create-bestax 4.2.17 → 4.2.19

package/README.md

@@ -41,8 +41,8 @@ npm create bestax@latest
 
 You'll be asked to:
 
-1. Enter a project name (and, if that directory already holds files, confirm removing them;
-   nothing is removed until you have answered the last question)
+1. Enter a project name or path (and, if that directory already holds files, confirm removing
+   them; nothing is removed until you have answered the last question)
 2. Select a framework (Vite or Vite + TypeScript)
 3. Choose a Bulma CSS flavor (the `--bulma` options below)
 4. Select an icon library (Font Awesome, Material Icons, etc.)
@@ -62,8 +62,12 @@ with or without it.
 
 **Arguments:**
 
-- `[project-directory]` - Optional project directory name. It also becomes the `package.json`
-  name, lower-cased the way `npm init` does and without a leading `_`, since npm rejects both.
+- `[project-directory]` - Optional project directory: a name such as `my-app`, or a path,
+  absolute or relative, such as `../apps/my-app`, whose missing folders are created. Its last
+  part is the project name, held to the same rules as a bare name. It becomes the page title as
+  typed, and the `package.json` name lower-cased the way `npm init` does and without a leading
+  `_`, since npm rejects both. A path ending in `.` or `..` is refused, like a bare `.` or `..`,
+  so name the directory you want.
 
 **Options:**
 
@@ -99,7 +103,8 @@ with or without it.
   directory under `-y` alone, so a script that relied on that now needs `--overwrite`.
 
 - `--overwrite` - Remove existing files if the target directory is not empty, without asking.
-  Every other flag is checked first, so a typo stops the run before anything is deleted.
+  Every other flag is checked first, so a typo stops the run before anything is deleted. It
+  never empties the current directory or a folder that holds it, however the path is written.
 
 **Example:**
 
@@ -110,6 +115,9 @@ npm create bestax@latest my-app -- -t vite-ts -i fontawesome -b complete
 # Use all defaults (skip prompts)
 npm create bestax@latest my-app -- -y
 
+# Scaffold into a path; the package is named my-app
+npm create bestax@latest ../apps/my-app -- -y
+
 # The same with bun
 bun create bestax@latest my-app -- -y
 ```

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EACL,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,cAAc,IAAI,cAAc,EAChC,iBAAiB,IAAI,iBAAiB,EACtC,iBAAiB,IAAI,iBAAiB,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,wBAAsB,cAAc,CAClC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,aAAa,CACjC,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAcD,wBAAgB,SAAS,IAAI,OAAO,CAsCnC;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKxE;AAED,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAAiB,GACrC,OAAO,CAAC,IAAI,CAAC,CAGf"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EACL,cAAc,EACd,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC3B,MAAM,sBAAsB,CAAC;AAI9B,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACtE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGzE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,cAAc,IAAI,cAAc,EAChC,iBAAiB,IAAI,iBAAiB,EACtC,iBAAiB,IAAI,iBAAiB,GACvC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,aAAa,EACb,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAG1B,wBAAsB,cAAc,CAClC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGxD;AAED,wBAAsB,YAAY,CAChC,YAAY,EAAE,MAAM,EACpB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,aAAa,CACjC,UAAU,CAAC,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,IAAI,CAAC,CAGf;AAcD,wBAAgB,SAAS,IAAI,OAAO,CAyCnC;AAED,wBAAgB,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAKxE;AAED,wBAAsB,MAAM,CAC1B,IAAI,GAAE,SAAS,MAAM,EAAiB,GACrC,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/cli.js

@@ -53,7 +53,7 @@ export function createCLI() {
         .name('create-bestax')
         .description('Create a new bestax-bulma project')
         .version(getPackageVersion())
-        .argument('[project-directory]', 'project directory to create')
+        .argument('[project-directory]', 'project directory to create, a name or a path (its last part names the package)')
         .option('-t, --template <template>', 'template to use (vite, vite-ts)')
         .option('-b, --bulma <flavor>', 'Bulma CSS flavor (complete, prefixed, no-helpers, no-helpers-prefixed, no-dark-mode)')
         .option('-i, --icon <library>', 'icon library (none, fontawesome, mdi, ionicons, material-icons, material-symbols)')

package/dist/constants.d.ts

@@ -15,11 +15,13 @@ export declare const MESSAGES: {
     readonly PROJECT_NAME_INVALID_CHARS: "Project name can only contain letters, numbers, dots, dashes and underscores";
