@mcp-abap-adt/interfaces-auth-broker 1.0.0

package/LICENSE

@@ -0,0 +1,165 @@
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

package/README.md

@@ -0,0 +1,57 @@
+# @mcp-abap-adt/interfaces-auth-broker
+
+The broker's port: what a destination states — its connection settings, how it
+renews its credential — and the stores that hold it. Types only; no
+implementation.
+
+```bash
+npm install @mcp-abap-adt/interfaces-auth-broker
+```
+
+| symbol | what it is |
+|---|---|
+| `IConnectionConfig` | a destination's connection settings, as a store hands them to the broker: `serviceUrl`, `sapClient`, `language`, the credential (`authorizationToken`, `username`/`password`, `sessionCookies`), `authType`, `grantType`, `expiresAt`, and the settings a grant needs — SNC (`snc*`), OIDC (`oidc*`) and the SAML IdP's trust (`saml*`) |
+| `DestinationGrant` | how a destination obtains a new credential: the UAA, OIDC and SAML grants, or `'none'` — handed over, not renewed |
+| `IConfig` | `Partial<IAuthorizationConfig> & Partial<IConnectionConfig>` — what a session store loads and saves |
+| `ISessionStore` | loads, saves and updates a destination's session |
+| `IServiceKeyStore` | reads a destination's service key as authorization and connection settings |
+| `ITokenProviderResult` | the result of authenticating a destination: its `IConnectionConfig` and a refresh token |
+
+```typescript
+import type { IConnectionConfig, ISessionStore } from '@mcp-abap-adt/interfaces-auth-broker';
+import type { IAuthorizationConfig, ISapConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+```
+
+## Why this package exists
+
+**`interfaces-auth-sap` 1.x held two subjects.** One is the SAP system and the
+UAA client — `ISapConfig`, `IAuthorizationConfig`, XSUAA, the certificate
+loader — which a token provider, the ABAP connection and the ADT clients take.
+The other is the destination and its storage, which only the stores, the
+broker and the servers that build a broker import. The broker states what it
+needs from a destination and the stores implement it: that is the broker's
+port, and its fields name the destination, not the SAP system. A contract lives
+in the package whose subject its own fields name (decision 35); decision 41 in
+the repository's `docs/architecture/DECISIONS.md` records this split.
+
+Kept apart, a release of the destination — new grant settings for the broker —
+no longer asks every provider and connection to follow, and a change to the
+SAP system's configuration no longer reaches the stores.
+
+## Where these contracts were
+
+`@mcp-abap-adt/interfaces-auth-sap`, until its 2.0.0 — same names, same shapes;
+only the package changed. Before that, `@mcp-abap-adt/interfaces-adt` until its
+9.0.0. Not re-exported from `interfaces-auth-sap`: import them from here
+(decision 34).
+
+## Dependencies
+
+Depends on `@mcp-abap-adt/interfaces-auth-sap` (`^2.0.0`), for
+`IAuthorizationConfig` — the UAA client a store returns beside the connection
+settings — and on nothing else. `interfaces-auth` and `interfaces-utils` reach
+it through that package.
+
+## Licence
+
+`LGPL-3.0-only`.

package/dist/auth/DestinationGrant.d.ts

@@ -0,0 +1,34 @@
+/**
+ * How a destination obtains a new credential — stated by the destination's
+ * configuration, never inferred from the host or the shape of a service key.
+ *
+ * Read with `IConnectionConfig.authType`: the grants in the first group renew
+ * a `'jwt'` destination, those in the second a `'saml'` one, and `'none'`
+ * either — a credential handed over and not renewed.
+ *
+ * Not `OAuth2GrantType` (`@mcp-abap-adt/interfaces-auth`): that lists OAuth
+ * grants on the wire; this lists the ways a destination is renewed, which
+ * include a UAA passcode, SAML session cookies and no renewal at all.
+ */
+export type DestinationGrant = 
+/** UAA authorization code */
+'authorization_code'
+/** UAA client credentials */
+ | 'client_credentials'
+/** UAA one-time passcode */
+ | 'passcode'
+/** OIDC authorization code with PKCE */
+ | 'oidc_authorization_code'
+/** OIDC device authorization */
+ | 'device_code'
+/** OIDC resource owner password */
+ | 'password'
+/** OAuth 2.0 token exchange (RFC 8693) */
+ | 'token_exchange'
+/** A SAML assertion exchanged for session cookies */
+ | 'saml2_pure'
+/** A SAML assertion exchanged for an OAuth token (RFC 7522) */
+ | 'saml2_bearer'
+/** Handed over, not renewed */
+ | 'none';
+//# sourceMappingURL=DestinationGrant.d.ts.map

