@dozimple/abap-adt 1.0.0-rc.1

package/dist/core/atc.js

@@ -0,0 +1,94 @@
+/**
+ * ATC recordados por sistema Y alcance (objeto u orden), para que «el hallazgo 3» sea siempre del objeto que se
+ * nombra. Antes se recordaba solo el último por sistema, y explain/finding sobre un objeto devolvían el hallazgo de
+ * otro objeto analizado antes: con apariencia correcta, que es lo peor.
+ */
+const runs = new Map();
+const lastScope = new Map();
+const MAX_RUNS = 100;
+export const objectScope = (name) => `OBJ:${name.trim().toUpperCase()}`;
+export const transportScope = (trkorr) => `TR:${trkorr.trim().toUpperCase()}`;
+export function rememberRun(systemId, scopeKey, r) {
+    const k = `${systemId.toUpperCase()}|${scopeKey}`;
+    runs.delete(k); // reinsertar = más reciente
+    runs.set(k, r);
+    if (runs.size > MAX_RUNS)
+        runs.delete(runs.keys().next().value);
+    lastScope.set(systemId.toUpperCase(), scopeKey);
+}
+/** ATC de ese alcance; sin alcance, el último del sistema (quien llama debe decir de qué objeto es). */
+export function recallRun(systemId, scopeKey) {
+    const key = scopeKey ?? lastScope.get(systemId.toUpperCase());
+    return key ? runs.get(`${systemId.toUpperCase()}|${key}`) : undefined;
+}
+/** «hace 3 min» para que se vea si el resultado recordado es de hace un rato. */
+export function runAge(r, now = Date.now()) {
+    const min = Math.max(0, Math.round((now - Date.parse(r.at)) / 60_000));
+    return min < 1 ? "hace menos de 1 min" : `hace ${min} min`;
+}
+export async function defaultVariant(c) {
+    const cust = await c.atcCustomizing();
+    const v = cust.properties.find((p) => p.name === "systemCheckVariant")?.value;
+    return typeof v === "string" && v ? v : "DEFAULT";
+}
+const xmlEsc = (s) => s.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/</g, "&lt;");
+/**
+ * Ejecución ATC sobre varios objetos a la vez. La librería solo admite una
+ * URI; en NW 7.50 una orden no sirve como conjunto («No URI-Mapping defined
+ * for URI»), así que se envían sus objetos en la misma ejecución.
+ */
+async function createMultiRun(c, worklistId, uris, maxResults) {
+    const refs = uris.map((u) => `<adtcore:objectReference adtcore:uri="${xmlEsc(u)}"/>`).join("");
+    const body = `<?xml version="1.0" encoding="UTF-8"?><atc:run maximumVerdicts="${maxResults}" xmlns:atc="http://www.sap.com/adt/atc">` +
+        `<objectSets xmlns:adtcore="http://www.sap.com/adt/core"><objectSet kind="inclusive"><adtcore:objectReferences>${refs}` +
+        `</adtcore:objectReferences></objectSet></objectSets></atc:run>`;
+    const r = await c.httpClient.request(`/sap/bc/adt/atc/runs?worklistId=${encodeURIComponent(worklistId)}`, {
+        method: "POST",
+        headers: { Accept: "application/xml", "Content-Type": "application/xml" },
+        body,
+    });
+    const xml = String(r.body);
+    const tag = (t) => new RegExp(`<(?:\\w+:)?${t}>([^<]*)</(?:\\w+:)?${t}>`).exec(xml)?.[1] ?? "";
+    const infos = [...xml.matchAll(/<(?:\w+:)?info>([\s\S]*?)<\/(?:\w+:)?info>/g)].map((m) => ({
+        type: /<(?:\w+:)?type>([^<]*)</.exec(m[1])?.[1] ?? "",
+        description: /<(?:\w+:)?description>([^<]*)</.exec(m[1])?.[1] ?? "",
+    }));
+    return { id: tag("worklistId"), timestamp: new Date(tag("worklistTimestamp")).getTime() / 1000, infos };
+}
+/** Ejecuta ATC sobre una o varias URI (objeto, paquete, orden u objetos de una orden). */
+export async function runAtc(c, uri, variant, maxResults, includeExempted) {
+    const worklistId = await c.atcCheckVariant(variant);
+    const run = Array.isArray(uri) ? await createMultiRun(c, worklistId, uri, maxResults) : await c.createAtcRun(worklistId, uri, maxResults);
+    const wl = await c.atcWorklists(run.id, run.timestamp, "99999999999999999999999999999999", includeExempted);
+    const statsInfo = run.infos.find((i) => i.type === "FINDING_STATS")?.description;
+    const [p1, p2, p3] = (statsInfo ?? "").split(",").map((x) => Number(x));
+    const findings = [];
+    for (const o of wl.objects) {
+        for (const f of o.findings) {
+            findings.push({
+                n: 0,
+                objectName: o.name,
+                objectType: o.type,
+                objectUri: o.uri,
+                sourceUri: f.location.uri.split("#")[0],
+                line: f.location.range.start.line,
+                column: f.location.range.start.column,
+                priority: f.priority,
+                checkTitle: f.checkTitle,
+                messageTitle: f.messageTitle,
+                docUri: f.link?.href,
+                exempted: !!f.exemptionKind,
+            });
+        }
+    }
+    findings.sort((a, b) => a.priority - b.priority || a.objectName.localeCompare(b.objectName) || a.line - b.line);
+    findings.forEach((f, i) => (f.n = i + 1));
+    return {
+        variant,
+        scope: Array.isArray(uri) ? `${uri.length} objetos` : uri,
+        at: new Date().toISOString(),
+        stats: statsInfo && [p1, p2, p3].every(Number.isFinite) ? { p1, p2, p3 } : undefined,
+        findings,
+    };
+}
+//# sourceMappingURL=atc.js.map

package/dist/core/audit.js

@@ -0,0 +1,93 @@
+import { createHash } from "node:crypto";
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { stateDir } from "./telemetry.js";
+/**
+ * Registro de auditoría de todo lo que modifica o ejecuta en SAP. Solo
+ * añade líneas y cada una lleva el hash de la anterior: borrar o retocar una
+ * entrada rompe la cadena y `npm run audit:verify` lo detecta.
