@cspeach/cli 1.1.35 → 1.1.37

package/dist/rap/generator-names.js

@@ -0,0 +1,57 @@
+const camel = (base) => base.toLowerCase().split('_').filter(Boolean)
+    .map((p) => p[0].toUpperCase() + p.slice(1)).join('');
+/**
+ * The names both skeleton paths build. `suffix` (final review I3, spec row 7):
+ * a digit appended to the base when a name is taken — every derived name
+ * carries it, and the cuts that keep the limits are made BEFORE it, so the
+ * digit is never cut off. The table name itself never changes.
+ */
+export function proposeNames(table, suffix = '') {
+    const t = table.trim().toUpperCase();
+    const plain = t.replace(/^[ZY]/, '').replace(/^_/, '');
+    const base = `${plain}${suffix}`;
+    // Draft table ≤16 chars; strip ALL trailing underscores so it never ends in '__D'.
+    const draft = `${t.slice(0, 14 - suffix.length).replace(/_+$/, '')}${suffix}_D`;
+    // Service names ≤26 (SRVB limit): shorten the service base only (spec §3: "the plan proposes shorter ones").
+    const svcBase = `ZUI_${base}_O4`.length <= 26 ? base : `${plain.slice(0, 19 - suffix.length).replace(/_+$/, '')}${suffix}`;
+    const svc = `ZUI_${svcBase}_O4`;
+    return {
+        table: t, base, entity: camel(base),
+        root: `ZR_${base}`, projection: `ZC_${base}`, behaviorPool: `ZBP_${base}`,
+        draftTable: draft, serviceDefinition: svc, serviceBinding: svc,
+    };
+}
+export function namesFitLimits(n) {
+    return n.draftTable.length <= 16 && n.serviceBinding.length <= 26
+        && [n.root, n.projection, n.behaviorPool, n.serviceDefinition].every((x) => x.length <= 30);
+}
+/** The 9 objects SAP's uiservice generator creates, in SAP's preview order. */
+export function generatorPlannedObjects(n, pkg) {
+    const p = pkg.toUpperCase();
+    return [
+        { type: 'DDLS', name: n.root, package: p },
+        { type: 'BDEF', name: n.root, package: p },
+        { type: 'CLAS', name: n.behaviorPool, package: p },
+        { type: 'TABL', name: n.draftTable, package: p },
+        { type: 'DDLS', name: n.projection, package: p },
+        { type: 'BDEF', name: n.projection, package: p },
+        { type: 'DDLX', name: n.projection, package: p },
+        { type: 'SRVD', name: n.serviceDefinition, package: p },
+        { type: 'SRVB', name: n.serviceBinding, package: p },
+    ];
+}
+export function buildUiserviceContent(n, pkg, description) {
+    return {
+        metadata: { package: pkg.toUpperCase(), masterLanguage: 'EN' },
+        general: { referenceObjectName: n.table, description: description.slice(0, 60) },
+        businessObject: {
+            dataModelEntity: { cdsName: n.root, entityName: n.entity },
+            behavior: { implementationType: 'Managed', implementationClass: n.behaviorPool, draftTable: n.draftTable },
+        },
+        serviceProjection: { name: n.projection },
+        businessService: {
+            serviceDefinition: { name: n.serviceDefinition },
+            serviceBinding: { name: n.serviceBinding, bindingType: 'OData V4 - UI' },
+        },
+    };
+}

