@sap/cds-dk 10.0.7 → 10.1.1

package/node_modules/@sap/cds-compiler/lib/transform/odata/adaptAnnotationRefs.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { transformAnnotationExpression, implicitAs } = require('../../model/csnUtils');
+const { transformAnnotationExpression, implicitAs, isSimpleAnnoExprRef } = require('../../model/csnUtils');
 
 /**
  * Used during annotating of foreign keys.
@@ -13,10 +13,10 @@ const { transformAnnotationExpression, implicitAs } = require('../../model/csnUt
  * @param {object} messageFunctions
  * @param {CSN.Path} elementPath
  */
-function adaptAnnotationsRefs(generatedForeignKeys, csnUtils, { error }, elementPath) {
+function adaptAnnotationsRefs(generatedForeignKeys, csnUtils, { error }, elementPath, options) {
   if (Array.isArray(generatedForeignKeys?.[0])) {
     // ensure we are always called with an array of objects. TODO: Cleanup fk creation in for.effective to create array of objects
-    adaptAnnotationsRefs(remapToArrayOfObjects(generatedForeignKeys), csnUtils, { error }, elementPath);
+    adaptAnnotationsRefs(remapToArrayOfObjects(generatedForeignKeys), csnUtils, { error }, elementPath, options);
   }
   else {
     const reportedErrorsForAnnoPath = {};
@@ -49,8 +49,14 @@ function adaptAnnotationsRefs(generatedForeignKeys, csnUtils, { error }, element
               if (gfkForRef.length === 1) {
                 ref[0] = gfkForRef[0].prefix;
 
-                if (ctx?.annoExpr?.['='])
-                  ctx.annoExpr['='] = true;
+                if (ctx?.annoExpr?.['=']) {
+                  // TODO: Apply the same fix for OData once the OData behavior is aligned;
+                  //       when done, the `options` parameter can be removed from this function.
+                  if (options?.transformation === 'effective')
+                    ctx.annoExpr['='] = isSimpleAnnoExprRef(ctx.annoExpr) ? ctx.annoExpr.ref.join('.') : true;
+                  else
+                    ctx.annoExpr['='] = true;
+                }
               }
               else {
                 // check if the annotation reference points to a structure that has been expanded,

package/node_modules/@sap/cds-compiler/lib/transform/translateAssocsToJoins.js

@@ -24,6 +24,9 @@ function translateAssocsToJoinsCSN(csn, options) {
   const compileOptions = { ...options, $skipNameCheck: true };
   delete compileOptions.csnFlavor;
 
+  // DO NOT DELETE the `require('fs').writeFileSync(...)` lines in this function!
+  // Uncomment them to see the CSN input and output for A2J
+  // require('fs').writeFileSync('./a2j_in.csn', JSON.stringify(csn,null,2))
   const model = recompileX(csn, compileOptions);
   timetrace.stop('A2J: Recompiling model');
   timetrace.start('A2J: Translating associations to joins');
@@ -49,7 +52,9 @@ function translateAssocsToJoinsCSN(csn, options) {
     deduplicateMessages( options.messages );
   }
 
-  return compactModel(model, compileOptions);
+  const newCsn = compactModel(model, compileOptions);
+  // require('fs').writeFileSync('./a2j_out.csn', JSON.stringify(newCsn,null,2))
+  return newCsn;
 }
 
 function translateAssocsToJoins(model, inputOptions = {}) {
@@ -607,11 +612,10 @@ function translateAssocsToJoins(model, inputOptions = {}) {
           args.push({
             op: { val: '=' },
             args: [ constructPathNode( [ srcAlias, prefixFK(assoc.$elementPrefix, assoc.$flatSrcFKs[i]) ] ),
-              constructPathNode( [ tgtAlias, assoc.$flatTgtFKs[i] ] ) ],
+              constructPathNode( [ tgtAlias, resolveTgtFKToAlias(assoc.$flatTgtFKs[i], tgtAlias) ] ) ],
           });
         }
-        // TODO: why inner "parenthesise" - comparison in `and`?
-        return parenthesise((args.length > 1 ? { op: { val: 'and' }, args: [ ...args.map(parenthesise) ] } : args[0] ));
+        return parenthesise((args.length > 1 ? { op: { val: 'and' }, args } : args[0] ));
       }
       else if (assoc.on) {
         if (env.assocStack === undefined) {
@@ -707,7 +711,7 @@ function translateAssocsToJoins(model, inputOptions = {}) {
 
