@mcp-abap-adt/auth-broker 3.0.3 → 3.1.0

package/CHANGELOG.md

@@ -7,10 +7,79 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Contributors
 
-Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the complete list.
+Thank you to all contributors! See [CONTRIBUTORS.md](../../CONTRIBUTORS.md) for the complete list.
 
 ## [Unreleased]
 
+## [3.1.0] - 2026-10-01
+
+**Why a minor.** The library's API is unchanged: every export, signature and
+behaviour of 3.0.4 stays. What changed is where the commands install from —
+`mcp-auth` and `mcp-sso` are now `@mcp-abap-adt/auth-broker-cli` 1.0.0 — and
+which dependencies this package pulls in. Read the migration below if you
+install this package for its commands, or import `auth-stores` or
+`auth-providers` without declaring them.
+
+### Migration
+
+- **You run `npm i -g @mcp-abap-adt/auth-broker` for `mcp-auth` / `mcp-sso`:**
+  this version has no `bin`. Install the commands from their own package:
+
+  ```bash
+  npm uninstall -g @mcp-abap-adt/auth-broker && npm i -g @mcp-abap-adt/auth-broker-cli
+  ```
+
+  Commands and flags are the same.
+- **Your code imports `@mcp-abap-adt/auth-stores` or
+  `@mcp-abap-adt/auth-providers` and found them only because this package
+  depended on them:** declare them in your own `package.json`. This package no
+  longer installs either.
+
+### Changed
+
+- **The repository is a workspace** (the `mcp-abap-adt-interfaces` layout): this
+  package is `packages/auth-broker`, and the commands are
+  `packages/auth-broker-cli`, published as `@mcp-abap-adt/auth-broker-cli`. Tags
+  are `auth-broker-v<version>` from here on; the `v*` tags are this package's
+  history up to 3.0.4. Run everything from the repository root: `npm run build`,
+  `npm test`, `npm run check`.
+
+### Removed
+
+- **`bin`: `mcp-auth` and `mcp-sso`** move to `@mcp-abap-adt/auth-broker-cli`,
+  commands and flags unchanged (see *Migration*).
+- **`axios`** from the dependencies: nothing imports it.
+- **`@mcp-abap-adt/logger`** from the dependencies: only the commands use it
+  at run time; the tests keep it as a dev dependency.
+- **`@mcp-abap-adt/auth-stores` and `@mcp-abap-adt/auth-providers`** from the
+  dependencies: the library imports neither, only its tests do (dev
+  dependencies now). `tools/check-graph.js` keeps it that way for auth-stores.
+  A consumer that imported either without declaring it must declare it (see
+  *Migration*).
+- **The test helpers from `dist/`**: `dist/__tests__/helpers` shipped in the
+  tarball; the build no longer compiles anything under `src/__tests__`.
+- **`CONTRIBUTORS.md` from the tarball**: it stays at the repository root.
+
+## [3.0.4] - 2026-09-28
+
+### Fixed
+
+- **`mcp-sso` did not start from an installed package.** It imports
+  `@mcp-abap-adt/logger`, which was only a dev dependency, so every command —
+  `--version` and `help` included — died with `Cannot find module
+  '@mcp-abap-adt/logger'`. It worked in this repository, where dev dependencies
+  are installed. `@mcp-abap-adt/logger` is now a runtime dependency. `mcp-auth`
+  was not affected. Found by installing the 3.0.3 tarball into an empty
+  directory and running each bin.
+
+### Tests
+
+- **`tests/sso-demo` moves to CAP 10**: `@sap/cds` `^10`, `@sap/cds-dk` `^10`,
+  `@cap-js/sqlite` `^3`. `npm audit` there goes from 12 findings (2 critical,
+  6 high) to 0: they sat in copies nested under `@sap/cds-dk` 9, which no
+  update inside 9.x could reach. `cds build --production` builds the service as
+  before. The demo is not part of the published package.
+
 ## [3.0.3] - 2026-09-27
 
 ### Added

package/README.md

@@ -8,8 +8,13 @@ session cookies, with the refresh token. It decides nothing about tokens itself:
 cached token is still good, when to refresh and when to log in is the provider's call
 (`@mcp-abap-adt/auth-providers`), and where sessions live is the stores' (`@mcp-abap-adt/auth-stores`).
 
