@mcp-abap-adt/interfaces-adt 7.0.0 → 9.0.0

package/dist/Headers.js

@@ -1,62 +0,0 @@
-"use strict";
-/**
- * HTTP Header Constants for MCP ABAP ADT
- *
- * This file contains all HTTP header names used across MCP ABAP ADT packages.
- * These constants should be used instead of hardcoded string values to ensure
- * consistency and prevent typos.
- *
- * Priority: Values from mcp-abap-adt-interfaces package take precedence.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTH_TYPES = exports.AUTH_TYPE_XSUAA = exports.AUTH_TYPE_BASIC = exports.AUTH_TYPE_JWT = exports.HEADER_UAA_CLIENT_SECRET = exports.HEADER_SAP_UAA_CLIENT_SECRET = exports.HEADER_UAA_CLIENT_ID = exports.HEADER_SAP_UAA_CLIENT_ID = exports.HEADER_UAA_URL = exports.HEADER_SAP_UAA_URL = exports.HEADER_SAP_REFRESH_TOKEN = exports.HEADER_SAP_PASSWORD = exports.HEADER_SAP_LOGIN = exports.HEADER_SAP_CLIENT = exports.HEADER_SAP_AUTH_TYPE = exports.HEADER_SAP_JWT_TOKEN = exports.HEADER_SAP_URL = exports.HEADER_SAP_DESTINATION_SERVICE = exports.HEADER_SAP_DESTINATION = exports.HEADER_MCP_URL = exports.HEADER_MCP_DESTINATION = exports.HEADER_BTP_DESTINATION = void 0;
-/**
- * Proxy Routing Headers
- * Used by the proxy to determine routing and authentication
- */
-exports.HEADER_BTP_DESTINATION = 'x-btp-destination';
-exports.HEADER_MCP_DESTINATION = 'x-mcp-destination';
-exports.HEADER_MCP_URL = 'x-mcp-url';
-/**
- * SAP ABAP Connection Headers
- * Used for SAP ABAP system connection
- */
-exports.HEADER_SAP_DESTINATION = 'x-sap-destination';
-/**
- * SAP Destination Header (for Cloud ABAP connection via SAP destination service)
- * This header is used to specify the SAP destination name for connecting to ABAP systems on SAP Cloud.
- * The URL is automatically derived from the destination service key.
- * This is a separate constant to emphasize its specific purpose for SAP destination service.
- */
-exports.HEADER_SAP_DESTINATION_SERVICE = 'x-sap-destination';
-exports.HEADER_SAP_URL = 'x-sap-url';
-exports.HEADER_SAP_JWT_TOKEN = 'x-sap-jwt-token';
-exports.HEADER_SAP_AUTH_TYPE = 'x-sap-auth-type';
-exports.HEADER_SAP_CLIENT = 'x-sap-client';
-exports.HEADER_SAP_LOGIN = 'x-sap-login';
-exports.HEADER_SAP_PASSWORD = 'x-sap-password';
-exports.HEADER_SAP_REFRESH_TOKEN = 'x-sap-refresh-token';
-/**
- * UAA/XSUAA Headers
- * Used for UAA/XSUAA authentication
- */
-exports.HEADER_SAP_UAA_URL = 'x-sap-uaa-url';
-exports.HEADER_UAA_URL = 'uaa-url'; // Alternative name
-exports.HEADER_SAP_UAA_CLIENT_ID = 'x-sap-uaa-client-id';
-exports.HEADER_UAA_CLIENT_ID = 'uaa-client-id'; // Alternative name
-exports.HEADER_SAP_UAA_CLIENT_SECRET = 'x-sap-uaa-client-secret';
-exports.HEADER_UAA_CLIENT_SECRET = 'uaa-client-secret'; // Alternative name
-/**
- * Authentication type values
- */
-exports.AUTH_TYPE_JWT = 'jwt';
-exports.AUTH_TYPE_BASIC = 'basic';
-exports.AUTH_TYPE_XSUAA = 'xsuaa';
-/**
- * Valid authentication types
- */
-exports.AUTH_TYPES = [
-    exports.AUTH_TYPE_JWT,
-    exports.AUTH_TYPE_BASIC,
-    exports.AUTH_TYPE_XSUAA,
-];

