@linkup-ai/abap-ai 0.1.0 → 0.1.1

package/dist/adt-client.js

@@ -12,6 +12,7 @@ exports.adtPut = adtPut;
 exports.adtLock = adtLock;
 exports.adtUnlock = adtUnlock;
 exports.adtDelete = adtDelete;
+exports.adtLockAndDelete = adtLockAndDelete;
 exports.adtPostXml = adtPostXml;
 exports.adtGetXmlWithParams = adtGetXmlWithParams;
 exports.adtPostText = adtPostText;
@@ -328,6 +329,76 @@ async function adtDelete(path, transportRequest) {
         });
     });
 }
+/**
+ * Lock + Delete atômico — resolve o bug do axios-cookiejar-support@4
+ * que não mantém cookies entre POST (LOCK) e DELETE.
+ *
+ * Captura os cookies e o CSRF token da resposta do LOCK e os injeta
+ * manualmente no DELETE request, garantindo que o SAP ICM reconheça
+ * a mesma sessão.
+ */
+async function adtLockAndDelete(objectPath, transportRequest) {
+    await withRetry("LOCK+DELETE", objectPath, async () => {
+        const csrf = await ensureSession();
+        // 1. LOCK — capturar response headers (cookies + lockHandle)
+        const lockResp = await http.post(objectPath, "", {
+            headers: { "X-CSRF-Token": csrf },
+            params: { _action: "LOCK", accessMode: "MODIFY" },
+            validateStatus: (status) => status < 500,
+            responseType: "text",
+        });
+        if (lockResp.status >= 300) {
+            throw new AdtError(`Falha ao bloquear ${objectPath} (status ${lockResp.status}). O objeto pode estar bloqueado por outro usuário.`, lockResp.status, objectPath);
+        }
+        // Extrair lockHandle
+        const lockData = typeof lockResp.data === "string" ? lockResp.data : "";
+        const handleMatch = lockData.match(/<LOCK_HANDLE>([^<]+)<\/LOCK_HANDLE>/);
+        const lockHandle = handleMatch?.[1] ?? "";
+        if (!lockHandle) {
+            throw new AdtError("Lock handle não retornado pelo SAP.", 0, objectPath);
+        }
+        // Capturar cookies da resposta do LOCK para reusar no DELETE
+        const setCookies = lockResp.headers["set-cookie"];
+        const cookieHeader = Array.isArray(setCookies)
+            ? setCookies.map((c) => c.split(";")[0]).join("; ")
+            : typeof setCookies === "string"
+                ? setCookies.split(";")[0]
+                : "";
+        // Capturar CSRF token atualizado (o LOCK pode retornar um novo)
+        const updatedCsrf = lockResp.headers["x-csrf-token"] || csrf;
+        // 2. DELETE — injetar cookies e lockHandle manualmente
+        const deleteParams = { lockHandle };
+        if (transportRequest)
+            deleteParams.corrNr = transportRequest;
+        const deleteHeaders = {
+            "X-CSRF-Token": updatedCsrf,
+        };
+        // Injetar cookies manualmente se capturados
+        if (cookieHeader) {
+            deleteHeaders["Cookie"] = cookieHeader;
+        }
+        const delResp = await http.delete(objectPath, {
+            headers: deleteHeaders,
+            params: deleteParams,
+            validateStatus: (status) => status < 500,
+        });
+        if (delResp.status >= 400) {
+            // Tentar unlock em caso de erro
+            await http.post(objectPath, "", {
+                headers: {
+                    "X-CSRF-Token": updatedCsrf,
+                    ...(cookieHeader ? { Cookie: cookieHeader } : {}),
+                },
+                params: { _action: "UNLOCK", lockHandle },
+                validateStatus: () => true,
+            }).catch(() => { });
+            const errorBody = typeof delResp.data === "string" ? delResp.data : "";
+            const sapMsg = errorBody.match(/<message[^>]*>([^<]+)<\/message>/i)?.[1]
+                ?? `HTTP ${delResp.status}`;
+            throw new AdtError(`Erro ao excluir ${objectPath}: ${sapMsg}`, delResp.status, objectPath);
+        }
+    });
+}
 async function adtPostXml(path, body, params, accept = "application/xml") {
     return withRetry("POST_XML", path, async () => {
         const csrf = await ensureSession();

