@mcp-abap-adt/auth-providers 4.1.2 → 4.2.0

package/CHANGELOG.md

@@ -7,6 +7,75 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [4.2.0] - 2026-09-26
+
+### Added
+
+- **`refreshTokens()`** on every provider, through `BaseTokenProvider`: a new
+  token, never the cached one — the refresh token when there is one, the login
+  flow when there is none or the refresh is refused — and it replaces the
+  cache. `getTokens()` answers the cache while the token looks valid, so a
+  caller holding a 401 had no way to ask for another; auth-broker's
+  `refreshToken()` got the refused token back. Every provider now implements
+  `IRefreshableTokenProvider` from `@mcp-abap-adt/interfaces-auth` 2.1.0
+  (decision 39 there). `getTokens()` is unchanged: it now calls
+  `refreshTokens()` once the cache is not valid, which is the same path it
+  took inline before.
+- **`SsoProviderFactory.create()` answers `IRefreshableTokenProvider`**, and
+  `SsoProviderInstance` is that type, so a provider from the factory can be
+  handed to anything requiring the refreshable contract without a cast. Every
+  provider it builds already was one.
+
+### Fixed
+
+- **A failed browser login is a `BrowserAuthError`.** The class was exported
+  and documented as "browser auth failed", and thrown nowhere: a timeout, the
+  identity provider's refusal (`OAuth2 authentication failed: …`), a busy
+  callback port, a browser that would not open and an abort all reached the
+  caller as a plain `Error`, so the one type a caller could catch for them
+  never arrived. `BrowserCallbackStrategy` — and so `browserCallbackStrategy`,
+  `oidcCallbackStrategy` and `samlCallbackStrategy` — now throws it, with the
+  original message and the original error as `cause`; an error that already
+  has a type (a `ValidationError` from building the URL) passes unchanged.
+  Found by auth-broker, whose migration note had nothing to point at.
+- The README's error-handling example caught `RefreshError` as "browser auth
+  failed". No provider throws `RefreshError`, `SessionDataError` or
+  `ServiceKeyError`; the README now says so.
+
+### Changed
+
+- `@mcp-abap-adt/interfaces-auth` `^2.1.0` (was `^2.0.1`), which declares
+  `IRefreshableTokenProvider`.
+
+### Documentation
+
+- `docs/btp-setup.md`: what each provider needs on the SAP side — XSUAA
+  client, trust, user, ABAP mapping — and whether ADT accepts its token, with
+  every claim tagged by source (SAP, Community, Measured, Inference) and the
+  open questions still to be settled live.
+- `docs/passwordless-sso.md`: SAP GUI's passwordless SNC login, why Eclipse
+  ADT's on-premise SSO runs over RFC, the HTTP equivalents (X.509 client
+  certificates, SPNego, IAS), what a Node.js client can reach, and options for
+  this package.
+
+## [4.1.3] - 2026-09-26
+
+### Changed
+
+- A `bearerConfirmation` refusal naming several candidates joins them with
+  ` | ` instead of `; `, and ends ` | and N more`. The count reason
+  `carries N SubjectConfirmationData; exactly one is allowed` contains `; `
+  itself, so the old separator read ambiguously. `check` and every reason's
+  wording are unchanged.
+
+### Removed
+
+- `mcp.json`, an XSUAA service key with a client secret, committed to the
+  repository on 2025-12-23 with the since-removed `bin/` CLIs. It was never in
+  the npm package. It stays in the git history, so that binding should be
+  rotated or deleted. `.gitignore` now keeps `mcp.json` and
+  `*service-key*.json` out.
+
 ## [4.1.2] - 2026-09-26
 
 ### Security

package/README.md

@@ -13,7 +13,7 @@ npm install @mcp-abap-adt/auth-providers
 
 ## Overview
 
-This package implements the `ITokenProvider` interface from `@mcp-abap-adt/interfaces-auth`:
+This package implements `IRefreshableTokenProvider` — `ITokenProvider` plus `refreshTokens()` — from `@mcp-abap-adt/interfaces-auth`:
 
 - **ClientCredentialsProvider** — `client_credentials`, no user interaction
 - **AuthorizationCodeProvider** — UAA/XSUAA authorization code, through a browser
@@ -27,7 +27,15 @@ This package implements the `ITokenProvider` interface from `@mcp-abap-adt/inter
   (RFC 7522)
 - **Saml2PureProvider** — a SAML assertion exchanged for session cookies
 