package/dist/adt/AdtTypes.d.ts

@@ -1,40 +0,0 @@
-/**
- * Shared ADT types for type-safe error handling and XML parsing.
- */
-/**
- * Shape of HTTP errors thrown by the connection layer.
- * Used for type-safe catch blocks instead of `catch (error: any)`.
- *
- * @example
- * ```typescript
- * try {
- *   await connection.makeAdtRequest({ url: '...' });
- * } catch (error: unknown) {
- *   const e = error as HttpError;
- *   console.log(e.response?.status);
- * }
- * ```
- */
-export interface HttpError {
-    response?: {
-        status?: number;
-        statusText?: string;
-        data?: unknown;
-        headers?: Record<string, unknown>;
-    };
-    message?: string;
-}
-/**
- * Recursive type for XML parser results.
- * Allows property access on deeply nested parsed XML structures.
- *
- * @example
- * ```typescript
- * const result = parser.parse(xmlData) as XmlNode;
- * const data = (result?.['asx:abap'] as XmlNode)?.['asx:values'];
- * ```
- */
-export interface XmlNode {
-    [key: string]: XmlNode | XmlNode[] | string | number | boolean | undefined;
-}
-//# sourceMappingURL=AdtTypes.d.ts.map

package/dist/adt/AdtTypes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AdtTypes.d.ts","sourceRoot":"","sources":["../../src/adt/AdtTypes.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE;QACT,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,OAAO;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CAC5E"}

package/dist/adt/AdtTypes.js

@@ -1,5 +0,0 @@
-"use strict";
-/**
- * Shared ADT types for type-safe error handling and XML parsing.
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/AssertionErrorCodes.d.ts

@@ -1,15 +0,0 @@
-/**
- * Error codes for assertion validation
- * Used by an IAssertionValidator to say which check refused the assertion
- *
- * Deliberately separate from TOKEN_PROVIDER_ERROR_CODES: that set describes what
- * can go wrong with ANY token provider, so a single authentication mechanism
- * must not widen it. A mechanism brings its own codes, as stores and the
- * network layer already do.
- */
-export declare const ASSERTION_ERROR_CODES: {
-    /** A SAML assertion failed validation and was refused */
-    readonly VALIDATION_ERROR: "ASSERTION_VALIDATION_ERROR";
-};
-export type AssertionErrorCode = (typeof ASSERTION_ERROR_CODES)[keyof typeof ASSERTION_ERROR_CODES];
-//# sourceMappingURL=AssertionErrorCodes.d.ts.map

package/dist/auth/AssertionErrorCodes.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AssertionErrorCodes.d.ts","sourceRoot":"","sources":["../../src/auth/AssertionErrorCodes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,eAAO,MAAM,qBAAqB;IAChC,yDAAyD;;CAEjD,CAAC;AAEX,MAAM,MAAM,kBAAkB,GAC5B,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/auth/AssertionErrorCodes.js

@@ -1,16 +0,0 @@
-"use strict";
-/**
- * Error codes for assertion validation
- * Used by an IAssertionValidator to say which check refused the assertion
- *
- * Deliberately separate from TOKEN_PROVIDER_ERROR_CODES: that set describes what
- * can go wrong with ANY token provider, so a single authentication mechanism
- * must not widen it. A mechanism brings its own codes, as stores and the
- * network layer already do.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ASSERTION_ERROR_CODES = void 0;
-exports.ASSERTION_ERROR_CODES = {
-    /** A SAML assertion failed validation and was refused */
-    VALIDATION_ERROR: 'ASSERTION_VALIDATION_ERROR',
-};

package/dist/auth/AuthType.d.ts

@@ -1,5 +0,0 @@
-/**
- * Authentication type
- */
-export type AuthType = 'jwt' | 'xsuaa' | 'basic';
-//# sourceMappingURL=AuthType.d.ts.map

