@mcp-abap-adt/proxy 1.1.0 → 1.2.1

package/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.1] - 2026-05-26
+
+### Security
+- **Default bind host changed from `0.0.0.0` to `127.0.0.1`** (loopback) for HTTP and SSE transports. The proxy holds auth tokens and runs locally, so it no longer listens on all network interfaces by default. Set `httpHost`/`sseHost` (or `MCP_HTTP_HOST`/`MCP_SSE_HOST`) to `0.0.0.0` to expose it intentionally.
+
+### Removed
+- **Interactive configuration wizard (TUI)** — removed the `mcp-abap-adt-proxy tui` subcommand and the `src/tui/` module (its `direct`/`mcpUrl` scenario no longer matched the BTP-only proxy and produced unusable configs). Client and proxy configuration is handled by the separate `@mcp-abap-adt/configurator` package (`mcp-conf`). Dropped the `@inquirer/prompts` dependency.
+- **Combined-launch test harness** — removed `tools/start-servers.js` and the `npm run test:servers` script. It started a local `mcp-abap-adt` server with the proxy in front of it via the long-removed `--mcp-url`/`--mcp` flags, which no longer applies to a pure authorization proxy.
+
+### Changed
+- **Documentation synced to the BTP-only model.** Removed stale references to the long-gone `x-mcp-url`/`--mcp-url`, `mcpDestination`, `cloudLlmHubUrl`/`CLOUD_LLM_HUB_URL`, `DEBUG_HTTP_REQUESTS`, and config-file auto-discovery/`MCP_PROXY_CONFIG`. Documented the actual options: `defaultHeaders`, `browser`/`browserAuthPort`, and `targetUrl`/`x-target-url`. Removed the obsolete `IMPLEMENTATION_ANALYSIS.md`.
+
+## [1.2.0] - 2026-04-20
+
+### Added
+- **Proactive JWT token refresh** — proxy now decodes the `exp` claim from the JWT and refreshes the token in the background 5 minutes before expiry via `authBroker.refreshToken()` (OAuth2 refresh_token grant, preserves role assignment). Eliminates latency spikes from on-demand 401 refreshes while keeping the reactive 401/403 fallback.
+
+### Changed
+- **@mcp-abap-adt/interfaces 7.0** — updated from v6.0 to v7.0
+- **typescript 6.0.3**, **@biomejs/biome 2.4.12**, **@modelcontextprotocol/inspector 0.21.2**, **axios 1.15.1**, **@inquirer/prompts 8.4.2** — patch bumps
+
 ## [1.1.0] - 2026-04-12
 
 ### Changed

package/README.md

@@ -1,4 +1,5 @@
 # @mcp-abap-adt/proxy
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 
 MCP proxy server for SAP ABAP ADT - proxies local requests to MCP servers with JWT authentication.
 
@@ -141,7 +142,6 @@ The proxy uses BTP/XSUAA authentication:
 - **[Architecture](./docs/ARCHITECTURE.md)** - System architecture and design
 - **[Troubleshooting](./docs/TROUBLESHOOTING.md)** - Common issues and solutions
 - **[Routing Logic Specification](./docs/ROUTING_LOGIC.md)** - Detailed routing logic and scenarios
-- **[Implementation Analysis](./docs/IMPLEMENTATION_ANALYSIS.md)** - Current implementation analysis
 - **[Roadmap](./ROADMAP.md)** - Development roadmap and progress
 
 ## How It Works
@@ -225,28 +225,13 @@ See [Configuration Guide](./docs/CONFIGURATION.md) for complete options.
 
 ## Testing Tools
 
-### Start Both Servers for Testing
-
-Use the included script to start both `mcp-abap-adt` and `mcp-abap-adt-proxy` simultaneously:
+Verify a BTP destination's service key and token retrieval:
 
 ```bash
-# Using npm script
-npm run test:servers
-
-# Direct execution
-node tools/start-servers.js
-
-# With SSE transport
-node tools/start-servers.js --transport=sse
+npm run test-destination
 ```
 
-The script automatically:
-- Starts ADT server on port 3000 (HTTP) or 3001 (SSE)
-- Starts Proxy server on port 3001 (HTTP) or 3002 (SSE)
-- Generates `mcpUrl` based on ADT server configuration
-- Ensures both servers use the same transport protocol
-
-See [tools/README.md](./tools/README.md) for complete documentation.
+See [tools/README.md](./tools/README.md) for the available scripts.
 
