@mcp-abap-adt/auth-broker 4.0.0 → 4.1.0

package/dist/AuthBroker.d.ts

@@ -19,8 +19,9 @@
  * broker does not repeat or override any of them.
  */
 import type { IDeviceCodePresenter, OidcCallbackResult } from '@mcp-abap-adt/auth-providers';
-import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IRefreshableTokenProvider, ITokenRefresher } from '@mcp-abap-adt/interfaces-auth';
+import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IClientAuthentication, IRefreshableTokenProvider, ITokenRefresher } from '@mcp-abap-adt/interfaces-auth';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import { type ClientAuthenticationStrategy } from './clientAuthentication';
 import type { IAuthorizationConfig, IConnectionConfig, IServiceKeyStore, ISessionStore } from './stores/interfaces';
 /**
  * Builds the provider for one destination, from what the stores hold for it.
@@ -31,10 +32,39 @@ import type { IAuthorizationConfig, IConnectionConfig, IServiceKeyStore, ISessio
  * - `connConfig`: the session's connection config, with `serviceUrl` resolved
  *   and the last token the session stored, so the provider can reuse it while
  *   it is valid.
+ * - `client` (optional): passed only beside a `clientAuthentication` strategy,
+ *   for a destination whose grant authenticates a client — the strategy's
+ *   answer, the client identity and the bound refresh token; never PEM. See
+ *   `TokenProviderClient`. Without a strategy the factory gets three
+ *   arguments, as 4.0.0.
  *
  * Called once per destination; the broker keeps the provider it returns.
  */
-export type TokenProviderFactory = (destination: string, authConfig: IAuthorizationConfig | null, connConfig: IConnectionConfig) => IRefreshableTokenProvider;
+export type TokenProviderFactory = (destination: string, authConfig: IAuthorizationConfig | null, connConfig: IConnectionConfig, client?: TokenProviderClient) => IRefreshableTokenProvider;
+/**
+ * The token API factory's fourth argument — present only when the broker was
+ * given a `clientAuthentication` strategy and the destination states a grant
+ * whose client authenticates; without one the factory is called with three
+ * arguments, as 4.0.0. It never carries a certificate, a key or a secret.
+ */
+export interface TokenProviderClient {
+    /** The strategy's answer, resolved before the factory is called. */
+    readonly clientAuthentication?: IClientAuthentication;
+    /**
+     * The client's identity — the secret client's `uaaUrl` when the stores hold
+     * one, else the certificate client's; absent when there is neither.
+     */
+    readonly uaaUrl?: string;
+    /** The client id beside `uaaUrl`, from the same client. */
+    readonly clientId?: string;
+    /**
+     * The refresh token the session stored, only when the session is bound to
+     * this resource and this client identity — as `authConfig` carries it on
+     * the strategy path for a secret client, so a certificate client, whose
+     * `authConfig` is `null`, gets it too.
+     */
+    readonly refreshToken?: string;
+}
 /** The grants whose provider takes an `IAuthorizationStrategy<string>`. */
 export type StrategyGrant = 'authorization_code' | 'passcode' | 'saml2_pure' | 'saml2_bearer';
 /**
@@ -71,6 +101,26 @@ export interface AuthBrokerConfig {
     samlCookies?: (destination: string) => (samlResponse: string) => Promise<string>;
     /** The replay store the SAML assertion validators share. */
     assertionReplayStore?: (destination: string) => IAssertionReplayStore;
+    /**
+     * How a destination's client authenticates to the authorization server, for
+     * every grant that authenticates one (`ClientAuthenticationGrant`). Called
+     * once when the destination's provider is built, with the client the key
+     * store answers and its certificate, read only if the strategy asks.
+     *
+     * A given strategy always answers one, or throws: there is no "nothing"
+     * answer, so an explicit choice never falls back to the secret. A throw
+     * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
+     * words. Absent: the client secret, as in 4.0.0, and nothing
+     * certificate-related is read. Shipped: `fromServiceKeyCertificate()`,
+     * `fromServiceKeySecret({ encoding })`.
+     *
+     * It applies to the providers the broker builds: `getProvider`'s, and the
+     * token API's `provider` factory, which gets its answer as a fourth
+     * argument (`TokenProviderClient`) for a grant that authenticates a client.
+     * An instance given as `provider` is already composed by the consumer, so
+     * the token API uses it as given and calls no strategy for it.