package/dist/auth/AuthType.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"AuthType.d.ts","sourceRoot":"","sources":["../../src/auth/AuthType.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,OAAO,GAAG,OAAO,CAAC"}

package/dist/auth/IAssertionValidator.d.ts

@@ -1,100 +0,0 @@
-/**
- * Establishing that a SAML assertion may be trusted.
- *
- * Validation is a strategy for the same reason everything else here is: a
- * consumer may have a trust model this package cannot anticipate. The shipped
- * default verifies the signature and refuses anything it cannot place; a
- * consumer replacing it takes on that duty entirely.
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-/** What the provider knows about the login the assertion is answering. */
-export interface AssertionContext {
-    /** The AuthnRequest ID this response must answer. */
-    readonly expectedInResponseTo: string;
-    /** Our entity ID, which the AudienceRestriction must name. */
-    readonly audience: string;
-    /** The ACS the response arrived at; Recipient and Destination must match. */
-    readonly acsUrl: string;
-    /**
-     * Trusted issuer; the assertion's `Issuer` must equal it.
-     *
-     * Optional on the interface because a custom validator may establish trust
-     * without it. The shipped default always receives it.
-     */
-    readonly expectedIssuer?: string;
-    /** For progress messages. Absent means silence — never stdout. */
-    readonly logger?: ILogger;
-}
-/** What a validated assertion yields to the flow. */
-export interface ValidatedAssertion {
-    /**
-     * The earlier of `Conditions/@NotOnOrAfter` and the `NotOnOrAfter` of the
-     * bearer confirmation that was accepted — never later than either, so a
-     * session cannot outlive a window the assertion itself closed.
-     */
-    readonly expiresAt: Date;
-    readonly assertionId: string;
-    readonly issuer: string;
-    readonly nameId?: string;
-    readonly sessionIndex?: string;
-    readonly attributes?: Readonly<Record<string, readonly string[]>>;
-    /**
-     * The response exactly as it arrived, for a flow that must forward it
-     * verbatim.
-     *
-     * **The wire payload, not a validated artifact.** It is the whole
-     * `samlp:Response`, and under `createSignedAssertionValidator` that includes
-     * `Status`, `Response/Issuer` and `Destination`, which nothing read and
-     * nothing checked. Holding a `ValidatedAssertion` does not make every byte
-     * of `raw` trustworthy.
-     */
-    readonly raw: string;
-    /**
-     * The signed element, serialised: the `Assertion`, or the `Response` when
-     * that is what the signature covered.
-     *
-     * Everything here is inside the signature that verified. A consumer wanting
-     * anything this interface does not surface should parse this rather than
-     * `raw` — the difference between them is the difference between "signed"
-     * and "arrived".
-     */
-    readonly signedXml: string;
-}
-/**
- * Establishes that an assertion is genuine, addressed to us, currently valid,
- * and answers a request we made. Rejects by throwing, with a reason naming the
- * check that failed.
- */
-export interface IAssertionValidator {
-    validate(samlResponse: string, context: AssertionContext): Promise<ValidatedAssertion>;
-}
-/**
- * What identifies an assertion for replay purposes.
- *
- * An assertion's `ID` is unique only within the identity provider that minted
- * it, so a store shared by two providers would reject a perfectly good second
- * login the moment two issuers happened to mint the same `_id`. The key is the
- * pair, never the ID alone.
- */
-export interface AssertionReplayKey {
-    readonly issuer: string;
-    readonly assertionId: string;
-}
-/** Remembers assertions so a replay is refused. */
-export interface IAssertionReplayStore {
-    /**
-     * Records this key if it is not already recorded, and reports which
-     * happened: `true` when newly recorded, `false` when already present — a
-     * replay.
-     *
-     * **Must be atomic.** Two validations of the same assertion running at once
-     * must not both be told `true`; a check followed by a separate write is a
-     * race, and it is precisely the race a replay exploits.
-     *
-     * `retainUntil` is the last instant a validator would still accept the
-     * assertion — its expiry plus any clock skew allowed — not its expiry. An
-     * entry dropped earlier reopens the window in which a replay is accepted.
-     */
-    recordIfUnseen(key: AssertionReplayKey, retainUntil: Date): Promise<boolean>;
-}
-//# sourceMappingURL=IAssertionValidator.d.ts.map

