diff --git a/AGENTS.md b/AGENTS.md
index 4076853..c7e2bd9 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -19,7 +19,7 @@ VitePress build. It is also what CI runs, on every pull request
- every `require("@cap2ui5/cds-plugin")` or `import { … } from
"@cap2ui5/cds-plugin"` **inside a code fence** names only what the package
really exports (and two dead packages are reported, in either form: the
- port's `abap2UI5/…` and the plugin's withdrawn old name `cap2ui5`),
+ port's `abap2UI5/…` and the plugin's old name `cap2ui5`, a deprecated placeholder on npm),
- every `cds.requires.cap2ui5.` is an option the plugin defines (and
0.1.0's `cds.cap2ui5. ` is reported as the deprecated place),
- every `1.x.y` release number is the pinned runtime release,
@@ -62,12 +62,18 @@ against the repos, don't guess):
| [abap2UI5/abap2UI5](https://github.com/abap2UI5/abap2UI5) | the framework itself, in ABAP. Downported and transpiled, it is published as `@abap2ui5/node-runtime` |
| [cap2UI5/docs](https://github.com/cap2UI5/docs) | this site |
-On npm since 2026-09-29: `@cap2ui5/cds-plugin@0.3.1` (Node ≥ 22, peer
+On npm: `@cap2ui5/cds-plugin@0.4.0` (since 2026-09-30; Node ≥ 22, peer
`@sap/cds` ≥ 9), published by the npm organisation `cap2ui5`, and
-`@cap2ui5/samples@0.1.0`. The plugin pins `@abap2ui5/node-runtime@1.145.0`
-(on npm since 2026-09-27) **exactly**. Up to 0.2.0 the plugin was the unscoped
-package `cap2ui5`; it is withdrawn from npm (0.2.0 never reached it), so the
-site names it only as the old name. What did NOT change name: the
+`@cap2ui5/samples@0.2.0` (peer `^0.4.0`). The plugin pins
+`@abap2ui5/node-runtime@1.146.0` **exactly**, the first runtime whose frontend
+does the approuter's `X-CSRF-Token` handshake and has `accelerate( )`.
+verify-refs reads that pin from `plugin/package.json`, not from the stand-in
+`runtime/package.json`. Up to 0.2.0 the plugin was the unscoped
+package `cap2ui5`. On npm that name is now only a deprecated placeholder,
+`cap2ui5@0.0.1-placeholder` (since 2026-09-30, cap2UI5/cap2UI5#97): no `main`,
+and a `cap2ui5` bin that prints where to go and exits 1. It installs nothing an
+app can use (0.2.0 never reached npm), so the site names it only as the old
+name. What did NOT change name: the
configuration `cds.requires.cap2ui5`, `cds add cap2ui5`, the bin `cap2ui5`
(`npx --no-install cap2ui5 abap2js`), the entity `cap2ui5.Drafts` and the
logger `cap2ui5`. The runtime package was renamed from
@@ -140,8 +146,8 @@ against the cap2UI5 repository.
be given a host-side registration (`defineExit`) instead. Boot the runtime
and check rather than porting a claim from abap2UI5's documentation.
- Write the translator as `npx --no-install cap2ui5 abap2js`, never a bare
- `npx cap2ui5`. The unscoped npm name `cap2ui5` was withdrawn and is
- anybody's now; a bare `npx cap2ui5` where the plugin is not installed
+ `npx cap2ui5`. The unscoped npm name `cap2ui5` holds only a placeholder;
+ a bare `npx cap2ui5` where the plugin is not installed
downloads and runs whatever npm has under it. `--no-install` runs the
project's own `@cap2ui5/cds-plugin` bin or fails. A page that shows the
command says it needs the plugin installed. Left as they are: `cds add
diff --git a/HANDOVER.md b/HANDOVER.md
index b5e9722..0c33914 100644
--- a/HANDOVER.md
+++ b/HANDOVER.md
@@ -29,6 +29,12 @@ The reasoning behind all of it is in [ROADMAP.md](ROADMAP.md) §§8–25 and in
## Open — the approuter and CSRF
+> **2026-09-30:** resolved in code. `@cap2ui5/cds-plugin` 0.4.0 pins runtime
+> 1.146.0, which carries `5a1bd70`; the deployment page now says the generated
+> catch-all route works, and keeps the extra route only for 0.3.x. What is left
+> is to run it once behind an approuter bound to XSUAA or IAS — it is read from
+> both sides' code, not measured. The text below is the state before.
