Release 1.43.0: DEV to main promotion

.claude/hooks/block-full-test-suite.sh

@@ -38,6 +38,8 @@ is_scoped() {
   if printf '%s' "$norm" | grep -Eq '(npm (run )?test|run test:[a-z:]*) +-- +[^ -]'; then return 0; fi
   # vitest run <path or -t pattern>
   if printf '%s' "$norm" | grep -Eq 'vitest run +(-t|--testNamePattern|[^ -])'; then return 0; fi
+  # vitest run --project unit <file>  (project flag followed by a file/pattern)
+  if printf '%s' "$norm" | grep -Eq 'vitest( run)? +--project +[a-z0-9-]+ +(-t|--testNamePattern|[^ -])'; then return 0; fi
   return 1
 }
 

.claude/settings.json

@@ -2,12 +2,6 @@
   "permissions": {
     "allow": [
       "mcp__plugin_cds-mcp_cds-mcp__search_model",
-      "Bash(rm -rf d:/projects/tutorials-poc/approuter/static/*)",
-      "Bash(cp -r d:/projects/tutorials-poc/hugo/public/* d:/projects/tutorials-poc/approuter/static/)",
-      "Bash(rm -rf approuter/static/*)",
-      "Bash(cp -r hugo/public/* approuter/static/)",
-      "Bash(mkdir -p d:/projects/tutorials-poc/scripts/grammars)",
-      "Bash(cp \"/c/Users/I809764/.vscode/extensions/sapse.vscode-cds-9.9.0/node_modules/@sap/cds-lsp/syntaxes/cds.tmLanguage.json\" d:/projects/tutorials-poc/scripts/grammars/cds.tmLanguage.json)",
       "mcp__hana-cli__hana_query_simple"
     ],
     "additionalDirectories": [

.claude/skills/event-app-space-report/SKILL.md

@@ -0,0 +1,92 @@
+---
+name: event-app-space-report
+description: >-
+  Use when asked for completion statistics / a report for an SAP event (TechEd,
+  ASUG Tech Connect, DSAG, etc.) on the tutorials-ims / developers.sap.com
+  platform, given an app-space URL (…/app-space/?eventId=NNN) or a bare eventId.
+  Produces the four-section report: tutorial completions by Track, abandonment +
+  step-drop histogram, completer email-domain breakdown, and SAP-vs-external.
+  Triggers on "report/statistics from the event <url|eventId>", "app-space stats
+  for …", "event completion numbers".
+---
+
+# Event App-Space Report
+
+Produces a point-in-time, read-only completion report for one event, scoped by
+the event's **date window** to the tutorials linked via its mission's
+CompletionPaths (Tracks). Reuses the server helper `srv/lib/event-path-buckets.js`
+so Track numbers match the live app-space page.
+
+## Input
+
+An app-space URL (`https://developers.sap.com/app-space/?eventId=10000003&theme=…`)
+or a bare `eventId` (= `Events.legacyId`). The script parses either.
+
+## Steps
+
+1. **Parse the eventId** from the URL (or accept the bare id).
+2. **Target PROD.** The report runs against PROD HANA. Confirm you are logged in
+   and targeted at the **prod** space first:
+   ```bash
+   cf target        # org/space must be prod
+   cf target -s prod
+   ```
+   The script enforces this (`assertCfTargetProd`) and refuses to run on any
+   other space — it is the only env-separation safeguard (binding follows the
+   current `cf` login; there is no prod-vs-dev named binding).
+3. **Bind PROD HANA** if not already bound in this worktree:
+   ```bash
+   cds bind -2 tutorials-hana
+   ```
+   **Do NOT use the `tutorials-hana:tutorials-hana-key` service-key** — per
+   `docs/developers/operations/gameboard-prod-data-troubleshooting.md` it maps to
+   a near-empty decoy HDI container, not the live app container. Use the plain
+   instance binding.
+4. **Run the report** (read-only; SELECT/CQL only, no writes):
+   ```bash
+   cds bind --exec -- node scripts/event-report.mjs <eventId> [--json]
+   ```
+   `--json` additionally prints the raw event + bucket aggregates.
+5. **Present** the emitted markdown to the user (the four sections).
+
+## Verification
+
+Cross-check the **Track** totals against the live app-space page or the admin
+`getEventBuckets` OData call for that event when the user wants assurance. The
+script reuses the same `computePathBuckets` helper, so a mismatch means a
+binding/environment problem (wrong space, decoy container), not a logic
+difference.
+
+## Report sections
+
+1. **Tutorial completions by track** — total + per-Track count and share
+   (`CompletionPaths.name`; FK-first tutorial resolution; windowed COMPLETED/
+   SUPERSEDED completions).
+2. **Abandoned tutorials** — a "Top abandonees by count" list, a computed
+   stop-pattern summary (minimum steps done before stopping; % of abandoners
+   who'd done 3+ steps), then per-tutorial median stop-step with "% through"
+   framing and a per-step drop histogram (stop-step = COMPLETED STEP records at
+   the user's current attempt vs `Tutorials.stepCount`).
+3. **Completer email domains** — distinct completers per domain (with known
+   multi-domain orgs like NTT Data / EY rolled up via `ORG_DOMAIN_MAP`),
+   completions, completions/user; a most-engaged table + a prose callout naming
+   the standout high-engagement companies.
+4. **SAP employees vs external** — `@sap.com` vs everyone else.
+
+## Notes
+
+- Read-only and prod-guarded. No writes, no deploy.
+- `scripts/event-report.mjs` lives in the main repo, so it's runnable outside
+  this skill too (`cds bind --exec -- node scripts/event-report.mjs <eventId>`).
+- Scoping is by **date window**, never `TaskRecords.event_ID` (NULL on normal
+  completions). Track = `CompletionPaths.name`, not Mission title.
+- **Sections 3–4 reconcile with the §1 total**: domain and SAP-vs-external
+  counts use the same all-windowed TUTORIAL completion set as the "Total
+  completions" headline, not only track-member tutorials. Anonymized/null-email
+  completers show as `(unknown)` in the domain table and are excluded from the
+  SAP-vs-external split.
+- **Abandonment is an approximation, not an exact count.** Stop-step counts a
+  user's COMPLETED STEP records at their current `attemptNumber` with no
+  per-step date filter, so for returning/multi-attempt users (steps completed
+  before the event, or under a different attempt) the step-drop histogram and
+  median are estimates. Treat them as directional.

