sap-ai-dev-toolkit 0.9.9912 → 0.9.9913

package/.github/agents/abap-developer.agent.md

@@ -24,7 +24,7 @@ You are an ABAP development agent for SAP Business Application Studio (BAS). Fol
    - **Clean Core:** `PlanABAPCloudMigration` to batch-check release-state evidence for relevant ADT object URIs. Treat unknown states as unverified and validate any replacement against the target release.
    Tool modes and system capabilities vary. Do not infer tool availability from this map or static documentation.
 
-   Use `GetStructure`, `GetTypeInfo`, and `GetMessages` for read-only DDIC shape, ABAP type, and SE91 message-text inspection. Use `CreatePackage` only when a new package is required and explicitly approved; transportable packages need a known software component and explicit transport. For transparent DDIC persistence, use `CreateTable`; it creates, writes generated DDL, and activates in one call. Neither tool creates authorization objects.
+   Use `GetStructure`, `GetTypeInfo`, and `GetMessages` for read-only DDIC shape, ABAP type, and SE91 message-text inspection. Use `CreatePackage` only when a new package is required and explicitly approved; transportable packages need a known software component and explicit transport. For transparent DDIC persistence, use `CreateTable`; it creates, writes generated DDL, and activates in one call. For existing Z/Y tables, use `UpdateTable` with reviewed current DDL and exact confirmation. Use `DeleteEmptyDDLS` only for a blank Z/Y DDLS shell after verifying it is empty; generic `DeleteObject` remains hidden. Neither creator creates authorization objects.
 
 4. **Use test-driven development.** ABAP code changes require a real test plan. Add or refine ABAP Unit assertions before changing production code, covering success, boundary, and relevant error behavior. Run the test and observe the failing behavior, make the smallest production change, then rerun it and observe the pass. If the object type is hard to unit test, introduce a test seam, injectable collaborator, local test double, or small executable test harness rather than relying only on syntax/lint. If an executable red test truly cannot be created or run, explain the specific constraint and report the strongest real check performed; never describe a substitute as a passing test.
 5. **Author locally first; check and lint before sending to SAP.** Create or change sources in the workspace as plain source files named `object.type.extension` (for example `zcl_report.clas.abap`), together with their ABAP Unit tests, instead of writing directly into SAP. Author only the plain source files; do not generate XML or other object-metadata sidecar files. Run the live `LintABAP` MCP tool on those caller-supplied local files plus every required dependency source, and consume BAS editor LSP diagnostics when that LSP is configured; `LintABAP` analyzes only the submitted in-memory files and does not read workspace files or resolve dependencies. Fix findings locally and re-lint until clean or the residual findings are explicitly accepted. Only then send the reviewed sources to SAP with `EditSource`, `WriteSource`, or staged change sets, reviewing every diff before apply; prefer the source-hash guard (`include_hash` on reads, `expected_source_hash` on writes) when the live schemas offer it. Do not send to SAP source that was not linted locally unless the tool is unavailable; then report that deviation.

package/.github/skills/abap-development/SKILL.md

@@ -11,7 +11,7 @@ description: Implement or change ABAP programs, classes, interfaces, function gr
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Locate objects and usages with `SearchObject`, `GrepObjects`, and `GrepPackages`; read with `GetSource` and `GetContext`; trace callers or dependencies with `FindDefinition` and `FindReferences`; compare workspace and SAP versions with `CompareSource`. Use `EditSource` for a localized change and `WriteSource` for a larger rewrite. Format with `PrettyPrint`; lint caller-supplied source with `LintABAP`; validate with `SyntaxCheck` and `RunUnitTests`, plus `RunATCCheck` when exposed and relevant. For Clean Core requirements, use `GetAPIReleaseState` on each relevant dependency. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.
 
-Use `GetStructure`, `GetTypeInfo`, and `GetMessages` for read-only DDIC shape, ABAP type, and SE91 text inspection. If a new package is required, use live `CreatePackage` only with explicit approval; a transportable package requires its software component and transport. For transparent DDIC persistence, use `CreateTable`, not `CreateObject`; it creates the table, writes generated DDL, and activates in one SAP call. Neither creator supports authorization objects; transport release/deletion is unavailable through this addon.
+Use `GetStructure`, `GetTypeInfo`, and `GetMessages` for read-only DDIC shape, ABAP type, and SE91 text inspection. If a new package is required, use live `CreatePackage` only with explicit approval; a transportable package requires its software component and transport. For transparent DDIC persistence, use `CreateTable`, not `CreateObject`; it creates the table, writes generated DDL, and activates in one SAP call. For an existing Z/Y table, `UpdateTable` compares the reviewed DDL and uses a hash-guarded locked update; it requires exact confirmation. `DeleteEmptyDDLS` only deletes blank Z/Y DDLS shells after checking source and exact confirmation; generic `DeleteObject` remains hidden. Neither creator supports authorization objects; transport release/deletion is unavailable through this addon.
 