package/dist/rap/skeleton-card.js

@@ -0,0 +1,31 @@
+import { cardLine } from '../lane/card.js';
+import { OBJECT_TYPE_LABELS } from '../projects/plan-objects.js';
+export const SKELETON_WHO = {
+    'sap-generator': "SAP's generator",
+    cspeach: 'CSPeach writer',
+};
+export function skeletonCardRequest(d, blockedReason, n, objects) {
+    const by = d.by ?? 'cspeach';
+    const facts = [
+        `Table: ${n.table}`,
+        `Why: ${d.reason}`,
+        ...(by === 'sap-generator'
+            ? objects.map((o) => `${o.name} · ${OBJECT_TYPE_LABELS[o.type] ?? o.type}`)
+            : [`App shape: ${n.root}, ${n.projection}, ${n.serviceBinding}`]),
+        'Either way, CSPeach then adds security, labels, value helps, logic and tests, and checks them.',
+    ];
+    const choices = [{ value: 'confirm', label: `Build the skeleton with the ${SKELETON_WHO[by]}` }];
+    if (by === 'sap-generator')
+        choices.push({ value: 'switch:cspeach', label: 'Use the CSPeach writer instead' });
+    else if (!blockedReason)
+        choices.push({ value: 'switch:sap-generator', label: "Use SAP's generator instead" });
+    choices.push({ value: 'cancel', label: 'Cancel' });
+    return {
+        id: 'rap-skeleton',
+        tag: 'QUESTION',
+        title: 'How should the RAP skeleton be built?',
+        facts: facts.map(cardLine),
+        choices: choices.map((c) => ({ ...c, label: cardLine(c.label) })),
+        initial: 0,
+    };
+}

package/dist/rap/skeleton-rules.js

@@ -0,0 +1,38 @@
+const RAP_TIERS = new Set(['s4-2020-plus', 'unknown']);
+export function generatorBlockers(req, f) {
+    // Row 3 variant (final review I1): no SAP at all — nothing to check, the CSPeach writer.
+    if (f.connected === false)
+        return { row: 3, reason: 'Not connected to SAP' };
+    if (f.generator === 'no')
+        return { row: 3, reason: 'This system has no RAP generator' };
+    if (f.generator === 'unknown')
+        return { row: 3, reason: "Couldn't confirm a RAP generator on this system" };
+    if (req.entities !== 1 || req.implementation !== 'managed' || !req.draft || req.binding !== 'odata-v4-ui') {
+        return { row: 4, reason: "SAP's generator supports only one table, managed, with draft, V4 UI" };
+    }
+    // Row 4 variant (final review M2): the generator writes to a transport; a $ package has none.
+    if (f.localPackage)
+        return { row: 4, reason: "SAP's generator needs a transport, and a local package has none" };
+    if (f.tableExists && f.tableHasTimestamps === false)
+        return { row: 5, reason: "This table lacks the fields SAP's generator needs" };
+    if (f.tableExists && f.uiserviceOffered === false)
+        return { row: 6, reason: "SAP's generator isn't offered for this table" };
+    if (!f.namesFit)
+        return { row: 7, reason: "These names are too long for SAP's generator" };
+    if (f.tableExists && f.validation && !f.validation.ok) {
+        return { row: 7, reason: `SAP's generator check failed: ${f.validation.text || 'no reason given'}` };
+    }
+    return null;
+}
+export function decideSkeleton(req, f, override) {
+    if (!RAP_TIERS.has(f.tier))
+        return { by: null, row: 2, reason: 'RAP needs S/4HANA 2020 or later', overridden: false };
+    const blocked = generatorBlockers(req, f);
+    if (override === 'cspeach')
+        return { by: 'cspeach', row: 1, reason: 'Chosen by you', overridden: true };
+    if (override === 'sap-generator' && !blocked)
+        return { by: 'sap-generator', row: 1, reason: 'Chosen by you', overridden: true };
+    if (blocked)
+        return { by: 'cspeach', row: blocked.row, reason: blocked.reason, overridden: false };
+    return { by: 'sap-generator', row: 8, reason: "Fits SAP's generator: built in seconds, then finished by CSPeach", overridden: false };
+}

