@mcp-abap-adt/auth-broker 3.0.4 → 3.1.0

package/dist/bin/mcp-auth.js

@@ -1,752 +0,0 @@
-#!/usr/bin/env node
-"use strict";
-/**
- * MCP Auth - Get tokens and generate .env files from service keys
- *
- * Usage:
- *   mcp-auth --service-key <path> --output <path> [--env <path>] [--type abap|xsuaa] [--credential] [--browser auto|none|chrome|edge|firefox|system] [--format json|env]
- *
- * Examples:
- *   # Generate .env file with authorization_code (default)
- *   mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa
- *
- *   # With authorization_code, show URL in console (no browser)
- *   mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa --browser none
- *
- *   # With client_credentials (special cases)
- *   mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa --credential
- *
- *   # Generate .env file for ABAP
- *   mcp-auth --service-key ./abap-key.json --output ./abap.env --type abap
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-const child_process_1 = require("child_process");
-const fs = __importStar(require("fs"));
-const path = __importStar(require("path"));
-// Use require for CommonJS dist files with absolute path
-const distPath = path.resolve(__dirname, '..', 'index.js');
-const { AuthBroker } = require(distPath);
-const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
-const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
-const workDir_1 = require("./workDir");
-/**
- * A person completes this login at a browser; the provider's own default
- * (30s) is sized for an unattended caller instead.
- */
-const INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
-function getVersion() {
-    try {
-        const candidates = [
-            path.join(__dirname, 'package.json'),
-            path.join(__dirname, '..', 'package.json'),
-            path.join(__dirname, '..', '..', 'package.json'),
-        ];
-        for (const candidate of candidates) {
-            if (fs.existsSync(candidate)) {
-                const packageJson = JSON.parse(fs.readFileSync(candidate, 'utf8'));
-                return packageJson.version || 'unknown';
-            }
-        }
-        const localRequire = require('module').createRequire(__filename);
-        const resolved = localRequire.resolve('@mcp-abap-adt/auth-broker/package.json');
-        const packageJson = JSON.parse(fs.readFileSync(resolved, 'utf8'));
-        return packageJson.version || 'unknown';
-    }
-    catch {
-        return 'unknown';
-    }
-}
-function showHelp() {
-    console.log('MCP Auth - Get tokens and generate .env files from service keys');
-    console.log('');
-    console.log('Usage:');
-    console.log('  mcp-auth <auth-code|oidc|saml2-pure|saml2-bearer> [options]');
-    console.log('  mcp-auth --service-key <path> --output <path> [options]');
-    console.log('');
-    console.log('Required Options:');
-    console.log('  --output <path>         Output file path');
-    console.log('');
-    console.log('Service Key or Env (one required):');
-    console.log('  --service-key <path>    Path to service key JSON file');
-    console.log('  --env <path>            Path to existing .env file (used for refresh token)');
-    console.log('');
-    console.log('Optional Options:');
-    console.log('  --type <type>           Auth type: abap or xsuaa (default: abap)');
-    console.log('  --dev                   Enable in-progress commands (saml2-bearer)');
-    console.log('  --credential            Use client_credentials flow (clientId/clientSecret, no browser)');
-    console.log('                          By default uses authorization_code flow');
-    console.log('  --browser <browser>     Browser for authorization_code flow (default: auto):');
-    console.log('                            - auto: Try to open browser, fallback to showing URL (like cf login)');
-    console.log('                            - none/headless: Show URL in console and wait for callback');
-    console.log('                            - system/chrome/edge/firefox: Open specific browser');
-    console.log('  --format <format>       Output format: json or env (default: env)');
-    console.log('  --service-url <url>     Service URL (SAP URL for ABAP, MCP URL for XSUAA). For XSUAA, optional.');
-    console.log('  --redirect-port <port>  Port for OAuth redirect URI (default: from auth-providers, currently 61001).');
-    console.log('                          Must match XSUAA redirect-uris config.');
-    console.log('');
