@mcp-abap-adt/auth-providers 2.0.0 → 2.2.1

package/CHANGELOG.md

@@ -7,6 +7,57 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-09-24
+
+### Fixed
+
+- **`Saml2BearerProvider` spends its refresh token** (#23). `performRefresh()`
+  used to run a full interactive login on both of its branches, so a session
+  holding a valid refresh token still went through the IdP and a browser — and
+  a headless consumer got `BROWSER_AUTH_REQUIRED` from `auth-broker`. It now
+  sends a `refresh_token` grant to the same token endpoint and with the same
+  client credentials as the assertion exchange, keeps the refresh token it spent
+  when the response carries no new one, and falls back to a full login when the
+  grant is refused.
+
+## [2.2.0] - 2026-09-24
+
+### Dependencies
+
+- **`@mcp-abap-adt/interfaces` is replaced by the contract packages this
+  package actually uses.** The facade is deleted upstream; 51.0.0 is its last
+  version. The contracts now come from:
+  - `@mcp-abap-adt/interfaces-auth` `^1.2.0` — `ITokenProvider`, `ITokenResult`,
+    `IAuthorizationStrategy`, the callback server types, `AUTH_TYPE_*` and
+    `TOKEN_PROVIDER_ERROR_CODES`;
+  - `@mcp-abap-adt/interfaces-auth-sap` `^1.0.0` — `IAuthorizationConfig`;
+  - `@mcp-abap-adt/interfaces-utils` `^1.1.0` — `ILogger`.
+
+  No export of this package changed. A consumer that imports these types itself
+  should import them from the same packages, not from the facade.
+- `@mcp-abap-adt/logger` (dev) `^0.4.0`, which is on `interfaces-utils` as well.
+
+## [2.1.0] - 2026-09-03
+
+### Licence
+
+- **This package is now `LGPL-3.0-only`.** It was MIT up to and including 2.0.0, and
+  those versions stay MIT — a licence change is not retroactive, and anyone
+  already using 2.0.0 under MIT keeps that grant for 2.0.0.
+
+  The library licence of the GNU family, chosen for what it does *not* ask:
+  linking it into your own program — importing it, as every consumer of an npm
+  package does — does not put your program under the LGPL. What it asks is that
+  changes to this library stay free and that your users can substitute their own
+  build of it.
+
+  Both texts ship in the package: `LICENSE` is the LGPL, `COPYING` is the GPL it
+  is written on top of. The LGPL is a set of additional permissions over the GPL,
+  so it cannot be read without both.
+
+  Copyright © 2025–2026 Oleksii Kyslytsia.
+
+
 ## [2.0.0] - 2026-07-31
 
 Callback reception leaves the providers. How an interactive login is conducted —