-Providers are configured via constructor; `getTokens()` takes no parameters and handles refresh/login internally.
+Providers are configured via constructor; `getTokens()` takes no parameters and handles refresh/login internally. `refreshTokens()` obtains a new token even while the cached one looks valid — what a caller holding a 401 needs.
+
+A token is only half of it: whether ADT accepts it depends on the XSUAA client,
+the trust and the user configured on the SAP side. What each provider needs
+there, and which are usable for ADT at all, is in
+[docs/btp-setup.md](docs/btp-setup.md).
+Logging on without a password — SAP GUI's SNC single sign-on and its HTTP
+equivalents, X.509 client certificates and SPNego — is in
+[docs/passwordless-sso.md](docs/passwordless-sso.md).
 
 Since 2.0.0 an interactive login is conducted by an **authorization strategy**
 (`IAuthorizationStrategy` from `@mcp-abap-adt/interfaces-auth`) passed as
@@ -672,7 +680,7 @@ What the table compresses:
   `xsd:dateTime`; `NotOnOrAfter` has not passed beyond `clockSkewMs`;
   `NotBefore` has arrived within it. When none qualifies, the refusal names
   every candidate in document order with the first sub-rule it failed —
-  `no bearer confirmation qualifies: #1 Recipient is not the ACS; #2
+  `no bearer confirmation qualifies: #1 Recipient is not the ACS | #2
   NotOnOrAfter has passed` — listing at most five, then `and N more`.
 - **Check 9 is AND across restrictions, OR within one**, as SAML Core §2.5.1.4
   says: every `AudienceRestriction` must name you; the `Audience` elements
@@ -755,14 +763,16 @@ value.
 | `bearerConfirmation` | `the assertion carries no saml:Subject` |
 | `bearerConfirmation` | `the assertion carries <n> saml:Subject; exactly one is allowed` |
 | `bearerConfirmation` | `the saml:Subject holds no SubjectConfirmation` |
-| `bearerConfirmation` | `no bearer confirmation qualifies: #1 <reason>; #2 <reason>; …` |
+| `bearerConfirmation` | `no bearer confirmation qualifies: #1 <reason> \| #2 <reason> \| …` |
 | `destination` | `the response carries no Destination` |
 | `destination` | `the response is addressed to "…", not to us` |
 | `replay` | `this assertion has been presented before` |
 
 A `bearerConfirmation` refusal naming candidates lists each one's first failed
-sub-rule, in document order, joined by `; `; past five candidates it ends
-`; and N more`, N being how many were not listed. The eleven reasons:
+sub-rule, in document order, joined by ` | ` — not `; `, which a count reason
+such as `carries 2 SubjectConfirmationData; exactly one is allowed` contains
+itself; past five candidates it ends ` | and N more`, N being how many were
+not listed. The eleven reasons:
 
 | # | `<reason>`, in the order a candidate is tested |
 |---|---|
@@ -1202,7 +1212,22 @@ This approach prevents unnecessary token refresh and browser authentication when
 
