@sap/cds-dk 10.0.7 → 10.1.0

package/lib/mtx/auth_manager.js

@@ -1,5 +1,5 @@
 const cds = require('../cds');
-const { SettingsManager } = require('./settings_manager');
+const { SettingsManager, OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN } = require('./settings_manager');
 const { ParamCollection } = require('./params');
 const { getMessage } = require('./util/logging');
 const { buildResponseError, buildNetworkError, parseResponseBody } = require('./util/request');
@@ -39,28 +39,107 @@ function reqParams(method, params) {
     const url = params.get('tokenUrl');
     const d = {};
     const ignored = {};
-    if (params.has('subdomain')) {
-        d.subdomain = params.get('subdomain');
-    }
-    if (params.has('refreshToken')) {
-        d.refresh_token = params.get('refreshToken');
-        const param = ['passcode', 'clientid'].find(param => params.has(param));
-        if (param) {
-            ignored[param] = 'refresh token is present';
+    const headers = { 'content-type': 'application/x-www-form-urlencoded' };
+    const tls = {};
+    if (params.get('directUaa')) {
+        d.grant_type = 'client_credentials';
+        d.client_id = params.get('clientid');
+        if (params.has('key')) {
+            tls.cert = params.get('certificate');
+            tls.key = params.get('key');
+        } else {
+            const encoded = Buffer.from(`${params.get('clientid')}:${params.get('clientsecret')}`).toString('base64');
+            headers.Authorization = `Basic ${encoded}`;
+        }
+    } else {
+        if (params.has('subdomain')) {
+            d.subdomain = params.get('subdomain');
+        }
+        if (params.has('refreshToken')) {
+            d.refresh_token = params.get('refreshToken');
+            const param = ['passcode', 'clientid'].find(param => params.has(param));
+            if (param) {
+                ignored[param] = 'refresh token is present';
+            }
+        } else if (params.has('passcode')) {
+            d.passcode = params.get('passcode');
+        } else if (params.has('clientsecret')) {
+            d.clientid = params.get('clientid');
+            d.clientsecret = params.get('clientsecret');
         }
-    } else if (params.has('passcode')) {
-        d.passcode = params.get('passcode');
-    } else if (params.has('clientsecret')) {
-        d.clientid = params.get('clientid');
-        d.clientsecret = params.get('clientsecret');
-    } else if (params.has('key')) {
-        d.clientid = params.get('clientid');
-        d.key = params.get('key');
     }
     const data = new URLSearchParams(d).toString();
-    return method === 'post'
-        ? { url, data, ignored }
-        : { url: `${url}?${data}`, data: undefined, ignored };
+    const req = method === 'post'
+        ? { url, data, method, headers, ...tls }
+        : { url: `${url}?${data}`, data: undefined, method, headers, ...tls };
+    return { req, ignored };
+}
+
+function toResponse(res, body) {
+    const status = res.statusCode;
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        statusText: res.statusMessage ?? '',
+        headers: { get: name => res.headers[name.toLowerCase()] },
+        json: async () => JSON.parse(body),
+        text: async () => body
+    };
+}
+
+function postTokenViaMtls(url, data, headers, { cert, key }) {
+    const https = require('node:https');
+    const u = new URL(url);
+    return new Promise((resolve, reject) => {
+        const request = https.request({
+            hostname: u.hostname,
+            port: u.port || 443,
+            path: `${u.pathname}${u.search}`,
+            method: 'POST',
+            headers,
+            cert,
+            key
+        }, res => {
+            let body = '';
+            res.setEncoding('utf8');
+            res.on('data', chunk => { body += chunk; });
+            res.on('end', () => resolve(toResponse(res, body)));
+        });
+        request.on('error', reject);
+        if (data) {
+            request.write(data);
+        }
+        request.end();
+    });
+}
+
+async function postTokenTo(req, params) {
+    const { url, data, method, headers, cert, key } = req;
+    DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
+    const response = cert
+        ? await postTokenViaMtls(url, data, headers, { cert, key })
+        : await fetch(url, {
+            method: method.toUpperCase(),
+            body: data,
+            headers
+        });
+    if (!response.ok) {
+        throw await buildResponseError(method, url, response);
+    }
+    return parseResponseBody(response);
+}
+
+async function postToken(req, params) {
+    try {
+        return await postTokenTo(req, params);
+    } catch (e) {
+        if (e.status !== 404 || !req.url.includes(OAUTH_PATH)) {
+            throw e;
+        }
+        req.url = req.url.replace(OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN);
+        DEBUG?.(`Token endpoint not found, retrying against legacy path ${params.obfuscateQueryParams(req.url)}`);
+        return postTokenTo(req, params);
+    }
 }
 
