Document the packages as they are published

[oblomov-dev]

Both packages are on npm since 2026-09-27: cap2ui5@0.1.0 and @abap2ui5/node-runtime@1.145.0, which the plugin pins exactly. This PR updates the site to match what a reader actually gets from npm today. It also documents the approuter setting a BTP deployment needs right now.

What changed

• Package name. Every place that means the package now says @abap2ui5/node-runtime instead of @abap2ui5/runtime. ROADMAP keeps the old name in its dated sections, and a note at the top says so.
• No static frontend. Removed /z2ui5/webapp/ and the webapp option from getting-started, project-structure, configuration, deployment (including its approuter route), protocol, what-is, why, user-exit, devtools, index and architecture. The GET page embeds the whole UI5 component.
• Quickstart now works verbatim. The steps are cds init my-cap2ui5-app --nodejs --add tiny-sample, npm install, npm install cap2ui5, srv/apps/hello.js, cds watch. The page points to the [cap2ui5] HELLO http://…?app_start=HELLO startup lines as the entry point, because CAP's / index doesn't list the route. It also has a tip about the NO_DRAFT_ENTRY_OF_PREVIOUS_REQUEST_FOUND error after cds watch restarts. The "not on npm yet" box is gone.
• import instead of require in every example. cds init --nodejs creates an ES module project, where a require in an app file breaks the whole runtime boot. A box on getting-started and a troubleshooting entry cover CommonJS projects and .cjs files. scripts/verify-refs.mjs now checks import { … } from "cap2ui5" (including as aliases), cap2ui5/<sub> import specifiers, and the retired abap2UI5/… package, the same way it checks require.
• Deployment page:
  • The production build as measured, with a statement that real HANA/BTP was not exercised.
  • The approuter route with "csrfProtection": false in front of the generated catch-all. The page explains why it is needed (approuter 23.0.0 xsrf-token-handler; the frontend up to 1.145.0 sends no token) and why it is safe (abap2UI5's own Origin/Referer check against Host or X-Forwarded-Host).
  • Run behind an SAP approuter that keeps csrfProtection on abap2UI5/abap2UI5#2802 is described as open and pending. The roadmap lists removing the extra route as the next step.
• Troubleshooting: new entries for "every roundtrip 500" (the ES module require failure) and "403 behind the approuter".
• Repository docs: AGENTS.md "Ground truth" (package name, published versions, no static route or webapp, runtime stand-in without webapp/, import in examples), HANDOVER.md (publishing done; the approuter CSRF item is open) and ROADMAP §25.
• Also fixed: stale plugin line counts, and removed two .verify-refs-ignore entries (app/webapp, my_app) that no longer match anything.

Verification

• npm run check:ci passes against cap2UI5 and abap2UI5 main (verify-refs with --require-checkout, then the VitePress build).
• The new verify-refs checks were tested with deliberate errors: a name cap2ui5 doesn't export, a cap2ui5/lib/nope import and an abap2UI5/core import. Each was reported with file and line.
• Re-ran the facts from the task brief in this session with cds-dk 10.1.0 and Node 22:
  • The quickstart runs verbatim and prints the documented log lines.
  • The GET page returns 200 (358 KB) and /z2ui5/webapp/index.html returns 404.
  • An ESM require fails the boot, and roundtrips return 500 "roundtrip failed".
  • cds add hana + cds build --production produces cap2ui5.Drafts.hdbtable, gen/srv/srv/apps/hello.js and cap2ui5.Drafts in csn.json.
  • cds add xsuaa,approuter writes .deploy/app-router/xs-app.json with one catch-all route, csrfProtection: true.
• Not re-run here: the approuter 23.0.0 test (roundtrips pass, a foreign Origin gets 403) and the boot of the built service from csn.json. Both come from the brief and are described on the page as the brief states them.

🤖 Generated with Claude Code

https://claude.ai/code/session_01CegF7ccAM1UDD7VSXU85Tw

---

Generated by Claude Code