vite-plus 0.2.1 → 0.2.3

package/dist/create/bin.js

@@ -1,13 +1,13 @@
-import { r as __toESM, t as __commonJSMin } from "../rolldown-runtime-DnnnRqeS.js";
-import { o as VITE_PLUS_NAME } from "../constants-CrfJQIUX.js";
-import { A as select, D as log, E as intro, F as runCommand$1, I as runCommandSilently, L as require_cross_spawn, M as text, N as require_picocolors, O as multiselect, P as R, S as PackageManager, T as confirm, _ as approveBuilds, d as promptGitHooks, f as resolveGitInit, h as selectPackageManager, j as spinner, l as defaultInteractive, m as runViteInstall, p as runViteFmt, u as downloadPackageManager$1, v as detectGatedBuilds, w as cancel, x as DependencyType, y as resolveApproveBuildTargets } from "../tsconfig-BWQPmGKz.js";
+import { r as __toESM, t as __commonJSMin } from "../rolldown-runtime-C7HZzL1F.js";
+import { s as VITE_PLUS_NAME } from "../constants-CZ7Mnq-C.js";
+import { A as intro, B as runCommandSilently, C as resolveApproveBuildTargets, E as PackageManager, F as spinner, I as text, L as require_picocolors, M as multiselect, O as cancel, P as select, R as isCancel, S as detectGatedBuilds, T as DependencyType, V as require_cross_spawn, d as downloadPackageManager$1, f as promptGitHooks, g as selectPackageManager, h as runViteInstall, j as log, k as confirm, m as runViteFmt, p as resolveGitInit, u as defaultInteractive, x as approveBuilds, z as runCommand$1 } from "../tsconfig-D6sTl0dN.js";
 import { a as printHeader, i as muted, o as success, r as log$1, t as accent } from "../terminal-uTv0ZaMr.js";
-import { r as readJsonFile, t as editJsonFile } from "../json-Dn87fvjk.js";
-import { a as resolveViteConfig, n as findWorkspaceRoot, r as hasViteConfig, t as findViteConfig } from "../resolve-vite-config-CmdsfQzS.js";
+import { i as readJsonFile, n as editJsonFile } from "../json-DiRs8ceZ.js";
+import { a as resolveViteConfig, n as findWorkspaceRoot, r as hasViteConfig, t as findViteConfig } from "../resolve-vite-config-DX2o0SWM.js";
 import { t as lib_default } from "../lib-L3DWSRQp.js";
-import { o as fetchNpmResource, s as getNpmRegistry, t as checkNpmPackageExists } from "../package-BHirM1_v.js";
-import { B as setPackageManager, D as injectCreateDefaultTemplate, F as promptEslintMigration, I as promptPrettierMigration, J as templatesDir, L as rewriteMonorepo, R as rewriteMonorepoProject, T as hasFrameworkShim, a as selectAgentTargets, b as detectPrettierProject, c as writeCopilotSetupWorkflow, h as detectFramework, k as installGitHooks, l as addFrameworkShim, m as detectEslintProject, q as displayRelative, r as detectExistingAgentTargetPaths, s as writeAgentInstructions, t as COPILOT_AGENT_ID, z as rewriteStandaloneProject } from "../agent--cKmgD_n.js";
-import { c as selectEditors, i as updateWorkspaceConfig, l as writeEditorConfigs, n as isBingoTemplate, o as detectExistingEditors, r as updatePackageJsonWithDeps, t as detectWorkspace$1 } from "../workspace-D0AVy4fu.js";
+import { o as fetchNpmResource, s as getNpmRegistry, t as checkNpmPackageExists } from "../package-Cpo2ei_V.js";
+import { A as detectWorkspace$1, F as detectEslintProject, M as updatePackageJsonWithDeps, N as updateWorkspaceConfig, R as promptEslintMigration, S as injectCreateDefaultTemplate, X as templatesDir, Y as displayRelative, a as selectAgentTargets, c as writeCopilotSetupWorkflow, d as rewriteStandaloneProject, g as setPackageManager, j as isBingoTemplate, l as rewriteMonorepo, r as detectExistingAgentTargetPaths, s as writeAgentInstructions, t as COPILOT_AGENT_ID, u as rewriteMonorepoProject, y as installGitHooks } from "../agent-D3nZAMGI.js";
+import { a as writeEditorConfigs, c as hasFrameworkShim, f as promptPrettierMigration, i as selectEditors, n as detectExistingEditors, o as addFrameworkShim, s as detectFramework, u as detectPrettierProject } from "../editor-D1BZiU1h.js";
 import { t as renderCliDoc } from "../help-YP84FSEz.js";
 import path from "node:path";
 import { runCommand, upsertJsonConfig, vitePlusHeader } from "../../binding/index.js";
@@ -27,28 +27,6 @@ async function initGitRepository(cwd) {
 		envs: process.env
 	})).exitCode === 0;
 }
-async function createInitialCommit(cwd) {
-	await runCommandSilently({
-		command: "git",
-		args: ["add", "-A"],
-		cwd,
-		envs: process.env
-	});
-	const result = await runCommandSilently({
-		command: "git",
-		args: [
-			"commit",
-			"-m",
-			"Initial commit from Vite+"
-		],
-		cwd,
-		envs: process.env
-	});
-	return {
-		success: result.exitCode === 0,
-		output: `${result.stdout.toString()}${result.stderr.toString()}`.trim()
-	};
-}
 //#endregion
 //#region src/create/command.ts
 async function runCommandAndDetectProjectDir(options, parentDir) {
@@ -127,829 +105,861 @@ function prependToPathToEnvs(extraPath, envs) {
 	return envs;
 }
 //#endregion
-//#region src/create/org-manifest.ts
-/**
-* Parse the org picker specifier: `@scope` (scope only → picker) or
-* `@scope:name` (direct manifest-entry selection). Colon mirrors the
-* existing `vite:monorepo` / `vite:library` builtin-template syntax and
-* keeps manifest entries syntactically distinct from real
-* `@scope/package-name` npm specifiers.
-*
-* Returns `null` for anything else — including the plain `@scope/name`
-* form, which routes to the existing `@scope/create-name` shorthand as
-* it did before the org-manifest feature.
-*
-* The optional `version` suffix (`@scope@1.2.3`, `@scope:name@1.2.3`)
-* pins `@scope/create` to a specific release rather than `dist-tags.latest`.
-*/
-function parseOrgScopedSpec(spec) {
-	if (!spec.startsWith("@")) return null;
-	if (spec.includes("/")) return null;
-	const colonIndex = spec.indexOf(":");
-	if (colonIndex === -1) {
-		const atIndex = spec.indexOf("@", 1);
-		if (atIndex === -1) return { scope: spec };
-		const version = spec.slice(atIndex + 1);
-		return version ? {
-			scope: spec.slice(0, atIndex),
-			version
-		} : { scope: spec.slice(0, atIndex) };
+//#region ../../node_modules/.pnpm/nanotar@0.3.0/node_modules/nanotar/dist/index.mjs
+const tarItemTypeMap = {
+	"0": "file",
+	"1": "hardLink",
+	"2": "symbolicLink",
+	"3": "characterDevice",
+	"4": "blockDevice",
+	"5": "directory",
+	"6": "fifo",
+	"7": "contiguousFile",
+	"g": "globalExtendedHeader",
+	"x": "extendedHeader",
+	"D": "gnuDirectory",
+	"I": "gnuInodeMetadata",
+	"K": "gnuLongLinkName",
+	"L": "gnuLongFileName",
+	"N": "gnuOldLongFileName",
+	"M": "gnuMultiVolume",
+	"S": "gnuSparseFile",
+	"E": "gnuExtendedSparse",
+	"A": "solarisAcl",
+	"V": "solarisVolumeLabel",
+	"X": "solarisOldExtendedHeader"
+};
+function parseTar(data, opts) {
+	const buffer = data.buffer || data;
+	const files = [];
+	let offset = 0;
+	let nextExtendedHeader;
+	let globalExtendedHeader;
+	while (offset < buffer.byteLength - 512) {
+		let name = _readString(buffer, offset, 100);
+		if (name.length === 0) break;
+		if (nextExtendedHeader) {
+			const longName = nextExtendedHeader.path || nextExtendedHeader.linkpath;
+			if (longName) name = longName;
+		}
+		const mode = _readString(buffer, offset + 100, 8).trim();
+		const uid = Number.parseInt(_readString(buffer, offset + 108, 8));
+		const gid = Number.parseInt(_readString(buffer, offset + 116, 8));
+		const size = _readNumber(buffer, offset + 124, 12);
+		const seek = 512 + 512 * Math.trunc(size / 512) + (size % 512 ? 512 : 0);
+		const mtime = _readNumber(buffer, offset + 136, 12);
+		const _type = _readString(buffer, offset + 156, 1) || "0";
+		const type = tarItemTypeMap[_type] || _type;
+		switch (type) {
+			case "extendedHeader":
+			case "globalExtendedHeader": {
+				const headers = _parseExtendedHeaders(new Uint8Array(buffer, offset + 512, size));
+				if (type === "extendedHeader") nextExtendedHeader = headers;
+				else {
+					nextExtendedHeader = void 0;
+					globalExtendedHeader = {
+						...globalExtendedHeader,
+						...headers
+					};
+				}
+				offset += seek;
+				continue;
+			}
+			case "gnuLongFileName":
+			case "gnuOldLongFileName":
+			case "gnuLongLinkName":
+				nextExtendedHeader = { path: _readString(buffer, offset + 512, size) };
+				offset += seek;
+				continue;
+		}
+		const user = _readString(buffer, offset + 265, 32);
+		const group = _readString(buffer, offset + 297, 32);
+		name = _sanitizePath(name);
+		const meta = {
+			name,
+			type,
+			size,
+			attrs: {
+				...globalExtendedHeader,
+				...nextExtendedHeader,
+				mode,
+				uid,
+				gid,
+				mtime,
+				user,
+				group
+			}
+		};
+		nextExtendedHeader = void 0;
+		if (opts?.filter && !opts.filter(meta)) {
+			offset += seek;
+			continue;
+		}
+		if (opts?.metaOnly) {
+			files.push(meta);
+			offset += seek;
+			continue;
+		}
+		const data2 = size === 0 ? void 0 : new Uint8Array(buffer, offset + 512, size);
+		files.push({
+			...meta,
+			data: data2,
+			get text() {
+				return new TextDecoder().decode(this.data);
+			}
+		});
+		offset += seek;
 	}
-	const scope = spec.slice(0, colonIndex);
-	const rest = spec.slice(colonIndex + 1);
-	const atIndex = rest.indexOf("@");
-	const name = atIndex === -1 ? rest : rest.slice(0, atIndex);
-	const version = atIndex === -1 ? "" : rest.slice(atIndex + 1);
-	if (!name) return version ? {
-		scope,
-		version
-	} : { scope };
-	return version ? {
-		scope,
-		name,
-		version
-	} : {
-		scope,
-		name
-	};
+	return files;
 }
-/**
-* Schema-level failure. Never falls through silently — a maintainer who
-* shipped an invalid manifest should see the offending field.