+ *
+ * Nunca guarda fuente, textos ni datos: de los argumentos largos o
+ * compuestos queda solo su huella (sha256 y tamaño), suficiente para probar
+ * qué se escribió comparando con la versión en SAP.
+ */
+export const AUDIT_FILE = "audit.jsonl";
+const GENESIS = "0".repeat(64);
+const INLINE_MAX = 120;
+/** E/S del registro, sustituible en tests para simular disco lleno o permisos. */
+export const auditIo = { appendFileSync, existsSync, mkdirSync, readFileSync };
+const sha256 = (s) => createHash("sha256").update(s).digest("hex");
+/** Argumentos aptos para el registro: valores cortos tal cual, el resto como huella. */
+export function auditArgs(args) {
+    const out = {};
+    for (const [k, v] of Object.entries(args)) {
+        if (v === undefined)
+            continue;
+        if (typeof v === "string" && v.length > INLINE_MAX) {
+            out[k] = { sha256: sha256(v), chars: v.length, lines: v.split("\n").length };
+        }
+        else if (v !== null && typeof v === "object") {
+            const json = JSON.stringify(v);
+            out[k] = { sha256: sha256(json), items: Array.isArray(v) ? v.length : Object.keys(v).length };
+        }
+        else {
+            out[k] = v;
+        }
+    }
+    return out;
+}
+function entryHash(e) {
+    return sha256(JSON.stringify(e));
+}
+function lastEntry(path) {
+    if (!auditIo.existsSync(path))
+        return { seq: 0, hash: GENESIS };
+    const lines = auditIo.readFileSync(path, "utf8").trimEnd().split("\n").filter(Boolean);
+    if (!lines.length)
+        return { seq: 0, hash: GENESIS };
+    const last = JSON.parse(lines[lines.length - 1]);
+    return { seq: last.seq, hash: last.hash };
+}
+/**
+ * Añade una entrada. Lanza si no puede escribir: quien llama decide no
+ * seguir (una escritura sin rastro no se hace).
+ */
+export function appendAudit(input, dir = stateDir()) {
+    auditIo.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const path = join(dir, AUDIT_FILE);
+    const prev = lastEntry(path);
+    const base = {
+        seq: prev.seq + 1,
+        ts: new Date().toISOString(),
+        ...input,
+        args: auditArgs(input.args),
+        prev: prev.hash,
+    };
+    const entry = { ...base, hash: entryHash(base) };
+    auditIo.appendFileSync(path, JSON.stringify(entry) + "\n", { mode: 0o600 });
+    return entry;
+}
+/** Recorre la cadena completa: secuencia, enlace con la anterior y hash propio. */
+export function verifyAudit(text) {
+    const lines = text.split("\n").filter(Boolean);
+    let prev = GENESIS;
+    for (let i = 0; i < lines.length; i++) {
+        let e;
+        try {
+            e = JSON.parse(lines[i]);
+        }
+        catch {
+            return { ok: false, entries: lines.length, brokenAt: i + 1, reason: "línea que no es JSON" };
+        }
+        const { hash, ...rest } = e;
+        if (e.seq !== i + 1)
+            return { ok: false, entries: lines.length, brokenAt: i + 1, reason: `secuencia ${e.seq}, se esperaba ${i + 1}` };
+        if (e.prev !== prev)
+            return { ok: false, entries: lines.length, brokenAt: i + 1, reason: "no enlaza con la entrada anterior" };
+        if (entryHash(rest) !== hash)
+            return { ok: false, entries: lines.length, brokenAt: i + 1, reason: "contenido alterado" };
+        prev = hash;
+    }
+    return { ok: true, entries: lines.length };
+}
+//# sourceMappingURL=audit.js.map

package/dist/core/catalog.en.js

@@ -0,0 +1,92 @@
+/**
+ * English texts for the generated blocks of README.md. The tool descriptions the
+ * model reads stay in the code (Spanish); this is only the public summary. A test
+ * requires every catalogued tool, group and prompt to have its English entry.