+
`cds add approuter` generates a catch-all route with `"csrfProtection": true`,
and the frontend in runtime 1.145.0 sends no `X-CSRF-Token`, so behind that
route every roundtrip gets 403. The site documents the working setup — an
diff --git a/docs/.verify-refs-ignore b/docs/.verify-refs-ignore
index bf353cc..c04750e 100644
--- a/docs/.verify-refs-ignore
+++ b/docs/.verify-refs-ignore
@@ -17,6 +17,7 @@ my_first_app # the class the getting-started walkthrough has you writ
my_app_name # stands for "your class" in the ?app_start= URL on the navigation page
zcl_my_app # stands for "your app class": the name you gave defineApp in the why-cap2UI5 pitch, and the ABAP class on the views page — an ABAP app is registered by its transpiled class, not by defineApp
ClassName # literal placeholder in the URL-parameter description
+z2ui5_cl_smp_app_493 # abap2UI5's hello-world sample: a class in abap2UI5/samples and @cap2ui5/samples, not in abap2UI5's src
# --- apps of other repositories -------------------------------------------
# Registered with defineApp in their own repository, not in cap2UI5 - and apps,
diff --git a/docs/api/app-interface.md b/docs/api/app-interface.md
index 9d2976f..1801933 100644
--- a/docs/api/app-interface.md
+++ b/docs/api/app-interface.md
@@ -55,10 +55,27 @@ The wrapper awaits it either way.
### State is the fields
-Every field with an initial value becomes part of the model and survives the
-roundtrip. A field the plugin cannot type is left out and **named in a
-warning**, never silently dropped. Unlike ABAP there is no `PROTECTED
-SECTION`: every field is model.
+Every field with an initial value is kept in the draft and survives the
+roundtrip. It reaches the browser only once the app **binds** it —
+`_bind()`, `_bind_edit()`, `_bind_path()`, a component or a cell — and from
+then on it stays bound, as the framework does for an ABAP app. So a field no
+view shows is neither sent to the browser nor taken back from it; there is no
+`PROTECTED SECTION` to hide it, and none is needed. A field the plugin cannot
+type is left out and **named in a warning**, never silently dropped.
+
+Three names `defineApp` refuses, each with a message that says what to write
+instead:
+
+- **a camelCase field** — `isAdmin = false`. A field is an ABAP attribute, and
+ the runtime reads it by its lower-case name; write `is_admin`. Components of
+ a structure and the class's methods may be camelCase.
+- **a `#private` member** used in `main()` or a method it calls. They run on a
+ proxy of the instance, which a private name does not reach. Use a plain
+ field — it is not sent to the browser unless bound — or a module-level
+ function.
+- **an app name the runtime already has a class of** — the framework's own,
+ one of its apps, the plugin's. `defineApp("Z2UI5_CL_UTIL", …)` would replace
+ what every roundtrip runs.
Inside `main` and inside any method it calls, fields read and write as plain
values. A helper method that needs the client gets it as an ABAP app does —
diff --git a/docs/examples/selection-screen.md b/docs/examples/selection-screen.md
index b4a135d..0e70dca 100644
--- a/docs/examples/selection-screen.md
+++ b/docs/examples/selection-screen.md
@@ -18,8 +18,8 @@ const { SELECT } = cds.ql;
defineApp("ZCL_ORDERS", class {
customer = "";
- minTotal = 0;
- onlyOpen = false;
+ min_total = 0;
+ only_open = false;
rows = t.table({ ID: 0, customer: "", total: t.packed(11, 2), open: false });
hits = 0;
@@ -33,8 +33,8 @@ defineApp("ZCL_ORDERS", class {
`` +
`` +
` ` +
`" specifier
* lands on a file that exists. Two dead packages are reported by name,
* in either form: "abap2UI5/…", the port's package, and "cap2ui5", the
- * plugin's name up to 0.2.0, withdrawn from npm.
+ * plugin's name up to 0.2.0, now a deprecated placeholder on npm.
* 5. every plugin option named as `cds.requires.cap2ui5.` is a key the plugin
* really defines, every three-part release number (1.x.y) is the runtime
* release the checkout pins or an allowlisted historical number, and a
* `"@cap2ui5/cds-plugin": "^x.y.z"` a page tells a reader to write is a
* range the plugin's own version actually falls in (and a dependency on
- * the withdrawn `"cap2ui5"` is reported whatever its range).
+ * the deprecated `"cap2ui5"` is reported whatever its range).
