@mcp-abap-adt/auth-broker 4.0.0 → 5.0.0

package/dist/index.d.ts

@@ -5,13 +5,17 @@
  * secret, and stores back what that provider obtains; the token API serves a
  * token from the same provider, or from one the consumer injects.
  */
-export type { ITokenRefresher } from '@mcp-abap-adt/interfaces-auth';
+export type { IClientAuthentication, IRenewalStrategy, ITokenRefresher, } from '@mcp-abap-adt/interfaces-auth';
+export type { IClientCertificate } from '@mcp-abap-adt/interfaces-auth-broker';
 export type { AuthType } from '@mcp-abap-adt/interfaces-auth-sap';
 export type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export { AuthBroker, type AuthBrokerConfig, type StrategyGrant, type TokenProviderFactory, } from './AuthBroker';
+export { AuthBroker, type AuthBrokerConfig, type BrokerCallOptions, type StrategyGrant, type TokenProviderClient, type TokenProviderFactory, } from './AuthBroker';
 export { bindingOf, type SecretBinding } from './bindingOf';
-export { DestinationConfigError } from './DestinationConfigError';
+export { type ClientAuthenticationContext, type ClientAuthenticationGrant, type ClientAuthenticationStrategy, type FromServiceKeySecretOptions, fromServiceKeyCertificate, fromServiceKeySecret, } from './clientAuthentication';
+export { DestinationConfigError, type DestinationConfigErrorLike, isDestinationConfigError, } from './DestinationConfigError';
+export type { TokenGrant } from './destinations';
 export type { IRefreshableTokenProvider, ITokenProvider, ITokenResult, TokenProviderOptions, } from './providers';
+export { SessionWriteFailure } from './SessionWriter';
 export type { IAuthorizationConfig, IConnectionConfig, IServiceKeyStore, ISessionStore, } from './stores/interfaces';
 export type { IConfig } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,YAAY,EACV,qBAAqB,EACrB,gBAAgB,EAChB,eAAe,GAChB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,2BAA2B,EAChC,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,sBAAsB,EACtB,KAAK,0BAA0B,EAC/B,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAGtD,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -7,12 +7,18 @@
  * token from the same provider, or from one the consumer injects.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DestinationConfigError = exports.bindingOf = exports.AuthBroker = void 0;
+exports.SessionWriteFailure = exports.isDestinationConfigError = exports.DestinationConfigError = exports.fromServiceKeySecret = exports.fromServiceKeyCertificate = exports.bindingOf = exports.AuthBroker = void 0;
 var AuthBroker_1 = require("./AuthBroker");
 Object.defineProperty(exports, "AuthBroker", { enumerable: true, get: function () { return AuthBroker_1.AuthBroker; } });
 var bindingOf_1 = require("./bindingOf");
 Object.defineProperty(exports, "bindingOf", { enumerable: true, get: function () { return bindingOf_1.bindingOf; } });
+var clientAuthentication_1 = require("./clientAuthentication");
+Object.defineProperty(exports, "fromServiceKeyCertificate", { enumerable: true, get: function () { return clientAuthentication_1.fromServiceKeyCertificate; } });
+Object.defineProperty(exports, "fromServiceKeySecret", { enumerable: true, get: function () { return clientAuthentication_1.fromServiceKeySecret; } });
 var DestinationConfigError_1 = require("./DestinationConfigError");
 Object.defineProperty(exports, "DestinationConfigError", { enumerable: true, get: function () { return DestinationConfigError_1.DestinationConfigError; } });
+Object.defineProperty(exports, "isDestinationConfigError", { enumerable: true, get: function () { return DestinationConfigError_1.isDestinationConfigError; } });
+var SessionWriter_1 = require("./SessionWriter");
+Object.defineProperty(exports, "SessionWriteFailure", { enumerable: true, get: function () { return SessionWriter_1.SessionWriteFailure; } });
 // Store implementations: `@mcp-abap-adt/auth-stores`, or any `ISessionStore` /
 // `IServiceKeyStore`. Provider implementations: `@mcp-abap-adt/auth-providers`.