 ## Development Status
 
@@ -257,7 +242,7 @@ See [tools/README.md](./tools/README.md) for complete documentation.
 - ✅ JWT Token Management & Proxy Forwarding
 - ✅ Configuration & Environment
 - ✅ Error Handling & Resilience
-- ✅ Testing Tools (`tools/start-servers.js`)
+- ✅ Testing Tools (`tools/`)
 - ✅ Documentation
 
 🚧 **Future Work**

package/bin/mcp-abap-adt-proxy.js

@@ -7,7 +7,6 @@
  *
  * Usage:
  *   mcp-abap-adt-proxy [options]
- *   mcp-abap-adt-proxy tui
  *   mcp-abap-adt-proxy --transport=stdio
  *   mcp-abap-adt-proxy --transport=http
  */
@@ -44,17 +43,13 @@ MCP ABAP ADT Proxy Server v${pkg.version}
 
 Usage:
   mcp-abap-adt-proxy [options]
-  mcp-abap-adt-proxy tui
-
-Commands:
-  tui                       Interactive configuration wizard (generates YAML config)
 
 Options:
   --transport=<type>       Transport type: stdio, http, streamable-http, sse
   --http-port=<port>      HTTP server port (default: 3001)
   --sse-port=<port>       SSE server port (default: 3002)
-  --http-host=<host>      HTTP server host (default: 0.0.0.0)
-  --sse-host=<host>       SSE server host (default: 0.0.0.0)
+  --http-host=<host>      HTTP server host (default: 127.0.0.1)
+  --sse-host=<host>       SSE server host (default: 127.0.0.1)
   --btp=<destination>     Override x-sap-destination header (for BTP Cloud authorization)
                            Required for stdio/SSE transports unless provided in headers
   --target-url=<url>      Override target URL (separates Auth from Connection)
@@ -70,8 +65,8 @@ Options:
 Environment Variables:
   MCP_HTTP_PORT           HTTP server port (default: 3001)
   MCP_SSE_PORT            SSE server port (default: 3002)
-  MCP_HTTP_HOST           HTTP server host (default: 0.0.0.0)
-  MCP_SSE_HOST            SSE server host (default: 0.0.0.0)
+  MCP_HTTP_HOST           HTTP server host (default: 127.0.0.1)
+  MCP_SSE_HOST            SSE server host (default: 127.0.0.1)
   MCP_TRANSPORT           Transport type (stdio|http|sse)
   MCP_PROXY_UNSAFE        Enable file-based session storage (set to "true")
 
@@ -85,7 +80,6 @@ Examples:
   mcp-abap-adt-proxy --btp=ai                           # With BTP destination override
   mcp-abap-adt-proxy --btp=ai --unsafe                  # With file-based session storage
   mcp-abap-adt-proxy --btp=ai --header x-sap-destination=S4HANA  # With default SAP headers
-  mcp-abap-adt-proxy tui                                 # Interactive configuration wizard
   mcp-abap-adt-proxy --config=proxy-config.yaml         # Load configuration from YAML file
   mcp-abap-adt-proxy -c proxy-config.yml                # Load configuration from YAML file (short form)
 
@@ -146,30 +140,6 @@ function main() {
     process.exit(0);
   }
 
-  // Handle 'tui' subcommand — interactive configuration wizard
-  if (process.argv[2] === 'tui') {
-    const wizardPath = path.resolve(__dirname, '../dist/tui/index.js');
-    if (!fs.existsSync(wizardPath)) {
-      process.stderr.write(`[MCP Proxy] ✗ Wizard not found at: ${wizardPath}\n`);
-      process.stderr.write(`[MCP Proxy]   Make sure to build the project with 'npm run build' first.\n`);
-      process.exit(1);
-      return;
-    }
-    import(wizardPath).then(({ runWizard }) => {
-      runWizard().catch((err) => {
-        if (err.name === 'ExitPromptError') {
-          process.exit(0);
-        }
-        process.stderr.write(`[MCP Proxy] ✗ Wizard error: ${err.message}\n`);
-        process.exit(1);
-      });
-    }).catch((err) => {
-      process.stderr.write(`[MCP Proxy] ✗ Failed to load wizard: ${err.message}\n`);
-      process.exit(1);
-    });
-    return;
-  }
-
   // Spawn the main server process
   const serverPath = path.resolve(__dirname, '../dist/index.js');
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA6T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA6T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAoBhC;AAGD,eAAe,qBAAqB,CAAC"}

