@mcp-abap-adt/auth-broker 4.0.0 → 4.1.0

package/dist/clientAuthentication.d.ts

@@ -0,0 +1,109 @@
+/**
+ * How a destination's client authenticates to the authorization server — the
+ * consumer's choice, as a strategy (`AuthBrokerConfig.clientAuthentication`).
+ *
+ * The broker ships two factories, each failing closed: one answers the
+ * certificate the key store holds, one the secret. Neither falls back to the
+ * other; a consumer that wants a fallback composes it, and its order is the
+ * consumer's statement. Whatever a strategy throws, the broker turns into a
+ * `DestinationConfigError` in fixed words (`resolveClientAuthentication`) —
+ * nothing of the thrown value, no `cause`.
+ */
+import type { IClientAuthentication } from '@mcp-abap-adt/interfaces-auth';
+import type { IClientCertificate } from '@mcp-abap-adt/interfaces-auth-broker';
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+/**
+ * Every grant whose client authenticates to the authorization server: the
+ * three UAA grants, the OIDC grants and `saml2_bearer`. (`saml2_pure` and the
+ * basic, SNC and handed-over rows authenticate no client and never call the
+ * strategy.)
+ */
+export type ClientAuthenticationGrant = 'client_credentials' | 'authorization_code' | 'passcode' | 'oidc_authorization_code' | 'device_code' | 'password' | 'token_exchange' | 'saml2_bearer';
+/** What a strategy is given, once per build of a destination's provider. */
+export interface ClientAuthenticationContext {
+    readonly destination: string;
+    readonly grant: ClientAuthenticationGrant;
+    /**
+     * The secret client the key store's `getAuthorizationConfig` answered —
+     * `uaaUrl`, `uaaClientId`, `uaaClientSecret` only, never a refresh token —
+     * or null.
+     */
+    readonly client: IAuthorizationConfig | null;
+    /**
+     * The key store's certificate client, read only when called and at most
+     * once per build; `null` when the store has none or implements no
+     * `getClientCertificate`.
+     */
+    readCertificate(): Promise<IClientCertificate | null>;
+}
+/** The strategy `AuthBrokerConfig.clientAuthentication` takes. */
+export type ClientAuthenticationStrategy = (context: ClientAuthenticationContext) => Promise<IClientAuthentication>;
+/**
+ * `tls_client_auth` with the certificate and key the key store holds, against
+ * `${certUrl}/oauth/token`. The material is handed over as given and checked
+ * before the factory answers — auth-providers checks it only on first use, so
+ * a malformed, incomplete or expired PEM would otherwise surface only at the
+ * first token request, in a provider already built and cached.
+ *
+ * Throws "the destination has no client certificate" when the store answers
+ * `null` or implements no `getClientCertificate`.
+ */
+export declare function fromServiceKeyCertificate(): ClientAuthenticationStrategy;
+/** How `fromServiceKeySecret` writes the client id and secret. */
+export interface FromServiceKeySecretOptions {
+    /**
+     * `'raw'`: `base64(id:secret)` as given — XSUAA accepts only this
+     * (measured). `'form'`: each component form-encoded first (RFC 6749
+     * §2.3.1) — UAA, Keycloak. Required: it depends on the server.
+     */
+    readonly encoding: 'raw' | 'form';
+}
+/**
+ * `client_secret_basic` with the secret client the key store holds.
+ *
+ * Throws "the destination has no client secret" when the store answers no
+ * secret client, or one with an empty secret. A missing or unknown `encoding`
+ * is refused when the factory is made.
+ */
+export declare function fromServiceKeySecret(options: FromServiceKeySecretOptions): ClientAuthenticationStrategy;
+/**
+ * What a strategy is told of the secret client: an allowlist — who it is
+ * (`uaaUrl`, `uaaClientId`) and its secret (`uaaClientSecret`, which
+ * `fromServiceKeySecret` sends) — never a refresh token or any other field a
+ * store's `getAuthorizationConfig` carried, which no binding has checked.
