/sap-config-compare

name: sap-config-compare
description: |
  Keyed, row-level RFC diff of ONE customizing table or view across two saved
  connection profiles (or two clients of one system) — the shareable answer to
  "it works in QAS but not in DEV/PRD". Resolves the object on both sides, computes
  the compared-field set (drops the technical client key for client-dependent tables,
  excludes unreadable/too-wide columns honestly), guards against an unbounded read,
  does a chunked offset-based read of each side, and runs the ONE shared keyed-diff
  engine to classify every key LEFT_ONLY / RIGHT_ONLY / CHANGED. Claude then translates
  the raw deltas into functional meaning using DDIC texts. Output is a diffable diff.tsv
  + summary, registered for /sap-evidence-pack. Read-only. Prerequisites: two profiles
  via /sap-login (pinned LEFT + --against RIGHT); SAP NCo 3.1 (32-bit). No GUI, no
  Z-object, no dev-init.
argument-hint: "<TABLE|VIEW> --against <profile-hint> [--where \"F=V,F=A..B\"] [--fields F1,F2] [--keys-only] [--max-rows N]"

SAP Config Compare — Cross-System Customizing Diff

You answer **"why does this work there but not here?"** with a keyed, row-level diff of one customizing table/view between two systems (or two clients), read-only over RFC. SCU0/SCMP are GUI-bound and unshareable; two SE16 windows miss rows. This does the join deterministically and narrates the deltas in functional language.

Task: $ARGUMENTS

**You are read-only against BOTH systems.** No confirm gates, no TR, no GUI. All output stays local under `{work_dir}`.

---

Shared Resources

| File | Token / call | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/skill_operating_rules.md` | *(rule)* | Mandatory operating rules — read-only here | | `<SKILL_DIR>/references/sap_config_compare_read.ps1` | `-Object -Against [-Where -Options -Fields -KeysOnly -MaxRows] -OutDir` | Dual-connect, object resolution, metadata, unbounded guard, chunked offset read | | `<SKILL_DIR>/references/sap_config_compare_diff.ps1` | `-LeftTsv -RightTsv -MetaJson -OutDir` | Offline keyed diff (dot-sources the shared engine) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_keyed_diff_lib.ps1` | `%%KEYED_DIFF_LIB_PS1%%` | The ONE keyed row-diff engine (shared with /sap-se16n snapshot diff, /sap-compare) | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_connection_lib.ps1` / `sap_rfc_lib.ps1` / `sap_dpapi.ps1` | dot-sourced / subprocess | Profile resolution, RFC connect, RIGHT-password decrypt | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | Step 9 | Artifact index for /sap-evidence-pack |

---

Step 0 — Resolve Work Directory & OUT

powershell -NoProfile -ExecutionPolicy Bypass -Command ". '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_settings_lib.ps1'; . '<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_connection_lib.ps1'; Write-Output ('WORK_DIR=' + (Get-SapWorkDir))"

Set `{RUN_TEMP}` via `Get-SapRunTemp`. `{OUT}` = `Get-SapArtifactDir -ScopeKey CFG_<OBJECT> -Skill sap-config-compare` (manual scope key — the compared object is a TABL/VIEW).

Step 0.5 — Start Logging

powershell -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_log_helper.ps1" -Action start -StateFile "{RUN_TEMP}\sap_config_compare_run.json" -Skill sap-config-compare -ParamsJson "{}"

---

Step 1 — Parse Arguments

Positional `<OBJECT>` (table or view, uppercased). Required `--against <hint>` (a /sap-login profile hint — `<SID>`, `<SID>/<CLIENT>`, description substring). Flags: `--where "F=V,F2=A..B"` (F=V → EQ, F=A..B → BETWEEN, comma = AND), `--options "<raw OPTIONS>"` (escape hatch; read-only predicate only — the engine refuses write keywords), `--fields F1,F2` (restrict compared columns; keys always included), `--keys-only` (diff key existence only; cap ×5), `--max-rows N` (default 10000, ceiling 100000). `--client NNN` (cross-client sugar — resolves `<LEFT_SID>/NNN`) and `preset <name>` are **v1.5/v2 (not implemented)** → say so and STOP.

Step 2 — Extract Both Sides (RFC)

LEFT = pinned profile; RIGHT = `--against`. The engine self-connects LEFT and resolves+connects RIGHT (DPAPI decrypt in-process). Identity per side is read LIVE (RFC_SYSTEM_INFO → SID, USR02 MANDT → logon client) — the profile store can be stale.

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "<SKILL_DIR>\references\sap_config_compare_read.ps1" -Object "<OBJECT>" -Against "<hint>" -SharedDir "<SAP_DEV_CORE_SHARED_DIR>" -OutDir "{OUT}"

Add `-Where`, `-Options`, `-Fields`, `-KeysOnly`, `-MaxRows` as parsed. Parse:

IDENT: side=<L|R> sid=.. client=.. release=..
OBJECT: kind=<TABLE|VIEW_DB|VIEW_MAINT_BASE> read_target=<tbl> note="<..>"
FIELDS: keys=.. compared=.. excluded=.. only_left=.. only_right=..
READ: side=<L|R> rows=.. capped=<Y|N> groups=..
STATUS: OK | CFG_OBJECT_NOT_FOUND | CFG_NO_COMMON_KEY | CFG_UNBOUNDED_READ | CFG_SAME_IDENTITY | RFC_LOGON_FAILED | RFC_ERROR

**Refusals (fail loud, STOP, log the class):**

• `CFG_SAME_IDENTITY` — LEFT and RIGHT are the same SID+client. Nothing to compare.
• `CFG_OBJECT_NOT_FOUND object=.. side=<left|right|both>` — name which side(s) miss it.
• `CFG_NO_COMMON_KEY` — no shared key column (or a single-client-key table → v1.5).
• `CFG_UNBOUNDED_READ .. suggest_filter=<field>` — over `--max-rows` with no filter;

re-run with `--where <field>=..` (echo the suggestion). Never a partial read.

• `RFC_LOGON_FAILED` (ambiguous/unknown `--against`, RIGHT unreachable, DPAPI) — STOP.

The engine writes `left.tsv`, `right.tsv`, `meta.json`, `texts.tsv` into `{OUT}`. `kind=VIEW_MAINT_BASE` means a maintenance view was decomposed to its **primary base table** (RFC_READ_TABLE cannot read a maintenance view) — the `note`/`scope_notes` list the base tables NOT diffed; carry that caveat into the summary.

Step 3 — Diff (offline)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "<SKILL_DIR>\references\sap_config_compa