalog:
+  vite: npm:@voidzero-dev/vite-plus-core@<version>
+  vite-plus: <version>
+overrides:
+  vite: "catalog:"
+peerDependencyRules:
+  allowAny:
+    - vite
+  allowedVersions:
+    vite: "*"
+```
+
+## `vp up`
+
+nothing to update, yet the bare key still resolves the catalog reference away
+
+```
+✓ Lockfile passes supply-chain policies (verified <duration> ago)
+Already up to date
+
+Done in <duration> using pnpm <version>
+```
+
+## `vpt print-file package.json`
+
+`vite` lost `catalog:` for the pinned alias; `vite-plus` (no override) kept it
+
+```
+{
+  "name": "command-update-catalog-protocol-legacy-key",
+  "private": true,
+  "devDependencies": {
+    "vite": "npm:@voidzero-dev/vite-plus-core@<version>",
+    "vite-plus": "catalog:"
+  },
+  "packageManager": "pnpm@11.20.0"
+}
+```
+
+## `vp migrate --no-interactive --no-hooks`
+
+the bare key reads as pending, so one migrate repairs it
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+Formatting code...
+
+Code formatted
+◇ Updated . to Vite+ <version>
+• Node <version>  pnpm <version>
+✓ Dependencies installed in <duration>
+• Package manager settings configured
+```
+
+## `vpt print-file pnpm-workspace.yaml`
+
+the bare key is replaced by the range-qualified one
+
+```
+catalog:
+  vite: npm:@voidzero-dev/vite-plus-core@<version>
+  vite-plus: <version>
+overrides:
+  vite@*: "catalog:"
+peerDependencyRules:
+  allowAny:
+    - vite
+  allowedVersions:
+    vite: "*"
+```
+
+## `vp up`
+
+update is now a no-op on the catalog reference
+
+```
+✓ Lockfile passes supply-chain policies (verified <duration> ago)
+Already up to date
+
+Done in <duration> using pnpm <version>
+```
+
+## `vpt print-file package.json`
+
+`vite` stays `catalog:` across the update
+
+```
+{
+  "name": "command-update-catalog-protocol-legacy-key",
+  "private": true,
+  "devDependencies": {
+    "vite": "catalog:",
+    "vite-plus": "catalog:"
+  },
+  "packageManager": "pnpm@11.20.0"
+}
+```

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm/.gitignore

@@ -0,0 +1 @@
+node_modules/

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "command-update-catalog-protocol-pnpm",
+  "devDependencies": {
+    "vite": "^7.0.0"
+  },
+  "packageManager": "pnpm@11.20.0"
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm/snapshots.toml

@@ -0,0 +1,35 @@
+[[case]]
+name = "command_update_catalog_protocol_pnpm"
+vp = "global"
+skip-platforms = ["windows"]
+unset-env = ["CI", "VP_SKIP_INSTALL"]
+local-registry = true
+steps = [
+  { argv = [
+    "vp",
+    "migrate",
+    "--no-interactive",
+    "--no-hooks",
+    "--package-manager",
+    "pnpm",
+  ], comment = "migrate pins the toolchain through the workspace catalog", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "package.json",
+  ], comment = "the migrated project references the catalog", continue-on-failure = true },
+  { argv = [
+    "vp",
+    "up",
+  ], comment = "#2309: update must not resolve the catalog reference away", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "package.json",
+  ], comment = "`vite` stays `catalog:` instead of the concrete core alias", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "pnpm-workspace.yaml",
+  ], comment = "the catalog keeps owning the resolved toolchain version", continue-on-failure = true },
+]

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm/snapshots/command_update_catalog_protocol_pnpm.md

@@ -0,0 +1,75 @@
+# command_update_catalog_protocol_pnpm
+
+## `vp migrate --no-interactive --no-hooks --package-manager pnpm`
+
+migrate pins the toolchain through the workspace catalog
+
+```
+VITE+ - The Unified Toolchain for the Web
+
+Formatting code...
+
+Code formatted
+◇ Migrated . to Vite+ <version>
+• Node <version>  pnpm <version>
+✓ Dependencies installed in <duration>
+• 1 config update applied
+```
+
+## `vpt print-file package.json`
+
+the migrated project references the catalog
+
+```
+{
+  "name": "command-update-catalog-protocol-pnpm",
+  "devDependencies": {
+    "vite": "catalog:",
+    "vite-plus": "catalog:"
+  },
+  "packageManager": "pnpm@11.20.0"
+}
+```
+
+## `vp up`
+
+#2309: update must not resolve the catalog reference away
+
+```
+✓ Lockfile passes supply-chain policies (verified <duration> ago)
+Already up to date
+
+Done in <duration> using pnpm <version>
+```
+
+## `vpt print-file package.json`
+
+`vite` stays `catalog:` instead of the concrete core alias
+
+```
+{
+  "name": "command-update-catalog-protocol-pnpm",
+  "devDependencies": {
+    "vite": "catalog:",
+    "vite-plus": "catalog:"
+  },
+  "packageManager": "pnpm@11.20.0"
+}
+```
+
+## `vpt print-file pnpm-workspace.yaml`
+
+the catalog keeps owning the resolved toolchain version
+
+```
+catalog:
+  vite: npm:@voidzero-dev/vite-plus-core@<version>
+  vite-plus: <version>
+overrides:
+  vite@*: "catalog:"
+peerDependencyRules:
+  allowAny:
+    - vite
+  allowedVersions:
+    vite: "*"
+```

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm12/.gitignore

@@ -0,0 +1 @@
+node_modules/

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm12/package.json

@@ -0,0 +1,7 @@
+{
+  "name": "command-update-catalog-protocol-pnpm12",
+  "devDependencies": {
+    "vite": "^7.0.0"
+  },
+  "packageManager": "pnpm@12.0.0-rc.3"
+}

crates/vp_cli_snapshots/tests/cli_snapshots/fixtures/command_update_catalog_protocol_pnpm12/snapshots.toml

@@ -0,0 +1,31 @@
+[[case]]
+name = "command_update_catalog_protocol_pnpm12"
+vp = "global"
+skip-platforms = ["windows"]
+unset-env = ["CI", "VP_SKIP_INSTALL"]
+local-registry = true
+comment = "#2309 on pnpm 12. pnpm 12 fixes the clobber upstream (a bare override key no longer strips a `catalog:` importer spec), so this pins that the range-qualified key vite-plus writes is also correct there rather than only being a pnpm 9-11 workaround."
+steps = [
+  { argv = [
+    "vp",
+    "migrate",
+    "--no-interactive",
+    "--no-hooks",
+    "--package-manager",
+    "pnpm",
+  ], comment = "migrate pins the toolchain through the workspace catalog", continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "pnpm-workspace.yaml",
+  ], comment = "the range-qualified override key is written on pnpm 12 too", continue-on-failure = true },
+  { argv = [
+    "vp",
+    "up",
+  ], comment = "update must not resolve the catalog reference away (screen omitted: pnpm 12's update summary reports a package-count delta that churns with the bundled dependency graph)", snapshot = false, continue-on-failure = true },
+  { argv = [
+    "vpt",
+    "print-file",
+    "package.json",
+  ], comment = "`vite` stays `catalog:`", continue-on-failure = true },
+]