fix: ship LICENSE, NOTICE and README in the published packages

.changeset/ship-legal-files.md

@@ -0,0 +1,9 @@
+---
+"@asyncapi/parser": patch
+"@asyncapi/multi-parser": patch
+"@asyncapi/openapi-schema-parser": patch
+---
+
+Ship the Apache-2.0 `LICENSE` and the `NOTICE` file inside the published tarballs, and add the repository
+README to the two packages that had none. `LICENSE` and `README.md` were already listed in each package's
+`files` array, but those entries resolve inside `packages/<pkg>/`, where neither file exists.

packages/multi-parser/.gitignore

@@ -8,3 +8,8 @@ node_modules
 /cjs
 /browser
 *.tgz
+
+# copied from the repo root by prepublishOnly (scripts/copy-legal.js)
+LICENSE
+NOTICE
+README.md

packages/multi-parser/package.json

@@ -23,6 +23,7 @@
     "/esm",
     "/cjs",
     "LICENSE",
+    "NOTICE",
     "README.md"
   ],
   "scripts": {
@@ -36,7 +37,8 @@
     "generate:readme:toc": "markdown-toc -i \"../../README.md\"",
     "generate:assets": "npm run generate:readme:toc",
     "bump:version": "npm --no-git-tag-version --allow-same-version version $VERSION",
-    "prepublishOnly": "npm run generate:assets"
+    "copy:legal": "node ../../scripts/copy-legal.js",
+    "prepublishOnly": "npm run copy:legal && npm run generate:assets"
   },
   "dependencies": {
     "@asyncapi/avro-schema-parser": "^3.0.3",

packages/openapi-schema-parser/.gitignore

@@ -6,3 +6,7 @@ node_modules
 /lib
 /esm
 /cjs
+
+# copied from the repo root by prepublishOnly (scripts/copy-legal.js)
+LICENSE
+NOTICE

packages/openapi-schema-parser/package.json

@@ -34,6 +34,7 @@
     "/esm",
     "/cjs",
     "LICENSE",
+    "NOTICE",
     "README.md"
   ],
   "scripts": {
@@ -47,7 +48,8 @@
     "generate:readme:toc": "markdown-toc -i \"README.md\"",
     "generate:assets": "npm run build && npm run generate:readme:toc",
     "bump:version": "npm --no-git-tag-version --allow-same-version version $VERSION",
-    "prepublishOnly": "npm run generate:assets"
+    "copy:legal": "node ../../scripts/copy-legal.js",
+    "prepublishOnly": "npm run copy:legal && npm run generate:assets"
   },
   "dependencies": {
     "@openapi-contrib/openapi-schema-to-json-schema": "~3.2.0",

packages/parser/.gitignore

@@ -9,3 +9,8 @@ node_modules
 /browser
 *.tgz
 .turbo
+
+# copied from the repo root by prepublishOnly (scripts/copy-legal.js)
+LICENSE
+NOTICE
+README.md

packages/parser/package.json

@@ -24,6 +24,7 @@
     "/cjs",
     "/browser",
     "LICENSE",
+    "NOTICE",
     "README.md"
   ],
   "scripts": {
@@ -40,7 +41,8 @@
     "generate:readme:toc": "markdown-toc -i \"../../README.md\"",
     "generate:assets": "npm run generate:readme:toc",
     "bump:version": "npm --no-git-tag-version --allow-same-version version $VERSION",
-    "prepublishOnly": "npm run generate:assets"
+    "copy:legal": "node ../../scripts/copy-legal.js",
+    "prepublishOnly": "npm run copy:legal && npm run generate:assets"
   },
   "dependencies": {
     "@asyncapi/specs": "^6.11.1",

scripts/copy-legal.js

@@ -0,0 +1,18 @@
+// Copy the monorepo-root legal and readme files into the package being published.
+// npm only packs files that exist inside the package directory, so without this the published tarballs
+// contain no LICENSE and no NOTICE - see the "files" array in each packages/*/package.json.
+const fs = require('fs');
+const path = require('path');
+
+const root = path.join(__dirname, '..');
+const pkg = process.cwd();
+
+for (const name of ['LICENSE', 'NOTICE']) {
+  fs.copyFileSync(path.join(root, name), path.join(pkg, name));
+}
+
+// Only fall back to the monorepo README for packages that do not ship one of their own;
+// @asyncapi/openapi-schema-parser has its own and it must not be overwritten.
+if (!fs.existsSync(path.join(pkg, 'README.md'))) {
+  fs.copyFileSync(path.join(root, 'README.md'), path.join(pkg, 'README.md'));
+}