@mcp-abap-adt/auth-providers 4.1.0 → 4.1.3

package/CHANGELOG.md

@@ -7,6 +7,84 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.1.3] - 2026-09-26
+
+### Changed
+
+- A `bearerConfirmation` refusal naming several candidates joins them with
+  ` | ` instead of `; `, and ends ` | and N more`. The count reason
+  `carries N SubjectConfirmationData; exactly one is allowed` contains `; `
+  itself, so the old separator read ambiguously. `check` and every reason's
+  wording are unchanged.
+
+### Removed
+
+- `mcp.json`, an XSUAA service key with a client secret, committed to the
+  repository on 2025-12-23 with the since-removed `bin/` CLIs. It was never in
+  the npm package. It stays in the git history, so that binding should be
+  rotated or deleted. `.gitignore` now keeps `mcp.json` and
+  `*service-key*.json` out.
+
+## [4.1.2] - 2026-09-26
+
+### Security
+
+- **No token the provider holds reaches a log line.** Every provider logged tokens through
+  `BaseTokenProvider.formatToken`. That function returned a token of 50
+  characters or fewer whole, and a longer one's first and last 25 characters.
+  UAA and XSUAA refresh tokens are opaque and about 34 characters, so they were
+  logged in full, at `info`, by `AuthorizationCodeProvider` on creation, on
+  refresh (old and new) and by `BaseTokenProvider` on every token update. Access
+  tokens leaked 50 characters. A log line now carries only
+  `<redacted, N chars>`. Anyone who shipped logs from an earlier version at
+  `info` or `debug` should treat the refresh tokens in them as exposed, and
+  revoke them.
+- **No token endpoint's error body reaches a log line or an error message
+  whole.** The SAML exchange and SAML refresh logged the whole error body, and
+  `refreshJwtToken` and `getTokenWithClientCredentials` serialised it into the
+  thrown `Error`'s message, which `BaseTokenProvider` then logged. Only the
+  body's `error` and `error_description` are kept now, each quoted and capped:
+  `error` at 64 characters, and `error_description` at 512, so a server's
+  diagnosis survives. Both are redacted first. Every secret the request itself
+  sent (refresh token, assertion, client secret), however short, whether it
+  comes back as sent or form- or percent-encoded, and anything shaped like a JWT
+  becomes `<redacted>`. A server that echoes one of those, in the body or in
+  its description, no longer leaks it. **Limit:** an opaque token the request
+  did not send cannot be told from an ordinary identifier, so if a server writes
+  a new one into `error_description` it passes through, capped at 512
+  characters. Scrubbing every long string would also erase the IDs that make a
+  refusal diagnosable.
+
+## [4.1.1] - 2026-09-26
+
+### Changed
+
+- The `signedNode` refusal for an assertion inside a `ds:Signature` now reads
+  "…inside a ds:Signature, which is never accepted". The 4.1.0 wording, "where
+  no signature covers it", was untrue when a signed Response also covers that
+  signature. `check` and the fragment `inside a ds:Signature` are unchanged.
+
+### Fixed
+
+- The tarball no longer ships `dist/__tests__/…`. Test helpers and stand
+  fixtures were built into `dist` and published with 4.0.0 and 4.1.0. The build
+  now uses `tsconfig.build.json`, which leaves `src/__tests__` out, and the
+  tarball drops from 140 to 128 files. Nothing a consumer imports changes.
+
+### Development
+
+- `@mcp-abap-adt/auth-stores` devDependency `^1.2.1`, which depends on
+  `@mcp-abap-adt/interfaces-auth` `^2.0.1`. The development tree now holds a
+  single `interfaces-auth` 2.0.1 instead of a second, nested 1.2.0. Nothing
+  published changes.
+- The live authorization tests take tokens from any session file:
+  `MCP_ABAP_ADT_SESSION_FILE`, or `session_path` in `tests/test-config.yaml`,
+  or the stores' folder `<destination_dir>/sessions/<destination>.env`. The
+  folder defaults to `~/.config/mcp-abap-adt` on Unix and
+  `Documents/mcp-abap-adt` on Windows. Browser logins run only with
+  `interactive_login: true` or `MCP_ABAP_ADT_INTERACTIVE=1`, so a default
+  `npm test` never waits for one.
+
 ## [4.1.0] - 2026-09-26
 
 Three refusals get stricter; no export, configuration field or error class
@@ -54,7 +132,9 @@ changes. The README's *Upgrading from 4.0 to 4.1* lists what now fails.
 - `idpInitiated: true` with `authnRequestId` is refused when the provider is
   constructed — a `ValidationError` with `missingFields: ['idpInitiated']` —
   not after `authorize()` returns, so before the user has been through the
-  browser.
+  browser. A `Saml2BearerProvider` seeded with a `refreshToken` did work in 4.0
+  until that token lapsed, since a refresh never reaches the strategy; it now
+  fails at construction.
 - A malformed `Signature` whose `loadSignature` throws something other than
   an `Error` is refused at `signature` quoting what was thrown. Before, the
   refusal carried an empty message, and a thrown `null` or `undefined`

package/README.md

@@ -672,7 +672,7 @@ What the table compresses:
   `xsd:dateTime`; `NotOnOrAfter` has not passed beyond `clockSkewMs`;
   `NotBefore` has arrived within it. When none qualifies, the refusal names
   every candidate in document order with the first sub-rule it failed —
-  `no bearer confirmation qualifies: #1 Recipient is not the ACS; #2
+  `no bearer confirmation qualifies: #1 Recipient is not the ACS | #2
   NotOnOrAfter has passed` — listing at most five, then `and N more`.