package/dist/auth/DestinationGrant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DestinationGrant.d.ts","sourceRoot":"","sources":["../../src/auth/DestinationGrant.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,gBAAgB;AAE1B,6BAA6B;AAC3B,oBAAoB;AACtB,6BAA6B;GAC3B,oBAAoB;AACtB,4BAA4B;GAC1B,UAAU;AACZ,wCAAwC;GACtC,yBAAyB;AAC3B,gCAAgC;GAC9B,aAAa;AACf,mCAAmC;GACjC,UAAU;AACZ,0CAA0C;GACxC,gBAAgB;AAElB,qDAAqD;GACnD,YAAY;AACd,+DAA+D;GAC7D,cAAc;AAEhB,+BAA+B;GAC7B,MAAM,CAAC"}

package/dist/auth/DestinationGrant.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/IConfig.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Configuration - optional composition of authorization and connection configuration
+ * Can contain either authorization config, or connection config, or both
+ */
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { IConnectionConfig } from './IConnectionConfig';
+export type IConfig = Partial<IAuthorizationConfig> & Partial<IConnectionConfig>;
+//# sourceMappingURL=IConfig.d.ts.map

package/dist/auth/IConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IConfig.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,MAAM,MAAM,OAAO,GAAG,OAAO,CAAC,oBAAoB,CAAC,GACjD,OAAO,CAAC,iBAAiB,CAAC,CAAC"}

package/dist/auth/IConfig.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Configuration - optional composition of authorization and connection configuration
+ * Can contain either authorization config, or connection config, or both
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/auth/IConnectionConfig.d.ts

@@ -0,0 +1,75 @@
+import type { DestinationGrant } from './DestinationGrant';
+/**
+ * Connection configuration - values needed for connecting to services
+ * Returned by stores with actual values (not file paths)
+ */
+export interface IConnectionConfig {
+    /** Service URL (SAP/ABAP/MCP URL) - undefined for XSUAA if not provided */
+    serviceUrl?: string;
+    /** Authorization token (JWT token) - required for JWT auth, optional for basic auth */
+    authorizationToken?: string;
+    /** Username for basic authentication - required for basic auth, optional for JWT auth */
+    username?: string;
+    /** Password for basic authentication - required for basic auth, optional for JWT auth */
+    password?: string;
+    /**
+     * Authentication type - 'basic' for on-premise, 'jwt' for cloud, 'snc' for SNC over RFC.
+     * A store states it for every destination that holds a credential or a grant.
+     */
+    authType?: 'basic' | 'jwt' | 'saml' | 'snc';
+    /** How the destination obtains a new credential; absent means the destination does not say */
+    grantType?: DestinationGrant;
+    /**
+     * When the stored credential stops being valid, in epoch milliseconds, as the
+     * provider reported it. A JWT carries its own `exp`; session cookies do not.
+     */
+    expiresAt?: number;
+    /** SAP client number (optional, for ABAP/BTP) */
+    sapClient?: string;
+    /** Language (optional, for ABAP/BTP) */
+    language?: string;
+    /** Session cookies for SAML authentication (raw Cookie header value) */
+    sessionCookies?: string;
+    /** The system's SNC name, e.g. "p:CN=SID, O=ACME" */
+    sncPartnerName?: string;
+    /** Quality of protection: "1" auth, "2" integrity, "3" privacy, "8" default, "9" maximum available */
+    sncQop?: string;
+    /** The SNC (GSS) library; discovered when absent */
+    sncLib?: string;
+    /** The user's SNC name; taken from the credential when absent */
+    sncMyName?: string;
+    /** The issuer; its discovery document supplies any endpoint not given */
+    oidcIssuerUrl?: string;
+    oidcAuthorizationEndpoint?: string;
+    oidcTokenEndpoint?: string;
+    oidcDeviceAuthorizationEndpoint?: string;
+    oidcScopes?: string[];
+    /** token_exchange: the token exchanged (RFC 8693 subject_token) */
+    oidcSubjectToken?: string;
+    /** token_exchange: its type URI */
+    oidcSubjectTokenType?: string;
+    /** token_exchange: the audience asked for */
+    oidcAudience?: string;
+    /** token_exchange: the actor token, when acting on behalf of the subject */
+    oidcActorToken?: string;
+    /** token_exchange: its type URI */
+    oidcActorTokenType?: string;
+    /** The IdP's single sign-on URL */
+    samlIdpSsoUrl?: string;
+    /** The Issuer every assertion must name */
+    samlIdpEntityId?: string;
+    /** The IdP's signing certificates, PEM or base64 DER; several during a key rotation */
+    samlIdpCertificates?: string[];
+    /** This service provider's entity ID — the assertion's Audience */
+    samlSpEntityId?: string;
+    /** The assertion consumer service URL — the assertion's Recipient */
+    samlAcsUrl?: string;
+    samlRelayState?: string;
+    /** IdP-initiated: no AuthnRequest, and the assertion carries no InResponseTo */
+    samlIdpInitiated?: boolean;
+    /** Clock skew allowed when checking the assertion's times, in milliseconds */
+    samlClockSkewMs?: number;
+    /** saml2_bearer: the token endpoint the assertion is exchanged at */
+    samlTokenUrl?: string;
+}
+//# sourceMappingURL=IConnectionConfig.d.ts.map