-It also ships two CLIs that write session files: `mcp-auth` (service key → session,
-authorization code or client credentials) and `mcp-sso` (OIDC and SAML single sign-on).
+The `mcp-auth` and `mcp-sso` commands that write session files are in
+[`@mcp-abap-adt/auth-broker-cli`](../auth-broker-cli/README.md), in the same
+repository. Up to 3.0.4 they shipped in this package; from 3.1.0 this package
+has no `bin`. Install the commands with
+`npm i -g @mcp-abap-adt/auth-broker-cli` — after
+`npm uninstall -g @mcp-abap-adt/auth-broker` if you had installed this one
+globally for them.
 
 ## Features
 
@@ -18,7 +23,6 @@ authorization code or client credentials) and `mcp-sso` (OIDC and SAML single si
 - ⚡ **Forced refresh**: `refreshToken()` obtains a new token even when the cached one looks valid — for a caller holding a 401
 - 🧾 **JWT or SAML cookies**: what the provider returns is saved as a token or as session cookies
 - 🔑 **No secrets copied**: The client secret stays in the service key; the session store gets tokens only
-- 🧰 **CLIs**: `mcp-auth` and `mcp-sso` produce `.env`/JSON session files, SAML trust read from metadata
 
 ## Installation
 
@@ -208,7 +212,7 @@ const connection = new JwtAbapConnection(config, tokenRefresher);
    it from the service key store if you relied on finding it in the session.
 6. `refreshToken()` now forces a new token; it used to return `getToken()`'s.
 7. Node.js 22, 24 or 26; SAML runs need the IdP trust (see *Migrating `mcp-sso`
-   SAML runs from 2.2.0*).
+   SAML runs from 2.2.0* in the [CLI's README](../auth-broker-cli/README.md)).
 