-    console.log('SAML (saml2-pure, saml2-bearer; passed to mcp-sso, see mcp-sso --help for all):');
-    console.log('  --idp-metadata <url|path>  IdP SAML metadata (https or file): certificate, entityID, SSO URL');
-    console.log('                             e.g. https://<ias-tenant>.accounts.ondemand.com/saml2/metadata');
-    console.log('  --idp-cert <path>          IdP signing certificate (PEM or DER); repeat for key rotation');
-    console.log('  --idp-entity-id <id>       IdP entityID; the Issuer the assertion must name');
-    console.log('  --idp-sso-url <url>        IdP SSO endpoint (read from --idp-metadata when not given)');
-    console.log('  --idp-initiated            The IdP starts the login; required for saml2-bearer against XSUAA');
-    console.log('  --authn-request-id <id>    AuthnRequest ID an --assertion answers, when sent elsewhere');
-    console.log('  --sp-entity-id <id>        SP entityID, the Audience (saml2-bearer: read from XSUAA metadata)');
-    console.log('  --acs-url <url>            The Recipient (saml2-bearer: read from XSUAA metadata)');
-    console.log('  --saml-metadata <path>     XSUAA SP metadata file; with --service-key <uaa.url>/saml/metadata is read');
-    console.log('  --assertion <base64>       A SAMLResponse obtained elsewhere');
-    console.log('  --assertion-flow <flow>    browser|manual|assertion');
-    console.log('');
-    console.log('  version, --version, -v Show version number');
-    console.log('  help, --help, -h       Show this help message');
-    console.log('');
-    console.log('Examples:');
-    console.log('  # Auth code (default flow via service key)');
-    console.log('  mcp-auth auth-code --service-key ./service-key.json --output ./mcp.env --type xsuaa');
-    console.log('');
-    console.log('  # OIDC SSO (device/password/browser/token-exchange)');
-    console.log('  mcp-auth oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa');
-    console.log('');
-    console.log('  # SAML2 pure (cookies); every assertion is validated: see mcp-sso --help');
-    console.log('  mcp-auth saml2-pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --idp-cert ./idp.pem --idp-entity-id https://idp/metadata --output ./saml.env --type abap');
-    console.log('');
-    console.log('  # SAML2 bearer (in progress, requires --dev)');
-    console.log('  mcp-auth saml2-bearer --dev --service-key ./service-key.json --idp-metadata https://<ias-tenant>.accounts.ondemand.com/saml2/metadata --idp-initiated --output ./sso.env --type xsuaa');
-    console.log('');
-    console.log('  # XSUAA with authorization_code (default, opens browser)');
-    console.log('  mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa');
-    console.log('');
-    console.log('  # XSUAA with authorization_code (show URL in console, no browser)');
-    console.log('  mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa --browser none');
-    console.log('');
-    console.log('  # XSUAA using existing .env refresh token, fallback to service key');
-    console.log('  mcp-auth --env ./mcp.env --service-key ./service-key.json --output ./mcp.env --type xsuaa');
-    console.log('');
-    console.log('  # XSUAA with client_credentials (special cases)');
-    console.log('  mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa --credential');
-    console.log('');
-    console.log('  # XSUAA with custom redirect port');
-    console.log('  mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa --redirect-port 8080');
-    console.log('');
-    console.log('  # ABAP with authorization_code (default)');
-    console.log('  mcp-auth --service-key ./abap-key.json --output ./abap.env --type abap');
-    console.log('');
-    console.log('  # ABAP with client_credentials (special cases)');
-    console.log('  mcp-auth --service-key ./abap-key.json --output ./abap.env --type abap --credential');
-    console.log('');
-    console.log('Notes:');
-    console.log('  - --type determines the provider (xsuaa or abap)');
-    console.log('  - If --env is provided and file exists, refresh token is attempted first');
-    console.log('  - If refresh fails or env file is missing, service key auth is used');
-    console.log('  - Authentication flow:');
-    console.log('    * Default: authorization_code (browser-based OAuth2)');
-    console.log('    * --credential: client_credentials (clientId/clientSecret, no browser)');
-    console.log('  - Browser options for authorization_code:');