 ## Release compatibility and Clean ABAP naming
 

package/.github/skills/cds-development/SKILL.md

@@ -11,7 +11,7 @@ description: Implement, change, or analyze ABAP CDS data definitions and their d
 
 Query the active MCP server's live `tools/list` once; use task-relevant tools with their returned schemas. Locate views and usages with `SearchObject` and `GrepObjects`; read DDLS with `GetSource`; compare workspace and SAP versions with `CompareSource`; use `GetCDSDependencies` for upstream dependencies, `GetCDSImpactAnalysis` for consumers, and `GetCDSElementInfo` for element metadata. Trace references with `FindReferences`; edit via `EditSource` / `WriteSource`. Validate with `SyntaxCheck`, `RunATCCheck`, activation via `Activate` / `ActivateMultiple`, and read-only runtime queries via `RunQuery` or `GetTableContents` when exposed. Tool names shown in PascalCase (such as `GetSource` or `LintABAP`) are logical names; the live MCP surface exposes them as lowercase snake_case. A server scoped to a single destination (the normal case for generated `mcp.json` entries) exposes them unprefixed, so `GetSource` appears as `get_source` and `LintABAP` as `lint_abap`; when several destinations share one server, each name is destination-prefixed with its slug for disambiguation (for example `cfd_run_query`). Always call the exact names returned by `tools/list`.
 
-Use `GetStructure` and `GetTypeInfo` to inspect DDIC-backed structure and type metadata when resolving CDS field dependencies. If a new package is needed, `CreatePackage` is state-changing: require explicit approval, and provide a software component plus transport for a transportable package. For a new transparent DDIC table backing a CDS entity, use `CreateTable`; it is not for CDS views, writes generated DDL, and activates in one SAP call. Authorization-object creation and transport release/deletion are unavailable through this addon.
+Use `GetStructure` and `GetTypeInfo` to inspect DDIC-backed structure and type metadata when resolving CDS field dependencies. If a new package is needed, `CreatePackage` is state-changing: require explicit approval, and provide a software component plus transport for a transportable package. For a new transparent DDIC table backing a CDS entity, use `CreateTable`; it is not for CDS views, writes generated DDL, and activates in one SAP call. `UpdateTable` is limited to existing Z/Y DDIC tables; it is not a CDS-view editor. `DeleteEmptyDDLS` only removes a blank Z/Y DDLS shell after exact confirmation. Authorization-object creation and transport release/deletion are unavailable through this addon.
 
 ## Language level and naming
 

package/README.md

@@ -608,6 +608,8 @@ These local tools are namespaced by destination. Change-set tools appear when th
 | --- | --- |
 | `PrepareABAPChangeSet` | Stage up to 12 full-source `WriteSource` changes and return line diffs plus SHA-256 fingerprints. Proposals stay in MCP process memory. |
 | `ApplyABAPChangeSet` | Re-read each object and write only when its source still matches the reviewed version. It stops on conflicts or errors and reports partial application; it does not roll back SAP writes. |
+| `UpdateTable` | Compare the current Z/Y table DDL with reviewed source, then update and activate through VSP's source-hash check under lock. Requires exact confirmation. |
+| `DeleteEmptyDDLS` | Delete only a blank Z/Y DDLS shell after checking its source and requiring exact confirmation; generic `DeleteObject` remains hidden. |
 | `CheckTransportReadiness` | Run a caller-selected bundle of transport, dependency, inactive-object, ABAP Unit, and ATC checks. Completed calls may still contain findings. |
 | `PlanABAPCloudMigration` | Batch `GetAPIReleaseState` checks for ADT object URIs and prioritize recognized unreleased APIs ahead of unknown and released states. SAP evidence stays attached. |
 | `GenerateRAPRegressionSuite` | Read `$metadata` and return reusable JSON with a metadata check and one `$top=1` GET for each entity set. |

