sap-ai-dev-toolkit 0.7.0 → 0.7.2

package/README.md

@@ -813,7 +813,8 @@ NPM_PUBLISH_TOKEN=npm_...
 
 - `npm run publish:npm` publishes the version already set in `package.json`.
 - To publish a patch bump, run `npm run publish:npm -- --patch`; it updates `package.json` and `package-lock.json` before publishing. If publishing fails after the bump, retry without `--patch`.
-- Preview the package without publishing or changing its version with `npm run publish:npm -- --dry-run`.
+- npm's `prepublishOnly` hook builds the pinned VSP binaries for all platforms (including the Go toolchain if missing) and refuses to ship a tarball whose `dist/checksums.txt` does not list all five assets; it guards `npm run publish:npm` and a plain `npm publish` alike. Pass `--skip-build` to republish an already-built `dist/` without rebuilding.
+- Preview the package without publishing, changing its version, or building with `npm run publish:npm -- --dry-run`.
 
 The token is not printed or stored in the repository.
 

package/dist/checksums.txt

@@ -0,0 +1,5 @@
+8ab555658815db7de670b956dafe0f12d6a249e4f1e1cbbb058deb658a89a37d  vsp-linux-x64
+7011b716e295ce2cecc40b9a56e57d9a1ec24c2b9d6aa25ab46e5cde0ec23998  vsp-linux-arm64
+5c240a6b53e15ebaae817612aed1c5b95624a99adfc38e6abb9afa377de30d1a  vsp-darwin-x64
+28032c4d331253808ec9318e6db570420c6c9308935964de665e34374465d89f  vsp-darwin-arm64
+5bb45857489bbe5d57587d9abda0b768d3a1b352d89a2a6bf13b23af8d2fd45e  vsp-win32-x64.exe

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",
@@ -27,6 +27,7 @@
     "test:visibility": "node --test test/setup.test.mjs test/terminal-ui.test.mjs",
     "test:mutation": "node scripts/mutation-terminal-ui.mjs",
     "publish:npm": "node scripts/publish-npm.mjs",
+    "publish": "node scripts/build-vsp.mjs && node scripts/publish-npm.mjs",
     "ensure:go": "node scripts/ensure-go.mjs",
     "build:vsp": "node scripts/build-vsp.mjs"
   },

package/scripts/publish-npm.mjs

@@ -1,12 +1,14 @@
 import { spawn } from 'node:child_process';
 import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { realpathSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { tmpdir } from 'node:os';
+import { packagedBinaryAssets } from '../src/binary.mjs';
 
 const root = dirname(dirname(fileURLToPath(import.meta.url)));
 const args = new Set(process.argv.slice(2));
-const allowedArgs = new Set(['--patch', '--dry-run']);
+const allowedArgs = new Set(['--patch', '--dry-run', '--skip-build', '--verify-only']);
 
 function parseToken(value) {
   const tokenValue = value.trim();
@@ -57,6 +59,23 @@ function runNpm(npmArgs, env) {
   });
 }
 
+// dist/ is gitignored, so a publish from a clean checkout silently ships no
+// VSP binaries and every `npm install` of it fails (the 0.7.0 incident):
+// postinstall only downloads from a GitHub release as a fallback. The
+// prepublishOnly hook in package.json builds the binaries and re-invokes this
+// script with --verify-only, so an incomplete dist/ can never be published —
+// through publish:npm or a plain `npm publish` alike.
+export async function missingDistBinaries(directory = root) {
+  let text;
+  try {
+    text = await readFile(join(directory, 'dist', 'checksums.txt'), 'utf8');
+  } catch {
+    return packagedBinaryAssets();
+  }
+  const listed = new Set(text.split(/\r?\n/).map(line => line.trim().split(/\s+/)[1]).filter(Boolean));
+  return packagedBinaryAssets().filter(asset => !listed.has(asset));
+}
+
 async function main() {
   for (const argument of args) {
     if (!allowedArgs.has(argument)) throw new Error(`Unknown option: ${argument}`);
@@ -65,6 +84,20 @@ async function main() {
   const patch = args.has('--patch');
   if (dryRun && patch) throw new Error('--dry-run cannot be combined with --patch; it never changes the package version');
 
+  // Second half of the prepublishOnly hook (after build-vsp.mjs ran): refuse
+  // to let an incomplete dist/ reach the registry.
+  if (args.has('--verify-only')) {
+    const missing = await missingDistBinaries();
+    if (missing.length > 0) throw new Error(`dist/checksums.txt is missing ${missing.join(', ')}; run npm run build:vsp first`);
+    console.error('dist/checksums.txt lists every pinned VSP binary.');
+    return;
+  }
+
+  if (dryRun) {
+    const missing = await missingDistBinaries();
+    if (missing.length > 0) console.error(`Dry-run note: dist/ is missing ${missing.join(', ')}; a real publish builds them via the prepublishOnly hook.`);
+  }
+
   let authDirectory;
   try {
     let env = { ...process.env };
@@ -83,7 +116,10 @@ async function main() {
 
     if (patch) await runNpm(['version', 'patch', '--no-git-tag-version'], env);
     const packageJson = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
-    const publishArgs = ['publish', '--access', 'public', ...(dryRun ? ['--dry-run'] : [])];
+    // --dry-run and --skip-build bypass lifecycle scripts so neither waits
+    // through the prepublishOnly build; a real publish always runs it.
+    const bypassScripts = dryRun || args.has('--skip-build');
+    const publishArgs = ['publish', '--access', 'public', ...(bypassScripts ? ['--ignore-scripts'] : []), ...(dryRun ? ['--dry-run'] : [])];
     console.error(`${dryRun ? 'Dry-running' : 'Publishing'} ${packageJson.name}@${packageJson.version}${dryRun ? '' : ' to npm'}...`);
     await runNpm(publishArgs, env);
   } finally {
@@ -91,7 +127,9 @@ async function main() {
   }
 }
 
-main().catch(error => {
-  console.error(`publish:npm: ${error.message}`);
-  process.exitCode = 1;
-});
+if (process.argv[1] && realpathSync(fileURLToPath(import.meta.url)) === realpathSync(resolve(process.argv[1]))) {
+  main().catch(error => {
+    console.error(`publish:npm: ${error.message}`);
+    process.exitCode = 1;
+  });
+}

package/src/binary.mjs

@@ -15,7 +15,7 @@ const platformMap = {
   'linux:arm64': ['linux', 'arm64', ''],
   'darwin:x64': ['darwin', 'x64', ''],
   'darwin:arm64': ['darwin', 'arm64', ''],
-  'win32:x64': ['windows', 'x64', '.exe']
+  'win32:x64': ['win32', 'x64', '.exe']
 };
 
 export function binaryTarget(platform = process.platform, arch = process.arch) {
@@ -24,6 +24,12 @@ export function binaryTarget(platform = process.platform, arch = process.arch) {
   return { os: target[0], arch: target[1], extension: target[2], asset: `vsp-${target[0]}-${target[1]}${target[2]}` };
 }
 
+// Every VSP asset the npm tarball must bundle; publish:npm refuses to ship a
+// package whose dist/checksums.txt does not list all of them.
+export function packagedBinaryAssets() {
+  return Object.keys(platformMap).map(key => binaryTarget(...key.split(':')).asset);
+}
+
 export function bundledBinaryPath(platform = process.platform, arch = process.arch) {
   return join(packageRoot, 'dist', binaryTarget(platform, arch).asset);
 }