       function cloneOnCondExprStream(expr) {
         const { args } = expr;
-        const result = { op: { val: expr.op.val }, args: [ ] };
+        const result = { op: { val: expr.op.val }, args: [ ], $parens: expr.$parens };
         for (let i = 0; i < args.length; i++) {
           const op = args[i].op?.val;
           if (op === 'xpr' || op === 'ixpr' || op === 'nary') {
@@ -727,7 +731,7 @@ function translateAssocsToJoins(model, inputOptions = {}) {
                 args[i + 2].$check = false;
               }
               else {
-                result.args.push(createOnCondition(fwdAssoc, ...swapTableAliasesForFwdAssoc(fwdAssoc, srcAlias, tgtAlias)));
+                result.args.push(createOnCondition(backlinkOf(assoc, fwdAssoc), ...swapTableAliasesForFwdAssoc(fwdAssoc, srcAlias, tgtAlias)));
               }
               i += 2; // skip next two tokens and continue with loop
               continue;
@@ -764,7 +768,7 @@ function translateAssocsToJoins(model, inputOptions = {}) {
             return expr;
           }
 
-          return createOnCondition(fwdAssoc, ...swapTableAliasesForFwdAssoc(fwdAssoc, srcAlias, tgtAlias));
+          return createOnCondition(backlinkOf(assoc, fwdAssoc), ...swapTableAliasesForFwdAssoc(fwdAssoc, srcAlias, tgtAlias));
         }
 
         // If this is an ordinary expression, clone it and mangle its arguments
@@ -804,7 +808,19 @@ function translateAssocsToJoins(model, inputOptions = {}) {
         const assocSource = assoc._main;
         if (assoc.kind === 'mixin' && (i > 0 || fwdTarget !== assocSource) && fwdOrigin.kind !== 'mixin') {
           const tas = Object.values(env.lead.$tableAliases);
-          const j = tas.findIndex(ta => ta._artifact === fwdOrigin.target._artifact);
+          // The backlink association's target may be reached through a view
+          // over it, whose alias is not the target artifact itself; fall back
+          // to the alias whose `_origin` chain reaches the target.
+          let j = tas.findIndex(ta => ta._artifact === fwdOrigin.target._artifact);
+          if (j < 0) {
+            j = tas.findIndex((ta) => {
+              for (let a = ta._artifact; a; a = a._origin) {
+                if (a === fwdOrigin.target._artifact)
+                  return true;
+              }
+              return false;
+            });
+          }
           if (j >= 0 && tas[j].$QA) {
             newTgtAlias.id = tas[j].$QA.name.id;
             newTgtAlias._artifact = tas[j]._effectiveType;
@@ -1050,6 +1066,28 @@ function translateAssocsToJoins(model, inputOptions = {}) {
         }
         return undefined;
       }
+
+      // Build the backlink ON from the renaming-aware `$backlink` rather than the
+      // forward assoc's base-entity keys/on, if it is available.
+      function backlinkOf( backlinkAssoc, fwdAssoc ) {
+        const backlink = backlinkAssoc.$backlink;
+        return backlink && (backlink.foreignKeys || backlink.on) ? backlink : fwdAssoc;
+      }
+
+      // Resolve the target foreign key to the alias of the target table.
+      // If the target foreign key is not found in the scope of the target alias,
+      // try to find it in the origin chain of the foreign key artifact.
+      function resolveTgtFKToAlias( fk, tgtAlias ) {
+        const env = tgtAlias && (tgtAlias._effectiveType || tgtAlias._artifact);
+        const scope = env && env.elements;
+        if (!scope || !fk || scope[fk.id] || !fk._artifact || !fk._artifact._origin)
+          return fk;
+        for (let o = fk._artifact._origin; o; o = o._origin) {
+          if (o.name && scope[o.name.id])
+            return { id: o.name.id, _artifact: fk._artifact, acc: fk.acc };
+        }
+        return fk;
+      }
     } // createOnCondition
   } // createJoinQA
 