     readonly PROJECT_NAME_DOT: "Project name cannot start with a dot (names like \".\" or \"..\" would scaffold outside a new directory) — pass a directory name";
     readonly PROJECT_NAME_NO_PACKAGE_NAME: "Project name must contain a letter, number or dash (npm package names cannot start with \"_\" or \".\")";
+    readonly PROJECT_NAME_FROM_PATH: (message: string, name: string) => string;
     readonly PACKAGE_NAME_NORMALIZED: (name: string) => string;
     readonly OPERATION_CANCELLED: "✖ Operation cancelled";
     readonly NO_TTY: string;
     readonly DIRECTORY_NOT_EMPTY: (dir: string, entries: string[]) => string;
     readonly NOT_A_DIRECTORY: (dir: string) => string;
+    readonly DIRECTORY_HOLDS_CWD: (dir: string) => string;
     readonly DIRECTORY_NOT_EMPTY_REFUSED: (dir: string, entries: string[]) => string;
     readonly EMPTYING_DIRECTORY: (dir: string) => string;
     readonly CREATING_PROJECT: (path: string) => string;

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,SAAS,EAAE,QAAQ,EAG/B,CAAC;AAEF,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAOpC,eAAO,MAAM,QAAQ;;;;;;6CASa,MAAM;;;wCAQX,MAAM,WAAW,MAAM,EAAE;oCAE7B,MAAM;gDAIM,MAAM,WAAW,MAAM,EAAE;uCAIlC,MAAM;sCACP,MAAM;4CAEA,MAAM;;;;;wCAMV,MAAM,mBAAmB,MAAM;;;;;CAclD,CAAC;AASX,eAAO,MAAM,WAAW,QAed,CAAC;AAEX,eAAO,MAAM,OAAO;;;;;;;CAQV,CAAC;AAOX,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK9D,CAAC;AAKF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,eAAO,MAAM,SAAS,GACpB,aAAa,MAAM,EACnB,8BAA8B,eAAe,KAC5C,MA8HF,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EA8DvC,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,WAAW,EA8CtC,CAAC;AAKF,eAAO,MAAM,iBAAiB,QAE+B,CAAC;AAE9D,MAAM,WAAW,YAAY;IAE3B,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD,eAAO,MAAM,0BAA0B,EAAE,YAAY,EAgBpD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAMjB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,SAAS,EAAE,QAAQ,EAG/B,CAAC;AAEF,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AACpD,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,eAAO,MAAM,kBAAkB,QAAsB,CAAC;AAGtD,eAAO,MAAM,kBAAkB,IAAI,CAAC;AAOpC,eAAO,MAAM,QAAQ;;;;;;+CASe,MAAM,QAAQ,MAAM;6CAEtB,MAAM;;;wCAQX,MAAM,WAAW,MAAM,EAAE;oCAE7B,MAAM;wCAIF,MAAM;gDAKE,MAAM,WAAW,MAAM,EAAE;uCAIlC,MAAM;sCACP,MAAM;4CAEA,MAAM;;;;;wCAMV,MAAM,mBAAmB,MAAM;;;;;CAclD,CAAC;AASX,eAAO,MAAM,WAAW,QAed,CAAC;AAEX,eAAO,MAAM,OAAO;;;;;;;CAQV,CAAC;AAOX,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAK9D,CAAC;AAKF,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAkCD,eAAO,MAAM,SAAS,GACpB,aAAa,MAAM,EACnB,8BAA8B,eAAe,KAC5C,MA8HF,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,eAAO,MAAM,cAAc,EAAE,WAAW,EA8DvC,CAAC;AAEF,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IAGtB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,WAAW,EA8CtC,CAAC;AAQF,eAAO,MAAM,iBAAiB,QAEiC,CAAC;AAEhE,MAAM,WAAW,YAAY;IAE3B,IAAI,EAAE,MAAM,CAAC;IAEb,SAAS,EAAE,MAAM,CAAC;IAElB,WAAW,EAAE,MAAM,CAAC;CACrB;AAOD,eAAO,MAAM,0BAA0B,EAAE,YAAY,EAgBpD,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAMjB,CAAC"}

package/dist/constants.js

@@ -18,6 +18,7 @@ export const MESSAGES = {
     PROJECT_NAME_INVALID_CHARS: 'Project name can only contain letters, numbers, dots, dashes and underscores',
     PROJECT_NAME_DOT: 'Project name cannot start with a dot (names like "." or ".." would scaffold outside a new directory) — pass a directory name',
     PROJECT_NAME_NO_PACKAGE_NAME: 'Project name must contain a letter, number or dash (npm package names cannot start with "_" or ".")',
+    PROJECT_NAME_FROM_PATH: (message, name) => `${message} (the project name is "${name}", the last part of the path)`,
     PACKAGE_NAME_NORMALIZED: (name) => `  package.json name: ${name} (npm package names are lower-case and cannot start with "_")`,
     OPERATION_CANCELLED: '✖ Operation cancelled',
     NO_TTY: 'No interactive terminal detected — cannot prompt for input.\n' +
@@ -25,7 +26,11 @@ export const MESSAGES = {
         '  npm create bestax@latest my-app -- -t vite-ts -b complete -i none -y\n' +
         'Run with --help to see all options.',
     DIRECTORY_NOT_EMPTY: (dir, entries) => `Directory ${chalk.yellow(dir)} is not empty (${listEntries(entries)}). Remove existing files and continue?`,
-    NOT_A_DIRECTORY: (dir) => `${dir} already exists and is not a directory, so nothing was written. Choose another project name.`,
+    NOT_A_DIRECTORY: (dir) => `${dir} already exists and is not a directory, so nothing was written. Choose another project name or path.`,
+    // #310: the working directory, or a folder holding it, under another
+    // spelling than "." or "..", such as "../<its name>" or its absolute path.