package/dist/rap/skeleton-session.js

@@ -0,0 +1,21 @@
+// cspeach-cli/src/rap/skeleton-session.ts
+//
+// RAP generator plan, Task 8 fix round 1 — the session's latest skeleton
+// decision. rap_skeleton_resolve records the {path, sha256} it just wrote; the
+// plan save then accepts only that decision, so a plan cannot cite an older
+// sha-valid file (e.g. one from before an owner override). Keyed on the session
+// object in a WeakMap, like the app flow (lane/app-flow.ts): two sessions never
+// see each other's decision and nothing outlives its session.
+const latest = new WeakMap();
+/** Record the decision rap_skeleton_resolve just wrote (replaces any earlier one). */
+export function setLatestSkeletonDecision(session, ref) {
+    latest.set(session, { path: ref.path, sha256: ref.sha256 });
+}
+/** A frozen copy of the session's latest decision, or undefined when none was made. */
+export function getLatestSkeletonDecision(session) {
+    const r = latest.get(session);
+    return r ? Object.freeze({ ...r }) : undefined;
+}
+export function clearLatestSkeletonDecision(session) {
+    latest.delete(session);
+}

package/dist/rap/skeleton-store.js

@@ -0,0 +1,40 @@
+// cspeach-cli/src/rap/skeleton-store.ts
+//
+// RAP generator plan, Task 6 — the skeleton decision file, written only by
+// rap_skeleton_resolve, read by the plan-save check and sap_generate_objects.
+// sha-pinned like the lane decision (lane/store.ts): a hand edit is refused.
+import { createHash, randomBytes } from 'node:crypto';
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+const DIR = '.cspeach/lane';
+const sha = (s) => createHash('sha256').update(s).digest('hex');
+export async function writeSkeletonDecision(laneRoot, rec) {
+    const full = { kind: 'rap-skeleton', version: 1, ...rec, createdAt: new Date().toISOString() };
+    const body = `${JSON.stringify(full, null, 2)}\n`;
+    const day = full.createdAt.slice(0, 10).replace(/-/g, '');
+    const rel = `${DIR}/skeleton-${day}-${randomBytes(4).toString('hex')}.json`;
+    await fs.mkdir(path.join(laneRoot, DIR), { recursive: true });
+    await fs.writeFile(path.join(laneRoot, rel), body, { encoding: 'utf8', flag: 'wx' });
+    return { path: rel, sha256: sha(body) };
+}
+export async function readSkeletonDecision(laneRoot, relPath, sha256) {
+    const norm = String(relPath ?? '').replace(/\\/g, '/');
+    if (!/^\.cspeach\/lane\/skeleton-\d{8}-[0-9a-f]{8}\.json$/.test(norm)) {
+        return { ok: false, message: 'The skeleton decision path is not a CSPeach decision file. Run /abap-plan again.' };
+    }
+    let body;
+    try {
+        body = await fs.readFile(path.join(laneRoot, norm), 'utf8');
+    }
+    catch {
+        return { ok: false, message: 'The skeleton decision file is missing. Run /abap-plan again.' };
+    }
+    if (sha(body) !== sha256) {
+        return { ok: false, message: 'The skeleton decision file changed after it was saved. Run /abap-plan again.' };
+    }
+    const rec = JSON.parse(body);
+    if (rec.kind !== 'rap-skeleton' || rec.version !== 1) {
+        return { ok: false, message: 'The skeleton decision file is not readable by this CSPeach version. Run /abap-plan again.' };
+    }
+    return { ok: true, rec };
+}