@@ -1706,9 +1744,9 @@ function translateAssocsToJoins(model, inputOptions = {}) {
     return newObj;
   }
 
+  // to-csn now auto-wraps AND args that are OR-terms (see json/to-csn.js `case 'and'`),
+  // so A2J no longer needs to pre-wrap sub-expressions to preserve SQL precedence.
   function parenthesise(expr) {
-    if (typeof expr === 'object' && expr.op && expr.args)
-      setProp(expr, '$parens', [ expr.$location ]);
     return expr;
   }
 }

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.0.3",
+  "version": "7.1.1",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/@sap/cds-mtxs/CHANGELOG.md

@@ -6,6 +6,55 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 4.1.0 - 2026-09-04
+
+### Added
+
+- Beta: Multitenant provisioning now supports HANA Cloud serverless, resolving one HDI container per tenant through the serverless Tenant API.
+- Beta: The MTX job service can now use native javascript workers to make the MTX sidecar more responsive while jobs (e. g. tenant upgrade) are running.
+Native workers can be enabled by `nativeWorkers` in the jobs configuration, e. g.
+  ```jsonc
+  "cds.xt.SaasProvisioningService":  {
+        "jobs": {
+          "nativeWorkers": true,
+          "workerSize": 3,
+          "clusterSize": 3
+        }
+      },
+  ```
+  - With configuration `cds.requires['cds.xt.SaasProvisioning'].upgrade.skipAlreadyUpgraded: true` or `cds.requires['cds.xt.SmsProvisioning'].upgrade.skipAlreadyUpgraded: true`,
+already upgraded tenants are skipped when running an upgrade of all tenants (`tenants: ['*']`). Tenants are considered as already upgraded if the last upgrade was run after the
+last deployment of the application.
+
+### Fixed
+
+- `SmsProvisioningService` certificate check is now better aligned with the Java implementation.
+- Extension validation checks have been refined.
+- `POST /-/cds/model-provider/getEdmx` now checks the requested service name more exactly.
+- Callback url for Saas Registry and Subscription Manager is now determined in a more robust way.
+
+## Version 4.0.4 - 2026-08-21
+
+### Fixed
+
+- Version bump
+
+## Version 4.0.3 - 2026-08-21
+
+### Added
+
+- `cds-mtx subscribe`, `unsubscribe`, and `upgrade` now take more than one tenant at once, e.g. `cds-mtx upgrade t1 t2` or `cds-mtx upgrade t1,t2`.
+
+### Changed
+
+- Login endpoints renamed to `/-/cds/login/grant` and `/-/cds/login/grant-metadata` with redirects from former paths.
+
+### Fixed
+
+- HANA credential health-check now detects the available driver via `require.resolve()` instead of reading `package.json`, fixing `MODULE_NOT_FOUND` for apps that follow the "Plug & Play" guidance and don't declare `hdb` or `@sap/hana-client` directly.
+- Tenant upgrade now reports a clear per-tenant `422` error when a stored extension is incompatible with the changed base model, instead of aborting with an uncaught compilation error.
+- `cds-mtx-migrate` now runs more robust with uncommon model configurations.
+
 ## Version 4.0.2 - 2026-08-07
 
 ### Fixed

package/node_modules/@sap/cds-mtxs/bin/cds-mtx-migrate.js

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 /* eslint-disable no-console */
 