package/dist/index.js

@@ -206,7 +206,7 @@ Authorization source: BTP destination "${this.config.btpDestination}"`;
             }
         });
         const port = httpConfig.port || 3001;
-        const host = httpConfig.host || '0.0.0.0';
+        const host = httpConfig.host || '127.0.0.1';
         return new Promise((resolve, reject) => {
             this.httpServer?.listen(port, host, () => {
                 const authSourceObj = this.config.btpDestination
@@ -513,7 +513,7 @@ Authorization source: ${authSourceObj}`;
             res.end('Not found');
         });
         const port = sseConfig.port || 3002;
-        const host = sseConfig.host || '0.0.0.0';
+        const host = sseConfig.host || '127.0.0.1';
         return new Promise((resolve, reject) => {
             httpServer.listen(port, host, () => {
                 const authSourceObj = this.config.btpDestination
@@ -544,6 +544,7 @@ Authorization source: ${authSourceObj}`;
      * Shutdown server
      */
     async shutdown() {
+        this.btpProxy?.dispose();
         try {
             await this.server.close();
         }

package/dist/lib/config.js

@@ -132,8 +132,8 @@ function applyDefaults(fileConfig) {
     const result = {
         httpPort: fileConfig.httpPort ?? 3001,
         ssePort: fileConfig.ssePort ?? 3002,
-        httpHost: fileConfig.httpHost || '0.0.0.0',
-        sseHost: fileConfig.sseHost || '0.0.0.0',
+        httpHost: fileConfig.httpHost || '127.0.0.1',
+        sseHost: fileConfig.sseHost || '127.0.0.1',
         logLevel: fileConfig.logLevel || 'info',
         btpDestination: fileConfig.btpDestination,
         targetUrl: fileConfig.targetUrl,
@@ -179,8 +179,8 @@ function loadFromEnv() {
     return {
         httpPort: parseInt(process.env.MCP_HTTP_PORT || '3001', 10),
         ssePort: parseInt(process.env.MCP_SSE_PORT || '3002', 10),
-        httpHost: process.env.MCP_HTTP_HOST || '0.0.0.0',
-        sseHost: process.env.MCP_SSE_HOST || '0.0.0.0',
+        httpHost: process.env.MCP_HTTP_HOST || '127.0.0.1',
+        sseHost: process.env.MCP_SSE_HOST || '127.0.0.1',
         logLevel: process.env.LOG_LEVEL || 'info',
         btpDestination,
         targetUrl,

package/dist/lib/transportConfig.js

@@ -64,7 +64,7 @@ function parseTransportConfig(fileOverrides) {
         const host = getArgValue('--sse-host') ||
             fileOverrides?.sseHost ||
             process.env.MCP_SSE_HOST ||
-            '0.0.0.0';
+            '127.0.0.1';
         return {
             type: 'sse',
             host,
@@ -85,7 +85,7 @@ function parseTransportConfig(fileOverrides) {
         const host = getArgValue('--http-host') ||
             fileOverrides?.httpHost ||
             process.env.MCP_HTTP_HOST ||
-            '0.0.0.0';
+            '127.0.0.1';
         return {
             type: 'streamable-http',
             host,

package/dist/proxy/btpProxy.d.ts

@@ -38,7 +38,9 @@ export declare class BtpProxy {
     private defaultBtpAuthBroker;
     private btpAuthBrokers;
     private tokenCache;
+    private refreshTimers;
     private readonly TOKEN_CACHE_TTL;
+    private readonly REFRESH_LEAD_MS;
     private circuitBreaker;
     private config;
     private unsafe;
@@ -64,6 +66,27 @@ export declare class BtpProxy {
      * @param forceRefresh Force token refresh
      */
     getJwtToken(destination: string, forceRefresh?: boolean): Promise<string>;
+    /**
+     * Decode JWT exp claim (seconds since epoch). Returns null if not parseable.
+     */
+    private decodeJwtExp;
+    /**
+     * Cache token with expiry derived from JWT, and schedule proactive refresh
+     * 5 minutes before expiry.
+     */
+    private cacheToken;
+    /**
+     * Schedule background refresh REFRESH_LEAD_MS before token expiry.
+     */
+    private scheduleProactiveRefresh;
+    /**
+     * Background refresh via auth-broker's refreshToken grant.
+     */
+    private proactiveRefresh;
+    /**
+     * Cancel all pending refresh timers. Call on shutdown.
+     */
+    dispose(): void;
     /**
      * Get the target service URL for a destination.
      * Priority: config.targetUrl > service key's serviceUrl

