@mcp-abap-adt/proxy 0.1.1

package/dist/lib/transportConfig.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Transport Configuration - Parse and manage transport settings
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseTransportConfig = parseTransportConfig;
+/**
+ * Parse transport configuration from command line arguments and environment variables
+ */
+function parseTransportConfig() {
+    const args = process.argv;
+    // Check for explicit transport type
+    let transportType = null;
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg.startsWith("--transport=")) {
+            const value = arg.split("=")[1].toLowerCase();
+            if (value === "stdio" || value === "streamable-http" || value === "http" || value === "sse") {
+                transportType = value === "http" ? "streamable-http" : value;
+            }
+        }
+        if (arg === "--transport" && i + 1 < args.length) {
+            const value = args[i + 1].toLowerCase();
+            if (value === "stdio" || value === "streamable-http" || value === "http" || value === "sse") {
+                transportType = value === "http" ? "streamable-http" : value;
+            }
+        }
+        if (arg === "--http")
+            transportType = "streamable-http";
+        if (arg === "--stdio")
+            transportType = "stdio";
+        if (arg === "--sse")
+            transportType = "sse";
+    }
+    // Check environment variable
+    if (!transportType && process.env.MCP_TRANSPORT) {
+        const envTransport = process.env.MCP_TRANSPORT.toLowerCase();
+        if (envTransport === "stdio" || envTransport === "streamable-http" || envTransport === "http" || envTransport === "sse") {
+            transportType = envTransport === "http" ? "streamable-http" : envTransport;
+        }
+    }
+    // Auto-detect stdio mode: if stdin is not a TTY, we're likely in stdio mode
+    if (!transportType && !process.stdin.isTTY) {
+        transportType = "stdio";
+    }
+    // Default to streamable-http if not specified
+    if (!transportType) {
+        transportType = "streamable-http";
+    }
+    // Parse SSE config
+    if (transportType === "sse") {
+        const port = parseInt(getArgValue("--sse-port") || process.env.MCP_SSE_PORT || "3002", 10);
+        const host = getArgValue("--sse-host") || process.env.MCP_SSE_HOST || "0.0.0.0";
+        return {
+            type: "sse",
+            host,
+            port,
+            allowedOrigins: parseListOption("--sse-allowed-origins", "MCP_SSE_ALLOWED_ORIGINS"),
+            allowedHosts: parseListOption("--sse-allowed-hosts", "MCP_SSE_ALLOWED_HOSTS"),
+            enableDnsRebindingProtection: parseBooleanOption("--sse-enable-dns-protection", "MCP_SSE_ENABLE_DNS_PROTECTION", false),
+        };
+    }
+    // Parse HTTP/streamable-http config
+    if (transportType === "streamable-http") {
+        const port = parseInt(getArgValue("--http-port") || process.env.MCP_HTTP_PORT || "3001", 10);
+        const host = getArgValue("--http-host") || process.env.MCP_HTTP_HOST || "0.0.0.0";
+        return {
+            type: "streamable-http",
+            host,
+            port,
+            enableJsonResponse: parseBooleanOption("--http-json-response", "MCP_HTTP_ENABLE_JSON_RESPONSE", false),
+            allowedOrigins: parseListOption("--http-allowed-origins", "MCP_HTTP_ALLOWED_ORIGINS"),
+            allowedHosts: parseListOption("--http-allowed-hosts", "MCP_HTTP_ALLOWED_HOSTS"),
+            enableDnsRebindingProtection: parseBooleanOption("--http-enable-dns-protection", "MCP_HTTP_ENABLE_DNS_PROTECTION", false),
+        };
+    }
+    // Stdio config (no additional options)
+    return {
+        type: "stdio",
+    };
+}
+/**
+ * Get argument value from command line
+ */
+function getArgValue(argName) {
+    const args = process.argv;
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === argName && i + 1 < args.length) {
+            return args[i + 1];
+        }
+        if (args[i].startsWith(`${argName}=`)) {
+            return args[i].split("=")[1];
+        }
+    }
+    return undefined;
+}
+/**
+ * Parse boolean option from command line or environment
+ */
+function parseBooleanOption(argName, envName, defaultValue) {
+    const argValue = getArgValue(argName);
+    if (argValue !== undefined) {
+        return argValue.toLowerCase() === "true" || argValue === "1";
+    }
+    const envValue = process.env[envName];
+    if (envValue !== undefined) {
+        return envValue.toLowerCase() === "true" || envValue === "1";
+    }
+    return defaultValue;
+}
+/**
