@sap/cds-dk 9.9.3 → 10.0.3

package/lib/upgrade/steps/removals.js

@@ -0,0 +1,88 @@
+'use strict';
+
+const path = require('node:path');
+const { dependencyUpdatesFor } = require('../constants');
+
+// User-facing text keyed by dep name. `hint` follows the dep name in the
+// recommendation line; `column` is the display suffix in the file list.
+const REMOVAL_COPY = {
+  '@sap/cds-compiler': {
+    hint: 'we recommend removing this dependency. It is unlikely that you need to call its API directly.',
+    column: '@sap/cds-compiler',
+  },
+  '@sap/cds-dk': {
+    hint: 'we recommend removing this dependency (it is a global tool).',
+    column: '@sap/cds-dk',
+  },
+};
+
+async function runRemovals(ctx, cds) {
+  const { askYesNo, NonTTYError } = require('../util/prompt');
+  const { info, bold, dim } = require('../../util/term');
+
+  const removals = ctx.proposal?.removals || [];
+  if (removals.length === 0) return;
+
+  const dep = dependencyUpdatesFor(ctx.target);
+  const bumpRange = name => dep.node?.[name] || `^${ctx.target}`;
+
+  // Group by dep name.
+  const byName = new Map();
+  for (const r of removals) {
+    if (!byName.has(r.name)) byName.set(r.name, []);
+    byName.get(r.name).push(r);
+  }
+
+  for (const [name, list] of byName) {
+    const copy = REMOVAL_COPY[name] || {
+      hint: 'we recommend removing this dependency.',
+      column: name,
+    };
+    console.log();
+    console.log(`'${name}': ${copy.hint}`);
+    console.log();
+    for (const r of list) {
+      console.log(`  ${bold(path.relative(cds.root, r.file))} > ${copy.column}`);
+    }
+    console.log();
+
+    let accept;
+    try {
+      accept = await askYesNo('Remove it?');
+    } catch (e) {
+      if (e instanceof NonTTYError) return;   // skip silently on non-TTY
+      throw e;
+    }
+
+    // Apply either removal (accept) or version bump (decline).
+    const files = new Set(list.map(r => r.file));
+    for (const pkgPath of files) {
+      const pkg = JSON.parse(cds.utils.fs.readFileSync(pkgPath, 'utf8'));
+      let touched = false;
+      let action;
+      for (const kind of ['dependencies', 'devDependencies']) {
+        const current = pkg[kind]?.[name];
+        if (!current) continue;
+        if (accept) {
+          delete pkg[kind][name];
+          action = `removed ${name}`;
+          touched = true;
+        } else {
+          const target = bumpRange(name);
+          if (current !== target) {
+            pkg[kind][name] = target;
+            action = `${name}: ${current} → ${target}`;
+            touched = true;
+          }
+        }
+      }
+      if (touched) {
+        cds.utils.fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+        console.log(`  ${info('✓')} ${path.relative(cds.root, pkgPath)}  ${dim(`(${action})`)}`);
+        ctx.rewriteRan = true;
+      }
+    }
+  }
+}
+
+module.exports = { runRemovals };