+ */
+export const GROUPS_EN = {
+    revision: { title: "Code review and transports", pitch: "Know what a transport really changes and what it may break, before releasing it." },
+    calidad: { title: "Quality, ATC and remediation", pitch: "Find, understand and fix findings with SAP's real syntax check and quick fixes." },
+    exploracion: { title: "Repository exploration", pitch: "Read and understand any ABAP object and its relations, on ECC and S/4HANA." },
+    datos: { title: "Data queries", pitch: "Query tables with ABAP SQL, read-only, with sensitive and personal data protected." },
+    diagnostico: { title: "Incident diagnosis", pitch: "One conversation for what used to take ST22, SM37, SLG1 and /IWFND/ERROR_LOG." },
+    documentacion: { title: "SAP documentation", pitch: "Answer from official documentation and check which syntax exists in each release." },
+    escritura: { title: "Controlled writes", pitch: "Save changes only in development, in the right transport, previewed and confirmed by a human." },
+    "transport-risk": { title: "DoZimple Transport Risk", pitch: "Decide whether a whole release can go to QA or production, with the why in business terms." },
+    operacion: { title: "Operations and growth", pitch: "See what works on each system and decide the next tool with data." },
+};
+export const TOOLS_EN = {
+    transport_diff: "**What a transport changed (code diff).** Code review of a transport: for each source object (programs, includes, classes, interfaces, function modules, CDS) compares the version recorded with that transport against the previous one and shows a unified diff.",
+    transport_contents: "**Transport contents.** Header, tasks (owner and status) and objects of a transport request, read from E070/E07T/E071.",
+    co_change: "**What usually travels with this object?** Looks at the transports that touched an object and counts which other objects travelled with it, most frequent first.",
+    inactive_objects: "**Inactive objects.** Objects saved but not activated by the connection user, with their transport.",
+    edit_preflight: "**Before editing: which transport will it land in?** Tells, BEFORE changing an object, which transport the change will end up in and why: CTS lock by another transport, local object ($TMP), repair (different original system), or free with your open transports.",
+    run_atc: "**Run ATC.** Runs the ABAP Test Cockpit on an object or a transport and lists numbered findings (priority, line, check, message) with SAP's P1/P2/P3 totals.",
+    atc_quickfix: "**SAP-proposed fixes.** The fixes SAP offers (the same as Ctrl+1 in Eclipse) for an ATC finding or a line: create text symbol, extract constant, etc.",
+    api_release_state: "**Is this API released? What is its successor?** Release state of an SAP object (class, function module/BAPI, table, CDS…) by contract C0–C4 and its released successor, read from the system itself.",
+    syntax_check: "**SAP syntax check.** SAP's real syntax check (not abaplint), also on code not saved yet.",
+    run_unit_tests: "**Run ABAP Unit.** Runs the ABAP Unit tests of a class or program (harmless and short only) and returns the result per method, with each failure in detail.",
+    search_objects: "**Search ABAP objects.** Searches repository objects by name (supports * wildcards).",
+    get_source: "**Read ABAP source.** Reads the source of any object: program, include, class (and its includes), interface, function module (without knowing its group), CDS, table/structure, etc.",
+    where_used: "**Where used.** Where-used list of an object: who references it, with package and owner.",
+    object_versions: "**Object versions.** Version history of an object (date, author, transport).",
+    package_contents: "**Package contents.** Objects of a development package grouped by type, with subpackages (TADIR/TDEVC, any release).",
+    ddic_type_info: "**Data element, domain or table type.** Definition of a DDIC type: data element (domain, type, length, texts), domain (type, length, fixed values, value table) or table type (line type, key).",
+    function_modules: "**Function modules of a group.** Lists the function modules of a function group with their text and whether they are RFC or update modules; given a module, finds its group and siblings. Works with /XXX/ namespaces.",
+    transaction_info: "**What a transaction runs.** Program, screen and parameters of a transaction (TSTC/TSTCP), with its text.",
+    text_elements: "**Text symbols and selection texts.** Reads the text symbols (TEXT-001…), selection texts or headings of a program, class or function group.",
+    sql_query: "**ABAP SQL query.** Runs an ABAP SQL SELECT (WHERE, JOIN, ORDER BY, subqueries) through ADT data preview, with personal columns masked and row caps on production-data systems.",
+    table_contents: "**Table contents.** Rows of a table, view or CDS, with optional columns and filter.",
