@sap/cds-dk 10.1.1 → 10.2.0

package/node_modules/@sap/cds-compiler/lib/transform/odata/toFinalBaseType.js

@@ -7,9 +7,9 @@ const {
   forEachDefinition,
   forEachGeneric,
   forEachMemberRecursively,
-} = require('../../model/csnUtils');
+} = require('../../base/csnUtils');
 const { isBuiltinType } = require('../../base/builtins');
-const { isArtifactInSomeService, isArtifactInService } = require('./utils');
+const { isArtifactInSomeService, isArtifactInService, odataTypeFacetAnnotations } = require('./utils');
 const { cloneCsnDict, cloneCsnNonDict } = require('../../base/cloneCsn');
 
 function expandToFinalBaseType(csn, transformers, csnUtils, services, options, error) {
@@ -18,15 +18,28 @@ function expandToFinalBaseType(csn, transformers, csnUtils, services, options, e
     // Unravel derived type chains to final one for elements, actions, action parameters (propagating annotations)
     forEachMemberRecursively(def, (member, _memberName) => {
       expandToFinalBaseType(member, defName);
+      // Mark items nodes so isExpandable can distinguish them from direct element types.
+      // Annotated outside-service scalar items types (many T) are preserved for TypeDefinition
+      // exposure
+      if (isV4 && member.items)
+        setProp(member.items, '$v4ItemsContext', true);
       expandToFinalBaseType(member.items, defName);
       expandToFinalBaseType(member.returns, defName);
-      expandToFinalBaseType(member.returns && member.returns.items, defName);
+      const returnsItems = member.returns && member.returns.items;
+      if (isV4 && returnsItems)
+        setProp(returnsItems, '$v4ItemsContext', true);
+      expandToFinalBaseType(returnsItems, defName);
     }, [ 'definitions', defName ]);
 
     expandToFinalBaseType(def, defName);
+    if (isV4 && def.items)
+      setProp(def.items, '$v4ItemsContext', true);
     expandToFinalBaseType(def.items, defName);
     expandToFinalBaseType(def.returns, defName);
-    expandToFinalBaseType(def.returns && def.returns.items, defName);
+    const defReturnsItems = def.returns && def.returns.items;
+    if (isV4 && defReturnsItems)
+      setProp(defReturnsItems, '$v4ItemsContext', true);
+    expandToFinalBaseType(defReturnsItems, defName);
     /*
       If the definition('def' variable) is a type definition and the assigned type of this very same definition('def' variable)
       is structured type, e.g.:
@@ -267,7 +280,18 @@ function expandToFinalBaseType(csn, transformers, csnUtils, services, options, e
       const isBuiltin = isBuiltinType(finalBaseType.type);
       const isAssoc = node.target;
       const isInCurServ = isArtifactInService(node.type, currService);
-      return !isV4 || !(isBuiltin && !isAssoc && isInCurServ);
+      // For items context in V4 - also preserve annotated outside-service scalar types so the types exposure
+      // can expose them as TypeDefinitions. Only applies to items nodes (many T), not direct element types,
+      // to avoid breaking allInOneFlattening.
+      // Exclude annotations that must not trigger TypeDefinition creation:
+      //    @cds.* — compiler-internal markers (e.g. @cds.external); never rendered in EDMX
+      //    @odata.Type / @odata.<facet> — type-facet overrides; change the primitive mapping, so the TypeDefinition would get a wrong UnderlyingType
+      //    @open — map open/closed marker; type must resolve to cds.Map, not become a TypeDefinition
+      const itemsTypeDef = isV4 && node.$v4ItemsContext && !isBuiltinType(node.type) && csn.definitions[node.type];
+      const hasExposableAnnotations = !!itemsTypeDef && Object.keys(itemsTypeDef).some(
+        k => k[0] === '@' && !k.startsWith('@cds.') && !odataTypeFacetAnnotations.includes(k) && k !== '@open'
+      );
+      return !isV4 || !(isBuiltin && !isAssoc && (isInCurServ || hasExposableAnnotations));
     }
 