 - **Check 9 is AND across restrictions, OR within one**, as SAML Core §2.5.1.4
   says: every `AudienceRestriction` must name you; the `Audience` elements
@@ -727,7 +727,7 @@ value.
 | `signedNode` | `the signature does not cover the samlp:Response this validator requires` |
 | `signedNode` | `the signature does not cover the saml:Assertion this validator requires` |
 | `signedNode` | `the document carries an Assertion or EncryptedAssertion, SAML 2.0 or 1.x, outside the one the signature covers` |
-| `signedNode` | `the document carries an Assertion or EncryptedAssertion inside a ds:Signature, where no signature covers it` |
+| `signedNode` | `the document carries an Assertion or EncryptedAssertion inside a ds:Signature, which is never accepted` |
 | `status` | `the response carries no samlp:Status` |
 | `status` | `the response carries <n> samlp:Status; exactly one is allowed` |
 | `status` | `the samlp:Status carries no samlp:StatusCode` |
@@ -755,14 +755,16 @@ value.
 | `bearerConfirmation` | `the assertion carries no saml:Subject` |
 | `bearerConfirmation` | `the assertion carries <n> saml:Subject; exactly one is allowed` |
 | `bearerConfirmation` | `the saml:Subject holds no SubjectConfirmation` |
-| `bearerConfirmation` | `no bearer confirmation qualifies: #1 <reason>; #2 <reason>; …` |
+| `bearerConfirmation` | `no bearer confirmation qualifies: #1 <reason> \| #2 <reason> \| …` |
 | `destination` | `the response carries no Destination` |
 | `destination` | `the response is addressed to "…", not to us` |
 | `replay` | `this assertion has been presented before` |
 
 A `bearerConfirmation` refusal naming candidates lists each one's first failed
-sub-rule, in document order, joined by `; `; past five candidates it ends
-`; and N more`, N being how many were not listed. The eleven reasons:
+sub-rule, in document order, joined by ` | ` — not `; `, which a count reason
+such as `carries 2 SubjectConfirmationData; exactly one is allowed` contains
+itself; past five candidates it ends ` | and N more`, N being how many were
+not listed. The eleven reasons:
 
 | # | `<reason>`, in the order a candidate is tested |
 |---|---|
@@ -1768,7 +1770,7 @@ Example output:
 ```
 
 **Logging Features**:
-- **Token Formatting**: Tokens are logged in truncated format (start...end) for security
+- **No tokens in logs**: a token the provider holds or sent is never logged, not even in part. A log line carries only `<redacted, N chars>` (since 4.1.2; earlier versions logged a short refresh token whole). A token endpoint's error body contributes only `error` and `error_description`, with the request's secrets and anything shaped like a JWT redacted. A new opaque token that a server writes into `error_description` cannot be recognised and passes through, capped at 512 characters.
 - **Date Formatting**: Expiration dates are displayed in readable format (YYYY-MM-DD HH:MM:SS UTC) instead of ISO format
 - **Browser Information**: Logs browser type and authorization URL for debugging
 - **Token Lifecycle**: Detailed logging of token acquisition, validation, and refresh operations

package/dist/auth/clientCredentialsAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientCredentialsAuth.d.ts","sourceRoot":"","sources":["../../src/auth/clientCredentialsAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAmDlC"}
+{"version":3,"file":"clientCredentialsAuth.d.ts","sourceRoot":"","sources":["../../src/auth/clientCredentialsAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAmDlC"}

package/dist/auth/clientCredentialsAuth.js

@@ -11,6 +11,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getTokenWithClientCredentials = getTokenWithClientCredentials;
 const axios_1 = __importDefault(require("axios"));
+const oauthErrorBody_1 = require("./oauthErrorBody");
 /**
  * Get access token using client_credentials grant type
  * @param uaaUrl UAA URL (e.g., https://your-account.authentication.eu10.hana.ondemand.com)
@@ -54,7 +55,7 @@ async function getTokenWithClientCredentials(uaaUrl, clientId, clientSecret) {
             'status' in error.response &&
             'data' in error.response) {
             const axiosError = error;
-            throw new Error(`Client credentials authentication failed (${axiosError.response.status}): ${JSON.stringify(axiosError.response.data)}`);
+            throw new Error(`Client credentials authentication failed (${axiosError.response.status}): ${(0, oauthErrorBody_1.describeOAuthErrorBody)(axiosError.response.data, [clientSecret])}`);
         }
         else {
             const errorMessage = error instanceof Error ? error.message : String(error);

package/dist/auth/oauthErrorBody.d.ts

@@ -0,0 +1,15 @@
+/**
+ * What of an OAuth error response may reach a log line or an error message.
+ *
+ * Only RFC 6749 §5.2's `error` and `error_description`, each quoted and capped.
+ * A token endpoint's body is otherwise untrusted: a misbehaving server can echo
+ * the request or return tokens in it, so it is never serialised whole.
+ * `error_description` is the server's human-readable diagnosis, so it keeps a
+ * cap long enough to stay useful (UAA explains assertion refusals in it).
+ */
+/**
+ * @param knownSecrets what the request sent that must never come back out:
+ *   the refresh token, the assertion, the client secret.
+ */
+export declare function describeOAuthErrorBody(data: unknown, knownSecrets?: readonly (string | undefined)[]): string;
+//# sourceMappingURL=oauthErrorBody.d.ts.map

package/dist/auth/oauthErrorBody.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauthErrorBody.d.ts","sourceRoot":"","sources":["../../src/auth/oauthErrorBody.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsCH;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,YAAY,GAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAO,GACjD,MAAM,CAaR"}

package/dist/auth/oauthErrorBody.js

@@ -0,0 +1,58 @@
+"use strict";
+/**
+ * What of an OAuth error response may reach a log line or an error message.