+    dumps: "**Dumps (ST22).** Lists runtime dumps: date, error, program, user and short text.",
+    jobs: "**Background jobs (SM37).** Background jobs by name (supports *), user, status and date, with their steps (program and variant).",
+    application_log: "**Application log (SLG1) headers.** Application log headers (BALHDR) by object/subobject, external number, user and date, with error and warning counts.",
+    gateway_errors: "**SAP Gateway errors (/IWFND/ERROR_LOG).** Lists SAP Gateway (OData) errors: service, error, user, date.",
+    abap_feature_matrix: "**Since which release does this syntax exist?** Availability of each ABAP language feature per release (7.40 … 7.58, 2025).",
+    docs_search: "**Search ABAP documentation.** Searches the official ABAP keyword documentation (standard and cloud), Clean ABAP, the DSAG guide, ABAP cheat sheets and RAP samples, locally.",
+    docs_fetch: "**Read a documentation page.** Returns the full content of a document by the id docs_search gives.",
+    clean_core_objects: "**Released objects catalog (Clean Core).** Searches SAP's public catalog (abap-atc-cr-cv-s4hc, local) for released/deprecated objects by name or topic, with Clean Core level (A released … D all) and successors.",
+    clean_core_object: "**Clean Core state of an SAP object.** Release state, Clean Core level and successor of an SAP object according to the public catalog (local).",
+    abap_lint: "**abaplint on a snippet.** Runs abaplint locally (code never leaves the machine) on an ABAP snippet or source.",
+    docs_community_search: "**Search SAP Community.** Searches SAP Community (blogs and questions) by error message, class or concept.",
+    write_source: "**Save source to SAP.** Replaces the FULL source of an existing object (or class include) in the given transport, after a preview with syntax check and diff and a human confirmation.",
+    activate: "**Activate object.** Activates an object and returns SAP's messages as they are (errors with line, warnings, objects left inactive).",
+    write_text_elements: "**Create or change text symbols.** Adds or changes text symbols (or selection texts) of a program/class/group, merging with the existing ones: nothing not mentioned is deleted.",
+    create_transport: "**Create transport request.** Creates a workbench request for an object's package BEFORE the first edit, so the change lands in the ticket's transport and not in a reused task.",
+    analyze_transport_risk: "**Transport risk.** Tells whether a transport (or a release of several, comma-separated) is safe to move to QA or production: unreleased tasks, import status, dependencies that don't travel, positional access, CTS locks, import queue.",
+    import_health: "**Import health.** Health of the imports into a target (QA or production): answers “how are the releases to production going?”.",
+    failure_ranking: "**Objects that fail most on import.** Ranking of objects by import failure history in a target.",
+    change_audit: "**Change audit evidence.** Evidence for a change management audit on a target: what went in, with which ticket, initiative and origin.",
+    object_transport_history: "**Transport history of an object.** Which transports touched an object, when, and which already reached the target.",
+    remote_source: "**Source on the target.** The source of an object AS IT IS in QA or production, read through TMS (like “Retrieve remote versions”).",
+    transport_source_check: "**Transport code against the target.** Compares the code of a transport's objects with the target: objects missing there (R3.4) and version drift — signatures, fields or parameters that differ and don't travel in the transport (R3.5).",
+    sap_systems: "**SAP systems and available tools.** Lists the configured systems (role, writes, data class, modules) and, optionally, checks connectivity and which tools work on each.",
+    report_gap: "**Record a missing tool.** Records a need no tool covers (e.g. something you had to do manually in a transaction), to decide what to build next.",
+    close_gap: "**Close a recorded gap.** Marks a gap recorded with report_gap as resolved, with a note (a tool now covers it, or the note turned out to be wrong); nothing is deleted.",
+    usage_stats: "**Tool usage and gaps.** Summary of the local log: calls per tool, failure rate and type, systems, and the gaps recorded with report_gap.",
+};
+export const PROMPTS_EN = {
+    revisar_pase: {
+        title: "Review a transport before release",
+        description: "Full review of a transport: code, missing companions, locks and, with the risk module, its analysis.",
+        chain: "transport_contents → transport_diff → inactive_objects → co_change + edit_preflight → analyze_transport_risk (if module) → three-layer report: business, consultant, Basis",
+    },
+    remediar_atc: {
+        title: "Remediate ATC findings of an object",
+        description: "ATC → documentation and SAP note → released successor → fix → syntax → save in the transport.",