 ## Configuration
 
@@ -602,339 +606,57 @@ const xsuaaBroker = new AuthBroker({
 });
 ```
 
-### CLI: mcp-auth
-
-Generate or refresh `.env`/JSON output using AuthBroker + stores:
-
-```bash
-mcp-auth <auth-code|oidc|saml2-pure|saml2-bearer> [options]
-mcp-auth --service-key <path> --output <path> [--env <path>] [--type abap|xsuaa] [--credential] [--browser auto|none|system|chrome|edge|firefox] [--format json|env]
-```
-
-**Note**: The published CLI is compiled to `dist/bin` and does not require `tsx` at runtime. For repo usage, run `npm install` and `npm run build`.
-
-**Authentication Flow:**
-- Default: `authorization_code` (browser-based OAuth2)
-- `--credential`: `client_credentials` (clientId/clientSecret, no browser)
-
-**Browser Options (for authorization_code):**
-- `auto` (default): Try to open browser, fallback to showing URL
-- `none`: Show URL in console and wait for callback (no browser)
-- `system/chrome/edge/firefox`: Open specific browser
-
-`--browser` and `--redirect-port` are routed into `browserCallbackStrategy`. This CLI has no
-default of its own for the callback port: `--redirect-port` overrides it when given; omitted,
-the port comes from `auth-providers` (currently `61001`, chosen to sit above the ephemeral range
-and clear of the `3001`/`3333` range servers and proxies typically use). If you registered a
-redirect URI with a specific port at your identity provider, pass `--redirect-port` to match it.
-A login is given 5 minutes to complete (this is a person switching to a browser and signing in
-by hand, not an unattended caller).
-
-**SAML options (`saml2-pure`, `saml2-bearer`):**
-`mcp-auth` hands these subcommands to `mcp-sso` with every argument unchanged, so the SAML options
-are `mcp-sso`'s (see *CLI: mcp-sso* and *SAML assertion validation* below) and its exit code is
-`mcp-auth`'s. The ones a run needs:
-
-| Option | What it is |
-|---|---|
-| `--idp-metadata <url\|path>` | The identity provider's SAML metadata; fills `--idp-cert`, `--idp-entity-id` and `--idp-sso-url`. For SAP Cloud Identity Services: `https://<tenant>.accounts.ondemand.com/saml2/metadata`. |
-| `--idp-cert <path>`, `--idp-entity-id <id>` | The same trust, stated instead of read. |
-| `--idp-initiated` | The identity provider starts the login. `saml2-bearer` against XSUAA needs it. |
-| `--sp-entity-id`, `--acs-url` | The `Audience` and `Recipient`. For `saml2-bearer` with `--service-key`, read from `<uaa.url>/saml/metadata`. |
-| `--assertion <base64>`, `--assertion-flow <flow>` | A `SAMLResponse` obtained elsewhere, or how to obtain one. |
-| `--authn-request-id <id>` | The request an `--assertion` answers, when `mcp-sso` did not send it. |
-
-`saml2-bearer` still requires `--dev`: it has not been run against a live XSUAA with a SAML trust.
-
-**Examples:**
-```bash
-# Auth code (default via service key)
-mcp-auth auth-code --service-key ./abap.json --output ./abap.env --type abap
-
-# OIDC SSO (device flow example)
-mcp-auth oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
-
-# SAML2 pure (cookie); the SAML flags are mcp-sso's, see "SAML assertion validation" below
-mcp-auth saml2-pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --idp-cert ./idp-signing.pem --idp-entity-id https://idp.example/metadata --output ./saml.env --type abap
-
-# SAML2 bearer (in progress, requires --dev)
-mcp-auth saml2-bearer --dev --service-key ./mcp.json --idp-metadata https://<ias-tenant>.accounts.ondemand.com/saml2/metadata --idp-initiated --output ./sso.env --type xsuaa
-
-# ABAP: authorization_code (default, opens browser)
-mcp-auth --service-key ./abap.json --output ./abap.env --type abap
-
-# ABAP: authorization_code (show URL in console, no browser)
-mcp-auth --service-key ./abap.json --output ./abap.env --type abap --browser none
