@cspeach/cli 0.9.0 → 1.1.0

package/dist/tools/fiori/apply.js

@@ -0,0 +1,50 @@
+// cspeach-cli/src/tools/fiori/apply.ts
+import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { getEntry } from './catalog/index.js';
+import { renderEntry } from './render.js';
+import { mergeManifest } from './manifest.js';
+import { appendI18n } from './i18n.js';
+import { resolveSafePath } from '../_filesystem-shared.js';
+/**
+ * Render a catalog entry and apply it into an existing scaffolded app on disk.
+ *
+ * SECURITY — containment is enforced HERE, on every write.
+ * --------------------------------------------------------
+ * Each output path is derived from a catalog EJS template rendered with
+ * CUSTOMER params (e.g. `webapp/ext/fragment/<%- ns %>Chart.fragment.xml`), so a
+ * hostile param could otherwise carry `..` and escape `appDir`. Every path this
+ * function writes — rendered files, manifest.json, and the i18n file (whose
+ * relative location is itself read from on-disk manifest data) — is resolved
+ * through `resolveSafePath(opts.appDir, rel)`, which throws PathOutsideRootError
+ * if the resolved absolute path is not contained under appDir. This is the
+ * authoritative defense; the catalog-side `ns` pattern (render.ts) is the
+ * second, earlier layer.
+ */
+export function applyEntry(opts) {
+    const rendered = renderEntry(getEntry(opts.entryName), opts.params);
+    // 1. write files — re-validate EVERY rendered (param-derived) path against appDir.
+    for (const f of rendered.files) {
+        const abs = resolveSafePath(opts.appDir, f.path);
+        mkdirSync(dirname(abs), { recursive: true });
+        writeFileSync(abs, f.content, 'utf8');
+    }
+    // 2. merge manifest — ALWAYS re-read from disk (I2). Fixed relative path, but
+    // routed through resolveSafePath for uniform containment.
+    const manifestPath = resolveSafePath(opts.appDir, 'webapp/manifest.json');
+    const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    let merged = mergeManifest(manifest, rendered.manifestPatch);
+    for (const lib of rendered.libraries) {
+        merged = mergeManifest(merged, { 'sap.ui5': { dependencies: { libs: { [lib]: {} } } } });
+    }
+    writeFileSync(manifestPath, JSON.stringify(merged, null, 2), 'utf8');
+    // 3. append i18n — resolve path from sap.app.i18n (M1). i18nRel is on-disk
+    // data, not a render param, but it still drives a write target, so contain it.
+    const i18nRel = merged['sap.app']?.i18n ?? 'i18n/i18n.properties';
+    const i18nPath = resolveSafePath(opts.appDir, `webapp/${i18nRel}`);
+    const existing = existsSync(i18nPath) ? readFileSync(i18nPath, 'utf8') : '';
+    if (Object.keys(rendered.i18nKeys).length) {
+        mkdirSync(dirname(i18nPath), { recursive: true });
+        writeFileSync(i18nPath, appendI18n(existing, rendered.i18nKeys), 'utf8');
+    }
+}

package/dist/tools/fiori/bin.js

@@ -0,0 +1,3 @@
+// cspeach-cli/src/tools/fiori/bin.ts
+import { runFioriCli } from './cli.js';
+runFioriCli(process.argv.slice(2)).then((code) => process.exit(code));

package/dist/tools/fiori/catalog/index.js

@@ -0,0 +1,27 @@
+// cspeach-cli/src/tools/fiori/catalog/index.ts
+//
+// Catalog index for the Fiori engine.
+// v1 scope: only the two "fiddly" SAPUI5 patterns — viz-chart and value-help.
+// confirm-dialog (4.1), list-table-page (4.2), object-detail-page (4.3),
+// message-toast (4.4) are SKILL.md recipes, not catalog entries.
+import { vizChart } from './viz-chart.js';
+import { valueHelp } from './value-help.js';
+export const CATALOG = [vizChart, valueHelp];
+export function getEntry(name) {
+    const e = CATALOG.find((x) => x.name === name);
+    if (!e)
+        throw new Error(`Unknown catalog entry "${name}". Available: ${CATALOG.map((c) => c.name).join(', ')}`);
+    return e;
+}
+export function listCatalog() {
+    // params included so the agent can construct a correct `apply --params` call
+    // straight from `fiori list` — no trial-and-error against required-param errors.
+    return CATALOG.map(({ name, title, description, categories, libraries, params }) => ({
+        name,
+        title,
+        description,
+        categories,
+        libraries,
+        params,
+    }));
+}