+     */
+    clientAuthentication?: ClientAuthenticationStrategy;
 }
 /**
  * AuthBroker manages authentication tokens for destinations
@@ -101,6 +151,7 @@ export declare class AuthBroker {
     private readonly deviceCodePresenter;
     private readonly samlCookies;
     private readonly assertionReplayStore;
+    private readonly clientAuthentication;
     /** getProvider's writes of the session secret, retried on their own. */
     private readonly writer;
     /**
@@ -163,12 +214,29 @@ export declare class AuthBroker {
      */
     private consumerProviderFor;
     /**
-     * The credentials a consumer's factory is built with: the session's own when
-     * it holds them, else the service key's, carrying the refresh token the
-     * session stored — the 3.x order. A session store of auth-stores 3
+     * The token API's strategy path: with a `clientAuthentication` strategy and a
+     * destination stating a grant whose client authenticates, the strategy's
+     * answer — resolved inside the guard — and the client identity: the secret
+     * client, else the certificate client's, read through the context's memoised
+     * `readCertificate`. `null` without a strategy (4.0.0: nothing
+     * certificate-related is asked) and for a grant that authenticates no
+     * client (`saml2_pure`, `none`), as `getProvider` decides.
+     *
+     * The strategy is told the grant, so a destination that states none is
+     * refused before it is called rather than built without it. (An instance
+     * given as `provider` is the consumer's own composition: the strategy
+     * applies only to what the broker builds, so it is not used there.)
+     */
+    private consumerClientAuthentication;
+    /**
+     * What a consumer's factory's credentials are composed from, read in the
+     * 3.x order: the session's authorization config; only when it has none, the
+     * session and then the key store's client. A session store of auth-stores 3
      * answers no client, so the key store's is what is found.
      */
-    private resolveAuthorizationConfig;
+    private readAuthorization;
+    /** The session the store holds for the destination, or null. */
+    private loadStoredSession;
     /**
      * `serviceUrl` for a consumer's provider, in the 3.x order: the session's,
      * else the key store's, else an error before the provider is asked.
@@ -250,8 +318,10 @@ export declare class AuthBroker {
      *   write time, so a result without one does not erase the stored one — for
      *   a provider the broker built, only a stored one bound where this one is:
      *   a refresh token obtained for another resource or from another client is
-     *   not carried into this secret. A consumer's provider was seeded
-     *   with whatever the session held, so whatever it holds is carried.
+     *   not carried into this secret. So too for a consumer's factory beside a
+     *   `clientAuthentication` strategy, seeded only with a bound session. A
+     *   consumer's provider without one was seeded with whatever the session
+     *   held, so whatever it holds is carried (4.0.0).
      * - `issuedFor` / `issuedBy`: the binding computed when the provider was
      *   built, each left out when the means lack its source — so the
      *   store clears it.

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,yBAAyB,EACzB,eAAe,EAEhB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAkB9D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAS7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,EACvC,UAAU,EAAE,iBAAiB,KAC1B,yBAAyB,CAAC;AAE/B,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,UAAU,GACV,YAAY,GACZ,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,YAAY,EAAE,aAAa,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,yBAAyB,GAAG,oBAAoB,CAAC;IAM5D,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,KACjB,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACpC,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAClB,WAAW,EAAE,MAAM,KAChB,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAChD,qDAAqD;IACrD,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACpE,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CACZ,WAAW,EAAE,MAAM,KAChB,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC;CACvE;AA8FD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGX;IACd,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IACJ,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAClE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwC;IAC1E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA0C;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD;;;OAGG;gBACS,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO;IAmFtD;;;;;;;;;;;;;;;;;OAiBG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,MAAM;IAWpB;;;;;;OAMG;YACW,eAAe;IAoB7B,iDAAiD;YACnC,YAAY;IAqC1B;;;;;OAKG;YACW,kBAAkB;IA8BhC,wFAAwF;IACxF,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IAiD3B;;;;;OAKG;YACW,0BAA0B;IAiCxC;;;OAGG;YACW,iBAAiB;IAuB/B;;;;;;;;;;OAUG;YACW,IAAI;IAgBlB;;;;;OAKG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAwBvC;;;;;;OAMG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAyBpC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YAiB1C,KAAK;IAoHnB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;;;;;;;;;;;;;;;;;;;;OAuBG;YACW,WAAW;IAmDzB;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAM3D"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,yBAAyB,EACzB,eAAe,EAEhB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAQ9D,OAAO,EACL,KAAK,4BAA4B,EAMlC,MAAM,wBAAwB,CAAC;AAiBhC,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAS7B;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,EACvC,UAAU,EAAE,iBAAiB,EAC7B,MAAM,CAAC,EAAE,mBAAmB,KACzB,yBAAyB,CAAC;AAE/B;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IACtD;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,2EAA2E;AAC3E,MAAM,MAAM,aAAa,GACrB,oBAAoB,GACpB,UAAU,GACV,YAAY,GACZ,cAAc,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,YAAY,EAAE,aAAa,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,yBAAyB,GAAG,oBAAoB,CAAC;IAM5D,0EAA0E;IAC1E,aAAa,CAAC,EAAE,CACd,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,aAAa,KACjB,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACpC,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,CAClB,WAAW,EAAE,MAAM,KAChB,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAChD,qDAAqD;IACrD,mBAAmB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC;IACpE,8EAA8E;IAC9E,WAAW,CAAC,EAAE,CACZ,WAAW,EAAE,MAAM,KAChB,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC;IACtE;;;;;;;;;;;;;;;;;;OAkBG;IACH,oBAAoB,CAAC,EAAE,4BAA4B,CAAC;CACrD;AA4LD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAGX;IACd,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6C;IAC3E;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,KAAK,CAA6C;IACnE;;;;;;OAMG;IACH,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IACJ,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAoC;IAClE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAwC;IAC1E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA0C;IAC9E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkC;IAC9D,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2C;IAChF,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6B;IAEpD;;;OAGG;gBACS,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO;IAoFtD;;;;;;;;;;;;;;;;;OAiBG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,MAAM;IAWpB;;;;;;OAMG;YACW,eAAe;IAoB7B,iDAAiD;YACnC,YAAY;IAqC1B;;;;;OAKG;YACW,kBAAkB;IA8BhC,wFAAwF;IACxF,OAAO,CAAC,gBAAgB;IAOxB;;;;;;;OAOG;IACH,OAAO,CAAC,mBAAmB;IA8G3B;;;;;;;;;;;;;OAaG;YACW,4BAA4B;IA4C1C;;;;;OAKG;YACW,iBAAiB;IAqB/B,gEAAgE;IAChE,OAAO,CAAC,iBAAiB;IAMzB;;;OAGG;YACW,iBAAiB;IAuB/B;;;;;;;;;;OAUG;YACW,IAAI;IAgBlB;;;;;OAKG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAwBvC;;;;;;OAMG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAyBpC;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;YAiB1C,KAAK;IAmJnB;;;;;OAKG;IACH,OAAO,CAAC,gBAAgB;IAkBxB;;;;;OAKG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,WAAW;IAmDzB;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAM3D"}

package/dist/AuthBroker.js

@@ -24,6 +24,7 @@ exports.AuthBroker = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const binding_1 = require("./binding");
 const bindingOf_1 = require("./bindingOf");
+const clientAuthentication_1 = require("./clientAuthentication");
 const DestinationConfigError_1 = require("./DestinationConfigError");
 const destinations_1 = require("./destinations");
 const SessionWriter_1 = require("./SessionWriter");
@@ -43,6 +44,37 @@ const SECRET_FIELDS = [
     'issuedBy',
 ];
 const isSecretField = (field) => SECRET_FIELDS.includes(field);
+/**
+ * The connection means a strategy-path seed carries — the connection's own,
+ * none of them a secret. Everything else a store's connection read answers
+ * (credentials, grant data, fields outside the type) stays behind.
+ */
+const SEED_MEANS = [
+    'serviceUrl',
+    'sapClient',
+    'language',
+    'authType',
+    'grantType',
+];
+/**
+ * The token API factory's seed on the `clientAuthentication` strategy path,
+ * from an allowlist only: `SEED_MEANS`, and the session secret's own fields
+ * (`SECRET_FIELDS`: the token or cookies, the expiry, the binding) only when
+ * that same read is bound here — each secret judged by the read it came from.
+ * `serviceUrl` is the one resolved for the destination.
+ */
+function strategySeed(connConfig, binding, serviceUrl) {
+    const source = (connConfig ?? {});
+    const fields = connConfig && (0, binding_1.boundHere)(connConfig, binding)
+        ? [...SEED_MEANS, ...SECRET_FIELDS]
+        : SEED_MEANS;
+    const seed = {};
+    for (const field of fields) {
+        if (source[field] !== undefined)
+            seed[field] = source[field];
+    }
+    return { ...seed, serviceUrl };
+}
 /** When the result expires, in epoch ms: its own `expiresAt`, else `expiresIn` from now. */
 function expiryOf(result) {
     if (typeof result.expiresAt === 'number')
@@ -58,6 +90,39 @@ function obtainsTokens(provider) {
     return (typeof candidate.getTokens === 'function' &&
         typeof candidate.refreshTokens === 'function');
 }
+/** The refresh token a stored session holds, unchecked. */
+function storedRefreshTokenOf(session) {
+    return typeof session?.refreshToken === 'string'
+        ? session.refreshToken
+        : undefined;
+}
+/**
+ * The 3.x composition, the no-strategy path: the session's client as it is,
+ * else the key store's with `refreshToken` — the one given, else the key's
+ * own. (The strategy path takes `strategyAuthorization`.)