-
-# XSUAA: authorization_code (default)
-mcp-auth --service-key ./mcp.json --output ./mcp.env --type xsuaa
-
-# XSUAA: client_credentials (special cases)
-mcp-auth --service-key ./mcp.json --output ./mcp.env --type xsuaa --credential
-
-# Using existing .env for refresh token
-mcp-auth --env ./mcp.env --service-key ./mcp.json --output ./mcp.env --type xsuaa
-```
-
-### CLI: mcp-sso
-
-Get tokens via SSO providers (OIDC/SAML) and generate `.env`/JSON output:
-
-```bash
-mcp-sso <oidc|saml2|bearer> [options]
-mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [--type abap|xsuaa] [--format env|json] [--env <path>] [--config <path>]
-```
-
-**Supported flows:**
-- OIDC: `browser`, `device`, `password`, `token_exchange`
-- SAML2: `bearer`, `pure`
-
-Only the flows that actually open a browser (OIDC `browser`; SAML2 `bearer`/`pure` with the
-default `--assertion-flow browser`) use `--browser` and `--redirect-port` — they are routed
-into `browserCallbackStrategy`/`oidcCallbackStrategy`/`samlCallbackStrategy`. This CLI has no
-default of its own for the callback port: `--redirect-port` overrides it when given; omitted,
-the port comes from `auth-providers` (currently `61001`). A login is given 5 minutes to
-complete. `device`, `password`, and `token_exchange` never open a browser from this process, so
-`--browser`/`--redirect-port` have no effect for them. This applies the same way whether
-`--protocol`/`--flow` come from CLI flags or from `--config` (below) — a field's origin doesn't
-change how it's handled, and CLI flags always take precedence over the same field in a file.
-
-**Examples:**
-```bash
-# OIDC browser flow
-mcp-sso oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
-
-# OIDC browser flow (manual code / OOB — no callback server is opened for this combination)
-mcp-sso oidc --flow browser --token-endpoint https://issuer/token --client-id my-client --code <auth_code> --redirect-uri urn:ietf:wg:oauth:2.0:oob --output ./sso.env --type xsuaa
-
-# OIDC device flow
-mcp-sso oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
-
-# OIDC password flow
-mcp-sso oidc --flow password --token-endpoint https://issuer/oauth/token --client-id my-client --username user --password pass --output ./sso.env --type xsuaa
-
-# OIDC token exchange
-mcp-sso oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
-
-# SAML bearer flow against XSUAA with a service key: the Audience, Recipient and token alias
-# come from <uaa.url>/saml/metadata, the IdP's trust from its own metadata
-mcp-sso bearer --service-key ./service-key.json --idp-metadata https://<ias-tenant>.accounts.ondemand.com/saml2/metadata --idp-initiated --output ./sso.env --type xsuaa
-
-# The same, every value stated (IdP-initiated assertion -> token)
-mcp-sso bearer --idp-sso-url https://idp/sso --sp-entity-id <uaa-entity-id> --acs-url <uaa-bearer-acs> --idp-cert ./idp-signing.pem --idp-entity-id https://idp.example/metadata --idp-initiated --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
-
-# SAML pure flow (cookie; SP-initiated browser login, the request is sent by mcp-sso)
-mcp-sso saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --idp-cert ./idp-signing.pem --idp-entity-id https://idp.example/metadata --cookie "SAP_SESSION=..." --output ./sso.env --type abap
-```
-
-**SAML assertion validation:**
-Both SAML flows validate every assertion before using it — signature, issuer, audience,
-recipient, time window, request ID and replay (done by `@mcp-abap-adt/auth-providers` 4; see its
-README, *SAML assertion validation*). The provider will not even be constructed without the
-trust it checks against, and `mcp-sso` invents none of it — it is stated, or read from SAML
-metadata:
-
-| Option | `--config` field | What it is |