package/dist/tools/fiori/catalog/value-help.js

@@ -0,0 +1,230 @@
+// cspeach-cli/src/tools/fiori/catalog/value-help.ts
+//
+// SAPUI5 ValueHelpDialog (F4 help) entry.
+// Authored against the public sap.ui.comp.valuehelpdialog.ValueHelpDialog API.
+// Source inspiration: SAPUI5 SDK ValueHelpDialog demokit (ui5.sap.com/#/api/sap.ui.comp.valuehelpdialog.ValueHelpDialog).
+// This is an original authoring against the public API — not a copy of any Apache-licensed sample.
+// NOTE: sap.ui.comp is a SAPUI5-only library (not available in OpenUI5).
+export const valueHelp = {
+    name: 'value-help',
+    title: 'ValueHelpDialog (F4 value help)',
+    description: 'A sap.ui.comp.valuehelpdialog.ValueHelpDialog F4 help backed by a second OData entity. ' +
+        'Opens a search-and-select dialog, lets the user pick a key+description row, and writes the ' +
+        'selected key back to a target field. Single-select by default. Use for any code/key field ' +
+        'that needs a search dialog (customer, material, cost centre, etc.).',
+    engine: 'freestyle',
+    ui5MinVersion: '1.54.0',
+    libraries: ['sap.ui.comp', 'sap.m', 'sap.ui.core'],
+    categories: ['dialog', 'value-help', 'f4', 'search', 'selection'],
+    files: [
+        {
+            // Fragment: declares the ValueHelpDialog as a dependent; used by the controller mixin.
+            // The dialog is created programmatically in the mixin (not in XML) because
+            // ValueHelpDialog requires JS-side column and token configuration.
+            // This fragment is a thin host container — a Panel that shows the currently
+            // selected value token inline (optional), giving the agent a drop-in XML widget.
+            path: 'webapp/ext/fragment/<%- ns %>ValueHelp.fragment.xml',
+            content: `<core:FragmentDefinition
+  xmlns="sap.m"
+  xmlns:core="sap.ui.core">
+  <!--
+    <%- ns %>ValueHelp — F4 value-help trigger widget.
+    Drop this fragment into any form field row.
+    Bind the Input value to your form model field (e.g. {formModel>/<%- targetField %>}).
+    The press handler opens the ValueHelpDialog via the controller mixin.
+  -->
+  <HBox alignItems="Center">
+    <Input
+      id="<%- ns %>VHInput"
+      value="{formModel>/<%- targetField %>}"
+      placeholder="{i18n><%- ns %>.vhPlaceholder}"
+      showValueHelp="true"
+      valueHelpRequest=".open<%- ns %>ValueHelp"
+      width="100%" />
+  </HBox>
+</core:FragmentDefinition>`,
+        },
+        {
+            // Controller mixin: creates and wires the ValueHelpDialog
+            path: 'webapp/controller/ext/<%- ns %>ValueHelp.js',
+            content: `sap.ui.define([
+  "sap/ui/comp/valuehelpdialog/ValueHelpDialog",
+  "sap/m/Token",
+  "sap/ui/model/Filter",
+  "sap/ui/model/FilterOperator"
+], function (ValueHelpDialog, Token, Filter, FilterOperator) {
+  "use strict";
+
+  /**
+   * Controller mixin for <%- ns %>ValueHelp.
+   *
+   * Provides F4 value help for the "<%- targetField %>" field.
+   * Help entity: <%- helpEntityPath %>  Key: <%- keyField %>  Description: <%- descriptionField %>
+   *
+   * Usage:
+   *   Object.assign(this, <%- ns %>ValueHelpMixin);
+   *   // In your XML form bind the Input valueHelpRequest=".open<%- ns %>ValueHelp"
+   */
+  var <%- ns %>ValueHelpMixin = {
+
+    /**
+     * Opens the ValueHelpDialog. Wired to valueHelpRequest on the Input control.
+     * @param {sap.ui.base.Event} oEvent
+     */
+    open<%- ns %>ValueHelp: function (oEvent) {
+      var oView = this.getView();
+      var oModel = oView.getModel(); // default OData model
+
+      if (!this._o<%- ns %>VHDialog) {
+        this._o<%- ns %>VHDialog = new ValueHelpDialog({
+          title: oView.getModel("i18n").getResourceBundle().getText("<%- ns %>.vhTitle"),
+          supportMultiselect: false,
+          supportRanges: false,
+          key: "<%- keyField %>",
+          descriptionKey: "<%- descriptionField %>",
+          ok: this._on<%- ns %>VHConfirm.bind(this),
+          cancel: this._on<%- ns %>VHCancel.bind(this),
+          afterClose: function () {
+            this._o<%- ns %>VHDialog.destroy();
+            this._o<%- ns %>VHDialog = null;
+          }.bind(this)
+        });
+
+        // Device-agnostic column setup via the "columns" named model.
+        // ValueHelpDialog.getTable() returns sap.ui.table.Table on desktop/tablet
+        // and sap.m.Table on phone. Neither shares the same column/items API,
+        // so we use the canonical "columns" model approach that works for both.
+        var oTable = this._o<%- ns %>VHDialog.getTable();
+        oTable.setModel(oModel);
+
+        // 1. Describe columns via a named JSON model — VHD reads this model
+        //    to render grid columns on desktop (sap.ui.table.Table).
+        var oColModel = new sap.ui.model.json.JSONModel({