package/dist/auth/IAssertionValidator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IAssertionValidator.d.ts","sourceRoot":"","sources":["../../src/auth/IAssertionValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,0EAA0E;AAC1E,MAAM,WAAW,gBAAgB;IAC/B,qDAAqD;IACrD,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,qDAAqD;AACrD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;IAClE;;;;;;;;;OASG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CACN,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,GAAG,EAAE,kBAAkB,EAAE,WAAW,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E"}

package/dist/auth/IAssertionValidator.js

@@ -1,10 +0,0 @@
-"use strict";
-/**
- * Establishing that a SAML assertion may be trusted.
- *
- * Validation is a strategy for the same reason everything else here is: a
- * consumer may have a trust model this package cannot anticipate. The shipped
- * default verifies the signature and refuses anything it cannot place; a
- * consumer replacing it takes on that duty entirely.
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/IAuthorizationConfig.d.ts

@@ -1,15 +0,0 @@
-/**
- * Authorization configuration - values needed for obtaining and refreshing tokens
- * Returned by stores with actual values (not file paths)
- */
-export interface IAuthorizationConfig {
-    /** UAA URL for token refresh */
-    uaaUrl: string;
-    /** UAA client ID */
-    uaaClientId: string;
-    /** UAA client secret */
-    uaaClientSecret: string;
-    /** Refresh token for token renewal (optional) */
-    refreshToken?: string;
-}
-//# sourceMappingURL=IAuthorizationConfig.d.ts.map

package/dist/auth/IAuthorizationConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IAuthorizationConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IAuthorizationConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,oBAAoB;IACnC,gCAAgC;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/auth/IAuthorizationConfig.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/IAuthorizationStrategy.d.ts

@@ -1,59 +0,0 @@
-/**
- * How an interactive authorization is conducted.
- *
- * The provider owns what it can compute — the authorization URL and the token
- * exchange. Everything between them (reaching the URL, receiving what comes
- * back, the port, the timeout) belongs to whoever implements this interface,
- * which is why a consumer can replace it wholesale.
- *
- * See `ICallbackServer` for the transport a shipped strategy is composed of.
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-/** What the provider tells a strategy about the login to conduct. */
-export interface AuthorizationRequest {
-    /**
-     * Build the authorization URL for a redirect URI the strategy has settled on.
-     *
-     * Called once the strategy knows its redirect URI — which is what makes an
-     * ephemeral port possible, since the URL cannot be assembled before the
-     * socket is bound. May not be called at all: a strategy that already holds a
-     * payload needs no URL.
-     *
-     * Asynchronous because building may require OIDC discovery. Rejects when the
-     * redirect URI cannot be honoured — a pre-built authorization URL carries its
-     * own redirect, and a mismatch must fail here, before a browser is opened,
-     * rather than as a callback that never arrives.
-     */
-    buildAuthorizationUrl(redirectUri: string): Promise<string>;
-    /** For progress messages. Absent means silence — never stdout. */
-    readonly logger?: ILogger;
-}
-/** How the login ended. */
-export interface AuthorizationOutcome<TResult> {
-    /** What the redirect carried: a code, `{code, state}`, a SAMLResponse. */
-    readonly payload: TResult;
-    /**
-     * The redirect URI that actually took part. The token exchange must send this
-     * one — with an ephemeral port the provider has no other way to learn it.
-     */
-    readonly redirectUri: string;
-}
-/**
- * A way of conducting an interactive authorization.
- *
- * `authorize` may be called again sequentially; an implementation that holds a
- * fixed port should reject overlapping calls rather than queue them.
- *
- * `dispose` carries four obligations:
- * - idempotent — every call after the first resolves as a no-op;
- * - legal during an active `authorize`, which it ends with a rejection, since
- *   releasing resources while a socket is still bound would be untrue;
- * - resolves only once the resources are actually free;
- * - never masks a failure from `authorize` — a caller invoking it from
- *   `finally` propagates the original error and logs the cleanup one.
- */
-export interface IAuthorizationStrategy<TResult> {
-    authorize(request: AuthorizationRequest): Promise<AuthorizationOutcome<TResult>>;
-    dispose?(): Promise<void>;
-}
-//# sourceMappingURL=IAuthorizationStrategy.d.ts.map

