create-ifc-lite 1.15.1 → 1.16.0

package/README.md

@@ -1,6 +1,6 @@
 # create-ifc-lite
 
-Scaffolds an IFClite project in seconds. One command, working code.
+Scaffolds an IFClite project with runnable code and a resolved dependency lock.
 
 ## Usage
 
@@ -8,18 +8,18 @@ Scaffolds an IFClite project in seconds. One command, working code.
 npx create-ifc-lite <project-name> [--template <type>]
 ```
 
-That's it — no install step. The scaffolder picks `basic` if you don't pass a template.
+The scaffolder picks `basic` by default. It pins inspected IFClite releases, skips releases whose required worker files are missing, and checks their transitive IFClite dependencies. It resolves the complete dependency set with npm, checks peer constraints, and writes `package-lock.json` without running dependency install scripts. Run `npm ci` in the generated project to install that exact set; commit the lockfile so teammates and CI use the same versions.
 
 ## Templates
 
 ```bash
 # Minimal TypeScript project — parse an IFC file from a script
 npx create-ifc-lite my-app
-cd my-app && npm install && npm run parse ./model.ifc
+cd my-app && npm ci && npm run parse ./model.ifc
 
 # WebGPU 3D viewer (React + Vite + drag-and-drop)
 npx create-ifc-lite my-viewer --template react
-cd my-viewer && npm install && npm run dev
+cd my-viewer && npm ci && npm run dev
 
 # Three.js (WebGL) viewer
 npx create-ifc-lite my-viewer --template threejs

package/dist/index.js

@@ -5,6 +5,7 @@
 import { existsSync, mkdirSync, rmSync, readFileSync } from 'fs';
 import { join, dirname } from 'path';
 import { fileURLToPath } from 'url';
+import { createDependencyLock } from './utils/dependency-lock.js';
 import { createBasicTemplate } from './templates/basic.js';
 import { createThreejsTemplate } from './templates/threejs.js';
 import { createBabylonjsTemplate } from './templates/babylonjs.js';
@@ -137,6 +138,8 @@ async function main() {
     mkdirSync(targetDir, { recursive: true });
     try {
         TEMPLATES[template](targetDir, projectName);
+        console.log('  Resolving the dependency set and writing package-lock.json...');
+        createDependencyLock(targetDir);
     }
     catch (error) {
         // Templates resolve their dependency versions from the npm registry as
@@ -149,16 +152,16 @@ async function main() {
     console.log(`    cd ${projectName}`);
     if (template === 'server') {
         console.log(`    docker compose up -d`);
-        console.log(`    npm install && npm run example ./your-model.ifc`);
+        console.log(`    npm ci && npm run example ./your-model.ifc`);
         console.log(`\n  Server will be available at http://localhost:3001`);
     }
     else if (template === 'server-native') {
-        console.log(`    npm install`);
+        console.log(`    npm ci`);
         console.log(`    npm run server:start`);
         console.log(`\n  Server will be available at http://localhost:8080`);
     }
     else {
-        console.log(`    npm install`);
+        console.log(`    npm ci`);
         if (template === 'react' || template === 'threejs' || template === 'babylonjs') {
             console.log(`    npm run dev`);
         }

package/dist/templates/babylonjs.js

@@ -3,14 +3,14 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { getPackageVersion } from '../utils/config-fixers.js';
+import { getPinnedPackageVersion, MODULE_WORKER_CONFIG } from '../utils/config-fixers.js';
 import { writeGitignore } from '../utils/gitignore.js';
 /**
  * Scaffold a Babylon.js IFC viewer project using @ifc-lite/geometry.
  * No WebGPU required — renders via Babylon.js WebGL Engine.
  */
 export function createBabylonjsTemplate(targetDir, projectName) {
-    const geometryVersion = getPackageVersion('@ifc-lite/geometry');
+    const geometryVersion = getPinnedPackageVersion('@ifc-lite/geometry');
     // package.json
     writeFileSync(join(targetDir, 'package.json'), JSON.stringify({
         name: projectName,
@@ -49,7 +49,7 @@ export function createBabylonjsTemplate(targetDir, projectName) {
     writeFileSync(join(targetDir, 'vite.config.ts'), `import { defineConfig } from 'vite';
 
 export default defineConfig({
-  optimizeDeps: {
+${MODULE_WORKER_CONFIG}  optimizeDeps: {
     exclude: ['@ifc-lite/wasm'],
   },
   server: {
@@ -249,7 +249,7 @@ Babylon.js IFC viewer using [IFC-Lite](https://github.com/LTplus-AG/ifc-lite).
 ## Quick Start
 