+ */
+export declare function contextClient(client: IAuthorizationConfig | null): IAuthorizationConfig | null;
+/**
+ * The context for one build: the client through `contextClient`;
+ * `readCertificate` lazy and memoised — the first call reads, every later one
+ * gets the same answer.
+ */
+export declare function clientAuthenticationContext(destination: string, grant: ClientAuthenticationGrant, client: IAuthorizationConfig | null, read: () => Promise<IClientCertificate | null>): ClientAuthenticationContext;
+/**
+ * Runs the strategy inside the guard. Any throw — the strategy's own, a
+ * store's, a malformed PEM — and any answer that is no client authentication
+ * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
+ * words: no `cause`, nothing of the thrown value.
+ */
+export declare function resolveClientAuthentication(strategy: ClientAuthenticationStrategy, context: ClientAuthenticationContext): Promise<IClientAuthentication>;
+/**
+ * Who the client is — its authorization server and client id — and nothing
+ * else: no secret field, so it can never be taken for a (public) secret
+ * client, and never PEM.
+ */
+export interface ClientIdentity {
+    readonly uaaUrl: string;
+    readonly uaaClientId: string;
+}
+/**
+ * The client identity a strategy-authenticated row and its binding take: the
+ * secret client's `uaaUrl` and `uaaClientId` when the key store has one, else
+ * the certificate client's `uaaUrl` and `clientId` — read through the
+ * context's memoised `readCertificate`, so at most once per build — else
+ * `null`. The secret stays behind: beside a strategy a row passes none.
+ *
+ * A failing read is a `DestinationConfigError` naming `clientAuthentication`
+ * in fixed words — nothing of what the store threw, no `cause`.
+ */
+export declare function clientIdentity(context: ClientAuthenticationContext): Promise<ClientIdentity | null>;
+//# sourceMappingURL=clientAuthentication.d.ts.map

package/dist/clientAuthentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clientAuthentication.d.ts","sourceRoot":"","sources":["../src/clientAuthentication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAG9E;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,oBAAoB,GACpB,UAAU,GACV,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,cAAc,CAAC;AAEnB,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,kEAAkE;AAClE,MAAM,MAAM,4BAA4B,GAAG,CACzC,OAAO,EAAE,2BAA2B,KACjC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAsBpC;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,IAAI,4BAA4B,CAgBxE;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,4BAA4B,CAc9B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,oBAAoB,GAAG,IAAI,CAO7B;AAmBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,oBAAoB,GAAG,IAAI,EACnC,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAC7C,2BAA2B,CAW7B;AAiCD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,4BAA4B,EACtC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBhC"}

package/dist/clientAuthentication.js

@@ -0,0 +1,218 @@
+"use strict";
+/**
+ * How a destination's client authenticates to the authorization server — the
+ * consumer's choice, as a strategy (`AuthBrokerConfig.clientAuthentication`).
+ *
+ * The broker ships two factories, each failing closed: one answers the
+ * certificate the key store holds, one the secret. Neither falls back to the
+ * other; a consumer that wants a fallback composes it, and its order is the
+ * consumer's statement. Whatever a strategy throws, the broker turns into a
+ * `DestinationConfigError` in fixed words (`resolveClientAuthentication`) —
+ * nothing of the thrown value, no `cause`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromServiceKeyCertificate = fromServiceKeyCertificate;
+exports.fromServiceKeySecret = fromServiceKeySecret;
+exports.contextClient = contextClient;
+exports.clientAuthenticationContext = clientAuthenticationContext;
+exports.resolveClientAuthentication = resolveClientAuthentication;
+exports.clientIdentity = clientIdentity;
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
+const DestinationConfigError_1 = require("./DestinationConfigError");
+const NO_CERTIFICATE = 'the destination has no client certificate';
+const NO_SECRET = 'the destination has no client secret';
+/**
+ * A shipped factory's refusal. Module-private, so nothing outside this file
+ * can make one — but a consumer composing a factory can catch and alter it,
+ * so the guard reads only `missing` and picks the words itself.