+    DIRECTORY_HOLDS_CWD: (dir) => `Directory ${dir} is or holds the current directory, so it is never emptied, even with --overwrite, and nothing was written.\n` +
+        '  Choose a new or empty directory.',
     // Shown instead of the question above when it cannot be asked: under -y, or
     // without a terminal. -y never answers it (#945), so this must not suggest -y.
     DIRECTORY_NOT_EMPTY_REFUSED: (dir, entries) => `Directory ${dir} is not empty (${listEntries(entries)}), so nothing was written.\n` +
@@ -343,8 +348,11 @@ export const BULMA_FLAVORS = [
 // Sits above the stylesheet import in the templates' entry files, and the
 // scaffolder writes it back when it swaps in a flavor's stylesheet, so the
 // reason for the import order survives. The no-helpers classes depend on it.
+// It names src/index.css, the app's global stylesheet, rather than the starter
+// page's src/App.css, which loads after bestax's too but goes when a port
+// replaces the page (#1240).
 export const CSS_ORDER_COMMENT = "// Bestax's stylesheet loads before the app's own CSS, so a named class in\n" +
-    '// src/App.css wins over a Bulma rule of the same weight.';
+    '// src/index.css wins over a Bulma rule of the same weight.';
 // Every helper prop the starter App uses, with the named class that stands in
 // for it under a `noHelpers` flavor, where the prop would render nothing. The
 // scaffolder swaps each prop for its class and writes the rules into

package/dist/display.d.ts

@@ -1,4 +1,13 @@
 export declare function displayHeader(): void;
+/**
+ * value written so that pasting it into a shell gives back exactly value. The
+ * project name is held to safe characters, but a parent folder in a path can
+ * hold anything (#1154). POSIX shells get single quotes, which keep spaces, $
+ * and backticks literal, with each single quote inside written '\''. Windows
+ * gets double quotes, the quoting cmd and PowerShell share, since cmd has no
+ * single quotes.
+ */
+export declare function quoteShellArgument(value: string, platform?: typeof process.platform): string;
 export declare function displaySuccess(targetDir: string): void;
 export declare function displayError(message: string): void;
 export declare function displayInfo(message: string): void;

package/dist/display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../src/display.ts"],"names":[],"mappings":"AAKA,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAiCtD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}
+{"version":3,"file":"display.d.ts","sourceRoot":"","sources":["../src/display.ts"],"names":[],"mappings":"AAKA,wBAAgB,aAAa,IAAI,IAAI,CAMpC;AAOD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,OAAO,OAAO,CAAC,QAA2B,GACnD,MAAM,CAKR;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAiCtD;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAElD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/display.js

@@ -9,6 +9,24 @@ export function displayHeader() {
     console.log(chalk.cyan('━'.repeat(50)));
     console.log();
 }
+// Characters no shell reads specially, so a path made only of them pastes as
+// it is. Windows adds its backslash separator.
+const SHELL_SAFE = /^[\w@%+=:,./-]+$/;
+const WINDOWS_SHELL_SAFE = /^[\w@%+=:,./\\-]+$/;
+/**
+ * value written so that pasting it into a shell gives back exactly value. The
+ * project name is held to safe characters, but a parent folder in a path can
+ * hold anything (#1154). POSIX shells get single quotes, which keep spaces, $
+ * and backticks literal, with each single quote inside written '\''. Windows
+ * gets double quotes, the quoting cmd and PowerShell share, since cmd has no
+ * single quotes.
+ */
+export function quoteShellArgument(value, platform = process.platform) {
+    if (platform === 'win32') {
+        return WINDOWS_SHELL_SAFE.test(value) ? value : `"${value}"`;
+    }
+    return SHELL_SAFE.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
+}
 export function displaySuccess(targetDir) {
     console.log();
     console.log(chalk.green(MESSAGES.PROJECT_CREATED));
@@ -18,7 +36,7 @@ export function displaySuccess(targetDir) {
     // Mirror the package manager that invoked the CLI — `<pm> install` and
     // `<pm> run dev` are valid for all four supported PMs.
     const pm = detectPackageManager();
-    console.log(chalk.cyan(`  cd ${targetDir}`));
+    console.log(chalk.cyan(`  cd ${quoteShellArgument(targetDir)}`));
     console.log(chalk.cyan(`  ${pm} install`));
     console.log(chalk.cyan(`  ${pm} run dev`));
     console.log();

package/dist/file-system.d.ts

@@ -1,10 +1,23 @@
 export declare function checkDirectoryExists(targetPath: string): Promise<boolean>;
 export declare function isDirectoryEmpty(targetPath: string): Promise<boolean>;
 /**
- * Whether something other than a directory, such as a file, already sits at
- * targetPath. listDirectoryEntries cannot read one, so callers check first.