+ */
+function composeAuthorization(read, refreshToken) {
+    if (read.sessionAuth)
+        return read.sessionAuth;
+    if (!read.keyAuth)
+        return null;
+    return {
+        ...read.keyAuth,
+        refreshToken: refreshToken ?? read.keyAuth.refreshToken,
+    };
+}
+/**
+ * The client on the `clientAuthentication` strategy path: the session's own
+ * client, else the key store's, carrying only `refreshToken` — the one the
+ * session read whose binding was checked holds, when bound — never a refresh
+ * token either client read carried itself.
+ */
+function strategyAuthorization(read, refreshToken) {
+    // The same allowlist the strategy is told (`contextClient`): nothing else a
+    // store's authorization-config read carried reaches the factory.
+    const client = (0, clientAuthentication_1.contextClient)(read.sessionAuth ?? read.keyAuth);
+    return client ? { ...client, refreshToken } : null;
+}
 /** A stored string that counts as present: `''` is none. */
 function present(value) {
     return typeof value === 'string' && value !== '';
@@ -105,6 +170,7 @@ class AuthBroker {
     deviceCodePresenter;
     samlCookies;
     assertionReplayStore;
+    clientAuthentication;
     /** getProvider's writes of the session secret, retried on their own. */
     writer;
     /**
@@ -158,6 +224,7 @@ class AuthBroker {
         this.deviceCodePresenter = config.deviceCodePresenter;
         this.samlCookies = config.samlCookies;
         this.assertionReplayStore = config.assertionReplayStore;
+        this.clientAuthentication = config.clientAuthentication;
         this.logger = logger ?? noOpLogger;
         this.writer = new SessionWriter_1.SessionWriter(async (destination, bound) => {
             try {
@@ -268,14 +335,14 @@ class AuthBroker {
     async obtainFromConsumer(destination, method, means) {
         const connConfig = await this.read(destination, 'session connection config', () => this.sessionStore.getConnectionConfig(destination));
         const serviceUrl = await this.resolveServiceUrl(destination, connConfig);
-        const { provider, binding } = await this.consumerProviderFor(destination, serviceUrl, connConfig, means);
+        const { provider, binding, carry } = await this.consumerProviderFor(destination, serviceUrl, connConfig, means);
         this.logger.debug(`[AuthBroker] ${method} for ${destination}`);
         const result = checked(destination, await provider[method]());
         await this.writer.submit(destination, {
             result: { ...result, expiresAt: expiryOf(result) },
             original: result,
             binding,
-            carry: 'any',
+            carry,
         });
         this.throwFailedWrite(destination, result);
         return result;
@@ -309,22 +376,76 @@ class AuthBroker {
                 return {
                     provider,
                     binding: (0, binding_1.consumerBinding)(serviceUrl, sapClient, null),
+                    carry: 'any',
                 };
             }
-            const client = await this.resolveAuthorizationConfig(destination);
-            const built = provider(destination, client, {
-                ...(connConfig ?? {}),
-                serviceUrl,
-            });
+            const read = await this.readAuthorization(destination);
+            const strategic = await this.consumerClientAuthentication(destination, means, 
+            // The strategy is told the client, never a refresh token read with it.
+            strategyAuthorization(read, undefined));
+            let built;
+            let client;
+            let binding;
+            let carry;
+            if (strategic) {
+                // The strategy's answer and the client identity, resolved before the
+                // factory; the factory called inside the same guard: a throw is fixed
+                // words, nothing of the thrown value, no cause. The stored refresh
+                // token is carried only when the session is bound to this resource
+                // and this client identity — never to another authorization server.
+                binding = (0, binding_1.strategyBinding)((0, binding_1.consumerBinding)(serviceUrl, sapClient, strategic.identity));
+                const session = read.sessionRead
+                    ? read.session
+                    : await this.loadStoredSession(destination);
+                const bound = !!session && (0, binding_1.boundHere)(session, binding);
+                const boundRefreshToken = bound
+                    ? storedRefreshTokenOf(session)
+                    : undefined;
+                // The client without any refresh token of its own read: a session
+                // store's `getAuthorizationConfig` is another read than the session
+                // whose binding was checked, and another process may have written
+                // between them. The refresh token comes only from that checked read.
+                client = strategyAuthorization(read, boundRefreshToken);
+                // Each stored secret is judged by the read it came from: the seed's
+                // token, cookies and expiry by the binding the connection read itself
+                // carries — another process may have written between the two reads —
+                // else only the means seed the provider.