 ### Token Refresh
 
-Providers handle refresh automatically inside `getTokens()`. No separate refresh methods are needed.
+Providers handle refresh automatically inside `getTokens()`: while the cached token is valid it
+is returned, once it expires the refresh token is used, and a login follows when there is none or
+the refresh is refused.
+
+The clock is not the only judge, though. When the server refuses a token the cache still
+considers valid — a 401 — ask for a new one with `refreshTokens()`. It skips the cache, takes the
+same refresh-then-login path, and replaces the cache with what it obtains:
+
+```typescript
+let { authorizationToken } = await provider.getTokens();
+let response = await call(authorizationToken);
+if (response.status === 401) {
+  ({ authorizationToken } = await provider.refreshTokens());
+  response = await call(authorizationToken);
+}
+```
 
 ```typescript
 try {
@@ -1211,8 +1236,9 @@ try {
 } catch (error) {
   if (error instanceof ValidationError) {
     console.error('Missing fields:', error.missingFields);
-  } else if (error instanceof RefreshError) {
-    console.error('Browser auth failed:', error.cause);
+  } else if (error instanceof BrowserAuthError) {
+    // the login timed out, the IdP refused, the port was taken, ...
+    console.error('Browser auth failed:', error.message, error.cause);
   }
 }
 ```
@@ -1243,14 +1269,12 @@ try {
     // provider config validation failed
     console.error('Missing required fields:', error.missingFields);
     console.error('Error code:', error.code); // 'VALIDATION_ERROR'
-  } else if (error instanceof RefreshError) {
-    // Token refresh operation failed
-    console.error('Refresh failed:', error.message);
-    console.error('Original error:', error.cause);
-    console.error('Error code:', error.code); // 'REFRESH_ERROR'
   } else if (error instanceof BrowserAuthError) {
-    // Browser authentication failed
-    console.error('Browser auth failed:', error.cause);
+    // A browser login failed: timeout, the IdP's refusal, a busy callback
+    // port, a browser that would not open, an abort. The message is the
+    // original's, and the original is `cause`.
+    console.error('Browser auth failed:', error.message);
+    console.error('Error code:', error.code); // 'BROWSER_AUTH_ERROR'
   }
 }
 ```
@@ -1258,10 +1282,8 @@ try {
 **Error Types**:
 - `TokenProviderError` - Base class with `code: string` property
 - `ValidationError` - provider config validation failed, includes `missingFields: string[]`
-- `RefreshError` - Token refresh failed, includes `cause?: Error`
-- `SessionDataError` - Session data invalid, includes `missingFields: string[]`
-- `ServiceKeyError` - Service key data invalid, includes `missingFields: string[]`
-- `BrowserAuthError` - Browser auth failed, includes `cause?: Error`
+- `BrowserAuthError` - a browser login failed (timeout, the identity provider's refusal, a busy callback port, a browser that would not open, an abort), includes `cause?: Error`; thrown by every browser strategy (`browserCallbackStrategy`, `oidcCallbackStrategy`, `samlCallbackStrategy`)
+- `RefreshError`, `SessionDataError`, `ServiceKeyError` - exported, but no provider throws them: a refused refresh falls back to a login inside `getTokens()`/`refreshTokens()`, and sessions and service keys are read by `@mcp-abap-adt/auth-stores`, not here
 - `AssertionValidationError` - a SAML assertion was refused, includes `check: AssertionCheck` naming the check that failed — see [SAML assertion validation](#errors)
 
 All error codes are defined in `@mcp-abap-adt/interfaces-auth` package as `TOKEN_PROVIDER_ERROR_CODES`, and `AssertionValidationError`'s as `ASSERTION_ERROR_CODES`.

package/dist/providers/BaseTokenProvider.d.ts

@@ -7,7 +7,7 @@
  * - Expiration checking
  * - Automatic refresh/relogin
  */
-import type { ITokenProvider, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { IRefreshableTokenProvider, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 /**
  * Abstract base class for token providers
@@ -18,7 +18,7 @@ import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
  * - Automatically refreshes expired tokens
  * - Falls back to login if refresh fails
  */
-export declare abstract class BaseTokenProvider implements ITokenProvider {
+export declare abstract class BaseTokenProvider implements IRefreshableTokenProvider {
     protected authorizationToken?: string;
     protected refreshToken?: string;
     protected expiresAt?: number;
@@ -66,6 +66,15 @@ export declare abstract class BaseTokenProvider implements ITokenProvider {
      * @returns Promise that resolves to token result
      */
     getTokens(): Promise<ITokenResult>;
+    /**
+     * A new token, never the cached one: the refresh token when there is one,
+     * the login flow when there is none or the refresh is refused.
+     *
+     * `getTokens()` answers the cache while the token looks valid, so a caller
+     * holding a 401 — the server refused a token the clock still accepts — has
+     * no other way to get a different one. What this obtains replaces the cache.
+     */
+    refreshTokens(): Promise<ITokenResult>;
     validateToken(_token: string, _serviceUrl?: string): Promise<boolean>;
     /**
      * Update internal token cache from result

package/dist/providers/BaseTokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAyElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IA0BlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}