+ * What stands in the way of creating targetPath as a directory: the nearest
+ * of it and its parents that exists, when that is not a directory. That is a
+ * file at the target itself, or a file where a parent folder should be, as in
+ * `notes.txt/login` (#1154). null when the nearest existing entry is a
+ * directory. listDirectoryEntries cannot read a file, so callers check first.
+ *
+ * It never throws. throwIfNoEntry covers a missing entry, and a path under a
+ * file fails with ENOTDIR on some Node versions, so any failed stat moves on
+ * to the parent, where the file that caused it is found.
  */
-export declare function existsAsNonDirectory(targetPath: string): Promise<boolean>;
+export declare function findNonDirectoryInPath(targetPath: string): Promise<string | null>;
+/**
+ * targetPath with its symbolic links resolved, so two spellings of one
+ * directory compare equal (macOS's /tmp is /private/tmp). Returned resolved
+ * but otherwise as given when that fails, as it does for a missing path.
+ */
+export declare function realPath(targetPath: string): Promise<string>;
 /** A directory's top-level entries, sorted; none when it does not exist. */
 export declare function listDirectoryEntries(targetPath: string): Promise<string[]>;
 export declare function emptyDirectory(targetPath: string): Promise<void>;
@@ -12,5 +25,9 @@ export declare function ensureDirectory(targetPath: string): Promise<void>;
 export declare function copyDirectory(source: string, destination: string, renames?: Record<string, string>): Promise<void>;
 export declare function readJsonFile<T = unknown>(filePath: string): Promise<T>;
 export declare function writeJsonFile(filePath: string, data: unknown, spaces?: number): Promise<void>;
-export declare function updatePackageJson(targetPath: string, projectName: string): Promise<void>;
+/**
+ * Names the copied app's package and sets the given dependencies' ranges. One
+ * the template already lists keeps its place among the others.
+ */
+export declare function updatePackageJson(targetPath: string, projectName: string, dependencies?: Record<string, string>): Promise<void>;
 //# sourceMappingURL=file-system.d.ts.map

package/dist/file-system.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-system.d.ts","sourceRoot":"","sources":["../src/file-system.ts"],"names":[],"mappings":"AAIA,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM3E;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED,4EAA4E;AAC5E,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAE5E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,SAAI,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAQf"}
+{"version":3,"file":"file-system.d.ts","sourceRoot":"","sources":["../src/file-system.ts"],"names":[],"mappings":"AAIA,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAM3E;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAkBxB;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMlE;AAED,4EAA4E;AAC5E,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,EAAE,CAAC,CAKnB;AAED,wBAAsB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;AAED,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAE5E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,MAAM,SAAI,GACT,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACxC,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/file-system.js

@@ -12,12 +12,48 @@ export async function isDirectoryEmpty(targetPath) {
     return files.length === 0;
 }
 /**
- * Whether something other than a directory, such as a file, already sits at
- * targetPath. listDirectoryEntries cannot read one, so callers check first.
+ * What stands in the way of creating targetPath as a directory: the nearest
+ * of it and its parents that exists, when that is not a directory. That is a
+ * file at the target itself, or a file where a parent folder should be, as in
+ * `notes.txt/login` (#1154). null when the nearest existing entry is a
+ * directory. listDirectoryEntries cannot read a file, so callers check first.
+ *
+ * It never throws. throwIfNoEntry covers a missing entry, and a path under a
+ * file fails with ENOTDIR on some Node versions, so any failed stat moves on
+ * to the parent, where the file that caused it is found.
  */
-export async function existsAsNonDirectory(targetPath) {
-    const stat = fs.statSync(targetPath, { throwIfNoEntry: false });
-    return stat !== undefined && !stat.isDirectory();
+export async function findNonDirectoryInPath(targetPath) {
+    let current = path.resolve(targetPath);
+    for (;;) {
+        let stat;
+        try {
+            stat = fs.statSync(current, { throwIfNoEntry: false });
+        }
+        catch {
+            stat = undefined;
+        }
+        if (stat) {
+            return stat.isDirectory() ? null : current;
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            return null;
+        }
+        current = parent;
+    }
+}
+/**
+ * targetPath with its symbolic links resolved, so two spellings of one
+ * directory compare equal (macOS's /tmp is /private/tmp). Returned resolved
+ * but otherwise as given when that fails, as it does for a missing path.