-*/
-var OrgManifestSchemaError = class extends Error {
-	packageName;
-	constructor(message, packageName) {
-		super(`${packageName}: ${message}`);
-		this.packageName = packageName;
-		this.name = "OrgManifestSchemaError";
+async function parseTarGzip(data, opts = {}) {
+	const stream = new ReadableStream({ start(controller) {
+		controller.enqueue(new Uint8Array(data));
+		controller.close();
+	} }).pipeThrough(new DecompressionStream(opts.compression ?? "gzip"));
+	return parseTar(await new Response(stream).arrayBuffer(), opts);
+}
+function _sanitizePath(path) {
+	let normalized = path.replace(/\\/g, "/");
+	normalized = normalized.replace(/^[a-zA-Z]:\//, "");
+	normalized = normalized.replace(/^\/+/, "");
+	const hasLeadingDotSlash = normalized.startsWith("./");
+	const parts = normalized.split("/");
+	const resolved = [];
+	for (const part of parts) if (part === "..") resolved.pop();
+	else if (part !== "." && part !== "") resolved.push(part);
+	let result = resolved.join("/");
+	if (hasLeadingDotSlash && !result.startsWith("./")) result = "./" + result;
+	if (path.endsWith("/") && !result.endsWith("/")) result += "/";
+	return result;
+}
+function _readString(buffer, offset, size) {
+	const view = new Uint8Array(buffer, offset, size);
+	const i = view.indexOf(0);
+	return new TextDecoder().decode(i === -1 ? view : view.slice(0, i));
+}
+function _readNumber(buffer, offset, size) {
+	const view = new Uint8Array(buffer, offset, size);
+	let str = "";
+	for (let i = 0; i < size; i++) str += String.fromCodePoint(view[i]);
+	return Number.parseInt(str, 8);
+}
+function _parseExtendedHeaders(data) {
+	const dataStr = new TextDecoder().decode(data);
+	const headers = {};
+	for (const line of dataStr.split("\n")) {
+		const s = line.split(" ")[1]?.split("=");
+		if (s) headers[s[0]] = s[1];
 	}
-};
-function isRelativePath(spec) {
-	return spec.startsWith("./") || spec.startsWith("../");
+	return headers;
+}
+//#endregion
+//#region src/create/org-tarball.ts
+function getCacheRoot() {
+	const home = process.env.VP_HOME || path.join(os.homedir(), ".vite-plus");
+	return path.join(home, "tmp", "create-org");
 }
 /**
-* Validate the `{ name, description, template }` fields shared by org manifest
-* entries and local `create.templates` entries. `label` is the config path
-* used in error messages (e.g. `createConfig.templates` or `create.templates`)
-* and `makeError` builds the thrown error so each source uses its own type.
+* Replace characters that are illegal in Windows path segments
+* (`\ / : * ? " < > |` plus the IPv6 bracket pair `[ ]`). The host
+* comes from `new URL(...).host` which can carry a port (`:4873`) or
+* IPv6 literal (`[::1]`); both end up in the cache path otherwise.
 */
-function validateTemplateEntry(entry, index, label, makeError) {
-	if (!entry || typeof entry !== "object") throw makeError(`${label}[${index}] must be an object`);
-	const raw = entry;
-	const requireString = (field) => {
-		const value = raw[field];
-		if (typeof value !== "string" || value.length === 0) throw makeError(`${label}[${index}].${field} must be a non-empty string`);
-		return value;
-	};
-	const name = requireString("name");
-	if (name.startsWith("__vp_")) throw makeError(`${label}[${index}].name uses the reserved \`__vp_\` prefix`);
-	const description = requireString("description");
-	const template = requireString("template");
-	if (isRelativePath(template)) {
-		const resolved = path.posix.resolve("/root", template.replaceAll("\\", "/"));
-		if (resolved !== "/root" && !resolved.startsWith("/root/")) throw makeError(`${label}[${index}].template escapes the package root: ${template}`);
-	}
-	return {
-		name,
-		description,
-		template
-	};
+function sanitizeHostForPath(host) {
+	return host.replaceAll(/[\\/:*?"<>|[\]]/g, "_");
 }
 /**
-* Validate a list of entries, rejecting duplicate `name`s. Shared by org
-* manifests and local `create.templates`.
-*/
-function validateTemplateEntries(templates, label, makeError, validateOne) {
-	const entries = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (let index = 0; index < templates.length; index += 1) {
-		const entry = validateOne(templates[index], index);
-		if (seen.has(entry.name)) throw makeError(`${label}[${index}].name duplicates an earlier entry: "${entry.name}"`);
-		seen.add(entry.name);
-		entries.push(entry);
-	}
-	return entries;
+* Cache extracted tarballs under `<host>/<scope>/create/<version>` so two
+* repos resolving the same `<scope>@<version>` through different registries
+* (via `.npmrc` scope mappings) don't share a cache slot. The registry
+* guarantees `manifest.tarballUrl` is a valid URL, so any parse failure
+* here is a real bug worth surfacing.
+*/
+function getExtractionDir(manifest) {
+	const { host } = new URL(manifest.tarballUrl);
+	return path.join(getCacheRoot(), sanitizeHostForPath(host), manifest.scope, "create", manifest.version);
 }
-function validateEntry(entry, index, packageName) {
-	const makeError = (message) => new OrgManifestSchemaError(message, packageName);
-	const base = validateTemplateEntry(entry, index, "createConfig.templates", makeError);
-	let monorepo;
-	const raw = entry;
-	if (raw.monorepo !== void 0) {
-		if (typeof raw.monorepo !== "boolean") throw makeError(`createConfig.templates[${index}].monorepo must be a boolean`);
-		monorepo = raw.monorepo;
-	}
+function parseIntegrity(integrity) {
+	const match = integrity.split(/\s+/)[0].match(/^(sha\d+)-(.+)$/);
+	if (!match) return null;
 	return {
-		...base,
-		...monorepo !== void 0 ? { monorepo } : {}
+		algorithm: match[1],
+		expected: match[2]
 	};
 }
-function validateManifest(raw, packageName) {
-	if (!raw || typeof raw !== "object") return null;
-	const createConfig = raw.createConfig;
-	if (!createConfig || typeof createConfig !== "object") return null;
-	const templates = createConfig.templates;
-	if (templates === void 0) return null;
-	if (!Array.isArray(templates)) throw new OrgManifestSchemaError("createConfig.templates must be an array", packageName);
-	if (templates.length === 0) return null;
-	return validateTemplateEntries(templates, "createConfig.templates", (message) => new OrgManifestSchemaError(message, packageName), (entry, index) => validateEntry(entry, index, packageName));
+function verifyIntegrity(bytes, integrity) {
+	if (!integrity) return;
+	const parsed = parseIntegrity(integrity);
+	if (!parsed) return;
+	const hash = createHash(parsed.algorithm);
+	hash.update(bytes);
+	const actual = hash.digest("base64");
+	if (actual !== parsed.expected) throw new Error(`integrity check failed: expected ${integrity}, got ${parsed.algorithm}-${actual}`);
 }
-/**
-* Schema-level failure for `create.templates` in `vite.config.ts`. A misconfigured
-* local template should surface clearly rather than silently disappear.
-*/
-var CreateConfigSchemaError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "CreateConfigSchemaError";
+const MAX_TARBALL_BYTES = 50 * 1024 * 1024;
+async function downloadTarball(url) {
+	const response = await fetchNpmResource(url, { timeoutMs: 3e4 });
+	if (!response.ok) throw new Error(`failed to download tarball (${response.status}): ${url}`);
+	const contentLength = Number(response.headers.get("content-length"));
+	if (Number.isFinite(contentLength) && contentLength > MAX_TARBALL_BYTES) throw new Error(`tarball exceeds ${MAX_TARBALL_BYTES} byte size limit: ${url}`);
+	const reader = response.body?.getReader();
+	if (!reader) throw new Error(`tarball response has no body: ${url}`);
+	const chunks = [];
+	let total = 0;
+	while (true) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		total += value.byteLength;
+		if (total > MAX_TARBALL_BYTES) {
+			await reader.cancel();
+			throw new Error(`tarball exceeds ${MAX_TARBALL_BYTES} byte size limit: ${url}`);
+		}
+		chunks.push(value);
 	}
-};
-/**
-* Validate `create.templates` from `vite.config.ts`. Returns `[]` when the field
-* is absent or an empty array; throws {@link CreateConfigSchemaError} when present
-* but malformed.
-*/
-function validateCreateTemplates(templates) {
-	if (templates === void 0) return [];
-	if (!Array.isArray(templates)) throw new CreateConfigSchemaError("create.templates must be an array");
-	const makeError = (message) => new CreateConfigSchemaError(message);
-	return validateTemplateEntries(templates, "create.templates", makeError, (entry, index) => {
-		const validated = validateTemplateEntry(entry, index, "create.templates", makeError);
-		if (validated.name.startsWith("vite:")) throw makeError(`create.templates[${index}].name uses the reserved \`vite:\` prefix`);
-		return validated;
-	});
-}
-async function fetchPackument(scope, packageName) {
-	const response = await fetchNpmResource(`${getNpmRegistry(scope)}/${packageName}`, {
-		headers: { accept: "application/json" },
-		timeoutMs: 5e3
-	});
-	if (response.status === 404) return null;
-	if (!response.ok) throw new Error(`npm registry responded with ${response.status} for ${packageName}`);
-	return await response.json();
+	const bytes = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		bytes.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return bytes;
 }
 /**
-* Fetch `@scope/create` from the npm registry and parse its `createConfig.templates`
-* manifest.
-*
-* Returns `null` when:
-* - the package does not exist on the registry (404), or
-* - the package exists but has no `createConfig.templates` field
+* Download a package tarball and parse its `package/package.json`.