+ */
+class ClientUnavailableError extends Error {
+    missing;
+    constructor(missing) {
+        super(missing === 'certificate' ? NO_CERTIFICATE : NO_SECRET);
+        this.missing = missing;
+        this.name = 'ClientUnavailableError';
+    }
+}
+/** The broker's words for auth-providers' CertificateMaterialError, by its flags. */
+const CERTIFICATE_INCOMPLETE = 'the client certificate is incomplete';
+const CERTIFICATE_EXPIRED = 'the client certificate has expired';
+const CERTIFICATE_UNUSABLE = 'the client certificate could not be used';
+/**
+ * `tls_client_auth` with the certificate and key the key store holds, against
+ * `${certUrl}/oauth/token`. The material is handed over as given and checked
+ * before the factory answers — auth-providers checks it only on first use, so
+ * a malformed, incomplete or expired PEM would otherwise surface only at the
+ * first token request, in a provider already built and cached.
+ *
+ * Throws "the destination has no client certificate" when the store answers
+ * `null` or implements no `getClientCertificate`.
+ */
+function fromServiceKeyCertificate() {
+    return async (context) => {
+        const certificate = await context.readCertificate();
+        if (!certificate) {
+            throw new ClientUnavailableError('certificate');
+        }
+        const authentication = (0, auth_providers_1.tlsClientCertificate)({
+            material: { cert: certificate.certificate, key: certificate.key },
+            endpoint: `${certificate.certUrl.replace(/\/+$/, '')}/oauth/token`,
+        });
+        if (typeof authentication.tlsMaterial !== 'function') {
+            throw new ClientUnavailableError('certificate');
+        }
+        await authentication.tlsMaterial();
+        return authentication;
+    };
+}
+/**
+ * `client_secret_basic` with the secret client the key store holds.
+ *
+ * Throws "the destination has no client secret" when the store answers no
+ * secret client, or one with an empty secret. A missing or unknown `encoding`
+ * is refused when the factory is made.
+ */
+function fromServiceKeySecret(options) {
+    const encoding = options?.encoding;
+    if (encoding !== 'raw' && encoding !== 'form') {
+        throw new TypeError("fromServiceKeySecret: encoding must be 'raw' or 'form'");
+    }
+    return async (context) => {
+        const secret = context.client?.uaaClientSecret;
+        if (typeof secret !== 'string' || secret.length === 0) {
+            throw new ClientUnavailableError('secret');
+        }
+        return (0, auth_providers_1.clientSecretBasic)(secret, { encoding });
+    };
+}
+/**
+ * What a strategy is told of the secret client: an allowlist — who it is
+ * (`uaaUrl`, `uaaClientId`) and its secret (`uaaClientSecret`, which
+ * `fromServiceKeySecret` sends) — never a refresh token or any other field a
+ * store's `getAuthorizationConfig` carried, which no binding has checked.
+ */
+function contextClient(client) {
+    if (!client)
+        return null;
+    return {
+        uaaUrl: client.uaaUrl,
+        uaaClientId: client.uaaClientId,
+        uaaClientSecret: client.uaaClientSecret,
+    };
+}
+/**
+ * The certificate client as the contract declares it — `uaaUrl`, `clientId`,
+ * `certificate`, `key`, `certUrl` — and nothing else a store answered with it.
+ */
+function certificateOf(answer) {
+    if (!answer)
+        return null;
+    return {
+        uaaUrl: answer.uaaUrl,
+        clientId: answer.clientId,
+        certificate: answer.certificate,
+        key: answer.key,
+        certUrl: answer.certUrl,
+    };
+}
+/**
+ * The context for one build: the client through `contextClient`;
+ * `readCertificate` lazy and memoised — the first call reads, every later one
+ * gets the same answer.