+ * Parse list option from command line or environment
+ */
+function parseListOption(argName, envName) {
+    const argValue = getArgValue(argName);
+    if (argValue) {
+        return argValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    }
+    const envValue = process.env[envName];
+    if (envValue) {
+        return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    }
+    return undefined;
+}

package/dist/proxy/cloudLlmHubProxy.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Cloud LLM Hub Proxy - Proxies requests to cloud-llm-hub with JWT authentication
+ *
+ * For requests with x-sap-destination: "sk", proxies to cloud-llm-hub
+ * with JWT token from auth-broker
+ */
+import { AuthBroker } from "@mcp-abap-adt/auth-broker";
+import { RoutingDecision } from "../router/headerAnalyzer.js";
+import { ProxyConfig } from "../lib/config.js";
+export interface ProxyRequest {
+    method: string;
+    params?: any;
+    id?: string | number | null;
+    jsonrpc?: string;
+}
+export interface ProxyResponse {
+    jsonrpc: string;
+    id?: string | number | null;
+    result?: any;
+    error?: {
+        code: number;
+        message: string;
+        data?: any;
+    };
+}
+/**
+ * Cloud LLM Hub Proxy Client
+ */
+export declare class CloudLlmHubProxy {
+    private axiosInstance;
+    private authBroker;
+    private defaultBaseUrl;
+    private tokenCache;
+    private readonly TOKEN_CACHE_TTL;
+    private circuitBreaker;
+    private config;
+    constructor(defaultBaseUrl: string, authBroker: AuthBroker, config?: Partial<ProxyConfig>);
+    /**
+     * Get JWT token for destination from auth-broker with retry and token refresh
+     */
+    private getJwtToken;
+    /**
+     * Build proxy request with JWT tokens and SAP configuration
+     *
+     * Uses service keys:
+     * 1. x-btp-destination - for BTP Cloud authorization (Authorization: Bearer token) - OPTIONAL
+     * 2. x-mcp-destination - for SAP ABAP connection (SAP headers with token and config) - OPTIONAL
+     *
+     * Can work with only x-mcp-destination (without BTP) for local testing without authentication
+     */
+    private buildProxyRequest;
+    /**
+     * Proxy MCP request to cloud-llm-hub with retry, circuit breaker, and error handling
+     */
+    proxyRequest(originalRequest: ProxyRequest, routingDecision: RoutingDecision, originalHeaders: Record<string, string | string[] | undefined>): Promise<ProxyResponse>;
+}
+/**
+ * Create Cloud LLM Hub Proxy instance
+ */
+export declare function createCloudLlmHubProxy(cloudLlmHubUrl: string, config?: Partial<ProxyConfig>): Promise<CloudLlmHubProxy>;
+//# sourceMappingURL=cloudLlmHubProxy.d.ts.map

package/dist/proxy/cloudLlmHubProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudLlmHubProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/cloudLlmHubProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAc,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAU3D,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,GAAG,CAAC;IACb,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,GAAG,CAAC;KACZ,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,cAAc,CAAS;IAC/B,OAAO,CAAC,UAAU,CAAgE;IAClF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;gBAEhB,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAmEzF;;OAEG;YACW,WAAW;IAwDzB;;;;;;;;OAQG;YACW,iBAAiB;IA4J/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;CA2G1B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,gBAAgB,CAAC,CAY3B"}

package/dist/proxy/cloudLlmHubProxy.js

@@ -0,0 +1,380 @@
+"use strict";
+/**
+ * Cloud LLM Hub Proxy - Proxies requests to cloud-llm-hub with JWT authentication
+ *
+ * For requests with x-sap-destination: "sk", proxies to cloud-llm-hub
+ * with JWT token from auth-broker
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudLlmHubProxy = void 0;
+exports.createCloudLlmHubProxy = createCloudLlmHubProxy;
+const axios_1 = __importDefault(require("axios"));
+const auth_broker_1 = require("@mcp-abap-adt/auth-broker");
+const logger_js_1 = require("../lib/logger.js");
+const config_js_1 = require("../lib/config.js");
+const stores_js_1 = require("../lib/stores.js");
+const errorHandler_js_1 = require("../lib/errorHandler.js");
+/**
+ * Cloud LLM Hub Proxy Client
+ */
+class CloudLlmHubProxy {
+    axiosInstance;
+    authBroker;
+    defaultBaseUrl;
+    tokenCache = new Map();
+    TOKEN_CACHE_TTL = 30 * 60 * 1000; // 30 minutes
+    circuitBreaker;
+    config;
+    constructor(defaultBaseUrl, authBroker, config) {
+        // Default base URL (used if x-mcp-url is relative)