 async function fetchToken(params) {
@@ -71,29 +150,16 @@ async function fetchToken(params) {
     let responseData, error;
     const method = 'post';
     do {
-        const { url, data, ignored } = reqParams(method, params);
+        const { req, ignored } = reqParams(method, params);
         if (Object.keys(ignored).length) {
             console.log(`Ignoring parameters for fetching token: ${Object.entries(ignored).map(([param, reason]) => `${param} (${reason})`).join(', ')}.`);
         }
-        DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
         error = undefined;
         try {
-            const response = await fetch(url, {
-                method: method.toUpperCase(),
-                body: data,
-                headers: { 'content-type': 'application/x-www-form-urlencoded' }
-            });
-            if (!response.ok) {
-                throw await buildResponseError(method, url, response);
-            }
-            responseData = await parseResponseBody(response);
+            responseData = await postToken(req, params);
             break;
         } catch (e) {
-            if (e.status) {
-                error = e;
-            } else {
-                error = buildNetworkError(method, url, e);
-            }
+            error = e.status ? e : buildNetworkError(method, req.url, e);
             DEBUG?.(`HTTP status ${error.status}`);
             if (params.has('refreshToken')) {
                 DEBUG?.('Discarding invalid refresh token');
@@ -122,7 +188,7 @@ async function fetchToken(params) {
                 message += `. Ensure the client credentials are correct`;
             }
         } else {
-            message = 'error on token request';
+            message = 'token request failed';
         }
         throw new Error(message + '.', { cause: error });
     }

package/lib/mtx/params.js

@@ -178,7 +178,8 @@ class BasicParams {
         this.password               = new Param('password',               undefined, { obfuscate: ObfuscationLevel.full });
         this.clientid               = new Param('clientid',               undefined);
         this.clientsecret           = new Param('clientsecret',           undefined, { obfuscate: ObfuscationLevel.partial });
-        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of client certificate
+        this.certificate            = new Param('certificate',            undefined, { obfuscate: ObfuscationLevel.partial }); // client certificate for mTLS
+        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of the client certificate
         this.tokenStorage           = new Param('tokenStorage',           undefined, { allowedValues: ['plain', 'keyring'] });
         this.clearOtherTokenStorage = new Param('clearOtherTokenStorage', false, { internal: true });
         this.plain                  = new Param('plain',                  false, { internal: true }); // for backward compatibility - superseded by tokenStorage
@@ -195,7 +196,6 @@ class BasicParams {
     }
 }
 
-// TODO pass these as extra arguments to lib functions
 /**
  * All known params including those needed for specific commands.
  */
@@ -216,6 +216,7 @@ class AllParams extends BasicParams {
 
         // `login` PARAMS
         this.skipToken              = new Param('skipToken',              false, { internal: true });
+        this.directUaa              = new Param('directUaa',              false, { internal: true }); // client-credentials login goes directly to the authorization server
         this.saveRefreshToken       = new Param('saveRefreshToken',       false, { internal: true });
 