package/dist/checksums.txt

@@ -1,5 +1,5 @@
-f10b759b5e320c6fec4c176ef9bce49f783d796eeb8a2476dd5898c94cb14afd  vsp-linux-x64
-a4c47e4c15538cc16b540d19f55771e4c1340389efeca815e1881eafd89e45c5  vsp-linux-arm64
-20a197921c88f539ea1a7f5236509dbaa9b9f906a6333e6fb1dce9f8b5eec85c  vsp-darwin-x64
-24a8810a17d31a434b92957ea41e6347b24e2a6a35e47b3b2fc13a16082a44c3  vsp-darwin-arm64
-b318fdf5194a7f15ebcf7ee912fb2493df21aba337540a2402f81786300fd0ea  vsp-win32-x64.exe
+5a8adb501a30bb4f3c3a1f2c16aee0f60de0be9a226cafbc07191ba955c9269f  vsp-linux-x64
+d7b96b63ec812949e2ab2e223b1fbac5f5a0cd1c6e068e3ddd117d3548c968a2  vsp-linux-arm64
+7328b9fd0ceb60287b53e9d6425e7111c87cdefcec1d412544eb6b1e70f4249c  vsp-darwin-x64
+fb90f7a1b2bdca5fcc7bb8ba5623d6fb1dcbb88de02bba5686acad503f29f84f  vsp-darwin-arm64
+bd33b0a45640700bd26372355b73169632b21fb4c07df33b8cc0b5d7ff5b76e0  vsp-win32-x64.exe

package/inventory.md

@@ -8,12 +8,12 @@ This inventory reflects the current SAP AI Dev Toolkit proxy behavior in `src/mc
 | --- | ---: | --- |
 | Upstream tools | Up to 64 | Curated from the child tool list and exposed in lowercase snake_case, unprefixed (`get_source`) on single-destination servers; a destination slug prefix (`demo-abap_get_source`) appears only when one server fronts multiple destinations. |
 | Local lint tool | 1 per destination | `LintABAP` analyzes caller-supplied ABAP source in memory; it is exposed publicly as `lint_abap`. |
-| Workflow tools | Up to 6 per destination | Review/apply change sets, transport evidence, Clean Core release assessment, and read-only RAP regression suites. Some are exposed only when their upstream capabilities are registered. |
+| Workflow tools | Up to 8 per destination | Review/apply change sets, transport evidence, Clean Core release assessment, RAP regression suites, guarded table updates, and empty-DDLS cleanup. Some require upstream capabilities. |
 | Convenience mapping | Dynamic | `GetApplicationLog` maps to the upstream `SAP(action="analyze", type="application_log")` operation when the SAP router is registered. |
 | Intentionally filtered tools | Dynamic | Destructive, broad-router, trace, and unsupported operations are hidden from direct calls. |
 | Mode-dependent | Dynamic | Focused/expert mode and backend capabilities determine which tools are registered. |
 
-The maximum fixture surface is 72 tools per destination when expert-mode capabilities and all local workflows are available. Multiple selected destinations create separate MCP servers; this add-on cannot inspect VS Code's aggregate tool budget or per-chat tool binding.
+The maximum fixture surface is 74 destination-scoped tools per destination when expert-mode capabilities and all local workflows are available, plus one workspace-scoped `LintABAPProject` tool per MCP server. Multiple selected destinations create separate MCP servers; this add-on cannot inspect VS Code's aggregate tool budget or per-chat tool binding.
 
 ## Known upstream tools
 
@@ -168,6 +168,8 @@ These logical names are exposed through MCP in lowercase snake_case (`lint_abap`
 - `PlanABAPCloudMigration` — batch-check API release state for supplied ADT object URIs and prioritize recognized unreleased APIs.
 - `GenerateRAPRegressionSuite` — read service metadata and emit reusable GET-only smoke cases for entity sets.
 - `RunRAPRegressionSuite` — execute saved cases with status, content-type, and JSON-path assertions over the connected destination.
+- `UpdateTable` — compare the current DDL with the reviewed source, then update and activate one Z/Y table using VSP's locked source-hash check.
+- `DeleteEmptyDDLS` — delete only a blank Z/Y DDLS source after exact confirmation; generic `DeleteObject` remains hidden.
 