package/dist/auth/IAuthorizationStrategy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IAuthorizationStrategy.d.ts","sourceRoot":"","sources":["../../src/auth/IAuthorizationStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,qEAAqE;AACrE,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;;;;OAYG;IACH,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5D,kEAAkE;IAClE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,2BAA2B;AAC3B,MAAM,WAAW,oBAAoB,CAAC,OAAO;IAC3C,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAE1B;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,sBAAsB,CAAC,OAAO;IAC7C,SAAS,CACP,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B"}

package/dist/auth/IAuthorizationStrategy.js

@@ -1,12 +0,0 @@
-"use strict";
-/**
- * How an interactive authorization is conducted.
- *
- * The provider owns what it can compute — the authorization URL and the token
- * exchange. Everything between them (reaching the URL, receiving what comes
- * back, the port, the timeout) belongs to whoever implements this interface,
- * which is why a consumer can replace it wholesale.
- *
- * See `ICallbackServer` for the transport a shipped strategy is composed of.
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/ICallbackServer.d.ts

@@ -1,139 +0,0 @@
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-/**
- * Local callback server used by interactive authorization flows.
- *
- * This interface is intentionally domain-agnostic: it describes the lifetime of
- * a short-lived local listener that receives a redirect, not what the redirect
- * carries. OAuth authorization codes, OIDC `code` + `state` and SAML
- * `SAMLResponse` all fit through the same contract, parameterised by result.
- *
- * The handle is borrowed: it exists for the duration of the factory's callback,
- * and the port is released on the first terminal outcome. Releasing the socket
- * is therefore never a consequence of a wait settling — which is exactly what
- * lets an abandoned login hold a port for the lifetime of a process.
- */
-export interface ICallbackServerOptions {
-    /**
-     * Port for the local listener. Must be an integer in 0..65535.
-     *
-     * `0` means "bind an ephemeral port": the handle then reports what the OS
-     * actually gave, and the authorization URL must be built from
-     * `handle.redirectUri` rather than from anything known beforehand. A flow
-     * that assembles its URL before binding — or one whose redirect is
-     * registered with the identity provider, as a SAML ACS always is — cannot
-     * use it, because the redirect would advertise a port nobody is listening on.
-     */
-    readonly port: number;
-    /**
-     * How long to wait for the callback. Mandatory: there is no such thing as
-     * waiting forever, and the absence of this bound is a known way to strand a
-     * port.
-     *
-     * Must satisfy `Number.isFinite(timeoutMs) && timeoutMs > 0 && timeoutMs <=
-     * 2_147_483_647`. The upper bound is Node's rather than this contract's:
-     * `setTimeout` takes a 32-bit signed delay, and a larger value fires after
-     * 1 ms with a `TimeoutOverflowWarning` — so a generous-looking timeout would
-     * end the login almost instantly. Implementations reject such a value rather
-     * than clamping it, because clamping hides the mistake.
-     */
-    readonly timeoutMs: number;
-    /**
-     * External cancellation — "this login is no longer needed". Honoured whether
-     * it fires before the bind, during it, or while waiting for the callback.
-     */
-    readonly signal?: AbortSignal;
-    /**
-     * Where the transport reports what it did — an ignored request that was not
-     * our redirect, for instance. Absent means silence; never stdout.
-     */
-    readonly logger?: ILogger;
-}
-/**
- * Borrowed handle on a listening callback server.
- *
- * Valid until the scope reaches its first terminal outcome, which may be before
- * the factory's callback has finished: a timeout or an abort ends the scope
- * without stopping an already-running callback. Members behave differently once
- * that has happened, so a still-running body cannot be harmed by touching it:
- *
- * - `fail()` becomes a silent no-op and never throws;
- * - `waitForResult()` returns a rejected promise, never throwing synchronously;