+        chain: "edit_preflight → run_atc (BEFORE) → explain + api_release_state + where_used/object_versions → CHANGE/INVESTIGATE/KEEP classification → atc_quickfix → syntax_check → write_source in the transport (with human OK) → run_atc (AFTER) and P1 reduction",
+    },
+    diagnosticar_ticket: {
+        title: "Diagnose an incident",
+        description: "Dumps, jobs, application log and Gateway errors around an incident.",
+        chain: "dumps → jobs → application_log → gateway_errors → transaction_info / get_source / object_versions / transport_contents → probable cause with evidence and what could not be checked",
+    },
+};
+const PHRASES_EN = [
+    [/ y contribuidores/g, " and contributors"],
+    [/ y autores de la comunidad/g, " and community authors"],
+    [/^según el repositorio$/, "per repository"],
+    [/^términos de SAP$/, "SAP terms"],
+    [/^algoritmo publicado$/, "published algorithm"],
+];
+export const toEn = (s) => PHRASES_EN.reduce((acc, [re, en]) => acc.replace(re, en), s);
+export const KIND_EN = { dependencia: "dependency", datos: "data", idea: "idea", algoritmo: "algorithm" };
+//# sourceMappingURL=catalog.en.js.map

package/dist/core/catalog.js

@@ -0,0 +1,139 @@
+export const CREDITS = {
+    abapAdtApi: { what: "abap-adt-api", by: "Marcello Urbani", url: "https://github.com/marcellourbani/abap-adt-api", license: "MIT", kind: "dependencia" },
+    abapFs: { what: "ABAP Remote FS (vscode_abap_remote_fs)", by: "Marcello Urbani", url: "https://github.com/marcellourbani/vscode_abap_remote_fs", license: "MIT", kind: "idea" },
+    mcpSdk: { what: "Model Context Protocol TypeScript SDK", by: "Model Context Protocol", url: "https://github.com/modelcontextprotocol/typescript-sdk", license: "MIT", kind: "dependencia" },
+    marioAdt: { what: "mcp-abap-adt", by: "mario-andreschak", url: "https://github.com/mario-andreschak/mcp-abap-adt", license: "MIT", kind: "idea" },
+    arc1: { what: "ARC-1", by: "arc-mcp (Marian Zeis y contribuidores)", url: "https://github.com/arc-mcp/arc-1", license: "MIT", kind: "idea" },
+    vsp: { what: "vibing-steampunk", by: "oisee y contribuidores", url: "https://github.com/oisee/vibing-steampunk", license: "MIT", kind: "idea" },
+    awsAccel: { what: "ABAP Accelerator for Amazon Q Developer", by: "AWS Solutions Library Samples", url: "https://github.com/aws-solutions-library-samples/guidance-for-deploying-sap-abap-accelerator-for-amazon-q-developer", license: "MIT-0", kind: "idea" },
+    sapDocsMcp: { what: "mcp-sap-docs", by: "Marian Zeis (marianfoo)", url: "https://github.com/marianfoo/mcp-sap-docs", license: "Apache-2.0", kind: "dependencia" },
+    abapDocs: { what: "ABAP Keyword Documentation", by: "SAP SE", url: "https://help.sap.com/doc/abapdocu_latest_index_htm/latest/en-US/index.htm", license: "© SAP SE", kind: "datos" },
+    cheatSheets: { what: "ABAP Cheat Sheets", by: "SAP (SAP-samples)", url: "https://github.com/SAP-samples/abap-cheat-sheets", license: "Apache-2.0", kind: "datos" },
+    cleanAbap: { what: "Clean ABAP (SAP Style Guides)", by: "SAP", url: "https://github.com/SAP/styleguides", license: "según el repositorio", kind: "datos" },
+    dsag: { what: "DSAG ABAP-Leitfaden", by: "DSAG e.V.", url: "https://github.com/marianfoo/DSAG-ABAP-Guide", license: "según el repositorio", kind: "datos" },
+    featureMatrix: { what: "ABAP Feature Matrix", by: "Software-Heroes", url: "https://software-heroes.com/en/abap-feature-matrix", license: "© Software-Heroes", kind: "datos" },
+    releasedObjects: { what: "Released objects / Cloudification Repository (abap-atc-cr-cv-s4hc)", by: "SAP", url: "https://github.com/SAP/abap-atc-cr-cv-s4hc", license: "Apache-2.0", kind: "datos" },
+    abaplint: { what: "abaplint", by: "Lars Hvam y contribuidores", url: "https://github.com/abaplint/abaplint", license: "MIT", kind: "dependencia" },
+    sapCommunity: { what: "SAP Community / SAP Help Portal", by: "SAP SE y autores de la comunidad", url: "https://community.sap.com", license: "términos de SAP", kind: "datos" },
+    myers: { what: "An O(ND) Difference Algorithm and Its Variations (1986)", by: "Eugene W. Myers", url: "https://doi.org/10.1007/BF01840446", license: "algoritmo publicado", kind: "algoritmo" },
+    zod: { what: "zod", by: "Colin McDonnell y contribuidores", url: "https://github.com/colinhacks/zod", license: "MIT", kind: "dependencia" },
+};
+const ADT = ["abapAdtApi"];
+export const GROUPS = [
+    {
+        id: "revision",
+        title: "Revisión de código y pases",
+        pitch: "Saber qué cambia de verdad una orden y qué puede romper, antes de liberarla.",
+        tools: [
+            { name: "transport_diff", credits: ["abapAdtApi", "arc1", "myers"] },
+            { name: "transport_contents", credits: ADT },
+            { name: "co_change", credits: ["vsp"] },
+            { name: "inactive_objects", credits: ADT },
+            { name: "edit_preflight", credits: ADT },
+        ],
+    },
+    {