+const cds = require('@sap/cds')
+const { _import, isfile, local, path } = cds.utils
+
 async function run(param, options) {
     const { dry, genTenantList, syncTenantList, cleanup, directory, tag, tagRule } = options
     const skipVerification = options['skip-verification'] || options.skipVerification
@@ -26,7 +29,6 @@ async function run(param, options) {
         _handleError(`The migration from @sap/cds-mtx to @sap/cds-mtxs has been removed. Only --init-tenant-list and --sync-tenant-list are still supported.`)
     }
 
-    const cds = require('@sap/cds')
     const { syncTenantList: synchronizeTenantList, _hasMtEnv } = require('../lib/migration/migration')
 
     async function cds_mtx_migrate(tenants, options) {
@@ -45,11 +47,20 @@ async function run(param, options) {
             services.push('@sap/cds-mtxs/srv/extensibility-service')
         }
 
-        await cds.connect.to('db')
-        await cds.serve(services)
-        cds.env.requires.multitenancy = cds.env.requires.multitenancy || true // needed for current sidecar config that only enables services
+        await _local_server_js()
+        cds.emit ('bootstrap')
+        const model = await cds.load([...services, '@sap/cds-mtxs/db/extensions'])
+        cds.model = cds.compile.for.nodejs(model)
+        const d = 'cds.xt.DeploymentService'
+        const unserved = !cds.services[d]
+        if (unserved) {
+            await cds.serve(services)
+        }
+        await cds.plugins
+
+        await cds.emit('served', cds.services)
 
-        await cds.emit('served')
+        cds.env.requires.multitenancy ??= true // needed for current sidecar config that only enables services
 
         if (genTenantList) {
             const tenantListResult = await synchronizeTenantList(tenantList, options)
@@ -73,6 +84,16 @@ async function run(param, options) {
     await cds_mtx_migrate(param, options).catch(console.error)
 }
 
+// copied from cds.serve
+async function _local_server_js() {
+    const _local = file => isfile(file) || isfile (path.join(cds.env.folders.srv,file))
+    const cli_js = process.env.CDS_TYPESCRIPT && _local('cli.ts') || _local('cli.js')
+    if (cli_js) {
+      console.log ('[cds] - loading server from', { file: local(cli_js) })
+      await _import(cli_js)
+    }
+  }
+
 function getParameterValue(options, parameter) {
    const index = options.indexOf(parameter)
    const value = (index > -1) ? options[index + 1] : undefined

package/node_modules/@sap/cds-mtxs/bin/cds-mtx.js

@@ -10,15 +10,16 @@ const SUPPORTED = ['subscribe', 'unsubscribe', 'upgrade']
 // This function must only be changed in a backward compatible way. It is used by DwC.
 async function cds_mtx(cmd, tenant, body) {
 
-    let connectedTenants = [tenant]
+    const tenants = (Array.isArray(tenant) ? tenant : [tenant]).flatMap(t => t.split(','))
+    const one = tenants.length === 1 ? tenants[0] : undefined
+
+    let connectedTenants = []
 
     try {
         if (!cmd) return _usage()
         if (!SUPPORTED.includes(cmd)) return _usage(`Unknown command ${cmd}.`)
         if (!_hasMtEnv()) return _handleError(`cds-mtx ${cmd} operation can only be run inside a multitenant application environment using @sap/cds-mtxs.`)
-        if (!tenant) return _handleError(`Please provide a tenant: cds-mtx ${cmd} <tenant>`)
-        if (/.*,.*/.test(tenant)) return _handleError(`List of tenants not supported: ${tenant}`)
-        // parse body and handle error
+        if (!tenants.length) return _handleError(`Please provide a tenant: cds-mtx ${cmd} <tenant>`)
         let parsedMetadata
         if (body) {
             try {
@@ -46,18 +47,27 @@ async function cds_mtx(cmd, tenant, body) {
             await cds.connect.to('db')
         }
 