+                const seed = strategySeed(connConfig, binding, serviceUrl);
+                carry = 'bound';
+                const refreshToken = client ? client.refreshToken : boundRefreshToken;
+                const fourth = {
+                    clientAuthentication: strategic.clientAuthentication,
+                    ...(strategic.identity
+                        ? {
+                            uaaUrl: strategic.identity.uaaUrl,
+                            clientId: strategic.identity.uaaClientId,
+                        }
+                        : {}),
+                    ...(present(refreshToken) ? { refreshToken } : {}),
+                };
+                try {
+                    built = provider(destination, client, seed, fourth);
+                }
+                catch {
+                    throw new DestinationConfigError_1.DestinationConfigError(destination, ['provider', 'clientAuthentication'], 'the token provider factory failed beside the clientAuthentication strategy');
+                }
+            }
+            else {
+                // 4.0.0: the stored secret and refresh token carried over as read.
+                client = composeAuthorization(read, storedRefreshTokenOf(read.session));
+                binding = (0, binding_1.consumerBinding)(serviceUrl, sapClient, client);
+                carry = 'any';
+                built = provider(destination, client, {
+                    ...(connConfig ?? {}),
+                    serviceUrl,
+                });
+            }
             this.logger.debug(`[AuthBroker] Provider built for ${destination}`, {
                 hasCredentials: !!client,
                 hasRefreshToken: !!client?.refreshToken,
                 hasStoredToken: !!(connConfig?.authorizationToken || connConfig?.sessionCookies),
             });
-            return {
-                provider: built,
-                binding: (0, binding_1.consumerBinding)(serviceUrl, sapClient, client),
-            };
+            return { provider: built, binding, carry };
         });
         this.consumerBuilt.set(destination, build);
         build.catch(() => {
@@ -335,31 +456,61 @@ class AuthBroker {
         return build;
     }
     /**
-     * The credentials a consumer's factory is built with: the session's own when
-     * it holds them, else the service key's, carrying the refresh token the
-     * session stored — the 3.x order. A session store of auth-stores 3
+     * The token API's strategy path: with a `clientAuthentication` strategy and a
+     * destination stating a grant whose client authenticates, the strategy's
+     * answer — resolved inside the guard — and the client identity: the secret
+     * client, else the certificate client's, read through the context's memoised
+     * `readCertificate`. `null` without a strategy (4.0.0: nothing
+     * certificate-related is asked) and for a grant that authenticates no
+     * client (`saml2_pure`, `none`), as `getProvider` decides.
+     *
+     * The strategy is told the grant, so a destination that states none is
+     * refused before it is called rather than built without it. (An instance
+     * given as `provider` is the consumer's own composition: the strategy
+     * applies only to what the broker builds, so it is not used there.)
+     */
+    async consumerClientAuthentication(destination, means, client) {
+        const strategy = this.clientAuthentication;
+        if (!strategy) {
+            return null;
+        }
+        // basic and snc never get here: the token API refuses them first
+        // (`statedForTokens`).
+        if (!means || (means.authType !== 'jwt' && means.authType !== 'saml')) {
+            throw new DestinationConfigError_1.DestinationConfigError(destination, ['authType', 'grantType'], 'a clientAuthentication strategy is told the grant: the destination must state its authType and grantType');
+        }
+        const grant = (0, destinations_1.statedGrant)(destination, means.authType, means);
+        if (grant === 'saml2_pure' || grant === 'none') {
+            return null;
+        }
+        const serviceKeyStore = this.serviceKeyStore;
+        const context = (0, clientAuthentication_1.clientAuthenticationContext)(destination, grant, client, () => this.read(destination, 'client certificate', async () => serviceKeyStore?.getClientCertificate
+            ? serviceKeyStore.getClientCertificate(destination)
+            : null));
+        const clientAuthentication = await (0, clientAuthentication_1.resolveClientAuthentication)(strategy, context);
+        return { clientAuthentication, identity: await (0, clientAuthentication_1.clientIdentity)(context) };
+    }
+    /**
+     * What a consumer's factory's credentials are composed from, read in the
+     * 3.x order: the session's authorization config; only when it has none, the
+     * session and then the key store's client. A session store of auth-stores 3
      * answers no client, so the key store's is what is found.