package/dist/auth/IConnectionConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IConnectionConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IConnectionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAC5C,8FAA8F;IAC9F,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IAIxB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IAKnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAG5B,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/auth/IConnectionConfig.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * @mcp-abap-adt/interfaces-auth-broker
+ *
+ * The broker's port: what `@mcp-abap-adt/auth-broker` needs from a destination,
+ * and the stores that hold one.
+ *
+ * **What makes a contract belong here is that its own fields name the
+ * destination or its storage** — the connection settings a store hands the
+ * broker (`IConnectionConfig`), how that destination renews its credential
+ * (`DestinationGrant`), the composition a store saves (`IConfig`), the stores
+ * themselves (`ISessionStore`, `IServiceKeyStore`), and the result of
+ * authenticating a destination (`ITokenProviderResult`). That is decision 35
+ * applied to the second subject `interfaces-auth-sap` 1.x held; decision 41
+ * records the split.
+ *
+ * **Who imports it**: the stores (`@mcp-abap-adt/auth-stores`), the broker,
+ * and the servers that build a broker. A token provider, the ABAP connection
+ * and the ADT clients take nothing from here — what they take, `ISapConfig` and
+ * the UAA client, stayed in `interfaces-auth-sap`.
+ *
+ * **Depends on `interfaces-auth-sap`, and on nothing else**, for
+ * `IAuthorizationConfig` — the UAA client a store returns beside the
+ * connection settings. It is imported, not re-exported (decision 34).
+ */
+export type { DestinationGrant } from './auth/DestinationGrant';
+export type { IConfig } from './auth/IConfig';
+export type { IConnectionConfig } from './auth/IConnectionConfig';
+export type { IServiceKeyStore } from './serviceKey/IServiceKeyStore';
+export type { ISessionStore } from './session/ISessionStore';
+export type { ITokenProviderResult } from './token/ITokenProviderResult';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,YAAY,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/serviceKey/IServiceKeyStore.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Interface for storing and retrieving service keys
+ *
+ * Service keys contain UAA credentials and connection URLs.
+ */
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { IConfig } from '../auth/IConfig';
+import type { IConnectionConfig } from '../auth/IConnectionConfig';
+export interface IServiceKeyStore {
+    /**
+     * Get raw service key for destination
+     * @param destination Destination name (e.g., "TRIAL")
+     * @returns Service key object (implementation-specific) or null if not found
+     */
+    getServiceKey(destination: string): Promise<IConfig | null>;
+    /**
+     * Get authorization configuration from service key
+     * Returns values needed for obtaining and refreshing tokens
+     * @param destination Destination name (e.g., "TRIAL")
+     * @returns IAuthorizationConfig with actual values or null if not found
+     */
+    getAuthorizationConfig(destination: string): Promise<IAuthorizationConfig | null>;
+    /**
+     * Get connection configuration from service key
+     * Returns values needed for connecting to services
+     * @param destination Destination name (e.g., "TRIAL")
+     * @returns IConnectionConfig with actual values or null if not found
+     */
+    getConnectionConfig(destination: string): Promise<IConnectionConfig | null>;
+}
+//# sourceMappingURL=IServiceKeyStore.d.ts.map

package/dist/serviceKey/IServiceKeyStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IServiceKeyStore.d.ts","sourceRoot":"","sources":["../../src/serviceKey/IServiceKeyStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE5D;;;;;OAKG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;CAC7E"}