+          cols: [
+            { label: "<%- keyField %>",         template: "<%- keyField %>" },
+            { label: "<%- descriptionField %>",  template: "<%- descriptionField %>" }
+          ]
+        });
+        oTable.setModel(oColModel, "columns");
+
+        // 2. Bind rows/items device-aware: sap.ui.table.Table uses bindRows,
+        //    sap.m.Table (phone) uses bindItems.
+        // Normalise the entity path: strip a leading slash then re-prepend one
+        // so we never produce double-slash regardless of what helpEntityPath contains.
+        var sEntityPath = "/<%- helpEntityPath %>".replace(/^\\/+/, "/");
+        if (oTable.bindRows) {
+          // sap.ui.table.Table — desktop / tablet
+          oTable.bindRows(sEntityPath);
+        } else {
+          // sap.m.Table — phone
+          oTable.bindItems({
+            path: sEntityPath,
+            template: new sap.m.ColumnListItem({
+              cells: [
+                new sap.m.Text({ text: "{<%- keyField %>}" }),
+                new sap.m.Text({ text: "{<%- descriptionField %>}" })
+              ]
+            })
+          });
+        }
+        this._o<%- ns %>VHDialog.update();
+
+        // Pre-select current value if set
+        var sCurrentKey = oView.getModel("formModel") &&
+          oView.getModel("formModel").getProperty("/<%- targetField %>");
+        if (sCurrentKey) {
+          this._o<%- ns %>VHDialog.setTokens([new Token({ key: sCurrentKey, text: sCurrentKey })]);
+        }
+      }
+
+      this._o<%- ns %>VHDialog.open();
+    },
+
+    /**
+     * OK handler — transfers the selected token key to the target field.
+     * @param {sap.ui.base.Event} oEvent
+     */
+    _on<%- ns %>VHConfirm: function (oEvent) {
+      var aTokens = oEvent.getParameter("tokens");
+      var oFormModel = this.getView().getModel("formModel");
+      if (aTokens && aTokens.length > 0 && oFormModel) {
+        oFormModel.setProperty("/<%- targetField %>", aTokens[0].getKey());
+      }
+      if (this._o<%- ns %>VHDialog) {
+        this._o<%- ns %>VHDialog.close();
+      }
+    },
+
+    /**
+     * Cancel handler — closes without changes.
+     */
+    _on<%- ns %>VHCancel: function () {
+      if (this._o<%- ns %>VHDialog) {
+        this._o<%- ns %>VHDialog.close();
+      }
+    }
+  };
+
+  return <%- ns %>ValueHelpMixin;
+});`,
+        },
+    ],
+    manifestPatch: {
+        'sap.ui5': {
+            dependencies: {
+                libs: {
+                    'sap.ui.comp': {},
+                },
+            },
+        },
+    },
+    i18nKeys: {
+        '<%- ns %>.vhTitle': '<%- ns %> Search',
+        '<%- ns %>.vhPlaceholder': 'Select <%- ns %>…',
+    },
+    params: {
+        appId: {
+            type: 'string',
+            required: true,
+            from: 'context.app.id',
+            description: 'Application namespace ID, e.g. zsales.app',
+        },
+        ns: {
+            type: 'string',
+            required: true,
+            // SECURITY: ns lands directly in a file path
+            // (webapp/ext/fragment/<ns>ValueHelp.fragment.xml). Constrain to a simple
+            // UI5-identifier fragment — letters/digits only, leading letter — so no
+            // dot, slash, or `..` can ever reach join(appDir, path).
+            pattern: '[A-Za-z][A-Za-z0-9]*',
+            description: 'PascalCase prefix for IDs and method names, e.g. Customer. Simple identifier only (letters/digits, leading letter).',
+        },
+        helpEntityPath: {
+            type: 'string',
+            required: true,
+            description: 'Absolute OData binding path for the help entity set, e.g. /Customers',
+        },
+        keyField: {
+            type: 'string',
+            required: true,
+            description: 'Property name of the key column in the help entity, e.g. CustomerID',
+        },
+        descriptionField: {
+            type: 'string',
+            required: true,
+            description: 'Property name of the description column in the help entity, e.g. CustomerName',
+        },
+        targetField: {
+            type: 'string',
+            required: true,
+            description: 'Property path on formModel to write the selected key into, e.g. CustomerID',
+        },
+    },
+    source: {
+        url: 'https://ui5.sap.com/#/api/sap.ui.comp.valuehelpdialog.ValueHelpDialog',
+        license: 'SAPUI5 — authored against the public ValueHelpDialog API; not copied from Apache-licensed source',
+        adaptedFrom: 'Original authoring against sap.ui.comp.valuehelpdialog.ValueHelpDialog public API. ' +
+            'sap.ui.comp is a SAPUI5-only library (not OpenUI5); targets SAPUI5 runtime. ' +
+            'Pattern adapted from standard F4 help implementation approach documented in SAP ABAP Fiori guidelines.',
+    },
+};