package/dist/proxy/btpProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAqHlB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}
+{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAOtB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}

package/dist/proxy/btpProxy.js

@@ -58,7 +58,9 @@ class BtpProxy {
     defaultBtpAuthBroker;
     btpAuthBrokers = new Map();
     tokenCache = new Map();
-    TOKEN_CACHE_TTL = 30 * 60 * 1000; // 30 minutes
+    refreshTimers = new Map();
+    TOKEN_CACHE_TTL = 30 * 60 * 1000; // fallback if JWT has no exp
+    REFRESH_LEAD_MS = 5 * 60 * 1000; // refresh 5 min before expiry
     circuitBreaker;
     config;
     unsafe;
@@ -349,11 +351,7 @@ class BtpProxy {
                 });
                 // Get token from auth-broker
                 const token = await authBroker.getToken(destination);
-                // Cache token (assume it's valid for 30 minutes)
-                this.tokenCache.set(destination, {
-                    token,
-                    expiresAt: Date.now() + this.TOKEN_CACHE_TTL,
-                });
+                this.cacheToken(destination, token);
                 logger_js_1.logger?.debug('Retrieved JWT token from auth-broker', {
                     type: 'JWT_TOKEN_RETRIEVED',
                     destination,
@@ -404,6 +402,79 @@ class BtpProxy {
             throw new Error(errorMessage);
         }
     }
+    /**
+     * Decode JWT exp claim (seconds since epoch). Returns null if not parseable.
+     */
+    decodeJwtExp(token) {
+        const parts = token.split('.');
+        if (parts.length < 2)
+            return null;
+        try {
+            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+            return typeof payload.exp === 'number' ? payload.exp : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Cache token with expiry derived from JWT, and schedule proactive refresh
+     * 5 minutes before expiry.
+     */
+    cacheToken(destination, token) {
+        const exp = this.decodeJwtExp(token);
+        const expiresAt = exp !== null ? exp * 1000 : Date.now() + this.TOKEN_CACHE_TTL;
+        this.tokenCache.set(destination, { token, expiresAt });
+        this.scheduleProactiveRefresh(destination, expiresAt);
+    }
+    /**
+     * Schedule background refresh REFRESH_LEAD_MS before token expiry.
+     */
+    scheduleProactiveRefresh(destination, expiresAt) {
+        const existing = this.refreshTimers.get(destination);
+        if (existing)
+            clearTimeout(existing);
+        const delay = expiresAt - Date.now() - this.REFRESH_LEAD_MS;
+        if (delay <= 0) {
+            // Token already within lead window or expired; skip scheduling.
+            this.refreshTimers.delete(destination);
+            return;
+        }
+        const timer = setTimeout(() => {
+            this.refreshTimers.delete(destination);
+            this.proactiveRefresh(destination).catch((err) => {
+                logger_js_1.logger?.warn('Proactive token refresh failed, will retry reactively', {
+                    type: 'JWT_TOKEN_PROACTIVE_REFRESH_ERROR',
+                    destination,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            });
+        }, delay);
+        // Don't keep the event loop alive just for refresh timers.
+        timer.unref?.();
+        this.refreshTimers.set(destination, timer);
+    }
+    /**
+     * Background refresh via auth-broker's refreshToken grant.
+     */
+    async proactiveRefresh(destination) {
+        logger_js_1.logger?.info('Proactively refreshing JWT token', {
+            type: 'JWT_TOKEN_PROACTIVE_REFRESH',
+            destination,
+        });
+        const broker = await this.getOrCreateBtpAuthBroker(destination);
+        const token = await broker.refreshToken(destination);
+        this.cacheToken(destination, token);
+    }
+    /**
+     * Cancel all pending refresh timers. Call on shutdown.
+     */
+    dispose() {
+        for (const timer of this.refreshTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.refreshTimers.clear();
+    }
     /**
      * Get the target service URL for a destination.
      * Priority: config.targetUrl > service key's serviceUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -19,7 +19,6 @@
     "dev": "npx @modelcontextprotocol/inspector node ./dist/index.js",
     "clean": "rimraf dist tsconfig.tsbuildinfo",
     "prepublishOnly": "npm run build",
-    "test:servers": "node ./tools/start-servers.js",
     "test-destination": "npx tsx tools/test-destination.ts"
   },
   "keywords": [
@@ -44,9 +43,9 @@
     "access": "public"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.15",
+    "@biomejs/biome": "^2.4.12",
     "@jest/globals": "^30.2.0",
-    "@modelcontextprotocol/inspector": "^0.21.1",
+    "@modelcontextprotocol/inspector": "^0.21.2",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.2.3",
@@ -61,18 +60,17 @@
     "rimraf": "^6.1.2",
     "ts-jest": "^29.2.5",
     "tsx": "^4.21.0",
-    "typescript": "^6.0.2"
+    "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.3.2",
     "@mcp-abap-adt/auth-broker": "^1.0.5",
     "@mcp-abap-adt/auth-providers": "^1.0.5",
     "@mcp-abap-adt/auth-stores": "^1.0.4",
     "@mcp-abap-adt/header-validator": "^0.1.8",
-    "@mcp-abap-adt/interfaces": "^6.0.0",
+    "@mcp-abap-adt/interfaces": "^7.0.0",
     "@mcp-abap-adt/logger": "^0.1.4",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "axios": "^1.13.5",
+    "axios": "^1.15.1",
     "js-yaml": "^4.1.1",
     "zod": "^4.3.6"
   },