+        id: "calidad",
+        title: "Calidad, ATC y remediación",
+        pitch: "Encontrar, entender y corregir hallazgos con la sintaxis y las correcciones reales de SAP.",
+        tools: [
+            { name: "run_atc", credits: ADT },
+            { name: "atc_quickfix", credits: ["abapAdtApi", "arc1", "myers"] },
+            { name: "api_release_state", credits: ["abapAdtApi", "vsp"] },
+            { name: "syntax_check", credits: ["abapAdtApi", "abapFs"] },
+            { name: "run_unit_tests", credits: ADT },
+        ],
+    },
+    {
+        id: "exploracion",
+        title: "Exploración del repositorio",
+        pitch: "Leer y entender cualquier objeto ABAP y sus relaciones, en ECC y en S/4HANA.",
+        tools: [
+            { name: "search_objects", credits: ["abapAdtApi", "marioAdt"] },
+            { name: "get_source", credits: ["abapAdtApi", "marioAdt"] },
+            { name: "where_used", credits: ADT },
+            { name: "object_versions", credits: ADT },
+            { name: "package_contents", credits: ["abapAdtApi", "marioAdt"] },
+            { name: "ddic_type_info", credits: ["abapAdtApi", "marioAdt"] },
+            { name: "transaction_info", credits: ["abapAdtApi", "marioAdt"] },
+            { name: "function_modules", credits: ADT },
+            { name: "text_elements", credits: ADT },
+        ],
+    },
+    {
+        id: "datos",
+        title: "Consulta de datos",
+        pitch: "Preguntar a las tablas con ABAP SQL, de solo lectura y sin tocar material de credenciales.",
+        tools: [
+            { name: "sql_query", credits: ADT },
+            { name: "table_contents", credits: ["abapAdtApi", "marioAdt"] },
+        ],
+    },
+    {
+        id: "diagnostico",
+        title: "Diagnóstico de incidentes",
+        pitch: "Reunir en una conversación lo que antes exigía ST22, SM37, SLG1 y /IWFND/ERROR_LOG.",
+        tools: [
+            { name: "dumps", credits: ADT },
+            { name: "jobs", credits: ["vsp"] },
+            { name: "application_log", credits: ["vsp"] },
+            { name: "gateway_errors", credits: ["abapAdtApi", "arc1"] },
+        ],
+    },
+    {
+        id: "documentacion",
+        title: "Documentación SAP",
+        pitch: "Responder con la documentación oficial y comprobar qué sintaxis existe en cada release.",
+        tools: [
+            { name: "abap_feature_matrix", credits: ["sapDocsMcp", "featureMatrix"] },
+            { name: "docs_search", credits: ["sapDocsMcp", "abapDocs", "cheatSheets", "cleanAbap", "dsag"] },
+            { name: "docs_fetch", credits: ["sapDocsMcp", "abapDocs"] },
+            { name: "clean_core_objects", credits: ["sapDocsMcp", "releasedObjects"] },
+            { name: "clean_core_object", credits: ["sapDocsMcp", "releasedObjects"] },
+            { name: "abap_lint", credits: ["sapDocsMcp", "abaplint"] },
+            { name: "docs_community_search", credits: ["sapDocsMcp", "sapCommunity"] },
+        ],
+    },
+    {
+        id: "escritura",
+        title: "Escritura controlada",
+        pitch: "Guardar cambios solo en desarrollo, en la orden correcta y con la sintaxis verificada antes.",
+        tools: [
+            { name: "write_source", credits: ADT },
+            { name: "activate", credits: ADT },
+            { name: "write_text_elements", credits: ADT },
+            { name: "create_transport", credits: ADT },
+        ],
+    },
+    {
+        id: "transport-risk",
+        title: "DoZimple Transport Risk",
+        pitch: "Decidir si un pase entero puede ir a calidad o productivo, con el porqué en lenguaje de negocio.",
+        tools: [
+            { name: "analyze_transport_risk", credits: [] },
+            { name: "import_health", credits: [] },
+            { name: "failure_ranking", credits: [] },
+            { name: "change_audit", credits: [] },
+            { name: "object_transport_history", credits: [] },
+            { name: "remote_source", credits: [] },
+            { name: "transport_source_check", credits: [] },
+        ],
+    },
+    {
+        id: "operacion",
+        title: "Operación y crecimiento",
+        pitch: "Ver qué funciona en cada sistema y decidir con datos cuál es la siguiente tool.",
+        tools: [
+            { name: "sap_systems", credits: ADT },
+            { name: "report_gap", credits: [] },
+            { name: "close_gap", credits: [] },
+            { name: "usage_stats", credits: ["awsAccel"] },
+        ],
+    },
+];
+/** Créditos del núcleo (todas las tools se apoyan en ellos). */
+export const CORE_CREDITS = ["mcpSdk", "zod", "abapAdtApi", "awsAccel"];
+export function groupOf(tool) {
+    return GROUPS.find((g) => g.tools.some((t) => t.name === tool));
+}
+//# sourceMappingURL=catalog.js.map

package/dist/core/checks.js

@@ -0,0 +1,19 @@
+/**
+ * Chequeo de sintaxis de SAP (no abaplint) sobre un contenido dado, esté
+ * guardado o no. Para includes se pasa el programa principal como contexto.