+{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,yBAAyB;IAC1E,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;;;OAIG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAKzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAmCxC;;;;;;;OAOG;IACG,aAAa,IAAI,OAAO,CAAC,YAAY,CAAC;IAsCtC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IA0BlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}

package/dist/providers/BaseTokenProvider.js

@@ -115,9 +115,19 @@ class BaseTokenProvider {
                     : undefined,
             };
         }
-        // Try refresh if we have refresh token
+        return this.refreshTokens();
+    }
+    /**
+     * A new token, never the cached one: the refresh token when there is one,
+     * the login flow when there is none or the refresh is refused.
+     *
+     * `getTokens()` answers the cache while the token looks valid, so a caller
+     * holding a 401 — the server refused a token the clock still accepts — has
+     * no other way to get a different one. What this obtains replaces the cache.
+     */
+    async refreshTokens() {
         if (this.refreshToken) {
-            this.logger?.info('[BaseTokenProvider] Token invalid, attempting refresh', {
+            this.logger?.info('[BaseTokenProvider] Obtaining a new token by refresh', {
                 oldToken: this.formatToken(this.authorizationToken),
                 refreshToken: this.formatToken(this.refreshToken),
             });
@@ -134,14 +144,11 @@ class BaseTokenProvider {
                 this.logger?.warn('[BaseTokenProvider] Refresh failed', {
                     error: error instanceof Error ? error.message : String(error),
                 });
-                // Refresh failed - need to login
-                // Clear refresh token as it's invalid
+                // The refresh token was refused: it is spent, so a login follows.
                 this.refreshToken = undefined;
-                // Fall through to login
             }
         }
-        // Perform login
-        this.logger?.info('[BaseTokenProvider] Token invalid and no refresh token, performing login');
+        this.logger?.info('[BaseTokenProvider] No usable refresh token, performing login');
         const result = await this.performLogin();
         this.updateTokens(result);
         this.logger?.info('[BaseTokenProvider] Login completed', {

package/dist/providers/index.d.ts

@@ -2,7 +2,7 @@
  * Token Providers
  *
  * Stateful token providers with automatic token lifecycle management.
- * All providers extend BaseTokenProvider and implement ITokenProvider.
+ * All providers extend BaseTokenProvider and implement IRefreshableTokenProvider.
  */
 export type { AuthorizationCodeProviderConfig } from './AuthorizationCodeProvider';
 export { AuthorizationCodeProvider } from './AuthorizationCodeProvider';

package/dist/providers/index.js

@@ -3,7 +3,7 @@
  * Token Providers
  *
  * Stateful token providers with automatic token lifecycle management.
- * All providers extend BaseTokenProvider and implement ITokenProvider.
+ * All providers extend BaseTokenProvider and implement IRefreshableTokenProvider.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;

package/dist/sso/SsoProviderFactory.d.ts

@@ -1,6 +1,6 @@
-import type { ITokenProvider } from '@mcp-abap-adt/interfaces-auth';
+import type { IRefreshableTokenProvider } from '@mcp-abap-adt/interfaces-auth';
 import type { SsoProviderConfig } from './types';
 export declare class SsoProviderFactory {
-    static create(config: SsoProviderConfig): ITokenProvider;
+    static create(config: SsoProviderConfig): IRefreshableTokenProvider;
 }
 //# sourceMappingURL=SsoProviderFactory.d.ts.map

package/dist/sso/SsoProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SsoProviderFactory.d.ts","sourceRoot":"","sources":["../../src/sso/SsoProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAOpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc;CA6BzD"}
+{"version":3,"file":"SsoProviderFactory.d.ts","sourceRoot":"","sources":["../../src/sso/SsoProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAO/E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,yBAAyB;CA6BpE"}

package/dist/sso/types.d.ts

@@ -1,11 +1,11 @@
-import type { ITokenProvider } from '@mcp-abap-adt/interfaces-auth';
+import type { IRefreshableTokenProvider } from '@mcp-abap-adt/interfaces-auth';
 import type { OidcBrowserProviderConfig } from '../providers/OidcBrowserProvider';
 import type { OidcDeviceFlowProviderConfig } from '../providers/OidcDeviceFlowProvider';
 import type { OidcPasswordProviderConfig } from '../providers/OidcPasswordProvider';
 import type { OidcTokenExchangeProviderConfig } from '../providers/OidcTokenExchangeProvider';
 import type { Saml2BearerProviderConfig } from '../providers/Saml2BearerProvider';
 import type { Saml2PureProviderConfig } from '../providers/Saml2PureProvider';
-export type SsoProviderInstance = ITokenProvider;
+export type SsoProviderInstance = IRefreshableTokenProvider;
 export type SsoProviderConfig = {
     protocol: 'oidc';
     flow: 'browser';