 \`\`\`bash
-npm install
+npm ci
 npm run dev
 \`\`\`
 

package/dist/templates/basic.js

@@ -3,16 +3,16 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { getPackageVersion } from '../utils/config-fixers.js';
+import { getPinnedPackageVersion } from '../utils/config-fixers.js';
 import { writeGitignore } from '../utils/gitignore.js';
 /**
  * Scaffold a minimal TypeScript project for parsing IFC files.
  */
 export function createBasicTemplate(targetDir, projectName) {
-    const parserVersion = getPackageVersion('@ifc-lite/parser');
+    const parserVersion = getPinnedPackageVersion('@ifc-lite/parser');
     // `store.entityIndex.byType` is keyed by the raw STEP spelling, and the
     // PascalCase lookup table for it lives in @ifc-lite/data.
-    const dataVersion = getPackageVersion('@ifc-lite/data');
+    const dataVersion = getPinnedPackageVersion('@ifc-lite/data');
     // package.json
     writeFileSync(join(targetDir, 'package.json'), JSON.stringify({
         name: projectName,
@@ -123,7 +123,7 @@ IFC parser project using [IFC-Lite](https://github.com/LTplus-AG/ifc-lite).
 ## Quick Start
 
 \`\`\`bash
-npm install
+npm ci
 npm run parse ./your-model.ifc
 \`\`\`
 

package/dist/templates/react.js

@@ -3,14 +3,14 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { getPackageVersion } from '../utils/config-fixers.js';
+import { getPinnedPackageVersion, MODULE_WORKER_CONFIG } from '../utils/config-fixers.js';
 import { writeGitignore } from '../utils/gitignore.js';
 /**
  * Scaffold a standalone React + Vite WebGPU viewer.
  */
 export function createReactTemplate(targetDir, projectName) {
-    const geometryVersion = getPackageVersion('@ifc-lite/geometry');
-    const rendererVersion = getPackageVersion('@ifc-lite/renderer');
+    const geometryVersion = getPinnedPackageVersion('@ifc-lite/geometry');
+    const rendererVersion = getPinnedPackageVersion('@ifc-lite/renderer');
     writeFileSync(join(targetDir, 'package.json'), JSON.stringify({
         name: projectName,
         version: '0.1.0',
@@ -63,7 +63,7 @@ const isolationHeaders = {
 };
 
 export default defineConfig({
-  plugins: [react()],
+${MODULE_WORKER_CONFIG}  plugins: [react()],
   optimizeDeps: {
     exclude: ['@ifc-lite/wasm'],
   },
@@ -556,7 +556,7 @@ React + Vite IFC viewer using [IFC-Lite](https://github.com/LTplus-AG/ifc-lite).
 ## Quick Start
 
 \`\`\`bash
-npm install
+npm ci
 npm run dev
 \`\`\`
 

package/dist/templates/server-native.js

@@ -3,14 +3,14 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { getPackageVersion } from '../utils/config-fixers.js';
+import { getPinnedPackageVersion } from '../utils/config-fixers.js';
 /**
  * Scaffold a native-binary IFC processing server with TypeScript client examples.
  * No Docker required -- the server binary is downloaded and run via npm scripts.
  */
 export function createServerNativeTemplate(targetDir, projectName) {
-    const serverBinVersion = getPackageVersion('@ifc-lite/server-bin');
-    const serverClientVersion = getPackageVersion('@ifc-lite/server-client');
+    const serverBinVersion = getPinnedPackageVersion('@ifc-lite/server-bin');
+    const serverClientVersion = getPinnedPackageVersion('@ifc-lite/server-client');
     // package.json
     writeFileSync(join(targetDir, 'package.json'), JSON.stringify({
         name: projectName,
@@ -326,7 +326,7 @@ IFC processing server using native binary - no Docker required.
 