+ *
+ * Only RFC 6749 §5.2's `error` and `error_description`, each quoted and capped.
+ * A token endpoint's body is otherwise untrusted: a misbehaving server can echo
+ * the request or return tokens in it, so it is never serialised whole.
+ * `error_description` is the server's human-readable diagnosis, so it keeps a
+ * cap long enough to stay useful (UAA explains assertion refusals in it).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeOAuthErrorBody = describeOAuthErrorBody;
+const ERROR_CAP = 64;
+const DESCRIPTION_CAP = 512;
+const quote = (value, cap) => JSON.stringify(value.length > cap ? `${value.slice(0, cap)}…` : value);
+/** Anything shaped like a JWT: three base64url segments, the first a header. */
+const JWT_SHAPE = /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/g;
+/**
+ * Removes what a server might echo back: every secret the request itself
+ * sent (a refresh token, an assertion, a client secret), in each form it may
+ * come back in, and any JWT.
+ * Every known secret is redacted, however short: nothing guarantees a client
+ * secret is long, and dropping a matching word from a diagnosis is the lesser
+ * harm.
+ */
+function redact(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (!secret)
+            continue;
+        // As sent, as the request body encoded it (URLSearchParams: + / = become
+        // %2B %2F %3D), and percent-encoded: a server may echo any of these.
+        const forms = new Set([
+            secret,
+            new URLSearchParams({ s: secret }).toString().slice(2),
+            encodeURIComponent(secret),
+        ]);
+        for (const form of forms)
+            out = out.split(form).join('<redacted>');
+    }
+    return out.replace(JWT_SHAPE, '<redacted jwt>');
+}
+/**
+ * @param knownSecrets what the request sent that must never come back out:
+ *   the refresh token, the assertion, the client secret.
+ */
+function describeOAuthErrorBody(data, knownSecrets = []) {
+    if (!data || typeof data !== 'object')
+        return 'no error given';
+    const { error, error_description } = data;
+    const parts = [];
+    if (typeof error === 'string')
+        parts.push(quote(redact(error, knownSecrets), ERROR_CAP));
+    if (typeof error_description === 'string') {
+        parts.push(quote(redact(error_description, knownSecrets), DESCRIPTION_CAP));
+    }
+    return parts.length > 0 ? parts.join(': ') : 'no error given';
+}

package/dist/auth/saml2TokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC"}
+{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CA2CrC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CA2CrC"}

package/dist/auth/saml2TokenExchange.js

@@ -9,6 +9,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.exchangeSamlAssertion = exchangeSamlAssertion;
 exports.refreshSamlBearerToken = refreshSamlBearerToken;
 const axios_1 = __importDefault(require("axios"));
+const oauthErrorBody_1 = require("./oauthErrorBody");
 function toBasicAuth(clientId, clientSecret) {
     return Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
 }
@@ -34,7 +35,10 @@ async function exchangeSamlAssertion(samlResponse, tokenUrl, clientId, clientSec
         if (axios_1.default.isAxiosError(error)) {
             logger?.error('[SAML] Token exchange failed', {
                 status: error.response?.status,
-                data: error.response?.data,
+                error: (0, oauthErrorBody_1.describeOAuthErrorBody)(error.response?.data, [
+                    samlResponse,
+                    clientSecret,
+                ]),
             });
         }
         throw error;
@@ -79,7 +83,10 @@ async function refreshSamlBearerToken(refreshToken, tokenUrl, clientId, clientSe
         if (axios_1.default.isAxiosError(error)) {
             logger?.error('[SAML] Token refresh failed', {
                 status: error.response?.status,
-                data: error.response?.data,
+                error: (0, oauthErrorBody_1.describeOAuthErrorBody)(error.response?.data, [
+                    refreshToken,
+                    clientSecret,
+                ]),
             });
         }
         throw error;

package/dist/auth/tokenRefresher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tokenRefresher.d.ts","sourceRoot":"","sources":["../../src/auth/tokenRefresher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAqD7B"}
+{"version":3,"file":"tokenRefresher.d.ts","sourceRoot":"","sources":["../../src/auth/tokenRefresher.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CACnC,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAqD7B"}

package/dist/auth/tokenRefresher.js

@@ -8,6 +8,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.refreshJwtToken = refreshJwtToken;
 const axios_1 = __importDefault(require("axios"));
+const oauthErrorBody_1 = require("./oauthErrorBody");
 /**
  * Refreshes the access token using refresh token
  * @param refreshToken Refresh token
@@ -53,7 +54,7 @@ async function refreshJwtToken(refreshToken, uaaUrl, clientId, clientSecret) {
             'status' in error.response &&
             'data' in error.response) {
             const axiosError = error;
-            throw new Error(`Token refresh failed (${axiosError.response.status}): ${JSON.stringify(axiosError.response.data)}`);
+            throw new Error(`Token refresh failed (${axiosError.response.status}): ${(0, oauthErrorBody_1.describeOAuthErrorBody)(axiosError.response.data, [refreshToken, clientSecret])}`);
         }
         else {
             const errorMessage = error instanceof Error ? error.message : String(error);

package/dist/providers/BaseTokenProvider.d.ts

@@ -31,7 +31,9 @@ export declare abstract class BaseTokenProvider implements ITokenProvider {
      */
     protected formatExpirationDate(timestamp: number): string;
     /**
-     * Format token for logging (start...end)
+     * What a log line may say about a token: that it is there, and its length.
+     * Never any of its characters — a UAA refresh token is about 34 characters,
+     * so even "the first and last 25" is the whole secret.