package/dist/index.js

@@ -62,14 +62,20 @@ const security_audit_js_1 = require("./security-audit.js");
 const license_guard_js_1 = require("./license-guard.js");
 const server = new mcp_js_1.McpServer({
     name: "abap-adt",
-    version: "2.0.0",
+    version: VERSION,
 });
 // ─── License Guard (wraps all tool handlers) ─────────────────────
 // Intercepta server.tool para injetar licenseGuard() automaticamente.
 // Toda tool retorna erro amigável se a licença é ausente ou expirada.
+// Também coleta os nomes de todas as tools registradas para validação de segurança.
+const _registeredToolNames = [];
 {
     const _origTool = server.tool.bind(server);
     server.tool = (...args) => {
+        // Coletar o nome da tool (1º argumento string)
+        if (typeof args[0] === "string") {
+            _registeredToolNames.push(args[0]);
+        }
         const handler = args[args.length - 1];
         args[args.length - 1] = async (...handlerArgs) => {
             const licBlock = (0, license_guard_js_1.licenseGuard)();
@@ -1429,6 +1435,9 @@ server.resource("security-policy", "abap://security-policy", { description: "Pol
 });
 // Inicializa o servidor via stdio (modo Claude Code MCP)
 async function main() {
+    // Validação de segurança: toda tool registrada DEVE ter classificação de risco.
+    // Falha rápido no startup se alguma tool foi adicionada sem classificar.
+    (0, security_policy_js_1.validateToolRiskMap)(_registeredToolNames);
     const transport = new stdio_js_1.StdioServerTransport();
     await server.connect(transport);
     const profile = (0, system_profile_js_1.getProfile)();

package/dist/security-policy.js

@@ -11,6 +11,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getToolRisk = getToolRisk;
+exports.validateToolRiskMap = validateToolRiskMap;
 exports.loadPolicy = loadPolicy;
 exports.checkToolAccess = checkToolAccess;
 exports.getEffectiveMaxRows = getEffectiveMaxRows;
@@ -23,7 +24,7 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 /**
  * Mapa de cada tool para seu nível de risco.
- * Tools não listadas aqui são consideradas READ (safe by default).
+ * TODA tool registrada DEVE estar neste mapa — tools não classificadas causam erro no startup.
  */
 const TOOL_RISK = {
     // READ — sem guard extra (default para tools não listadas)
@@ -64,7 +65,7 @@ const TOOL_RISK = {
     abap_knowledge: "READ",
     abap_traces: "READ",
     abap_breakpoints: "READ",
-    abapgit_repos: "READ",
+    abap_git_repos: "READ",
     // WRITE — modifica objetos existentes
     abap_write: "WRITE",
     abap_activate: "WRITE",
@@ -74,8 +75,8 @@ const TOOL_RISK = {
     abap_publish_binding: "WRITE",
     abap_deploy_bsp: "WRITE",
     abap_assign_transport: "WRITE",
-    abapgit_pull: "WRITE",
-    abapgit_stage: "WRITE",
+    abap_git_pull: "WRITE",
+    abap_git_stage: "WRITE",
     // CREATE — cria objetos novos no SAP
     abap_create: "CREATE",
     abap_create_transport: "CREATE",
@@ -89,9 +90,28 @@ const TOOL_RISK = {
 };
 /**
  * Retorna o nível de risco de uma tool.
+ * Lança erro se a tool não estiver classificada — toda tool DEVE estar no TOOL_RISK map.
  */
 function getToolRisk(toolName) {
-    return TOOL_RISK[toolName] ?? "READ";
+    const risk = TOOL_RISK[toolName];
+    if (!risk) {
+        throw new Error(`[SECURITY] Tool "${toolName}" não está classificada no TOOL_RISK map. `
+            + `Toda tool DEVE ter um nível de risco definido em security-policy.ts antes de ser registrada.`);
+    }
+    return risk;
+}
+/**
+ * Valida que todas as tools fornecidas estão classificadas no TOOL_RISK map.
+ * Deve ser chamada no startup do MCP server, após registrar todas as tools.
+ * Lança erro listando TODAS as tools não classificadas (para corrigir de uma vez).
+ */
+function validateToolRiskMap(registeredToolNames) {
+    const missing = registeredToolNames.filter((name) => !(name in TOOL_RISK));
+    if (missing.length > 0) {
+        throw new Error(`[SECURITY] ${missing.length} tool(s) registrada(s) sem classificação de risco no TOOL_RISK map:\n`
+            + missing.map((t) => `  - ${t}`).join("\n") + "\n"
+            + `Adicione essas tools em src/security-policy.ts antes de continuar.`);
+    }
 }
 // ─── Policies padrão por ambiente ─────────────────────────────────
 const POLICY_DEVELOPMENT = {
@@ -118,7 +138,7 @@ const POLICY_QUALITY = {
         "abap_quick_fix",
         "abap_publish_binding",
         "abap_deploy_bsp",
-        "abapgit_pull",
+        "abap_git_pull",
     ],
     require_transport: true,
     max_preview_rows: 100,
@@ -141,8 +161,8 @@ const POLICY_PRODUCTION = {
         "abap_quick_fix",
         "abap_publish_binding",
         "abap_deploy_bsp",
-        "abapgit_pull",
-        "abapgit_stage",
+        "abap_git_pull",
+        "abap_git_stage",
         "abap_assign_transport",
     ],
     require_transport: true,

