@mcp-abap-adt/core 4.8.1 → 4.8.3

package/dist/src/server/tlsUtils.d.ts

@@ -0,0 +1,19 @@
+import * as http from 'node:http';
+import * as https from 'node:https';
+import type { TlsConfig } from '../lib/config/IServerConfig.js';
+/**
+ * Create HTTP or HTTPS server based on TLS configuration.
+ *
+ * When `tls` is provided with cert + key paths, creates an HTTPS server.
+ * Otherwise creates a plain HTTP server.
+ *
+ * @param app - Express application (or any http.RequestListener)
+ * @param tls - Optional TLS configuration with file paths
+ * @returns http.Server or https.Server
+ */
+export declare function createServerListener(app: http.RequestListener, tls?: TlsConfig): http.Server | https.Server;
+/**
+ * Returns the protocol string based on TLS configuration.
+ */
+export declare function getProtocol(tls?: TlsConfig): 'https' | 'http';
+//# sourceMappingURL=tlsUtils.d.ts.map

package/dist/src/server/tlsUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tlsUtils.d.ts","sourceRoot":"","sources":["../../../src/server/tlsUtils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC;AACpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAEhE;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,CAAC,EAAE,SAAS,GACd,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAsB5B;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAE7D"}

package/dist/src/server/tlsUtils.js

@@ -0,0 +1,77 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServerListener = createServerListener;
+exports.getProtocol = getProtocol;
+const fs = __importStar(require("node:fs"));
+const http = __importStar(require("node:http"));
+const https = __importStar(require("node:https"));
+/**
+ * Create HTTP or HTTPS server based on TLS configuration.
+ *
+ * When `tls` is provided with cert + key paths, creates an HTTPS server.
+ * Otherwise creates a plain HTTP server.
+ *
+ * @param app - Express application (or any http.RequestListener)
+ * @param tls - Optional TLS configuration with file paths
+ * @returns http.Server or https.Server
+ */
+function createServerListener(app, tls) {
+    if (!tls) {
+        return http.createServer(app);
+    }
+    if (!fs.existsSync(tls.cert)) {
+        throw new Error(`TLS cert file not found: ${tls.cert}`);
+    }
+    if (!fs.existsSync(tls.key)) {
+        throw new Error(`TLS key file not found: ${tls.key}`);
+    }
+    if (tls.ca && !fs.existsSync(tls.ca)) {
+        throw new Error(`TLS CA file not found: ${tls.ca}`);
+    }
+    const tlsOptions = {
+        cert: fs.readFileSync(tls.cert),
+        key: fs.readFileSync(tls.key),
+        ...(tls.ca && { ca: fs.readFileSync(tls.ca) }),
+    };
+    return https.createServer(tlsOptions, app);
+}
+/**
+ * Returns the protocol string based on TLS configuration.
+ */
+function getProtocol(tls) {
+    return tls ? 'https' : 'http';
+}
+//# sourceMappingURL=tlsUtils.js.map

package/dist/src/server/tlsUtils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tlsUtils.js","sourceRoot":"","sources":["../../../src/server/tlsUtils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,oDAyBC;AAKD,kCAEC;AA/CD,4CAA8B;AAC9B,gDAAkC;AAClC,kDAAoC;AAGpC;;;;;;;;;GASG;AACH,SAAgB,oBAAoB,CAClC,GAAyB,EACzB,GAAe;IAEf,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,UAAU,GAAwB;QACtC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAC/B,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QAC7B,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;KAC/C,CAAC;IAEF,OAAO,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED;;GAEG;AACH,SAAgB,WAAW,CAAC,GAAe;IACzC,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;AAChC,CAAC"}

package/dist/src/utils/StdioLogger.d.ts

@@ -0,0 +1,17 @@
+/**
+ * StdioLogger - minimal logger for stdio transport
+ *
+ * Only writes errors to stderr, all other log levels are no-ops
+ * This is required because MCP protocol over stdio requires only JSON-RPC messages on stdout
+ */
+/**
+ * Minimal logger for stdio transport
+ * Only errors are written to stderr, all other methods are no-ops
+ */
+export declare class StdioLogger {
+    info(_message: string, ..._args: any[]): void;
+    error(message: string, ...args: any[]): void;
+    warn(_message: string, ..._args: any[]): void;
+    debug(_message: string, ..._args: any[]): void;
+}
+//# sourceMappingURL=StdioLogger.d.ts.map