 ## Notes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9912",
+  "version": "0.9.9913",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/patches/vsp-bas-proxy-auth.patch

@@ -148,6 +148,23 @@ index 5007935..3b1fdd8 100755
  	cookieFile, _ := cmd.Flags().GetString("cookie-file")
  	cookieString, _ := cmd.Flags().GetString("cookie-string")
  
+diff --git a/internal/mcp/handlers_source.go b/internal/mcp/handlers_source.go
+index d23089b..8e7e5ff 100644
+--- a/internal/mcp/handlers_source.go
++++ b/internal/mcp/handlers_source.go
+@@ -132,10 +132,10 @@ func (s *Server) registerGetSource() {
+ // registerWriteSource registers the unified WriteSource tool
+ func (s *Server) registerWriteSource() {
+ 	s.mcpServer.AddTool(mcp.NewTool("WriteSource",
+-		mcp.WithDescription("Unified tool for writing ABAP source code with automatic create/update detection. Supports PROG, CLAS, INTF, INCL, and RAP types (DDLS, BDEF, SRVD)."),
++		mcp.WithDescription("Unified tool for writing ABAP source code with automatic create/update detection. Supports PROG, CLAS, INTF, INCL, RAP types (DDLS, BDEF, SRVD), and updates to existing DDIC tables (TABL). New tables must be created with CreateTable."),
+ 		mcp.WithString("object_type",
+ 			mcp.Required(),
+-			mcp.Description("Object type: PROG (program), CLAS (class), INTF (interface), INCL (include), DDLS (CDS view), BDEF (behavior definition), SRVD (service definition)"),
++			mcp.Description("Object type: PROG (program), CLAS (class), INTF (interface), INCL (include), DDLS (CDS view), BDEF (behavior definition), SRVD (service definition), or TABL (existing DDIC table update only)"),
+ 		),
+ 		mcp.WithString("name",
+ 			mcp.Required(),
 diff --git a/internal/mcp/server.go b/internal/mcp/server.go
 index 9337857..11fc940 100644
 --- a/internal/mcp/server.go
@@ -290,7 +307,7 @@ index 7740e56..b4c2faf 100755
 +	}
 +}
 diff --git a/internal/mcp/tools_register.go b/internal/mcp/tools_register.go
-index dd433d6..5553b7f 100644
+index dd433d6..d9ea365 100644
 --- a/internal/mcp/tools_register.go
 +++ b/internal/mcp/tools_register.go
 @@ -837,6 +837,19 @@ func (s *Server) registerDevTools(shouldRegister func(string) bool) {
@@ -313,6 +330,24 @@ index dd433d6..5553b7f 100644
  			),
  		), s.handleActivateMultiple)
  	}
+@@ -1070,7 +1083,7 @@ func (s *Server) registerCRUDTools(shouldRegister func(string) bool) {
+ 
+ 	if shouldRegister("CreateTable") {
+ 		s.mcpServer.AddTool(mcp.NewTool("CreateTable",
+-			mcp.WithDescription("Create a DDIC transparent table from a simple JSON definition. Handles full workflow: create → set source → activate. Supports common ABAP types: CHAR, NUMC, INT4, DEC, STRING, TIMESTAMPL, UUID, etc."),
++			mcp.WithDescription("Create a DDIC transparent table from a simple JSON definition. Handles full workflow: create → set source → activate. Supports common ABAP types: CHAR, NUMC, INT4, DEC, STRING, TIMESTAMPL, UUID, etc. Client-dependent tables get one implicit CLIENT key; supplied CLIENT or MANDT fields are treated as that same key."),
+ 			mcp.WithString("name",
+ 				mcp.Required(),
+ 				mcp.Description("Table name (uppercase, max 30 chars, must start with Z/Y)"),
+@@ -1084,7 +1097,7 @@ func (s *Server) registerCRUDTools(shouldRegister func(string) bool) {
+ 			),
+ 			mcp.WithString("fields",
+ 				mcp.Required(),
+-				mcp.Description("JSON array of fields: [{\"name\":\"ID\",\"type\":\"CHAR32\",\"key\":true},{\"name\":\"VALUE\",\"type\":\"STRING\"}]. Types: CHAR/CHARnn, NUMC/NUMCnn, INT4, DEC, STRING, TIMESTAMPL, UUID, DATS, TIMS, or data element name."),
++				mcp.Description("JSON array of user fields: [{\"name\":\"ID\",\"type\":\"CHAR32\",\"key\":true},{\"name\":\"VALUE\",\"type\":\"STRING\"}]. Do not include CLIENT or MANDT; the client key is added automatically. Types: CHAR/CHARnn, NUMC/NUMCnn, INT4, DEC, STRING, TIMESTAMPL, UUID, DATS, TIMS, or data element name."),
+ 			),
+ 			mcp.WithString("transport",
+ 				mcp.Description("Transport request number (optional for $TMP)"),
 diff --git a/pkg/adt/browser_auth.go b/pkg/adt/browser_auth.go
 index ea3c1a9..5bc7a01 100644
 --- a/pkg/adt/browser_auth.go
@@ -436,7 +471,7 @@ index 0000000..1ed3c2b
 +	}
 +}
 diff --git a/pkg/adt/crud.go b/pkg/adt/crud.go
-index f412fb1..15ac38a 100755
+index f412fb1..8021a5a 100755
 --- a/pkg/adt/crud.go
 +++ b/pkg/adt/crud.go
 @@ -1250,7 +1250,12 @@ func (c *Client) publishUnpublishServiceBinding(ctx context.Context, action, ser
@@ -453,6 +488,23 @@ index f412fb1..15ac38a 100755
  