*
* Check 4 exists because the first three did not see the largest defect this
* site ever had. Fenced blocks were skipped wholesale as "examples, not
@@ -200,10 +200,17 @@ if (haveUpstream) {
* .verify-refs-ignore with a reason: historical upstream releases stay true
* whatever the pin says, and UI5 numbers are not framework releases at all.
* Two-part floors like 1.71 are UI5 talk and deliberately not matched. */
-const VERSION_SOURCE = "runtime/package.json";
+/* Read from the PLUGIN's dependency, not from runtime/package.json: that is the
+ * repository's stand-in, whose committed version only moves when someone
+ * assembles and commits it - it still said 1.145.0 after 0.4.0 pinned 1.146.0,
+ * and every stale 1.145.0 on the site passed. What a reader installs is the
+ * exact version plugin/package.json names. */
+const VERSION_SOURCE = "plugin/package.json";
const PINNED_RELEASE = (() => {
try {
- return JSON.parse(fs.readFileSync(path.join(APP, VERSION_SOURCE), "utf8")).version ?? null;
+ const spec = JSON.parse(fs.readFileSync(path.join(APP, VERSION_SOURCE), "utf8"))
+ .dependencies?.["@abap2ui5/node-runtime"];
+ return /^\d+\.\d+\.\d+$/.test(spec ?? "") ? spec : null;
} catch { return null; }
})();
@@ -221,8 +228,9 @@ const PLUGIN_VERSION = (() => {
} catch { return null; }
})();
const CAP2UI5_DEP_RE = /"@cap2ui5\/cds-plugin"\s*:\s*"[~^]?(\d+\.\d+)\.[\dx]+"/g;
-// The unscoped package `cap2ui5` was withdrawn from npm with 0.3.0 - a
-// dependency on it is a line a reader cannot install, whatever its range.
+// The unscoped package `cap2ui5` is, since 0.3.0, only a deprecated placeholder
+// on npm - a dependency on it installs nothing a reader can use, whatever its
+// range.
const WITHDRAWN_DEP_RE = /"cap2ui5"\s*:\s*"[~^]?\d/g;
const minor = (v) => String(v).split(".").slice(0, 2).join(".");
@@ -268,7 +276,7 @@ const RELEASE_RE = /\b1\.\d{2,3}\.\d+\b/g;
const CLASS_RE = /`(z2ui5_(?:cl|if|cx)_[a-z0-9_]+)(?![a-z0-9_])/gi;
// require("@cap2ui5/cds-plugin"), require("@cap2ui5/cds-plugin/lib/…"), and two
// dead packages: the port's `abap2UI5` and the plugin's own old name `cap2ui5`,
-// withdrawn from npm with 0.3.0.
+// a deprecated placeholder on npm since 0.3.0.
const PKG = "@cap2ui5/cds-plugin";
const REQUIRE_RE = /require\(\s*["'`](@cap2ui5\/cds-plugin|cap2ui5|abap2UI5)(?:\/([^"'`]+))?["'`]\s*\)/gi;
// `const { defineApp, t } = require("@cap2ui5/cds-plugin")` — the names, not just the path
@@ -326,7 +334,7 @@ for (const file of markdownFiles(DOCS)) {
}
for (const m of line.matchAll(WITHDRAWN_DEP_RE)) {
- add(file, n, `tells a reader to depend on "cap2ui5", which was withdrawn from npm `
+ add(file, n, `tells a reader to depend on "cap2ui5", which is only a deprecated placeholder on npm `
+ `- the package is "${PKG}"`);
}
@@ -335,7 +343,7 @@ for (const file of markdownFiles(DOCS)) {
for (const m of line.matchAll(RELEASE_RE)) {
if (m[0] === PINNED_RELEASE || IGNORE.has(m[0])) continue;
add(file, n, `names release ${m[0]}, but the checkout pins ${PINNED_RELEASE} `
- + `(version in ${VERSION_SOURCE}) - update the prose, or add the number `
+ + `(the @abap2ui5/node-runtime dependency in ${VERSION_SOURCE}) - update the prose, or add the number `
+ `to .verify-refs-ignore with the reason it stays`);
}
}
@@ -362,7 +370,7 @@ for (const file of markdownFiles(DOCS)) {
continue;
}
if (pkg.toLowerCase() === "cap2ui5") {
- add(file, n, `${how} "${spec}" is the plugin's OLD name, withdrawn from npm - `
+ add(file, n, `${how} "${spec}" is the plugin's OLD name, only a deprecated placeholder on npm - `
+ `the package is "${PKG}"`);
continue;
}