+ */
+export async function realPath(targetPath) {
+    try {
+        return fs.realpathSync(targetPath);
+    }
+    catch {
+        return path.resolve(targetPath);
+    }
 }
 /** A directory's top-level entries, sorted; none when it does not exist. */
 export async function listDirectoryEntries(targetPath) {
@@ -54,11 +90,21 @@ export async function readJsonFile(filePath) {
 export async function writeJsonFile(filePath, data, spaces = 2) {
     await fs.writeJson(filePath, data, { spaces });
 }
-export async function updatePackageJson(targetPath, projectName) {
+/**
+ * Names the copied app's package and sets the given dependencies' ranges. One
+ * the template already lists keeps its place among the others.
+ */
+export async function updatePackageJson(targetPath, projectName, dependencies = {}) {
     const packageJsonPath = path.join(targetPath, 'package.json');
     if (fs.existsSync(packageJsonPath)) {
         const packageJson = await fs.readJson(packageJsonPath);
         packageJson.name = projectName;
+        if (Object.keys(dependencies).length > 0) {
+            packageJson.dependencies = {
+                ...packageJson.dependencies,
+                ...dependencies,
+            };
+        }
         await fs.writeJson(packageJsonPath, packageJson, { spaces: 2 });
     }
 }

package/dist/library-range.d.ts

@@ -0,0 +1,16 @@
+/** The library every template is built on. */
+export declare const LIBRARY = "@allxsmith/bestax-bulma";
+/**
+ * The range a scaffolded app gives @allxsmith/bestax-bulma: the one this
+ * CLI's own manifest declares, so the app is floored at the release the CLI
+ * was built with (#1240). The manifest spells it `workspace:^`, which
+ * `pnpm publish` rewrites to a caret on the library's version in the checkout
+ * it packs, and CI releases bulma-ui first in the same job. A published CLI
+ * therefore reads a plain range, the one `npm create bestax` installed the
+ * library from beside it. Run from this repo, the protocol is still there,
+ * and it is resolved the way `pnpm publish` resolves it, from the version of
+ * the library the workspace links, so a scaffold made with a checkout's build
+ * gets that checkout's release.
+ */
+export declare function libraryRange(packageRoot?: string): string;
+//# sourceMappingURL=library-range.d.ts.map

package/dist/library-range.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"library-range.d.ts","sourceRoot":"","sources":["../src/library-range.ts"],"names":[],"mappings":"AAIA,8CAA8C;AAC9C,eAAO,MAAM,OAAO,4BAA4B,CAAC;AAqBjD;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,WAAW,GAAE,MAAqB,GAAG,MAAM,CAkBvE"}

package/dist/library-range.js

@@ -0,0 +1,40 @@
+import { readFileSync } from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+/** The library every template is built on. */
+export const LIBRARY = '@allxsmith/bestax-bulma';
+const WORKSPACE = 'workspace:';
+// dist/ and src/ both sit directly under the package root.
+const PACKAGE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+function readManifest(dir) {
+    return JSON.parse(readFileSync(path.join(dir, 'package.json'), 'utf8'));
+}
+/**
+ * The range a scaffolded app gives @allxsmith/bestax-bulma: the one this
+ * CLI's own manifest declares, so the app is floored at the release the CLI
+ * was built with (#1240). The manifest spells it `workspace:^`, which
+ * `pnpm publish` rewrites to a caret on the library's version in the checkout
+ * it packs, and CI releases bulma-ui first in the same job. A published CLI
+ * therefore reads a plain range, the one `npm create bestax` installed the
+ * library from beside it. Run from this repo, the protocol is still there,
+ * and it is resolved the way `pnpm publish` resolves it, from the version of
+ * the library the workspace links, so a scaffold made with a checkout's build
+ * gets that checkout's release.
+ */
+export function libraryRange(packageRoot = PACKAGE_ROOT) {
+    const declared = readManifest(packageRoot).dependencies?.[LIBRARY];
+    if (declared === undefined) {
+        throw new Error(`${path.join(packageRoot, 'package.json')} declares no ${LIBRARY} dependency.`);
+    }
+    if (!declared.startsWith(WORKSPACE))
+        return declared;
+    const { version } = readManifest(path.join(packageRoot, 'node_modules', LIBRARY));
+    // What pnpm publish writes for each form: `*` the version itself, `^` and
+    // `~` that operator on it, and a range as written.
+    const spec = declared.slice(WORKSPACE.length);
+    if (spec === '*')
+        return version;
+    if (spec === '^' || spec === '~')
+        return `${spec}${version}`;
+    return spec;
+}

package/dist/project-creator.d.ts

@@ -24,6 +24,10 @@ export type ExistingDirectoryPlan = 'empty' | 'overwrite' | 'stop';
 export declare class ProjectCreator {
     private templatesDir;
     constructor(templatesDir?: string);
+    /**
+     * The project directory, as typed or answered: a name or a path, absolute
+     * or relative, whose last segment must be a valid project name (#1154).