         // `logout` PARAMS

package/lib/mtx/settings_manager.js

@@ -34,9 +34,10 @@ const KEYRING_DESC = {
 };
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
-const OAUTH_PATH_LEGACY = '/mtx/v1/oauth/token';
-const OAUTH_PATH = '/-/cds/login/token';
-const OAUTH_META_PATH = '/-/cds/login/authorization-metadata';
+const OAUTH_PATH_LEGACY_TOKEN = '/-/cds/login/token';
+const OAUTH_PATH = '/-/cds/login/grant';
+const OAUTH_META_PATH = '/-/cds/login/grant-metadata';
+const OAUTH_UAA_PATH = '/oauth/token';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -102,12 +103,40 @@ async function getTokenUrl(params, renewUrl) {
     if (!params.has('appUrl')) {
         throw 'Failed to determine token URL: app URL not given';
     }
+    if (params.has('clientid')) {
+        return deriveUaaTokenUrl(params);
+    }
     return appUrlWith(OAUTH_PATH, params);
 }
 
-async function fetchPasscodeUrl(params) {
+function uaaTokenUrl(passcodeUrl, { mtls } = {}) {
+    const url = new URL(passcodeUrl);
+    url.pathname = url.pathname.replace(/\/passcode\/*$/, '').replace(/\/+$/, '') + OAUTH_UAA_PATH;
+    url.search = '';
+    if (mtls) {
+        url.hostname = url.hostname.replace(/\.authentication\./, '.authentication.cert.');
+    }
+    return url.toString();
+}
+
+async function deriveUaaTokenUrl(params) {
+    const mtls = params.has('key');
+    const metadata = await fetchAuthMetadata(params);
+    const announced = mtls ? metadata?.cert_token_url : metadata?.token_url;
+    const passcodeUrl = metadata?.passcode_url;
+    const tokenUrl = announced ?? (passcodeUrl && uaaTokenUrl(passcodeUrl, { mtls }));
+    if (!tokenUrl) {
+        throw 'Cannot determine the authorization server for client-credentials login. ' +
+            'Ensure MTX is running with extensibility enabled and up to date.';
+    }
+    params.set('directUaa', true);
+    DEBUG?.(`Derived authorization-server token URL for ${mtls ? 'mTLS' : 'client-credentials'} login: ${tokenUrl}`);
+    return tokenUrl;
+}
+
+async function fetchAuthMetadata(params) {
     let fetchUrl = appUrlWith(OAUTH_META_PATH, params);
-    DEBUG?.(`Trying to get passcode URL from GET`, fetchUrl);
+    DEBUG?.(`Trying to get authorization metadata from GET`, fetchUrl);
     if (params.has('subdomain')) {
         const u = new URL(fetchUrl);
         u.searchParams.set('subdomain', params.get('subdomain'));
@@ -124,10 +153,10 @@ async function fetchPasscodeUrl(params) {
         if (error.status === 404) {
             DEBUG?.(`Request unsupported by server, ignoring (${error.message.replace(/ *Details:.*/s, '')})`);
         } else if (error.status) {
-            DEBUG?.(getMessage(`Getting passcode URL failed`, { error }));
+            DEBUG?.(getMessage(`Getting authorization metadata failed`, { error }));
         } else {
             const netError = buildNetworkError('GET', fetchUrl, error);
-            DEBUG?.(getMessage(`Getting passcode URL failed`, { error: netError }));
+            DEBUG?.(getMessage(`Getting authorization metadata failed`, { error: netError }));
         }
         return undefined;
     }
@@ -139,7 +168,7 @@ async function fetchPasscodeUrl(params) {
         DEBUG?.(`Unsupported signed metadata received. Since these should take precedence, ignoring response.`);
         return undefined;
     }
-    return responseData.passcode_url;
+    return responseData;
 }
 