 *
-* Throws when:
-* - the `createConfig.templates` field is present but malformed (`OrgManifestSchemaError`), or
-* - the registry request fails for any non-404 reason
+* Some registries (GitHub Packages among them) strip fields they don't
+* recognize — including `createConfig` — from packument *version metadata*
+* while preserving the published tarball byte-for-byte. This gives
+* `readOrgManifest` a fallback source of truth for those registries.
 *
-* `requestedVersion` pins the lookup to a specific `versions[...]` entry
-* (equivalent to `vp create @scope@1.2.3`); omit it to resolve `dist-tags.latest`.
+* Returns `null` when the archive contains no `package/package.json`.
+* Throws on download/integrity failures or unparsable JSON.
 */
-async function readOrgManifest(scope, requestedVersion) {
-	if (!scope.startsWith("@")) return null;
-	const packageName = `${scope}/create`;
-	const packument = await fetchPackument(scope, packageName);
-	if (!packument) return null;
-	let resolvedVersion;
-	if (requestedVersion) {
-		resolvedVersion = packument["dist-tags"]?.[requestedVersion] ?? (packument.versions?.[requestedVersion] ? requestedVersion : void 0);
-		if (!resolvedVersion) throw new OrgManifestSchemaError(`version "${requestedVersion}" not found (known tags: ${Object.keys(packument["dist-tags"] ?? {}).join(", ") || "none"})`, packageName);
-	} else {
-		resolvedVersion = packument["dist-tags"]?.latest;
-		if (!resolvedVersion) return null;
+async function readPackageJsonFromTarball(tarballUrl, integrity) {
+	const bytes = await downloadTarball(tarballUrl);
+	verifyIntegrity(bytes, integrity);
+	const entries = await parseTarGzip(bytes);
+	for (const entry of entries) {
+		if (normalizeEntryName(entry.name) !== "package.json" || !entry.data) continue;
+		const text = new TextDecoder().decode(entry.data);
+		try {
+			return JSON.parse(text);
+		} catch {
+			throw new Error(`invalid package.json in tarball: ${tarballUrl}`);
+		}
 	}
-	const meta = packument.versions?.[resolvedVersion];
-	if (!meta) return null;
-	const templates = validateManifest(meta, packageName);
-	if (!templates) return null;
-	if (!meta.dist?.tarball) throw new OrgManifestSchemaError(`missing dist.tarball for ${resolvedVersion}`, packageName);
-	return {
-		scope,
-		packageName,
-		version: resolvedVersion,
-		tarballUrl: meta.dist.tarball,
-		integrity: meta.dist.integrity,
-		templates
-	};
+	return null;
 }
+const STAGING_SUFFIX_PREFIX = ".tmp-";
 /**
-* Apply the in-monorepo filter rule from the RFC: entries with
-* `monorepo: true` are hidden when the command is invoked inside an
-* existing monorepo, mirroring `initial-template-options.ts:9-31`.
+* Parse a tar entry's stored mode (always octal) into the numeric
+* permission bits (low 9 bits — `rwxrwxrwx`). Returns `undefined` when
+* the mode is missing or unparsable so the caller leaves the file with
+* its default (umask-derived) permissions instead of downgrading.
 */
-function filterManifestForContext(templates, isMonorepo) {
-	if (!isMonorepo) return [...templates];
-	return templates.filter((entry) => !entry.monorepo);
-}
-//#endregion
-//#region src/create/templates/types.ts
-const LibraryTemplateRepo = "github:sxzz/tsdown-templates/vite-plus";
-const BuiltinTemplate = {
-	generator: "vite:generator",
-	monorepo: "vite:monorepo",
-	application: "vite:application",
-	library: "vite:library"
-};
-const TemplateType = {
-	builtin: "builtin",
-	bingo: "bingo",
-	remote: "remote",
-	bundled: "bundled"
-};
-//#endregion
-//#region src/create/discovery.ts
-function isGitHubUrl(templateName) {
-	return templateName.startsWith("https://github.com/") || templateName.startsWith("github:") || templateName.includes("github.com/");
-}
-function parseGitHubUrl(url) {
-	if (url.startsWith("github:")) return url.slice(7);
-	const match = url.match(/github\.com\/([^/]+\/[^/]+)/);
-	if (match) return match[1].replace(/\.git$/, "");
-	return null;
+function parseEntryMode(raw) {
+	if (!raw) return;
+	const parsed = Number.parseInt(raw, 8);
+	if (!Number.isFinite(parsed)) return;
+	return parsed & 511;
 }
-function inferGitHubRepoName(templateName) {
-	const degitPath = parseGitHubUrl(templateName);
-	if (!degitPath) return null;
-	return degitPath.split("/").pop() || null;
+/**
+* Strip the `package/` prefix from an `npm pack` tarball entry. Returns
+* `null` for entries to skip (root dir, PaxHeader, anything outside
+* `package/`).
+*/
+function normalizeEntryName(rawName) {
+	const name = rawName.replace(/^\.\//, "").replace(/\\/g, "/");
+	if (!name || name === "package" || name === "package/") return null;
+	if (name.startsWith("PaxHeader/") || name.includes("/PaxHeader/")) return null;
+	if (!name.startsWith("package/")) return null;
+	return name.slice(8);
 }
-function localTemplateDir(workspaceInfo, templateName) {
-	if (isRelativePath(templateName)) return templateName.replace(/^\.\//, "");
-	return workspaceInfo.packages.find((pkg) => pkg.name === templateName)?.path;
+async function extractTarballTo(bytes, destDir) {
+	const entries = await parseTarGzip(bytes);
+	const stagingDir = `${destDir}${STAGING_SUFFIX_PREFIX}${process.pid}-${Date.now()}`;
+	await fs.promises.mkdir(stagingDir, { recursive: true });
+	const resolvedStaging = path.resolve(stagingDir);
+	try {
+		for (const entry of entries) {
+			const relativeName = normalizeEntryName(entry.name);
+			if (relativeName === null) continue;
+			const targetPath = path.join(stagingDir, relativeName);
+			const resolvedTarget = path.resolve(targetPath);
+			if (resolvedTarget !== resolvedStaging && !resolvedTarget.startsWith(`${resolvedStaging}${path.sep}`)) throw new Error(`tarball entry escapes extraction root: ${entry.name}`);
+			if (entry.type === "directory" || relativeName.endsWith("/")) {
+				await fs.promises.mkdir(targetPath, { recursive: true });
+				continue;
+			}
+			await fs.promises.mkdir(path.dirname(targetPath), { recursive: true });
+			const data = entry.data ?? /* @__PURE__ */ new Uint8Array(0);
+			await fs.promises.writeFile(targetPath, data);
+			const mode = parseEntryMode(entry.attrs?.mode);
+			if (mode !== void 0) await fs.promises.chmod(targetPath, mode);
+		}
+		try {
+			await fs.promises.rename(stagingDir, destDir);
+		} catch (error) {
+			const code = error.code;
+			if ((code === "ENOTEMPTY" || code === "EEXIST") && fs.existsSync(path.join(destDir, "package.json"))) {
+				await fs.promises.rm(stagingDir, {
+					recursive: true,
+					force: true
+				}).catch(() => {});
+				return;
+			}
+			throw error;
+		}
+	} catch (error) {
+		await fs.promises.rm(stagingDir, {
+			recursive: true,
+			force: true
+		}).catch(() => {});
+		throw error;
+	}
 }
-function resolveLocalBinPath(localPackagePath, packageName, bin) {
-	if (!bin) return;
-	if (typeof bin === "string") return path.join(localPackagePath, bin);
-	const entries = Object.entries(bin);
-	if (entries.length === 0) return;
-	if (entries.length === 1) return path.join(localPackagePath, entries[0][1]);
-	const unscopedName = packageName.slice(packageName.lastIndexOf("/") + 1);
-	const preferred = bin[packageName] ?? bin[unscopedName];
-	if (preferred) return path.join(localPackagePath, preferred);
-	throw new Error(`Local template package "${packageName}" defines multiple "bin" entries (${entries.map(([name]) => name).join(", ")}); add a "bin" entry named "${packageName}" so the template entry is unambiguous`);
-}
-function discoverTemplate(templateName, templateArgs, workspaceInfo, interactive, bundledLocalPath, skipShorthand, localTemplate) {
-	const envs = prependToPathToEnvs(workspaceInfo.downloadPackageManager.binPrefix, { ...process.env });
-	const parentDir = inferParentDir(templateName, workspaceInfo, localTemplate);
-	if (bundledLocalPath) return {
-		command: "",
-		args: [...templateArgs],
-		envs,
-		type: TemplateType.bundled,
-		parentDir,
-		interactive,
-		localPath: bundledLocalPath
-	};
-	if (templateName.startsWith("vite:")) return {
-		command: templateName,
-		args: [...templateArgs],
-		envs,
-		type: TemplateType.builtin,
-		parentDir,
-		interactive
-	};
-	if (isGitHubUrl(templateName)) {
-		const degitPath = parseGitHubUrl(templateName);
-		if (degitPath) return {
-			command: "degit",
-			args: [degitPath, ...templateArgs],
-			envs,
-			type: TemplateType.remote,
-			parentDir,
-			interactive
-		};
-	}
-	if (localTemplate) {
-		const localDir = localTemplateDir(workspaceInfo, templateName);
-		if (!localDir) throw new Error(`Local template "${templateName}" does not match any workspace package; update the \`create.templates\` entry in vite.config.ts`);
-		const localPackagePath = path.join(workspaceInfo.rootDir, localDir);
-		const packageJsonPath = path.join(localPackagePath, "package.json");
-		if (!fs.existsSync(packageJsonPath)) throw new Error(`Local template "${templateName}" has no package.json, so it cannot be run as a template`);
-		const pkg = readJsonFile(packageJsonPath);
-		const binPath = resolveLocalBinPath(localPackagePath, pkg.name ?? templateName, pkg.bin);
-		if (!binPath) throw new Error(`Local template "${templateName}" has no "bin" entry in its package.json, so it cannot be run as a template`);
-		const args = [binPath, ...templateArgs];
-		let type = TemplateType.remote;
-		if (isBingoTemplate(pkg)) {
-			type = TemplateType.bingo;
-			args.push("--skip-requests");
-		}
-		return {
-			command: "node",
-			args,
-			envs,
-			type,
-			parentDir,
-			interactive
-		};
+const STAGING_STALE_MS = 1440 * 60 * 1e3;
+/**
+* Remove `<destDir>.tmp-*` siblings left behind by a previous crash so
+* repeated aborts don't accumulate orphaned staging trees. Only deletes
+* entries whose mtime is older than 24 hours — a concurrent `vp create`
+* that's still actively extracting will always be younger than that, so
+* the age gate keeps this safe to run at the top of every extract.