+ */
+export async function syntaxCheck(c, obj, srcUrl, content, mainProgram) {
+    let context = mainProgram;
+    if (!context && obj.type.startsWith("PROG/I")) {
+        const mains = await c.mainPrograms(obj.uri).catch(() => []);
+        context = mains[0]?.["adtcore:uri"];
+    }
+    return c.syntaxCheck(obj.uri, srcUrl, content, context ?? "");
+}
+export const isError = (m) => ["E", "A", "X"].includes(m.severity?.toUpperCase());
+export function renderSyntax(msgs) {
+    return msgs
+        .map((m) => `  ${m.severity} L${m.line}${m.offset ? `:${m.offset}` : ""}  ${m.text}${m.uri && !/source\/main$/.test(m.uri) ? `  [${m.uri}]` : ""}`)
+        .join("\n");
+}
+//# sourceMappingURL=checks.js.map

package/dist/core/config.js

@@ -0,0 +1,136 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join, resolve } from "node:path";
+import { z } from "zod";
+/**
+ * Sistemas SAP a los que puede hablar el servidor.
+ *
+ * El archivo NO lleva contraseñas: `password` solo dice de dónde sacarla
+ * (llavero de macOS por defecto). Así el archivo se puede versionar o
+ * compartir sin revisar nada.
+ */
+const SystemSchema = z.object({
+    id: z.string().regex(/^[A-Za-z0-9_]+$/, "id: solo letras, números y _"),
+    description: z.string().optional(),
+    sid: z.string().regex(/^[A-Z0-9]{3}$/).optional(),
+    url: z.string().url(),
+    client: z.string().regex(/^\d{3}$/),
+    user: z.string().min(1),
+    language: z.string().length(2).default("ES"),
+    role: z.enum(["DEV", "QAS", "PRD"]),
+    /** Solo tiene efecto si role es DEV: QAS y PRD nunca se escriben. */
+    allowWrite: z.boolean().default(false),
+    /** Módulos de cliente habilitados en este sistema, p. ej. "dz-transport-risk". */
+    modules: z.array(z.string()).default([]),
+    /** Certificado (PEM) de la CA o del servidor, para verificar TLS en sistemas con certificado propio. */
+    caFile: z.string().optional(),
+    /** Último recurso: desactiva la verificación TLS. Preferir caFile. */
+    allowSelfSigned: z.boolean().default(false),
+    /**
+     * Qué datos hay en el sistema: test (ficticios), masked (anonimizados) o
+     * prod (reales). Por defecto DEV = test y QAS/PRD = prod. En masked y prod
+     * se ocultan columnas personales y se limita el número de filas.
+     */
+    dataClass: z.enum(["test", "masked", "prod"]).optional(),
+    /** Tope de filas por consulta; por defecto test 5000, masked 1000, prod 200. */
+    maxRows: z.number().int().min(1).max(5000).optional(),
+    password: z
+        .string()
+        .regex(/^(keychain|env:[A-Z0-9_]+)$/, 'password: "keychain" o "env:NOMBRE_VARIABLE"')
+        .default("keychain"),
+});
+/**
+ * MCP de terceros que corren como proceso hijo aislado y cuyas tools publica
+ * este servidor (con su política). Hoy: "docs" = mcp-sap-docs.
+ */
+const SidecarSchema = z.object({
+    command: z.string().min(1),
+    args: z.array(z.string()).default([]),
+    /** Si false (por defecto), ninguna consulta del usuario sale a internet. */
+    allowOnline: z.boolean().default(false),
+    /** Términos que nunca pueden salir en una consulta online (clientes, proyectos…). */
+    blockTerms: z.array(z.string()).default([]),
+});
+const ConfigSchema = z.object({
+    defaultSystem: z.string().optional(),
+    systems: z.array(SystemSchema).min(1),
+    sidecars: z.record(SidecarSchema).default({}),
+});
+export function configPath() {
+    return process.env.ABAP_DZ_CONFIG
+        ? resolve(process.env.ABAP_DZ_CONFIG)
+        : join(homedir(), ".config", "abap-adt-dozimple", "systems.json");
+}
+export function parseConfig(raw) {
+    const cfg = ConfigSchema.parse(raw);
+    const ids = new Set();
+    for (const s of cfg.systems) {
+        const key = s.id.toUpperCase();
+        if (ids.has(key))
+            throw new Error(`Sistema duplicado en la configuración: ${s.id}`);
+        ids.add(key);
+    }
+    if (cfg.defaultSystem && !ids.has(cfg.defaultSystem.toUpperCase())) {
+        throw new Error(`defaultSystem "${cfg.defaultSystem}" no está en systems[]`);
+    }
+    return cfg;
+}
+export function loadConfig(path = configPath()) {
+    if (!existsSync(path)) {
+        throw new Error(`No existe la configuración de sistemas en ${path}. ` +
+            `Copia config/systems.example.json ahí (o define ABAP_DZ_CONFIG).`);
+    }
+    assertPrivateFile(path);
+    return parseConfig(JSON.parse(readFileSync(path, "utf8")));
+}
+/**
+ * Quien pueda escribir systems.json decide a qué sistema se conecta el
+ * servidor y si puede escribir en él: tiene que ser solo del usuario.