+        this.defaultBaseUrl = defaultBaseUrl.replace(/\/$/, ""); // Remove trailing slash
+        this.authBroker = authBroker;
+        this.config = (0, config_js_1.loadConfig)();
+        // Merge provided config
+        if (config) {
+            this.config = { ...this.config, ...config };
+        }
+        // Initialize circuit breaker
+        this.circuitBreaker = new errorHandler_js_1.CircuitBreaker(this.config.circuitBreakerThreshold || 5, this.config.circuitBreakerTimeout || 60000);
+        // Create axios instance without baseURL - we'll use full URLs from x-mcp-url
+        this.axiosInstance = axios_1.default.create({
+            timeout: this.config.requestTimeout || 60000,
+            headers: {
+                "Content-Type": "application/json",
+            },
+        });
+        // Add request interceptor for logging
+        this.axiosInstance.interceptors.request.use((config) => {
+            logger_js_1.logger.debug("Proxying request to cloud-llm-hub", {
+                type: "CLOUD_LLM_HUB_PROXY_REQUEST",
+                method: config.method,
+                url: config.url,
+                baseURL: config.baseURL,
+            });
+            return config;
+        }, (error) => {
+            logger_js_1.logger.error("Request interceptor error", {
+                type: "CLOUD_LLM_HUB_PROXY_REQUEST_ERROR",
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return Promise.reject(error);
+        });
+        // Add response interceptor for logging
+        this.axiosInstance.interceptors.response.use((response) => {
+            logger_js_1.logger.debug("Received response from cloud-llm-hub", {
+                type: "CLOUD_LLM_HUB_PROXY_RESPONSE",
+                status: response.status,
+                url: response.config.url,
+            });
+            return response;
+        }, (error) => {
+            logger_js_1.logger.error("Response interceptor error", {
+                type: "CLOUD_LLM_HUB_PROXY_RESPONSE_ERROR",
+                error: error instanceof Error ? error.message : String(error),
+                status: error.response?.status,
+                url: error.config?.url,
+            });
+            return Promise.reject(error);
+        });
+    }
+    /**
+     * Get JWT token for destination from auth-broker with retry and token refresh
+     */
+    async getJwtToken(destination, forceRefresh = false) {
+        // Check cache first (unless force refresh)
+        if (!forceRefresh) {
+            const cached = this.tokenCache.get(destination);
+            if (cached && cached.expiresAt > Date.now()) {
+                logger_js_1.logger.debug("Using cached JWT token", {
+                    type: "JWT_TOKEN_CACHE_HIT",
+                    destination,
+                });
+                return cached.token;
+            }
+        }
+        // Retry logic for token retrieval
+        const retryOptions = {
+            maxRetries: this.config.maxRetries || 3,
+            retryDelay: this.config.retryDelay || 1000,
+            retryableStatusCodes: [500, 502, 503, 504],
+        };
+        try {
+            const token = await (0, errorHandler_js_1.retryWithBackoff)(async () => {
+                // Clear cache if force refresh
+                if (forceRefresh) {
+                    this.tokenCache.delete(destination);
+                }
+                // Get token from auth-broker
+                const token = await this.authBroker.getToken(destination);
+                // Cache token (assume it's valid for 30 minutes)
+                this.tokenCache.set(destination, {
+                    token,
+                    expiresAt: Date.now() + this.TOKEN_CACHE_TTL,
+                });
+                logger_js_1.logger.debug("Retrieved JWT token from auth-broker", {
+                    type: "JWT_TOKEN_RETRIEVED",
+                    destination,
+                    forceRefresh,
+                });
+                return token;
+            }, retryOptions);
+            return token;
+        }
+        catch (error) {
+            logger_js_1.logger.error("Failed to get JWT token from auth-broker after retries", {
+                type: "JWT_TOKEN_ERROR",
+                destination,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    /**
+     * Build proxy request with JWT tokens and SAP configuration
+     *
+     * Uses service keys:
+     * 1. x-btp-destination - for BTP Cloud authorization (Authorization: Bearer token) - OPTIONAL
+     * 2. x-mcp-destination - for SAP ABAP connection (SAP headers with token and config) - OPTIONAL
+     *