+*/
+async function cleanupStaleStagingDirs(destDir) {
+	const parent = path.dirname(destDir);
+	const prefix = `${path.basename(destDir)}${STAGING_SUFFIX_PREFIX}`;
+	let entries;
+	try {
+		entries = await fs.promises.readdir(parent);
+	} catch {
+		return;
 	}
-	return {
-		command: skipShorthand ? templateName : expandCreateShorthand(templateName),
-		args: [...templateArgs],
-		envs,
-		type: TemplateType.remote,
-		parentDir,
-		interactive
-	};
+	const cutoff = Date.now() - STAGING_STALE_MS;
+	await Promise.all(entries.filter((name) => name.startsWith(prefix)).map(async (name) => {
+		const fullPath = path.join(parent, name);
+		try {
+			if ((await fs.promises.stat(fullPath)).mtimeMs < cutoff) await fs.promises.rm(fullPath, {
+				recursive: true,
+				force: true
+			});
+		} catch {}
+	}));
 }
 /**
-* Expand shorthand template names to their full `create-*` package names.
-*
-* This follows the same convention as `npm create` / `pnpm create`:
-* - `vite` → `create-vite`
-* - `vite@latest` → `create-vite@latest`
-*
-* Special cases for packages where the convention doesn't work:
-* - `nitro` → `create-nitro-app` (create-nitro is abandoned)
-* - `svelte` → `sv`
-* - `@tanstack/start` → `@tanstack/cli` (@tanstack/create-start is deprecated)
+* Ensure the `@org/create` package tarball for the given manifest has been
+* downloaded and extracted locally. Returns the absolute path to the
+* extracted package root (i.e. the directory that contains
+* `package.json`).
 *
-* Skips expansion for:
-* - Builtin templates (`vite:*`)
-* - GitHub URLs
-* - Local paths (`./`, `../`, `/`)
-* - Names already starting with `create-` (or `@scope/create-`)
+* Idempotent: subsequent calls for the same `<scope, version>` reuse the
+* cached extraction. Concurrent calls race on the final rename; the loser
+* cleans up and returns the existing directory.
 */
-function expandCreateShorthand(templateName) {
-	if (templateName.includes(":")) return templateName;
-	if (isGitHubUrl(templateName)) return templateName;
-	if (templateName.startsWith("./") || templateName.startsWith("../") || templateName.startsWith("/")) return templateName;
-	if (templateName.startsWith("@")) {
-		const slashIndex = templateName.indexOf("/");
-		if (slashIndex === -1) {
-			const atIndex = templateName.indexOf("@", 1);
-			return `${atIndex === -1 ? templateName : templateName.slice(0, atIndex)}/create${atIndex === -1 ? "" : templateName.slice(atIndex)}`;
-		}
-		const scope = templateName.slice(0, slashIndex);
-		const rest = templateName.slice(slashIndex + 1);
-		const atIndex = rest.indexOf("@");
-		const name = atIndex === -1 ? rest : rest.slice(0, atIndex);
-		const version = atIndex === -1 ? "" : rest.slice(atIndex);
-		if (name.startsWith("create-")) return templateName;
-		if (scope === "@tanstack" && name === "start") return `@tanstack/cli${version}`;
-		return `${scope}/create-${name}${version}`;
-	}
-	const atIndex = templateName.indexOf("@");
-	const name = atIndex === -1 ? templateName : templateName.slice(0, atIndex);
-	const version = atIndex === -1 ? "" : templateName.slice(atIndex);
-	if (name.startsWith("create-")) return templateName;
-	if (name === "nitro") return `create-nitro-app${version}`;
-	if (name === "svelte") return `sv${version}`;
-	return `create-${name}${version}`;
-}
-function inferParentDir(templateName, workspaceInfo, localTemplate = false) {
-	if (workspaceInfo.parentDirs.length === 0) return;
-	const localDir = localTemplate ? localTemplateDir(workspaceInfo, templateName) : void 0;
-	if (localDir) {
-		const ownParentDir = path.dirname(localDir);
-		if (workspaceInfo.parentDirs.includes(ownParentDir)) return ownParentDir;
-	}
-	let rule = /app/i;
-	if (templateName === BuiltinTemplate.library) rule = /lib|component|package/i;
-	else if (templateName === BuiltinTemplate.generator) rule = /generator|tool/i;
-	for (const parentDir of workspaceInfo.parentDirs) if (rule.test(parentDir)) return parentDir;
+async function ensureOrgPackageExtracted(manifest) {
+	const extractedRoot = getExtractionDir(manifest);
+	if (fs.existsSync(path.join(extractedRoot, "package.json"))) return extractedRoot;
+	const parent = path.dirname(extractedRoot);
+	await fs.promises.mkdir(parent, { recursive: true });
+	await cleanupStaleStagingDirs(extractedRoot);
+	const bytes = await downloadTarball(manifest.tarballUrl);
+	verifyIntegrity(bytes, manifest.integrity);
+	await extractTarballTo(bytes, extractedRoot);
+	return extractedRoot;
 }
-//#endregion
-//#region src/create/initial-template-options.ts
-function getInitialTemplateOptions(isMonorepo, templates = []) {
-	return [
-		...!isMonorepo ? [{
-			label: "Vite+ Monorepo",
-			value: BuiltinTemplate.monorepo,
-			hint: "Create a new Vite+ monorepo project"
-		}] : [],
-		{
-			label: "Vite+ Application",
-			value: BuiltinTemplate.application,
-			hint: "Create vite applications"
-		},
-		{
-			label: "Vite+ Library",
-			value: BuiltinTemplate.library,
-			hint: "Create vite libraries"
-		},
-		...isMonorepo ? templates.map((entry) => ({
-			label: entry.name,
-			value: entry.name,
-			hint: entry.description
-		})) : []
-	];
+/**
+* Resolve a manifest entry's relative `./...` path against an already-
+* extracted package root, rejecting any path that escapes the root (via
+* `..` walks or an absolute specifier).
+*
+* Existence is NOT checked here — the subsequent `copyDir` surfaces any
+* missing-directory error with a clearer errno.
+*/
+function resolveBundledPath(extractedRoot, relativePath) {
+	if (path.isAbsolute(relativePath)) throw new Error(`bundled template path must be relative, got ${relativePath}`);
+	const resolvedRoot = path.resolve(extractedRoot);
+	const resolvedTarget = path.resolve(extractedRoot, relativePath);
+	if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) throw new Error(`bundled template path escapes the package root: ${relativePath}`);
+	return resolvedTarget;
 }
 //#endregion
-//#region src/create/org-picker.ts
-const ORG_PICKER_CANCEL = Symbol("org-picker-cancel");
-const ORG_PICKER_BUILTIN_ESCAPE = Symbol("org-picker-builtin-escape");
-const ESCAPE_HATCH = Symbol("builtin-escape");
+//#region src/create/org-manifest.ts
 /**
-* Render the interactive picker for an org manifest. Always appends a
-* trailing "Vite+ built-in templates" escape-hatch entry.
+* Parse the org picker specifier: `@scope` (scope only → picker) or
+* `@scope:name` (direct manifest-entry selection). Colon mirrors the
+* existing `vite:monorepo` / `vite:library` builtin-template syntax and
+* keeps manifest entries syntactically distinct from real
+* `@scope/package-name` npm specifiers.
 *
-* Context-filters entries with `monorepo: true` when running inside an
-* existing monorepo, mirroring `initial-template-options.ts:9-31`.
+* Returns `null` for anything else — including the plain `@scope/name`
+* form, which routes to the existing `@scope/create-name` shorthand as
+* it did before the org-manifest feature.
 *
-* Returns `ORG_PICKER_BUILTIN_ESCAPE` when the escape hatch is selected,
-* or `ORG_PICKER_CANCEL` when the user hits Ctrl-C.
+* The optional `version` suffix (`@scope@1.2.3`, `@scope:name@1.2.3`)
+* pins `@scope/create` to a specific release rather than `dist-tags.latest`.
 */
-async function pickOrgTemplate(manifest, opts) {
-	const filtered = filterManifestForContext(manifest.templates, opts.isMonorepo);
-	if (filtered.length === 0) return ORG_PICKER_BUILTIN_ESCAPE;
-	const escapeValue = `__vp_builtin_escape__::${randomUUID()}`;
-	const lookup = /* @__PURE__ */ new Map();
-	const options = filtered.map((entry) => {
-		lookup.set(entry.name, entry);
-		return {
-			value: entry.name,
-			label: entry.name,
-			hint: entry.description
-		};
-	});
-	lookup.set(escapeValue, ESCAPE_HATCH);
-	const builtinHint = opts.isMonorepo ? "Use defaults (application / library)" : "Use defaults (monorepo / application / library)";
-	options.push({
-		value: escapeValue,
-		label: "Vite+ built-in templates",
-		hint: builtinHint
-	});
-	const picked = await select({
-		message: `Pick a template from ${manifest.scope}`,
-		options
-	});
-	if (R(picked)) return ORG_PICKER_CANCEL;
-	const found = lookup.get(picked);
-	if (found === ESCAPE_HATCH) return ORG_PICKER_BUILTIN_ESCAPE;
-	if (!found) throw new Error(`org-picker: prompts.select returned an unregistered value: ${picked}`);
-	return {
-		kind: "entry",
-		entry: found
+function parseOrgScopedSpec(spec) {
+	if (!spec.startsWith("@")) return null;
+	if (spec.includes("/")) return null;
+	const colonIndex = spec.indexOf(":");
+	if (colonIndex === -1) {
+		const atIndex = spec.indexOf("@", 1);
+		if (atIndex === -1) return { scope: spec };
+		const version = spec.slice(atIndex + 1);
+		return version ? {
+			scope: spec.slice(0, atIndex),
+			version
+		} : { scope: spec.slice(0, atIndex) };
+	}
+	const scope = spec.slice(0, colonIndex);
+	const rest = spec.slice(colonIndex + 1);
+	const atIndex = rest.indexOf("@");
+	const name = atIndex === -1 ? rest : rest.slice(0, atIndex);
+	const version = atIndex === -1 ? "" : rest.slice(atIndex + 1);
+	if (!name) return version ? {
+		scope,
+		version
+	} : { scope };
+	return version ? {
+		scope,
+		name,
+		version
+	} : {
+		scope,
+		name
 	};
 }
 /**
-* Render the manifest as a plain-text table for the `--no-interactive`
-* error output. Fixed column order so AI agents and scripts can recover
-* available template names without a `--json` flag.