+ */
+function clientAuthenticationContext(destination, grant, client, read) {
+    let certificate;
+    return {
+        destination,
+        grant,
+        client: contextClient(client),
+        readCertificate: () => {
+            certificate ??= read().then(certificateOf);
+            return certificate;
+        },
+    };
+}
+const FAILED = 'the clientAuthentication strategy failed';
+const REFUSED = 'the clientAuthentication strategy refused';
+/**
+ * The fixed words for what a strategy threw. Every word is this module's own:
+ * the thrown value only selects among them, through `instanceof` and flags
+ * compared with `===` — never a message, never its `words`. Classifying may
+ * itself throw (a Proxy, a getter), so it runs in its own try and falls back
+ * to the generic words.
+ */
+function refusalWords(error) {
+    try {
+        if (error instanceof ClientUnavailableError) {
+            const missing = error.missing;
+            if (missing === 'certificate')
+                return `${REFUSED}: ${NO_CERTIFICATE}`;
+            if (missing === 'secret')
+                return `${REFUSED}: ${NO_SECRET}`;
+            return FAILED;
+        }
+        if (error instanceof auth_providers_1.CertificateMaterialError) {
+            if (error.incomplete === true) {
+                return `${REFUSED}: ${CERTIFICATE_INCOMPLETE}`;
+            }
+            if (error.expired === true)
+                return `${REFUSED}: ${CERTIFICATE_EXPIRED}`;
+            return `${REFUSED}: ${CERTIFICATE_UNUSABLE}`;
+        }
+    }
+    catch {
+        // Fall through: the thrown value could not even be classified.
+    }
+    return FAILED;
+}
+/**
+ * Runs the strategy inside the guard. Any throw — the strategy's own, a
+ * store's, a malformed PEM — and any answer that is no client authentication
+ * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
+ * words: no `cause`, nothing of the thrown value.
+ */
+async function resolveClientAuthentication(strategy, context) {
+    let answer;
+    let usable;
+    try {
+        answer = await strategy(context);
+        // Read inside the guard: a getter on the answer may throw too.
+        usable =
+            typeof answer === 'object' &&
+                answer !== null &&
+                typeof answer.authenticate === 'function';
+    }
+    catch (error) {
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], refusalWords(error));
+    }
+    if (!usable) {
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], 'the clientAuthentication strategy answered no client authentication');
+    }
+    return answer;
+}
+/**
+ * The client identity a strategy-authenticated row and its binding take: the
+ * secret client's `uaaUrl` and `uaaClientId` when the key store has one, else
+ * the certificate client's `uaaUrl` and `clientId` — read through the
+ * context's memoised `readCertificate`, so at most once per build — else
+ * `null`. The secret stays behind: beside a strategy a row passes none.
+ *
+ * A failing read is a `DestinationConfigError` naming `clientAuthentication`
+ * in fixed words — nothing of what the store threw, no `cause`.
+ */
+async function clientIdentity(context) {
+    const client = context.client;
+    if (client) {
+        return { uaaUrl: client.uaaUrl, uaaClientId: client.uaaClientId };
+    }
+    let certificate;
+    try {
+        certificate = await context.readCertificate();
+    }
+    catch {
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], 'the client certificate could not be read');
+    }
+    if (!certificate)
+        return null;
+    return { uaaUrl: certificate.uaaUrl, uaaClientId: certificate.clientId };
+}

package/dist/destinations.d.ts

@@ -6,16 +6,23 @@
  * read to pick a row. Both come from the key store's means.
  */
 import { type IDeviceCodePresenter, type OidcCallbackResult } from '@mcp-abap-adt/auth-providers';
-import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
+import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IClientAuthentication, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
 import type { DestinationGrant, IConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
 import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { type Binding } from './binding';
+import type { ClientIdentity } from './clientAuthentication';
 type StatedAuthType = NonNullable<IConnectionConfig['authType']>;
 /** The stated `authType`, or the error naming it. */
 export declare function statedAuthType(destination: string, means: IConnectionConfig | null): StatedAuthType;
 /** The stated grant of a `jwt` or `saml` destination, or the error naming it. */
 export declare function statedGrant(destination: string, authType: 'jwt' | 'saml', means: IConnectionConfig): DestinationGrant;
+/**
+ * A row's client: the key store's secret client, or — on the strategy path
+ * without one — the certificate client's identity, which carries no secret
+ * field at all, so it can never pass for a (public) secret client.