package/dist/src/utils/StdioLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"StdioLogger.d.ts","sourceRoot":"","sources":["../../../src/utils/StdioLogger.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;GAGG;AACH,qBAAa,WAAW;IACtB,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI;IAI7C,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI;IAS5C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI;IAI7C,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI;CAG/C"}

package/dist/src/utils/StdioLogger.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * StdioLogger - minimal logger for stdio transport
+ *
+ * Only writes errors to stderr, all other log levels are no-ops
+ * This is required because MCP protocol over stdio requires only JSON-RPC messages on stdout
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StdioLogger = void 0;
+/**
+ * Minimal logger for stdio transport
+ * Only errors are written to stderr, all other methods are no-ops
+ */
+class StdioLogger {
+    info(_message, ..._args) {
+        // No-op for stdio - MCP protocol requires only JSON-RPC messages on stdout
+    }
+    error(message, ...args) {
+        // Write errors to stderr for stdio transport
+        const errorMsg = args.length > 0
+            ? `${message} ${args.map((a) => (a instanceof Error ? a.message : JSON.stringify(a))).join(' ')}`
+            : message;
+        process.stderr.write(`[ERROR] ${errorMsg}\n`);
+    }
+    warn(_message, ..._args) {
+        // No-op for stdio
+    }
+    debug(_message, ..._args) {
+        // No-op for stdio
+    }
+}
+exports.StdioLogger = StdioLogger;
+//# sourceMappingURL=StdioLogger.js.map

package/dist/src/utils/StdioLogger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StdioLogger.js","sourceRoot":"","sources":["../../../src/utils/StdioLogger.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH;;;GAGG;AACH,MAAa,WAAW;IACtB,IAAI,CAAC,QAAgB,EAAE,GAAG,KAAY;QACpC,2EAA2E;IAC7E,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,GAAG,IAAW;QACnC,6CAA6C;QAC7C,MAAM,QAAQ,GACZ,IAAI,CAAC,MAAM,GAAG,CAAC;YACb,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACjG,CAAC,CAAC,OAAO,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,CAAC,QAAgB,EAAE,GAAG,KAAY;QACpC,kBAAkB;IACpB,CAAC;IAED,KAAK,CAAC,QAAgB,EAAE,GAAG,KAAY;QACrC,kBAAkB;IACpB,CAAC;CACF;AArBD,kCAqBC"}

package/dist/src/utils/transportValidation.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Validates transport request requirement based on package name.
+ * If transport_request is not provided, we assume it's a local object and let SAP handle the validation.
+ * No strict validation - if creation fails, SAP will return an error.
+ *
+ * @param packageName - The package name to validate
+ * @param transportRequest - The transport request (optional)
+ * @param superPackage - The super package name (optional, not used for validation)
+ */
+export declare function validateTransportRequest(_packageName: string, _transportRequest: string | undefined, _superPackage?: string): void;
+//# sourceMappingURL=transportValidation.d.ts.map

package/dist/src/utils/transportValidation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportValidation.d.ts","sourceRoot":"","sources":["../../../src/utils/transportValidation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,iBAAiB,EAAE,MAAM,GAAG,SAAS,EACrC,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI,CAIN"}

package/dist/src/utils/transportValidation.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateTransportRequest = validateTransportRequest;
+/**
+ * Validates transport request requirement based on package name.
+ * If transport_request is not provided, we assume it's a local object and let SAP handle the validation.
+ * No strict validation - if creation fails, SAP will return an error.
+ *
+ * @param packageName - The package name to validate
+ * @param transportRequest - The transport request (optional)
+ * @param superPackage - The super package name (optional, not used for validation)
+ */
+function validateTransportRequest(_packageName, _transportRequest, _superPackage) {
+    // No strict validation - if transport_request is missing, we assume local object
+    // SAP will return an error if transport is actually required
+    // This allows flexible creation of both local and transportable objects
+}
+//# sourceMappingURL=transportValidation.js.map

package/dist/src/utils/transportValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transportValidation.js","sourceRoot":"","sources":["../../../src/utils/transportValidation.ts"],"names":[],"mappings":";;AASA,4DAQC;AAjBD;;;;;;;;GAQG;AACH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,iBAAqC,EACrC,aAAsB;IAEtB,iFAAiF;IACjF,6DAA6D;IAC7D,wEAAwE;AAC1E,CAAC"}

package/docs/development/tests/TESTING_GUIDE.md

@@ -45,7 +45,17 @@ Optional (cloud/BTP, JWT token refresh):
 
 All other values (object names, timeouts, CDS sources, unit test code) have working defaults.
 