package/dist/renderer/tool-labels.js

@@ -160,6 +160,9 @@ const RULES = {
     sap_link: (a) => ({ verb: 'SAP link', object: str(a['action']) ?? '' }),
     cap_link_smoke: (a) => ({ verb: 'S/4 link check', object: str(a['s4']?.['entitySet']) ?? '' }),
     app_lane_resolve: (a) => ({ verb: 'Chose lane', object: shortLeft(str(a['specPath']) ?? '') }),
+    rap_skeleton_resolve: (a) => ({ verb: 'Chose skeleton', object: str(a['table']) ?? '' }),
+    sap_generate_objects: () => ({ verb: 'Ran SAP generator', object: 'RAP skeleton' }),
+    rap_finish_check: (a) => ({ verb: 'Checked finish', object: str(a['root']) ?? '' }),
     team_findings: (a) => ({ verb: 'Read team findings', object: str(a['lane']) ?? str(a['packages']) ?? 'all objects' }),
     rules_propose: () => ({ verb: 'Check a proposed decision rule', object: 'nothing is saved' }),
     team_estate: (a) => ({ verb: 'Read estate inventory', object: str(a['packages']) ?? 'all packages' }),
@@ -258,7 +261,7 @@ const PRESENT = {
     Structure: 'Reading structure of', 'Change log': 'Reading change log of', 'Read dumps': 'Reading dumps',
     'API state': 'Checking API state of', 'ABAP docs': 'Reading ABAP docs for', 'Read includes': 'Reading includes of',
     Compared: 'Comparing', 'Previewed change': 'Previewing change to', 'Ran unit tests': 'Running unit tests on',
-    'OData test': 'Testing OData', 'Service catalog': 'Reading service catalog', 'Import metadata': 'Importing metadata', 'SAP link': 'SAP link', 'S/4 link check': 'Checking S/4 link', 'Chose lane': 'Choosing build lane', 'Searched BAdIs': 'Searching BAdIs', 'Listed snapshots': 'Listing snapshots',
+    'OData test': 'Testing OData', 'Service catalog': 'Reading service catalog', 'Import metadata': 'Importing metadata', 'SAP link': 'SAP link', 'S/4 link check': 'Checking S/4 link', 'Chose lane': 'Choosing build lane', 'Chose skeleton': 'Choosing RAP skeleton builder', 'Ran SAP generator': 'Running SAP generator', 'Checked finish': 'Checking finish items', 'Searched BAdIs': 'Searching BAdIs', 'Listed snapshots': 'Listing snapshots',
     'Read snapshot': 'Reading snapshot of', 'Cleaned snapshots': 'Cleaning snapshots',
     'Created transport': 'Creating transport', 'Transport for': 'Finding transport for',
     'Listed transports': 'Listing transports', Released: 'Releasing', 'Created domain': 'Creating domain',

package/dist/repl/rule8-detector.js

@@ -32,12 +32,13 @@ export function setRule8BatchApprovedProvider(fn) {
 }
 /**
  * True for a tool that cannot run without an approval id from request_approval
- * (its schema requires `approval_id`): each such call is already approved one
+ * (its schema requires `approval_id`, or `approval_ids` for a multi-object write): each such call is already approved one
  * by one. Shell, file and other tools without an id are never in this set.
  */
 export function toolSpendsApprovalId(tool) {
     const req = tool.input_schema?.required;
-    return Array.isArray(req) && req.includes('approval_id');
+    // RAP generator final review M4 — sap_generate_objects spends one id per object (`approval_ids`).
+    return Array.isArray(req) && (req.includes('approval_id') || req.includes('approval_ids'));
 }
 /**
  * Returns true on the 2nd (and later) mutating call of the turn — the gate

package/dist/repl.js

@@ -172,6 +172,9 @@ import './tools/cap/metadata-import.js';
 import './tools/cap/sap-link-tool.js';
 import './tools/cap/link-smoke.js';
 import './tools/lane/app-lane-resolve.js';
+import './tools/rap/skeleton-resolve.js';
+import './tools/rap/generate-objects.js';
+import './tools/rap/finish-check.js';
 import './tools/extend-model/tool.js';
 import './tools/text-elements/tools.js';
 import './tools/capability/tool.js';
@@ -1980,7 +1983,7 @@ export async function runRepl(opts) {
                     // Task 7 — plan-phase subagent read-only enforcement: set for EVERY
                     // plan-resume phase turn regardless of mode (guarded AND step);
                     // agent_run consults the flag and forces its read-only tool filter.
-                    setPlanPhaseActive(true, planPhaseCtx.envelope.id);
+                    setPlanPhaseActive(true, planPhaseCtx.envelope.id, planPhaseCtx.path);
                     // Task 10 — the writes declaration of the phase EXECUTING this turn
                     // (fail-safe: undefined ⇒ true, the deviation backstop never fires).
                     // request_approval consults it in guarded mode to deny undeclared
@@ -3998,7 +4001,7 @@ export async function runRepl(opts) {
                 const { setPlanPhaseActive, setGuardedRunActive, setCurrentPhaseWrites, getAndResetPlanDeviation } = await import('./commands/plan-gate.js');
                 // Task 7 — plan-phase subagent read-only enforcement (classic mirror):
                 // set for EVERY plan-resume phase turn regardless of mode.
-                setPlanPhaseActive(true, planPhaseCtx.envelope.id);
+                setPlanPhaseActive(true, planPhaseCtx.envelope.id, planPhaseCtx.path);
                 // Task 10 — executing phase's writes declaration for the deviation
                 // backstop + stale-flag discard (classic mirror; see Ink path note).
                 setCurrentPhaseWrites(planPhaseCtx.nextPhaseWrites ?? true);