+* Schema-level failure. Never falls through silently — a maintainer who
+* shipped an invalid manifest should see the offending field.
 */
-function formatManifestTable(manifest, isMonorepo) {
-	const visible = filterManifestForContext(manifest.templates, isMonorepo);
-	const filteredCount = manifest.templates.length - visible.length;
-	const nameWidth = Math.max(4, ...visible.map((entry) => entry.name.length));
-	const descWidth = Math.max(11, ...visible.map((entry) => entry.description.length));
-	const lines = [];
-	lines.push(`  ${"NAME".padEnd(nameWidth)}  ${"DESCRIPTION".padEnd(descWidth)}  TEMPLATE`);
-	for (const entry of visible) lines.push(`  ${entry.name.padEnd(nameWidth)}  ${entry.description.padEnd(descWidth)}  ${entry.template}`);
+var OrgManifestSchemaError = class extends Error {
+	packageName;
+	constructor(message, packageName) {
+		super(`${packageName}: ${message}`);
+		this.packageName = packageName;
+		this.name = "OrgManifestSchemaError";
+	}
+};
+function isRelativePath(spec) {
+	return spec.startsWith("./") || spec.startsWith("../");
+}
+/**
+* Validate the `{ name, description, template }` fields shared by org manifest
+* entries and local `create.templates` entries. `label` is the config path
+* used in error messages (e.g. `createConfig.templates` or `create.templates`)
+* and `makeError` builds the thrown error so each source uses its own type.
+*/
+function validateTemplateEntry(entry, index, label, makeError) {
+	if (!entry || typeof entry !== "object") throw makeError(`${label}[${index}] must be an object`);
+	const raw = entry;
+	const requireString = (field) => {
+		const value = raw[field];
+		if (typeof value !== "string" || value.length === 0) throw makeError(`${label}[${index}].${field} must be a non-empty string`);
+		return value;
+	};
+	const name = requireString("name");
+	if (name.startsWith("__vp_")) throw makeError(`${label}[${index}].name uses the reserved \`__vp_\` prefix`);
+	const description = requireString("description");
+	const template = requireString("template");
+	if (isRelativePath(template)) {
+		const resolved = path.posix.resolve("/root", template.replaceAll("\\", "/"));
+		if (resolved !== "/root" && !resolved.startsWith("/root/")) throw makeError(`${label}[${index}].template escapes the package root: ${template}`);
+	}
 	return {
-		lines,
-		filteredCount
+		name,
+		description,
+		template
 	};
 }
-//#endregion
-//#region ../../node_modules/.pnpm/nanotar@0.3.0/node_modules/nanotar/dist/index.mjs
-const tarItemTypeMap = {
-	"0": "file",
-	"1": "hardLink",
-	"2": "symbolicLink",
-	"3": "characterDevice",
-	"4": "blockDevice",
-	"5": "directory",
-	"6": "fifo",
-	"7": "contiguousFile",
-	"g": "globalExtendedHeader",
-	"x": "extendedHeader",
-	"D": "gnuDirectory",
-	"I": "gnuInodeMetadata",
-	"K": "gnuLongLinkName",
-	"L": "gnuLongFileName",
-	"N": "gnuOldLongFileName",
-	"M": "gnuMultiVolume",
-	"S": "gnuSparseFile",
-	"E": "gnuExtendedSparse",
-	"A": "solarisAcl",
-	"V": "solarisVolumeLabel",
-	"X": "solarisOldExtendedHeader"
-};
-function parseTar(data, opts) {
-	const buffer = data.buffer || data;
-	const files = [];
-	let offset = 0;
-	let nextExtendedHeader;
-	let globalExtendedHeader;
-	while (offset < buffer.byteLength - 512) {
-		let name = _readString(buffer, offset, 100);
-		if (name.length === 0) break;
-		if (nextExtendedHeader) {
-			const longName = nextExtendedHeader.path || nextExtendedHeader.linkpath;
-			if (longName) name = longName;
-		}
-		const mode = _readString(buffer, offset + 100, 8).trim();
-		const uid = Number.parseInt(_readString(buffer, offset + 108, 8));
-		const gid = Number.parseInt(_readString(buffer, offset + 116, 8));
-		const size = _readNumber(buffer, offset + 124, 12);
-		const seek = 512 + 512 * Math.trunc(size / 512) + (size % 512 ? 512 : 0);
-		const mtime = _readNumber(buffer, offset + 136, 12);
-		const _type = _readString(buffer, offset + 156, 1) || "0";
-		const type = tarItemTypeMap[_type] || _type;
-		switch (type) {
-			case "extendedHeader":
-			case "globalExtendedHeader": {
-				const headers = _parseExtendedHeaders(new Uint8Array(buffer, offset + 512, size));
-				if (type === "extendedHeader") nextExtendedHeader = headers;
-				else {
-					nextExtendedHeader = void 0;
-					globalExtendedHeader = {
-						...globalExtendedHeader,
-						...headers
-					};
-				}
-				offset += seek;
-				continue;
-			}
-			case "gnuLongFileName":
-			case "gnuOldLongFileName":
-			case "gnuLongLinkName":
-				nextExtendedHeader = { path: _readString(buffer, offset + 512, size) };
-				offset += seek;
-				continue;
-		}
-		const user = _readString(buffer, offset + 265, 32);
-		const group = _readString(buffer, offset + 297, 32);
-		name = _sanitizePath(name);
-		const meta = {
-			name,
-			type,
-			size,
-			attrs: {
-				...globalExtendedHeader,
-				...nextExtendedHeader,
-				mode,
-				uid,
-				gid,
-				mtime,
-				user,
-				group
-			}
-		};
-		nextExtendedHeader = void 0;
-		if (opts?.filter && !opts.filter(meta)) {
-			offset += seek;
-			continue;
-		}
-		if (opts?.metaOnly) {
-			files.push(meta);
-			offset += seek;
-			continue;
-		}
-		const data2 = size === 0 ? void 0 : new Uint8Array(buffer, offset + 512, size);
-		files.push({
-			...meta,
-			data: data2,
-			get text() {
-				return new TextDecoder().decode(this.data);
-			}
-		});
-		offset += seek;
+/**
+* Validate a list of entries, rejecting duplicate `name`s. Shared by org
+* manifests and local `create.templates`.
+*/
+function validateTemplateEntries(templates, label, makeError, validateOne) {
+	const entries = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (let index = 0; index < templates.length; index += 1) {
+		const entry = validateOne(templates[index], index);
+		if (seen.has(entry.name)) throw makeError(`${label}[${index}].name duplicates an earlier entry: "${entry.name}"`);
+		seen.add(entry.name);
+		entries.push(entry);
 	}
-	return files;
-}
-async function parseTarGzip(data, opts = {}) {
-	const stream = new ReadableStream({ start(controller) {
-		controller.enqueue(new Uint8Array(data));
-		controller.close();
-	} }).pipeThrough(new DecompressionStream(opts.compression ?? "gzip"));
-	return parseTar(await new Response(stream).arrayBuffer(), opts);
-}
-function _sanitizePath(path) {
-	let normalized = path.replace(/\\/g, "/");
-	normalized = normalized.replace(/^[a-zA-Z]:\//, "");
-	normalized = normalized.replace(/^\/+/, "");
-	const hasLeadingDotSlash = normalized.startsWith("./");
-	const parts = normalized.split("/");
-	const resolved = [];
-	for (const part of parts) if (part === "..") resolved.pop();
-	else if (part !== "." && part !== "") resolved.push(part);
-	let result = resolved.join("/");
-	if (hasLeadingDotSlash && !result.startsWith("./")) result = "./" + result;
-	if (path.endsWith("/") && !result.endsWith("/")) result += "/";
-	return result;
+	return entries;
 }
-function _readString(buffer, offset, size) {
-	const view = new Uint8Array(buffer, offset, size);
-	const i = view.indexOf(0);
-	return new TextDecoder().decode(i === -1 ? view : view.slice(0, i));
+function validateEntry(entry, index, packageName) {
+	const makeError = (message) => new OrgManifestSchemaError(message, packageName);
+	const base = validateTemplateEntry(entry, index, "createConfig.templates", makeError);
+	let monorepo;
+	const raw = entry;
+	if (raw.monorepo !== void 0) {
+		if (typeof raw.monorepo !== "boolean") throw makeError(`createConfig.templates[${index}].monorepo must be a boolean`);
+		monorepo = raw.monorepo;
+	}
+	return {
+		...base,
+		...monorepo !== void 0 ? { monorepo } : {}
+	};
 }
-function _readNumber(buffer, offset, size) {
-	const view = new Uint8Array(buffer, offset, size);
-	let str = "";
-	for (let i = 0; i < size; i++) str += String.fromCodePoint(view[i]);
-	return Number.parseInt(str, 8);
+function validateManifest(raw, packageName) {
+	if (!raw || typeof raw !== "object") return null;
+	const createConfig = raw.createConfig;
+	if (!createConfig || typeof createConfig !== "object") return null;
+	const templates = createConfig.templates;
+	if (templates === void 0) return null;
+	if (!Array.isArray(templates)) throw new OrgManifestSchemaError("createConfig.templates must be an array", packageName);
+	if (templates.length === 0) return null;
+	return validateTemplateEntries(templates, "createConfig.templates", (message) => new OrgManifestSchemaError(message, packageName), (entry, index) => validateEntry(entry, index, packageName));
 }
-function _parseExtendedHeaders(data) {
-	const dataStr = new TextDecoder().decode(data);
-	const headers = {};
-	for (const line of dataStr.split("\n")) {
-		const s = line.split(" ")[1]?.split("=");
-		if (s) headers[s[0]] = s[1];
+/**
+* Schema-level failure for `create.templates` in `vite.config.ts`. A misconfigured
+* local template should surface clearly rather than silently disappear.