      */
     protected formatToken(token?: string): string | undefined;
     /**

package/dist/providers/BaseTokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAyElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IA0BlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}
+{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAyElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IA0BlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}

package/dist/providers/BaseTokenProvider.js

@@ -41,14 +41,14 @@ class BaseTokenProvider {
         return `${year}-${month}-${day} ${hours}:${minutes}:${seconds} UTC`;
     }
     /**
-     * Format token for logging (start...end)
+     * What a log line may say about a token: that it is there, and its length.
+     * Never any of its characters — a UAA refresh token is about 34 characters,
+     * so even "the first and last 25" is the whole secret.
      */
     formatToken(token) {
         if (!token)
             return undefined;
-        if (token.length <= 50)
-            return token;
-        return `${token.substring(0, 25)}...${token.substring(token.length - 25)}`;
+        return `<redacted, ${token.length} chars>`;
     }
     /**
      * Check if current token is valid (not expired)

package/dist/validation/assertionValidator.js

@@ -173,7 +173,7 @@ function createValidator(require, options) {
             // whose subtree an enveloped signature leaves unsigned.
             const place = placeOfAssertions(doc, assertion);
             if (place === 'inSignature') {
-                return fail('signedNode', 'the document carries an Assertion or EncryptedAssertion inside a ds:Signature, where no signature covers it');
+                return fail('signedNode', 'the document carries an Assertion or EncryptedAssertion inside a ds:Signature, which is never accepted');
             }
             if (place === 'outside') {
                 return fail('signedNode', 'the document carries an Assertion or EncryptedAssertion, SAML 2.0 or 1.x, outside the one the signature covers');
@@ -506,7 +506,7 @@ function readConfirmation(confirmation, context) {
     return { notOnOrAfter, notBefore };
 }
 /**
- * `no bearer confirmation qualifies: #1 …; #2 …`, naming at most
+ * `no bearer confirmation qualifies: #1 … | #2 …`, naming at most
  * LISTED_CANDIDATES candidates so the message stays bounded however many the
  * document carries.
  */
@@ -515,5 +515,5 @@ function describeRefusals(reasons) {
         .slice(0, LISTED_CANDIDATES)
         .map((reason, index) => `#${index + 1} ${reason}`);
     const more = reasons.length - listed.length;
-    return `no bearer confirmation qualifies: ${listed.join('; ')}${more > 0 ? `; and ${more} more` : ''}`;
+    return `no bearer confirmation qualifies: ${listed.join(' | ')}${more > 0 ? ` | and ${more} more` : ''}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "4.1.0",
+  "version": "4.1.3",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -39,12 +39,12 @@
   },
   "scripts": {
     "chrono": "./tools/version-stats.sh",
-    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "clean": "rm -rf dist tsconfig.tsbuildinfo tsconfig.build.tsbuildinfo",
     "lint": "npx biome check --write src",
     "lint:check": "npx biome check src",
     "format": "npx biome format --write src",
-    "build": "npm run --silent clean && npx biome check src --diagnostic-level=error && npx tsc -p tsconfig.json",
-    "build:fast": "npx tsc -p tsconfig.json",
+    "build": "npm run --silent clean && npx biome check src --diagnostic-level=error && npx tsc -p tsconfig.build.json",
+    "build:fast": "npx tsc -p tsconfig.build.json",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:check": "npx tsc --noEmit",
     "prepublishOnly": "npm run build",
@@ -70,7 +70,7 @@
     "@biomejs/biome": "^2.3.14",
     "@jest/globals": "^30.2.0",
     "@mcp-abap-adt/auth-mocks": "^0.3.0",
-    "@mcp-abap-adt/auth-stores": "^1.0.1",
+    "@mcp-abap-adt/auth-stores": "^1.2.1",
     "@mcp-abap-adt/logger": "^0.4.0",
     "@types/express": "^5.0.5",
     "@types/jest": "^30.0.0",

package/dist/__tests__/helpers/configHelpers.d.ts

@@ -1,46 +0,0 @@
-/**
- * Configuration helpers for auth-providers tests
- * Loads test configuration from test-config.yaml
- */
-export interface TestConfig {
-    destination?: string;
-    destination_dir?: string;
-    service_key_path?: string;
-    session_path?: string;
-}
-/**
- * Load test configuration from YAML
- * Uses test-config.yaml from tests/ directory
- */
-export declare function loadTestConfig(): TestConfig;
-/**
- * Check if test config has real values (not placeholders)
- */
-export declare function hasRealConfigValue(config?: TestConfig): boolean;
-/**
- * Get destination from config
- */
-export declare function getDestination(config?: TestConfig): string | null;
-/**
- * Get service keys directory from config
- * Uses base_dir/service-keys or default platform path
- */
-export declare function getServiceKeysDir(config?: TestConfig): string;
-/**
- * Get sessions directory from config
- * Uses base_dir/sessions or default platform path
- */
-export declare function getSessionsDir(config?: TestConfig): string;
-/**
- * Get service key file path
- * Returns full path to service key file
- */
-export declare function getServiceKeyPath(config?: TestConfig): string | null;
-/**
- * Get session file path
- * Returns full path to session file
- */
-export declare function getSessionPath(config?: TestConfig): string | null;
-export declare function getAbapDestination(config?: TestConfig): string | null;
-export declare function hasRealConfig(config?: TestConfig, _section?: 'abap' | 'xsuaa'): boolean;
-//# sourceMappingURL=configHelpers.d.ts.map

package/dist/__tests__/helpers/configHelpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"configHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/configHelpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAyD3C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAO/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAGjE;AA+BD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAa7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAa1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAcpE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAcjE;AAGD,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAErE;AAED,wBAAgB,aAAa,CAC3B,MAAM,CAAC,EAAE,UAAU,EACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAC1B,OAAO,CAET"}

package/dist/__tests__/helpers/configHelpers.js

@@ -1,232 +0,0 @@
-"use strict";
-/**
- * Configuration helpers for auth-providers tests