.claude/skills/tutorial-qa-to-prod/SKILL.md

@@ -53,6 +53,17 @@ CONTRIB_DEF=$(gh api "repos/$CONTRIB" --jq '.default_branch')   # expect: main
 MAIN_DEF=$(gh api "repos/$MAIN"    --jq '.default_branch')      # expect: master
 ```
 
+### Step 0.5 — Check for authoring aids (author notes + QA-only blocks)
+
+After fetching the QA source (below), scan the file for leftover authoring aids:
+
+```bash
+NOTE_COUNT=$(grep -c '%%' "$FILE" 2>/dev/null || echo 0)
+QA_ONLY_COUNT=$(grep -c '^:::qa-only' "$FILE" 2>/dev/null || echo 0)
+```
+
+If `NOTE_COUNT > 0` or `QA_ONLY_COUNT > 0`: **report the counts and locations** to the author and ask them to remove author notes (`%% … %%`) and resolve QA-only blocks (`:::qa-only`) before the PROD PR is opened. Authoring aids in PROD source will trigger lint warnings on the PROD build. Do not block on this (the author may have a valid reason to proceed), but make the counts visible.
+
 ### Step 1 — Fetch the QA source (source of truth for the copy)
 
 The QA file is what the author previewed and approved — it is authoritative.

.deploy/mta.yaml

@@ -10,7 +10,7 @@ ID: tutorials-ims
 # Bump this on each release you deploy — it's the version shown by `cf mtas`
 # and in the mtar filename (tutorials-ims_<version>.mtar). Deploy is manual:
 # `cd .deploy && mbt build && cf deploy mta_archives/tutorials-ims_<version>.mtar -e ../deploy/<env>.mtaext -f`.
-version: 1.42.0
+version: 1.43.0
 
 # Top-level parameters (overridable per-env via deploy/<env>.mtaext).
 parameters:

.github/copilot-instructions.md

@@ -0,0 +1,32 @@
+# Copilot instructions
+
+**Read [CLAUDE.md](../CLAUDE.md) first.** It's the canonical project guide (commands, architecture, gotchas). [AGENTS.md](../AGENTS.md) has the short version. This file only covers what's specific to Copilot and to Windows/PowerShell.
+
+## Shell (Windows / PowerShell)
+
+- Most maintainers run PowerShell on Windows. Commands in CLAUDE.md are written in bash. Translate them, don't paste them as-is:
+  - `export VAR=x` becomes `$env:VAR = 'x'`.
+  - `&&` only chains native commands. Use `;` before PowerShell statements.
+  - Use `git --no-pager`.
+- Wrap noisy commands (`npm run build:all`, `mbt build`, `cf deploy`, `cf logs`, test runs) in **`scripts/quiet-run.ps1 <cmd…>`**. It's the PowerShell port of `scripts/quiet-run.sh`, with the same env knobs and log dir (`.quiet-logs/`). Open the full log only when the summary isn't enough.
+
+## Tests
+
+- Run only **scoped** unit tests locally: `npm test -- <file-or-pattern>` or `npx vitest run <path>`. A shared `preToolUse` hook ([.github/hooks/block-full-test-suite.json](hooks/block-full-test-suite.json)) denies the full suite. That suite runs in CI.
+- Admin UI e2e (`npm run test:e2e`) runs only after a deploy and skips itself when `SMOKE_BASE_URL` is unset.
+
+## Hard rules (summary, see CLAUDE.md for the details)
+
+- Never edit generated output: `hugo/content/tutorials/`, `gen/`, `hugo/public/`, `approuter/static/`, `mta_archives/`.
+- Never run `publish-content` from a workstation. Use `gh workflow run rebuild-content.yml`.
+- Default to a feature branch and a PR (`.github/pull_request_template.md`). Confirm the deploy scope with the maintainer before you deploy.
+- Don't stage unrelated working-tree changes. Hugo data files (`hugo/data/*.json`) are often regenerated locally.
+
+## Tools
+
+- **CDS/CAP:** Use the CAP MCP server (`search_model`, `search_docs`) before you edit `.cds` or CAP code.
+- **UI5/Fiori:** Use the UI5 MCP server (`get_api_reference`, `run_ui5_linter`) for `app/admin*/**`.