package/dist/tui/index.d.ts

@@ -1,8 +0,0 @@
-/**
- * TUI module barrel export
- */
-export type { ServiceKeyCheckResult } from './serviceKeyCheck.js';
-export { checkServiceKeyExists } from './serviceKeyCheck.js';
-export type { WizardAnswers } from './wizard.js';
-export { generateConfigYaml, runWizard } from './wizard.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/tui/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tui/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/tui/index.js

@@ -1,11 +0,0 @@
-"use strict";
-/**
- * TUI module barrel export
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.runWizard = exports.generateConfigYaml = exports.checkServiceKeyExists = void 0;
-var serviceKeyCheck_js_1 = require("./serviceKeyCheck.js");
-Object.defineProperty(exports, "checkServiceKeyExists", { enumerable: true, get: function () { return serviceKeyCheck_js_1.checkServiceKeyExists; } });
-var wizard_js_1 = require("./wizard.js");
-Object.defineProperty(exports, "generateConfigYaml", { enumerable: true, get: function () { return wizard_js_1.generateConfigYaml; } });
-Object.defineProperty(exports, "runWizard", { enumerable: true, get: function () { return wizard_js_1.runWizard; } });

package/dist/tui/serviceKeyCheck.d.ts

@@ -1,25 +0,0 @@
-/**
- * Service key existence checker
- * Checks if a service key file exists for a given BTP destination
- * by searching platform-specific directories.
- */
-/**
- * Result of a service key existence check
- */
-export interface ServiceKeyCheckResult {
-    /** Whether the service key file was found */
-    found: boolean;
-    /** Absolute path to the found service key file (if found) */
-    path?: string;
-    /** Directories that were searched (when not found) */
-    searchedPaths?: string[];
-}
-/**
- * Check if a service key file exists for the given BTP destination.
- * Searches all platform-specific directories returned by getPlatformPaths('service-keys').
- *
- * @param destination - BTP destination name (without .json extension)
- * @returns ServiceKeyCheckResult indicating whether the key was found and where
- */
-export declare function checkServiceKeyExists(destination: string): ServiceKeyCheckResult;
-//# sourceMappingURL=serviceKeyCheck.d.ts.map

package/dist/tui/serviceKeyCheck.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"serviceKeyCheck.d.ts","sourceRoot":"","sources":["../../src/tui/serviceKeyCheck.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,6CAA6C;IAC7C,KAAK,EAAE,OAAO,CAAC;IACf,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,WAAW,EAAE,MAAM,GAClB,qBAAqB,CAYvB"}