     // convert $path to path starting at main artifact

package/node_modules/@sap/cds-compiler/lib/transform/odata/typesExposure.js

@@ -8,11 +8,11 @@
 
 const { setProp } = require('../../utils/objectUtils');
 const { isBetaEnabled } = require('../../base/specialOptions');
-const { defNameWithoutServiceOrContextName, isArtifactInService } = require('./utils');
+const { defNameWithoutServiceOrContextName, isArtifactInService, odataTypeFacetAnnotations } = require('./utils');
 const {
   getNamespace, copyAnnotations,
   forEachDefinition, forEachMember, forEachGeneric, isEdmPropertyRendered,
-} = require('../../model/csnUtils');
+} = require('../../base/csnUtils');
 const { isBuiltinType } = require('../../base/builtins');
 const { CompilerAssertion } = require('../../base/error');
 const { cloneCsnNonDict } = require('../../base/cloneCsn');
@@ -253,7 +253,7 @@ function typesExposure(csn, whatsMyServiceName, requestedServiceNames, fallBackS
           }
         }
       }
-      else if (isTermDef) {
+      else if (isTermDef || (!elements && !isAnonymous)) {
         newType = Object.create(null);
         for (const n in typeDef)
           newType[n] = typeDef[n];
@@ -319,6 +319,16 @@ function typesExposure(csn, whatsMyServiceName, requestedServiceNames, fallBackS
                 // Implementation note: For `type S: T:struct;`, elements from `T:struct` were already propagated to `S`.
                 if ((isTermDef && typeDef.enum) || (rc.elements = (typeDef.items?.elements || typeDef.elements)) !== undefined)
                   return rc;
+                // Annotated outside-service scalar types in items context (many T) need to be exposed as TypeDefinitions.
+                // Only applies to items nodes (not direct type refs) to preserve existing behavior for direct uses.
+                // Exclude types annotated with:
+                //    @cds.* — compiler-internal markers (e.g. @cds.external); never rendered in EDMX
+                //    @odata.Type / @odata.<facet> — type-facet overrides; change the primitive mapping, so the TypeDefinition would get a wrong UnderlyingType
+                //    @open — map open/closed marker; type must resolve to cds.Map, not become a TypeDefinition
+                if (node.items && Object.keys(typeDef).some(
+                  k => k[0] === '@' && !k.startsWith('@cds.') && !odataTypeFacetAnnotations.includes(k) && k !== '@open'
+                ))
+                  return rc;
                 type = typeDef.items?.type || typeDef.type;
                 typeName = (type.ref && csnUtils.artifactRef(type)) || type;
               }

package/node_modules/@sap/cds-compiler/lib/transform/odata/utils.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { EdmTypeFacetNames } = require('../../edm/EdmPrimitiveTypeDefinitions');
+
 /**
  * Return the definition name, without the prefixed service name
  * @param {string} name
@@ -56,10 +58,17 @@ function isLocalizedArtifactInService(artName, services) {
   return isArtifactInSomeService(artName.split('.').slice(1).join('.'), services);
 }
 
+// @odata.* type-facet annotations that override how a scalar type maps to an EDM primitive.
+// A type carrying these must not trigger TypeDefinition creation because the TypeDefinition
+// would get a wrong UnderlyingType (e.g. @odata.Type: 'Edm.Date' on a String-based type).
+// Derived from EdmTypeFacetNames (the actively processed facets) plus @odata.Type itself.
+const odataTypeFacetAnnotations = [ '@odata.Type', ...EdmTypeFacetNames.map(n => `@odata.${ n }`) ];
+
 module.exports = {
   defNameWithoutServiceOrContextName,
   getServiceOfArtifact,
   isArtifactInService,
   isArtifactInSomeService,
   isLocalizedArtifactInService,
+  odataTypeFacetAnnotations,
 };

package/node_modules/@sap/cds-compiler/lib/transform/transformUtils.js

@@ -6,8 +6,8 @@
 
 const { setProp } = require('../utils/objectUtils');
 
-const { copyAnnotations, applyTransformations, isDeepEqual } = require('../model/csnUtils');
-const { getUtils, implicitAs } = require('../model/csnUtils');
+const { copyAnnotations, applyTransformations, isDeepEqual } = require('../base/csnUtils');
+const { getUtils, implicitAs } = require('../base/csnUtils');
 const { typeParameters } = require('../compiler/builtins');
 const { isBuiltinType } = require('../base/builtins');
 const { ModelError, CompilerAssertion } = require('../base/error');