+ */
+export type RowClient = IAuthorizationConfig | ClientIdentity;
 /** `basic` → `BasicAuthProvider(username, password)`, from the means alone. */
 export declare function basicProvider(destination: string, means: IConnectionConfig): IAuthProvider;
 /**
@@ -43,10 +50,18 @@ export declare function isUaaGrant(grant: DestinationGrant): grant is UaaGrant;
 export interface UaaRow {
     destination: string;
     grant: UaaGrant;
-    /** The client, from the key store's `getAuthorizationConfig`. */
-    client: IAuthorizationConfig | null;
+    /**
+     * The client: the key store's `getAuthorizationConfig` — or, with a
+     * strategy and no secret client, the certificate client's identity.
+     */
+    client: RowClient | null;
     /** The session secret — the seed; `null` when there is no session. */
     secret: IConfig | null;
+    /**
+     * The consumer strategy's answer. Given, the provider authenticates its
+     * client with it and gets no `clientSecret`; absent, 4.0.0's secret.
+     */
+    clientAuthentication?: IClientAuthentication;
     /** The consumer's `authorization` option. */
     authorization: ((destination: string, grant: 'authorization_code' | 'passcode') => IAuthorizationStrategy<string>) | undefined;
     logger: ILogger;
@@ -60,9 +75,14 @@ export interface UaaRow {
  *
  * Every field and option the row lacks is named in one error, before the
  * consumer's `authorization` is called. `serviceUrl` is not among them: the
- * providers read the client and `uaaUrl` only. `uaaClientSecret: ''` is a public
- * client: `passcode` takes it as no secret; the other two rows' providers
- * require a secret, so for them `''` is missing.
+ * providers read the client and `uaaUrl` only. Without a strategy,
+ * `uaaClientSecret: ''` is a public client: `passcode` takes it as no secret;
+ * the other two rows' providers require a secret, so for them `''` is
+ * missing. On the strategy path the client may be a certificate client's
+ * identity, which holds no secret field at all (`RowClient`).
+ *
+ * With the strategy's answer (`clientAuthentication`) no secret is required
+ * and none is passed: the provider authenticates its client with the answer.
  */
 export declare function uaaProvider(row: UaaRow): IAuthProvider;
 /** The OIDC grants: a client, and an issuer or explicit endpoints. */
@@ -74,9 +94,11 @@ export interface OidcRow {
     grant: OidcGrant;
     means: IConnectionConfig;
     /** The client, from the key store's `getAuthorizationConfig`. */
-    client: IAuthorizationConfig | null;
+    client: RowClient | null;
     /** The session secret — the seed; `null` when there is none, or it is not bound here. */
     secret: IConfig | null;
+    /** The consumer strategy's answer: given, it replaces the secret. */
+    clientAuthentication?: IClientAuthentication;
     oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
     deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
     logger: ILogger;
@@ -105,9 +127,11 @@ export interface SamlRow {
     grant: SamlGrant;
     means: IConnectionConfig;
     /** `saml2_bearer`'s client, from the key store; `null` for `saml2_pure`. */
-    client: IAuthorizationConfig | null;
+    client: RowClient | null;
     /** The session secret — the seed; `null` when there is none, or it is not bound here. */
     secret: IConfig | null;
+    /** `saml2_bearer`: the consumer strategy's answer; given, it replaces the secret. */
+    clientAuthentication?: IClientAuthentication;
     authorization: ((destination: string, grant: SamlGrant) => IAuthorizationStrategy<string>) | undefined;
     samlCookies: ((destination: string) => (samlResponse: string) => Promise<string>) | undefined;
     assertionReplayStore: ((destination: string) => IAssertionReplayStore) | undefined;
@@ -126,8 +150,9 @@ export interface SamlRow {
  *
  * `saml2_pure` is seeded with the stored cookies and `expiresAt`;
  * `saml2_bearer` with the stored token, its refresh token and expiry, and
- * takes the client (`uaaUrl`, `uaaClientId`; `uaaClientSecret` `''` a public
- * client) and `samlTokenUrl` when stated.