package/dist/tui/serviceKeyCheck.js

@@ -1,62 +0,0 @@
-"use strict";
-/**
- * Service key existence checker
- * Checks if a service key file exists for a given BTP destination
- * by searching platform-specific directories.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.checkServiceKeyExists = checkServiceKeyExists;
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const stores_js_1 = require("../lib/stores.js");
-/**
- * Check if a service key file exists for the given BTP destination.
- * Searches all platform-specific directories returned by getPlatformPaths('service-keys').
- *
- * @param destination - BTP destination name (without .json extension)
- * @returns ServiceKeyCheckResult indicating whether the key was found and where
- */
-function checkServiceKeyExists(destination) {
-    const searchDirs = (0, stores_js_1.getPlatformPaths)('service-keys');
-    const fileName = `${destination}.json`;
-    for (const dir of searchDirs) {
-        const filePath = path.join(dir, fileName);
-        if (fs.existsSync(filePath)) {
-            return { found: true, path: filePath };
-        }
-    }
-    return { found: false, searchedPaths: searchDirs };
-}

package/dist/tui/wizard.d.ts

@@ -1,38 +0,0 @@
-/**
- * TUI wizard for interactive proxy configuration
- */
-/**
- * Answers collected by the wizard
- */
-export interface WizardAnswers {
-    scenario: 'btp' | 'direct';
-    btpDestination?: string;
-    targetUrl?: string;
-    mcpDestination?: string;
-    mcpUrl?: string;
-    transport: 'stdio' | 'http' | 'sse';
-    httpHost?: string;
-    httpPort?: number;
-    sseHost?: string;
-    ssePort?: number;
-    browser: 'system' | 'headless' | 'chrome' | 'edge' | 'firefox' | 'none';
-    browserAuthPort: number;
-    unsafe: boolean;
-    logLevel: string;
-    maxRetries?: number;
-    retryDelay?: number;
-    requestTimeout?: number;
-    circuitBreakerThreshold?: number;
-    circuitBreakerTimeout?: number;
-    cloudLlmHubUrl?: string;
-}
-/**
- * Generate a YAML configuration string from wizard answers.
- * The output follows the structure of docs/mcp-proxy-config.example.yaml.
- */
-export declare function generateConfigYaml(answers: WizardAnswers): string;
-/**
- * Run the interactive configuration wizard
- */
-export declare function runWizard(): Promise<WizardAnswers>;
-//# sourceMappingURL=wizard.d.ts.map

package/dist/tui/wizard.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"wizard.d.ts","sourceRoot":"","sources":["../../src/tui/wizard.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,KAAK,GAAG,QAAQ,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAWD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CA+FjE;AAeD;;GAEG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,aAAa,CAAC,CAwMxD"}

