fix: _servicePath no longer mutates @protocol annotation

CHANGELOG.md

@@ -14,6 +14,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/).
 ### Removed
 ### Fixed
 - Entities that are transitively autoexposed and should still be considered readonly, do not generate documentation for write endpoints anymore
+- OpenAPI compilation is now pure: the input CSN is no longer mutated during compilation
 ### Security
 
 ## [1.6.0] - 2026-08-04

lib/compile/index.js

@@ -32,12 +32,13 @@ function compileToOpenAPI(csn, options = {}) {
 }
 
 function processor(csn, options = {}) {
+  csn = cds.clone(csn);
   const edmOptions = {
     odataOpenapiHints: true, // hint to cds-compiler
     edm4OpenAPI: true, // downgrades certain OData errors to warnings in cds-compiler
     to: 'openapi' // hint to cds.compile.to.edm (usually set by CLI, but also do this in programmatic usages)
-  , ...options
-}
+    , ...options
+  }
 
   _applyMandatoryToFunctionParams(csn);
 

test/lib/compile/openapi.test.js

@@ -292,6 +292,19 @@ service CatalogService {
     assert(!openapi.servers[0].url.includes('odata'));
   });
 
+  test('does not mutate @protocol annotation after compilation', () => {
+    const csn = cds.compile.to.csn(`
+      namespace com.sap;
+      @protocol: ['odata', 'rest']
+      service A { entity E { key ID : UUID; }; }
+    `);
+    const originalProtocol = csn.definitions['com.sap.A']['@protocol'];
+    assert(Array.isArray(originalProtocol), '@protocol should be an array before compilation');
+    toOpenApi(csn);
+    assert(Array.isArray(csn.definitions['com.sap.A']['@protocol']),
+      '@protocol must not be mutated by toOpenApi');
+  });
+
   test('options: Multiple servers', () => {
     const csn = cds.compile.to.csn(`
       service A {entity E { key ID : UUID; };};`