 function getKeyringAccountName(params) {
@@ -289,8 +318,9 @@ class SettingsManager {
         }
         async function updateTokenUrl() {
             const tokenUrl = secure(params.get('tokenUrl'), 'token URL');
+            const machineLogin = params.has('clientid');
             const renewUrl = !logout && !params.get('skipToken')
-                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_LEGACY)
+                && (machineLogin || !tokenUrl || tokenUrl.includes('//-/cds') || !tokenUrl.includes(OAUTH_PATH)
                     || params.get('appUrl') !== loadedSettings.get('appUrl')
                     || params.get('subdomain') !== loadedSettings.get('subdomain'));
             if (renewUrl) {
@@ -303,7 +333,6 @@ class SettingsManager {
                 }
             }
         }
-
         await updateAppUrl();
         await updateTokenUrl();
     }
@@ -353,16 +382,9 @@ class SettingsManager {
                 throw 'Clientsecret cannot be empty';
             }
         }
-        async function addKey() {
-            params.set('key', await Question.askQuestion('key: ', undefined, true));
-            console.log();
-            if (params.get('key') === '') {
-                throw 'Key cannot be empty';
-            }
-        }
         async function addPasscode() {
             if (!params.has('passcodeUrl')) {
-                const passcodeUrl = await fetchPasscodeUrl(params);
+                const passcodeUrl = (await fetchAuthMetadata(params))?.passcode_url;
                 if (passcodeUrl) {
                     params.set('passcodeUrl', passcodeUrl);
                 }
@@ -440,15 +462,8 @@ class SettingsManager {
             return;
         }
 
-        if (params.get('clientid') && !logout) {
-            if (params.has('key')) {
-                if (params.get('key') === 'ask') {
-                    params.delete('key');
-                    await addKey();
-                }
-            } else if (!params.has('clientsecret')) {
-                await addClientSecret();
-            }
+        if (params.get('clientid') && !logout && !params.has('clientsecret') && !params.has('key')) {
+            await addClientSecret();
         }
 
         await addAuthSettings();
@@ -714,5 +729,7 @@ class SettingsManager {
 module.exports = {
     SettingsManager,
     other,
-    notifyLogin
+    notifyLogin,
+    OAUTH_PATH,
+    OAUTH_PATH_LEGACY_TOKEN
 };

package/lib/mtx/tenant_action.js

@@ -20,7 +20,6 @@ const DEFAULT_LOCALHOST_PASSWORD = '';
 
 module.exports = class TenantAction {
 
-    // TODO JSDoc
     /**
      * @param command {string} the command to execute: 'subscribe', 'upgrade' or 'unsubscribe'
      */