-    console.log('    * auto (default): Try to open browser, fallback to showing URL');
-    console.log('    * none/headless: Show URL in console and wait for callback');
-    console.log('    * system/chrome/edge/firefox: Open specific browser');
-    console.log('  - Both providers (xsuaa and abap) support both flows');
-    console.log('  - --redirect-port: Port for OAuth redirect URI (default: from auth-providers, currently 61001)');
-    console.log('    * Must match redirect_uri configured in XSUAA/ABAP OAuth2 settings');
-    console.log('    * If your registered redirect URI uses a different port (e.g. 3001, 8080), pass it explicitly');
-    console.log('  - For XSUAA, serviceUrl (MCP URL) is optional - can be provided via --service-url or service key');
-    console.log('  - For ABAP, serviceUrl (SAP URL) is required - can be provided via --service-url or service key');
-    console.log('  - SAP_URL/XSUAA_MCP_URL is written to .env (from --service-url, service key, or placeholder)');
-}
-function parseArgs(args = process.argv.slice(2)) {
-    // Handle --version and --help first
-    if (args.length === 0 ||
-        args[0] === 'help' ||
-        args.includes('--help') ||
-        args.includes('-h')) {
-        showHelp();
-        process.exit(0);
-    }
-    if (args[0] === 'version' ||
-        args.includes('--version') ||
-        args.includes('-v')) {
-        console.log(getVersion());
-        process.exit(0);
-    }
-    let serviceKeyPath;
-    let envFilePath;
-    let outputFile;
-    let authType = 'abap';
-    let browser = 'auto'; // Default to auto for authorization_code flow
-    let credential = false; // Use client_credentials instead of authorization_code
-    let format = 'env';
-    let serviceUrl;
-    let redirectPort;
-    // Parse arguments
-    for (let i = 0; i < args.length; i++) {
-        if (args[i] === '--service-key' && i + 1 < args.length) {
-            serviceKeyPath = args[i + 1];
-            i++;
-        }
-        else if (args[i] === '--env' && i + 1 < args.length) {
-            envFilePath = args[i + 1];
-            i++;
-        }
-        else if (args[i] === '--output' && i + 1 < args.length) {
-            outputFile = args[i + 1];
-            i++;
-        }
-        else if (args[i] === '--type' && i + 1 < args.length) {
-            const type = args[i + 1];
-            if (type === 'abap' || type === 'xsuaa') {
-                authType = type;
-            }
-            else {
-                console.error(`Invalid auth type: ${type}. Must be 'abap' or 'xsuaa'`);
-                process.exit(1);
-            }
-            i++;
-        }
-        else if (args[i] === '--browser' && i + 1 < args.length) {
-            browser = args[i + 1];
-            if (![
-                'none',
-                'chrome',
-                'edge',
-                'firefox',
-                'system',
-                'headless',
-                'auto',
-            ].includes(browser)) {
-                console.error(`Invalid browser: ${browser}. Must be one of: none, chrome, edge, firefox, system, headless, auto`);
-                process.exit(1);
-            }
-            i++;
-        }
-        else if (args[i] === '--format' && i + 1 < args.length) {
-            const fmt = args[i + 1];
-            if (fmt === 'json' || fmt === 'env') {
-                format = fmt;
-            }
-            else {
-                console.error(`Invalid format: ${fmt}. Must be 'json' or 'env'`);
-                process.exit(1);
-            }
-            i++;
-        }
-        else if (args[i] === '--service-url' && i + 1 < args.length) {
-            serviceUrl = args[i + 1];
-            i++;
-        }
-        else if (args[i] === '--redirect-port' && i + 1 < args.length) {
-            const port = parseInt(args[i + 1], 10);
-            if (isNaN(port) || port < 1 || port > 65535) {
-                console.error(`Invalid redirect port: ${args[i + 1]}. Must be a number between 1 and 65535`);
-                process.exit(1);
-            }
-            redirectPort = port;
-            i++;
-        }
-        else if (args[i] === '--credential') {
-            credential = true;
-        }
-        else {
-            console.error(`Unknown option: ${args[i]}`);
-            console.error('Run "mcp-auth --help" for usage information');
-            process.exit(1);
-        }
-    }
-    // Validate required arguments
-    if (!outputFile) {
-        console.error('Error: --output is required');