-|---|---|---|
-| `--idp-cert <path>` (repeatable) | `idpCertificates` (string or list, inline PEM or base64 DER) | The identity provider's signing certificate(s). A file may be PEM (one or several certificates) or binary DER. Repeat the flag, or list several, to trust both keys during a rotation. |
-| `--idp-entity-id <id>` | `idpEntityId` | The identity provider's `entityID` — the `Issuer` its assertions carry. |
-| `--idp-metadata <url\|path>` | `idpMetadata` | The identity provider's SAML metadata (for SAP Cloud Identity Services `https://<tenant>.accounts.ondemand.com/saml2/metadata`). Fills the two rows above and `--idp-sso-url` where not given: signing keys and keys without `use`, never encryption keys. An https URL or a file; plain http only for loopback. Federation metadata (an `EntitiesDescriptor` of several entities) works too: entity ID, keys and SSO URL all come from the same identity provider, which `--idp-entity-id` names when there are several — without it such a run stops and lists them. |
-| `--sp-entity-id <id>` | `spEntityId` | Already required; it is now also the `Audience` the assertion must name. For bearer against UAA/XSUAA, the `entityID` in their SAML metadata. |
-| `--acs-url <url>` | `acsUrl` | The `Recipient` the assertion must name. For bearer against UAA/XSUAA, the token endpoint's bearer ACS; the default `http://localhost:<port>/callback` fits only a login delivered to this CLI. |
-| `--idp-initiated` | `idpInitiated` (`true`/`false`) | The identity provider starts the login and no AuthnRequest is sent, so the assertion must carry no `InResponseTo`. |
-| `--authn-request-id <id>` | `authnRequestId` | The AuthnRequest ID an `--assertion` answers, when the request was sent by something other than `mcp-sso`. |
-
-A `--idp-cert` on the command line replaces the file's `idpCertificates` rather than adding to
-them, so a certificate retired on the command line is not still trusted from the file.
-
-Which request setting a run needs:
-
-- **Browser or manual login, SP-initiated** (`--assertion-flow browser`, the default, or
-  `manual`): nothing — `mcp-sso` builds the AuthnRequest and knows its ID.
-- **`--assertion <base64>`** from an SP-initiated login sent elsewhere: `--authn-request-id`.
-- **IdP-initiated** — required for `bearer` against UAA or XSUAA, whose saml2-bearer grant refuses
-  an assertion carrying `InResponseTo`: `--idp-initiated`, with `--assertion`, or with
-  `--assertion-flow manual` (the default under `--idp-initiated`), which asks you to start the
-  login at the identity provider and paste the `SAMLResponse` it posts. `--idp-initiated` with
-  `--assertion-flow browser` is refused, since there is no request URL to open.
-
-`--idp-initiated` together with `--authn-request-id`, a missing certificate or entity ID, or an
-assertion that fails a check is reported by `auth-providers` itself (`ValidationError` or
-`AssertionValidationError`), with the field or the check it refused.
-
-**XSUAA's side of a bearer run:**
-None of `--sp-entity-id`, `--acs-url` and the bearer token endpoint is in an XSUAA service key, but
-XSUAA publishes all three in its SAML metadata: its `entityID` is the `Audience`, and its
-`/oauth/token/alias/<alias>` endpoint is both the `Recipient` and where the assertion is exchanged.
-With `--service-key`, `bearer` reads `<uaa.url>/saml/metadata` and fills whichever of them was not
-given. Without network access to it, pass the file (from *Security > Trust Configuration >
-Download SAML Metadata* in the subaccount):
-
-```bash
-mcp-sso bearer --saml-metadata ./saml-sp.xml --idp-sso-url https://idp/sso --sp-entity-id <uaa-entity-id> --acs-url <uaa-bearer-acs> --idp-cert ./idp-signing.pem --idp-entity-id https://idp.example/metadata --idp-initiated --assertion <base64> --service-key ./service-key.json --output ./sso.env --type xsuaa