package/dist/tui/wizard.js

@@ -1,321 +0,0 @@
-"use strict";
-/**
- * TUI wizard for interactive proxy configuration
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateConfigYaml = generateConfigYaml;
-exports.runWizard = runWizard;
-const fs = __importStar(require("node:fs"));
-const serviceKeyCheck_js_1 = require("./serviceKeyCheck.js");
-/** Default values for advanced settings */
-const DEFAULTS = {
-    maxRetries: 3,
-    retryDelay: 1000,
-    requestTimeout: 60000,
-    circuitBreakerThreshold: 5,
-    circuitBreakerTimeout: 60000,
-};
-/**
- * Generate a YAML configuration string from wizard answers.
- * The output follows the structure of docs/mcp-proxy-config.example.yaml.
- */
-function generateConfigYaml(answers) {
-    const lines = [];
-    lines.push('# MCP ABAP ADT Proxy Configuration');
-    lines.push('');
-    // Transport configuration
-    lines.push('# Transport configuration');
-    lines.push(`transport: ${answers.transport}  # stdio | http | sse`);
-    if (answers.transport === 'http' || answers.transport === 'sse') {
-        lines.push(`httpPort: ${answers.httpPort ?? 3001}`);
-        lines.push(`httpHost: "${answers.httpHost ?? '0.0.0.0'}"`);
-    }
-    if (answers.transport === 'sse') {
-        lines.push(`ssePort: ${answers.ssePort ?? 3002}`);
-        lines.push(`sseHost: "${answers.sseHost ?? '0.0.0.0'}"`);
-    }
-    lines.push('');
-    // Destination overrides
-    lines.push('# Destination overrides');
-    if (answers.scenario === 'btp') {
-        if (answers.btpDestination) {
-            lines.push(`btpDestination: "${answers.btpDestination}"`);
-        }
-        if (answers.targetUrl) {
-            lines.push(`targetUrl: "${answers.targetUrl}"`);
-        }
-        if (answers.mcpDestination) {
-            lines.push(`mcpDestination: "${answers.mcpDestination}"`);
-        }
-        if (answers.mcpUrl) {
-            lines.push(`# mcpUrl: "${answers.mcpUrl}"`);
-        }
-        else {
-            lines.push('# mcpUrl:');
-        }
-    }
-    else {
-        lines.push('# btpDestination:');
-        lines.push('# mcpDestination:');
-        if (answers.mcpUrl) {
-            lines.push(`mcpUrl: "${answers.mcpUrl}"`);
-        }
-    }
-    lines.push('');
-    // Browser authentication
-    lines.push('# Browser authentication');
-    lines.push(`browser: "${answers.browser}"`);
-    lines.push(`browserAuthPort: ${answers.browserAuthPort}`);
-    lines.push('');
-    // Session storage mode
-    lines.push('# Session storage mode');
-    lines.push(`unsafe: ${answers.unsafe}  # If true, persists tokens to disk`);
-    lines.push('');
-    // Error handling & resilience
-    lines.push('# Error handling & resilience');
-    lines.push(`maxRetries: ${answers.maxRetries ?? DEFAULTS.maxRetries}`);
-    lines.push(`retryDelay: ${answers.retryDelay ?? DEFAULTS.retryDelay}  # milliseconds`);
-    lines.push(`requestTimeout: ${answers.requestTimeout ?? DEFAULTS.requestTimeout}  # milliseconds`);
-    lines.push(`circuitBreakerThreshold: ${answers.circuitBreakerThreshold ?? DEFAULTS.circuitBreakerThreshold}`);
-    lines.push(`circuitBreakerTimeout: ${answers.circuitBreakerTimeout ?? DEFAULTS.circuitBreakerTimeout}  # milliseconds`);
-    lines.push('');
-    // Logging
-    lines.push('# Logging');
-    lines.push(`logLevel: "${answers.logLevel}"  # debug | info | warn | error`);
-    // Cloud LLM Hub URL
-    if (answers.cloudLlmHubUrl) {
-        lines.push('');
-        lines.push('# Cloud LLM Hub URL');
-        lines.push(`cloudLlmHubUrl: "${answers.cloudLlmHubUrl}"`);
-    }
-    lines.push('');
-    return lines.join('\n');
-}
-/**
- * Print a service key check result to the console.
- */
-function printServiceKeyCheck(destination) {
-    const result = (0, serviceKeyCheck_js_1.checkServiceKeyExists)(destination);
-    if (result.found) {
-        console.log(`  Found: ${result.path}`);
-    }
-    else {
-        console.log(`  Warning: Service key file not found for "${destination}".`);
-        console.log(`  Searched: ${result.searchedPaths?.join(', ') ?? '(none)'}`);
-    }
-}
-/**
- * Run the interactive configuration wizard
- */
-async function runWizard() {
-    try {
-        const { select, input, confirm, number } = await import('@inquirer/prompts');
-        console.log('\n  MCP ABAP ADT Proxy — Configuration Wizard\n');
-        // 1. Scenario
-        const scenario = await select({
-            message: 'Select scenario:',
-            choices: [
-                {
-                    name: 'BTP service (XSUAA auth via service key)',
-                    value: 'btp',
-                },
-                {
-                    name: 'Direct MCP server URL (no auth)',
-                    value: 'direct',
-                },
-            ],
-        });
-        const answers = { scenario };
-        // 2. Scenario-specific questions
-        if (scenario === 'btp') {
-            const btpDestination = await input({
-                message: 'BTP destination name:',
-                required: true,
-            });
-            answers.btpDestination = btpDestination;
-            printServiceKeyCheck(btpDestination);
-            const targetUrl = await input({
-                message: 'Target service URL (leave empty if in service key):',
-                default: '',
-            });
-            if (targetUrl) {