package/dist/rewind/restore.js

@@ -28,6 +28,7 @@ import { effectiveRisk } from '../approvals/risk-floor.js';
 import { verifySyntax, verifyActive } from '../tools/verify.js';
 import { renderDiff } from '../repl/diff-display.js';
 import { parseIncludeSnapshotType } from '../tools/include-snapshot.js';
+import { hasManualLocks } from '../sap/session-end.js';
 /** Compact single-line failure text for receipts / error envelopes. */
 function shortError(err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -148,7 +149,8 @@ export async function restoreSnapshot(c, deps) {
     if (currentSource === null) {
         let created;
         try {
-            created = await deps.adt.createObject(c.objType, c.object, c.package ?? '', 'Restored via CSPeach rewind', deps.transport);
+            // Review fix round 1, I-1: keep the stateful session while a sap_lock is held.
+            created = await deps.adt.createObject(c.objType, c.object, c.package ?? '', 'Restored via CSPeach rewind', deps.transport, { keepSession: hasManualLocks() });
         }
         catch (err) {
             record('② written ✗');

package/dist/sap/generator-fact.js

@@ -0,0 +1,21 @@
+const cache = new Map();
+export async function getGeneratorFact(adt, alias) {
+    const hit = cache.get(alias);
+    if (hit)
+        return hit;
+    let r;
+    try {
+        r = await adt.hasRepositoryGenerators();
+    }
+    catch {
+        return 'unknown';
+    }
+    if (r === null)
+        return 'unknown';
+    const fact = r ? 'yes' : 'no';
+    cache.set(alias, fact);
+    return fact;
+}
+export function resetGeneratorFactCache() {
+    cache.clear();
+}

package/dist/sap/session-end.js

@@ -26,6 +26,11 @@ export function noteManualLock() {
 export function noteManualUnlock() {
     manualLocks = Math.max(0, manualLocks - 1);
 }
+/** True while a `sap_lock` handle is held (review fix round 1, I-1): sap-client's
+ *  createObject must then keep the stateful session (extras.keepSession). */
+export function hasManualLocks() {
+    return manualLocks > 0;
+}
 export function __resetManualLocksForTests() {
     manualLocks = 0;
 }