+     * Can work with only x-mcp-destination (without BTP) for local testing without authentication
+     */
+    async buildProxyRequest(originalRequest, routingDecision, originalHeaders, forceTokenRefresh = false) {
+        // Build headers for target MCP server
+        const proxyHeaders = {
+            "Content-Type": "application/json",
+        };
+        // 1. Get authorization token for BTP Cloud (x-btp-destination or --btp) - OPTIONAL
+        // This token is used for Authorization: Bearer header to connect to cloud MCP server
+        // Only required if btpDestination is present
+        if (routingDecision.btpDestination) {
+            const authToken = await this.getJwtToken(routingDecision.btpDestination, forceTokenRefresh);
+            proxyHeaders["Authorization"] = `Bearer ${authToken}`;
+            logger_js_1.logger.debug("Added BTP Cloud authorization token", {
+                type: "BTP_AUTH_TOKEN_ADDED",
+                destination: routingDecision.btpDestination,
+            });
+        }
+        else {
+            logger_js_1.logger.debug("Skipping BTP Cloud authorization (no btpDestination - local testing mode)", {
+                type: "BTP_AUTH_SKIPPED",
+            });
+        }
+        // 2. Get SAP ABAP configuration from x-mcp-destination (OPTIONAL)
+        // This provides token and configuration for SAP ABAP connection
+        // Only used if x-mcp-destination or --mcp is provided
+        // For local testing (without BTP), token retrieval is optional - URL is still needed
+        if (routingDecision.mcpDestination) {
+            const sapUrl = await this.authBroker.getSapUrl(routingDecision.mcpDestination);
+            // Try to get token, but don't fail if it's not available (for local testing)
+            try {
+                const sapToken = await this.getJwtToken(routingDecision.mcpDestination, forceTokenRefresh);
+                proxyHeaders["x-sap-jwt-token"] = sapToken;
+                logger_js_1.logger.debug("Added SAP ABAP token", {
+                    type: "SAP_TOKEN_ADDED",
+                    destination: routingDecision.mcpDestination,
+                });
+            }
+            catch (error) {
+                logger_js_1.logger.warn("Failed to get SAP ABAP token (continuing without token for local testing)", {
+                    type: "SAP_TOKEN_SKIPPED",
+                    destination: routingDecision.mcpDestination,
+                    error: error instanceof Error ? error.message : String(error),
+                });
+                // Continue without token - this is OK for local testing
+            }
+            // Add SAP ABAP headers
+            if (sapUrl) {
+                proxyHeaders["x-sap-url"] = sapUrl;
+            }
+            proxyHeaders["x-sap-destination"] = routingDecision.mcpDestination;
+            logger_js_1.logger.debug("Added SAP ABAP configuration", {
+                type: "SAP_CONFIG_ADDED",
+                destination: routingDecision.mcpDestination,
+                sapUrl: sapUrl || "not found",
+                hasToken: !!proxyHeaders["x-sap-jwt-token"],
+            });
+        }
+        // Preserve other original SAP headers if provided
+        const sapHeaders = [
+            "x-sap-client",
+            "x-sap-auth-type",
+            "x-sap-login",
+            "x-sap-password",
+        ];
+        for (const headerName of sapHeaders) {
+            const value = originalHeaders[headerName];
+            if (value) {
+                proxyHeaders[headerName] = Array.isArray(value) ? value[0] : value;
+            }
+        }
+        // Get MCP server URL from:
+        // 1. x-mcp-url header (if provided) - direct URL
+        // 2. BTP destination service key (if btpDestination is present)
+        // 3. MCP destination service key (if only mcpDestination is present)
+        let baseUrl;
+        if (routingDecision.mcpUrl) {
+            // Use direct URL from x-mcp-url header
+            baseUrl = routingDecision.mcpUrl;
+            logger_js_1.logger.debug("Using MCP URL from x-mcp-url header", {
+                type: "MCP_URL_FROM_HEADER",
+                url: baseUrl,
+            });
+        }
+        else if (routingDecision.btpDestination) {
+            // Get URL from BTP destination service key
+            baseUrl = await this.authBroker.getSapUrl(routingDecision.btpDestination);
+            if (!baseUrl) {
+                throw new Error(`Failed to get MCP server URL from BTP destination "${routingDecision.btpDestination}". Check service key file.`);
+            }