-### 3. Run tests
+### 3. Create shared objects (first run only)
+
+Some tests depend on shared SAP objects (tables, CDS views, classes). Create them before running tests for the first time:
+
+```bash
+npm run shared:setup
+```
+
+Verify with `npm run shared:check`. These objects persist across test runs — no need to re-create unless deleted via `npm run shared:teardown`.
+
+### 4. Run tests
 
 ```bash
 # Build first

package/docs/superpowers/plans/2026-04-04-object-version-history.md

@@ -0,0 +1,268 @@
+# Object Version History Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add tools to retrieve object version history and read source code at specific versions, enabling LLM-driven code review of transport request changes.
+
+**Architecture:** New readonly handlers using raw ADT requests to `/sap/bc/adt/vit/` (Version Information Tool) API. Follows the same pattern as `GetTransport` handler — raw HTTP + XML parsing. No changes to `@mcp-abap-adt/adt-clients` package needed initially.
+
+**Tech Stack:** TypeScript, fast-xml-parser, existing ADT connection infrastructure.
+
+**Ref:** GitHub issue #30 — request from external user for code review workflow based on transport changes.
+
+---
+
+## Pre-requisite: Research VIT API
+
+> **BLOCKER** — This task must be completed before any implementation begins.
+
+### Task 0: Discover and document VIT API endpoints on a real SAP system
+
+The ADT Version Information Tool (`/sap/bc/adt/vit/`) API is not yet used in this project. Before implementing handlers, we need to discover the exact endpoints, parameters, headers, and response formats.
+
+**Research steps:**
+
+- [ ] **Step 1: Test VIT discovery endpoint**
+
+  Try the global ADT discovery and VIT-specific endpoints:
+  ```
+  GET /sap/bc/adt/discovery
+  Accept: application/xml
+  ```
+  Grep the response for "vit" or "version" to find relevant capabilities.
+
+  Then try the VIT-specific discovery:
+  ```
+  GET /sap/bc/adt/vit/
+  Accept: application/xml
+  ```
+  Document both responses — they should list available operations and schemas.
+
+- [ ] **Step 2: Get version list for a known program**
+
+  Try retrieving version history for a known ABAP object:
+  ```
+  GET /sap/bc/adt/vit/wb/PROG/S/{program_name}
+  Accept: application/xml
+  ```
+  Variations to try:
+  - `/sap/bc/adt/vit/wb/object_type/object_name`
+  - Query params: `?dateFrom=...&dateTo=...`
+  - Different Accept headers: `application/atom+xml`, `application/vnd.sap.adt.vit.v1+xml`
+
+- [ ] **Step 3: Get source code at a specific version**
+
+  Once version IDs are known from Step 2, check if the VIT response contains URIs/links to version content. Try following those URIs directly.
+
+  If no URIs in response, try speculative endpoints (these are guesses, may not work):
+  ```
+  GET /sap/bc/adt/programs/programs/{name}/source/main?version={version_id}
+  GET /sap/bc/adt/vit/wb/PROG/S/{name}/content?versionId={id}
+  ```
+
+- [ ] **Step 4: Test on Cloud system (if available)**
+
+  Repeat Steps 1-3 on BTP ABAP Cloud to check if VIT API is available and what differs.
+  If no cloud system is available, default `available_in` to `['onprem']` only — do not ship `'cloud'` without verification.
+
+- [ ] **Step 5: Test for different object types**
+
+  Check VIT availability for: CLAS (class), INTF (interface), FUGR (function group), TABL (table), DDLS (CDS view).
+  Document which types support versioning.
+
+- [ ] **Step 6: Document findings**
+
+  Create `docs/development/research/vit-api.md` with:
+  - Exact URLs, headers, query params
+  - Response XML structure (sample responses)
+  - Supported object types
+  - Cloud vs On-Prem differences
+  - Any limitations found
+
+**Exit criteria:** We have documented, working API calls for at least program version history + version source retrieval on one system.
+
+---
+
+## Task 1: Implement `GetObjectVersions` handler
+
+> **Depends on:** Task 0 completed with successful API discovery.
+
+**Files:**
+- Create: `src/handlers/version/readonly/handleGetObjectVersions.ts`
+- Modify: `src/lib/handlers/groups/ReadOnlyHandlersGroup.ts` (add registration)
+
+- [ ] **Step 1: Create handler file with TOOL_DEFINITION**
+
+  ```typescript
+  export const TOOL_DEFINITION = {
+    name: 'GetObjectVersions',
+    available_in: ['onprem', 'cloud'] as const,  // adjust based on Task 0 findings
+    description: '[read-only] Get version history of an ABAP object. Returns list of versions with date, author, transport request, and version ID.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        object_type: {
+          type: 'string',
+          description: 'ABAP object type (e.g., PROG, CLAS, INTF, FUGR)',
+        },
+        object_name: {
+          type: 'string',
+          description: 'ABAP object name',
+        },
+      },
+      required: ['object_type', 'object_name'],
+    },
+  } as const;
+  ```
+
+  **Note:** Exact URL, headers, and XML parsing logic depend on Task 0 findings. The handler will use `makeAdtRequestWithTimeout()` for raw ADT requests and `fast-xml-parser` for response parsing (same pattern as `handleGetTransport.ts`). Use `return_response()` for responses (not raw `{ isError, content }`).