-        console.error('');
-        console.error('Usage: mcp-auth --output <path> [--service-key <path> | --env <path>] [options]');
-        console.error('Run "mcp-auth --help" for more information');
-        process.exit(1);
-    }
-    // Either service-key or env must be provided
-    if (!serviceKeyPath && !envFilePath) {
-        console.error('Error: Either --service-key or --env must be provided');
-        console.error('');
-        console.error('Usage: mcp-auth --output <path> [--service-key <path> | --env <path>] [options]');
-        console.error('Run "mcp-auth --help" for more information');
-        process.exit(1);
-    }
-    return {
-        serviceKeyPath,
-        envFilePath,
-        outputFile,
-        authType,
-        browser,
-        credential,
-        format,
-        serviceUrl,
-        redirectPort,
-    };
-}
-function writeEnvFile(outputPath, authType, token, refreshToken, serviceUrl, uaaUrl, uaaClientId, uaaClientSecret) {
-    const lines = [];
-    if (authType === 'abap') {
-        // ABAP format
-        if (serviceUrl) {
-            lines.push(`${auth_stores_1.ABAP_CONNECTION_VARS.SERVICE_URL}=${serviceUrl}`);
-        }
-        lines.push(`${auth_stores_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token}`);
-        if (refreshToken) {
-            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=${refreshToken}`);
-        }
-        if (uaaUrl) {
-            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.UAA_URL}=${uaaUrl}`);
-        }
-        if (uaaClientId) {
-            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.UAA_CLIENT_ID}=${uaaClientId}`);
-        }
-        if (uaaClientSecret) {
-            lines.push(`${auth_stores_1.ABAP_AUTHORIZATION_VARS.UAA_CLIENT_SECRET}=${uaaClientSecret}`);
-        }
-    }
-    else {
-        // XSUAA format
-        if (serviceUrl) {
-            lines.push(`XSUAA_MCP_URL=${serviceUrl}`);
-        }
-        lines.push(`${auth_stores_1.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token}`);
-        if (refreshToken) {
-            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=${refreshToken}`);
-        }
-        if (uaaUrl) {
-            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.UAA_URL}=${uaaUrl}`);
-        }
-        if (uaaClientId) {
-            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.UAA_CLIENT_ID}=${uaaClientId}`);
-        }
-        if (uaaClientSecret) {
-            lines.push(`${auth_stores_1.XSUAA_AUTHORIZATION_VARS.UAA_CLIENT_SECRET}=${uaaClientSecret}`);
-        }
-    }
-    // Ensure output directory exists
-    const outputDir = path.dirname(outputPath);
-    if (!fs.existsSync(outputDir)) {
-        fs.mkdirSync(outputDir, { recursive: true });
-    }
-    // Write to file
-    fs.writeFileSync(outputPath, lines.join('\n') + '\n', 'utf8');
-}
-function writeJsonFile(outputPath, token, refreshToken, serviceUrl, uaaUrl, uaaClientId, uaaClientSecret) {
-    const outputData = {
-        accessToken: token,
-    };
-    if (refreshToken) {
-        outputData.refreshToken = refreshToken;
-    }
-    if (serviceUrl) {
-        outputData.serviceUrl = serviceUrl;
-    }
-    if (uaaUrl) {
-        outputData.uaaUrl = uaaUrl;
-    }
-    if (uaaClientId) {
-        outputData.uaaClientId = uaaClientId;
-    }
-    if (uaaClientSecret) {
-        outputData.uaaClientSecret = uaaClientSecret;
-    }
-    // Ensure output directory exists
-    const outputDir = path.dirname(outputPath);
-    if (!fs.existsSync(outputDir)) {
-        fs.mkdirSync(outputDir, { recursive: true });
-    }
-    // Write to file
-    fs.writeFileSync(outputPath, JSON.stringify(outputData, null, 2), 'utf8');
-}
-function runMcpSso(args) {
-    const mcpSsoPath = path.resolve(__dirname, 'mcp-sso.js');
-    const result = (0, child_process_1.spawnSync)(process.execPath, [mcpSsoPath, ...args], {
-        stdio: 'inherit',
-    });
-    if (result.error) {
-        throw result.error;
-    }
-    process.exit(result.status ?? 1);
-}
-/** The run's private working directory, created on first use and removed on any exit. */
-let runWorkDir;
-function workDir() {
-    runWorkDir ??= (0, workDir_1.createWorkDir)('mcp-auth');
-    return runWorkDir;
-}
-async function main() {
-    const rawArgs = process.argv.slice(2);
-    // `help` and `version` as commands, like every CLI in the family; they answer
-    // before any subcommand is dispatched.