-        if (tenant === '*') {
+        if (tenants.includes('*')) {
             if (cmd !== 'upgrade') return _handleError('"*" only supported for upgrade command')
-            const tenants = await sps.read('tenant')
-            connectedTenants = tenants.map(t => t.subscribedTenantId)
+            if (tenants.length > 1) return _handleError('"*" cannot be combined with other tenants')
+            const all = await sps.read('tenant')
+            connectedTenants = all.map(t => t.subscribedTenantId)
             await sps.tx({ user: new cds.User.Privileged() }, async (tx) => {
-                await tx.upgrade([tenant], parsedMetadata)
+                await tx.upgrade(['*'], parsedMetadata)
             })
             return
-        } else if (tenant === 't0') {
+        } else if (one === 't0') {
             return
         }
-        await ds[cmd](tenant, parsedMetadata, parsedMetadata)
+        connectedTenants = tenants
+
+        if (cmd === 'upgrade') {
+            await sps.tx({ user: new cds.User.Privileged() }, async (tx) => {
+                await tx.upgrade(tenants, parsedMetadata)
+            })
+        } else {
+            for (const t of tenants) await ds[cmd](t, parsedMetadata, parsedMetadata)
+        }
     } catch(e) {
         if (isCli) {
             console.error(e.message)
@@ -68,6 +78,9 @@ async function cds_mtx(cmd, tenant, body) {
             cds.db.disconnect(cds.env.requires.multitenancy.t0 ?? 't0')
             for (const t of connectedTenants) cds.db.disconnect(t)
         }
+        if (isCli) {
+            await cds.exit()
+        }
     }
 }
 
@@ -109,27 +122,35 @@ async function _usage(message = '') {
 USAGE
 
    cds-mtx <command> <tenant> [--body <json>]
+   cds-mtx <command> <tenant1> [<tenant2> ...] [--body <json>]
+   cds-mtx <command> <t1,t2,...> [--body <json>]
 
 COMMANDS
 
-   subscribe   subscribe a tenant
-   unsubscribe unsubscribe a tenant
-   upgrade     upgrade a tenant
+   subscribe   subscribe one or more tenants
+   unsubscribe unsubscribe one or more tenants
+   upgrade     upgrade one or more tenants
 
 EXAMPLES
 
    cds-mtx subscribe t1
+   cds-mtx subscribe t1 t2 t3
    cds-mtx subscribe t1 --body '{ "_": { "hdi": { "create": { "database_id": "<database id>" } } } }'
    cds-mtx unsubscribe t1
    cds-mtx upgrade t1
+   cds-mtx upgrade t1 t2 t3
+   cds-mtx upgrade t1,t2,t3
    cds-mtx upgrade "*"
 `
     )
 }
 
 if (isCli) {
-    const [, , cmd, tenant, option, json] = process.argv
-    if (option && option !== '--body') _usage(`Invalid option ${option}`)
-    ;(async () => await cds_mtx(cmd, tenant, option ? json : undefined))()
+    const [, , cmd, ...rest] = process.argv
+    const bodyIdx = rest.indexOf('--body')
+    const tenants = bodyIdx === -1 ? rest : rest.slice(0, bodyIdx)
+    const body = bodyIdx !== -1 ? rest[bodyIdx + 1] : undefined
+    if (bodyIdx !== -1 && !body) _usage(`Missing value for --body`)
+    ;(async () => await cds_mtx(cmd, tenants, body))()
 }
 module.exports = { cds_mtx }

package/node_modules/@sap/cds-mtxs/lib/utils.js

@@ -89,15 +89,30 @@ const t0_ = async (query) => retry(async () => {
   return cds.tx({ tenant: t0 }, tx => { tx.model = _t0Csn; return tx.run(query) })
 })
 