package/lib/mtx/util/credentials.js

@@ -0,0 +1,62 @@
+const CLIENT_ID_ENV = 'CDS_LOGIN_CLIENT_ID';
+const CLIENT_SECRET_ENV = 'CDS_LOGIN_CLIENT_SECRET';
+const CLIENT_CERT_ENV = 'CDS_LOGIN_CLIENT_CERT';
+const CLIENT_KEY_ENV = 'CDS_LOGIN_CLIENT_KEY';
+
+function clientId(inlineId) {
+    const clientid = inlineId ?? process.env[CLIENT_ID_ENV];
+    if (!clientid) {
+        throw `Client ID required: pass it as --client <id> or via the ${CLIENT_ID_ENV} environment variable.`;
+    }
+    return clientid;
+}
+
+function splitFirst(value, separator) {
+    const i = value.indexOf(separator);
+    return i === -1 ? [value, undefined] : [value.slice(0, i), value.slice(i + separator.length)];
+}
+
+/**
+ * Resolve `--client` credentials, each part falling back to the environment
+ * (`CDS_LOGIN_CLIENT_ID`/`CDS_LOGIN_CLIENT_SECRET`). Splits on the first colon only;
+ * an empty client ID (`:secret`) is rejected.
+ * @returns {{ clientid?: string, clientsecret?: string }}
+ */
+function clientCredentials(clientOption) {
+    if (!clientOption) {
+        return {};
+    }
+    const [id, secret] = typeof clientOption === 'string' ? splitFirst(clientOption, ':') : [];
+    return { clientid: clientId(id), clientsecret: secret ?? process.env[CLIENT_SECRET_ENV] };
+}
+
+/**
+ * Resolve `--mtls` credentials: client ID inline or from `CDS_LOGIN_CLIENT_ID`,
+ * certificate and key only from `CDS_LOGIN_CLIENT_CERT`/`CDS_LOGIN_CLIENT_KEY`.
+ * An inline `:key` is rejected.
+ * @returns {{ clientid?: string, certificate?: string, key?: string }}
+ */
+function clientCertificate(mtlsOption) {
+    if (!mtlsOption) {
+        return {};
+    }
+    if (typeof mtlsOption === 'string' && mtlsOption.includes(':')) {
+        throw `The client key cannot be passed on the command line. Pass only the client ID as --mtls <id>, and provide the certificate and key via the ${CLIENT_CERT_ENV} and ${CLIENT_KEY_ENV} environment variables.`;
+    }
+    const id = typeof mtlsOption === 'string' ? mtlsOption : undefined;
+    const certificate = process.env[CLIENT_CERT_ENV];
+    const key = process.env[CLIENT_KEY_ENV];
+    if (!certificate || !key) {
+        throw `Client certificate and key required: set the ${CLIENT_CERT_ENV} and ${CLIENT_KEY_ENV} environment variables.`;
+    }
+    return { clientid: clientId(id), certificate, key };
+}
+
+module.exports = {
+    clientCredentials,
+    clientCertificate,
+    CLIENT_ID_ENV,
+    CLIENT_SECRET_ENV,
+    CLIENT_CERT_ENV,
+    CLIENT_KEY_ENV
+};

package/node_modules/@sap/cds/CHANGELOG.md

@@ -4,6 +4,49 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 10.1.0 - 2026-09-02
+
+### Added
+
+- New `sqlite:memory` preset for `cds.requires.db` runs an in-memory SQLite database, now also in production
+- New `hana-serverless` kind for `cds.requires.db` connects to a HANA Cloud serverless instance (Beta)
+- Node.js-native `fetch` client now resolves named destinations through the SAP BTP Destination service for `NoAuthentication`, `BasicAuthentication`, and `OAuth2ClientCredentials` (proxy type `Internet` only) (beta)
+
+### Changed
+
+- `cds.spawn` uses dedicated, short-lived transaction for fetching extended models
+- Messaging webhook endpoints are no longer registered anonymously in production when neither `cds.requires.auth` nor `cds.requires.messaging.xsuaa` is configured.
+- UCL tenant mapping notification handlers will be scheduled as `tenant: receiverTenant` instead of anonymously
+
+### Fixed
+
+- `@assert` messages using `{i18n>...}` placeholders are no longer mistaken for structured `error(...)` results
+- JSON `$batch` requests now reject invalid `atomicityGroup` identifiers
+- Scheduling a task via `srv.schedule(...).after(<delay>)` or `.every(<interval>)` with a delay above Node's 32-bit `setTimeout` limit (~24.8 days, e.g. `.after('30d')`) no longer emits a `TimeoutOverflowWarning` or fires almost immediately. Such delays are now armed as chained timers, so the task still fires at its exact scheduled time.
+- OData requests with unknown key names in the key predicate (e.g. `Books(ID=1,sad=2)`) are now rejected with `400 Bad Request` instead of causing a `500` error
+- `cds-rc.js` schema now has a `$id` so `jsonschema` 1.5 resolves internal `$ref`s correctly
+- REST `HEAD` responses now report byte-accurate `Content-Length` headers for Unicode JSON payloads
+- Query properties like `limit` and `recurse` are no longer lost when forwarded to remote services
+- `cds.requires.<name>.service = <name>` (a required service naming itself) no longer fails with a spurious `conflicts with` error on server start
+- `UPDATE` and `DELETE` remote-service-queries, that use `.where` instead of a key to specify their subject, will throw
+- Navigating to or creating under a parent protected by an instance-based `@restrict.where` now returns `404` when the parent is not readable
+- A static `@restrict.where` on a collection-bound action is now enforced, rejecting callers who do not satisfy the condition — previously it was silently ignored
+
+### Removed
+
+- UCL GraphQL interface adapter as dead code after UCL deprecated the GraphQL on-boarding flow
+
+## Version 10.0.6 - 2026-08-18
+
+### Fixed
+
+- `$apply=filter(...)/groupby(...)/aggregate($count)` with non-UTC `DateTimeOffset` filter values now returns correct results on HANA
+- Generated index page now uses relative hrefs, fixing links when served behind an approuter with a path prefix
+- `$batch` sub-requests returned an empty body and headers when `@opentelemetry/instrumentation-express` (or any instrumentation that wraps Express handlers to arity 2) was active
+- `cds.xt.ModelProviderService` can be served in mtx sidecar
+- Modeled service events were not properly ignored in OData adapter
+- Generic handler for draft-specific actions not correctly being bound to the transaction context
+
 ## Version 10.0.5 - 2026-07-28
 