 \`\`\`bash
 # Install dependencies (downloads server binary automatically)
-npm install
+npm ci
 
 # Start the server
 npm run server:start

package/dist/templates/server.js

@@ -3,12 +3,12 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { getPackageVersion } from '../utils/config-fixers.js';
+import { getPinnedPackageVersion } from '../utils/config-fixers.js';
 /**
  * Scaffold a Docker-based IFC processing server with TypeScript client examples.
  */
 export function createServerTemplate(targetDir, projectName) {
-    const serverClientVersion = getPackageVersion('@ifc-lite/server-client');
+    const serverClientVersion = getPinnedPackageVersion('@ifc-lite/server-client');
     // docker-compose.yml - Production configuration
     writeFileSync(join(targetDir, 'docker-compose.yml'), `# IFC-Lite Server - Production Configuration
 # Start with: docker compose up -d
@@ -484,7 +484,7 @@ IFC processing server using [IFC-Lite](https://github.com/LTplus-AG/ifc-lite).
 docker compose up -d
 
 # 2. Install client dependencies
-npm install
+npm ci
 
 # 3. Run the example (replace with your IFC file)
 npm run example ./your-model.ifc

package/dist/templates/threejs.js

@@ -3,14 +3,14 @@
  * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
 import { mkdirSync, writeFileSync } from 'fs';
 import { join } from 'path';
-import { getPackageVersion } from '../utils/config-fixers.js';
+import { getPinnedPackageVersion, MODULE_WORKER_CONFIG } from '../utils/config-fixers.js';
 import { writeGitignore } from '../utils/gitignore.js';
 /**
  * Scaffold a Three.js IFC viewer project using @ifc-lite/geometry.
  * No WebGPU required — renders via Three.js WebGLRenderer.
  */
 export function createThreejsTemplate(targetDir, projectName) {
-    const geometryVersion = getPackageVersion('@ifc-lite/geometry');
+    const geometryVersion = getPinnedPackageVersion('@ifc-lite/geometry');
     // package.json
     writeFileSync(join(targetDir, 'package.json'), JSON.stringify({
         name: projectName,
@@ -50,12 +50,7 @@ export function createThreejsTemplate(targetDir, projectName) {
     writeFileSync(join(targetDir, 'vite.config.ts'), `import { defineConfig } from 'vite';
 
 export default defineConfig({
-  // @ifc-lite ships ES-module geometry workers; emit them as ESM so a
-  // production build never trips over Rollup's IIFE worker default.
-  worker: {
-    format: 'es',
-  },
-  optimizeDeps: {
+${MODULE_WORKER_CONFIG}  optimizeDeps: {
     exclude: ['@ifc-lite/wasm'],
   },
   server: {
@@ -263,7 +258,7 @@ Three.js IFC viewer using [IFC-Lite](https://github.com/LTplus-AG/ifc-lite).
 ## Quick Start
 
 \`\`\`bash
-npm install
+npm ci
 npm run dev
 \`\`\`
 

package/dist/utils/config-fixers.d.ts

@@ -5,6 +5,9 @@
  * placeholder versions.
  */
 export declare function getPackageVersion(packageName: string): string;
+/** Pin the selected, inspected release so npm cannot reselect a rejected newer one. */
+export declare function getPinnedPackageVersion(packageName: string): string;
+export declare const MODULE_WORKER_CONFIG = "  // Published geometry workers are ES modules and may split chunks.\n  worker: { format: 'es' },\n";
 /**
  * Rewrite the viewer's package.json so it works as a standalone project:
  *   - Set the project name