-```
-
-### Local Keycloak (OIDC + SAML Tests)
-
-For local testing of `mcp-sso`, a ready-to-run Keycloak setup is included
-(OIDC browser/password/device + SAML assertion capture).
-
-```bash
-cd tests/keycloak
-docker compose up -d
-```
-
-Then use:
-```bash
-node dist/bin/mcp-sso.js \
-  oidc \
-  --flow browser \
-  --issuer http://localhost:8080/realms/mcp-sso \
-  --client-id mcp-sso-cli \
-  --scopes openid,profile,email \
-  --output /tmp/keycloak.env \
-  --type xsuaa
-```
-
-See `tests/keycloak/README.md` for device flow and SAML examples.
-
-### XSUAA Demo (CAP)
-
-A minimal CAP app for testing XSUAA flows is included at `tests/sso-demo`.
-It enables `authorization_code` and `saml2-bearer` grant types and provides a
-simple `CatalogService`. See `tests/sso-demo/readme.md` for deploy steps.
-
-**Config file:**
-You can pass a JSON file with provider config instead of (or alongside) `--protocol`/`--flow`
-and the OIDC/SAML flags — `--config` alone is enough to run a flow, with no other flags required:
-
-```json
-{
-  "protocol": "oidc",
-  "flow": "device",
-  "issuerUrl": "https://issuer",
-  "clientId": "my-client",
-  "scopes": ["openid", "profile"]
-}
-```
-
-Any CLI flag given alongside `--config` overrides the same field in the file; a field the file
-sets and no flag overrides is used as-is. A file written for a pre-2.0.0 config still works:
-`browser` and `redirectPort` are routed into the strategy exactly as the equivalent CLI flags
-are, and `authorizationCode`/`assertionFlow` are honored the same way `--code`/`--assertion-flow`
-are. A file that sets `authorizationCodeProvider`, `assertionProvider`, or `manualInput` — all
-functions, which JSON cannot express — is refused with an error naming the CLI flag to use
-instead, rather than having the field silently dropped.
-
-A SAML config file carries the trust inline:
-
-```json
-{
-  "protocol": "saml2",
-  "flow": "bearer",
-  "idpSsoUrl": "https://idp.example/sso",
-  "spEntityId": "https://uaa.example/entity",
-  "acsUrl": "https://uaa.example/oauth/token/alias/example",
-  "idpEntityId": "https://idp.example/metadata",
-  "idpCertificates": ["MIIC...base64 DER from the IdP metadata's <X509Certificate>..."],
-  "idpInitiated": true,
-  "assertionFlow": "manual"
-}
-```
-
-#### Migrating `mcp-sso` SAML runs from 2.2.0
-
-2.2.0 used `@mcp-abap-adt/auth-providers` 2.x, which trusted any SAML payload it was handed.
-With 4.x every `mcp-sso` SAML run (`bearer`, `saml2 --flow pure`, and `mcp-auth saml2-pure` /
-`saml2-bearer`, which call it) fails before login until you add:
-
-1. `--idp-metadata <url|path>`, or `--idp-cert <path>` and `--idp-entity-id <id>` (or
-   `idpCertificates` and `idpEntityId` in `--config`) — without them the provider refuses to
-   construct.
-2. The real `--sp-entity-id` (the `Audience`) and, unless the assertion is delivered to this CLI's
-   own callback, the `--acs-url` it names as `Recipient`. For `bearer` with `--service-key` both
-   are read from XSUAA's metadata.
-3. For `bearer` against UAA or XSUAA: `--idp-initiated`, with `--assertion` or
-   `--assertion-flow manual`. For any other `--assertion` from an SP-initiated login:
-   `--authn-request-id`.
-
-Node.js 22, 24 or 26 is required.
-
-### Utility Script
-
-Generate `.env` files from service keys:
-
-```bash
-npm run generate-env <destination> [service-key-path] [session-path]
-```
-
 ## Testing
 
-Tests are located in `src/__tests__/` and use Jest as the test runner.
-
-### Running Tests
+The library's tests are in `packages/auth-broker/src/__tests__/` and use Jest.
+Run them from the repository root, where the dev dependencies are installed:
 