-                answers.targetUrl = targetUrl;
-            }
-            const addMcpDest = await confirm({
-                message: 'Add MCP destination (for ABAP connection params on Cloud)?',
-                default: false,
-            });
-            if (addMcpDest) {
-                const mcpDestination = await input({
-                    message: 'MCP destination name:',
-                    required: true,
-                });
-                answers.mcpDestination = mcpDestination;
-                printServiceKeyCheck(mcpDestination);
-            }
-        }
-        else {
-            const mcpUrl = await input({
-                message: 'MCP server URL:',
-                required: true,
-            });
-            answers.mcpUrl = mcpUrl;
-        }
-        // 3. Transport
-        const transport = await select({
-            message: 'Select transport:',
-            choices: [
-                { name: 'stdio', value: 'stdio' },
-                { name: 'streamable-http', value: 'http' },
-                { name: 'sse', value: 'sse' },
-            ],
-        });
-        answers.transport = transport;
-        // 4. Transport-specific settings
-        if (transport !== 'stdio') {
-            answers.httpHost = await input({
-                message: 'HTTP host:',
-                default: '0.0.0.0',
-            });
-            answers.httpPort = await number({
-                message: 'HTTP port:',
-                default: 3001,
-                min: 1,
-                max: 65535,
-            });
-            if (transport === 'sse') {
-                answers.sseHost = await input({
-                    message: 'SSE host:',
-                    default: '0.0.0.0',
-                });
-                answers.ssePort = await number({
-                    message: 'SSE port:',
-                    default: 3002,
-                    min: 1,
-                    max: 65535,
-                });
-            }
-        }
-        // 5. Browser
-        answers.browser = await select({
-            message: 'Select browser for OAuth2 login:',
-            choices: [
-                { name: 'system (default browser)', value: 'system' },
-                { name: 'chrome', value: 'chrome' },
-                { name: 'edge', value: 'edge' },
-                { name: 'firefox', value: 'firefox' },
-                { name: 'headless', value: 'headless' },
-                { name: 'none (disable)', value: 'none' },
-            ],
-        });
-        // 6. OAuth2 callback port
-        answers.browserAuthPort = await number({
-            message: 'OAuth2 callback port:',
-            default: 3333,
-        });
-        // 7. Unsafe mode
-        answers.unsafe = await confirm({
-            message: 'Unsafe mode (persist tokens to disk)?',
-            default: false,
-        });
-        // 8. Log level
-        answers.logLevel = await select({
-            message: 'Log level:',
-            choices: [
-                { name: 'debug', value: 'debug' },
-                { name: 'info', value: 'info' },
-                { name: 'warn', value: 'warn' },
-                { name: 'error', value: 'error' },
-            ],
-            default: 'info',
-        });
-        // 9. Advanced settings
-        const configureAdvanced = await confirm({
-            message: 'Configure advanced settings?',
-            default: false,
-        });
-        if (configureAdvanced) {
-            answers.maxRetries = await number({
-                message: 'Max retries:',
-                default: DEFAULTS.maxRetries,
-            });
-            answers.retryDelay = await number({
-                message: 'Retry delay (ms):',
-                default: DEFAULTS.retryDelay,
-            });
-            answers.requestTimeout = await number({
-                message: 'Request timeout (ms):',
-                default: DEFAULTS.requestTimeout,
-            });
-            answers.circuitBreakerThreshold = await number({
-                message: 'Circuit breaker threshold:',
-                default: DEFAULTS.circuitBreakerThreshold,
-            });
-            answers.circuitBreakerTimeout = await number({
-                message: 'Circuit breaker timeout (ms):',
-                default: DEFAULTS.circuitBreakerTimeout,
-            });
-            const setCloudUrl = await confirm({
-                message: 'Set Cloud LLM Hub URL?',
-                default: false,
-            });
-            if (setCloudUrl) {
-                answers.cloudLlmHubUrl = await input({
-                    message: 'Cloud LLM Hub URL:',
-                    required: true,
-                });
-            }
-        }
-        // 10. Output file
-        const outputPath = await input({
-            message: 'Output file path:',
-            default: './mcp-proxy-config.yaml',
-        });
-        // Generate and write config
-        const fullAnswers = answers;
-        const yaml = generateConfigYaml(fullAnswers);
-        fs.writeFileSync(outputPath, yaml, 'utf-8');
-        console.log(`\nConfig saved to: ${outputPath}`);
-        console.log(`Run with: mcp-abap-adt-proxy --config ${outputPath}`);
-        return fullAnswers;
-    }
-    catch (error) {
-        if (error instanceof Error && error.name === 'ExitPromptError') {
-            process.exit(0);
-        }
-        throw error;
-    }
-}