package/dist/quietLogger.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The one way the broker logs: the consumer's `ILogger` behind a
+ * wrapper whose every method never throws and never leaves an unhandled
+ * rejection.
+ *
+ * The logger is the consumer's code. A method that throws, a method or a
+ * getter for one that throws, or a method that answers a rejecting promise
+ * (an async logger) changes nothing the broker does: a log line is never an
+ * outcome. Without the wrapper a throwing `info` after a store took a write
+ * would turn the landed write into a failed, pending one, and a throwing
+ * `warn` would reject a `submit` that must never reject.
+ *
+ * Every argument reaches the consumer's method as given — the same count,
+ * the same values — so a logger sees exactly what the broker wrote. Logging
+ * stays fire-and-forget: an answer is never awaited, only adopted with a
+ * no-op rejection handler.
+ */
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+/**
+ * The consumer's logger, every method guarded; none given, a logger that
+ * writes nothing.
+ */
+export declare function quietLogger(logger: ILogger | undefined): ILogger;
+//# sourceMappingURL=quietLogger.d.ts.map

package/dist/quietLogger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quietLogger.d.ts","sourceRoot":"","sources":["../src/quietLogger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AA0B9D;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,GAAG,OAAO,CAehE"}

package/dist/quietLogger.js

@@ -0,0 +1,63 @@
+"use strict";
+/**
+ * The one way the broker logs: the consumer's `ILogger` behind a
+ * wrapper whose every method never throws and never leaves an unhandled
+ * rejection.
+ *
+ * The logger is the consumer's code. A method that throws, a method or a
+ * getter for one that throws, or a method that answers a rejecting promise
+ * (an async logger) changes nothing the broker does: a log line is never an
+ * outcome. Without the wrapper a throwing `info` after a store took a write
+ * would turn the landed write into a failed, pending one, and a throwing
+ * `warn` would reject a `submit` that must never reject.
+ *
+ * Every argument reaches the consumer's method as given — the same count,
+ * the same values — so a logger sees exactly what the broker wrote. Logging
+ * stays fire-and-forget: an answer is never awaited, only adopted with a
+ * no-op rejection handler.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.quietLogger = quietLogger;
+const LEVELS = ['debug', 'info', 'warn', 'error'];
+const ignore = () => { };
+/**
+ * Adopts what a log method answered, the way an `await` would — a native
+ * promise, a subclass or any thenable — through a promise this module makes,
+ * and handles its rejection. A `then` (or a getter for one) that throws is a
+ * rejection like any other. Never throws.
+ */
+function settleQuietly(answer) {
+    if ((answer === null || typeof answer !== 'object') &&
+        typeof answer !== 'function') {
+        return;
+    }
+    try {
+        new Promise((resolve) => resolve(answer)).then(ignore, ignore);
+    }
+    catch {
+        // Nothing a logger answers is the broker's outcome.
+    }
+}
+/**
+ * The consumer's logger, every method guarded; none given, a logger that
+ * writes nothing.
+ */
+function quietLogger(logger) {
+    const quiet = {};
+    for (const level of LEVELS) {
+        quiet[level] = (...args) => {
+            if (logger === undefined)
+                return;
+            try {
+                const method = logger[level];
+                if (typeof method !== 'function')
+                    return;
+                settleQuietly(Reflect.apply(method, logger, args));
+            }
+            catch {
+                // A log line is never an outcome.
+            }
+        };
+    }
+    return Object.freeze(quiet);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "4.0.0",
+  "version": "5.0.0",
   "description": "Per-destination credential broker for SAP BTP and ABAP: the IAuthProvider a destination states, built from its key store and session store, with every secret it obtains stored back; and a token API",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -44,6 +44,7 @@
     "build": "tsc -b tsconfig.build.json",
     "test": "cross-env NODE_OPTIONS=--experimental-vm-modules jest",
     "test:live": "cross-env NODE_OPTIONS=--experimental-vm-modules jest -c jest.live.config.js",
+    "test:live:x509": "tests/live/x509/run.sh",
     "test:stand": "tests/stand/run.sh",
     "stand:up": "tests/stand/up.sh",
     "stand:down": "tests/stand/down.sh",
@@ -54,16 +55,17 @@
     "node": "^22 || ^24 || ^26"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-providers": "^5.2.1",
-    "@mcp-abap-adt/interfaces-auth": "^3.0.0",
-    "@mcp-abap-adt/interfaces-auth-broker": "^1.1.0",
-    "@mcp-abap-adt/interfaces-auth-sap": "^2.0.0",
+    "@mcp-abap-adt/auth-errors": "^2.1.1",
+    "@mcp-abap-adt/auth-providers": "^6.0.0",
+    "@mcp-abap-adt/interfaces-auth": "^7.5.0",
+    "@mcp-abap-adt/interfaces-auth-broker": "^1.3.0",
+    "@mcp-abap-adt/interfaces-auth-sap": "^3.3.0",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0"
   },
   "devDependencies": {
     "@mcp-abap-adt/auth-mocks": "^0.3.0",
-    "@mcp-abap-adt/auth-stores": "^3.2.0",
-    "@mcp-abap-adt/connection": "^10.0.3",
+    "@mcp-abap-adt/auth-stores": "^4.0.0",
+    "@mcp-abap-adt/connection": "^14.0.0",
     "@mcp-abap-adt/logger": "^0.4.0",
     "@types/js-yaml": "^4.0.9",
     "js-yaml": "^4.1.1",