+- **Browser checks:** Use the `playwright-test` MCP server.
+- **SAP / BTP / CF lookups:** Use the `sap-devs` MCP server. The `sap-devs` CLI must be on PATH.
+- **MCP setup:** `.mcp.json` is personal and git-ignored because it can hold PATs. Start from `Copy-Item .mcp.json.example .mcp.json`. On Windows, if `npx` won't start, use `"command": "cmd", "args": ["/c", "npx", ...]`. The CAP and UI5 servers come from their VS Code extensions.
+- Repo skills live in `.claude/skills/`, for example `tutorial-qa-to-prod`, `provision-tutorial-repo` and `whats-new`. Use one when it matches the task.

.github/hooks/block-full-test-suite.cjs

@@ -0,0 +1,81 @@
+#!/usr/bin/env node
+// Copilot preToolUse hook — port of .claude/hooks/block-full-test-suite.sh.
+//
+// BLOCK the full, in-process vitest suites locally — they peg the machine (concurrent
+// worker pools) and take >10 min. The full suite runs in CI; locally, run a SCOPED test.
+//
+// BLOCKED (full in-process suites):
+//   npm test / npm run test / npm run test:all / npm run test:a11y / npm run test:watch
+//   npx vitest run --project unit|a11y   (and bare `vitest run` with no file arg)
+// ALLOWED (pass through):
+//   scoped runs:  npm test -- <pattern|path>   /   vitest run <path/to/file>
+//   HTTP/remote:  test:smoke, test:e2e, test:hybrid, test:smoke:personalization, etc.
+//
+// Contract: JSON event on stdin; prints `{}` (no decision) or a deny decision on stdout.
+// Keep the regexes in sync with the bash version.
+'use strict';
+
+const fs = require('node:fs');
+
+const SHELL_TOOLS = /^(bash|powershell|shell|run_in_terminal|runInTerminal)$/i;
+
+function readEvent() {
+  try {
+    return JSON.parse(fs.readFileSync(0, 'utf8') || '{}');
+  } catch {
+    return {};
+  }
+}
+
+function extractCommand(event) {
+  const toolName = event.toolName ?? event.tool_name ?? '';
+  if (toolName && !SHELL_TOOLS.test(toolName)) return '';
+  let args = event.toolArgs ?? event.tool_input ?? {};
+  if (typeof args === 'string') {
+    try {
+      args = JSON.parse(args);
+    } catch {
+      return args;
+    }
+  }
+  return typeof args?.command === 'string' ? args.command : '';
+}
+
+function isScoped(norm) {
+  if (/(npm (run )?test|run test:[a-z:]*) +-- +[^ -]/.test(norm)) return true;
+  if (/vitest run +(-t|--testNamePattern|[^ -])/.test(norm)) return true;
+  // `vitest run --project unit <file>` — project flag followed by a file/pattern.
+  if (/vitest( run)? +--project +[a-z0-9-]+ +(-t|--testNamePattern|[^ -])/.test(norm)) return true;
+  return false;
+}
+
+function isFullSuite(norm) {
+  if (/(^|[;&|] *)(npm (run )?test( +--project +(unit|a11y))?|npm run test:all|npm run test:a11y|npm run test:watch)( |$)/.test(norm)) return true;
+  if (/vitest( run)? +--project +(unit|a11y)( |$)/.test(norm)) return true;
+  if (/(^|[;&|] *)(npx )?vitest( run)? *$/.test(norm)) return true;
+  return false;
+}
+
+function decide(cmd) {
+  // Strip a leading quiet-run wrapper so `quiet-run.ps1 npm test` is judged like `npm test`.
+  const norm = cmd
+    .replace(/\s+/g, ' ')
+    .trim()
+    .replace(/(^|[;&|] *)(\.?[\\/])?(scripts[\\/])?quiet-run\.(sh|ps1) +/g, '$1');
+  if (norm && isFullSuite(norm) && !isScoped(norm)) {
+    return {
+      permissionDecision: 'deny',
+      permissionDecisionReason:
+        'BLOCKED: the full local test suite is disallowed on this project — it pegs the machine and already runs in CI. ' +
+        "Run a SCOPED test instead: 'npm test -- <file-or-pattern>' or 'npx vitest run <path/to/file>'. " +
+        'Allowed remote suites: test:smoke / test:e2e / test:hybrid.',
+    };
+  }