package/dist/tools/fiori/catalog/viz-chart.js

@@ -0,0 +1,177 @@
+// cspeach-cli/src/tools/fiori/catalog/viz-chart.ts
+//
+// SAPUI5 VizFrame column/bar chart entry.
+// Authored against the public sap.viz.ui5.controls.VizFrame API.
+// Source inspiration: SAPUI5 SDK VizFrame demokit samples (ui5.sap.com/#/entity/sap.viz.ui5.controls.VizFrame).
+// This is an original authoring against the public API — not a copy of any Apache-licensed sample.
+export const vizChart = {
+    name: 'viz-chart',
+    title: 'VizFrame chart (column / bar / line)',
+    description: 'A sap.viz.ui5.controls.VizFrame chart bound to an OData list via FlattenedDataset. ' +
+        'Supports column, bar, and line chart types. Configures one dimension (category axis) ' +
+        'and one or more measures (value axis). Use when you need an analytic chart inline in a page or dialog.',
+    engine: 'freestyle',
+    ui5MinVersion: '1.54.0',
+    libraries: ['sap.viz', 'sap.m', 'sap.ui.core'],
+    categories: ['chart', 'analytics', 'visualization'],
+    files: [
+        {
+            // Fragment: VizFrame with inline FlattenedDataset
+            path: 'webapp/ext/fragment/<%- ns %>Chart.fragment.xml',
+            content: `<core:FragmentDefinition
+  xmlns="sap.m"
+  xmlns:core="sap.ui.core"
+  xmlns:viz="sap.viz.ui5.controls"
+  xmlns:viz.data="sap.viz.ui5.data"
+  xmlns:viz.feeds="sap.viz.ui5.controls.common.feeds">
+  <viz:VizFrame
+    id="<%- ns %>VizFrame"
+    vizType="<%- locals.vizType || 'column' %>"
+    width="100%"
+    height="380px"
+    uiConfig="{applicationSet:'fiori2'}"
+    vizProperties="{ title: { visible: false } }">
+    <viz:dataset>
+      <viz.data:FlattenedDataset data="{<%- listPath %>}">
+        <viz.data:dimensions>
+          <viz.data:DimensionDefinition
+            name="<%- dimensionField %>"
+            value="{<%- dimensionField %>}" />
+        </viz.data:dimensions>
+        <viz.data:measures>
+          <viz.data:MeasureDefinition
+            name="<%- measureFields[0] %>"
+            value="{<%- measureFields[0] %>}" />
+        </viz.data:measures>
+      </viz.data:FlattenedDataset>
+    </viz:dataset>
+    <viz:feeds>
+      <viz.feeds:FeedItem
+        uid="categoryAxis"
+        type="Dimension"
+        values="<%- dimensionField %>" />
+      <viz.feeds:FeedItem
+        uid="valueAxis"
+        type="Measure"
+        values="<%- measureFields[0] %>" />
+    </viz:feeds>
+  </viz:VizFrame>
+</core:FragmentDefinition>`,
+        },
+        {
+            // Controller mixin: lazy-loads the fragment and wires additional measures
+            path: 'webapp/controller/ext/<%- ns %>Chart.js',
+            content: `sap.ui.define([
+  "sap/ui/core/Fragment"
+], function (Fragment) {
+  "use strict";
+
+  /**
+   * Controller mixin for <%- ns %>Chart.
+   * Renders a VizFrame column/bar/line chart bound to <%- listPath %>.
+   * Dimension: <%- dimensionField %>.
+   *
+   * Usage: extend your controller with Object.assign(this, <%- ns %>ChartMixin).
+   */
+  var <%- ns %>ChartMixin = {
+
+    /**
+     * Open / show the chart fragment as a dependent of the current view.
+     * The fragment ID will be <view-id>--<%- ns %>VizFrame.
+     */
+    open<%- ns %>Chart: function () {
+      var oView = this.getView();
+      if (!this._p<%- ns %>Chart) {
+        this._p<%- ns %>Chart = Fragment.load({
+          id: oView.getId(),