+ */
+export function assertPrivateFile(path, st = statSync(path)) {
+    if (process.platform === "win32")
+        return;
+    if (st.mode & 0o022) {
+        throw new Error(`${path} lo pueden modificar otros usuarios (permisos ${(st.mode & 0o777).toString(8)}). Corrígelo con: chmod 600 "${path}"`);
+    }
+    const uid = process.getuid?.();
+    if (uid !== undefined && st.uid !== uid) {
+        throw new Error(`${path} pertenece a otro usuario (uid ${st.uid}). Debe ser tuyo y con permisos 600.`);
+    }
+}
+/** Escritura efectiva: hace falta allowWrite y ser un sistema de desarrollo. */
+export function canWrite(s) {
+    return s.allowWrite && s.role === "DEV";
+}
+/**
+ * Qué sistema usar, y por qué. Prioridad: el parámetro de la tool, luego
+ * defaultSystem (o ABAP_DZ_DEFAULT_SYSTEM). Si hay varios y ninguno está
+ * indicado, se pide en vez de adivinar.
+ */
+export function resolveSystem(cfg, requested) {
+    const find = (id) => cfg.systems.find((s) => s.id.toUpperCase() === id.trim().toUpperCase());
+    if (requested && requested.trim()) {
+        const s = find(requested);
+        if (!s) {
+            throw new Error(`Sistema "${requested}" no configurado. Disponibles: ${cfg.systems.map((x) => x.id).join(", ")}`);
+        }
+        return { system: s, source: "parámetro" };
+    }
+    const fromEnv = process.env.ABAP_DZ_DEFAULT_SYSTEM;
+    if (fromEnv) {
+        const s = find(fromEnv);
+        // Una variable de entorno que apunta a un sistema que no existe es un error, no un «siguiente candidato».
+        if (!s)
+            throw new Error(`ABAP_DZ_DEFAULT_SYSTEM="${fromEnv}" no está configurado. Disponibles: ${cfg.systems.map((x) => x.id).join(", ")}`);
+        return { system: s, source: "por defecto: ABAP_DZ_DEFAULT_SYSTEM" };
+    }
+    if (cfg.defaultSystem) {
+        const s = find(cfg.defaultSystem);
+        if (s)
+            return { system: s, source: "por defecto" };
+    }
+    if (cfg.systems.length === 1)
+        return { system: cfg.systems[0], source: "único configurado" };
+    throw new Error(`Hay varios sistemas y ninguno por defecto: indica "system" (${cfg.systems.map((x) => x.id).join(", ")})`);
+}
+//# sourceMappingURL=config.js.map

package/dist/core/confirm.js

@@ -0,0 +1,43 @@
+import { createHash, randomBytes } from "node:crypto";
+/**
+ * Confirmación en dos fases de las escrituras cuando el cliente MCP no
+ * soporta elicitación: la primera llamada devuelve la vista previa y un token
+ * de un solo uso atado a tool + sistema + argumentos exactos. Si el modelo
+ * cambia una coma de la fuente entre la vista previa y la escritura, el token
+ * deja de valer y hay que volver a previsualizar.
+ */
+export const CONFIRM_TTL_MS = 10 * 60_000;
+const pending = new Map();
+function canonical(v) {
+    if (Array.isArray(v))
+        return v.map(canonical);
+    if (v && typeof v === "object") {
+        return Object.fromEntries(Object.keys(v)
+            .sort()
+            .filter((k) => v[k] !== undefined)
+            .map((k) => [k, canonical(v[k])]));
+    }
+    return v;
+}
+export function argsDigest(tool, system, args) {
+    return createHash("sha256").update(JSON.stringify([tool, system.toUpperCase(), canonical(args)])).digest("hex");
+}
+export function issueToken(tool, system, args, now = Date.now()) {
+    for (const [t, p] of pending)
+        if (p.exp <= now)
+            pending.delete(t);
+    const token = randomBytes(16).toString("hex");
+    pending.set(token, { digest: argsDigest(tool, system, args), exp: now + CONFIRM_TTL_MS });
+    return token;
+}
+/** Consume el token: vale una sola vez, también cuando no coincide. */
+export function consumeToken(token, tool, system, args, now = Date.now()) {
+    const p = pending.get(token);
+    if (!p)
+        return "unknown";
+    pending.delete(token);
+    if (p.exp <= now)
+        return "expired";
+    return p.digest === argsDigest(tool, system, args) ? "ok" : "mismatch";
+}
+//# sourceMappingURL=confirm.js.map