package/dist/session/audit-export.js

@@ -59,6 +59,9 @@ const WRITE_TOOLS = new Set([
     // wrong silence.
     'sap_transport_create',
     'sap_transport_release',
+    // Final review I2 — SAP's RAP generator (tools/rap/generate-objects.ts) creates
+    // the skeleton objects in one call; its row names them.
+    'sap_generate_objects',
 ]);
 /**
  * Non-mutating tools that are interaction/plumbing, not object reads — excluded
@@ -189,6 +192,19 @@ function writeObject(tool, args, result) {
             const inc = str(args.includeType);
             return inc ? `${cls} (${inc})` : cls;
         }
+        case 'sap_generate_objects': {
+            // The generated objects live in the RESULT; a failed call names its decision file.
+            let r = {};
+            try {
+                r = asRecord(JSON.parse(result ?? ''));
+            }
+            catch { /* r stays {} */ }
+            const names = Array.isArray(r.objects) ? r.objects.map((o) => str(asRecord(o).name)).filter(Boolean) : [];
+            if (names.length)
+                return names.join(', ');
+            const d = str(args.decisionPath);
+            return d ? `RAP skeleton (${d})` : 'RAP skeleton';
+        }
         case 'sap_activate': {
             if (Array.isArray(args.objects)) {
                 const names = args.objects.map((o) => str(asRecord(o).name) ?? '?');
@@ -362,7 +378,9 @@ export function buildAuditReport(input) {
         L('| --- | --- | --- | :---: | --- | --- |');
         for (const c of writes) {
             const args = asRecord(c.args);
-            const approvalId = str(args.approval_id);
+            // sap_generate_objects carries one approval per object (approval_ids); pair the first.
+            const approvalId = str(args.approval_id)
+                ?? (Array.isArray(args.approval_ids) ? str(args.approval_ids[0]) : undefined);
             const rec = findApproval(approvalId, approvals);
             const key = snapshotKey(c.tool, args);
             const snap = key ? newestSnapshotBefore(snapIndex.get(key), Date.parse(tsOf(c))) : undefined;