      */
-    async resolveAuthorizationConfig(destination) {
+    async readAuthorization(destination) {
         const sessionAuth = await this.read(destination, 'session authorization config', () => this.sessionStore.getAuthorizationConfig(destination));
         if (sessionAuth) {
-            return sessionAuth;
+            return { sessionAuth, keyAuth: null, session: null, sessionRead: false };
         }
-        const session = await this.read(destination, 'session', () => this.sessionStore.loadSession(destination));
-        const storedRefreshToken = typeof session?.refreshToken === 'string'
-            ? session.refreshToken
-            : undefined;
+        const session = await this.loadStoredSession(destination);
         const serviceKeyStore = this.serviceKeyStore;
         const keyAuth = serviceKeyStore
             ? await this.read(destination, 'service key authorization config', () => serviceKeyStore.getAuthorizationConfig(destination))
             : null;
-        if (!keyAuth) {
-            return null;
-        }
-        return {
-            ...keyAuth,
-            refreshToken: storedRefreshToken ?? keyAuth.refreshToken,
-        };
+        return { sessionAuth: null, keyAuth, session, sessionRead: true };
+    }
+    /** The session the store holds for the destination, or null. */
+    loadStoredSession(destination) {
+        return this.read(destination, 'session', () => this.sessionStore.loadSession(destination));
     }
     /**
      * `serviceUrl` for a consumer's provider, in the 3.x order: the session's,
@@ -509,10 +660,29 @@ class AuthBroker {
                 // saml2_pure), what a secret for this destination is bound to
                 // — written with every secret, and required of a stored one
                 // before it seeds — and the stored secret when it is.
-                const client = grant === 'saml2_pure'
+                const secretClient = grant === 'saml2_pure'
                     ? null
                     : await this.read(destination, 'client', () => serviceKeyStore.getAuthorizationConfig(destination));
-                const binding = (0, bindingOf_1.destinationBinding)(authType, grant, stated, client);
+                // The consumer's client authentication, resolved inside the guard
+                // before any provider exists: a strategy that throws leaves nothing
+                // built and nothing cached. Then the client identity the row and the
+                // binding take — the secret client, else the certificate client's —
+                // so the binding and the seed are chosen from it. Without a strategy
+                // nothing of this runs: 4.0.0's client, nothing certificate-related.
+                let client = secretClient;
+                let clientAuthentication;
+                if (this.clientAuthentication && grant !== 'saml2_pure') {
+                    const context = (0, clientAuthentication_1.clientAuthenticationContext)(destination, grant, secretClient, () => this.read(destination, 'client certificate', async () => serviceKeyStore.getClientCertificate
+                        ? serviceKeyStore.getClientCertificate(destination)
+                        : null));
+                    clientAuthentication = await (0, clientAuthentication_1.resolveClientAuthentication)(this.clientAuthentication, context);
+                    client = await (0, clientAuthentication_1.clientIdentity)(context);
+                }
+                const computed = (0, bindingOf_1.destinationBinding)(authType, grant, stated, client);
+                // The strategy path: a resource neither side states matches.
+                const binding = clientAuthentication
+                    ? (0, binding_1.strategyBinding)(computed)
+                    : computed;
                 const stored = grant === 'client_credentials'
                     ? null
                     : await this.read(destination, 'session', () => this.sessionStore.loadSession(destination));
@@ -531,6 +701,7 @@ class AuthBroker {
                     destination,
                     client,
                     secret,
+                    ...(clientAuthentication ? { clientAuthentication } : {}),
                     logger: this.logger,
                     onTokens,
                 };
@@ -623,8 +794,10 @@ class AuthBroker {
      *   write time, so a result without one does not erase the stored one — for
      *   a provider the broker built, only a stored one bound where this one is:
      *   a refresh token obtained for another resource or from another client is
-     *   not carried into this secret. A consumer's provider was seeded
-     *   with whatever the session held, so whatever it holds is carried.
+     *   not carried into this secret. So too for a consumer's factory beside a
+     *   `clientAuthentication` strategy, seeded only with a bound session. A
+     *   consumer's provider without one was seeded with whatever the session
+     *   held, so whatever it holds is carried (4.0.0).
      * - `issuedFor` / `issuedBy`: the binding computed when the provider was
      *   built, each left out when the means lack its source — so the
      *   store clears it.

package/dist/binding.d.ts

@@ -24,6 +24,8 @@
  */
 import type { IConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
 import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+/** What a binding reads of a client: who it is, never its secret. */
+export type BoundClient = Pick<IAuthorizationConfig, 'uaaUrl' | 'uaaClientId'>;
 /**
  * The resource: `serviceUrl` with the SAP client as `sap-client` — the
  * destination's `sapClient` when it states one, over a `sap-client` already in
@@ -51,19 +53,28 @@ export interface Binding {
      * matches nothing.