- * Loads test configuration from test-config.yaml
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadTestConfig = loadTestConfig;
-exports.hasRealConfigValue = hasRealConfigValue;
-exports.getDestination = getDestination;
-exports.getServiceKeysDir = getServiceKeysDir;
-exports.getSessionsDir = getSessionsDir;
-exports.getServiceKeyPath = getServiceKeyPath;
-exports.getSessionPath = getSessionPath;
-exports.getAbapDestination = getAbapDestination;
-exports.hasRealConfig = hasRealConfig;
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const yaml = __importStar(require("js-yaml"));
-let cachedConfig = null;
-/**
- * Find project root directory by looking for package.json
- */
-function findProjectRoot() {
-    let currentDir = __dirname;
-    while (currentDir !== path.dirname(currentDir)) {
-        const packageJsonPath = path.join(currentDir, 'package.json');
-        if (fs.existsSync(packageJsonPath)) {
-            return currentDir;
-        }
-        currentDir = path.dirname(currentDir);
-    }
-    // Fallback to process.cwd() if package.json not found
-    return process.cwd();
-}
-/**
- * Load test configuration from YAML
- * Uses test-config.yaml from tests/ directory
- */
-function loadTestConfig() {
-    if (cachedConfig) {
-        return cachedConfig;
-    }
-    // Find project root and load from tests/test-config.yaml
-    const projectRoot = findProjectRoot();
-    const configPath = path.resolve(projectRoot, 'tests', 'test-config.yaml');
-    const templatePath = path.resolve(projectRoot, 'tests', 'test-config.yaml.template');
-    if (process.env.TEST_VERBOSE) {
-        console.log(`[configHelpers] Project root: ${projectRoot}`);
-        console.log(`[configHelpers] Config path: ${configPath}`);
-        console.log(`[configHelpers] Config exists: ${fs.existsSync(configPath)}`);
-    }
-    if (fs.existsSync(configPath)) {
-        try {
-            const configContent = fs.readFileSync(configPath, 'utf8');
-            cachedConfig = yaml.load(configContent) || {};
-            if (process.env.TEST_VERBOSE) {
-                console.log(`[configHelpers] Loaded config:`, JSON.stringify(cachedConfig, null, 2));
-            }
-            return cachedConfig;
-        }
-        catch (error) {
-            console.warn(`Failed to load test config from ${configPath}:`, error);
-            return {};
-        }
-    }
-    if (fs.existsSync(templatePath)) {
-        console.warn('⚠️  tests/test-config.yaml not found. Using template (all integration tests will be disabled).');
-        try {
-            const templateContent = fs.readFileSync(templatePath, 'utf8');
-            cachedConfig = yaml.load(templateContent) || {};
-            return cachedConfig;
-        }
-        catch (error) {
-            console.warn(`Failed to load test config template from ${templatePath}:`, error);
-            return {};
-        }
-    }
-    console.warn('⚠️  Test configuration files not found.');
-    console.warn('Please create tests/test-config.yaml with test parameters.');
-    return {};
-}
-/**
- * Check if test config has real values (not placeholders)
- */
-function hasRealConfigValue(config) {
-    const cfg = config || loadTestConfig();
-    if (!cfg.destination) {
-        return false;
-    }
-    // Check if destination is not a placeholder
-    return !cfg.destination.includes('<') && !cfg.destination.includes('>');
-}
-/**
- * Get destination from config
- */
-function getDestination(config) {
-    const cfg = config || loadTestConfig();
-    return cfg.destination || null;
-}
-/**
- * Get default destination directory based on platform
- */
-function getDefaultDestinationDir() {
-    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-    if (process.platform === 'win32') {
-        return path.join(homeDir, 'Documents', 'mcp-abap-adt');
-    }
-    return path.join(homeDir, '.config', 'mcp-abap-adt');
-}
-/**
- * Get destination directory from config or use default
- */
-function getDestinationDir(config) {
-    const cfg = config || loadTestConfig();
-    if (cfg.destination_dir) {
-        // Expand ~ to home directory
-        if (cfg.destination_dir.startsWith('~')) {
-            const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-            return cfg.destination_dir.replace('~', homeDir);
-        }
-        return cfg.destination_dir;
-    }
-    return getDefaultDestinationDir();
-}
-/**
- * Get service keys directory from config
- * Uses base_dir/service-keys or default platform path
- */
-function getServiceKeysDir(config) {
-    const cfg = config || loadTestConfig();
-    // If service_key_path is specified, return its directory
-    if (cfg.service_key_path) {
-        const projectRoot = findProjectRoot();
-        const fullPath = path.resolve(projectRoot, cfg.service_key_path);
-        return path.dirname(fullPath);
-    }
-    // Use destination_dir/service-keys
-    const destinationDir = getDestinationDir(cfg);
-    return path.join(destinationDir, 'service-keys');
-}
-/**
- * Get sessions directory from config
- * Uses base_dir/sessions or default platform path
- */
-function getSessionsDir(config) {
-    const cfg = config || loadTestConfig();
-    // If session_path is specified, return its directory
-    if (cfg.session_path) {
-        const projectRoot = findProjectRoot();
-        const fullPath = path.resolve(projectRoot, cfg.session_path);
-        return path.dirname(fullPath);
-    }
-    // Use destination_dir/sessions
-    const destinationDir = getDestinationDir(cfg);
-    return path.join(destinationDir, 'sessions');
-}
-/**
- * Get service key file path
- * Returns full path to service key file
- */
-function getServiceKeyPath(config) {
-    const cfg = config || loadTestConfig();
-    const destination = cfg.destination;
-    if (!destination)
-        return null;
-    // If service_key_path is specified, use it
-    if (cfg.service_key_path) {
-        const projectRoot = findProjectRoot();
-        return path.resolve(projectRoot, cfg.service_key_path);
-    }
-    // Construct from directory + destination
-    const serviceKeysDir = getServiceKeysDir(cfg);
-    return path.join(serviceKeysDir, `${destination}.json`);
-}
-/**
- * Get session file path
- * Returns full path to session file
- */
-function getSessionPath(config) {
-    const cfg = config || loadTestConfig();
-    const destination = cfg.destination;
-    if (!destination)
-        return null;
-    // If session_path is specified, use it
-    if (cfg.session_path) {
-        const projectRoot = findProjectRoot();
-        return path.resolve(projectRoot, cfg.session_path);
-    }