package/node_modules/@sap/cds-compiler/lib/transform/translateAssocsToJoins.js

@@ -1685,7 +1685,7 @@ function translateAssocsToJoins(model, inputOptions = {}) {
       // If rootQat ($tableAlias) already has a QA, reuse it, create a new one otherwise.
       if (!rootQat.$QA) {
         // Use the original FROM alias if available!
-        if (pathDict.name && pathDict.name.id) {
+        if (env.location === 'from' && pathDict.name && pathDict.name.id) {
           qat.$QA = createQA(env, art, pathDict.name.id, qat._namedArgs);
           rootQat.$QA = qat.$QA;
         }

package/node_modules/@sap/cds-compiler/lib/transform/tupleExpansion.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { setProp } = require('../utils/objectUtils');
-const { applyTransformations, isDollarSelfOrProjectionOperand, implicitAs } = require('../model/csnUtils');
+const { applyTransformations, isDollarSelfOrProjectionOperand, implicitAs } = require('../base/csnUtils');
 const { isBuiltinType } = require('../base/builtins');
 const { condAsTree } = require('../base/xprAsTree');
 const { pathToMessageString } = require('../base/messages');

package/node_modules/@sap/cds-compiler/lib/transform/universalCsn/coreComputed.js

@@ -2,7 +2,7 @@
 
 const {
   forEachDefinition, forAllQueries, getNormalizedQuery, forEachMemberRecursively,
-} = require('../../model/csnUtils');
+} = require('../../base/csnUtils');
 const { setAnnotationIfNotDefined } = require('./utils');
 const { CompilerAssertion } = require('../../base/error');
 const { isMagicVariable } = require('../../base/builtins');

package/node_modules/@sap/cds-compiler/lib/transform/universalCsn/universalCsnEnricher.js

@@ -8,7 +8,7 @@ const {
   getUtils,
   applyTransformations,
   implicitAs,
-} = require('../../model/csnUtils');
+} = require('../../base/csnUtils');
 const { isBuiltinType, propagationRules } = require('../../base/builtins');
 const {
   forEachValue, forEach,

package/node_modules/@sap/cds-compiler/lib/transform/universalCsn/utils.js

@@ -2,7 +2,7 @@
 
 const {
   applyTransformations,
-} = require('../../model/csnUtils');
+} = require('../../base/csnUtils');
 const { setProp } = require('../../utils/objectUtils');
 
 /**

package/node_modules/@sap/cds-compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-compiler",
-  "version": "7.1.1",
+  "version": "7.2.1",
   "description": "CDS (Core Data Services) compiler and backends",
   "homepage": "https://cap.cloud.sap/",
   "author": "SAP SE (https://www.sap.com)",

package/node_modules/@sap/cds-mtxs/CHANGELOG.md

@@ -6,10 +6,53 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 4.2.0 - 2026-10-21
+
+### Added
+
+- When an `extension-allowlist` is configured, CSV data uploaded with tenant extensions is now validated against it.
+- Tenant metadata APIs now report `status` as `SUBSCRIBED`, `UNSUBSCRIBING`, or `UNSUBSCRIPTION_FAILED`.
+- `cds.requires.multitenancy.containerManager.lifecycleMaxRetryAfter` now controls the maximum container manager retry delay during tenant subscription and unsubscription, defaulting to 5 minutes while `maxRetryAfter` defaults to 5 seconds.
+
+### Fixed
+
+- HANA Cloud serverless now resolves subscriber containers in their own HANA tenants instead of the application provider's tenant.
+- Extensions can no longer expose internal entities (e.g. `cds.xt.Extensions`) by projecting or selecting from a protected namespace.
+- `cds build` now produces identical main application CSNs for the server and MTX sidecar.
+- `cds.xt.SaasProvisioningService` now waits for asynchronous subscription callbacks before emitting the final job update.
+- Bulk tenant upgrades now skip tenants whose unsubscription failed.
+- HANA tenant unsubscription is now idempotent when Service Manager still lists already deleted resources.
+- `cds unsubscribe <t0> --local` now executes the unsubscription for the configured root tenant instead of returning without effect.
+- `cds.xt.SaasProvisioningService.upgrade` now preserves the original error status for failed tenant tasks.
+- The MTX sidecar now reports invalid production build layouts at startup and logs the full cause of deployment resource failures.
+- The Service Manager client no longer forwards TMS-specific parameters to the server to make migration from Service Manager to HANA TMS v2 easier.
+- Login endpoint for the extension upload now supports PKCE login with subscriber IAS host.
+- `cds-mtx-migrate '*' --sync-tenant-list` supports `--dry` again.
+- Entities and views with namespaces `cds.outbox` and `cds.core` can no longer be extended via tenant specific extensibility.
+
+## Version 4.1.1 - 2026-09-24
+
+### Added
+
+- Beta: The HANA container manager can use Service Manager v2 when `features.service_manager_v2` is enabled.
+- `cds-mtx` also accepts space-separated tenant lists such as `cds-mtx upgrade t1 t2 t3`.
+
+### Fixed
+
+- Service Manager retries now use jittered backoff to avoid synchronized retries during transient failures.
+- HANA Cloud serverless token requests now include the IAS application tenant ID when the client ID is not unique.
+- `cds-mtx` now prints the complete error with stack and causes when an operation fails.
+- A malformed extension `csn` string is now rejected with status `422` instead of `500`.
+- The Service Manager client now recreates an HDI container whose last operation was a succeeded deletion, instead of reusing the deleted instance.
+- The upgrade check that aborts on existing extensions when extensibility is disabled now reliably detects the `cds.xt.Extensions` table even if it is not part of the model.
+- More robust handling of faulty archives sent to `cds.xt.ExtensibilityService.push`.
+- MTX now always uses node-tar for archive handling for more stability.
+
 ## Version 4.1.0 - 2026-09-04
 