package/dist/serviceKey/IServiceKeyStore.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Interface for storing and retrieving service keys
+ *
+ * Service keys contain UAA credentials and connection URLs.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/session/ISessionStore.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Interface for session stores - stores and retrieves session data
+ *
+ * Session stores handle loading, saving, and managing session data (tokens, configuration).
+ */
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { IConfig } from '../auth/IConfig';
+import type { IConnectionConfig } from '../auth/IConnectionConfig';
+export interface ISessionStore {
+    /**
+     * Load session configuration for destination
+     * Returns optional composition of IAuthorizationConfig and IConnectionConfig
+     * Can contain either authorization config, or connection config, or both
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     * @returns IConfig with actual values or null if not found
+     */
+    loadSession(destination: string): Promise<IConfig | null>;
+    /**
+     * Save session configuration for destination
+     * Accepts IConfig (optional composition) or internal representation (for backward compatibility)
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     * @param config IConfig or internal session configuration to save
+     */
+    saveSession(destination: string, config: IConfig | unknown): Promise<void>;
+    /**
+     * Delete session for destination (optional)
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     */
+    deleteSession?(destination: string): Promise<void>;
+    /**
+     * Get authorization configuration with actual values (not file paths)
+     * Returns values needed for obtaining and refreshing tokens
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     * @returns IAuthorizationConfig with actual values or null if not found
+     */
+    getAuthorizationConfig(destination: string): Promise<IAuthorizationConfig | null>;
+    /**
+     * Get connection configuration with actual values (not file paths)
+     * Returns values needed for connecting to services
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     * @returns IConnectionConfig with actual values or null if not found
+     */
+    getConnectionConfig(destination: string): Promise<IConnectionConfig | null>;
+    /**
+     * Set authorization configuration
+     * Updates values needed for obtaining and refreshing tokens
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     * @param config IAuthorizationConfig with values to set
+     */
+    setAuthorizationConfig(destination: string, config: IAuthorizationConfig): Promise<void>;
+    /**
+     * Set connection configuration
+     * Updates values needed for connecting to services
+     * @param destination Destination name (e.g., "TRIAL" or "mcp")
+     * @param config IConnectionConfig with values to set
+     */
+    setConnectionConfig(destination: string, config: IConnectionConfig): Promise<void>;
+}
+//# sourceMappingURL=ISessionStore.d.ts.map

package/dist/session/ISessionStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ISessionStore.d.ts","sourceRoot":"","sources":["../../src/session/ISessionStore.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B;;;;;;OAMG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAE1D;;;;;OAKG;IACH,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E;;;OAGG;IACH,aAAa,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IAExC;;;;;OAKG;IACH,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAC;IAE5E;;;;;OAKG;IACH,sBAAsB,CACpB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;OAKG;IACH,mBAAmB,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB"}

package/dist/session/ISessionStore.js

@@ -0,0 +1,7 @@
+"use strict";
+/**
+ * Interface for session stores - stores and retrieves session data
+ *
+ * Session stores handle loading, saving, and managing session data (tokens, configuration).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/token/ITokenProviderResult.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Result from token provider
+ */
+import type { IConnectionConfig } from '../auth/IConnectionConfig';
+/** Nothing imports this yet; it sits with the session and token contracts it belongs to. */
+export interface ITokenProviderResult {
+    /** Connection configuration with authorization token */
+    connectionConfig: IConnectionConfig;
+    /** Refresh token (optional, for BTP/ABAP) */
+    refreshToken?: string;
+}
+//# sourceMappingURL=ITokenProviderResult.d.ts.map

package/dist/token/ITokenProviderResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ITokenProviderResult.d.ts","sourceRoot":"","sources":["../../src/token/ITokenProviderResult.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,4FAA4F;AAC5F,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,gBAAgB,EAAE,iBAAiB,CAAC;IACpC,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/dist/token/ITokenProviderResult.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@mcp-abap-adt/interfaces-auth-broker",
+  "version": "1.0.0",
+  "description": "The broker's port: the destination (IConnectionConfig, DestinationGrant, IConfig) and the stores that hold it",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "COPYING"
+  ],
+  "sideEffects": false,
+  "author": "Oleksii Kyslytsia <oleksij.kyslytsja@gmail.com>",
+  "license": "LGPL-3.0-only",
+  "homepage": "https://github.com/fr0ster/mcp-abap-adt-interfaces/tree/master/packages/interfaces-auth-broker#readme",
+  "bugs": {
+    "url": "https://github.com/fr0ster/mcp-abap-adt-interfaces/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fr0ster/mcp-abap-adt-interfaces.git",
+    "directory": "packages/interfaces-auth-broker"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "clean": "rm -rf dist tsconfig.tsbuildinfo tsconfig.build.tsbuildinfo",
+    "build": "tsc -b tsconfig.build.json",
+    "test:check": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run --prefix ../.. check"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "@mcp-abap-adt/interfaces-auth-sap": "^2.0.0"
+  }
+}