build(mcp-server): require the bundled draw.io in the package and cap the tarball at 40 MB

.github/workflows/publish-mcp.yml

@@ -62,6 +62,9 @@ jobs:
         if: steps.version.outputs.publish == 'true'
         run: npm test
 
+      # The build downloads the pinned draw.war from GitHub releases
+      # (scripts/fetch-drawio.mjs) and bundles a trimmed draw.io into
+      # dist/drawio; check-package confirms it is in the tarball
       - name: Build and check package contents
         if: steps.version.outputs.publish == 'true'
         run: npm run build && npm run check-package

packages/mcp-server/scripts/check-package.mjs

@@ -9,7 +9,13 @@ const REQUIRED = [
     "dist/preview/index.html",
     "dist/preview/preview.css",
     "dist/preview/preview.js",
+    "dist/drawio/index.html",
+    "dist/drawio/js/app.min.js",
+    "dist/drawio/LICENSE",
 ]
+// The bundled draw.io is most of the package; a jump means the file list
+// grew more than intended
+const MAX_TARBALL_BYTES = 40 * 1024 * 1024
 
 const output = JSON.parse(
     execSync("npm pack --dry-run --json", { encoding: "utf8" }),
@@ -22,4 +28,13 @@ if (missing.length > 0) {
     console.error(`npm package is missing: ${missing.join(", ")}`)
     process.exit(1)
 }
-console.log(`npm package OK (${files.size} files)`)
+const mb = (n) => (n / 1048576).toFixed(1)
+if (pack.size > MAX_TARBALL_BYTES) {
+    console.error(
+        `npm package is ${mb(pack.size)} MB packed, over the ${mb(MAX_TARBALL_BYTES)} MB limit`,
+    )
+    process.exit(1)
+}
+console.log(
+    `npm package OK (${files.size} files, ${mb(pack.size)} MB packed, ${mb(pack.unpackedSize)} MB unpacked)`,
+)