-    // Construct from directory + destination
-    const sessionsDir = getSessionsDir(cfg);
-    return path.join(sessionsDir, `${destination}.env`);
-}
-// Legacy functions for backward compatibility
-function getAbapDestination(config) {
-    return getDestination(config);
-}
-function hasRealConfig(config, _section) {
-    return hasRealConfigValue(config);
-}

package/dist/__tests__/helpers/netHelpers.d.ts

@@ -1,19 +0,0 @@
-export declare function getAvailablePort(): Promise<number>;
-export declare function canListenOnLocalhost(): Promise<boolean>;
-/**
- * Whether a login in this test could own `port` — and therefore whether
- * asserting that it released the port means anything.
- *
- * A release assertion is a claim about our own cleanup. When an unrelated
- * process already holds the port, the login fails at the probe, never binds
- * anything, and cannot release anything: the port is still held afterwards,
- * the code is behaving exactly as it should, and the assertion fails anyway.
- * That is a test reporting on what else is running on the machine.
- *
- * So the gate is placed *before* the login rather than the assertion being
- * widened until it always passes — a `toBe(true)` relaxed into "free or held"
- * would also pass when our own cleanup leaked, which is the one thing these
- * cases exist to catch.
- */
-export declare function canOwnPort(port: number, context: string): Promise<boolean>;
-//# sourceMappingURL=netHelpers.d.ts.map

package/dist/__tests__/helpers/netHelpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"netHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/netHelpers.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAcxD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB"}

package/dist/__tests__/helpers/netHelpers.js

@@ -1,92 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAvailablePort = getAvailablePort;
-exports.canListenOnLocalhost = canListenOnLocalhost;
-exports.canOwnPort = canOwnPort;
-const net = __importStar(require("node:net"));
-async function getAvailablePort() {
-    return new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            if (typeof address === 'object' && address?.port) {
-                const port = address.port;
-                server.close(() => resolve(port));
-            }
-            else {
-                server.close(() => reject(new Error('Failed to acquire a port')));
-            }
-        });
-    });
-}
-async function canListenOnLocalhost() {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.once('error', () => resolve(false));
-        server.listen(0, '127.0.0.1', () => {
-            server.close(() => resolve(true));
-        });
-    });
-}
-/**
- * Whether a login in this test could own `port` — and therefore whether
- * asserting that it released the port means anything.
- *
- * A release assertion is a claim about our own cleanup. When an unrelated
- * process already holds the port, the login fails at the probe, never binds
- * anything, and cannot release anything: the port is still held afterwards,
- * the code is behaving exactly as it should, and the assertion fails anyway.
- * That is a test reporting on what else is running on the machine.
- *
- * So the gate is placed *before* the login rather than the assertion being
- * widened until it always passes — a `toBe(true)` relaxed into "free or held"
- * would also pass when our own cleanup leaked, which is the one thing these
- * cases exist to catch.
- */
-async function canOwnPort(port, context) {
-    const free = await new Promise((resolve) => {
-        const probe = net.createServer();
-        probe.once('error', () => resolve(false));
-        probe.listen(port, () => probe.close(() => resolve(true)));
-    });
-    if (!free) {
-        console.warn(`⚠️  Port ${port} is held by another process — skipping the port-release ` +
-            `assertions in "${context}". A login that never bound the socket cannot ` +
-            'release it; the remaining assertions in this case still run.');
-    }
-    return free;
-}

package/dist/__tests__/helpers/testLogger.d.ts

@@ -1,7 +0,0 @@
-/**
- * Test logger with environment variable control
- * Uses DefaultLogger from @mcp-abap-adt/logger for proper formatting
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export declare function createTestLogger(prefix?: string): ILogger;
-//# sourceMappingURL=testLogger.d.ts.map

package/dist/__tests__/helpers/testLogger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"testLogger.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/testLogger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,MAAe,GAAG,OAAO,CAwCjE"}

package/dist/__tests__/helpers/testLogger.js

@@ -1,45 +0,0 @@
-"use strict";
-/**
- * Test logger with environment variable control
- * Uses DefaultLogger from @mcp-abap-adt/logger for proper formatting
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTestLogger = createTestLogger;
-const logger_1 = require("@mcp-abap-adt/logger");
-function createTestLogger(prefix = 'TEST') {
-    // Check if logging is enabled
-    const isEnabled = () => {
-        return (process.env.DEBUG_PROVIDER === 'true' ||
-            process.env.DEBUG_AUTH_PROVIDERS === 'true' ||
-            process.env.DEBUG_BROWSER_AUTH === 'true' ||
-            process.env.DEBUG === 'true' ||
-            process.env.DEBUG?.includes('provider') === true ||
-            process.env.DEBUG?.includes('auth-providers') === true);
-    };
-    // Create DefaultLogger with appropriate log level
-    // getLogLevel respects AUTH_LOG_LEVEL env var and defaults to INFO
-    const baseLogger = new logger_1.DefaultLogger((0, logger_1.getLogLevel)());
-    // Return wrapper that checks if logging is enabled
-    return {
-        debug: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.debug(`[${prefix}] ${message}`, meta);
-            }
-        },
-        info: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.info(`[${prefix}] ${message}`, meta);
-            }
-        },
-        warn: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.warn(`[${prefix}] ${message}`, meta);
-            }
-        },
-        error: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.error(`[${prefix}] ${message}`, meta);
-            }
-        },
-    };
-}

package/dist/__tests__/integration/stand/formLogin.d.ts

@@ -1,68 +0,0 @@
-/**
- * Plays the user in an interactive login against a stand server's own login
- * page: follows redirects, keeps cookies, finds the form with a password
- * field, fills it in with every hidden field it carries (UAA's CSRF token,
- * Keycloak's session code), and submits it.