      */
     issuerStated: boolean;
+    /**
+     * Set on the `clientAuthentication` strategy path only: a resource neither
+     * side states — no `issuedFor` computed (no service URL, or one that does
+     * not parse, as the CLI's XSUAA placeholder) and none stored — matches, so
+     * the issuer and client alone decide. A resource stated on one side only
+     * never matches. Without it (the 4.0.0 path) an absent resource matches
+     * nothing.
+     */
+    unstatedResourceMatches?: true;
 }
 /**
  * The UAA grants (`authorization_code`, `client_credentials`, `passcode`) and
  * `saml2_bearer`, whose token UAA issues to its client: the resource, and `uaaUrl` with `uaaClientId` — both required to match.
  */
-export declare function uaaBinding(means: IConnectionConfig, client: IAuthorizationConfig | null): Binding;
+export declare function uaaBinding(means: IConnectionConfig, client: BoundClient | null): Binding;
 /**
  * The OIDC grants: the resource, and the issuer — `oidcIssuerUrl`, else
  * `uaaUrl` — with `uaaClientId`; both required to match. Means that state
  * neither issuer (explicit endpoints alone) bind no stored secret: one is then
  * never seeded.
  */
-export declare function oidcBinding(means: IConnectionConfig, client: IAuthorizationConfig | null): Binding;
+export declare function oidcBinding(means: IConnectionConfig, client: BoundClient | null): Binding;
 /**
  * `saml2_pure`: the resource, and the ACS of the system that sets the
  * cookies — `samlAcsUrl`, origin and path; both required to match.
@@ -76,20 +87,31 @@ export declare function samlPureBinding(means: IConnectionConfig): Binding;
  * handed no client, so no issuer is claimed for what it obtains: `issuedBy` is
  * then absent, and `getProvider` never seeds from that secret.
  */
-export declare function consumerBinding(serviceUrl: string, sapClient: string | undefined, client: IAuthorizationConfig | null): Binding;
+export declare function consumerBinding(serviceUrl: string, sapClient: string | undefined, client: BoundClient | null): Binding;
+/**
+ * A binding on the `clientAuthentication` strategy path: a resource that
+ * neither the means nor the stored session state matches, so the issuer and
+ * client alone decide (`Binding.unstatedResourceMatches`).
+ */
+export declare function strategyBinding(binding: Binding): Binding;
 /**
  * A `none` row: the resource always; the issuer only when the means state one
  * — `oidcIssuerUrl` (with `uaaClientId` when stated) or the client (`uaaUrl`
  * and `uaaClientId`) for `jwt`, `samlAcsUrl` for `saml`.
  */
-export declare function handedOverBinding(authType: 'jwt' | 'saml', means: IConnectionConfig, client: IAuthorizationConfig | null): Binding;
-/** The stored `issuedFor`, canonicalised, equals the destination's. */
+export declare function handedOverBinding(authType: 'jwt' | 'saml', means: IConnectionConfig, client: BoundClient | null): Binding;
+/**
+ * The stored `issuedFor`, canonicalised, equals the destination's — or, with
+ * `unstatedResourceMatches`, neither states one.
+ */
 export declare function sameResource(stored: IConfig | null, binding: Binding): boolean;
 /** The stored `issuedBy`, canonicalised as the destination's kind, equals it. */
 export declare function sameIssuer(stored: IConfig | null, binding: Binding): boolean;
 /**
  * An obtained secret is this destination's only when **both** stored values
- * equal the computed ones; either absent, on either side, is not a match.
+ * equal the computed ones; either absent, on either side, is not a match —
+ * save a resource absent on both sides of a strategy-path binding
+ * (`unstatedResourceMatches`).