 ### Fixed
@@ -143,6 +186,20 @@
 - Internal `_initial` phase
 - Removed support for `async activate()` functions returned from `cds-plugin.js` modules, which was never documented, and deprecated since Oct 2023. If you need to run async code during plugin loading, just return a promise as default export.
 
+## Version 9.9.3 - 2026-07-21
+
+### Fixed
+
+- Fixed context propagation for local app and remote service calls
+
+## Version 9.9.2 - 2026-06-29
+
+### Fixed
+
+- `srv.model` propagation in extensibility scenarios
+- Restored `err.target:'in'` during draft activation with `cds.fiori.draft_messages=false` to avoid the `MULTIPLE_ERRORS` popup
+- `resolveView` prioritizes the original foreign key `parent_ID` if exposed multiple times, e.g., through `*, parent.ID as parentId`
+
 ## Version 9.9.1 - 2026-04-29
 
 ### Fixed

package/node_modules/@sap/cds/app/index.js

@@ -2,7 +2,8 @@ const cds = require('../lib')
 const { find, path, fs } = cds.utils
 
 const odata = endpoint => endpoint.kind.startsWith('odata')
-const metadata = endpoint => odata(endpoint) ? `<span>/</span> <a href="${endpoint.path}/$metadata"><span>$metadata</span></a>` : ``
+const rel = path => path.replace(/^\//, '')
+const metadata = endpoint => odata(endpoint) ? `<span>/</span> <a href="${rel(endpoint.path)}/$metadata"><span>$metadata</span></a>` : ``
 const asHtmlId = s => s.replace(/[.:/$&?@]/g, '_').toLowerCase()
 
 module.exports = { get html(){
@@ -22,12 +23,12 @@ module.exports = { get html(){
   .map (({srv, endpoint}) => `
       <div id="${asHtmlId(srv.name)}-${endpoint.kind}">
         <h3 class="header">
-          <a href="${endpoint.path}"><span>${endpoint.path}</span></a>${metadata(endpoint)} ${_moreLinks(srv, endpoint, undefined, false)}
+          <a href="${rel(endpoint.path)}"><span>${endpoint.path}</span></a>${metadata(endpoint)} ${_moreLinks(srv, endpoint, undefined, false)}
         </h3>
         <ul>${_entities_in(srv).map (e => `
           <li id="${asHtmlId(srv.name)}-${endpoint.kind}-${asHtmlId(e)}">
             <div>
-              <a href="${endpoint.path}/${e.replace(/\./g, '_')}"><span>${e}</span></a>
+              <a href="${rel(endpoint.path)}/${e.replace(/\./g, '_')}"><span>${e}</span></a>
             </div>
             ${_moreLinks(srv, endpoint, e)}
           </li>`).join('')}
@@ -35,7 +36,7 @@ module.exports = { get html(){
         <ul>${_operations_in(srv).map (e => `
           <li id="${asHtmlId(srv.name)}-${endpoint.kind}-${asHtmlId(e.name)}" class="operation">
             <div>
-              <a href="${endpoint.path}/${e.name}" title="${endpoint.path}/${e.name}"><span>${e.name} ${e.params}</span></a>
+              <a href="${rel(endpoint.path)}/${e.name}" title="${endpoint.path}/${e.name}"><span>${e.name} ${e.params}</span></a>
             </div>
           </li>`).join('')}
         </ul>