package/lib/upgrade/steps/rewrite.js

@@ -0,0 +1,167 @@
+'use strict'
+
+const { dependencyUpdatesFor, rangeSatisfiesTarget, targetMinNode, engineNodeMeetsMin } = require('../constants')
+const { parsePomXml, getPomPropertyValue } = require('../util/pom')
+
+function buildProposal(ctx, cds) {
+  const updates = []
+  const removals = []
+  const dep = dependencyUpdatesFor(ctx.target)
+  const minNode = targetMinNode(ctx.target)
+
+  // Removals: @sap/cds-compiler always; @sap/cds-dk only in Node-only projects.
+  // These deps own their own prompt (see runRemovals) — skip them here so
+  // they are not double-proposed as regular updates.
+  const removalNames = new Set(['@sap/cds-compiler'])
+  if (!ctx.project.isJava) removalNames.add('@sap/cds-dk')
+
+  if (ctx.project.isNode) {
+    for (const pkgPath of ctx.project.packageJsonFiles) {
+      let pkg
+      try { pkg = JSON.parse(cds.utils.fs.readFileSync(pkgPath, 'utf8')) } catch { continue }
+
+      for (const [name, targetRange] of Object.entries(dep.node)) {
+        if (removalNames.has(name)) continue
+        for (const kind of ['dependencies', 'devDependencies']) {
+          const current = pkg[kind]?.[name]
+          if (!current) continue
+          if (rangeSatisfiesTarget(current, ctx.target)) continue
+          if (current === targetRange) continue
+          updates.push({
+            file: pkgPath, name, from: current, to: targetRange,
+            kind: kind === 'dependencies' ? 'node-dep' : 'node-devDep',
+          })
+        }
+      }
+
+      // engines.node: propose a bump only when the package actually declares
+      // an `engines` block. Missing engines is a user choice, not a defect.
+      if (minNode !== null && pkg.engines && Object.keys(pkg.engines).length > 0) {
+        const current = pkg.engines.node
+        if (!engineNodeMeetsMin(current, minNode)) {
+          const to = `>=${minNode}`
+          if (current !== to) {
+            updates.push({
+              file: pkgPath, name: 'engines.node', from: current || '(missing)', to,
+              kind: 'node-engines-node',
+            })
+          }
+        }
+      }
+
+      for (const name of removalNames) {
+        for (const kind of ['dependencies', 'devDependencies']) {
+          if (pkg[kind]?.[name]) {
+            removals.push({
+              file: pkgPath, name, from: pkg[kind][name], to: null,
+              kind: kind === 'dependencies' ? 'node-dep' : 'node-devDep',
+            })
+          }
+        }
+      }
+    }
+  }
+
+  if (ctx.project.isJava) {
+    for (const pomPath of ctx.project.pomXmlFiles) {
+      let pom
+      try { pom = parsePomXml(pomPath) } catch { continue }
+      for (const [name, value] of Object.entries(dep.java)) {
+        const current = getPomPropertyValue(pom, name)
+        if (current && current !== value) {
+          updates.push({ file: pomPath, name, from: current, to: value, kind: 'pom-property' })
+        }
+      }
+    }
+  }
+
+  return { updates, removals }
+}
+
+async function runRewrite(ctx, cds) {
+  const { askYesNo, NonTTYError } = require('../util/prompt');
+  const path = require('node:path');
+  const { info, bold, dim } = require('../../util/term');
+
+  const { updates, removals } = buildProposal(ctx, cds);
+  ctx.proposal = { updates, removals };
+
+  if (updates.length === 0) return { applied: false, aborted: false };
+
+  console.log();
+  console.log('These dependencies can be upgraded:');
+  console.log();
+  const byFile = new Map();
+  for (const u of updates) {
+    if (!byFile.has(u.file)) byFile.set(u.file, []);
+    byFile.get(u.file).push(u);
+  }
+  for (const [file, list] of byFile) {
+    console.log(`  ${bold(path.relative(cds.root, file))}`);
+    const nameCol = Math.max(...list.map(u => u.name.length));
+    const fromCol = Math.max(...list.map(u => u.from.length));
+    for (const u of list) {
+      console.log(`    ${u.name.padEnd(nameCol)}: ${u.from.padEnd(fromCol)} → ${u.to}`);
+    }
+  }
+  console.log();
+
+  let accept;
+  try {
+    accept = await askYesNo('Update the dependencies?');
+  } catch (e) {
+    if (e instanceof NonTTYError) {
+      console.log('Non-interactive mode: stopping without changes. Re-run in a terminal to apply.');
+      return { applied: false, aborted: true, reason: 'non-tty' };
+    }
+    throw e;
+  }
+  if (!accept) return { applied: false, aborted: true, reason: 'user-declined' };
+
+  // Apply.
+  let anyWritten = false;
+  const nodeUpdates = updates.filter(u =>
+    u.kind === 'node-dep' || u.kind === 'node-devDep' || u.kind === 'node-engines-node');
+  const pomUpdates = updates.filter(u => u.kind === 'pom-property');
+
+  const nodeFiles = new Set(nodeUpdates.map(u => u.file));
+  for (const pkgPath of nodeFiles) {
+    const pkg = JSON.parse(cds.utils.fs.readFileSync(pkgPath, 'utf8'));
+    let count = 0;
+    for (const u of nodeUpdates.filter(x => x.file === pkgPath)) {
+      if (u.kind === 'node-engines-node') {
+        pkg.engines = pkg.engines || {};
+        pkg.engines.node = u.to;
+        count++;
+        continue;
+      }
+      const k = u.kind === 'node-dep' ? 'dependencies' : 'devDependencies';
+      if (pkg[k]?.[u.name]) { pkg[k][u.name] = u.to; count++; }
+    }
+    if (count > 0) {
+      cds.utils.fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
+      console.log(`  ${info('✓')} ${path.relative(cds.root, pkgPath)}  ${dim(`(${count} changes)`)}`);
+      anyWritten = true;
+    }
+  }
+
+  if (pomUpdates.length > 0) {
+    const { updatePomPropertyInFile } = require('../util/pom');
+    const pomFiles = new Set(pomUpdates.map(u => u.file));
+    for (const pomPath of pomFiles) {
+      let count = 0;
+      for (const u of pomUpdates.filter(x => x.file === pomPath)) {
+        if (updatePomPropertyInFile(pomPath, u.name, u.to)) count++;
+      }
+      if (count > 0) {
+        console.log(`  ${info('✓')} ${path.relative(cds.root, pomPath)}  ${dim(`(${count} changes)`)}`);
+        anyWritten = true;
+      }
+    }
+  }
+
+  ctx.rewriteRan = anyWritten;
+  return { applied: anyWritten, aborted: false };
+}
+
+module.exports = { runRewrite, buildProposal }