-async function token(credentials, { query = {}, form = {}, subdomain } = {}) {
+const SUBDOMAIN_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i
+
+function authUrl(baseUrl, subdomain, pathname) {
+  const u = new URL(baseUrl)
+  if (subdomain) {
+    if (typeof subdomain !== 'string' || !SUBDOMAIN_RE.test(subdomain)) {
+      throw cds.error('invalid subdomain', { status: 400 })
+    }
+    const dot = u.hostname.indexOf('.')
+    u.hostname = subdomain + (dot >= 0 ? u.hostname.slice(dot) : '')
+  }
+  u.pathname = pathname
+  return u
+}
+
+async function token(credentials, { query = {}, form = {}, subdomain, path = '/oauth/token' } = {}) {
   const { clientid, clientsecret, certurl, url, certificate, key } = credentials ?? {}
-  const u = new URL(certurl || url)
-  if (subdomain) u.hostname = u.hostname.replace(/^[^.]+/, subdomain)
-  u.pathname = '/oauth/token'
+  if (!form.grant_type) throw cds.error('grant_type is required', { status: 400 })
+  const u = authUrl(certurl || url, subdomain, path)
   Object.entries(query).forEach(([k, v]) => u.searchParams.append(k, v))
-  const body = new URLSearchParams({ grant_type: 'client_credentials', client_id: clientid, ...form })
+  const body = new URLSearchParams({ client_id: clientid, ...form })
   const headers = { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' }
   let raw
+  const _fail = (statusCode, respBody) => new Error(`token request to ${u.origin}${u.pathname} for client ${clientid} failed (${statusCode}): ${respBody}`, { status: statusCode })
   if (certificate) {
     raw = await new Promise((resolve, reject) => {
       const req = require('node:https').request({
@@ -112,7 +127,7 @@ async function token(credentials, { query = {}, form = {}, subdomain } = {}) {
         res.on('data', x => chunks.push(x))
         res.on('end', () => {
           if (res.statusCode >= 200 && res.statusCode < 300) resolve(Buffer.concat(chunks).toString())
-          else reject(new Error(Buffer.concat(chunks).toString(), { status: res.statusCode }))
+          else reject(_fail(res.statusCode, Buffer.concat(chunks).toString()))
         })
       })
       req.on('error', reject)
@@ -162,7 +177,7 @@ async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAf
     const data = contentType.includes('application/json') ? await res.json() : await res.text()
 
     if (!res.ok) {
-      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause].filter(Boolean).join(' – ')
+      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause, typeof data?.details === 'object' ? JSON.stringify(data.details) : data?.details].filter(Boolean).join(' – ')
       if (res.status === 429 && res.headers.get('retry-after')) msg += ` – retry after ${res.headers.get('retry-after')}`
       throw Object.assign(new Error(msg), { status, statusText, headers, code: data?.error?.code })
     }
@@ -249,6 +264,7 @@ module.exports = {
   readData,
   readDataCsv,
   token,
+  authUrl,
   fetchResiliently,
   getAppId,
   deepMerge

package/node_modules/@sap/cds-mtxs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-mtxs",
-  "version": "4.0.2",
+  "version": "4.1.0",
   "description": "SAP Cloud Application Programming Model - Multitenancy library",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-mtxs/srv/cf/abstract-provisioning-service.js

@@ -5,6 +5,7 @@ const { fetchResiliently, token } = require('../../lib/utils')
 const DeploymentService = 'cds.xt.DeploymentService'
 const JobsService = 'cds.xt.JobsService'
 const Tenants = 'cds.xt.Tenants'
+const { SKIPPED_DB } = require('../jobs-service')
 
 // we need to run in multitenancy mode for t0 ops
 if (!cds.env.requires.multitenancy) cds.env.requires.multitenancy = true
@@ -112,9 +113,9 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     )).map(({ ID, metadata, createdAt, modifiedAt }) => ({ subscribedTenantId: ID, ...this._toMetadataJson(metadata, ID), createdAt, modifiedAt }))
   }
 