+            logger_js_1.logger.debug("Using MCP URL from BTP destination service key", {
+                type: "MCP_URL_FROM_BTP",
+                destination: routingDecision.btpDestination,
+                url: baseUrl,
+            });
+        }
+        else if (routingDecision.mcpDestination) {
+            // Get URL from MCP destination service key (for local testing without BTP)
+            baseUrl = await this.authBroker.getSapUrl(routingDecision.mcpDestination);
+            if (!baseUrl) {
+                throw new Error(`Failed to get MCP server URL from MCP destination "${routingDecision.mcpDestination}". Check service key file.`);
+            }
+            logger_js_1.logger.debug("Using MCP URL from MCP destination service key (local testing mode)", {
+                type: "MCP_URL_FROM_MCP",
+                destination: routingDecision.mcpDestination,
+                url: baseUrl,
+            });
+        }
+        else {
+            throw new Error("Cannot determine MCP server URL: neither x-mcp-url header, btpDestination, nor mcpDestination is provided");
+        }
+        // Construct full MCP endpoint URL
+        // If baseUrl already contains the path, use it as-is
+        // Otherwise, append default endpoint /mcp/stream/http
+        let fullUrl;
+        if (baseUrl.includes("/mcp/") || baseUrl.endsWith("/mcp")) {
+            // URL already contains MCP path
+            fullUrl = baseUrl.endsWith("/") ? baseUrl.slice(0, -1) : baseUrl;
+        }
+        else {
+            // Append default endpoint
+            const mcpPath = "/mcp/stream/http";
+            fullUrl = baseUrl.endsWith("/")
+                ? `${baseUrl.slice(0, -1)}${mcpPath}`
+                : `${baseUrl}${mcpPath}`;
+        }
+        logger_js_1.logger.debug("Built proxy request", {
+            type: "PROXY_REQUEST_BUILT",
+            btpDestination: routingDecision.btpDestination,
+            mcpDestination: routingDecision.mcpDestination,
+            mcpUrl: routingDecision.mcpUrl,
+            baseUrl,
+            fullUrl,
+            hasAuthToken: !!proxyHeaders["Authorization"],
+            hasSapConfig: !!proxyHeaders["x-sap-jwt-token"],
+            sapHeaders: Object.keys(proxyHeaders).filter(h => h.startsWith("x-sap")),
+        });
+        // Return axios config with full URL
+        return {
+            method: "POST",
+            url: fullUrl,
+            headers: proxyHeaders,
+            data: originalRequest,
+        };
+    }
+    /**
+     * Proxy MCP request to cloud-llm-hub with retry, circuit breaker, and error handling
+     */
+    async proxyRequest(originalRequest, routingDecision, originalHeaders) {
+        // Check circuit breaker
+        if (!this.circuitBreaker.canProceed()) {
+            logger_js_1.logger.warn("Circuit breaker is open, rejecting request", {
+                type: "CIRCUIT_BREAKER_REJECTED",
+                btpDestination: routingDecision.btpDestination,
+                mcpDestination: routingDecision.mcpDestination,
+            });
+            return (0, errorHandler_js_1.createErrorResponse)(originalRequest.id || null, -32001, "Service temporarily unavailable (circuit breaker open)", { circuitBreakerState: this.circuitBreaker.getState() });
+        }
+        const retryOptions = {
+            maxRetries: this.config.maxRetries || 3,
+            retryDelay: this.config.retryDelay || 1000,
+            retryableStatusCodes: [500, 502, 503, 504],
+        };
+        try {
+            const response = await (0, errorHandler_js_1.retryWithBackoff)(async () => {
+                // Check for token expiration and refresh if needed
+                let forceTokenRefresh = false;
+                // Build proxy request (will get fresh token if needed)
+                const proxyConfig = await this.buildProxyRequest(originalRequest, routingDecision, originalHeaders, forceTokenRefresh);
+                // Send request to cloud-llm-hub
+                const response = await this.axiosInstance.request(proxyConfig);
+                // Record success in circuit breaker
+                this.circuitBreaker.recordSuccess();
+                logger_js_1.logger.debug("Proxied request completed", {
+                    type: "PROXY_REQUEST_COMPLETED",
+                    status: response.status,
+                    hasResult: !!response.data?.result,
+                    hasError: !!response.data?.error,
+                });
+                return response;
+            }, retryOptions);
+            return response.data;
+        }
+        catch (error) {
+            // Record failure in circuit breaker