  	resp, err := c.transport.Request(ctx, path, &RequestOptions{
  		Method:      http.MethodPost,
+@@ -1427,11 +1432,15 @@ func generateTableDDL(opts CreateTableOptions) string {
+ 	sb.WriteString("@AbapCatalog.dataMaintenance : #ALLOWED\n")
+ 	sb.WriteString(fmt.Sprintf("define table %s {\n\n", strings.ToLower(opts.Name)))
+ 
+-	// Auto-add MANDT as first key field (standard SAP practice)
++	// The table's implicit client field is named CLIENT in DDL; callers may
++	// provide CLIENT or MANDT, but the schema must contain it only once.
+ 	sb.WriteString("  key client : abap.clnt not null;\n")
+ 
+ 	// User-defined fields
+ 	for _, f := range opts.Fields {
++		if strings.EqualFold(strings.TrimSpace(f.Name), "CLIENT") || strings.EqualFold(strings.TrimSpace(f.Name), "MANDT") {
++			continue
++		}
+ 		fieldName := strings.ToLower(f.Name)
+ 		fieldType := mapFieldType(f)
+ 
 diff --git a/pkg/adt/features.go b/pkg/adt/features.go
 index 13aa4b0..8fb7376 100755
 --- a/pkg/adt/features.go
@@ -620,7 +672,7 @@ index 0000000..5e880bd
 +	}
 +}
 diff --git a/pkg/adt/http.go b/pkg/adt/http.go
-index 0b4d9f1..f0b5b51 100755
+index 0b4d9f1..e420573 100755
 --- a/pkg/adt/http.go
 +++ b/pkg/adt/http.go
 @@ -313,7 +313,7 @@ func (t *Transport) request(ctx context.Context, path string, opts *RequestOptio
@@ -723,7 +775,8 @@ index 0b4d9f1..f0b5b51 100755
 +	}
  	// Drain the body so the connection can be reused.
  	_, _ = io.Copy(io.Discard, resp.Body)
- 	traceHTTPResponse(resp, nil)
+-	traceHTTPResponse(resp, nil)
++	traceHTTPResponse(resp, body)
  	t.adoptServerCookies(resp)
  
 -	return resp.Header.Get("X-CSRF-Token"), resp.StatusCode, t.redirectedAwayFromSAP(resp), nil
@@ -751,10 +804,10 @@ index 0b4d9f1..f0b5b51 100755
  // redirectedAwayFromSAP reports whether a response was ultimately served by
 diff --git a/pkg/adt/http_csrf_discovery_test.go b/pkg/adt/http_csrf_discovery_test.go
 new file mode 100644
-index 0000000..80741da
+index 0000000..ee932b3
 --- /dev/null
 +++ b/pkg/adt/http_csrf_discovery_test.go
-@@ -0,0 +1,56 @@
+@@ -0,0 +1,55 @@
 +package adt
 +
 +import (
@@ -810,7 +863,6 @@ index 0000000..80741da
 +		t.Fatalf("expected both endpoint failures, got %v", err)
 +	}
 +}
-+
 diff --git a/pkg/adt/http_sso_same_host_test.go b/pkg/adt/http_sso_same_host_test.go
 new file mode 100644
 index 0000000..0c39b96
@@ -1290,3 +1342,32 @@ index 0000000..1385d6d
 +		}
 +	}
 +}
+diff --git a/pkg/adt/workflows_source_tabl_test.go b/pkg/adt/workflows_source_tabl_test.go
+index 220e91b..61e1691 100644
+--- a/pkg/adt/workflows_source_tabl_test.go
++++ b/pkg/adt/workflows_source_tabl_test.go
+@@ -44,3 +44,24 @@ func TestCreatingATableFromSourceSaysWhatDoesWork(t *testing.T) {
+ 		t.Errorf("the refusal should name the route that does work, got %q", result.Message)
+ 	}
+ }
++
++func TestCreateTableEmitsOnlyTheAutomaticClientField(t *testing.T) {
++	source := generateTableDDL(CreateTableOptions{
++		Name: "ZADK_SESSION",
++		Fields: []TableField{
++			{Name: "MANDT", Type: "mandt", IsKey: true},
++			{Name: "CLIENT", Type: "abap.clnt", IsKey: true},
++			{Name: "SESSION_ID", Type: "CHAR", Length: 32, IsKey: true},
++		},
++	})
++
++	if got := strings.Count(source, "key client : abap.clnt not null;"); got != 1 {
++		t.Fatalf("got %d client keys, want exactly 1:\n%s", got, source)
++	}
++	if strings.Contains(source, "key mandt :") || strings.Contains(source, "key client : abap.clnt not null;\n  key client :") {
++		t.Fatalf("generated DDL contains a duplicate client field:\n%s", source)
++	}
++	if !strings.Contains(source, "key session_id : abap.char(32) not null;") {
++		t.Fatalf("generated DDL lost the business key:\n%s", source)
++	}
++}