-  async _getTenants() {
+  async _getTenants(options) {
     const ds = await cds.connect.to(DeploymentService)
-    const all = await ds.getTenants()
+    const all = await ds.getTenants(options)
     if (cds.env.requires[this.name]?.upgrade?.ignoreNonExistingContainers) {
       const containers = await ds.getContainers()
       return all.filter(t => containers.includes(t))
@@ -129,9 +130,37 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const all = tenantIds.includes('*')
     const sharedGenDir = !main.requires.extensibility
     if (sharedGenDir) options.skipResources ??= sharedGenDir
-    const tenants = all ? await this._getTenants() : tenantIds
+
+    // Merge static upgrade config with dynamic options (dynamic takes precedence)
+    const upgradeConfig = cds.env.requires[this.name]?.upgrade
+    if (upgradeConfig) {
+      options.upgrade = cds.utils.merge({ ...upgradeConfig }, options.upgrade)
+    }
+
+    // Determine skipAfter: from explicit option or derived from package.json mtime
+    let skipAfter = options?.upgrade?.skipAfter
+    if (!skipAfter && options?.upgrade?.skipAlreadyUpgraded) {
+      const { stat } = require('fs/promises')
+      const { mtime } = await stat(cds.root + '/package.json')
+      skipAfter = mtime.toISOString()
+    }
+
+    const tenantsOptions = skipAfter ? { skipAfter } : undefined
+    let tenants
+    let skipped = []
+    if (all) {
+      tenants = await this._getTenants(tenantsOptions)
+    } else if (skipAfter) {
+      const upgradeable = await this._getTenants(tenantsOptions)
+      tenants = tenantIds.filter(t => upgradeable.includes(t))
+      // Requested tenants filtered out by skipAfter are considered already upgraded.
+      skipped = tenantIds.filter(t => !upgradeable.includes(t))
+    } else {
+      tenants = tenantIds
+    }
+
     const { isSync } = this._parseHeaders(cds.context.http?.req.headers)
-    if (!tenants.length && isSync) return
+    if (!tenants.length && !skipped.length && isSync) return
     if (sharedGenDir && cds.requires.db.kind === 'hana') { // REVISIT: Ideally part of HANA plugin
       const { resources4, csvs4, directory4 } = require('../plugins/hana')
       const out = await directory4('base', true)
@@ -141,13 +170,26 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const { 'cds.xt.DeploymentService': ds } = cds.services
     const js = await cds.connect.to(JobsService)
     const { clusterSize = 3 } = js._config()
-    const dbToTenants = (clusterSize > 1 && ds) ? await ds.tenantsByDb(tenants) : [new Set(tenants)]
-    LOG.info('upgrading', { tenants })
+    const dbToTenants = (tenants.length && clusterSize > 1 && ds) ? await ds.tenantsByDb(tenants) : [new Set(tenants)]
+    // Skipped tenants go into a separate pseudo-db cluster so JobsService records them (and their
+    // tasks) as FINISHED without upgrading.
+    let clusters = dbToTenants
+    if (skipped.length) {
+      // Normalize array-form to a db-id-keyed object so skipped tenants get their own cluster.
+      clusters = { ...dbToTenants }
+      // Drop skipped tenants from regular clusters (some tenantsByDb impls ignore the tenant list).
+      const skippedSet = new Set(skipped)
+      for (const db of Object.keys(clusters)) {
+        clusters[db] = new Set([...clusters[db]].filter(t => tenants.includes(t) && !skippedSet.has(t)))
+      }
+      clusters[SKIPPED_DB] = skippedSet
+    }
+    LOG.info('upgrading', { tenants, skipped })
 