package/dist/tools/delete.js

@@ -7,39 +7,6 @@ async function abapDeleteObject(input) {
     const name = object_name.toUpperCase();
     const adtPath = (0, adt_client_js_1.resolveAdtPath)(object_type);
     const objectPath = `/${adtPath}/${name}`;
-    const csrf = await (0, adt_client_js_1.ensureSession)();
-    // Lock — obter lockHandle
-    const lockResp = await adt_client_js_1.http.post(objectPath, "", {
-        headers: { "X-CSRF-Token": csrf },
-        params: { _action: "LOCK", accessMode: "MODIFY" },
-        validateStatus: (status) => status < 500,
-        responseType: "text",
-    });
-    const lockData = typeof lockResp.data === "string" ? lockResp.data : "";
-    const handleMatch = lockData.match(/<LOCK_HANDLE>([^<]+)<\/LOCK_HANDLE>/);
-    const lockHandle = handleMatch?.[1] ?? "";
-    if (!lockHandle) {
-        throw new Error(`Falha ao obter lock para ${name}. O objeto pode estar bloqueado por outro usuário.`);
-    }
-    // Delete com lockHandle
-    const params = { lockHandle };
-    if (transport_request)
-        params.corrNr = transport_request;
-    const delResp = await adt_client_js_1.http.delete(objectPath, {
-        headers: { "X-CSRF-Token": csrf },
-        params,
-        validateStatus: (status) => status < 500,
-    });
-    if (delResp.status >= 400) {
-        // Unlock em caso de erro
-        await adt_client_js_1.http.post(objectPath, "", {
-            headers: { "X-CSRF-Token": csrf },
-            params: { _action: "UNLOCK" },
-            validateStatus: () => true,
-        });
-        const data = typeof delResp.data === "string" ? delResp.data : "";
-        const msg = data.match(/<message[^>]*>([^<]+)<\/message>/i)?.[1] ?? `HTTP ${delResp.status}`;
-        throw new Error(`Erro ao excluir ${name}: ${msg}`);
-    }
+    await (0, adt_client_js_1.adtLockAndDelete)(objectPath, transport_request);
     return `Objeto ${name} (${object_type}) excluído com sucesso.`;
 }