 ```bash
-# Run all tests
+# Every workspace's tests (library and CLI)
 npm test
 
-# Run specific test file (all tests in that file)
-npm test -- getToken.test.ts
-npm test -- refreshToken.test.ts
+# The library's only
+npm test -w @mcp-abap-adt/auth-broker
 
-# Run specific test by name/pattern
-npm test -- getToken.test.ts -t "Test 1"
-npm test -- getToken.test.ts -t "Test 2"
-npm test -- getToken.test.ts -t "Test 3"
-
-# Run test group (e.g., all getToken tests)
-npm test -- getToken.test.ts
-
-# Note: Test 2 requires Test 1 to pass first (test1Passed flag)
-# To run Test 2 alone, you may need to run all tests in the file:
-npm test -- getToken.test.ts
+# One file, or one case
+npm test -w @mcp-abap-adt/auth-broker -- AuthBroker.test.ts
+npm test -w @mcp-abap-adt/auth-broker -- AuthBroker.test.ts -t "name of the case"
 ```
 
-### Test Structure
-
-Tests are designed to run sequentially (guaranteed by `maxWorkers: 1` and `maxConcurrency: 1` in `jest.config.js`):
-
-1. **Test 1**: Verifies error handling for non-existent destination (`NO_EXISTS`)
-   - Requires: `NO_EXISTS.json` should NOT exist
-   
-2. **Test 2**: Tests browser authentication when service key exists but `.env` file doesn't
-   - Requires: `TRIAL.json` must exist, `TRIAL.env` should NOT exist
-   - Will open browser for OAuth authentication
-   
-3. **Test 3**: Tests token refresh using existing `.env` file
-   - Requires: `TRIAL.json` and `TRIAL.env` must exist
-   - Can run independently if `.env` file exists (created manually or by Test 2)
+Tests run sequentially (`maxWorkers: 1` and `maxConcurrency: 1` in
+`packages/auth-broker/jest.config.js`). `AuthBroker.test.ts` needs nothing;
+`AuthBroker.integration.test.ts` reads real service keys and sessions, and
+every case in it returns early unless the configuration below names a real
+destination.
 
 ### Test Setup
 
-1. Copy `tests/test-config.yaml.template` to `tests/test-config.yaml`
+1. Copy `packages/auth-broker/tests/test-config.yaml.template` to
+   `packages/auth-broker/tests/test-config.yaml` (until the workspace layout it
+   lived in `tests/` at the repository root; move an existing copy)
 2. Fill in configuration values (paths, destinations, MCP URL for XSUAA)
 3. Place service key files in configured `service_keys_dir`:
    - `{destination}.json` for ABAP tests (e.g., `trial.json`)
    - `{btp_destination}.json` for XSUAA tests (e.g., `btp.json`)
 
-Tests will automatically skip if required files are missing or configuration contains placeholders.
+Without `test-config.yaml` the template is read, its placeholders disable every
+integration case, and the run reaches no system.
 
 ## Documentation
 
-Complete documentation is available in the [`docs/`](docs/) directory:
+Complete documentation is available in the repository's [`docs/`](../../docs/) directory:
 
-- **[Architecture](docs/architecture/ARCHITECTURE.md)** - System architecture and design decisions
-- **[Development](docs/development/)** - Testing methodology and development roadmap
-- **[Development Roadmap](docs/development/DEVELOPMENT_ROADMAP.md)** - Development roadmap and future plans
-- **[Installation](docs/installing/INSTALLATION.md)** - Installation and setup guide
-- **[Usage](docs/using/USAGE.md)** - API reference and usage examples
+- **[Architecture](../../docs/architecture/ARCHITECTURE.md)** - System architecture and design decisions
+- **[Development](../../docs/development/)** - Testing methodology and development roadmap
+- **[Development Roadmap](../../docs/development/DEVELOPMENT_ROADMAP.md)** - Development roadmap and future plans
+- **[Installation](../../docs/installing/INSTALLATION.md)** - Installation and setup guide
+- **[Usage](../../docs/using/USAGE.md)** - API reference and usage examples
 
-See [docs/README.md](docs/README.md) for the complete documentation index.
+See [docs/README.md](../../docs/README.md) for the complete documentation index.
 
 ## Contributors
 
-Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the complete list.
+Thank you to all contributors! See [CONTRIBUTORS.md](../../CONTRIBUTORS.md) for the complete list.
 
 ## License
 

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "3.0.3",