package/dist/utils/config-fixers.js

@@ -4,17 +4,18 @@
 import { existsSync, readFileSync, writeFileSync, rmSync } from 'fs';
 import { join } from 'path';
 import { execFileSync, spawnSync } from 'child_process';
+import { resolveNpmCommand, isMissingNpmArtifact } from './npm-command.js';
+import { hasWorkerFiles, publishedWorkerAssetsPresent } from './published-worker-assets.js';
 /** Cache of npm-resolved versions to avoid redundant registry queries. */
 const versionCache = new Map();
 const publishedVersionsCache = new Map();
+const dependenciesCache = new Map();
+const artifactCache = new Map();
 const VALID_PACKAGE_NAME = /^(?:@[\w.-]+\/)?[\w.-]+$/;
 const NPM_TIMEOUT_MS = 30000;
 const MAX_VERSION_CANDIDATES = 10;
-/** npm's own codes for "the registry does not have that artifact". */
-const MISSING_ARTIFACT_CODE = /\bE(404|410)\b/;
 function readJsonFromNpm(args) {
-    const command = process.platform === 'win32' ? process.env.ComSpec ?? 'cmd.exe' : 'npm';
-    const commandArgs = process.platform === 'win32' ? ['/d', '/s', '/c', 'npm', ...args] : args;
+    const { command, args: commandArgs } = resolveNpmCommand(args);
     const result = execFileSync(command, commandArgs, {
         stdio: 'pipe',
         timeout: NPM_TIMEOUT_MS,
@@ -39,11 +40,17 @@ function extractPinnedVersion(range) {
     return match ? match[0] : null;
 }
 function getVersionDependencies(packageName, version) {
-    const json = readJsonFromNpm(['view', `${packageName}@${version}`, 'dependencies', '--json']);
+    const key = `${packageName}@${version}`;
+    const cached = dependenciesCache.get(key);
+    if (cached)
+        return cached;
+    const json = readJsonFromNpm(['view', key, 'dependencies', '--json']);
     if (!json || typeof json !== 'object' || Array.isArray(json)) {
         return {};
     }
-    return json;
+    const dependencies = json;
+    dependenciesCache.set(key, dependencies);
+    return dependencies;
 }
 /**
  * Is the version's own tarball actually downloadable?
@@ -61,28 +68,49 @@ function getVersionDependencies(packageName, version) {
  * older version, so anything else is treated as "cannot tell, assume fine".
  */
 function isTarballFetchable(packageName, version) {
+    const key = `${packageName}@${version}`;
+    const cached = artifactCache.get(key);
+    if (cached !== undefined)
+        return cached;
     const args = ['pack', `${packageName}@${version}`, '--dry-run', '--json'];
-    const command = process.platform === 'win32' ? process.env.ComSpec ?? 'cmd.exe' : 'npm';
-    const commandArgs = process.platform === 'win32' ? ['/d', '/s', '/c', 'npm', ...args] : args;
+    const { command, args: commandArgs } = resolveNpmCommand(args);
     const result = spawnSync(command, commandArgs, { encoding: 'utf-8', timeout: NPM_TIMEOUT_MS });
-    if (result.status === 0)
-        return true;
+    if (result.status === 0) {
+        const metadata = JSON.parse(result.stdout || '[]');
+        const valid = !hasWorkerFiles(metadata) || publishedWorkerAssetsPresent(packageName, version);
+        artifactCache.set(key, valid);
+        return valid;
+    }
     const output = `${result.stdout ?? ''}${result.stderr ?? ''}`;
-    return !MISSING_ARTIFACT_CODE.test(output);
+    return !isMissingNpmArtifact(output);
 }
 function isInstallablePublishedVersion(packageName, version) {
-    const dependencies = getVersionDependencies(packageName, version);
-    for (const [dependencyName, dependencyRange] of Object.entries(dependencies)) {
-        if (!dependencyName.startsWith('@ifc-lite/'))
-            continue;
-        const pinnedVersion = extractPinnedVersion(dependencyRange);
-        if (!pinnedVersion)
+    // Iterative: registry dependency graphs can contain cycles or shared subgraphs.
+    const queue = [[packageName, version]];
+    const seen = new Set();
+    for (let index = 0; index < queue.length; index++) {
+        const [name, candidate] = queue[index];
+        const key = `${name}@${candidate}`;
+        if (seen.has(key))
             continue;
-        if (!getPublishedVersions(dependencyName).has(pinnedVersion)) {
-            return false;
+        seen.add(key);
+        if (seen.size > 128)
+            throw new Error('Scaffold dependency validation exceeds 128 package versions');
+        const dependencies = getVersionDependencies(name, candidate);
+        for (const [dependencyName, dependencyRange] of Object.entries(dependencies)) {
+            if (!dependencyName.startsWith('@ifc-lite/'))
+                continue;
+            const pinnedVersion = extractPinnedVersion(dependencyRange);
+            if (!pinnedVersion)
+                continue;
+            if (!getPublishedVersions(dependencyName).has(pinnedVersion))
+                return false;
+            queue.push([dependencyName, pinnedVersion]);
         }
+        if (!isTarballFetchable(name, candidate))
+            return false;
     }
-    return isTarballFetchable(packageName, version);
+    return true;
 }
 /**
  * Fetch the latest installable published version of a specific npm package.
@@ -110,6 +138,11 @@ export function getPackageVersion(packageName) {
             'Check your npm registry access and try again.', { cause });
     }
 }
+/** Pin the selected, inspected release so npm cannot reselect a rejected newer one. */
+export function getPinnedPackageVersion(packageName) {
+    return getPackageVersion(packageName).replace(/^\^/, '');
+}
+export const MODULE_WORKER_CONFIG = `  // Published geometry workers are ES modules and may split chunks.\n  worker: { format: 'es' },\n`;
 /**
  * Rewrite the viewer's package.json so it works as a standalone project:
  *   - Set the project name