+          name: "<%- appId %>.ext.fragment.<%- ns %>Chart",
+          controller: this
+        }).then(function (oFrag) {
+          oView.addDependent(oFrag);
+          // Wire additional measures if provided
+          var oVizFrame = oView.byId("<%- ns %>VizFrame");
+          if (oVizFrame) {
+            var oDataset = oVizFrame.getDataset();
+            var aExtraMeasures = <%- JSON.stringify(measureFields) %>.slice(1);
+            aExtraMeasures.forEach(function (sMeasure) {
+              oDataset.addMeasure(
+                new sap.viz.ui5.data.MeasureDefinition({ name: sMeasure, value: "{" + sMeasure + "}" })
+              );
+              oVizFrame.addFeed(
+                new sap.viz.ui5.controls.common.feeds.FeedItem({
+                  uid: "valueAxis", type: "Measure", values: sMeasure
+                })
+              );
+            });
+          }
+          return oFrag;
+        });
+      }
+      this._p<%- ns %>Chart.then(function (oFrag) {
+        if (typeof oFrag.open === "function") { oFrag.open(); }
+      });
+    }
+  };
+
+  return <%- ns %>ChartMixin;
+});`,
+        },
+    ],
+    manifestPatch: {
+        'sap.ui5': {
+            dependencies: {
+                libs: {
+                    'sap.viz': {},
+                },
+            },
+        },
+    },
+    i18nKeys: {
+        '<%- ns %>.chartTitle': '<%- ns %> Chart',
+    },
+    params: {
+        appId: {
+            type: 'string',
+            required: true,
+            from: 'context.app.id',
+            description: 'Application namespace ID, e.g. zsales.app',
+        },
+        ns: {
+            type: 'string',
+            required: true,
+            // SECURITY: ns lands directly in a file path
+            // (webapp/ext/fragment/<ns>Chart.fragment.xml). Constrain to a simple
+            // UI5-identifier fragment — letters/digits only, leading letter — so no
+            // dot, slash, or `..` can ever reach join(appDir, path).
+            pattern: '[A-Za-z][A-Za-z0-9]*',
+            description: 'PascalCase prefix for all generated IDs and method names, e.g. Revenue. Simple identifier only (letters/digits, leading letter).',
+        },
+        vizType: {
+            type: 'string',
+            required: false,
+            description: 'VizFrame vizType: column (default), bar, line, pie',
+        },
+        listPath: {
+            type: 'string',
+            required: true,
+            description: 'OData binding path for the list, e.g. /SalesOrderItems',
+        },
+        dimensionField: {
+            type: 'string',
+            required: true,
+            description: 'Property name used as the chart dimension (category axis), e.g. Material',
+        },
+        measureFields: {
+            type: 'array',
+            required: true,
+            description: 'Array of property names for value-axis measures, e.g. ["NetAmount","TaxAmount"]',
+        },
+    },
+    source: {
+        url: 'https://ui5.sap.com/#/entity/sap.viz.ui5.controls.VizFrame',
+        license: 'SAPUI5 — authored against the public VizFrame API; not copied from Apache-licensed source',
+        adaptedFrom: 'Original authoring against sap.viz.ui5.controls.VizFrame + sap.viz.ui5.data.FlattenedDataset public API ' +
+            '(SAPUI5 SDK demokit samples used as API reference only). ' +
+            'sap.viz is a SAPUI5-only library (not OpenUI5); targets SAPUI5 runtime.',
+    },
+};