 
     return await new Promise((resolve, reject) => {
       const tx = js.tx({ tenant: cds.context.tenant, user: new cds.User.Privileged() })
-      const job = tx.enqueue(DeploymentService, 'upgrade', dbToTenants, { options }, async error => {
+      const job = tx.enqueue(DeploymentService, 'upgrade', clusters, { options }, async error => {
         if (error) {
           await this._sendCallback('FAILED', `Tenant upgrade failed with error '${error}'`)
           if (isSync) reject(new Error(error))
@@ -291,7 +333,7 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
   async _token() {
     const serviceName = 'cds.xt.' + this.constructor.name
     const cred = this._getCredentials()
-    const raw = await token(cred, { query: { response_type: 'token' } })
+    const raw = await token(cred, { query: { response_type: 'token' }, form: { grant_type: 'client_credentials' } })
     const { access_token } = JSON.parse(raw)
     if (!access_token) cds.error(`could not get token for ${serviceName}: token is empty`)
     return access_token
@@ -303,4 +345,17 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const cred = s?.credentials ?? multitenancy?.credentials ?? {}
     return cred
   }
+
+  _resolveCallbackUrl(callbackPath, baseUrl) {
+    if (!callbackPath || !baseUrl) return undefined
+    if (typeof callbackPath !== 'string' || !/^\/(?![/\\])/.test(callbackPath) || callbackPath.includes('\\')) {
+      throw cds.error(`Invalid callback path: ${callbackPath}`, { status: 400 })
+    }
+    const base = new URL(baseUrl)
+    const resolved = new URL(callbackPath, base)
+    if (resolved.origin !== base.origin) {
+      throw cds.error(`Invalid callback path: ${callbackPath}`, { status: 400 })
+    }
+    return resolved.toString()
+  }
 }

package/node_modules/@sap/cds-mtxs/srv/cf/saas-provisioning-service.js

@@ -28,7 +28,7 @@ module.exports = class SaasProvisioningService extends require('./abstract-provi
   _parseHeaders(headers) {
     const { prefer, status_callback, mtx_status_callback } = headers ?? {}
     const { saas_registry_url } = this._getCredentials()
-    const callbackUrl = mtx_status_callback ?? (status_callback && saas_registry_url && new URL(status_callback, saas_registry_url).toString())
+    const callbackUrl = mtx_status_callback ?? this._resolveCallbackUrl(status_callback, saas_registry_url)
     return {
       callbackUrl,
       isCustomCallback: !!mtx_status_callback,

package/node_modules/@sap/cds-mtxs/srv/cf/sms-provisioning-service.js

@@ -53,7 +53,7 @@ module.exports = class SmsProvisioningService extends require('./abstract-provis
     _parseHeaders(headers) {
         const { prefer, status_callback } = headers ?? {}
         const { subscription_manager_url } = this._getCredentials()
-        const callbackUrl = (status_callback && subscription_manager_url && new URL(status_callback, subscription_manager_url).toString())
+        const callbackUrl = this._resolveCallbackUrl(status_callback, subscription_manager_url)
         return {
             callbackUrl,
             isSync: !(prefer?.includes('respond-async') || callbackUrl)
@@ -102,11 +102,31 @@ module.exports = class SmsProvisioningService extends require('./abstract-provis
         const isIssuerValid = isValid(callback_certificate_issuer, cert.issuer)
         const isSubjectValid = isValid(callback_certificate_subject, cert.subject)
 
+        function parseDN(dn) {
+            // Node's X509Certificate.issuer/subject uses newline as RDN separator.
+            // Each line is a single "attribute=value" pair. Multiple lines with the
+            // same attribute (e.g. multiple OU= entries) are all collected into an array.
+            const fields = {}
+            for (const line of dn.split('\n')) {
+                const eq = line.indexOf('=')
+                if (eq === -1) continue
+                const attr = line.slice(0, eq).trim().toUpperCase()
+                const val = line.slice(eq + 1).trim()
+                if (fields[attr]) fields[attr].push(val)
+                else fields[attr] = [val]
+            }
+            return fields
+        }
+
         function isValid(expected, fromCert) {
+            const certFields = parseDN(fromCert)
             return Object.entries(JSON.parse(expected)).every(([k, v]) => {
                 if (v === '*') return true
-                if (Array.isArray(v)) return v.some(v => fromCert.includes(`${k}=${v}`))
-                else return fromCert.includes(`${k}=${v}`)
+                const certVals = certFields[k.toUpperCase()] ?? []
+                // For array expected values every element must be present in the cert.
+                // For a scalar expected value the cert must contain that exact value.
+                if (Array.isArray(v)) return v.every(allowed => certVals.includes(allowed))
+                else return certVals.includes(v)
             })
         }