+*/
+var CreateConfigSchemaError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "CreateConfigSchemaError";
 	}
-	return headers;
+};
+/**
+* Validate `create.templates` from `vite.config.ts`. Returns `[]` when the field
+* is absent or an empty array; throws {@link CreateConfigSchemaError} when present
+* but malformed.
+*/
+function validateCreateTemplates(templates) {
+	if (templates === void 0) return [];
+	if (!Array.isArray(templates)) throw new CreateConfigSchemaError("create.templates must be an array");
+	const makeError = (message) => new CreateConfigSchemaError(message);
+	return validateTemplateEntries(templates, "create.templates", makeError, (entry, index) => {
+		const validated = validateTemplateEntry(entry, index, "create.templates", makeError);
+		if (validated.name.startsWith("vite:")) throw makeError(`create.templates[${index}].name uses the reserved \`vite:\` prefix`);
+		return validated;
+	});
 }
-//#endregion
-//#region src/create/org-tarball.ts
-function getCacheRoot() {
-	const home = process.env.VP_HOME || path.join(os.homedir(), ".vite-plus");
-	return path.join(home, "tmp", "create-org");
+async function fetchPackument(scope, packageName) {
+	const response = await fetchNpmResource(`${getNpmRegistry(scope)}/${packageName}`, {
+		headers: { accept: "application/json" },
+		timeoutMs: 5e3
+	});
+	if (response.status === 404) return null;
+	if (!response.ok) throw new Error(`npm registry responded with ${response.status} for ${packageName}`);
+	return await response.json();
 }
 /**
-* Replace characters that are illegal in Windows path segments
-* (`\ / : * ? " < > |` plus the IPv6 bracket pair `[ ]`). The host
-* comes from `new URL(...).host` which can carry a port (`:4873`) or
-* IPv6 literal (`[::1]`); both end up in the cache path otherwise.
+* Fetch `@scope/create` from the npm registry and parse its `createConfig.templates`
+* manifest.
+*
+* Returns `null` when:
+* - the package does not exist on the registry (404), or
+* - the package exists but has no `createConfig.templates` field
+*
+* When the packument version metadata lacks `createConfig` entirely, the
+* published tarball's package.json is consulted before giving up — some
+* registries (GitHub Packages among them) strip custom fields from version
+* metadata while preserving the tarball byte-for-byte.
+*
+* Throws when:
+* - the `createConfig.templates` field is present but malformed (`OrgManifestSchemaError`), or
+* - the registry request fails for any non-404 reason
+*
+* `requestedVersion` pins the lookup to a specific `versions[...]` entry
+* (equivalent to `vp create @scope@1.2.3`); omit it to resolve `dist-tags.latest`.
 */
-function sanitizeHostForPath(host) {
-	return host.replaceAll(/[\\/:*?"<>|[\]]/g, "_");
+async function readOrgManifest(scope, requestedVersion) {
+	if (!scope.startsWith("@")) return null;
+	const packageName = `${scope}/create`;
+	const packument = await fetchPackument(scope, packageName);
+	if (!packument) return null;
+	let resolvedVersion;
+	if (requestedVersion) {
+		resolvedVersion = packument["dist-tags"]?.[requestedVersion] ?? (packument.versions?.[requestedVersion] ? requestedVersion : void 0);
+		if (!resolvedVersion) throw new OrgManifestSchemaError(`version "${requestedVersion}" not found (known tags: ${Object.keys(packument["dist-tags"] ?? {}).join(", ") || "none"})`, packageName);
+	} else {
+		resolvedVersion = packument["dist-tags"]?.latest;
+		if (!resolvedVersion) return null;
+	}
+	const meta = packument.versions?.[resolvedVersion];
+	if (!meta) return null;
+	let templates = validateManifest(meta, packageName);
+	if (!templates && meta.createConfig === void 0 && meta.dist?.tarball) templates = validateManifest(await readPackageJsonFromTarball(meta.dist.tarball, meta.dist.integrity).catch(() => null), packageName);
+	if (!templates) return null;
+	if (!meta.dist?.tarball) throw new OrgManifestSchemaError(`missing dist.tarball for ${resolvedVersion}`, packageName);
+	return {
+		scope,
+		packageName,
+		version: resolvedVersion,
+		tarballUrl: meta.dist.tarball,
+		integrity: meta.dist.integrity,
+		templates
+	};
 }
 /**
-* Cache extracted tarballs under `<host>/<scope>/create/<version>` so two
-* repos resolving the same `<scope>@<version>` through different registries
-* (via `.npmrc` scope mappings) don't share a cache slot. The registry
-* guarantees `manifest.tarballUrl` is a valid URL, so any parse failure
-* here is a real bug worth surfacing.
+* Apply the in-monorepo filter rule from the RFC: entries with
+* `monorepo: true` are hidden when the command is invoked inside an
+* existing monorepo, mirroring `initial-template-options.ts:9-31`.
 */
-function getExtractionDir(manifest) {
-	const { host } = new URL(manifest.tarballUrl);
-	return path.join(getCacheRoot(), sanitizeHostForPath(host), manifest.scope, "create", manifest.version);
+function filterManifestForContext(templates, isMonorepo) {
+	if (!isMonorepo) return [...templates];
+	return templates.filter((entry) => !entry.monorepo);
 }
-function parseIntegrity(integrity) {
-	const match = integrity.split(/\s+/)[0].match(/^(sha\d+)-(.+)$/);
-	if (!match) return null;
-	return {
-		algorithm: match[1],
-		expected: match[2]
-	};
+//#endregion
+//#region src/create/templates/types.ts
+const LibraryTemplateRepo = "github:sxzz/tsdown-templates/vite-plus";
+const BuiltinTemplate = {
+	generator: "vite:generator",
+	monorepo: "vite:monorepo",
+	application: "vite:application",
+	library: "vite:library"
+};
+const TemplateType = {
+	builtin: "builtin",
+	bingo: "bingo",
+	remote: "remote",
+	bundled: "bundled"
+};
+//#endregion
+//#region src/create/discovery.ts
+function isGitHubUrl(templateName) {
+	return templateName.startsWith("https://github.com/") || templateName.startsWith("github:") || templateName.includes("github.com/");
 }
-function verifyIntegrity(bytes, integrity) {
-	if (!integrity) return;
-	const parsed = parseIntegrity(integrity);
-	if (!parsed) return;
-	const hash = createHash(parsed.algorithm);
-	hash.update(bytes);
-	const actual = hash.digest("base64");
-	if (actual !== parsed.expected) throw new Error(`integrity check failed: expected ${integrity}, got ${parsed.algorithm}-${actual}`);
+function parseGitHubUrl(url) {
+	if (url.startsWith("github:")) return url.slice(7);
+	const match = url.match(/github\.com\/([^/]+\/[^/]+)/);
+	if (match) return match[1].replace(/\.git$/, "");
+	return null;
 }
-const MAX_TARBALL_BYTES = 50 * 1024 * 1024;
-async function downloadTarball(url) {
-	const response = await fetchNpmResource(url, { timeoutMs: 3e4 });
-	if (!response.ok) throw new Error(`failed to download tarball (${response.status}): ${url}`);
-	const contentLength = Number(response.headers.get("content-length"));
-	if (Number.isFinite(contentLength) && contentLength > MAX_TARBALL_BYTES) throw new Error(`tarball exceeds ${MAX_TARBALL_BYTES} byte size limit: ${url}`);
-	const reader = response.body?.getReader();
-	if (!reader) throw new Error(`tarball response has no body: ${url}`);
-	const chunks = [];
-	let total = 0;
-	while (true) {
-		const { done, value } = await reader.read();
-		if (done) break;
-		total += value.byteLength;
-		if (total > MAX_TARBALL_BYTES) {
-			await reader.cancel();
-			throw new Error(`tarball exceeds ${MAX_TARBALL_BYTES} byte size limit: ${url}`);
-		}
-		chunks.push(value);
-	}
-	const bytes = new Uint8Array(total);
-	let offset = 0;
-	for (const chunk of chunks) {
-		bytes.set(chunk, offset);
-		offset += chunk.byteLength;
-	}
-	return bytes;
+function inferGitHubRepoName(templateName) {
+	const degitPath = parseGitHubUrl(templateName);
+	if (!degitPath) return null;
+	return degitPath.split("/").pop() || null;
 }
-const STAGING_SUFFIX_PREFIX = ".tmp-";
-/**
-* Parse a tar entry's stored mode (always octal) into the numeric
-* permission bits (low 9 bits — `rwxrwxrwx`). Returns `undefined` when
-* the mode is missing or unparsable so the caller leaves the file with
-* its default (umask-derived) permissions instead of downgrading.