- * - `port` and `redirectUri` remain readable, being values rather than
- *   operations.
- */
-export interface ICallbackServerHandle<TResult> {
-    /** The port actually bound. */
-    readonly port: number;
-    /** Redirect URI the authorization request must use. */
-    readonly redirectUri: string;
-    /**
-     * The result delivered to the callback endpoint.
-     *
-     * Returns the same promise on every call, so it is safe to call repeatedly.
-     * Rejects on timeout, on cancellation, on `fail`, and when the scope ends
-     * while it is still pending — the last of which is why an implementation must
-     * mark the promise handled on creation, so a body that creates it and walks
-     * away cannot raise `unhandledRejection`.
-     *
-     * Receiving a result does **not** end the scope. It hands the value to
-     * whoever is awaiting; the scope ends when the factory's callback returns.
-     */
-    waitForResult(): Promise<TResult>;
-    /**
-     * End the wait with an error — typically because the browser could not be
-     * launched.
-     *
-     * Safe to call at any time, including after the scope has ended, because it
-     * is meant to be used fire-and-forget:
-     *
-     * ```ts
-     * launchBrowser(url).catch((e) => server.fail(e));
-     * ```
-     *
-     * A launcher that rejects after the login has already timed out must not turn
-     * that into a fresh unhandled rejection.
-     */
-    fail(error: Error): void;
-}
-/**
- * The only way to obtain a callback server.
- *
- * There is deliberately no `close` on the handle: closing belongs to the
- * factory, so it cannot be forgotten.
- *
- * The factory settles on the first terminal outcome — the callback returning or
- * throwing, `fail`, the timeout, or an abort — and only once the listening
- * socket has been released, so a settled result always means the port is free.
- * On success it resolves with whatever the callback returned — which need not be
- * the payload itself, so `transform(await server.waitForResult())` resolves with
- * the transformed value.
- *
- * It does **not** promise to stop the callback: an arbitrary async function
- * cannot be force-terminated. A failure outcome ends the scope without waiting
- * for it, and a later settlement from the abandoned body is discarded.
- *
- * There are two type parameters, and the split matters:
- *
- * - `TResult` is on the alias, because the payload a flow's callback endpoint
- *   delivers is fixed by that flow. Were it generic per call, a browser-code
- *   factory would type-check against a caller expecting something it can never
- *   yield.
- * - `TReturn` is generic per call, because the scope resolves with whatever the
- *   callback returned. Tying it to `TResult` would forbid the transformation
- *   shown above — `transform(await server.waitForResult())` may legitimately
- *   produce a token, a session, or anything else built from the payload.
- *
- * ```ts
- * const code = await withBrowserCallbackServer(
- *   { port, timeoutMs, signal },
- *   async (server) => {
- *     const waiting = server.waitForResult();
- *     launchBrowser(buildAuthUrl(server.redirectUri)).catch((e) => server.fail(e));
- *     return await waiting;
- *   },
- * );
- * // reached only once the port is free — whatever the outcome
- * ```
- */
-export type CallbackServerFactory<TResult> = <TReturn>(options: ICallbackServerOptions, use: (server: ICallbackServerHandle<TResult>) => Promise<TReturn>) => Promise<TReturn>;
-//# sourceMappingURL=ICallbackServer.d.ts.map

package/dist/auth/ICallbackServer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ICallbackServer.d.ts","sourceRoot":"","sources":["../../src/auth/ICallbackServer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAE9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,qBAAqB,CAAC,OAAO;IAC5C,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,uDAAuD;IACvD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAElC;;;;;;;;;;;;;OAaG;IACH,IAAI,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,MAAM,qBAAqB,CAAC,OAAO,IAAI,CAAC,OAAO,EACnD,OAAO,EAAE,sBAAsB,EAC/B,GAAG,EAAE,CAAC,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,KAC9D,OAAO,CAAC,OAAO,CAAC,CAAC"}

package/dist/auth/ICallbackServer.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/ICertificateMaterialLoader.d.ts