package/lib/upgrade/steps/verify.js

@@ -0,0 +1,96 @@
+'use strict';
+
+const path = require('node:path');
+const { exec } = require('node:child_process');
+const util = require('node:util');
+const execAsync = util.promisify(exec);
+
+const { parsePomXml, getPomPropertyValue } = require('../util/pom');
+const { javaCdsMajorFor, TRACKED_MAJOR_MAP } = require('../constants');
+
+const NODE_TRACK = Object.keys(TRACKED_MAJOR_MAP);
+
+// Resolve a Node dep's *cds* major from its installed npm major, using the
+// same mapping the consistency check applies. Identity for @sap/cds and
+// @sap/cds-dk (npm major === cds major); table lookup for @sap/cds-mtxs
+// (major 4 → cds 10) and @sap/cds-compiler (major 7 → cds 10).
+function cdsMajorFor(name, npmMajor) {
+  const map = TRACKED_MAJOR_MAP[name];
+  if (map === null) return npmMajor;
+  return map[npmMajor] ?? null;
+}
+
+async function verifyNode(ctx, cds) {
+  const semver = require('semver');
+  const mismatches = [];
+  let stdout = '';
+  try {
+    const r = await execAsync(
+      `npm ls ${NODE_TRACK.join(' ')} --depth=0 --json`,
+      { cwd: cds.root, maxBuffer: 8 * 1024 * 1024 }
+    );
+    stdout = r.stdout;
+  } catch (e) {
+    stdout = e.stdout || '';   // npm ls returns non-zero for unmet peer deps; parse anyway
+  }
+  if (!stdout) return mismatches;
+
+  let tree;
+  try { tree = JSON.parse(stdout); } catch { return mismatches; }
+  const walk = (deps) => {
+    if (!deps) return;
+    for (const [name, entry] of Object.entries(deps)) {
+      if (NODE_TRACK.includes(name) && entry.version) {
+        const npmMajor = semver.major(entry.version);
+        const cdsMajor = cdsMajorFor(name, npmMajor);
+        if (cdsMajor !== ctx.target) {
+          mismatches.push({ scope: 'node', name, resolved: entry.version, expected: ctx.target });
+        }
+      }
+      walk(entry.dependencies);
+    }
+  };
+  walk(tree.dependencies);
+  return mismatches;
+}
+
+function verifyJava(ctx, cds) {
+  const mismatches = [];
+  for (const pomPath of ctx.project.pomXmlFiles) {
+    let pom;
+    try { pom = parsePomXml(pomPath); } catch { continue; }
+    const raw = getPomPropertyValue(pom, 'cds.services.version');
+    if (!raw) continue;
+    const m = raw.match(/^(\d+)/);
+    if (!m) continue;
+    const javaMajor = parseInt(m[1], 10);
+    const cdsMajor = javaCdsMajorFor(javaMajor);
+    if (cdsMajor !== ctx.target) {
+      mismatches.push({
+        scope: 'java', file: path.relative(cds.root, pomPath),
+        name: 'cds.services.version', resolved: raw, expected: ctx.target,
+      });
+    }
+  }
+  return mismatches;
+}
+
+async function runVerify(ctx, cds) {
+  const { error, bold, dim } = require('../../util/term');
+  const mismatches = [
+    ...(ctx.project.isNode ? await verifyNode(ctx, cds) : []),
+    ...(ctx.project.isJava ? verifyJava(ctx, cds) : []),
+  ];
+  if (mismatches.length > 0) {
+    console.log();
+    console.log(bold('Verification:'));
+    for (const m of mismatches) {
+      const prefix = m.file ? `${m.file}  ` : '';
+      console.log(`  ${error('✗')} ${prefix}${m.name} ${m.resolved}  ${dim(`(expected cds ${m.expected})`)}`);
+    }
+  }
+  ctx.verifyMismatches = mismatches;
+  return { mismatches };
+}
+
+module.exports = { runVerify, cdsMajorFor };