package/src/engineering-tools.mjs

@@ -69,6 +69,30 @@ const TOOLS = {
     ['change_set_id'],
     { readOnlyHint: false, destructiveHint: true, idempotentHint: false }
   ),
+  UpdateTable: textTool(
+    'UpdateTable',
+    'Update and activate an existing Z/Y DDIC table from replacement DDL. The current DDL is re-read and compared with expected_source; VSP checks its source hash again under lock. Requires confirmation exactly equal to UPDATE TABLE <TABLE_NAME>.',
+    {
+      table_name: { type: 'string', minLength: 2, maxLength: 30, pattern: '^[ZzYy][A-Za-z0-9_]{1,29}$' },
+      expected_source: { type: 'string', minLength: 1, maxLength: MAX_CHANGE_BYTES },
+      replacement_source: { type: 'string', minLength: 1, maxLength: MAX_CHANGE_BYTES },
+      transport: { type: 'string', minLength: 1 },
+      confirmation: { type: 'string', minLength: 1, description: 'Must exactly equal UPDATE TABLE <TABLE_NAME>.' }
+    },
+    ['table_name', 'expected_source', 'replacement_source', 'confirmation'],
+    { readOnlyHint: false, destructiveHint: true, idempotentHint: false }
+  ),
+  DeleteEmptyDDLS: textTool(
+    'DeleteEmptyDDLS',
+    'Delete only an empty Z/Y DDLS shell. The source is read first and deletion is refused unless it is blank. Requires confirmation exactly equal to DELETE EMPTY DDLS <OBJECT_NAME>.',
+    {
+      name: { type: 'string', minLength: 2, maxLength: 30, pattern: '^[ZzYy][A-Za-z0-9_]{1,29}$' },
+      transport: { type: 'string', minLength: 1 },
+      confirmation: { type: 'string', minLength: 1, description: 'Must exactly equal DELETE EMPTY DDLS <OBJECT_NAME>.' }
+    },
+    ['name', 'confirmation'],
+    { readOnlyHint: false, destructiveHint: true, idempotentHint: false }
+  ),
   CheckTransportReadiness: textTool(
     'CheckTransportReadiness',
     'Collect a transport request and dependency, inactive-object, ABAP Unit, and ATC evidence bundle. Only registered read/check tools are accepted; inspect findings before handoff.',
@@ -237,6 +261,18 @@ function hashSource(source) {
   return createHash('sha256').update(source).digest('hex');
 }
 
+function adtSourceHash(source) {
+  const canonical = source.replace(/\r\n/g, '\n').replace(/\n+$/g, '');
+  return `sha256:${createHash('sha256').update(canonical).digest('hex')}`;
+}
+
+function customerObjectName(value, label) {
+  if (typeof value !== 'string') throw new Error(`${label} must be a customer object name`);
+  const name = value.trim().toUpperCase();
+  if (!/^[ZY][A-Z0-9_]{1,29}$/.test(name)) throw new Error(`${label} must be a Z/Y customer object name of 2–30 letters, digits, or underscores`);
+  return name;
+}
+
 function containsSource(value, source) {
   if (typeof value === 'string') return value === source;
   if (Array.isArray(value)) return value.some(entry => containsSource(entry, source));
@@ -519,6 +555,75 @@ export function createEngineeringTools(entry, upstreamTools, { env = process.env
     });
   }
 