-    if (rawArgs[0] === 'help') {
-        showHelp();
-        process.exit(0);
-    }
-    if (rawArgs[0] === 'version') {
-        console.log(getVersion());
-        process.exit(0);
-    }
-    const subcommand = rawArgs[0];
-    const hasSubcommand = subcommand && !subcommand.startsWith('-') && subcommand.length > 0;
-    if (hasSubcommand) {
-        const remaining = rawArgs.slice(1);
-        const ensureNoProtocol = () => {
-            if (remaining.includes('--protocol')) {
-                console.error('❌ --protocol is not supported with subcommands.');
-                process.exit(1);
-            }
-        };
-        switch (subcommand) {
-            case 'auth-code': {
-                break;
-            }
-            case 'oidc': {
-                ensureNoProtocol();
-                runMcpSso(['oidc', ...remaining]);
-                return;
-            }
-            case 'saml2-pure': {
-                ensureNoProtocol();
-                if (remaining.includes('--flow')) {
-                    const idx = remaining.indexOf('--flow');
-                    const flow = remaining[idx + 1];
-                    if (flow && flow !== 'pure') {
-                        console.error('❌ saml2-pure requires --flow pure.');
-                        process.exit(1);
-                    }
-                }
-                else {
-                    remaining.unshift('pure');
-                    remaining.unshift('--flow');
-                }
-                runMcpSso(['saml2', ...remaining]);
-                return;
-            }
-            case 'saml2-bearer': {
-                ensureNoProtocol();
-                if (!remaining.includes('--dev')) {
-                    console.error('⚠️  saml2-bearer is in progress. Re-run with --dev to enable.');
-                    process.exit(1);
-                }
-                const filtered = remaining.filter((arg) => arg !== '--dev');
-                if (filtered.includes('--flow')) {
-                    console.error('❌ saml2-bearer does not accept --flow.');
-                    process.exit(1);
-                }
-                runMcpSso(['bearer', ...filtered]);
-                return;
-            }
-            default: {
-                console.error(`Unknown command: ${subcommand}`);
-                showHelp();
-                process.exit(1);
-            }
-        }
-    }
-    const options = parseArgs(hasSubcommand ? rawArgs.slice(1) : rawArgs);
-    if (!options) {
-        // Help or version was shown, exit already handled
-        return;
-    }
-    // Resolve paths
-    const resolvedOutputPath = path.resolve(options.outputFile);
-    const resolvedEnvPath = options.envFilePath
-        ? path.resolve(options.envFilePath)
-        : undefined;
-    // If service key is provided, use it; optionally read session from env
-    let serviceKeyStore = null;
-    let destination;
-    const envExists = resolvedEnvPath ? fs.existsSync(resolvedEnvPath) : false;
-    if (resolvedEnvPath) {
-        destination = path.basename(resolvedEnvPath, path.extname(resolvedEnvPath));
-    }
-    // Store raw service key JSON for fallback parsing
-    let rawServiceKeyJson = null;
-    if (options.serviceKeyPath) {
-        const resolvedServiceKeyPath = path.resolve(options.serviceKeyPath);
-        let serviceKeyDir = path.dirname(resolvedServiceKeyPath);
-        // Check if service key file exists
-        if (!fs.existsSync(resolvedServiceKeyPath)) {
-            console.error(`❌ Service key file not found: ${resolvedServiceKeyPath}`);
-            process.exit(1);
-        }
-        const serviceKeyFileName = path.basename(resolvedServiceKeyPath, '.json');
-        if (destination && destination !== serviceKeyFileName) {
-            console.error(`❌ Destination mismatch: env file (${destination}) vs service key (${serviceKeyFileName})`);
-            process.exit(1);
-        }
-        destination = serviceKeyFileName;
-        // Determine which store to use based on service key content
-        // ABAP format has nested "uaa" object, XSUAA format has flat structure
-        let isAbapFormat = options.authType === 'abap'; // default fallback
-        try {
-            // Use JsonFileHandler to ensure consistent parsing behavior