+            this.circuitBreaker.recordFailure();
+            // Handle token expiration
+            if ((0, errorHandler_js_1.isTokenExpirationError)(error)) {
+                logger_js_1.logger.warn("Token expiration detected, will retry with fresh token", {
+                    type: "TOKEN_EXPIRATION_DETECTED",
+                    btpDestination: routingDecision.btpDestination,
+                    mcpDestination: routingDecision.mcpDestination,
+                });
+                // Retry once with fresh token
+                try {
+                    const proxyConfig = await this.buildProxyRequest(originalRequest, routingDecision, originalHeaders, true // Force token refresh
+                    );
+                    const response = await this.axiosInstance.request(proxyConfig);
+                    this.circuitBreaker.recordSuccess();
+                    return response.data;
+                }
+                catch (retryError) {
+                    logger_js_1.logger.error("Failed to retry with fresh token", {
+                        type: "TOKEN_REFRESH_RETRY_FAILED",
+                        error: retryError instanceof Error ? retryError.message : String(retryError),
+                    });
+                }
+            }
+            logger_js_1.logger.error("Failed to proxy request to cloud-llm-hub", {
+                type: "PROXY_REQUEST_ERROR",
+                error: error instanceof Error ? error.message : String(error),
+                status: axios_1.default.isAxiosError(error) ? error.response?.status : undefined,
+                circuitBreakerState: this.circuitBreaker.getState(),
+            });
+            // Return error response in MCP format
+            return (0, errorHandler_js_1.createErrorResponse)(originalRequest.id || null, axios_1.default.isAxiosError(error) && error.response?.status
+                ? error.response.status
+                : -32000, error instanceof Error ? error.message : "Unknown error", {
+                circuitBreakerState: this.circuitBreaker.getState(),
+                originalError: axios_1.default.isAxiosError(error) && error.response?.data
+                    ? error.response.data
+                    : undefined,
+            });
+        }
+    }
+}
+exports.CloudLlmHubProxy = CloudLlmHubProxy;
+/**
+ * Create Cloud LLM Hub Proxy instance
+ */
+async function createCloudLlmHubProxy(cloudLlmHubUrl, config) {
+    const unsafe = config?.unsafe ?? false;
+    const { serviceKeyStore, sessionStore } = await (0, stores_js_1.getPlatformStores)(unsafe);
+    const authBroker = new auth_broker_1.AuthBroker({
+        serviceKeyStore,
+        sessionStore,
+    }, "system");
+    return new CloudLlmHubProxy(cloudLlmHubUrl, authBroker, config);
+}

package/dist/router/directCloudRouter.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Direct Cloud Router - Routes requests directly to cloud ABAP systems
+ *
+ * For requests with x-sap-destination (not "sk"), routes directly to cloud ABAP
+ * using the same approach as mcp-abap-adt
+ */
+import { IncomingHttpHeaders } from "http";
+import { AuthBroker } from "@mcp-abap-adt/auth-broker";
+import { AbapConnection } from "@mcp-abap-adt/connection";
+import { RoutingDecision } from "./headerAnalyzer.js";
+export interface DirectCloudConfig {
+    sapUrl: string;
+    destination?: string;
+    authType: "jwt" | "basic";
+    jwtToken?: string;
+    refreshToken?: string;
+    username?: string;
+    password?: string;
+    sapClient?: string;
+    uaaUrl?: string;
+    uaaClientId?: string;
+    uaaClientSecret?: string;
+}
+/**
+ * Convert validated auth config to direct cloud config
+ */
+export declare function createDirectCloudConfig(routingDecision: RoutingDecision, headers: IncomingHttpHeaders): DirectCloudConfig | null;
+/**
+ * Get or create ABAP connection for direct cloud routing
+ */
+export declare function getDirectCloudConnection(sessionId: string, config: DirectCloudConfig, authBroker?: AuthBroker): Promise<AbapConnection>;
+//# sourceMappingURL=directCloudRouter.d.ts.map

package/dist/router/directCloudRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"directCloudRouter.d.ts","sourceRoot":"","sources":["../../src/router/directCloudRouter.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAwB,cAAc,EAAsB,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,KAAK,GAAG,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,mBAAmB,GAC3B,iBAAiB,GAAG,IAAI,CAgD1B;AA4CD;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,iBAAiB,EACzB,UAAU,CAAC,EAAE,UAAU,GACtB,OAAO,CAAC,cAAc,CAAC,CA+FzB"}