@@ -1,7 +0,0 @@
-import type { ICertificateMaterial } from '@mcp-abap-adt/interfaces-auth';
-import type { ISapConfig } from '../sap/ISapConfig';
-/** Loads client-certificate material from a connection config (file paths, etc.). */
-export interface ICertificateMaterialLoader {
-    load(config: ISapConfig): Promise<ICertificateMaterial>;
-}
-//# sourceMappingURL=ICertificateMaterialLoader.d.ts.map

package/dist/auth/ICertificateMaterialLoader.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ICertificateMaterialLoader.d.ts","sourceRoot":"","sources":["../../src/auth/ICertificateMaterialLoader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,qFAAqF;AACrF,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACzD"}

package/dist/auth/ICertificateMaterialLoader.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/IConfig.d.ts

@@ -1,8 +0,0 @@
-/**
- * Configuration - optional composition of authorization and connection configuration
- * Can contain either authorization config, or connection config, or both
- */
-import type { IAuthorizationConfig } from './IAuthorizationConfig';
-import type { IConnectionConfig } from './IConnectionConfig';
-export type IConfig = Partial<IAuthorizationConfig> & Partial<IConnectionConfig>;
-//# sourceMappingURL=IConfig.d.ts.map

package/dist/auth/IConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/auth/IConfig.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/IConnectionConfig.d.ts

@@ -1,23 +0,0 @@
-/**
- * Connection configuration - values needed for connecting to services
- * Returned by stores with actual values (not file paths)
- */
-export interface IConnectionConfig {
-    /** Service URL (SAP/ABAP/MCP URL) - undefined for XSUAA if not provided */
-    serviceUrl?: string;
-    /** Authorization token (JWT token) - required for JWT auth, optional for basic auth */
-    authorizationToken?: string;
-    /** Username for basic authentication - required for basic auth, optional for JWT auth */
-    username?: string;
-    /** Password for basic authentication - required for basic auth, optional for JWT auth */
-    password?: string;
-    /** Authentication type - 'basic' for on-premise, 'jwt' for cloud */
-    authType?: 'basic' | 'jwt' | 'saml';
-    /** SAP client number (optional, for ABAP/BTP) */
-    sapClient?: string;
-    /** Language (optional, for ABAP/BTP) */
-    language?: string;
-    /** Session cookies for SAML authentication (raw Cookie header value) */
-    sessionCookies?: string;
-}
-//# sourceMappingURL=IConnectionConfig.d.ts.map

package/dist/auth/IConnectionConfig.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IConnectionConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IConnectionConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IACpC,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/auth/IConnectionConfig.js

@@ -1,2 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/connection/CalmService.d.ts

@@ -1,3 +0,0 @@
-export declare const CALM_SERVICES: readonly ["features", "documents", "tasks", "projects", "testManagement", "hierarchy", "analytics", "processMonitoring", "logs"];
-export type CalmService = (typeof CALM_SERVICES)[number];
-//# sourceMappingURL=CalmService.d.ts.map

package/dist/connection/CalmService.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CalmService.d.ts","sourceRoot":"","sources":["../../src/connection/CalmService.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,kIAUhB,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/connection/CalmService.js

@@ -1,14 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CALM_SERVICES = void 0;
-exports.CALM_SERVICES = [
-    'features',
-    'documents',
-    'tasks',
-    'projects',
-    'testManagement',
-    'hierarchy',
-    'analytics',
-    'processMonitoring',
-    'logs',
-];