package/lib/upgrade/util/pom.js

@@ -0,0 +1,46 @@
+'use strict'
+
+const { parseXml } = require('../../init/xml')
+
+function parsePomXml(filePath) {
+  return parseXml(filePath)
+}
+
+function updatePomPropertyInFile(filePath, propertyName, newValue) {
+  const cds = require('../../cds')
+  const { fs } = cds.utils
+
+  const content = fs.readFileSync(filePath, 'utf8')
+
+  // Match the property tag and replace its value
+  // Handles: <propertyName>oldValue</propertyName>
+  const regex = new RegExp(`(<${propertyName}>)[^<]*(</${propertyName}>)`, 'g')
+
+  if (!regex.test(content)) {
+    return false
+  }
+
+  const updated = content.replace(regex, `$1${newValue}$2`)
+  fs.writeFileSync(filePath, updated)
+  return true
+}
+
+function getPomPropertyValue(pomObject, propertyName) {
+  const props = pomObject?.properties?.[0]
+  if (!props || !props[propertyName]) return null
+
+  let value = props[propertyName]
+  if (Array.isArray(value)) value = value[0]
+  // xml-js with nativeType+textFn sometimes leaves `{ _text: [<value>] }` for
+  // leaf nodes that parsed as numbers. Unwrap to the actual value.
+  if (value && typeof value === 'object' && Array.isArray(value._text)) {
+    value = value._text[0]
+  }
+  return value == null ? null : String(value)
+}
+
+module.exports = {
+  parsePomXml,
+  updatePomPropertyInFile,
+  getPomPropertyValue,
+}

package/lib/upgrade/util/prompt.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const { ask4 } = require('../../util/question');
+
+class NonTTYError extends Error {
+  constructor(message = 'non-interactive stdin') {
+    super(message);
+    this.name = 'NonTTYError';
+  }
+}
+
+// Exported for unit testing; not part of the public API.
+function _parseAnswer(raw, defaultYes) {
+  const s = (raw || '').trim().toLowerCase();
+  if (s === '') return defaultYes;
+  if (s === 'y' || s === 'yes') return true;
+  if (s === 'n' || s === 'no') return false;
+  return defaultYes;
+}
+
+async function askYesNo(question, { defaultYes = true } = {}) {
+  if (!process.stdin.isTTY) throw new NonTTYError();
+  const suffix = defaultYes ? ' (Y/n) ' : ' (y/N) ';
+  const raw = await ask4([question + suffix]);
+  return _parseAnswer(raw, defaultYes);
+}
+
+module.exports = { askYesNo, NonTTYError, _parseAnswer };