+ * takes the client (`uaaUrl`, `uaaClientId`; without a strategy,
+ * `uaaClientSecret` `''` a public client; on the strategy path the identity
+ * alone, no secret) and `samlTokenUrl` when stated.
  *
  * Every field and option the row lacks is named in one error, before any
  * collaborator is called; so is a `samlClockSkewMs` that is not a whole number

package/dist/destinations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,oBAAoB,EAEzB,KAAK,kBAAkB,EAWxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AAGnE,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwBjE,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAUD,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,CA0Bf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CA2Bf;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CA4DtD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAqFxD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAgGxD"}
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,oBAAoB,EAEzB,KAAK,kBAAkB,EAWxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwBjE,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAwD9D,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,CA0Bf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CA2Bf;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAqEtD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iEAAiE;IACjE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAyFxD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAqGxD"}

package/dist/destinations.js

@@ -64,6 +64,32 @@ function statedGrant(destination, authType, means) {
     }
     return grantType;
 }
+/** The secret a row's client holds; an identity holds none. */
+function secretOf(client) {
+    return client && 'uaaClientSecret' in client
+        ? client.uaaClientSecret
+        : undefined;
+}
+/** Added to a row's refusal when it has no client and no strategy was given. */
+const CERTIFICATE_HINT = 'a certificate client needs a clientAuthentication strategy';
+/**
+ * Whether a client row's refusal gets the hint: no strategy, and no client
+ * at all — the key store answered none, or one without a client id. A
+ * client that lacks only its secret or its URL is a secret client with a
+ * gap, and gets 4.0.0's words alone. Decided from what was read, never by
+ * asking the store about a certificate.
+ */
+function noClientHint(clientAuthentication, client) {
+    return !clientAuthentication && !present(client?.uaaClientId);
+}
+/** A client row's refusal: 4.0.0's words, and the hint when `hinted`. */
+function clientRowError(destination, lacking, reason, hinted) {
+    return new DestinationConfigError_1.DestinationConfigError(destination, lacking, hinted ? `${reason}; ${CERTIFICATE_HINT}` : reason);
+}
+/** `clientAuthentication` for a provider's config: present only when given. */
+function authenticatedBy(clientAuthentication) {
+    return clientAuthentication ? { clientAuthentication } : {};
+}
 /** The names of the fields among `names` that `source` lacks or holds as `''`. */
 function missing(source, names) {
     return names.filter((name) => !present(source?.[name]));
@@ -152,37 +178,47 @@ function isUaaGrant(grant) {
  *
  * Every field and option the row lacks is named in one error, before the
  * consumer's `authorization` is called. `serviceUrl` is not among them: the
- * providers read the client and `uaaUrl` only. `uaaClientSecret: ''` is a public
- * client: `passcode` takes it as no secret; the other two rows' providers
- * require a secret, so for them `''` is missing.
+ * providers read the client and `uaaUrl` only. Without a strategy,
+ * `uaaClientSecret: ''` is a public client: `passcode` takes it as no secret;
+ * the other two rows' providers require a secret, so for them `''` is
+ * missing. On the strategy path the client may be a certificate client's
+ * identity, which holds no secret field at all (`RowClient`).
+ *
+ * With the strategy's answer (`clientAuthentication`) no secret is required
+ * and none is passed: the provider authenticates its client with the answer.