+     */
     getProjectName(projectDir?: string): Promise<string | null>;
     /**
      * Decides what happens to an existing target directory without touching it:
@@ -31,9 +35,20 @@ export declare class ProjectCreator {
      * question leaves the user's files where they were (#945). Only --overwrite
      * or a yes at the prompt removes files. -y never does, and neither -y nor a
      * missing terminal can ask, so both stop at a non-empty directory instead.
-     * A file at the target path stops the run too, whatever the flags say.
+     * Whatever the flags say, the run stops at a file on the target path or in
+     * place of one of its parents, and before emptying the working directory or
+     * one that holds it (#310), however the path spells it. create() calls this
+     * straight after the project name, so neither waits for the other prompts.
      */
     checkExistingDirectory(targetPath: string, targetDir: string, options?: CLIOptions): Promise<ExistingDirectoryPlan>;
+    /**
+     * Whether targetPath is the working directory or one of its ancestors, with
+     * symbolic links resolved on both sides. Emptying either deletes the folder
+     * the user is standing in, which the leading-dot rule refuses for "." and
+     * "..", and a path such as "../<its name>" or its absolute spelling reaches
+     * the same folder (#310, #1154).
+     */
+    private holdsWorkingDirectory;
     /**
      * Every flag's value is checked here, before any prompt runs or anything on
      * disk changes, so a typo can never cost the user an emptied directory (#945).

package/dist/project-creator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-creator.d.ts","sourceRoot":"","sources":["../src/project-creator.ts"],"names":[],"mappings":"AA8BA,OAAO,EAWL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAYxB,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEnE,qBAAa,cAAc;IACzB,OAAO,CAAC,YAAY,CAAS;gBAEjB,YAAY,CAAC,EAAE,MAAM;IAI3B,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAajE;;;;;;;OAOG;IACG,sBAAsB,CAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,qBAAqB,CAAC;IA2BjC;;;OAGG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IAmBpD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAInC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjE,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;;;OAKG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpE,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC;IAqBV,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAyDhB;;;;;OAKG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmBhB,OAAO,CAAC,WAAW;IA2BnB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAcd,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsJV,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmEV,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAoItE;;;;;;;;OAQG;YACW,eAAe;CA2B9B"}
+{"version":3,"file":"project-creator.d.ts","sourceRoot":"","sources":["../src/project-creator.ts"],"names":[],"mappings":"AA+BA,OAAO,EAWL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAaxB,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAEnE,qBAAa,cAAc;IACzB,OAAO,CAAC,YAAY,CAAS;gBAEjB,YAAY,CAAC,EAAE,MAAM;IAIjC;;;OAGG;IACG,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAajE;;;;;;;;;;OAUG;IACG,sBAAsB,CAC1B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,OAAO,CAAC,EAAE,UAAU,GACnB,OAAO,CAAC,qBAAqB,CAAC;IAqCjC;;;;;;OAMG;YACW,qBAAqB;IAanC;;;OAGG;IACH,eAAe,CAAC,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI;IAmBpD,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM;IAInC,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjE,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAgBhB;;;;;OAKG;IACG,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBpE,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC,IAAI,CAAC;IAqBV,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAyDhB;;;;;OAKG;IACG,yBAAyB,CAC7B,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmBhB,OAAO,CAAC,WAAW;IA2BnB;;;;OAIG;IACH,OAAO,CAAC,YAAY;IAcd,gBAAgB,CACpB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAsJV,mBAAmB,CACvB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;IAmEV,MAAM,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IA0ItE;;;;;;;;OAQG;YACW,eAAe;CA2B9B"}

package/dist/project-creator.js

@@ -2,13 +2,14 @@ import path from 'path';
 import { fileURLToPath } from 'url';
 import chalk from 'chalk';
 import fs from 'fs-extra';
-import { checkDirectoryExists, listDirectoryEntries, existsAsNonDirectory, emptyDirectory, ensureDirectory, copyDirectory, updatePackageJson, } from './file-system.js';
+import { checkDirectoryExists, listDirectoryEntries, findNonDirectoryInPath, realPath, emptyDirectory, ensureDirectory, copyDirectory, updatePackageJson, } from './file-system.js';
 import { promptProjectName, promptOverwriteDirectory, promptTemplate, promptIconLibrary, promptBulmaFlavor, promptInstallSkills, promptTelemetryConsent, } from './prompts.js';
 import { reportScaffold } from './telemetry.js';
 import { displayHeader, displaySuccess, displayError, displayCancelled, } from './display.js';
-import { validateProjectName, toValidPackageName } from './validators.js';
+import { validateProjectDirectory, toValidPackageName } from './validators.js';
 import { MESSAGES, TEMPLATES, ICON_LIBRARIES, BULMA_FLAVORS, CLAUDE_MD, LAUNCH_JSON, CONFIG_PROVIDER_ICON_VALUES, NO_HELPERS_STARTER_CLASSES, NO_HELPERS_APP_CSS, CSS_ORDER_COMMENT, } from './constants.js';
 import { detectPackageManager } from './package-manager.js';
+import { LIBRARY, libraryRange } from './library-range.js';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 // npm strips literal `.gitignore` files from published tarballs, so the
 // templates track `_gitignore` instead and the scaffolder renames it back
@@ -21,9 +22,13 @@ export class ProjectCreator {
     constructor(templatesDir) {
         this.templatesDir = templatesDir || path.resolve(__dirname, '../templates');
     }
+    /**
+     * The project directory, as typed or answered: a name or a path, absolute
+     * or relative, whose last segment must be a valid project name (#1154).