 ### Added
 
+- The extensibility login endpoints support SAP Cloud Identity Services (IAS): with `auth: ias`, `cds login` uses an OAuth 2.0 Authorization Code (PKCE) browser flow. The token targets the subscriber tenant (resolved from the `subdomain`), where `cds.ExtensionDeveloper` is granted via AMS policies.
 - Beta: Multitenant provisioning now supports HANA Cloud serverless, resolving one HDI container per tenant through the serverless Tenant API.
 - Beta: The MTX job service can now use native javascript workers to make the MTX sidecar more responsive while jobs (e. g. tenant upgrade) are running.
 Native workers can be enabled by `nativeWorkers` in the jobs configuration, e. g.
@@ -26,6 +69,10 @@ Native workers can be enabled by `nativeWorkers` in the jobs configuration, e. g
 already upgraded tenants are skipped when running an upgrade of all tenants (`tenants: ['*']`). Tenants are considered as already upgraded if the last upgrade was run after the
 last deployment of the application.
 
+### Added
+
+- `cds.env.features.native_hdi_deploy` can now enable native HANA tenant deployment with delta uploads, bulk HDI inputs, and streaming for large artifacts.
+
 ### Fixed
 
 - `SmsProvisioningService` certificate check is now better aligned with the Java implementation.

package/node_modules/@sap/cds-mtxs/bin/cds-mtx-migrate.js

@@ -42,10 +42,8 @@ async function run(param, options) {
             '@sap/cds-mtxs/srv/model-provider'
         ]
 
-        if (!dry) {
-            services.push('@sap/cds-mtxs/srv/deployment-service')
-            services.push('@sap/cds-mtxs/srv/extensibility-service')
-        }
+        services.push('@sap/cds-mtxs/srv/deployment-service')
+        services.push('@sap/cds-mtxs/srv/extensibility-service')
 
         await _local_server_js()
         cds.emit ('bootstrap')
@@ -58,10 +56,10 @@ async function run(param, options) {
         }
         await cds.plugins
 
-        await cds.emit('served', cds.services)
-
         cds.env.requires.multitenancy ??= true // needed for current sidecar config that only enables services
 
+        await cds.emit('served', cds.services)
+
         if (genTenantList) {
             const tenantListResult = await synchronizeTenantList(tenantList, options)
             for (let t of tenantListResult.connectedTenants) await cds.db.disconnect(t)

package/node_modules/@sap/cds-mtxs/bin/cds-mtx.js

@@ -10,8 +10,9 @@ const SUPPORTED = ['subscribe', 'unsubscribe', 'upgrade']
 // This function must only be changed in a backward compatible way. It is used by DwC.
 async function cds_mtx(cmd, tenant, body) {
 
-    const tenants = (Array.isArray(tenant) ? tenant : [tenant]).flatMap(t => t.split(','))
+    const tenants = (Array.isArray(tenant) ? tenant : [tenant]).flatMap(t => t.split(/[\s,]+/)).filter(Boolean)
     const one = tenants.length === 1 ? tenants[0] : undefined
+    const t0 = cds.env.requires.multitenancy?.t0 ?? 't0'
 
     let connectedTenants = []
 