  */
 export declare function boundHere(stored: IConfig | null, binding: Binding): boolean;
 //# sourceMappingURL=binding.d.ts.map

package/dist/binding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AA6C9E;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,OAAO,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAEpB;AAED,4EAA4E;AAC5E,wBAAgB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE1D;AAED,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1C,+FAA+F;AAC/F,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAUD;;;GAGG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,OAAO,CAUT;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,OAAO,CAWT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAOjE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,OAAO,CA4BT;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAKT;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAI5E;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAE3E"}
+{"version":3,"file":"binding.d.ts","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAE9E,qEAAqE;AACrE,MAAM,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,aAAa,CAAC,CAAC;AA6C/E;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,OAAO,EACnB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAEpB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CACvB,SAAS,EAAE,OAAO,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,MAAM,GAAG,SAAS,CAEpB;AAED,4EAA4E;AAC5E,wBAAgB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE1D;AAED,mFAAmF;AACnF,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE1C,+FAA+F;AAC/F,MAAM,WAAW,OAAO;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,UAAU,EAAE,UAAU,CAAC;IACvB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,IAAI,CAAC;CAChC;AAUD;;;GAGG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,WAAW,GAAG,IAAI,GACzB,OAAO,CAUT;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,WAAW,GAAG,IAAI,GACzB,OAAO,CAWT;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAOjE;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,MAAM,EAAE,WAAW,GAAG,IAAI,GACzB,OAAO,CAET;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,WAAW,GAAG,IAAI,GACzB,OAAO,CA4BT;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,OAAO,CAOT;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAI5E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAE3E"}

package/dist/binding.js

@@ -31,6 +31,7 @@ exports.uaaBinding = uaaBinding;
 exports.oidcBinding = oidcBinding;
 exports.samlPureBinding = samlPureBinding;
 exports.consumerBinding = consumerBinding;
+exports.strategyBinding = strategyBinding;
 exports.handedOverBinding = handedOverBinding;
 exports.sameResource = sameResource;
 exports.sameIssuer = sameIssuer;
@@ -152,6 +153,14 @@ function samlPureBinding(means) {
 function consumerBinding(serviceUrl, sapClient, client) {
     return uaaBinding({ serviceUrl, sapClient }, client);
 }
+/**
+ * A binding on the `clientAuthentication` strategy path: a resource that
+ * neither the means nor the stored session state matches, so the issuer and
+ * client alone decide (`Binding.unstatedResourceMatches`).
+ */
+function strategyBinding(binding) {
+    return { ...binding, unstatedResourceMatches: true };
+}
 /**
  * A `none` row: the resource always; the issuer only when the means state one
  * — `oidcIssuerUrl` (with `uaaClientId` when stated) or the client (`uaaUrl`
@@ -186,10 +195,15 @@ function handedOverBinding(authType, means, client) {
         issuerStated: stated,
     };
 }
-/** The stored `issuedFor`, canonicalised, equals the destination's. */
+/**
+ * The stored `issuedFor`, canonicalised, equals the destination's — or, with
+ * `unstatedResourceMatches`, neither states one.
+ */
 function sameResource(stored, binding) {
-    return (binding.issuedFor !== undefined &&
-        resourceUri(stored?.issuedFor) === binding.issuedFor);
+    if (binding.issuedFor === undefined) {
+        return (binding.unstatedResourceMatches === true && !present(stored?.issuedFor));
+    }
+    return resourceUri(stored?.issuedFor) === binding.issuedFor;
 }
 /** The stored `issuedBy`, canonicalised as the destination's kind, equals it. */
 function sameIssuer(stored, binding) {
@@ -200,7 +214,9 @@ function sameIssuer(stored, binding) {
 }
 /**
  * An obtained secret is this destination's only when **both** stored values
- * equal the computed ones; either absent, on either side, is not a match.
+ * equal the computed ones; either absent, on either side, is not a match —
+ * save a resource absent on both sides of a strategy-path binding
+ * (`unstatedResourceMatches`).
  */
 function boundHere(stored, binding) {
     return sameResource(stored, binding) && sameIssuer(stored, binding);

package/dist/bindingOf.d.ts

@@ -6,6 +6,7 @@
  */
 import type { DestinationGrant, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
 import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { BoundClient } from './binding';
 import { type Binding } from './binding';
 /**
  * The binding of a `jwt` or `saml` destination with the grant it states: the
@@ -13,7 +14,7 @@ import { type Binding } from './binding';
  * the issuer and the client, `saml2_pure` by its ACS, and `none` by what the
  * means state.
  */
-export declare function destinationBinding(authType: 'jwt' | 'saml', grant: DestinationGrant, means: IConnectionConfig, client: IAuthorizationConfig | null): Binding;
+export declare function destinationBinding(authType: 'jwt' | 'saml', grant: DestinationGrant, means: IConnectionConfig, client: BoundClient | null): Binding;
 /** The two strings a session store keeps beside a secret; absent where the means cannot say. */
 export interface SecretBinding {
     issuedFor?: string;

package/dist/bindingOf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindingOf.d.ts","sourceRoot":"","sources":["../src/bindingOf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,WAAW,CAAC;AAGnB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,OAAO,CAKT;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,GAAE,oBAAoB,GAAG,IAAW,GACzC,aAAa,CAcf"}
+{"version":3,"file":"bindingOf.d.ts","sourceRoot":"","sources":["../src/bindingOf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,KAAK,OAAO,EAKb,MAAM,WAAW,CAAC;AAGnB;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,WAAW,GAAG,IAAI,GACzB,OAAO,CAKT;AAED,gGAAgG;AAChG,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,iBAAiB,EACxB,MAAM,GAAE,oBAAoB,GAAG,IAAW,GACzC,aAAa,CAcf"}