-            const json = await auth_stores_1.JsonFileHandler.load(path.basename(resolvedServiceKeyPath), serviceKeyDir);
-            let effectiveJson = json;
-            if (json && json.credentials) {
-                console.log('🔍 Detected "credentials" wrapper -> unwrapping to temp file');
-                effectiveJson = json.credentials;
-                // Create temp file with unwrapped content to make it compatible with standard stores
-                const tempDir = workDir();
-                const tempKeyPath = path.join(tempDir, `${destination}.json`);
-                fs.writeFileSync(tempKeyPath, JSON.stringify(effectiveJson, null, 2));
-                // Point store to temp directory so it reads the unwrapped file
-                serviceKeyDir = tempDir;
-            }
-            // Store raw JSON for fallback parsing
-            rawServiceKeyJson = effectiveJson;
-            if (effectiveJson) {
-                // If it has uaa property (even if null/string/object), XSUAA parser rejects it.
-                // So we must use ABAP store which expects uaa object.
-                if (effectiveJson.uaa) {
-                    isAbapFormat = true;
-                }
-                else {
-                    isAbapFormat = false;
-                }
-            }
-        }
-        catch (e) {
-            // If parsing fails here, let the store handle the error
-        }
-        // Create appropriate stores based on detected format
-        serviceKeyStore = isAbapFormat
-            ? new auth_stores_1.AbapServiceKeyStore(serviceKeyDir)
-            : new auth_stores_1.XsuaaServiceKeyStore(serviceKeyDir);
-        // Patch serviceKeyStore for XSUAA to ensure serviceUrl is present (AuthBroker requirement)
-        // even if not in the file. XSUAA doesn't strictly need it, but AuthBroker enforces it.
-        if (options.authType === 'xsuaa') {
-            const originalGetConnectionConfig = serviceKeyStore.getConnectionConfig.bind(serviceKeyStore);
-            serviceKeyStore.getConnectionConfig = async (dest) => {
-                const config = await originalGetConnectionConfig(dest);
-                if (config && !config.serviceUrl) {
-                    config.serviceUrl = '<SERVICE_URL>';
-                }
-                return config;
-            };
-        }
-    }
-    if (!destination) {
-        console.error('❌ Destination could not be determined from inputs');
-        process.exit(1);
-    }
-    console.log(`📁 Output file: ${resolvedOutputPath}`);
-    if (resolvedEnvPath) {
-        console.log(`📁 Env file: ${resolvedEnvPath} (${envExists ? 'found' : 'not found'})`);
-    }
-    if (options.serviceKeyPath) {
-        console.log(`📁 Service key: ${path.resolve(options.serviceKeyPath)}`);
-    }
-    console.log(`🔐 Auth type: ${options.authType}`);
-    console.log(`🔑 Flow: ${options.credential ? 'client_credentials' : 'authorization_code'}`);
-    if (!options.credential) {
-        console.log(`🌐 Browser: ${options.browser}`);
-    }
-    console.log(`📄 Format: ${options.format}`);
-    if (options.serviceUrl) {
-        console.log(`🔗 Service URL: ${options.serviceUrl}`);
-    }
-    try {
-        if (!envExists && !serviceKeyStore) {
-            throw new Error('Env file not found and no service key provided.');
-        }
-        // Create temporary session store (work off a temp copy of env file)
-        const tempSessionDir = workDir();
-        if (envExists && resolvedEnvPath) {
-            const tempEnvPath = path.join(tempSessionDir, `${destination}.env`);
-            fs.copyFileSync(resolvedEnvPath, tempEnvPath);
-        }
-        // Resolve serviceUrl from service key if not provided explicitly
-        let actualServiceUrl = options.serviceUrl;
-        if (!actualServiceUrl && serviceKeyStore) {
-            try {
-                const serviceKeyConn = await serviceKeyStore.getConnectionConfig(destination);
-                actualServiceUrl = serviceKeyConn?.serviceUrl;
-            }
-            catch {
-                // For XSUAA, serviceUrl is optional and may not exist in service key
-                // This is expected - continue without serviceUrl
-            }
-        }
-        // For XSUAA, serviceUrl is optional - use placeholder only for AuthBroker internal work