package/dist/tools/system-info.js

@@ -61,8 +61,8 @@ async function abapSystemInfo() {
     // Detectar tipo do sistema
     const systemType = detectSystemType(discoveryXml, sapBasisVersion, abapPlatform);
     results.push(`System Type: ${systemType}`);
-    // Detectar release S/4HANA
-    const release = detectRelease(sapBasisVersion);
+    // Detectar release (depende do tipo: S/4HANA release vs ECC EHP)
+    const release = detectRelease(sapBasisVersion, systemType);
     results.push(`Release: ${release}`);
     // 3. Probe ETag behavior
     const etagQuirk = await probeEtagBehavior();
@@ -237,35 +237,74 @@ function detectSystemType(discoveryXml, basisVersion, platform) {
     if (bv < 750)
         return "ON_PREMISE_ECC";
     // BASIS 750+: distinguir S/4HANA de ECC EHP8 (ambos têm BASIS 750)
-    // S/4HANA sempre inclui collections RAP/Service no discovery XML.
-    // ECC 750 NÃO tem esses endpoints — essa é a diferença chave.
+    //
+    // Heurísticas (em ordem de confiança):
+    //
+    // 1. productName no discovery XML — S/4HANA systems incluem "S/4" ou "SAP S/4HANA"
+    //    ECC nunca inclui isso.
+    const productName = extractAttr(discoveryXml, "productName") ||
+        extractBetween(discoveryXml, "<productName>", "</productName>");
+    if (productName) {
+        if (/s.?4.?hana/i.test(productName))
+            return "ON_PREMISE_S4";
+        if (/ecc|erp/i.test(productName))
+            return "ON_PREMISE_ECC";
+    }
+    // 2. BASIS >= 751 é SEMPRE S/4HANA (ECC parou no 750 com EHP8)
+    if (bv >= 751)
+        return "ON_PREMISE_S4";
+    // 3. BASIS 750: pode ser S/4HANA 1511 ou ECC EHP8.
+    //    S/4HANA 1511+ inclui collections de RAP/Service Bindings que ECC não tem.
     const hasS4Collections = discoveryXml.includes("behaviordefinitions") ||
         discoveryXml.includes("ServiceBindings") ||
         discoveryXml.includes("ddic/srvd/sources");
     if (hasS4Collections)
         return "ON_PREMISE_S4";
-    // BASIS 750 sem collections S/4 = ECC EHP8
+    // BASIS 750 sem indicadores S/4 = ECC EHP8
     return "ON_PREMISE_ECC";
 }
-function detectRelease(basisVersion) {
+function detectRelease(basisVersion, systemType) {
     const bv = parseInt(basisVersion, 10) || 0;
-    if (bv >= 758)
-        return "2023";
-    if (bv >= 757)
-        return "2022";
-    if (bv >= 756)
-        return "2021";
-    if (bv >= 755)
-        return "2020";
-    if (bv >= 754)
-        return "1909";
-    if (bv >= 753)
-        return "1809";
-    if (bv >= 752)
-        return "1709";
-    if (bv >= 751)
-        return "1610";
-    if (bv >= 750)
-        return "1511";
-    return basisVersion;
+    // S/4HANA releases (BASIS → S/4HANA version)
+    if (systemType === "ON_PREMISE_S4") {
+        if (bv >= 758)
+            return "S/4HANA 2023";
+        if (bv >= 757)
+            return "S/4HANA 2022";
+        if (bv >= 756)
+            return "S/4HANA 2021";
+        if (bv >= 755)
+            return "S/4HANA 2020";
+        if (bv >= 754)
+            return "S/4HANA 1909";
+        if (bv >= 753)
+            return "S/4HANA 1809";
+        if (bv >= 752)
+            return "S/4HANA 1709";
+        if (bv >= 751)
+            return "S/4HANA 1610";
+        if (bv >= 750)
+            return "S/4HANA 1511";
+        return `S/4HANA (BASIS ${basisVersion})`;
+    }
+    // ECC releases (BASIS → EHP)
+    if (systemType === "ON_PREMISE_ECC") {
+        if (bv >= 750)
+            return "ECC EHP8 (BASIS 750)";
+        if (bv >= 749)
+            return "ECC EHP7 (BASIS 749)";
+        if (bv >= 748)
+            return "ECC EHP6 (BASIS 748)";
+        if (bv >= 740)
+            return "ECC EHP5 (BASIS 740)";
+        if (bv >= 731)
+            return "ECC EHP4 (BASIS 731)";
+        if (bv >= 730)
+            return "ECC (BASIS 730)";
+        return `ECC (BASIS ${basisVersion})`;
+    }
+    // BTP / BW / outros
+    if (systemType === "BTP_ABAP_ENV")
+        return `BTP ABAP ${basisVersion}`;
+    return `BASIS ${basisVersion}`;
 }