-*/
-function parseEntryMode(raw) {
-	if (!raw) return;
-	const parsed = Number.parseInt(raw, 8);
-	if (!Number.isFinite(parsed)) return;
-	return parsed & 511;
+function localTemplateDir(workspaceInfo, templateName) {
+	if (isRelativePath(templateName)) return templateName.replace(/^\.\//, "");
+	return workspaceInfo.packages.find((pkg) => pkg.name === templateName)?.path;
+}
+function resolveLocalBinPath(localPackagePath, packageName, bin) {
+	if (!bin) return;
+	if (typeof bin === "string") return path.join(localPackagePath, bin);
+	const entries = Object.entries(bin);
+	if (entries.length === 0) return;
+	if (entries.length === 1) return path.join(localPackagePath, entries[0][1]);
+	const unscopedName = packageName.slice(packageName.lastIndexOf("/") + 1);
+	const preferred = bin[packageName] ?? bin[unscopedName];
+	if (preferred) return path.join(localPackagePath, preferred);
+	throw new Error(`Local template package "${packageName}" defines multiple "bin" entries (${entries.map(([name]) => name).join(", ")}); add a "bin" entry named "${packageName}" so the template entry is unambiguous`);
+}
+function discoverTemplate(templateName, templateArgs, workspaceInfo, interactive, bundledLocalPath, skipShorthand, localTemplate) {
+	const envs = prependToPathToEnvs(workspaceInfo.downloadPackageManager.binPrefix, { ...process.env });
+	const parentDir = inferParentDir(templateName, workspaceInfo, localTemplate);
+	if (bundledLocalPath) return {
+		command: "",
+		args: [...templateArgs],
+		envs,
+		type: TemplateType.bundled,
+		parentDir,
+		interactive,
+		localPath: bundledLocalPath
+	};
+	if (templateName.startsWith("vite:")) return {
+		command: templateName,
+		args: [...templateArgs],
+		envs,
+		type: TemplateType.builtin,
+		parentDir,
+		interactive
+	};
+	if (isGitHubUrl(templateName)) {
+		const degitPath = parseGitHubUrl(templateName);
+		if (degitPath) return {
+			command: "degit",
+			args: [degitPath, ...templateArgs],
+			envs,
+			type: TemplateType.remote,
+			parentDir,
+			interactive
+		};
+	}
+	if (localTemplate) {
+		const localDir = localTemplateDir(workspaceInfo, templateName);
+		if (!localDir) throw new Error(`Local template "${templateName}" does not match any workspace package; update the \`create.templates\` entry in vite.config.ts`);
+		const localPackagePath = path.join(workspaceInfo.rootDir, localDir);
+		const packageJsonPath = path.join(localPackagePath, "package.json");
+		if (!fs.existsSync(packageJsonPath)) throw new Error(`Local template "${templateName}" has no package.json, so it cannot be run as a template`);
+		const pkg = readJsonFile(packageJsonPath);
+		const binPath = resolveLocalBinPath(localPackagePath, pkg.name ?? templateName, pkg.bin);
+		if (!binPath) throw new Error(`Local template "${templateName}" has no "bin" entry in its package.json, so it cannot be run as a template`);
+		const args = [binPath, ...templateArgs];
+		let type = TemplateType.remote;
+		if (isBingoTemplate(pkg)) {
+			type = TemplateType.bingo;
+			args.push("--skip-requests");
+		}
+		return {
+			command: "node",
+			args,
+			envs,
+			type,
+			parentDir,
+			interactive
+		};
+	}
+	return {
+		command: skipShorthand ? templateName : expandCreateShorthand(templateName),
+		args: [...templateArgs],
+		envs,
+		type: TemplateType.remote,
+		parentDir,
+		interactive
+	};
 }
 /**
-* Strip the `package/` prefix from an `npm pack` tarball entry. Returns
-* `null` for entries to skip (root dir, PaxHeader, anything outside
-* `package/`).
+* Expand shorthand template names to their full `create-*` package names.
+*
+* This follows the same convention as `npm create` / `pnpm create`:
+* - `vite` → `create-vite`
+* - `vite@latest` → `create-vite@latest`
+*
+* Special cases for packages where the convention doesn't work:
+* - `nitro` → `create-nitro-app` (create-nitro is abandoned)
+* - `svelte` → `sv`
+* - `@tanstack/start` → `@tanstack/cli` (@tanstack/create-start is deprecated)
+*
+* Skips expansion for:
+* - Builtin templates (`vite:*`)
+* - GitHub URLs
+* - Local paths (`./`, `../`, `/`)
+* - Names already starting with `create-` (or `@scope/create-`)
 */
-function normalizeEntryName(rawName) {
-	const name = rawName.replace(/^\.\//, "").replace(/\\/g, "/");
-	if (!name || name === "package" || name === "package/") return null;
-	if (name.startsWith("PaxHeader/") || name.includes("/PaxHeader/")) return null;
-	if (!name.startsWith("package/")) return null;
-	return name.slice(8);
-}
-async function extractTarballTo(bytes, destDir) {
-	const entries = await parseTarGzip(bytes);
-	const stagingDir = `${destDir}${STAGING_SUFFIX_PREFIX}${process.pid}-${Date.now()}`;
-	await fs.promises.mkdir(stagingDir, { recursive: true });
-	const resolvedStaging = path.resolve(stagingDir);
-	try {
-		for (const entry of entries) {
-			const relativeName = normalizeEntryName(entry.name);
-			if (relativeName === null) continue;
-			const targetPath = path.join(stagingDir, relativeName);
-			const resolvedTarget = path.resolve(targetPath);
-			if (resolvedTarget !== resolvedStaging && !resolvedTarget.startsWith(`${resolvedStaging}${path.sep}`)) throw new Error(`tarball entry escapes extraction root: ${entry.name}`);
-			if (entry.type === "directory" || relativeName.endsWith("/")) {
-				await fs.promises.mkdir(targetPath, { recursive: true });
-				continue;
-			}
-			await fs.promises.mkdir(path.dirname(targetPath), { recursive: true });
-			const data = entry.data ?? new Uint8Array(0);
-			await fs.promises.writeFile(targetPath, data);
-			const mode = parseEntryMode(entry.attrs?.mode);
-			if (mode !== void 0) await fs.promises.chmod(targetPath, mode);
-		}
-		try {
-			await fs.promises.rename(stagingDir, destDir);
-		} catch (error) {
-			const code = error.code;
-			if ((code === "ENOTEMPTY" || code === "EEXIST") && fs.existsSync(path.join(destDir, "package.json"))) {
-				await fs.promises.rm(stagingDir, {
-					recursive: true,
-					force: true
-				}).catch(() => {});
-				return;
-			}
-			throw error;
+function expandCreateShorthand(templateName) {
+	if (templateName.includes(":")) return templateName;
+	if (isGitHubUrl(templateName)) return templateName;
+	if (templateName.startsWith("./") || templateName.startsWith("../") || templateName.startsWith("/")) return templateName;
+	if (templateName.startsWith("@")) {
+		const slashIndex = templateName.indexOf("/");
+		if (slashIndex === -1) {
+			const atIndex = templateName.indexOf("@", 1);
+			return `${atIndex === -1 ? templateName : templateName.slice(0, atIndex)}/create${atIndex === -1 ? "" : templateName.slice(atIndex)}`;
 		}
-	} catch (error) {
-		await fs.promises.rm(stagingDir, {
-			recursive: true,
-			force: true
-		}).catch(() => {});
-		throw error;
+		const scope = templateName.slice(0, slashIndex);
+		const rest = templateName.slice(slashIndex + 1);
+		const atIndex = rest.indexOf("@");
+		const name = atIndex === -1 ? rest : rest.slice(0, atIndex);
+		const version = atIndex === -1 ? "" : rest.slice(atIndex);
+		if (name.startsWith("create-")) return templateName;
+		if (scope === "@tanstack" && name === "start") return `@tanstack/cli${version}`;
+		return `${scope}/create-${name}${version}`;
 	}
+	const atIndex = templateName.indexOf("@");
+	const name = atIndex === -1 ? templateName : templateName.slice(0, atIndex);
+	const version = atIndex === -1 ? "" : templateName.slice(atIndex);
+	if (name.startsWith("create-")) return templateName;
+	if (name === "nitro") return `create-nitro-app${version}`;
+	if (name === "svelte") return `sv${version}`;
+	return `create-${name}${version}`;
 }
-const STAGING_STALE_MS = 1440 * 60 * 1e3;
-/**
-* Remove `<destDir>.tmp-*` siblings left behind by a previous crash so
-* repeated aborts don't accumulate orphaned staging trees. Only deletes
-* entries whose mtime is older than 24 hours — a concurrent `vp create`
-* that's still actively extracting will always be younger than that, so
-* the age gate keeps this safe to run at the top of every extract.
-*/
-async function cleanupStaleStagingDirs(destDir) {
-	const parent = path.dirname(destDir);
-	const prefix = `${path.basename(destDir)}${STAGING_SUFFIX_PREFIX}`;
-	let entries;
-	try {
-		entries = await fs.promises.readdir(parent);
-	} catch {
-		return;
+function inferParentDir(templateName, workspaceInfo, localTemplate = false) {
+	if (workspaceInfo.parentDirs.length === 0) return;
+	const localDir = localTemplate ? localTemplateDir(workspaceInfo, templateName) : void 0;
+	if (localDir) {
+		const ownParentDir = path.dirname(localDir);
+		if (workspaceInfo.parentDirs.includes(ownParentDir)) return ownParentDir;
 	}
-	const cutoff = Date.now() - STAGING_STALE_MS;
-	await Promise.all(entries.filter((name) => name.startsWith(prefix)).map(async (name) => {
-		const fullPath = path.join(parent, name);
-		try {
-			if ((await fs.promises.stat(fullPath)).mtimeMs < cutoff) await fs.promises.rm(fullPath, {
-				recursive: true,
-				force: true
-			});
-		} catch {}
-	}));
+	let rule = /app/i;
+	if (templateName === BuiltinTemplate.library) rule = /lib|component|package/i;
+	else if (templateName === BuiltinTemplate.generator) rule = /generator|tool/i;
+	for (const parentDir of workspaceInfo.parentDirs) if (rule.test(parentDir)) return parentDir;
+}
+//#endregion
+//#region src/create/initial-template-options.ts
+function getInitialTemplateOptions(isMonorepo, templates = []) {
+	return [
+		...!isMonorepo ? [{
+			label: "Vite+ Monorepo",
+			value: BuiltinTemplate.monorepo,
+			hint: "Create a new Vite+ monorepo project"
+		}] : [],
+		{
+			label: "Vite+ Application",
+			value: BuiltinTemplate.application,
+			hint: "Create vite applications"
+		},
+		{
+			label: "Vite+ Library",
+			value: BuiltinTemplate.library,
+			hint: "Create vite libraries"
+		},
+		...isMonorepo ? templates.map((entry) => ({
+			label: entry.name,
+			value: entry.name,
+			hint: entry.description
+		})) : []
+	];
 }
+//#endregion
+//#region src/create/org-picker.ts
+const ORG_PICKER_CANCEL = Symbol("org-picker-cancel");
+const ORG_PICKER_BUILTIN_ESCAPE = Symbol("org-picker-builtin-escape");
+const ESCAPE_HATCH = Symbol("builtin-escape");
 /**
-* Ensure the `@org/create` package tarball for the given manifest has been
-* downloaded and extracted locally. Returns the absolute path to the
-* extracted package root (i.e. the directory that contains
-* `package.json`).
+* Render the interactive picker for an org manifest. Always appends a
+* trailing "Vite+ built-in templates" escape-hatch entry.
 *
-* Idempotent: subsequent calls for the same `<scope, version>` reuse the
-* cached extraction. Concurrent calls race on the final rename; the loser
-* cleans up and returns the existing directory.
+* Context-filters entries with `monorepo: true` when running inside an
+* existing monorepo, mirroring `initial-template-options.ts:9-31`.
+*
+* Returns `ORG_PICKER_BUILTIN_ESCAPE` when the escape hatch is selected,
+* or `ORG_PICKER_CANCEL` when the user hits Ctrl-C.