-  "description": "Per-destination token broker for SAP BTP and ABAP: sessions and service keys from stores, tokens from an injected provider, results persisted - plus the mcp-auth and mcp-sso CLIs",
+  "version": "3.1.0",
+  "description": "Per-destination token broker for SAP BTP and ABAP: sessions and service keys from stores, tokens from an injected provider, results persisted",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
     "README.md",
     "CHANGELOG.md",
-    "CONTRIBUTORS.md",
     "LICENSE",
     "COPYING"
   ],
@@ -24,70 +23,44 @@
     "abap-adt",
     "xsuaa",
     "oauth2",
-    "saml",
-    "sso"
+    "saml"
   ],
   "author": "Oleksii Kyslytsia <oleksij.kyslytsja@gmail.com>",
   "license": "LGPL-3.0-only",
-  "homepage": "https://github.com/fr0ster/mcp-abap-adt-auth-broker#readme",
+  "homepage": "https://github.com/fr0ster/mcp-abap-adt-auth-broker/tree/main/packages/auth-broker#readme",
   "bugs": {
     "url": "https://github.com/fr0ster/mcp-abap-adt-auth-broker/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/fr0ster/mcp-abap-adt-auth-broker.git"
+    "url": "git+https://github.com/fr0ster/mcp-abap-adt-auth-broker.git",
+    "directory": "packages/auth-broker"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "chrono": "./tools/version-stats.sh",
-    "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "lint": "biome check --write src",
-    "lint:check": "biome check src",
-    "format": "biome format --write src",
-    "build": "npm run --silent clean && biome check src --diagnostic-level=error && tsc -p tsconfig.json && tsc -p tsconfig.cli.json",
-    "build:fast": "tsc -p tsconfig.json && tsc -p tsconfig.cli.json",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo tsconfig.build.tsbuildinfo",
+    "build": "tsc -b tsconfig.build.json",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
-    "test:check": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
-    "test:mcp-auth": "sh tests/sso-demo/run-mcp-auth.sh",
-    "test:mcp-sso": "sh tests/sso-demo/run-mcp-sso.sh",
-    "test:device-code": "sh tests/keycloak/run-oidc.sh",
-    "test:saml-pure": "sh tests/keycloak/run-saml.sh",
-    "test:sso": "sh tests/keycloak/run-interactive.sh",
-    "prepublishOnly": "npm run build",
-    "prepack": "npm run build",
-    "generate-env": "tsx bin/generate-env-from-service-key.ts"
-  },
-  "bin": {
-    "mcp-auth": "./dist/bin/mcp-auth.js",
-    "mcp-sso": "./dist/bin/mcp-sso.js"
+    "test:check": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run --prefix ../.. check"
   },
   "engines": {
     "node": "^22 || ^24 || ^26"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-providers": "^4.2.0",
-    "@mcp-abap-adt/auth-stores": "^1.2.3",
     "@mcp-abap-adt/interfaces-auth": "^2.1.0",
     "@mcp-abap-adt/interfaces-auth-sap": "^1.0.1",
-    "@mcp-abap-adt/interfaces-utils": "^1.1.0",
-    "axios": "^1.13.5"
+    "@mcp-abap-adt/interfaces-utils": "^1.1.0"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.14",
+    "@mcp-abap-adt/auth-providers": "^4.2.0",
+    "@mcp-abap-adt/auth-stores": "^1.2.3",
     "@mcp-abap-adt/logger": "^0.4.0",
-    "@types/express": "^5.0.5",
-    "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.2.3",
-    "jest": "^30.2.0",
-    "jest-util": "^30.2.0",
     "js-yaml": "^4.1.1",
     "pino": "^10.1.0",
-    "pino-pretty": "^13.1.3",
-    "ts-jest": "^29.2.5",
-    "tsx": "^4.21.0",
-    "typescript": "^5.9.2"
+    "pino-pretty": "^13.1.3"
   }
 }

package/CONTRIBUTORS.md

@@ -1,33 +0,0 @@
-# Contributors
-
-Thank you to all contributors who have helped make `@mcp-abap-adt/auth-broker` better!
-
-## How to Contribute
-
-We welcome contributions! Please see the project documentation for details on how to get started.
-
-## Contributors
-
-<!-- Contributors are listed alphabetically by last name -->
-
-### Core Contributors
-
-- **Oleksii Kyslytsia** - Project creator and maintainer
-
----
-
-## Recognition
-
-We appreciate every contribution, whether it's:
-- 🐛 Bug reports and fixes
-- ✨ New features and enhancements
-- 📚 Documentation improvements
-- 🧪 Test coverage
-- 💬 Feedback and suggestions
-
-Every contribution helps make `@mcp-abap-adt/auth-broker` better for everyone!
-
----
-
-**Note:** This list is manually maintained. If you've contributed but don't see your name here, please open an issue or submit a PR to update this file.
-