package/node_modules/@sap/cds/eslint.config.mjs

@@ -80,6 +80,7 @@ export const tests = { name: '@cap/eslint/tests',
   languageOptions: {
     globals: {
       mocha: 'readonly',
+      vi: 'readonly',
       jest: 'readonly',
       expect: 'readonly',
       describe: 'writable',

package/node_modules/@sap/cds/lib/compile/minify.js

@@ -17,7 +17,7 @@ class Minifier {
     if (skip_unused === 'services') o.services = 'all'
     const all = new Map (Object.entries( this.defs ??= csn.definitions || {} ))
     const children = (n,fn,pre=n+'.') => { for (let [n,d] of all) if (n.startsWith(pre)) fn (n,d) }
-    const keep = (d,kinds) => d.kind in kinds || _can_minify(d)
+    const _keep = (d,kinds) => d.kind in kinds || d['@cds.minify'] === false
     const _own = o.keep ??= { entity:1, type:1, event:1, action:1, function:1 }
     const _ext = { event:1, action:1, function:1 }
     const kept = this.kept = csn.definitions = {}
@@ -31,16 +31,23 @@ class Minifier {
       }
     } else {
       // Otherwise first mark all external services and their children as initially skipped
-      for (let [s,d] of all) if (d.kind === 'service' && _skip_service(s,d)) {
-        skipped[s] = 0; children (s, (c,d) => keep(d,_ext) ? this.keep(c,d,s) : skipped[c] = s) // used later on in this.keep()
+      for (let [s,d] of all) if (d.kind === 'service' && d['@cds.external'] >= 2) {
+        if (d['@cds.minify'] === false) continue
+        else skipped[s] = 0
+        children (s, (c,d) => _keep(d,_ext) ? this.keep(c,d,s) : skipped[c] = s) // used later on in this.keep()
       }
       // Then keep all own services and their children
-      for (let [s,d] of all) if (d.kind === 'service' && !(s in skipped)) {
-        this.keep(s,d); children (s, (c,d) => keep(d,_own) ? this.keep(c,d) : skipped[c] = 0)
+      for (let [s,d] of all) if (d.kind === 'service') {
+        if (s in skipped) continue
+        else this.keep(s,d)
+        children (s, (c,d) => _keep(d,_own) ? this.keep(c,d) : skipped[c] = 0)
       }
       // Also keep remaining non-service entities
-      for (let [e,d] of all) if (d.kind === 'entity' || !_can_minify(d)) {
-        e in kept || e in skipped || _skip_entity(e,d) || this.keep(e,d)
+      for (let [e,d] of all) if (d.kind === 'entity' || d['@cds.minify'] === false) {
+        if (e in skipped || e in kept) continue //> skip already kept or skipped definitions
+        if (d['@cds.persistence.skip'] === 'if-unused') continue //> skip initially, they are kept by reference if used
+        if (e.endsWith('.texts')) continue //> skip texts entities, they are kept by reference if used
+        else this.keep(e,d)
       }
     }
 