package/lib/upgrade/util/workspaces.js

@@ -0,0 +1,111 @@
+'use strict';
+
+const path = require('node:path');
+const fs = require('node:fs');
+const { exec } = require('node:child_process');
+const util = require('node:util');
+const execAsync = util.promisify(exec);
+
+const SKIP_DIRS = new Set(['node_modules', '.git', 'target', 'dist', 'build']);
+
+function canonical(p) {
+  try {
+    return fs.realpathSync.native(p);
+  } catch {
+    return path.resolve(p);
+  }
+}
+
+function isValidChildDir(entry) {
+  return entry.isDirectory() && !entry.name.startsWith('.') && !SKIP_DIRS.has(entry.name);
+}
+
+function collectDirectChildren(baseDir, cds) {
+  const out = [];
+  if (!cds.utils.exists(baseDir)) return out;
+  const entries = cds.utils.fs.readdirSync(baseDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!isValidChildDir(entry)) continue;
+    const pkg = path.join(baseDir, entry.name, 'package.json');
+    if (cds.utils.exists(pkg)) out.push(pkg);
+  }
+  return out;
+}
+
+function collectRecursive(baseDir, cds, out = []) {
+  if (!cds.utils.exists(baseDir)) return out;
+  const entries = cds.utils.fs.readdirSync(baseDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!isValidChildDir(entry)) continue;
+    const sub = path.join(baseDir, entry.name);
+    const pkg = path.join(sub, 'package.json');
+    if (cds.utils.exists(pkg)) out.push(pkg);
+    collectRecursive(sub, cds, out);
+  }
+  return out;
+}
+
+function matchPattern(pattern, cds) {
+  if (pattern === '**' || pattern === '**/*') {
+    return collectRecursive(cds.root, cds);
+  }
+  if (pattern === '*') {
+    return collectDirectChildren(cds.root, cds);
+  }
+  if (pattern.endsWith('/**') || pattern.endsWith('/**/*')) {
+    const prefix = pattern.replace(/\/\*\*(\/\*)?$/, '');
+    return collectRecursive(path.join(cds.root, prefix), cds);
+  }
+  if (pattern.endsWith('/*')) {
+    const prefix = pattern.slice(0, -2);
+    return collectDirectChildren(path.join(cds.root, prefix), cds);
+  }
+  // Direct path.
+  const pkg = path.join(cds.root, pattern, 'package.json');
+  return cds.utils.exists(pkg) ? [pkg] : [];
+}
+
+async function filterGitIgnored(paths, cds) {
+  const env = { ...process.env, GIT_CEILING_DIRECTORIES: path.dirname(cds.root) };
+  const out = [];
+  for (const p of paths) {
+    try {
+      await execAsync(`git check-ignore -q "${p}"`, { cwd: cds.root, env });
+      // exit 0 → ignored, drop
+    } catch {
+      out.push(p);
+    }
+  }
+  return out;
+}
+
+async function collectWorkspacePackageJsons(cds) {
+  const rootPkgPath = path.join(cds.root, 'package.json');
+  const set = new Map(); // canonical → original
+  if (cds.utils.exists(rootPkgPath)) set.set(canonical(rootPkgPath), rootPkgPath);
+
+  let patterns = [];
+  if (cds.utils.exists(rootPkgPath)) {
+    try {
+      const rootPkg = JSON.parse(cds.utils.fs.readFileSync(rootPkgPath, 'utf8'));
+      if (rootPkg.workspaces) {
+        patterns = Array.isArray(rootPkg.workspaces)
+          ? rootPkg.workspaces
+          : (rootPkg.workspaces.packages || []);
+      }
+    } catch { /* fall through */ }
+  }
+
+  const matched = [];
+  for (const p of patterns) matched.push(...matchPattern(p, cds));
+
+  const filtered = await filterGitIgnored(matched, cds);
+  for (const p of filtered) {
+    const c = canonical(p);
+    if (!set.has(c)) set.set(c, p);
+  }
+
+  return [...set.values()];
+}
+
+module.exports = { collectWorkspacePackageJsons };