package/dist/utils/dependency-lock.d.ts

@@ -0,0 +1,2 @@
+/** Resolve the entire dependency graph together, without running install scripts. */
+export declare function createDependencyLock(targetDir: string): void;

package/dist/utils/dependency-lock.js

@@ -0,0 +1,23 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { resolveNpmCommand } from './npm-command.js';
+/** Resolve the entire dependency graph together, without running install scripts. */
+export function createDependencyLock(targetDir) {
+    const { command, args } = resolveNpmCommand(['install', '--package-lock-only', '--ignore-scripts',
+        '--strict-peer-deps', '--no-audit', '--no-fund']);
+    try {
+        execFileSync(command, args, { cwd: targetDir, stdio: 'pipe', timeout: 120000 });
+        const lock = JSON.parse(readFileSync(join(targetDir, 'package-lock.json'), 'utf8'));
+        if (!lock || typeof lock !== 'object' || !('packages' in lock) ||
+            !lock.packages || typeof lock.packages !== 'object' || !('' in lock.packages)) {
+            throw new Error('npm did not produce a dependency lock with a root package');
+        }
+    }
+    catch (cause) {
+        throw new Error('Could not resolve a compatible scaffold dependency set. Check npm registry access and peer requirements.', { cause });
+    }
+}

package/dist/utils/npm-command.d.ts

@@ -0,0 +1,7 @@
+/** Keep npm's Windows command-shim invocation consistent across scaffold steps. */
+export declare function resolveNpmCommand(args: string[]): {
+    command: string;
+    args: string[];
+};
+/** Explicit npm registry refusal, distinct from an inconclusive transport error. */
+export declare function isMissingNpmArtifact(output: string): boolean;

package/dist/utils/npm-command.js

@@ -0,0 +1,13 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+/** Keep npm's Windows command-shim invocation consistent across scaffold steps. */
+export function resolveNpmCommand(args) {
+    return process.platform === 'win32'
+        ? { command: process.env.ComSpec ?? 'cmd.exe', args: ['/d', '/s', '/c', 'npm', ...args] }
+        : { command: 'npm', args };
+}
+/** Explicit npm registry refusal, distinct from an inconclusive transport error. */
+export function isMissingNpmArtifact(output) {
+    return /\bE(404|410)\b/.test(output);
+}

package/dist/utils/published-worker-assets.d.ts

@@ -0,0 +1,7 @@
+/** A tarball's relative literal worker URLs must resolve to files it actually ships. */
+export declare function missingWorkerAssets(archive: string): Array<{
+    file: string;
+    specifier: string;
+}>;
+export declare function publishedWorkerAssetsPresent(packageName: string, version: string): boolean;
+export declare function hasWorkerFiles(metadata: unknown): boolean;