+  return {};
+}
+
+if (require.main === module) {
+  process.stdout.write(JSON.stringify(decide(extractCommand(readEvent()))));
+}
+
+module.exports = { decide, extractCommand };

.github/hooks/block-full-test-suite.json

@@ -0,0 +1,12 @@
+{
+  "version": 1,
+  "hooks": {
+    "preToolUse": [
+      {
+        "type": "command",
+        "command": "node .github/hooks/block-full-test-suite.cjs",
+        "timeoutSec": 10
+      }
+    ]
+  }
+}

.github/instructions/admin-ui.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "app/admin/**,app/admin-shell/**"
+---
+# Admin UI (SAPUI5 / Fiori Elements)
+
+- Use the UI5 MCP server: `get_api_reference` for APIs, `run_ui5_linter` and `run_manifest_validation` before you finish.
+- Components load as headless componentUsages inside the `sap.tnt.ToolPage` shell (`app/admin-shell/`). The theme is `sap_horizon`.
+- **Deploy gate:** Admin UI changes need a full `npm run deploy -- --env <env>`. Don't use `--skip-build` or `-m` scoping, and never bypass Step 3.5 (`scripts/check-shipped-admin-bundle.cjs`). Without a full deploy, a stale admin UI ships.
+- User-facing changes should come with an e2e spec (see `docs/developers/reference/e2e-coverage-pattern.md`).

.github/instructions/cds.instructions.md

@@ -0,0 +1,10 @@
+---
+applyTo: "db/**/*.cds,srv/**/*.cds,app/*.cds,db-qa/**"
+---
+# CDS model
+
+- Before you edit, look up entities and annotations with the CAP MCP server: `search_model` for the compiled model, `search_docs` for CAP docs.
+- Don't select a HANA BLOB in the same CDS QL query as its metadata. LOB locators expire. Use raw `db.run()`, following the pattern in `srv/lib/content-store.js`.
+- Slugs on `TutorialMeta`, `Tutorials`, `Missions` and `Groups` are unique and lowercase. New write paths must upsert on slug.
+- Don't bypass `@requires` or `@restrict`. Never edit `gen/`; regenerate it with `cds build`.
+- Keep `using` side-effect imports, for example the TechEd one in `db/external-content.cds`.

.github/instructions/hugo.instructions.md

@@ -0,0 +1,11 @@
+---
+applyTo: "hugo/**,hugo-apps/**,scripts/parsers/**,scripts/fetch-tutorials.ts"
+---
+# Hugo, islands and parsers
+
+- `hugo/content/tutorials/` is entirely generated, so never edit it. Change `scripts/parsers/` instead, or the source tutorial repos in the `sap-tutorials` org.
+- Tutorial HTML is served from HANA BLOBs, not from `hugo/public/`. Publish through `gh workflow run rebuild-content.yml`, never from a workstation.
+- Deploys refuse a dirty tree under `hugo/assets/**` or `hugo/layouts/**` (Step 0.5). Commit or stash those files before deploying.
+- `ignore-scripts=true` means `pre*` and `post*` hooks never run. The island manifest and page fallback are explicit `build:all` steps.
+- Compare tutorial slugs with `.toLowerCase()`.
+- Served tutorials render `<main>` and `<h1>`, not `<article>`. Keep that in mind when writing e2e selectors.

.github/instructions/srv-lib.instructions.md

@@ -0,0 +1,9 @@
+---
+applyTo: "srv/lib/**"
+---
+# srv/lib
+
+- **srv-qa cp-list audit:** If you change anything here, re-walk the transitive `./` imports from `srv/lib/content-store.js`. Confirm that every dependency is in the `srv-qa` `cp` list in `.deploy/mta.yaml`. A missing dependency crashes QA at boot.
+- `srv/lib/completion-rollup.js` is not a dependency of `content-store.js`. Group and mission completions are derived from rollups (see CLAUDE.md, "Completions rollup").
+- Feature flags (`KG_*`, provenance, NGDS) fail open and default to OFF. Keep it that way.
+- Run scoped tests for the module you touched: `npm test -- <pattern>`.