+  if (available.has('GetTable') && available.has('WriteSource')) {
+    add(TOOLS.UpdateTable, async args => {
+      validateObject(args, 'arguments', ['table_name', 'expected_source', 'replacement_source', 'transport', 'confirmation']);
+      const tableName = customerObjectName(args.table_name, 'table_name');
+      if (args.confirmation !== `UPDATE TABLE ${tableName}`) throw new Error(`confirmation must equal UPDATE TABLE ${tableName}`);
+      for (const [label, source] of [['expected_source', args.expected_source], ['replacement_source', args.replacement_source]]) {
+        if (typeof source !== 'string' || !source) throw new Error(`${label} is required`);
+        if (Buffer.byteLength(source, 'utf8') > MAX_CHANGE_BYTES) throw new Error(`${label} exceeds ${MAX_CHANGE_BYTES} bytes`);
+        if (source.split(/\r?\n/).length > 1000) throw new Error(`${label} exceeds the 1,000-line limit`);
+      }
+      if (args.transport !== undefined && (typeof args.transport !== 'string' || !args.transport.trim())) throw new Error('transport must be a nonempty string when supplied');
+      const tableDefinition = /^\s*define\s+table\s+([A-Z0-9_/]+)/im.exec(args.replacement_source);
+      if (!tableDefinition || tableDefinition[1].toUpperCase() !== tableName) throw new Error(`replacement_source must define table ${tableName}`);
+      const expectedHash = adtSourceHash(args.expected_source);
+      if (expectedHash === adtSourceHash(args.replacement_source)) throw new Error('replacement_source does not change the table DDL');
+
+      const currentResult = await remoteTool(entry, 'GetTable', { table_name: tableName }, available, log);
+      const currentSource = sourceFromResult(currentResult);
+      if (currentSource === undefined) throw new Error(`GetTable did not return source for ${tableName}`);
+      const currentHash = adtSourceHash(currentSource);
+      if (currentHash !== expectedHash) throw new Error(`table source changed since review; re-read ${tableName} and prepare a new update`);
+
+      const writeArguments = {
+        object_type: 'TABL',
+        name: tableName,
+        source: args.replacement_source,
+        mode: 'update',
+        expected_source_hash: currentHash,
+        ...(args.transport ? { transport: args.transport.trim() } : {})
+      };
+      const writeResult = await remoteTool(entry, 'WriteSource', writeArguments, available, log);
+      let writeDetails;
+      try {
+        writeDetails = JSON.parse(resultData(writeResult));
+      } catch {
+        throw new Error(`WriteSource returned an unparseable result for ${tableName}; inspect SAP state before retrying`);
+      }
+      if (!object(writeDetails) || writeDetails.success !== true) throw new Error(`WriteSource did not confirm a successful table update for ${tableName}; inspect SAP state before retrying`);
+      return toolJson({
+        status: 'updated',
+        table_name: tableName,
+        expected_source_hash: currentHash,
+        target_source_hash: adtSourceHash(args.replacement_source),
+        result: writeDetails
+      });
+    });
+  }
+
+  if (available.has('GetSource') && available.has('DeleteObject')) {
+    add(TOOLS.DeleteEmptyDDLS, async args => {
+      validateObject(args, 'arguments', ['name', 'transport', 'confirmation']);
+      const name = customerObjectName(args.name, 'name');
+      if (args.confirmation !== `DELETE EMPTY DDLS ${name}`) throw new Error(`confirmation must equal DELETE EMPTY DDLS ${name}`);
+      if (args.transport !== undefined && (typeof args.transport !== 'string' || !args.transport.trim())) throw new Error('transport must be a nonempty string when supplied');
+
+      const sourceResult = await remoteTool(entry, 'GetSource', { object_type: 'DDLS', name, include_context: false }, available, log);
+      const source = sourceFromResult(sourceResult);
+      if (source === undefined) throw new Error(`GetSource did not return source for DDLS ${name}; refusing deletion`);
+      if (source.trim() !== '') throw new Error(`DDLS ${name} is not empty; refusing deletion`);
+
+      const objectUrl = `/sap/bc/adt/ddic/ddl/sources/${encodeURIComponent(name.toLowerCase())}`;
+      await remoteTool(entry, 'DeleteObject', {
+        object_url: objectUrl,
+        ...(args.transport ? { transport: args.transport.trim() } : {})
+      }, available, log);
+      return toolJson({ status: 'deleted', object_type: 'DDLS', name, object_url: objectUrl });
+    });
+  }
+
   if (available.has('GetTransport')) {
     add(TOOLS.CheckTransportReadiness, async args => {
       validateObject(args, 'arguments', ['transport_id', 'checks']);

