@mcp-abap-adt/auth-broker 3.0.1 → 3.0.3

package/CHANGELOG.md

@@ -11,6 +11,18 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 
 ## [Unreleased]
 
+## [3.0.3] - 2026-09-27
+
+### Added
+
+- **`help` and `version` as commands** for `mcp-auth` and `mcp-sso`: `help` / `--help` / `-h` and `version` / `--version` / `-v` — the same set in every CLI of the family, each answering before anything starts or connects. Both answered "Unknown command".
+
+## [3.0.2] - 2026-09-27
+
+### Changed
+
+- **Node.js 26 is supported**: `engines` is `"^22 || ^24 || ^26"`. Under Node 26 npm skipped every release whose `engines` did not admit it and installed the newest one that did — silently an older major, for this package one without the restriction. Measured: `npm i -g @mcp-abap-adt/proxy` on Node 26.7.0 installed 4.2.0 while 5.0.1 was `latest`. The release build runs on Node 22 (it was 18, below `engines`).
+
 ## [3.0.1] - 2026-09-26
 
 ### Fixed

package/README.md

@@ -26,8 +26,9 @@ authorization code or client credentials) and `mcp-sso` (OIDC and SAML single si
 npm install @mcp-abap-adt/auth-broker
 ```
 
-Requires Node.js 22 or 24 (`engines: "^22 || ^24"`), the versions SAP BTP's Cloud Foundry
-Node.js buildpack offers.
+Requires Node.js 22, 24 or 26 (`engines: "^22 || ^24 || ^26"`): 22 and 24 are
+the versions SAP BTP's Cloud Foundry Node.js buildpack offers, and 26 is
+supported as well.
 
 ## Usage
 
@@ -206,7 +207,7 @@ const connection = new JwtAbapConnection(config, tokenRefresher);
 5. The broker no longer writes the client secret into the session store. Read
    it from the service key store if you relied on finding it in the session.
 6. `refreshToken()` now forces a new token; it used to return `getToken()`'s.
-7. Node.js 22 or 24; SAML runs need the IdP trust (see *Migrating `mcp-sso`
+7. Node.js 22, 24 or 26; SAML runs need the IdP trust (see *Migrating `mcp-sso`
    SAML runs from 2.2.0*).
 
 ## Configuration
@@ -857,7 +858,7 @@ With 4.x every `mcp-sso` SAML run (`bearer`, `saml2 --flow pure`, and `mcp-auth
    `--assertion-flow manual`. For any other `--assertion` from an SP-initiated login:
    `--authn-request-id`.
 
-Node.js 22 or 24 is required.
+Node.js 22, 24 or 26 is required.
 
 ### Utility Script
 

package/dist/bin/mcp-auth.js

@@ -131,8 +131,8 @@ function showHelp() {
     console.log('  --assertion <base64>       A SAMLResponse obtained elsewhere');
     console.log('  --assertion-flow <flow>    browser|manual|assertion');
     console.log('');
-    console.log('  --version, -v          Show version number');
-    console.log('  --help, -h             Show this help message');
+    console.log('  version, --version, -v Show version number');
+    console.log('  help, --help, -h       Show this help message');
     console.log('');
     console.log('Examples:');
     console.log('  # Auth code (default flow via service key)');
@@ -189,11 +189,16 @@ function showHelp() {
 }
 function parseArgs(args = process.argv.slice(2)) {
     // Handle --version and --help first
-    if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
+    if (args.length === 0 ||
+        args[0] === 'help' ||
+        args.includes('--help') ||
+        args.includes('-h')) {
         showHelp();
         process.exit(0);
     }
-    if (args.includes('--version') || args.includes('-v')) {
+    if (args[0] === 'version' ||
+        args.includes('--version') ||
+        args.includes('-v')) {
         console.log(getVersion());
         process.exit(0);
     }
@@ -401,6 +406,16 @@ function workDir() {
 }
 async function main() {
     const rawArgs = process.argv.slice(2);
+    // `help` and `version` as commands, like every CLI in the family; they answer
+    // before any subcommand is dispatched.
+    if (rawArgs[0] === 'help') {
+        showHelp();
+        process.exit(0);
+    }
+    if (rawArgs[0] === 'version') {
+        console.log(getVersion());
+        process.exit(0);
+    }
     const subcommand = rawArgs[0];
     const hasSubcommand = subcommand && !subcommand.startsWith('-') && subcommand.length > 0;
     if (hasSubcommand) {

package/dist/bin/mcp-sso.js

@@ -165,8 +165,8 @@ function showHelp() {
     console.log('  also needs --idp-initiated or --authn-request-id; the browser and manual flows');
     console.log('  send their own request unless --idp-initiated is given.');
     console.log('');
-    console.log('  --version, -v              Show version number');
-    console.log('  --help, -h                 Show this help message');
+    console.log('  version, --version, -v     Show version number');
+    console.log('  help, --help, -h           Show this help message');
 }
 function parseScopes(value) {
     if (!value)
@@ -218,11 +218,16 @@ function createCliLogger(prefix = 'SSO') {
 }
 function parseArgs() {
     let args = process.argv.slice(2);
-    if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
+    if (args.length === 0 ||
+        args[0] === 'help' ||
+        args.includes('--help') ||
+        args.includes('-h')) {
         showHelp();
         process.exit(0);
     }
-    if (args.includes('--version') || args.includes('-v')) {
+    if (args[0] === 'version' ||
+        args.includes('--version') ||
+        args.includes('-v')) {
         console.log(getVersion());
         process.exit(0);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "3.0.1",
+  "version": "3.0.3",
   "description": "Per-destination token broker for SAP BTP and ABAP: sessions and service keys from stores, tokens from an injected provider, results persisted - plus the mcp-auth and mcp-sso CLIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -64,7 +64,7 @@
     "mcp-sso": "./dist/bin/mcp-sso.js"
   },
   "engines": {
-    "node": "^22 || ^24"
+    "node": "^22 || ^24 || ^26"
   },
   "dependencies": {
     "@mcp-abap-adt/auth-providers": "^4.2.0",