@cspeach/sap-client

SAP development client with safe write/activate lifecycle. Used by CSPeach — AI-powered ABAP development.

Status: v0.1.0 — first public release on npm (2026-05-13). Proprietary; see LICENSE for terms. Free to use under your active CSPeach plan; not free to redistribute or fork. See DECISIONS.md for the design boundary against cspeach-cli.

Features

• Full SAP REST coverage: programs, classes, interfaces, CDS views, behavior definitions, service definitions/bindings, tables, message classes, transports.
• Proper lock → PUT → unlock lifecycle with 423 recovery.
• HTTP/1.1 forced. TLS verification ON by default — trust a customer's internal/corporate CA via caCertPath/caCert (verification stays on); explicit dev-only insecureSkipTlsVerify disables it with a loud warning. Legacy sslVerify: false is still accepted (mapped to insecure + warns).
• Request serialization via a per-connection mutex (prevents cookie/CSRF races).
• Snapshot + audit-log hooks built in; opt into them via the safety/ exports.

Installation

npm install @cspeach/sap-client

Used internally by @cspeach/cli. Direct dependency only if you're building tooling against SAP REST and want the lock/write/unlock lifecycle.

Requires Node.js 20+.

Quick start

import { SapConnection, AdtClient } from '@cspeach/sap-client';

// Constructor takes 3 positional args: (config, username, password)
const conn = new SapConnection(
  {
    host: '172.16.24.98',
    port: 44300,
    client: '100',
    useSsl: true,
    // TLS verification is ON by default. For self-signed / internal-CA SAP
    // systems, trust the CA instead of disabling verification:
    caCertPath: '/etc/ssl/corp-ca.pem',   // adds the CA, keeps verification ON
    // Dev-only escape hatch (NEVER production) — disables verification and
    // logs a loud warning on connect:
    // insecureSkipTlsVerify: true,
    credentialRef: 'my-sap-alias',
    authType: 'basic',
  },
  'S.LAEEQ',
  process.env.SAP_PASSWORD!,
);

const adt = new AdtClient(conn);
// getSource takes (type, name) — type first
const source = await adt.getSource('CLAS', 'ZCL_FOO');
console.log(source);

API surface

See the index.ts exports. Core classes:

• SapConnection — low-level SAP REST HTTPS transport
• AdtClient — high-level operations: getSource, setSource, activate, lock, unlock, atcRun, transport management, etc.

Safety modules:

• snapshots — take/restore source snapshots before writes
• auditLog — append-only operation log
• rollback — restore a named object to a snapshot state

License

Proprietary. Copyright (c) 2026 Cremencing Solutions. All rights reserved. Free to use under your active CSPeach plan; not free to redistribute, fork, or sublicense. Commercial / OEM licensing: [email protected].