package/dist/sso/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sso/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,4BAA4B,CAAC;CACtC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,0BAA0B,CAAC;CACpC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,+BAA+B,CAAC;CACzC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sso/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,yBAAyB,CAAC;AAE5D,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,4BAA4B,CAAC;CACtC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,0BAA0B,CAAC;CACpC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,+BAA+B,CAAC;CACzC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC"}

package/dist/strategies/BrowserCallbackStrategy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrowserCallbackStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/BrowserCallbackStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,uBAAuB,CAAC,OAAO,GAAG,MAAM;IACvD,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,wFAAwF;IACxF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B,CAAC,OAAO,CACrD,SAAQ,uBAAuB,CAAC,OAAO,CAAC;IACxC,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;CAChD;AAwBD,qBAAa,uBAAuB,CAAC,OAAO,CAC1C,YAAW,sBAAsB,CAAC,OAAO,CAAC;IAOxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAuD;IACvE,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAS;gBAGN,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC;IAG7D,SAAS,CACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IA8FzC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B;AAyBD,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAWhC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,kBAAkB,CAAM,GACxD,sBAAsB,CAAC,kBAAkB,CAAC,CAK5C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAKhC"}
+{"version":3,"file":"BrowserCallbackStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/BrowserCallbackStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAQlE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,uBAAuB,CAAC,OAAO,GAAG,MAAM;IACvD,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,wFAAwF;IACxF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B,CAAC,OAAO,CACrD,SAAQ,uBAAuB,CAAC,OAAO,CAAC;IACxC,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;CAChD;AAwBD,qBAAa,uBAAuB,CAAC,OAAO,CAC1C,YAAW,sBAAsB,CAAC,OAAO,CAAC;IAOxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAuD;IACvE,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAS;gBAGN,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC;IAG7D,SAAS,CACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAyGzC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B;AAyBD,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAWhC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,kBAAkB,CAAM,GACxD,sBAAsB,CAAC,kBAAkB,CAAC,CAK5C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAKhC"}

package/dist/strategies/BrowserCallbackStrategy.js

@@ -51,6 +51,7 @@ const browserAuth_1 = require("../auth/browserAuth");
 const callbackServer_1 = require("../auth/callbackServer");
 const oidcBrowserAuth_1 = require("../auth/oidcBrowserAuth");
 const saml2Auth_1 = require("../auth/saml2Auth");
+const TokenProviderErrors_1 = require("../errors/TokenProviderErrors");
 /**
  * Above Linux's `ip_local_port_range` (32768–60999), so an outbound connection
  * never squats on it, and far from the 3001/3333 range application servers use.
@@ -146,6 +147,19 @@ class BrowserCallbackStrategy {
         try {
             return await run;
         }
+        catch (error) {
+            // Everything that ends a browser login here — the timeout, the identity
+            // provider's own refusal, a port in use, a browser that would not open,
+            // an abort — is a browser authentication failure, and the one type a
+            // caller can catch for it. It was exported and thrown nowhere: each of
+            // these reached the caller as a plain Error. The text is kept, and the
+            // original is the cause. An error that already has a type (a
+            // ValidationError from building the URL) is not one of these.
+            if (error instanceof TokenProviderErrors_1.TokenProviderError)
+                throw error;
+            const cause = error instanceof Error ? error : new Error(String(error));
+            throw new TokenProviderErrors_1.BrowserAuthError(cause.message, cause);
+        }
         finally {
             this.options.signal?.removeEventListener('abort', relay);
             this.controller = null;

package/dist/validation/assertionValidator.js

@@ -506,7 +506,7 @@ function readConfirmation(confirmation, context) {
     return { notOnOrAfter, notBefore };
 }
 /**
- * `no bearer confirmation qualifies: #1 …; #2 …`, naming at most
+ * `no bearer confirmation qualifies: #1 … | #2 …`, naming at most
  * LISTED_CANDIDATES candidates so the message stays bounded however many the
  * document carries.
  */
@@ -515,5 +515,5 @@ function describeRefusals(reasons) {
         .slice(0, LISTED_CANDIDATES)
         .map((reason, index) => `#${index + 1} ${reason}`);
     const more = reasons.length - listed.length;
-    return `no bearer confirmation qualifies: ${listed.join('; ')}${more > 0 ? `; and ${more} more` : ''}`;
+    return `no bearer confirmation qualifies: ${listed.join(' | ')}${more > 0 ? ` | and ${more} more` : ''}`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "4.1.2",
+  "version": "4.2.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -57,7 +57,7 @@
     "node": "^22 || ^24"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces-auth": "^2.0.1",
+    "@mcp-abap-adt/interfaces-auth": "^2.1.0",
     "@mcp-abap-adt/interfaces-auth-sap": "^1.0.1",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
     "@xmldom/xmldom": "^0.9.12",