+
+  **Note:** `object_type` values may need mapping from user-friendly names (PROG, CLAS) to VIT-internal identifiers (e.g., PROG/S, CLAS/I). Add mapping if Task 0 reveals this.
+
+- [ ] **Step 2: Implement XML parsing for VIT response**
+
+  Parse version list from VIT XML response. Expected output per version:
+  ```json
+  {
+    "version_id": "...",
+    "date": "2026-04-01T10:30:00Z",
+    "author": "DEVELOPER",
+    "transport_request": "E19K905941",
+    "description": "..."
+  }
+  ```
+
+- [ ] **Step 3: Implement main handler function**
+
+  Follow `handleGetTransport.ts` pattern — raw request, XML parse, return_response.
+
+- [ ] **Step 4: Register handler in ReadOnlyHandlersGroup**
+
+  Import and add to `getHandlers()` array.
+
+- [ ] **Step 5: Test manually against real system**
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add src/handlers/version/readonly/handleGetObjectVersions.ts src/lib/handlers/groups/ReadOnlyHandlersGroup.ts
+  git commit -m "feat: add GetObjectVersions tool for object version history"
+  ```
+
+---
+
+## Task 2: Implement `ReadObjectVersion` handler
+
+> **Depends on:** Task 0 (to know how to fetch source at version). Independent from Task 1 — can be implemented in parallel.
+
+**Files:**
+- Create: `src/handlers/version/readonly/handleReadObjectVersion.ts`
+- Modify: `src/lib/handlers/groups/ReadOnlyHandlersGroup.ts` (add registration)
+
+- [ ] **Step 1: Create handler with TOOL_DEFINITION**
+
+  ```typescript
+  export const TOOL_DEFINITION = {
+    name: 'ReadObjectVersion',
+    available_in: ['onprem', 'cloud'] as const,  // adjust based on Task 0
+    description: '[read-only] Read source code of an ABAP object at a specific version. Use GetObjectVersions first to get available version IDs.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        object_type: {
+          type: 'string',
+          description: 'ABAP object type (e.g., PROG, CLAS, INTF)',
+        },
+        object_name: {
+          type: 'string',
+          description: 'ABAP object name',
+        },
+        version_id: {
+          type: 'string',
+          description: 'Version ID from GetObjectVersions response',
+        },
+      },
+      required: ['object_type', 'object_name', 'version_id'],
+    },
+  } as const;
+  ```
+
+- [ ] **Step 2: Implement handler**
+
+  Fetch source code at specific version via ADT API (exact endpoint from Task 0).
+
+- [ ] **Step 3: Register in ReadOnlyHandlersGroup**
+
+- [ ] **Step 4: Test manually against real system**
+
+- [ ] **Step 5: Commit**
+
+  ```bash
+  git add src/handlers/version/readonly/handleReadObjectVersion.ts src/lib/handlers/groups/ReadOnlyHandlersGroup.ts
+  git commit -m "feat: add ReadObjectVersion tool for reading source at specific version"
+  ```
+
+---
+
+## Task 3: Integration tests
+
+> **Depends on:** Tasks 1 and 2 implemented and manually verified.
+
+**Files:**
+- Create: `src/__tests__/integration/readOnly/version/GetObjectVersionsHandlers.test.ts`
+- Create: `src/__tests__/integration/readOnly/version/ReadObjectVersionHandlers.test.ts`
+- Modify: `tests/test-config.yaml.template` (add version test config section)
+
+- [ ] **Step 1: Add test config section to template**
+
+  Add to `test-config.yaml.template`:
+  ```yaml
+  version_history:
+    # Object with known version history for testing
+    test_object_type: "PROG"
+    test_object_name: "ZMCP_TEST_PROGRAM"  # ← CHANGE if needed
+    available_in: ['onprem']  # adjust based on Task 0 findings
+  ```
+
+- [ ] **Step 2: Write GetObjectVersions integration test**
+
+  Test that version list is returned with expected fields (version_id, date, author, transport_request).
+
+- [ ] **Step 3: Write ReadObjectVersion integration test**
+
+  Use first version_id from GetObjectVersions result to read source. Verify source code is returned.
+
+- [ ] **Step 4: Write error handling test**
+
+  Test requesting version history for a non-existent object. Verify proper error response (not crash).
+
+- [ ] **Step 5: Run tests, verify pass**
+
+- [ ] **Step 6: Commit**
+
+  ```bash
+  git add src/__tests__/integration/readOnly/version/ tests/test-config.yaml.template
+  git commit -m "test: add integration tests for version history tools"
+  ```
+
+---
+
+## Task 4 (Optional, future): Diff tool
+
+> **Deferred.** LLM can compare two versions by calling `ReadObjectVersion` twice. A dedicated diff tool may be added later if needed for performance (large objects, token cost).
+
+If implemented, it would either:
+- **Server-side diff**: Use ADT compare endpoint (if available, check in Task 0)
+- **Client-side diff**: Read two versions, compute unified diff in Node.js
+
+---
+
+## Summary
+
+| Task | Description | Blocker |
+|------|-------------|---------|
+| **Task 0** | Research VIT API on real system | **BLOCKER — do first** |
+| **Task 1** | `GetObjectVersions` handler | Task 0 |
+| **Task 2** | `ReadObjectVersion` handler | Task 0 (parallel with Task 1) |
+| **Task 3** | Integration tests | Tasks 1, 2 |
+| **Task 4** | Diff tool (optional, deferred) | Tasks 1, 2 |