+     */
     async getProjectName(projectDir) {
         if (projectDir) {
-            const validation = validateProjectName(projectDir);
+            const validation = validateProjectDirectory(projectDir);
             if (validation !== true) {
                 console.log(chalk.red(`✖ ${validation}`));
                 return null;
@@ -38,17 +43,25 @@ export class ProjectCreator {
      * question leaves the user's files where they were (#945). Only --overwrite
      * or a yes at the prompt removes files. -y never does, and neither -y nor a
      * missing terminal can ask, so both stop at a non-empty directory instead.
-     * A file at the target path stops the run too, whatever the flags say.
+     * Whatever the flags say, the run stops at a file on the target path or in
+     * place of one of its parents, and before emptying the working directory or
+     * one that holds it (#310), however the path spells it. create() calls this
+     * straight after the project name, so neither waits for the other prompts.
      */
     async checkExistingDirectory(targetPath, targetDir, options) {
-        if (await existsAsNonDirectory(targetPath)) {
-            displayError(MESSAGES.NOT_A_DIRECTORY(targetDir));
+        const blocker = await findNonDirectoryInPath(targetPath);
+        if (blocker !== null) {
+            displayError(MESSAGES.NOT_A_DIRECTORY(blocker === path.resolve(targetPath) ? targetDir : blocker));
             return 'stop';
         }
         const entries = await listDirectoryEntries(targetPath);
         if (entries.length === 0) {
             return 'empty';
         }
+        if (await this.holdsWorkingDirectory(targetPath)) {
+            displayError(MESSAGES.DIRECTORY_HOLDS_CWD(targetDir));
+            return 'stop';
+        }
         if (options?.overwrite) {
             return 'overwrite';
         }
@@ -62,6 +75,20 @@ export class ProjectCreator {
         }
         return 'overwrite';
     }
+    /**
+     * Whether targetPath is the working directory or one of its ancestors, with
+     * symbolic links resolved on both sides. Emptying either deletes the folder
+     * the user is standing in, which the leading-dot rule refuses for "." and
+     * "..", and a path such as "../<its name>" or its absolute spelling reaches
+     * the same folder (#310, #1154).
+     */
+    async holdsWorkingDirectory(targetPath) {
+        const relative = path.relative(await realPath(targetPath), await realPath(process.cwd()));
+        return (relative === '' ||
+            (!path.isAbsolute(relative) &&
+                relative !== '..' &&
+                !relative.startsWith(`..${path.sep}`)));
+    }
     /**
      * Every flag's value is checked here, before any prompt runs or anything on
      * disk changes, so a typo can never cost the user an emptied directory (#945).
@@ -413,6 +440,9 @@ export class ProjectCreator {
             process.exit(1);
             return; // TypeScript flow control
         }
+        // An absolute path is used as it is and a relative one from the working
+        // directory. Its last segment names the package and the page title, and
+        // copyTemplate creates it and any missing parent after the last prompt.
         const targetPath = path.resolve(process.cwd(), targetDir);
         const projectName = path.basename(targetPath);
         // Decide about an existing directory now, but empty it only after the
@@ -482,6 +512,8 @@ export class ProjectCreator {
             }
         }
         try {
+            // Read before the directory is emptied, so a failed read costs nothing.
