@mcp-abap-adt/auth-providers 4.1.2 → 4.1.3

package/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.1.3] - 2026-09-26
+
+### Changed
+
+- A `bearerConfirmation` refusal naming several candidates joins them with
+  ` | ` instead of `; `, and ends ` | and N more`. The count reason
+  `carries N SubjectConfirmationData; exactly one is allowed` contains `; `
+  itself, so the old separator read ambiguously. `check` and every reason's
+  wording are unchanged.
+
+### Removed
+
+- `mcp.json`, an XSUAA service key with a client secret, committed to the
+  repository on 2025-12-23 with the since-removed `bin/` CLIs. It was never in
+  the npm package. It stays in the git history, so that binding should be
+  rotated or deleted. `.gitignore` now keeps `mcp.json` and
+  `*service-key*.json` out.
+
 ## [4.1.2] - 2026-09-26
 
 ### Security

package/README.md

@@ -672,7 +672,7 @@ What the table compresses:
   `xsd:dateTime`; `NotOnOrAfter` has not passed beyond `clockSkewMs`;
   `NotBefore` has arrived within it. When none qualifies, the refusal names
   every candidate in document order with the first sub-rule it failed —
-  `no bearer confirmation qualifies: #1 Recipient is not the ACS; #2
+  `no bearer confirmation qualifies: #1 Recipient is not the ACS | #2
   NotOnOrAfter has passed` — listing at most five, then `and N more`.
 - **Check 9 is AND across restrictions, OR within one**, as SAML Core §2.5.1.4
   says: every `AudienceRestriction` must name you; the `Audience` elements
@@ -755,14 +755,16 @@ value.
 | `bearerConfirmation` | `the assertion carries no saml:Subject` |
 | `bearerConfirmation` | `the assertion carries <n> saml:Subject; exactly one is allowed` |
 | `bearerConfirmation` | `the saml:Subject holds no SubjectConfirmation` |
-| `bearerConfirmation` | `no bearer confirmation qualifies: #1 <reason>; #2 <reason>; …` |
+| `bearerConfirmation` | `no bearer confirmation qualifies: #1 <reason> \| #2 <reason> \| …` |
 | `destination` | `the response carries no Destination` |
 | `destination` | `the response is addressed to "…", not to us` |
 | `replay` | `this assertion has been presented before` |
 
 A `bearerConfirmation` refusal naming candidates lists each one's first failed
-sub-rule, in document order, joined by `; `; past five candidates it ends
-`; and N more`, N being how many were not listed. The eleven reasons:
+sub-rule, in document order, joined by ` | ` — not `; `, which a count reason
+such as `carries 2 SubjectConfirmationData; exactly one is allowed` contains
+itself; past five candidates it ends ` | and N more`, N being how many were
+not listed. The eleven reasons:
 
 | # | `<reason>`, in the order a candidate is tested |
 |---|---|

package/dist/validation/assertionValidator.js

@@ -506,7 +506,7 @@ function readConfirmation(confirmation, context) {
     return { notOnOrAfter, notBefore };
 }
 /**
- * `no bearer confirmation qualifies: #1 …; #2 …`, naming at most
+ * `no bearer confirmation qualifies: #1 … | #2 …`, naming at most
  * LISTED_CANDIDATES candidates so the message stays bounded however many the
  * document carries.
  */
@@ -515,5 +515,5 @@ function describeRefusals(reasons) {
         .slice(0, LISTED_CANDIDATES)
         .map((reason, index) => `#${index + 1} ${reason}`);
     const more = reasons.length - listed.length;
-    return `no bearer confirmation qualifies: ${listed.join('; ')}${more > 0 ? `; and ${more} more` : ''}`;
+    return `no bearer confirmation qualifies: ${listed.join(' | ')}${more > 0 ? ` | and ${more} more` : ''}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",