  */
 function uaaProvider(row) {
-    const { destination, grant, client, secret } = row;
+    const { destination, grant, client, secret, clientAuthentication } = row;
     const lacking = [];
     if (!present(client?.uaaUrl))
         lacking.push('uaaUrl');
     if (!present(client?.uaaClientId))
         lacking.push('uaaClientId');
-    if (grant !== 'passcode' && !present(client?.uaaClientSecret)) {
+    if (!clientAuthentication &&
+        grant !== 'passcode' &&
+        !present(secretOf(client))) {
         lacking.push('uaaClientSecret');
     }
     if (grant !== 'client_credentials' && !row.authorization) {
         lacking.push('authorization');
     }
     if (lacking.length > 0) {
-        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, `a jwt destination with grantType ${grant} lacks what its grant needs`);
+        throw clientRowError(destination, lacking, `a jwt destination with grantType ${grant} lacks what its grant needs`, noClientHint(clientAuthentication, client));
     }
     const uaaUrl = client?.uaaUrl;
     const clientId = client?.uaaClientId;
-    const clientSecret = present(client?.uaaClientSecret)
-        ? client.uaaClientSecret
+    const clientSecret = !clientAuthentication && present(secretOf(client))
+        ? secretOf(client)
         : undefined;
-    const hooks = { onTokens: row.onTokens };
+    const hooks = {
+        onTokens: row.onTokens,
+        ...authenticatedBy(clientAuthentication),
+    };
     if (grant === 'client_credentials') {
         return new auth_providers_1.ClientCredentialsProvider({
             uaaUrl,
             clientId,
-            clientSecret: clientSecret,
+            ...(clientSecret === undefined ? {} : { clientSecret }),
             logger: row.logger,
             ...hooks,
         });
@@ -194,7 +230,7 @@ function uaaProvider(row) {
         return new auth_providers_1.AuthorizationCodeProvider({
             uaaUrl,
             clientId,
-            clientSecret: clientSecret,
+            ...(clientSecret === undefined ? {} : { clientSecret }),
             authorization,
             ...seed,
             logger: row.logger,
@@ -279,7 +315,7 @@ function oidcProvider(row) {
         lacking.push('deviceCodePresenter');
     }
     if (lacking.length > 0) {
-        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, `a jwt destination with grantType ${grant} lacks what its grant needs`);
+        throw clientRowError(destination, lacking, `a jwt destination with grantType ${grant} lacks what its grant needs`, noClientHint(row.clientAuthentication, client));
     }
     const scopes = Array.isArray(means.oidcScopes) && means.oidcScopes.length > 0
         ? means.oidcScopes
@@ -287,7 +323,10 @@ function oidcProvider(row) {
     const common = {
         issuerUrl: stated(means.oidcIssuerUrl),
         clientId: client?.uaaClientId,
-        clientSecret: stated(client?.uaaClientSecret),
+        clientSecret: row.clientAuthentication
+            ? undefined
+            : stated(secretOf(client)),
+        ...authenticatedBy(row.clientAuthentication),
         tokenEndpoint: stated(means.oidcTokenEndpoint),
         ...tokenSeed(row.secret),
         logger: row.logger,
@@ -343,8 +382,9 @@ function isSamlGrant(grant) {
  *
  * `saml2_pure` is seeded with the stored cookies and `expiresAt`;
  * `saml2_bearer` with the stored token, its refresh token and expiry, and
- * takes the client (`uaaUrl`, `uaaClientId`; `uaaClientSecret` `''` a public
- * client) and `samlTokenUrl` when stated.
+ * takes the client (`uaaUrl`, `uaaClientId`; without a strategy,
+ * `uaaClientSecret` `''` a public client; on the strategy path the identity
+ * alone, no secret) and `samlTokenUrl` when stated.