-        const brokerServiceUrl = actualServiceUrl || '<SERVICE_URL>';
-        const sessionStore = options.authType === 'xsuaa'
-            ? new auth_stores_1.XsuaaSessionStore(tempSessionDir, brokerServiceUrl)
-            : new auth_stores_1.AbapSessionStore(tempSessionDir, undefined, actualServiceUrl);
-        const sessionAuthConfig = await sessionStore.getAuthorizationConfig(destination);
-        let serviceKeyAuthConfig = null;
-        if (serviceKeyStore?.getAuthorizationConfig) {
-            try {
-                serviceKeyAuthConfig =
-                    await serviceKeyStore.getAuthorizationConfig(destination);
-            }
-            catch (e) {
-                // Service key parsing might fail - try fallback parsing from raw JSON
-                console.log(`ℹ️  Store could not parse service key, using fallback parsing`);
-            }
-        }
-        // Fallback: if stores failed, try to construct authConfig from raw service key JSON
-        let fallbackAuthConfig = null;
-        if (!sessionAuthConfig && !serviceKeyAuthConfig && rawServiceKeyJson) {
-            // XSUAA format: clientid, clientsecret, url at top level
-            // ABAP format: uaa.clientid, uaa.clientsecret, uaa.url
-            const uaa = rawServiceKeyJson.uaa || rawServiceKeyJson;
-            if (uaa.clientid && uaa.clientsecret && uaa.url) {
-                fallbackAuthConfig = {
-                    uaaUrl: uaa.url,
-                    uaaClientId: uaa.clientid,
-                    uaaClientSecret: uaa.clientsecret,
-                };
-                console.log(`✅ Constructed auth config from raw service key`);
-            }
-        }
-        const authConfig = sessionAuthConfig || serviceKeyAuthConfig || fallbackAuthConfig;
-        if (!authConfig) {
-            throw new Error(`Authorization config not found for ${destination}. Service key must contain clientid, clientsecret, and url fields.`);
-        }
-        // Default: authorization_code flow with browser
-        // --credential: client_credentials flow (no browser needed)
-        // The callback port is the provider's own choice (DEFAULT_CALLBACK_PORT,
-        // currently 61001) unless the user overrides it with --redirect-port.
-        // Only resolved to a concrete number here for the URL preview below —
-        // the strategy itself re-derives the same default independently when
-        // `port` is left undefined.
-        const redirectPort = options.redirectPort ?? auth_providers_1.DEFAULT_CALLBACK_PORT;
-        // Log authorization URL for debugging
-        if (!options.credential) {
-            const redirectUri = `http://localhost:${redirectPort}/callback`;
-            const authorizationUrl = `${authConfig.uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(authConfig.uaaClientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=code`;
-            console.log(`🔗 Authorization URL: ${authorizationUrl}`);
-            console.log(`📍 Redirect URI: ${redirectUri}`);
-        }
-        const tokenProvider = options.credential
-            ? new auth_providers_1.ClientCredentialsProvider({
-                uaaUrl: authConfig.uaaUrl,
-                clientId: authConfig.uaaClientId,
-                clientSecret: authConfig.uaaClientSecret,
-            })
-            : new auth_providers_1.AuthorizationCodeProvider({
-                uaaUrl: authConfig.uaaUrl,
-                clientId: authConfig.uaaClientId,
-                clientSecret: authConfig.uaaClientSecret,
-                refreshToken: authConfig.refreshToken,
-                // Passing `options.redirectPort` (not the resolved `redirectPort`
-                // above) so an omitted --redirect-port lets the strategy bind its
-                // own default rather than this CLI pinning a number it doesn't own.
-                authorization: (0, auth_providers_1.browserCallbackStrategy)({
-                    browser: options.browser,
-                    port: options.redirectPort,
-                    timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
-                }),
-            });
-        // The output file is a self-contained session: whoever reads it refreshes
-        // the token with the UAA credentials it carries, and has no service key.