package/dist/utils/published-worker-assets.js

@@ -0,0 +1,101 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join, posix } from 'node:path';
+import { list } from 'tar';
+import { tokenizer } from 'acorn';
+import { resolveNpmCommand, isMissingNpmArtifact } from './npm-command.js';
+const valueOf = (token) => 'value' in token ? token.value : undefined;
+function literalWorkerUrls(source) {
+    if (!source.includes('worker.'))
+        return [];
+    const recent = [];
+    const found = [];
+    for (const token of tokenizer(source, { ecmaVersion: 'latest', sourceType: 'module', allowHashBang: true })) {
+        recent.push(token);
+        if (recent.length > 11)
+            recent.shift();
+        if (recent.length !== 11)
+            continue;
+        const labels = recent.map(item => item.type.label).join(' ');
+        if (labels !== 'new name ( string , import . name . name )' ||
+            valueOf(recent[1]) !== 'URL' || valueOf(recent[7]) !== 'meta' || valueOf(recent[9]) !== 'url')
+            continue;
+        const specifier = valueOf(recent[3]);
+        if (typeof specifier === 'string' && specifier.startsWith('.') && /worker\.[cm]?[jt]s(?:[?#]|$)/.test(specifier))
+            found.push(specifier);
+    }
+    return found;
+}
+/** A tarball's relative literal worker URLs must resolve to files it actually ships. */
+export function missingWorkerAssets(archive) {
+    const files = new Set();
+    const references = [];
+    list({ file: archive, sync: true, strict: true, onReadEntry(entry) {
+            if (entry.type !== 'File') {
+                entry.resume();
+                return;
+            }
+            const file = posix.normalize(entry.path);
+            files.add(file);
+            if (!/\.[cm]?js$/.test(file)) {
+                entry.resume();
+                return;
+            }
+            const chunks = [];
+            entry.on('data', (chunk) => { chunks.push(chunk); });
+            entry.on('end', () => {
+                for (const specifier of literalWorkerUrls(Buffer.concat(chunks).toString('utf8')))
+                    references.push({ file, specifier });
+            });
+        } });
+    return references.filter(({ file, specifier }) => {
+        const base = new URL(file.split('/').map(encodeURIComponent).join('/'), 'https://artifact.invalid/');
+        const target = decodeURIComponent(new URL(specifier, base).pathname).slice(1);
+        return !target.startsWith('package/') || !files.has(target);
+    });
+}
+export function publishedWorkerAssetsPresent(packageName, version) {
+    const scratch = mkdtempSync(join(tmpdir(), 'ifclite-worker-artifact-'));
+    try {
+        const { command, args } = resolveNpmCommand(['pack', `${packageName}@${version}`, '--json', '--pack-destination', scratch]);
+        let output;
+        try {
+            output = execFileSync(command, args, { encoding: 'utf8', stdio: 'pipe', timeout: 30000 });
+        }
+        catch (error) {
+            const details = error && typeof error === 'object'
+                ? ['stdout', 'stderr', 'code'].map(key => Reflect.get(error, key)).map(String).join(' ') : String(error);
+            if (isMissingNpmArtifact(details))
+                return false;
+            // Preserve the version probe's existing policy: an inconclusive network
+            // failure must not silently downgrade the selected package (PR #7660).
+            console.warn(`Could not inspect worker assets for ${packageName}@${version}; ` +
+                'npm did not report a missing artifact, so the version candidate is retained.');
+            return true;
+        }
+        const result = JSON.parse(output);
+        const first = Array.isArray(result) ? result[0] : undefined;
+        if (!first || typeof first !== 'object' || !('filename' in first) || typeof first.filename !== 'string' ||
+            basename(first.filename) !== first.filename)
+            throw new Error('npm did not identify a packed artifact');
+        const missing = missingWorkerAssets(join(scratch, first.filename));
+        if (missing.length > 0)
+            console.warn(`Skipping ${packageName}@${version}: worker assets are absent from its tarball: ` +
+                missing.map(item => `${item.file}: ${item.specifier}`).join(', '));
+        return missing.length === 0;
+    }
+    finally {
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+export function hasWorkerFiles(metadata) {
+    if (!Array.isArray(metadata))
+        return false;
+    return metadata.some((item) => item && typeof item === 'object' && 'files' in item && Array.isArray(item.files) &&
+        item.files.some((file) => file && typeof file === 'object' && 'path' in file && typeof file.path === 'string' &&
+            /worker\.[cm]?[jt]s$/.test(file.path)));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-ifc-lite",
-  "version": "1.15.1",
+  "version": "1.16.0",
   "description": "Create IFC-Lite projects with one command",
   "type": "module",
   "bin": {
@@ -37,6 +37,10 @@
   },
   "homepage": "https://ifclite.dev/docs/",
   "bugs": "https://github.com/LTplus-AG/ifc-lite/issues",
+  "dependencies": {
+    "acorn": "^8.19.0",
+    "tar": "^7.5.21"
+  },
   "scripts": {
     "build": "pnpm exec tsc",
     "typecheck": "node ../../scripts/typecheck-tests.mjs",