+            const libraryDependency = { [LIBRARY]: libraryRange() };
             if (directoryPlan === 'overwrite') {
                 console.log(chalk.yellow(MESSAGES.EMPTYING_DIRECTORY(targetDir)));
                 await emptyDirectory(targetPath);
@@ -494,7 +526,7 @@ export class ProjectCreator {
                 console.log(chalk.dim(MESSAGES.PACKAGE_NAME_NORMALIZED(packageName)));
             }
             await this.copyTemplate(template, targetPath);
-            await updatePackageJson(targetPath, packageName);
+            await updatePackageJson(targetPath, packageName, libraryDependency);
             await this.updateIndexHtmlTitle(targetPath, projectName);
             await this.updateReadme(targetPath, iconLibrary);
             await this.setupBulmaFlavor(targetPath, bulmaFlavor, template);

package/dist/prompts.d.ts

@@ -1,3 +1,4 @@
+/** Takes a name or a path, the same as the project-directory argument. */
 export declare function promptProjectName(): Promise<string | null>;
 /** Asks to remove `entries` from targetDir, naming them, since a yes deletes them. */
 export declare function promptOverwriteDirectory(targetDir: string, entries: string[]): Promise<boolean>;

package/dist/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAyBA,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWhE;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUnE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa7D;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA2BtE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBhE"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../src/prompts.ts"],"names":[],"mappings":"AAyBA,0EAA0E;AAC1E,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWhE;AAED,sFAAsF;AACtF,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAUnE;AAED,wBAAsB,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAa7D;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAchE;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA2BtE;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBhE"}

package/dist/prompts.js

@@ -1,7 +1,7 @@
 import prompts from 'prompts';
 import chalk from 'chalk';
 import { TEMPLATES, DEFAULT_PROJECT_NAME, PROMPTS as PROMPT_MESSAGES, MESSAGES, ICON_LIBRARIES, BULMA_FLAVORS, } from './constants.js';
-import { validateProjectName } from './validators.js';
+import { validateProjectDirectory } from './validators.js';
 import { displayError } from './display.js';
 /**
  * Guard against hanging forever in non-interactive environments (CI, agents,
@@ -14,6 +14,7 @@ function ensureInteractive() {
         process.exit(1);
     }
 }
+/** Takes a name or a path, the same as the project-directory argument. */
 export async function promptProjectName() {
     ensureInteractive();
     const response = await prompts({
@@ -21,7 +22,7 @@ export async function promptProjectName() {
         name: 'projectName',
         message: PROMPT_MESSAGES.PROJECT_NAME,
         initial: DEFAULT_PROJECT_NAME,
-        validate: validateProjectName,
+        validate: validateProjectDirectory,
     });
     return response.projectName || null;
 }

package/dist/validators.d.ts

@@ -1,5 +1,13 @@
 export declare function validateProjectName(value: string): boolean | string;
 export declare function isValidProjectName(name: string): boolean;
+/**
+ * The project directory may be a name or a path, absolute or relative, as
+ * create-vite takes it (#1154). Its last segment is the project name, the one
+ * that names the package and the page title, so that is what is validated, by
+ * the same rules as a bare name: a path ending in "." or ".." still fails the
+ * leading-dot rule above. A rejected path names the segment it was judged by.
+ */
+export declare function validateProjectDirectory(targetDir: string): boolean | string;
 /**
  * The package.json name for a project directory. npm rejects capitals and a
  * leading "_" or ".", so the name is lower-cased the way `npm init` does and

package/dist/validators.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAMA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAyBnE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D"}
+{"version":3,"file":"validators.d.ts","sourceRoot":"","sources":["../src/validators.ts"],"names":[],"mappings":"AAOA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CA2BnE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAExD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAM5E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE9D"}

package/dist/validators.js

@@ -1,3 +1,4 @@
+import path from 'path';
 import { PROJECT_NAME_REGEX, MAX_PROJECT_NAME_LENGTH, MESSAGES, } from './constants.js';
 export function validateProjectName(value) {
     if (!value) {
@@ -8,7 +9,9 @@ export function validateProjectName(value) {
     }
     // The regex below allows dots, so "." and ".." would pass and resolve to
     // the current/parent directory — which --overwrite would then empty. Rejecting
-    // every leading-dot name closes that hole ("/" and "\" are already blocked).
+    // every leading-dot name closes that hole for these spellings ("/" and "\" are
+    // already blocked). A path reaching the same directory another way, such as
+    // "../<its name>", is refused where it resolves, in checkExistingDirectory.
     if (value.startsWith('.')) {
         return MESSAGES.PROJECT_NAME_DOT;
     }
@@ -23,6 +26,20 @@ export function validateProjectName(value) {
 export function isValidProjectName(name) {
     return validateProjectName(name) === true;
 }
+/**
+ * The project directory may be a name or a path, absolute or relative, as
+ * create-vite takes it (#1154). Its last segment is the project name, the one
+ * that names the package and the page title, so that is what is validated, by
+ * the same rules as a bare name: a path ending in "." or ".." still fails the
+ * leading-dot rule above. A rejected path names the segment it was judged by.
+ */
+export function validateProjectDirectory(targetDir) {
+    const projectName = path.basename(targetDir);
+    const validation = validateProjectName(projectName);
+    return typeof validation === 'string' && projectName !== targetDir
+        ? MESSAGES.PROJECT_NAME_FROM_PATH(validation, projectName)
+        : validation;
+}
 /**
  * The package.json name for a project directory. npm rejects capitals and a
  * leading "_" or ".", so the name is lower-cased the way `npm init` does and