package/dist/tools/transports.js

@@ -45,24 +45,53 @@ async function abapAssignTransport(input) {
     const adtPath = (0, adt_client_js_1.resolveAdtPath)(object_type);
     const objectUri = `/sap/bc/adt/${adtPath}/${object_name.toUpperCase()}`;
     const csrf = await (0, adt_client_js_1.ensureSession)();
+    // Endpoint correto: POST /cts/transportchecks com o URI do objeto
+    // Retorna os transportes candidatos. Se transport_request é fornecido,
+    // passamos como corrNr para atribuição direta.
+    //
+    // Ref: ADT CTS API — transportchecks aceita POST com objectReference
+    // e corrNr como query param para atribuição.
     const payload = `<?xml version="1.0" encoding="UTF-8"?>
 <tm:root xmlns:tm="http://www.sap.com/cts/adt/tm" xmlns:adtcore="http://www.sap.com/adt/core">
-  <tm:workbenchObjects>
-    <tm:abapObject>
-      <adtcore:objectReference adtcore:uri="${objectUri}" adtcore:type="${object_type}" adtcore:name="${object_name.toUpperCase()}"/>
-    </tm:abapObject>
-  </tm:workbenchObjects>
+  <tm:workbenchRequest>
+    <tm:abapObjects>
+      <tm:abapObject tm:pgmid="R3TR" tm:type="${object_type.split("/")[0]}" tm:name="${object_name.toUpperCase()}"
+        adtcore:uri="${objectUri}" adtcore:type="${object_type}" adtcore:name="${object_name.toUpperCase()}"/>
+    </tm:abapObjects>
+  </tm:workbenchRequest>
 </tm:root>`;
-    const response = await adt_client_js_1.http.put(`/cts/transportrequests/${transport_request}/tasks/objects`, payload, {
+    const response = await adt_client_js_1.http.post("/cts/transportchecks", payload, {
         headers: {
-            "Content-Type": "application/xml",
+            "Content-Type": "application/vnd.sap.as+xml; charset=UTF-8; dataname=com.sap.adt.transport.service.checkData",
             "X-CSRF-Token": csrf,
+            Accept: "application/vnd.sap.as+xml; charset=UTF-8; dataname=com.sap.adt.transport.service.checkData",
         },
+        params: { corrNr: transport_request },
         validateStatus: (s) => s >= 200 && s < 500,
     });
-    if (response.status === 200 || response.status === 201 || response.status === 204) {
+    if (response.status >= 200 && response.status < 300) {
         return `Objeto ${object_name.toUpperCase()} (${object_type}) vinculado à ordem ${transport_request} com sucesso.`;
     }
+    // Fallback: se transportchecks não aceita corrNr, tentar via lock com corrNr
+    // (padrão ADT — lock do objeto atribui ao transporte automaticamente)
+    if (response.status === 404 || response.status === 400) {
+        const lockResp = await adt_client_js_1.http.post(objectUri, null, {
+            headers: { "X-CSRF-Token": csrf },
+            params: { _action: "LOCK", accessMode: "MODIFY", corrNr: transport_request },
+            validateStatus: (s) => s >= 200 && s < 500,
+        });
+        if (lockResp.status >= 200 && lockResp.status < 300) {
+            // Unlock imediatamente — o lock já atribuiu o objeto ao transporte
+            await adt_client_js_1.http.post(objectUri, null, {
+                headers: { "X-CSRF-Token": csrf },
+                params: { _action: "UNLOCK" },
+                validateStatus: () => true,
+            });
+            return `Objeto ${object_name.toUpperCase()} (${object_type}) vinculado à ordem ${transport_request} via lock/unlock.`;
+        }
+        const lockError = typeof lockResp.data === "string" ? lockResp.data : JSON.stringify(lockResp.data);
+        throw new Error(`Erro ao vincular objeto (lock fallback, HTTP ${lockResp.status}): ${lockError.slice(0, 500)}`);
+    }
     const errorBody = typeof response.data === "string" ? response.data : JSON.stringify(response.data);
     throw new Error(`Erro ao vincular objeto à ordem (HTTP ${response.status}): ${errorBody.slice(0, 500)}`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linkup-ai/abap-ai",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "LKPABAP.ai — AI-powered ABAP development tools for SAP S/4HANA via ADT REST API",
   "main": "dist/index.js",
   "bin": {
@@ -32,7 +32,11 @@
     "start": "node dist/index.js",
     "dev": "tsc --watch",
     "prepublishOnly": "npm run build",
-    "postinstall": "node dist/postinstall.js || true"
+    "postinstall": "node dist/postinstall.js || true",
+    "release:patch": "npm version patch && npm publish",
+    "release:minor": "npm version minor && npm publish",
+    "release:next": "npm version prerelease --preid=next && npm publish --tag next",
+    "promote:next": "npm dist-tag add @linkup-ai/abap-ai@$(node -p \"require('./package.json').version\") latest"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",