- *
- * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
- * the pinned image versions keep stable. It is a test helper, not a browser.
- */
-export interface Credentials {
-    username: string;
-    password: string;
-}
-export declare class FormBrowser {
-    private readonly cookies;
-    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
-    open(url: string, stop?: (next: string) => boolean): Promise<{
-        url: string;
-        html?: string;
-    }>;
-    /**
-     * Submit the login form on `page`, then follow redirects until `stop` says
-     * the next location is the one the caller wants — typically the client's
-     * redirect URI carrying the code — without requesting it.
-     */
-    submitLogin(page: {
-        url: string;
-        html?: string;
-    }, credentials: Credentials, stop?: (next: string) => boolean): Promise<{
-        url: string;
-        html?: string;
-    }>;
-    /**
-     * Accept a consent page ("Do you grant these access privileges?"): submit
-     * the form that carries an `accept` button, with its hidden fields.
-     */
-    acceptConsent(page: {
-        url: string;
-        html?: string;
-    }): Promise<{
-        url: string;
-        html?: string;
-    }>;
-    private follow;
-    private remember;
-    private cookieHeader;
-}
-/**
- * Log in through the authorization URL and return the redirect URI the server
- * sends the browser back to, with its `code` — not requested, since nothing
- * listens there.
- */
-export declare function authorizeByForm(authorizationUrl: string, redirectUri: string, credentials: Credentials): Promise<URL>;
-/**
- * Approve a device authorization the way a user would: open the verification
- * URI (with the user code already in it), log in, and grant access.
- */
-export declare function approveDevice(verificationUriComplete: string, credentials: Credentials): Promise<void>;
-/**
- * A SAML login at an identity provider: open the AuthnRequest URL, log in,
- * and take the SAMLResponse from the auto-posting form the IdP answers with —
- * what a browser would post to the assertion consumer service.
- */
-export declare function samlResponseByForm(authnRequestUrl: string, credentials: Credentials): Promise<{
-    samlResponse: string;
-    acsUrl: string;
-}>;
-//# sourceMappingURL=formLogin.d.ts.map

package/dist/__tests__/integration/stand/formLogin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"formLogin.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/integration/stand/formLogin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,4EAA4E;IACtE,IAAI,CACR,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAqB,GAC5C,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1C;;;;OAIG;IACG,WAAW,CACf,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACpC,WAAW,EAAE,WAAW,EACxB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAqB,GAC5C,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB1C;;;OAGG;IACG,aAAa,CAAC,IAAI,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAgC7B,MAAM;IA4BpB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,YAAY;CAGrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAcd;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,uBAAuB,EAAE,MAAM,EAC/B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnD"}

package/dist/__tests__/integration/stand/formLogin.js

@@ -1,194 +0,0 @@
-"use strict";
-/**
- * Plays the user in an interactive login against a stand server's own login
- * page: follows redirects, keeps cookies, finds the form with a password
- * field, fills it in with every hidden field it carries (UAA's CSRF token,
- * Keycloak's session code), and submits it.
- *
- * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
- * the pinned image versions keep stable. It is a test helper, not a browser.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FormBrowser = void 0;
-exports.authorizeByForm = authorizeByForm;
-exports.approveDevice = approveDevice;
-exports.samlResponseByForm = samlResponseByForm;
-const MAX_HOPS = 20;
-class FormBrowser {
-    cookies = new Map();
-    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
-    async open(url, stop = () => false) {
-        return this.follow(url, { method: 'GET' }, stop);
-    }
-    /**
-     * Submit the login form on `page`, then follow redirects until `stop` says
-     * the next location is the one the caller wants — typically the client's
-     * redirect URI carrying the code — without requesting it.
-     */
-    async submitLogin(page, credentials, stop = () => false) {
-        const form = findPasswordForm(page.html ?? '');
-        if (!form) {
-            throw new Error(`no login form on ${page.url}`);
-        }
-        const body = new URLSearchParams(form.hidden);
-        body.set(form.userField, credentials.username);
-        body.set(form.passwordField, credentials.password);
-        return this.follow(new URL(form.action, page.url).toString(), {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-        }, stop);
-    }
-    /**
-     * Accept a consent page ("Do you grant these access privileges?"): submit
-     * the form that carries an `accept` button, with its hidden fields.