package/tools.md

@@ -1,6 +1,6 @@
 # Curated SAP tools exposed through the BAS proxy
 
-The proxy no longer advertises every tool provided by the SAP runtime. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a curated set of upstream tools plus local workflow tools (currently 72 tools when all upstream capabilities are registered).
+The proxy no longer advertises every tool provided by the SAP runtime. To keep the developer-lifecycle MCP surface manageable, each generated one-destination server exposes a curated set of upstream tools plus local workflow tools (up to 75 tools: 74 destination-scoped tools plus one workspace-scoped project-lint tool).
 
 The names below are the logical tool names. Publicly they are exposed in lowercase snake_case without a prefix (`get_table_contents`, `run_query`) because each generated MCP server is scoped to one destination; only when a single server fronts multiple destinations does each name gain its destination slug (`demo-abap_get_table_contents`) to stay unambiguous. BAS/VS Code chat tool references bind only lowercase identifiers, so mixed-case names never reach the model.
 
@@ -73,11 +73,11 @@ Hidden upstream tools are not directly callable through the proxy. Local workflo
 - `UnpublishServiceBinding`
 - `WriteSource`
 
-`CreatePackage` creates a local package or a transportable package with an explicit transport; it changes SAP state and requires explicit approval. `CreateTable` creates a transparent DDIC table, writes its generated DDL source, and activates it. `GetStructure`, `GetTypeInfo`, and `GetMessages` are read-only metadata lookups. The upstream VSP package and transport mutation checks still apply. The pinned backend does not create structures, table types, or authorization objects.
+`CreatePackage` creates a local package or a transportable package with an explicit transport; it changes SAP state and requires explicit approval. `CreateTable` creates a transparent DDIC table, writes its generated DDL source, and activates it. Client-dependent tables already get the implicit `CLIENT` key; supplied `CLIENT` or `MANDT` fields map to that same key and are not emitted twice. `GetStructure`, `GetTypeInfo`, and `GetMessages` are read-only metadata lookups. The upstream VSP package and transport mutation checks still apply. The pinned backend does not create structures, table types, or authorization objects.
 
 ## Hidden from direct proxy calls
 
-Broad/destructive surfaces such as object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
+Broad/destructive surfaces such as generic object deletion, SQL trace, arbitrary SAP router calls, transport release/delete, RFC execution, debugger listen/delete-breakpoint helpers, and one-off generator/update helpers are intentionally not advertised by the BAS proxy. The local `DeleteEmptyDDLS` workflow is a narrow exception: it verifies the source is blank and requires exact confirmation before deleting a Z/Y DDLS shell. UI5 repository writes are hidden too: the ADT filestore only reads UI5 apps, so deploy them with SAP Fiori tools instead.
 
 ## Local and destination-scoped workflow tools
 
@@ -86,6 +86,8 @@ The proxy adds local tools to the MCP surface. Some are workspace-wide; others a
 - `LintABAP` — local in-memory ABAP linting.
 - `LintABAPProject` — scan serialized ABAP objects in the configured workspace root (SAP_AI_DEV_TOOLKIT_WORKSPACE_ROOT, defaulting to the MCP server working directory) using the project abaplint config and available local dependency folders. This is static analysis only; it does not contact SAP or activate objects.
 - `GetApplicationLog` — bounded convenience mapping to the upstream SAP application-log route when available.
+- `UpdateTable` — update and activate an existing Z/Y DDIC table from replacement DDL after comparing expected_source with `GetTable`; the write uses VSP's hash check under lock and requires `UPDATE TABLE <TABLE_NAME>` confirmation.
+- `DeleteEmptyDDLS` — delete only a blank Z/Y DDLS source after an emptiness check and exact `DELETE EMPTY DDLS <OBJECT_NAME>` confirmation. It calls the hidden generic delete operation internally.
 - `PrepareABAPChangeSet` and `ApplyABAPChangeSet` — review full-source diffs and recheck source before explicit writes.
 - `CheckTransportReadiness` — collect a whitelisted bundle of transport, dependency, inactive-object, ABAP Unit, and ATC results.
 - `PlanABAPCloudMigration` — batch SAP API release-state checks and prioritize recognized unreleased results.