@@ -106,7 +113,4 @@ class Minifier {
 
 }
 
-const _skip_service = (s,d) => (d['@cds.external'] >= 2) && _can_minify(d)
-const _skip_entity = (e,d) => (d['@cds.external'] >= 2 || d['@cds.persistence.skip'] === 'if-unused') && _can_minify(d) || e.endsWith('.texts')
-const _can_minify = d => d['@cds.minify'] !== false
 exports.Minifier = Minifier

package/node_modules/@sap/cds/lib/env/cds-env.js

@@ -524,7 +524,7 @@ function _merge (dst, src, _profiles) {
     }
     else if (v !== undefined) dst[p] = v
   }
-  if (profiled.length > 0 && !_profiles.has('production')) {
+  if (profiled.length > 1 && !_profiles.has('production')) {
     const profiles = Array.from(_profiles)
     profiled.sort((a,b) => profiles.indexOf(b.profile) - profiles.indexOf(a.profile))
   }

package/node_modules/@sap/cds/lib/env/cds-requires.js

@@ -24,7 +24,8 @@ exports = module.exports = {
   _resolved() {
     const requires = { __proto__: this }
     for (let [name,e] of Object.entries(this)) if (e.service) {
-      if (!(e.service in requires) || e.override || e.service !== name) requires[e.service] = { ...e, name }
+      if (e.service === name) continue
+      if (!(e.service in requires) || e.override) requires[e.service] = { ...e, name }
       else throw new Error (`Config 'cds.requires.${name}.service = ${e.service}' conflicts with 'cds.requires.${e.service}'`)
     }
     return requires
@@ -127,9 +128,10 @@ const _db_data = {
 
 const _databases = {
 
-  "db-defaults": { kind: 'sql', ..._db_data }, //> applied only for cds.requires.db: true 
-  
+  "db-defaults": { kind: 'sql', ..._db_data }, //> applied only for cds.requires.db: true
+
   "sql": {
+    // REVISIT: should be '[development]': { kind: 'sqlite:memory' },
     '[development]': { kind: 'sqlite', credentials: { url: ':memory:' } },
     '[production]': { kind: 'hana' },
   },
@@ -138,22 +140,33 @@ const _databases = {
     impl: '@cap-js/sqlite', credentials: { url: 'db.sqlite' },
     ..._db_data,
   },
+  "sqlite:memory": {
+    kind: 'sqlite', credentials: { url: ':memory:' },
+  },
   "hana": {
     impl: '@cap-js/hana',
     ..._db_data,
   },
   "hana-cloud": {
-    kind: 'hana', "deploy-format": "hdbtable",
+    kind: 'hana',
+    "deploy-format": "hdbtable", //> REVISIT: still needed?
+  },
+  "hana-serverless": {
+    kind: 'hana',
+    serverless: true,
+    vcap: { label: 'hana-cloud', plan: 'serverless' },
+    dialect: "hana", //> REVISIT: why needed?
+    "deploy-format": "hdbtable", //> REVISIT: still needed?
   },
+
   "sql-mt": { // For compatibility only
     '[development]': { kind: 'sqlite' },
     '[production]': { kind: 'hana-mt' },
   },
   "hana-mt": { // For compatibility only
-    kind: 'hana', "deploy-format": "hdbtable",
-    "vcap": {
-      "label": "service-manager"
-    }
+    kind: 'hana',
+    "vcap": { "label": "service-manager" },
+    "deploy-format": "hdbtable", //> REVISIT: still needed?
   },
 }
 
@@ -277,12 +290,10 @@ const _messaging = {
 const _platform_services = {
 
   ucl: {
-    model: '@sap/cds/srv/ucl-service.cds',
+    model: '@sap/cds/srv/ucl-service.cds'
     // REVISIT: how to configure such that a cds.connect.to('ucl') returns the already initialized UCLService?
     // service: 'UCLService',
     // impl: `${_runtime}/ucl/Service.js`,
-    // REVISIT: remove default as only needed for push mode
-    vcap: { label: 'xsuaa' }
   },
 
   destinations: {