-     */
-    async acceptConsent(page) {
-        for (const match of (page.html ?? '').matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
-            const formHtml = match[0];
-            const inputs = [...formHtml.matchAll(/<(?:input|button)\b[^>]*>/gi)].map((m) => m[0]);
-            const accept = inputs.find((i) => attribute(i, 'name') === 'accept');
-            if (!accept)
-                continue;
-            const body = new URLSearchParams();
-            for (const input of inputs) {
-                const name = attribute(input, 'name');
-                if (name && attribute(input, 'type') === 'hidden') {
-                    body.set(name, attribute(input, 'value') ?? '');
-                }
-            }
-            body.set('accept', attribute(accept, 'value') ?? 'Yes');
-            const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
-            return this.follow(new URL(attribute(formTag, 'action') ?? '', page.url).toString(), {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: body.toString(),
-            }, () => false);
-        }
-        throw new Error(`no consent form on ${page.url}`);
-    }
-    async follow(url, init, stop) {
-        let current = url;
-        let request = init;
-        for (let hop = 0; hop < MAX_HOPS; hop++) {
-            const response = await fetch(current, {
-                ...request,
-                redirect: 'manual',
-                headers: { ...(request.headers ?? {}), Cookie: this.cookieHeader() },
-                signal: AbortSignal.timeout(15_000),
-            });
-            this.remember(response);
-            const location = response.headers.get('location');
-            if (response.status >= 300 && response.status < 400 && location) {
-                const next = new URL(location, current).toString();
-                if (stop(next))
-                    return { url: next };
-                current = next;
-                request = { method: 'GET' };
-                continue;
-            }
-            return { url: current, html: await response.text() };
-        }
-        throw new Error(`more than ${MAX_HOPS} redirects from ${url}`);
-    }
-    remember(response) {
-        for (const line of response.headers.getSetCookie()) {
-            const [pair] = line.split(';');
-            const eq = pair.indexOf('=');
-            if (eq > 0) {
-                this.cookies.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
-            }
-        }
-    }
-    cookieHeader() {
-        return [...this.cookies].map(([k, v]) => `${k}=${v}`).join('; ');
-    }
-}
-exports.FormBrowser = FormBrowser;
-/**
- * Log in through the authorization URL and return the redirect URI the server
- * sends the browser back to, with its `code` — not requested, since nothing
- * listens there.
- */
-async function authorizeByForm(authorizationUrl, redirectUri, credentials) {
-    const reached = (next) => next.startsWith(redirectUri);
-    const browser = new FormBrowser();
-    const page = await browser.open(authorizationUrl, reached);
-    const done = page.html === undefined
-        ? page
-        : await browser.submitLogin(page, credentials, reached);
-    if (!reached(done.url)) {
-        throw new Error(`login did not return to ${redirectUri}; ended at ${done.url}`);
-    }
-    return new URL(done.url);
-}
-/**
- * Approve a device authorization the way a user would: open the verification
- * URI (with the user code already in it), log in, and grant access.
- */
-async function approveDevice(verificationUriComplete, credentials) {
-    const browser = new FormBrowser();
-    const page = await browser.open(verificationUriComplete);
-    const consent = await browser.submitLogin(page, credentials);
-    await browser.acceptConsent(consent);
-}
-/**
- * A SAML login at an identity provider: open the AuthnRequest URL, log in,
- * and take the SAMLResponse from the auto-posting form the IdP answers with —
- * what a browser would post to the assertion consumer service.
- */
-async function samlResponseByForm(authnRequestUrl, credentials) {
-    const browser = new FormBrowser();
-    const page = await browser.submitLogin(await browser.open(authnRequestUrl), credentials);
-    const html = page.html ?? '';
-    const input = [...html.matchAll(/<input\b[^>]*>/gi)]
-        .map((m) => m[0])
-        .find((i) => attribute(i, 'name') === 'SAMLResponse');
-    const samlResponse = input ? attribute(input, 'value') : undefined;
-    const formTag = /<form\b[^>]*>/i.exec(html)?.[0] ?? '';
-    if (!samlResponse) {
-        throw new Error(`no SAMLResponse form on ${page.url}`);
-    }
-    return { samlResponse, acsUrl: attribute(formTag, 'action') ?? '' };
-}
-const decode = (value) => value
-    .replace(/&amp;/g, '&')
-    .replace(/&quot;/g, '"')
-    .replace(/&#39;/g, "'")
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>');
-const attribute = (tag, name) => {
-    const match = new RegExp(`\\s${name}\\s*=\\s*("([^"]*)"|'([^']*)')`, 'i').exec(tag);
-    return match ? decode(match[2] ?? match[3] ?? '') : undefined;
-};
-function findPasswordForm(html) {
-    for (const match of html.matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
-        const formHtml = match[0];
-        const inputs = [...formHtml.matchAll(/<input\b[^>]*>/gi)].map((m) => m[0]);
-        const password = inputs.find((i) => attribute(i, 'type') === 'password');
-        if (!password)
-            continue;
-        const hidden = {};
-        let userField = 'username';
-        for (const input of inputs) {
-            const type = (attribute(input, 'type') ?? 'text').toLowerCase();
-            const name = attribute(input, 'name');
-            if (!name)
-                continue;
-            if (type === 'hidden')
-                hidden[name] = attribute(input, 'value') ?? '';
-            if ((type === 'text' || type === 'email') &&
-                /user|email|login/i.test(name)) {
-                userField = name;
-            }
-        }
-        const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
-        return {
-            action: attribute(formTag, 'action') ?? '',
-            userField,
-            passwordField: attribute(password, 'name') ?? 'password',
-            hidden,
-        };
-    }
-    return undefined;
-}