package/dist/tools/fiori/cli.js

@@ -0,0 +1,71 @@
+// cspeach-cli/src/tools/fiori/cli.ts
+import { listCatalog } from './catalog/index.js';
+import { scaffoldFreestyle } from './scaffold.js';
+import { applyEntry } from './apply.js';
+import { writeDeployConfig } from './deploy-config.js';
+/** Parse `--key value` / `--key=value` / `--json '<json>'` into a record. */
+function parseFlags(argv) {
+    const out = {};
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (!a.startsWith('--'))
+            continue;
+        const eq = a.indexOf('=');
+        if (eq !== -1)
+            out[a.slice(2, eq)] = a.slice(eq + 1);
+        else {
+            out[a.slice(2)] = argv[i + 1] ?? '';
+            i++;
+        }
+    }
+    return out;
+}
+/** Engine command surface invoked by the agent via shell_exec. Returns exit code. */
+export async function runFioriCli(argv, log = console.log) {
+    const [cmd, ...rest] = argv;
+    try {
+        switch (cmd) {
+            case 'list':
+                log(JSON.stringify(listCatalog(), null, 2));
+                return 0;
+            case 'scaffold': {
+                const f = parseFlags(rest);
+                await scaffoldFreestyle({
+                    basePath: f.basePath, appId: f.appId, appTitle: f.appTitle ?? f.appId,
+                    template: f.template ?? 'basic',
+                    service: f.serviceUrl ? { url: f.serviceUrl, path: f.servicePath, version: f.serviceVersion ?? '4.0' } : undefined,
+                    typescript: f.typescript === 'true',
+                    ui5Version: f.ui5Version,
+                });
+                log(`scaffolded ${f.appId} at ${f.basePath}`);
+                return 0;
+            }
+            case 'apply': {
+                const f = parseFlags(rest);
+                applyEntry({ appDir: f.appDir, entryName: f.entry, params: JSON.parse(f.params ?? '{}') });
+                log(`applied ${f.entry} into ${f.appDir}`);
+                return 0;
+            }
+            case 'deploy-config': {
+                const f = parseFlags(rest);
+                writeDeployConfig(f.appDir, {
+                    url: f.url, client: f.client, appName: f.name,
+                    description: f.description,
+                    package: f.package, transport: f.transport ?? '',
+                    ignoreCertErrors: f.ignoreCertErrors === 'true',
+                });
+                log(`deploy config written: ${f.appDir}/ui5-deploy.yaml (app ${f.name} -> package ${f.package}` +
+                    `${f.transport ? `, transport ${f.transport}` : ''}). ` +
+                    `Run \`npm run deploy-test\` to validate without deploying.`);
+                return 0;
+            }
+            default:
+                log(`Unknown fiori subcommand "${cmd}". Use: list | scaffold | apply | deploy-config`);
+                return 1;
+        }
+    }
+    catch (e) {
+        log(`ERROR: ${e.message}`);
+        return 1;
+    }
+}