 */
-async function ensureOrgPackageExtracted(manifest) {
-	const extractedRoot = getExtractionDir(manifest);
-	if (fs.existsSync(path.join(extractedRoot, "package.json"))) return extractedRoot;
-	const parent = path.dirname(extractedRoot);
-	await fs.promises.mkdir(parent, { recursive: true });
-	await cleanupStaleStagingDirs(extractedRoot);
-	const bytes = await downloadTarball(manifest.tarballUrl);
-	verifyIntegrity(bytes, manifest.integrity);
-	await extractTarballTo(bytes, extractedRoot);
-	return extractedRoot;
+async function pickOrgTemplate(manifest, opts) {
+	const filtered = filterManifestForContext(manifest.templates, opts.isMonorepo);
+	if (filtered.length === 0) return ORG_PICKER_BUILTIN_ESCAPE;
+	const escapeValue = `__vp_builtin_escape__::${randomUUID()}`;
+	const lookup = /* @__PURE__ */ new Map();
+	const options = filtered.map((entry) => {
+		lookup.set(entry.name, entry);
+		return {
+			value: entry.name,
+			label: entry.name,
+			hint: entry.description
+		};
+	});
+	lookup.set(escapeValue, ESCAPE_HATCH);
+	const builtinHint = opts.isMonorepo ? "Use defaults (application / library)" : "Use defaults (monorepo / application / library)";
+	options.push({
+		value: escapeValue,
+		label: "Vite+ built-in templates",
+		hint: builtinHint
+	});
+	const picked = await select({
+		message: `Pick a template from ${manifest.scope}`,
+		options
+	});
+	if (isCancel(picked)) return ORG_PICKER_CANCEL;
+	const found = lookup.get(picked);
+	if (found === ESCAPE_HATCH) return ORG_PICKER_BUILTIN_ESCAPE;
+	if (!found) throw new Error(`org-picker: prompts.select returned an unregistered value: ${picked}`);
+	return {
+		kind: "entry",
+		entry: found
+	};
 }
 /**
-* Resolve a manifest entry's relative `./...` path against an already-
-* extracted package root, rejecting any path that escapes the root (via
-* `..` walks or an absolute specifier).
-*
-* Existence is NOT checked here — the subsequent `copyDir` surfaces any
-* missing-directory error with a clearer errno.
+* Render the manifest as a plain-text table for the `--no-interactive`
+* error output. Fixed column order so AI agents and scripts can recover
+* available template names without a `--json` flag.
 */
-function resolveBundledPath(extractedRoot, relativePath) {
-	if (path.isAbsolute(relativePath)) throw new Error(`bundled template path must be relative, got ${relativePath}`);
-	const resolvedRoot = path.resolve(extractedRoot);
-	const resolvedTarget = path.resolve(extractedRoot, relativePath);
-	if (resolvedTarget !== resolvedRoot && !resolvedTarget.startsWith(`${resolvedRoot}${path.sep}`)) throw new Error(`bundled template path escapes the package root: ${relativePath}`);
-	return resolvedTarget;
+function formatManifestTable(manifest, isMonorepo) {
+	const visible = filterManifestForContext(manifest.templates, isMonorepo);
+	const filteredCount = manifest.templates.length - visible.length;
+	const nameWidth = Math.max(4, ...visible.map((entry) => entry.name.length));
+	const descWidth = Math.max(11, ...visible.map((entry) => entry.description.length));
+	const lines = [];
+	lines.push(`  ${"NAME".padEnd(nameWidth)}  ${"DESCRIPTION".padEnd(descWidth)}  TEMPLATE`);
+	for (const entry of visible) lines.push(`  ${entry.name.padEnd(nameWidth)}  ${entry.description.padEnd(descWidth)}  ${entry.template}`);
+	return {
+		lines,
+		filteredCount
+	};
 }
 //#endregion
 //#region ../../node_modules/.pnpm/validate-npm-package-name@7.0.2/node_modules/validate-npm-package-name/lib/builtin-modules.json
@@ -4019,7 +4029,7 @@ async function promptPackageNameAndTargetDir(defaultPackageName, interactive) {
 				return result?.errors?.[0] ?? result?.warnings?.[0] ?? "Invalid package name";
 			}
 		});
-		if (R(selected)) cancelAndExit();
+		if (isCancel(selected)) cancelAndExit();
 		packageName = selected;
 		targetDir = getProjectDirFromPackageName(packageName);
 	} else {
@@ -4041,7 +4051,7 @@ async function promptTargetDir(defaultTargetDir, interactive, options) {
 			defaultValue: defaultTargetDir,
 			validate: (value) => validateTargetDir(value ?? defaultTargetDir, options?.cwd).error
 		});
-		if (R(selected)) cancelAndExit();
+		if (isCancel(selected)) cancelAndExit();
 		targetDir = validateTargetDir(selected ?? defaultTargetDir, options?.cwd).directory;
 	} else {
 		targetDir = validateTargetDir(defaultTargetDir, options?.cwd).directory;
@@ -4074,7 +4084,7 @@ async function checkProjectDirExists(projectDirFullPath, interactive) {
 			value: "yes"
 		}]
 	});
-	if (R(overwrite)) cancelAndExit();
+	if (isCancel(overwrite)) cancelAndExit();
 	switch (overwrite) {
 		case "yes":
 			emptyDir(projectDirFullPath);
@@ -4352,7 +4362,7 @@ async function executeGeneratorScaffold(workspaceInfo, templateInfo, options) {
 			placeholder: defaultDescription,
 			defaultValue: defaultDescription
 		});
-		if (!R(descPrompt)) description = descPrompt;
+		if (!isCancel(descPrompt)) description = descPrompt;
 	}
 	const fullPath = path.join(workspaceInfo.rootDir, templateInfo.targetDir);
 	copyDir(path.join(templatesDir, "generator"), fullPath);
@@ -4665,7 +4675,7 @@ const helpMessage = renderCliDoc({
 				},
 				{
 					label: "--git",
-					description: "Initialize a git repository with an initial commit"
+					description: "Initialize a git repository"
 				},
 				{
 					label: "--no-git",
@@ -5025,7 +5035,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 			message: "",
 			options: getInitialTemplateOptions(isMonorepo, localTemplates)
 		});
-		if (R(template)) cancelAndExit();
+		if (isCancel(template)) cancelAndExit();
 		selectedTemplateName = template;
 	}
 	const matchedLocalTemplate = resolvedByOrg ? void 0 : localTemplates.find((entry) => entry.name === selectedTemplateName);
@@ -5073,7 +5083,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 				options: dirOptions,
 				initialValue: shouldOfferCwdOption ? cwdRelativeToRoot : inferParentDir(selectedTemplateName, workspaceInfoOptional, isLocalTemplate) ?? workspaceInfoOptional.parentDirs[0]
 			});
-			if (R(selected)) cancelAndExit();
+			if (isCancel(selected)) cancelAndExit();
 			if (selected !== "other") parentDir = selected;
 		}
 		if (!parentDir) {
@@ -5084,7 +5094,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 					return value ? formatTargetDir(value).error : "Target directory is required";
 				}
 			});
-			if (R(customTargetDir)) cancelAndExit();
+			if (isCancel(customTargetDir)) cancelAndExit();
 			parentDir = customTargetDir;
 		}
 		selectedParentDir = parentDir;
@@ -5199,7 +5209,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 	let migratePendingBuilds = [];
 	const handleIgnoredBuilds = async (projectPath, installCwd, summary) => {
 		if (summary?.status !== "installed") return;
-		const reportedBuilds = [...new Set([...summary.pendingBuilds ?? [], ...migratePendingBuilds])];
+		const reportedBuilds = [.../* @__PURE__ */ new Set([...summary.pendingBuilds ?? [], ...migratePendingBuilds])];
 		const targets = resolveApproveBuildTargets(projectPath, await detectGatedBuilds(installCwd, workspaceInfo.packageManager, reportedBuilds), workspaceInfo.packageManager);
 		if (targets.length === 0) return;
 		pauseCreateProgress();
@@ -5235,7 +5245,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 				initialValue: true
 			});
 			resumeCreateProgress();
-			if (R(selected)) {
+			if (isCancel(selected)) {
 				log.info("Operation cancelled. Skipping git initialization");
 				shouldInitGit = false;
 			} else shouldInitGit = selected;
@@ -5313,14 +5323,6 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 		await handleIgnoredBuilds(fullPath, fullPath, installSummary);
 		updateCreateProgress("Formatting code");
 		await runViteFmt(fullPath, options.interactive, void 0, { silent: compactOutput });
-		if (shouldSetupGit) {
-			updateCreateProgress("Creating initial commit");
-			const commitResult = await createInitialCommit(fullPath);
-			if (!commitResult.success) {
-				log.warn("Initial commit failed");
-				if (commitResult.output) log.info(commitResult.output);
-			}
-		}
 		clearCreateProgress();
 		showCreateSummary({
 			description: describeScaffold(selectedTemplateName, selectedTemplateArgs),
@@ -5459,7 +5461,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 					required: false
 				});
 				let selectedDepTypes = [];
-				if (!R(selectedDepTypeOptions)) selectedDepTypes = selectedDepTypeOptions;
+				if (!isCancel(selectedDepTypeOptions)) selectedDepTypes = selectedDepTypeOptions;
 				for (const selectedDepType of selectedDepTypes) {
 					const selected = await multiselect({
 						message: `Which packages should be added as ${selectedDepType} to ${success(projectDir)}?`,
@@ -5470,7 +5472,7 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 						required: false
 					});
 					let selectedDeps = [];
-					if (!R(selected)) selectedDeps = selected;
+					if (!isCancel(selected)) selectedDeps = selected;
 					if (selectedDeps.length > 0) updatePackageJsonWithDeps(workspaceInfo.rootDir, projectDir, selectedDeps, selectedDepType);
 				}
 				resumeCreateProgress();
@@ -5512,14 +5514,6 @@ Use \`vp create --list\` to list all available templates, or run \`vp create --h
 		await handleIgnoredBuilds(fullPath, fullPath, installSummary);
 		updateCreateProgress("Formatting code");
 		await runViteFmt(fullPath, options.interactive, void 0, { silent: compactOutput });
-		if (shouldSetupGit) {
-			updateCreateProgress("Creating initial commit");
-			const commitResult = await createInitialCommit(fullPath);
-			if (!commitResult.success) {
-				log.warn("Initial commit failed");
-				if (commitResult.output) log.info(commitResult.output);
-			}
-		}
 	}
 	clearCreateProgress();
 	showCreateSummary({