  *
  * Every field and option the row lacks is named in one error, before any
  * collaborator is called; so is a `samlClockSkewMs` that is not a whole number
@@ -374,7 +414,8 @@ function samlProvider(row) {
     if (!row.assertionReplayStore)
         lacking.push('assertionReplayStore');
     if (lacking.length > 0) {
-        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, `a saml destination with grantType ${grant} lacks what its grant needs`);
+        throw clientRowError(destination, lacking, `a saml destination with grantType ${grant} lacks what its grant needs`, grant === 'saml2_bearer' &&
+            noClientHint(row.clientAuthentication, client));
     }
     const skew = means.samlClockSkewMs;
     if (skew !== undefined && !(Number.isInteger(skew) && skew >= 0)) {
@@ -423,7 +464,10 @@ function samlProvider(row) {
         tokenUrl: stated(means.samlTokenUrl),
         uaaUrl: client?.uaaUrl,
         clientId: client?.uaaClientId,
-        clientSecret: stated(client?.uaaClientSecret),
+        clientSecret: row.clientAuthentication
+            ? undefined
+            : stated(secretOf(client)),
+        ...authenticatedBy(row.clientAuthentication),
         ...tokenSeed(row.secret),
     });
 }

package/dist/index.d.ts

@@ -5,11 +5,13 @@
  * secret, and stores back what that provider obtains; the token API serves a
  * token from the same provider, or from one the consumer injects.
  */
-export type { ITokenRefresher } from '@mcp-abap-adt/interfaces-auth';
+export type { IClientAuthentication, ITokenRefresher, } from '@mcp-abap-adt/interfaces-auth';
+export type { IClientCertificate } from '@mcp-abap-adt/interfaces-auth-broker';
 export type { AuthType } from '@mcp-abap-adt/interfaces-auth-sap';
 export type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export { AuthBroker, type AuthBrokerConfig, type StrategyGrant, type TokenProviderFactory, } from './AuthBroker';
+export { AuthBroker, type AuthBrokerConfig, type StrategyGrant, type TokenProviderClient, type TokenProviderFactory, } from './AuthBroker';
 export { bindingOf, type SecretBinding } from './bindingOf';
+export { type ClientAuthenticationContext, type ClientAuthenticationGrant, type ClientAuthenticationStrategy, type FromServiceKeySecretOptions, fromServiceKeyCertificate, fromServiceKeySecret, } from './clientAuthentication';
 export { DestinationConfigError } from './DestinationConfigError';
 export type { IRefreshableTokenProvider, ITokenProvider, ITokenResult, TokenProviderOptions, } from './providers';
 export type { IAuthorizationConfig, IConnectionConfig, IServiceKeyStore, ISessionStore, } from './stores/interfaces';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,YAAY,EACV,qBAAqB,EACrB,eAAe,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -7,11 +7,14 @@
  * token from the same provider, or from one the consumer injects.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DestinationConfigError = exports.bindingOf = exports.AuthBroker = void 0;
+exports.DestinationConfigError = exports.fromServiceKeySecret = exports.fromServiceKeyCertificate = exports.bindingOf = exports.AuthBroker = void 0;
 var AuthBroker_1 = require("./AuthBroker");
 Object.defineProperty(exports, "AuthBroker", { enumerable: true, get: function () { return AuthBroker_1.AuthBroker; } });
 var bindingOf_1 = require("./bindingOf");
 Object.defineProperty(exports, "bindingOf", { enumerable: true, get: function () { return bindingOf_1.bindingOf; } });
+var clientAuthentication_1 = require("./clientAuthentication");
+Object.defineProperty(exports, "fromServiceKeyCertificate", { enumerable: true, get: function () { return clientAuthentication_1.fromServiceKeyCertificate; } });
+Object.defineProperty(exports, "fromServiceKeySecret", { enumerable: true, get: function () { return clientAuthentication_1.fromServiceKeySecret; } });
 var DestinationConfigError_1 = require("./DestinationConfigError");
 Object.defineProperty(exports, "DestinationConfigError", { enumerable: true, get: function () { return DestinationConfigError_1.DestinationConfigError; } });
 // Store implementations: `@mcp-abap-adt/auth-stores`, or any `ISessionStore` /