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcp-abap-adt/core",
   "mcpName": "io.github.fr0ster/mcp-abap-adt",
-  "version": "4.8.1",
+  "version": "4.8.3",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -112,19 +112,19 @@
     "url": "git+https://github.com/fr0ster/mcp-abap-adt.git"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.4.6",
+    "@biomejs/biome": "^2.4.10",
     "@modelcontextprotocol/inspector": "^0.21.1",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.3.5",
+    "@types/node": "^25.5.2",
     "commander": "^14.0.3",
     "cors": "^2.8.6",
-    "dotenv": "^17.3.1",
+    "dotenv": "^17.4.0",
     "express": "^5.1.0",
-    "express-rate-limit": "^8.3.0",
+    "express-rate-limit": "^8.3.2",
     "husky": "^9.1.7",
-    "jest": "^30.2.0",
-    "jest-util": "^30.2.0",
+    "jest": "^30.3.0",
+    "jest-util": "^30.3.0",
     "lint-staged": "^16.4.0",
     "open": "^11.0.0",
     "pino": "^10.3.0",
@@ -132,21 +132,21 @@
     "serve-handler": "^6.1.7",
     "ts-jest": "^29.2.0",
     "tsx": "^4.21.0",
-    "typescript": "^5.9.2",
+    "typescript": "^6.0.2",
     "yaml": "^2.8.1"
   },
   "dependencies": {
-    "@mcp-abap-adt/adt-clients": "^3.14.1",
+    "@mcp-abap-adt/adt-clients": "^3.14.4",
     "@mcp-abap-adt/auth-broker": "^1.0.5",
     "@mcp-abap-adt/auth-providers": "^1.0.5",
     "@mcp-abap-adt/auth-stores": "^1.0.4",
     "@mcp-abap-adt/connection": "^1.5.0",
     "@mcp-abap-adt/header-validator": "^0.1.8",
-    "@mcp-abap-adt/interfaces": "^3.1.0",
+    "@mcp-abap-adt/interfaces": "^5.0.0",
     "@mcp-abap-adt/logger": "^0.1.4",
-    "@modelcontextprotocol/sdk": "^1.27.1",
-    "axios": "^1.13.6",
-    "fast-xml-parser": "^5.4.2",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "axios": "^1.14.0",
+    "fast-xml-parser": "^5.5.10",
     "js-yaml": "^4.1.1",
     "pino": "^10.1.0",
     "pino-pretty": "^13.1.3",