-        // So this CLI writes the credentials into its temporary session itself —
-        // its own decision about its own output. The broker no longer copies the
-        // client secret into a session store, and without these the refresh token
-        // the login obtains would not be readable back below.
-        if (!sessionAuthConfig) {
-            await sessionStore.setAuthorizationConfig(destination, authConfig);
-        }
-        const broker = new AuthBroker({
-            sessionStore,
-            serviceKeyStore: serviceKeyStore || undefined,
-            provider: tokenProvider,
-        });
-        console.log(`🔐 Getting token for destination "${destination}"...`);
-        const token = await broker.getToken(destination);
-        console.log(`✅ Token obtained successfully`);
-        const connConfig = await sessionStore.getConnectionConfig(destination);
-        // What the login left in the session, not what was known before it:
-        // `authConfig` came from the service key, which holds no refresh token,
-        // and the refresh token the login obtained went into the session store.
-        // Writing `authConfig` dropped it with the temporary session directory.
-        const savedAuthConfig = (await sessionStore.getAuthorizationConfig(destination)) ?? authConfig;
-        if (!token) {
-            throw new Error(`Token provider did not return authorization token for destination "${destination}"`);
-        }
-        const outputServiceUrl = options.serviceUrl || connConfig?.serviceUrl || actualServiceUrl;
-        // Filter out placeholder service URL
-        const finalServiceUrl = outputServiceUrl === '<SERVICE_URL>' ? undefined : outputServiceUrl;
-        // Write output file based on format
-        if (options.format === 'env') {
-            writeEnvFile(resolvedOutputPath, options.authType, token, savedAuthConfig?.refreshToken, finalServiceUrl, savedAuthConfig?.uaaUrl, savedAuthConfig?.uaaClientId, savedAuthConfig?.uaaClientSecret);
-            console.log(`✅ .env file created: ${resolvedOutputPath}`);
-            // Show what was written
-            console.log(`📋 .env file contains:`);
-            if (options.authType === 'abap') {
-                if (finalServiceUrl) {
-                    console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.SERVICE_URL}=${finalServiceUrl}`);
-                }
-                console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=<redacted, ${token.length} chars>`);
-                if (savedAuthConfig?.refreshToken) {
-                    console.log(`   - ${auth_stores_1.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=<redacted, ${savedAuthConfig.refreshToken.length} chars>`);
-                }
-            }
-            else {
-                if (finalServiceUrl) {
-                    console.log(`   - XSUAA_MCP_URL=${finalServiceUrl}`);
-                }
-                console.log(`   - ${auth_stores_1.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=<redacted, ${token.length} chars>`);
-                if (savedAuthConfig?.refreshToken) {
-                    console.log(`   - ${auth_stores_1.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=<redacted, ${savedAuthConfig.refreshToken.length} chars>`);
-                }
-            }
-        }
-        else {
-            writeJsonFile(resolvedOutputPath, token, savedAuthConfig?.refreshToken, finalServiceUrl, savedAuthConfig?.uaaUrl, savedAuthConfig?.uaaClientId, savedAuthConfig?.uaaClientSecret);
-            console.log(`✅ JSON file created: ${resolvedOutputPath}`);
-            console.log(`📋 Output contains:`);
-            console.log(`   - accessToken: <redacted, ${token.length} chars>`);
-            if (savedAuthConfig?.refreshToken) {
-                console.log(`   - refreshToken: <redacted, ${savedAuthConfig.refreshToken.length} chars>`);
-            }
-            if (finalServiceUrl) {
-                console.log(`   - serviceUrl: ${finalServiceUrl}`);
-            }
-        }
-        // Exit explicitly to close any open handles (e.g., OAuth callback server)
-        process.exit(0);
-    }
-    catch (error) {
-        console.error(`❌ Error: ${error.message}`);
-        if (error.stack) {
-            console.error(error.stack);
-        }
-        process.exit(1);
-    }
-}
-main().catch((error) => {
-    console.error('Fatal error:', error);
-    process.exit(1);
-});