package/dist/tools/rap/finish-check.js

@@ -0,0 +1,118 @@
+// cspeach-cli/src/tools/rap/finish-check.ts
+//
+// RAP generator plan, Task 10 — `rap_finish_check` (spec 2026-10-14 §6).
+// Reads the app's live sources (root + projection DDLS, root BDEF, behavior
+// pool CCIMP, projection DDLX, table, access controls) and reports the Finish
+// items F1–F5 item by item, so the model cannot claim them done.
+//
+// A read that fails is never a pass:
+//   - a 404 on the DDLX is the F4 problem "No metadata extension for <projection>";
+//   - any other failed read (a 404 on the DDLS, BDEF, class include or table,
+//     or any non-404 error) is a tool error naming the object.
+import { registerTool } from '../index.js';
+import { checkFinish, FINISH_TITLES } from '../../rap/finish-checks.js';
+const fail = (m) => ({ content: `error: ${m}`, is_error: true });
+const NAME_RE = /^[A-Za-z0-9_/]{1,40}$/;
+class ReadFailed extends Error {
+}
+function httpStatus(e) {
+    const s = e?.httpStatus;
+    return typeof s === 'number' ? s : undefined;
+}
+/** Reads one object; a 404 returns undefined only when `allow404`, every other failure throws ReadFailed. */
+async function read(what, fn, allow404 = false) {
+    try {
+        return await fn();
+    }
+    catch (e) {
+        const status = httpStatus(e);
+        if (status === 404 && allow404)
+            return undefined;
+        if (status === 404)
+            throw new ReadFailed(`${what} not found. Build the app first, then run the finish check.`);
+        const why = status !== undefined ? `HTTP ${status}` : (e instanceof Error ? e.message : String(e));
+        throw new ReadFailed(`could not read ${what} (${why}). Nothing was checked.`);
+    }
+}
+export function formatFinish(items) {
+    const passed = items.filter((i) => i.ok).length;
+    return [
+        `Finish check: ${passed} of ${items.length} passed`,
+        ...items.map((i) => `${i.id} ${FINISH_TITLES[i.id]} — ${i.ok ? 'passed' : `needs work: ${i.problems.join('; ')}`}`),
+    ].join('\n');
+}
+export async function rapFinishCheckHandler(args, ctx) {
+    const names = {};
+    for (const k of ['root', 'projection', 'behaviorPool', 'entity']) {
+        const v = args[k];
+        if (typeof v !== 'string' || !NAME_RE.test(v.trim()))
+            return fail(`${k} is required (an object name)`);
+        names[k] = k === 'entity' ? v.trim() : v.trim().toUpperCase();
+    }
+    const { root, projection, behaviorPool, entity } = names;
+    let table;
+    if (args.table !== undefined && args.table !== null && args.table !== '') {
+        if (typeof args.table !== 'string' || !NAME_RE.test(args.table.trim()))
+            return fail('table must be a table name');
+        table = args.table.trim().toUpperCase();
+    }
+    let authObject;
+    if (args.authObject !== undefined && args.authObject !== null && args.authObject !== '') {
+        if (typeof args.authObject !== 'string' || !/^[A-Za-z0-9_]{1,10}$/.test(args.authObject.trim())) {
+            return fail('authObject must be an authorization object name');
+        }
+        authObject = args.authObject.trim().toUpperCase();
+    }
+    let codedFields = [];
+    if (args.codedFields !== undefined && args.codedFields !== null) {
+        if (!Array.isArray(args.codedFields) || !args.codedFields.every((f) => typeof f === 'string' && /^\w+$/.test(f.trim()))) {
+            return fail('codedFields must be a list of element names');
+        }
+        codedFields = args.codedFields.map((f) => f.trim());
+    }
+    const adt = ctx.adt;
+    let src;
+    try {
+        const rootDdls = (await read(`CDS view ${root}`, () => adt.getSource('DDLS', root)));
+        const projectionDdls = (await read(`CDS view ${projection}`, () => adt.getSource('DDLS', projection)));
+        const rootBdef = (await read(`behavior definition ${root}`, () => adt.getSource('BDEF', root)));
+        const ccimp = String((await read(`local types of ${behaviorPool}`, () => adt.classIncludes(behaviorPool, 'locals_imp'))));
+        const ddlx = await read(`metadata extension ${projection}`, () => adt.getSource('DDLX', projection), true);
+        const tableSrc = table ? await read(`table ${table}`, () => adt.getSource('TABL', table)) : undefined;
+        const dclsNames = [];
+        for (const n of [root, projection]) {
+            const hits = (await read(`access controls for ${n}`, () => adt.searchObject(n, 'DCLS', 10)));
+            if (hits.some((h) => h.name.toUpperCase() === n && /^DCLS(\/|$)/i.test(h.type)))
+                dclsNames.push(n);
+        }
+        src = { rootDdls, projectionDdls, rootBdef, ccimp, dclsNames, ...(ddlx !== undefined ? { ddlx } : {}), ...(tableSrc !== undefined ? { table: tableSrc } : {}) };
+    }
+    catch (e) {
+        if (e instanceof ReadFailed)
+            return fail(e.message);
+        throw e;
+    }
+    return { content: formatFinish(checkFinish(src, { root, projection, entity, authObject, codedFields })) };
+}
+registerTool({
+    name: 'rap_finish_check',
+    description: 'Check the Finish items F1–F5 of a RAP app against its live sources (authorization, access control, '
+        + 'read-only admin fields, labels, coded fields). Read-only. Run it after the Finish step and before the UI. '
+        + 'A failed item lists what to fix; fix only those and run it again.',
+    isMutating: false,
+    requiresSap: true,
+    input_schema: {
+        type: 'object',
+        properties: {
+            root: { type: 'string', description: 'Root interface view (ZR_…); also the root behavior definition' },
+            projection: { type: 'string', description: 'Projection view (ZC_…); its metadata extension has the same name' },
+            behaviorPool: { type: 'string', description: 'Behavior pool class (ZBP_…)' },
+            entity: { type: 'string', description: 'The BDEF entity alias, e.g. SbsBook2 (the app title must not be this)' },
+            table: { type: 'string', description: 'Persistence table, to check a UUID key uses managed numbering' },
+            authObject: { type: 'string', description: 'Authorization object from the spec; the auth method must check it' },
+            codedFields: { type: 'array', items: { type: 'string' }, description: 'Elements with a fixed code list (status, type, currency …)' },
+        },
+        required: ['root', 'projection', 'behaviorPool', 'entity'],
+    },
+    handler: (args, ctx) => rapFinishCheckHandler(args, ctx),
+});