package/lib/util/cf.js

@@ -193,18 +193,18 @@ module.exports = new class CfUtil {
             this.#target = target;
 
             const { org, space } = target;
-            const orgs = await this.curl('/v3/organizations', { names: org });
-            if (!orgs?.resources?.length) {
+            const orgObj = await this.org(org);
+            if (!orgObj) {
                 throw `CF org ${bold(org)} not found!`;
             }
-            const orgGuid = orgs.resources[0].guid;
+            const orgGuid = orgObj.guid;
 
-            const spaces = await this.curl('/v3/spaces', { names: space, organization_guids: orgGuid });
-            if (!spaces?.resources?.length) {
+            const spaceObj = await this.space(orgGuid, space);
+            if (!spaceObj) {
                 throw `CF space ${bold(space)} not found in org ${bold(org)}!`;
             }
 
-            const spaceGuid = spaces.resources[0].guid;
+            const spaceGuid = spaceObj.guid;
 
             this.#target = {
                 ...target,
@@ -397,19 +397,30 @@ module.exports = new class CfUtil {
         throw `could not create service key ${bold(serviceKeyName)}`;
     }
 
+    // CF V3 API treats commas in the 'names' filter as delimiters.
+    // When a name contains a comma, omit it from the query and rely on client-side filtering.
+    #safeNameQuery(query) {
+        if (query.names?.includes(',')) {
+            const rest = { ...query }
+            delete rest.names
+            return Object.keys(rest).length ? rest : undefined
+        }
+        return query
+    }
+
     async org(orgName) {
-        const result = await this.curl('/v3/organizations', { names: orgName })
-        return result?.resources?.[0]
+        const result = await this.curl('/v3/organizations', this.#safeNameQuery({ names: orgName }))
+        return result?.resources?.find(r => r.name === orgName)
     }
 
     async space(orgGuid, spaceName) {
-        const result = await this.curl('/v3/spaces', { names: spaceName, organization_guids: orgGuid })
-        return result?.resources?.find(r => r.relationships.organization.data.guid === orgGuid)
+        const result = await this.curl('/v3/spaces', this.#safeNameQuery({ names: spaceName, organization_guids: orgGuid }))
+        return result?.resources?.find(r => r.name === spaceName && r.relationships.organization.data.guid === orgGuid)
     }
 
     async instance(spaceGuid, instanceName) {
-        const result = await this.curl('/v3/service_instances', { names: instanceName, space_guids: spaceGuid })
-        return result?.resources?.find(r => !!r.relationships.space.data.guid)
+        const result = await this.curl('/v3/service_instances', this.#safeNameQuery({ names: instanceName, space_guids: spaceGuid }))
+        return result?.resources?.find(r => r.name === instanceName && !!r.relationships.space.data.guid)
     }
 
     async plan(planGuid) {

package/lib/util/term.js

@@ -36,7 +36,7 @@ const format = module.exports.format = (o, severity='Error', asInternalError=fal
 }
 const forceColor = process.env.FORCE_COLOR && process.env.FORCE_COLOR !== 'false'
 const rendersColors = process.stdout.isTTY && process.stderr.isTTY || process.env.GITHUB_ACTIONS
-format.colors = rendersColors && process.env.NO_COLOR !== 'true' || forceColor
+format.colors = rendersColors && !process.env.NO_COLOR || forceColor
 
 // decorate.error, .warning, .info
 // 'Error: foo'  ->  '[ERROR] foo'  (Maven-like, allows for better grepping in logs)