From 400f4e00209e541961b93a1caad9668e327a4ebe Mon Sep 17 00:00:00 2001
From: jochen <jschoubben@gmail.com>
Date: Wed, 4 Nov 2026 12:10:00 +0100
Subject: [PATCH] =?UTF-8?q?SDK-3:=20package-version.sum=20and=20its=20guar?=
 =?UTF-8?q?d=20go:=20the=20builder=20numbers=20every=20version=20(ADR=2006?=
 =?UTF-8?q?05=20=C2=A77=20step=204,=20design=2051)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nothing reads either on any repository's main.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig
---
 go/packageguard/packageversion_test.go | 104 -------------------------
 go/packageguard/reads-outside          |   1 -
 package-version.sum                    |   1 -
 3 files changed, 106 deletions(-)
 delete mode 100644 go/packageguard/packageversion_test.go
 delete mode 100644 go/packageguard/reads-outside
 delete mode 100644 package-version.sum

diff --git a/go/packageguard/packageversion_test.go b/go/packageguard/packageversion_test.go
deleted file mode 100644
index 2ec2d8c..0000000
--- a/go/packageguard/packageversion_test.go
+++ /dev/null
@@ -1,104 +0,0 @@
-package packageguard
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"encoding/json"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-	"sort"
-	"strings"
-	"testing"
-)
-
-// The registry refuses a second, different package under one version
-// ("version taken", issues 1899 and 1331). This guard fails before a merge when
-// what npm packs changes while the version stays: package-version.sum holds the
-// version and a sha256 over the inputs of the packed dist (package.json without
-// its version, src/, tsconfig.json) and of the README npm always packs.
-// The lock file is not packed, so it is not hashed.
-
-const sumFile = "package-version.sum"
-
-func packedInputs(root string) (version, sum string, err error) {
-	raw, err := os.ReadFile(filepath.Join(root, "package.json"))
-	if err != nil {
-		return "", "", err
-	}
-	var pkg map[string]any
-	if err := json.Unmarshal(raw, &pkg); err != nil {
-		return "", "", err
-	}
-	version, _ = pkg["version"].(string)
-	delete(pkg, "version")
-	canon, err := json.Marshal(pkg) // map keys are sorted: stable bytes
-	if err != nil {
-		return "", "", err
-	}
-	files := map[string][]byte{"package.json": canon}
-	for _, name := range []string{"tsconfig.json", "README.md"} {
-		b, err := os.ReadFile(filepath.Join(root, name))
-		if err != nil {
-			return "", "", err
-		}
-		files[name] = b
-	}
-	err = filepath.WalkDir(filepath.Join(root, "src"), func(p string, d fs.DirEntry, err error) error {
-		if err != nil || d.IsDir() {
-			return err
-		}
-		b, err := os.ReadFile(p)
-		if err != nil {
-			return err
-		}
-		rel, _ := filepath.Rel(root, p)
-		files[filepath.ToSlash(rel)] = b
-		return nil
-	})
-	if err != nil {
-		return "", "", err
-	}
-	names := make([]string, 0, len(files))
-	for n := range files {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	h := sha256.New()
-	for _, n := range names {
-		fmt.Fprintf(h, "%s\x00%d\x00", n, len(files[n]))
-		h.Write(files[n])
-	}
-	return version, hex.EncodeToString(h.Sum(nil)), nil
-}
-
-func TestPackageVersionMatchesPackedInputs(t *testing.T) {
-	root := "../.."
-	if r := os.Getenv("MESH_SDK_ROOT"); r != "" {
-		root = r
-	}
-	version, sum, err := packedInputs(root)
-	if err != nil {
-		t.Fatal(err)
-	}
-	line := version + " " + sum + "\n"
-	if os.Getenv("UPDATE_PACKAGE_VERSION_SUM") != "" {
-		if err := os.WriteFile(filepath.Join(root, sumFile), []byte(line), 0o644); err != nil {
-			t.Fatal(err)
-		}
-		return
-	}
-	raw, err := os.ReadFile(filepath.Join(root, sumFile))
-	if err != nil {
-		t.Fatalf("%s is missing: %v", sumFile, err)
-	}
-	recVersion, recSum, _ := strings.Cut(strings.TrimSpace(string(raw)), " ")
-	switch {
-	case recVersion == version && recSum == sum:
-	case recVersion == version:
-		t.Fatalf("what npm packs for @novox/mesh-sdk changed while its version stayed %s: the registry would refuse a second, different %s. Raise @novox/mesh-sdk's version (package.json and package-lock.json) and update %s (UPDATE_PACKAGE_VERSION_SUM=1 go test -run TestPackageVersionMatchesPackedInputs in go/packageguard)", version, version, sumFile)
-	default:
-		t.Fatalf("package.json says %s but %s records %s: update %s (UPDATE_PACKAGE_VERSION_SUM=1 go test -run TestPackageVersionMatchesPackedInputs in go/packageguard)", version, sumFile, recVersion, sumFile)
-	}
-}
diff --git a/go/packageguard/reads-outside b/go/packageguard/reads-outside
deleted file mode 100644
index f6b2d87..0000000
--- a/go/packageguard/reads-outside
+++ /dev/null
@@ -1 +0,0 @@
-These tests read files outside this directory (the whole catalogue, the repository, or its root files): mesh-build-go never keeps this package's verdict (issue 1935).
diff --git a/package-version.sum b/package-version.sum
deleted file mode 100644
index c41176c..0000000
--- a/package-version.sum
+++ /dev/null
@@ -1 +0,0 @@
-0.1.18 5cbc2d043e45ab47eadff55a61f8be7d50144cec3cf295333b5ea1b4c181cfdf