package/dist/tools/fiori/deploy-config.js

@@ -0,0 +1,73 @@
+// cspeach-cli/src/tools/fiori/deploy-config.ts
+//
+// Writes the ABAP-repository deploy configuration for a scaffolded app:
+// ui5-deploy.yaml (deploy-to-abap custom task, shape grounded against the
+// bundled @sap/ux-ui5-tooling `fiori deploy --help` output, 2026-06-10) and
+// the package.json `deploy` / `deploy-test` scripts.
+//
+// Credentials are NEVER written here — `fiori deploy --username/--password`
+// take the NAMES of environment variables at deploy time.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+export function writeDeployConfig(appDir, opts) {
+    const appName = opts.appName;
+    if (appName.length > 15) {
+        throw new Error(`BSP app name "${appName}" exceeds 15 characters (ABAP repository limit)`);
+    }
+    if (appName !== appName.toUpperCase()) {
+        throw new Error(`BSP app name "${appName}" must be uppercase`);
+    }
+    const pkg = opts.package.toUpperCase();
+    if (!/^(\$TMP|[ZY][A-Z0-9_]*|\/[A-Z0-9_]+\/[A-Z0-9_]+)$/.test(pkg)) {
+        throw new Error(`Package "${opts.package}" is not in the customer namespace (Z-/Y-prefixed, $TMP, or /namespace/pkg)`);
+    }
+    const isTmp = pkg === '$TMP';
+    if (!isTmp && !/^[A-Z0-9]{3}K[0-9]{6,}$/.test(opts.transport)) {
+        throw new Error(`A valid workbench transport (e.g. S4HK903359) is required unless package is $TMP — got "${opts.transport}"`);
+    }
+    const pkgJsonPath = join(appDir, 'package.json');
+    const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
+    const projectName = pkgJson.name ?? appName.toLowerCase();
+    // TLS posture (2026-06-14): only disable cert verification when the caller
+    // explicitly opted into insecure (wired from the per-alias
+    // insecure_skip_tls_verify flag). When a CA is configured / verification is
+    // on, leave cert errors enabled — the OS/Node trust + CA handle it. The
+    // insecure line carries a loud dev-only comment.
+    const insecure = opts.ignoreCertErrors === true;
+    const certLine = insecure
+        ? 'ignoreCertErrors: true  # dev only — configure a CA for production'
+        : 'ignoreCertErrors: false';
+    const yaml = `# yaml-language-server: $schema=https://sap.github.io/ui5-tooling/schema/ui5.yaml.json
+# Deploy configuration — written by the CSPeach fiori engine.
+# Run \`npm run deploy-test\` first: the backend validates WITHOUT deploying.
+specVersion: "4.0"
+metadata:
+  name: ${projectName}
+type: application
+builder:
+  resources:
+    excludes:
+      - /test/**
+      - /localService/**
+  customTasks:
+    - name: deploy-to-abap
+      afterTask: generateCachebusterInfo
+      configuration:
+        ${certLine}
+        target:
+          url: ${opts.url}
+          client: "${opts.client}"
+        app:
+          name: ${appName}
+          description: ${opts.description ?? projectName}
+          package: ${pkg}
+          transport: ${isTmp ? '""' : opts.transport}
+        exclude:
+          - /test/
+`;
+    writeFileSync(join(appDir, 'ui5-deploy.yaml'), yaml, 'utf8');
+    pkgJson.scripts = pkgJson.scripts ?? {};
+    pkgJson.scripts['deploy'] = 'npm run build && fiori deploy --config ui5-deploy.yaml';
+    pkgJson.scripts['deploy-test'] = 'npm run build && fiori deploy --config ui5-deploy.yaml --testMode --yes';
+    writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\n', 'utf8');
+}