@@ -56,7 +57,7 @@ async function cds_mtx(cmd, tenant, body) {
                 await tx.upgrade(['*'], parsedMetadata)
             })
             return
-        } else if (one === 't0') {
+        } else if (one === t0 && cmd !== 'unsubscribe') {
             return
         }
         connectedTenants = tenants
@@ -70,12 +71,12 @@ async function cds_mtx(cmd, tenant, body) {
         }
     } catch(e) {
         if (isCli) {
-            console.error(e.message)
+            console.error(e)
             process.exit(1)
         } else throw e
     } finally {
         if (cds.db) {
-            cds.db.disconnect(cds.env.requires.multitenancy.t0 ?? 't0')
+            cds.db.disconnect(t0)
             for (const t of connectedTenants) cds.db.disconnect(t)
         }
         if (isCli) {

package/node_modules/@sap/cds-mtxs/cds-plugin.js

@@ -1,4 +1,5 @@
 const cds = require('@sap/cds')
+const { exists } = cds.utils
 const LOG = cds.log('mtx')
 const [major] = cds.version.split('.').map(Number)
 if (major < 9) throw new Error('@sap/cds-mtxs 3 requires @sap/cds version 9 or higher. Current version: ' + cds.version)
@@ -13,8 +14,13 @@ const sqlDefaults = Object.fromEntries(
 require('./srv/extensibility/linter').legacyCheck()
 
 const main = require('./srv/config')
+const inSidecar = cds.env.requires['cds.xt.ModelProviderService']?._in_sidecar === true
 
-if (main.env.cdsc && cds.env.requires['cds.xt.ModelProviderService']?._in_sidecar === true) {
+if (inSidecar && process.env.NODE_ENV === 'production' && !exists(main.root)) {
+    throw new Error(`Invalid MTX sidecar layout: '${main.root}' is missing. Ensure the generated sidecar build output is deployed.`)
+}
+
+if (main.env.cdsc && inSidecar) {
     if (cds.env.cdsc && !(cds.env.requires['cds.xt.ModelProviderService']?.['use-local-cdsc-config'] === true)) {
 
         // should not be used in MTX
@@ -32,7 +38,7 @@ if (main.env.cdsc && cds.env.requires['cds.xt.ModelProviderService']?._in_sideca
     cds.env.cdsc = main.env.cdsc
 }
 
-if (cds.env.requires['cds.xt.ModelProviderService']?._in_sidecar === true) {
+if (inSidecar) {
     if (!(cds.env.requires['cds.xt.ModelProviderService']?.['use-root-sql-config'] === true)) {
         const stringifiedSql = JSON.stringify(cds.env.sql)
 
@@ -46,3 +52,33 @@ if (cds.env.requires['cds.xt.ModelProviderService']?._in_sidecar === true) {
 } else {
     cds.env.sql = main.env.sql
 }
+
+cds.once('served', async () => {
+    if (cds.model.definitions['cds.xt.ModelProviderService']) return
+    const { definitions } = cds.model
+    const models = []
+
+    if (cds.requires.multitenancy) {
+        _serve('cds.xt.SaasProvisioningService')
+        _serve('cds.xt.DeploymentService')
+        _serve('cds.xt.ModelProviderService')
+    }
+
+    if (cds.requires.extensibility) {
+        _serve('cds.xt.ExtensibilityService')
+        _serve('cds.xt.ModelProviderService')
+    }
+
+    if (cds.requires.toggles) {
+        _serve('cds.xt.ModelProviderService')
+    }
+
+    function _serve(service) {
+        if (service in definitions) return
+        if (cds.requires[service] === false) return
+        models.push(cds.requires.kinds[service].model)
+    }
+
+    if (models.length) await cds.serve(models).in(cds.app)
+})
+require('./srv/plugins/common')

package/node_modules/@sap/cds-mtxs/db/t0.cds

@@ -7,6 +7,13 @@ entity Tenants {
         modifiedAt : Timestamp @cds.on.insert : $now  @cds.on.update : $now;
         schema     : String;
         version    : String;
+        status     : TenantStatus default #SUBSCRIBED;
+}
+
+type TenantStatus : String enum {
+    SUBSCRIBED;
+    UNSUBSCRIBING;
+    UNSUBSCRIPTION_FAILED;
 }
 
 entity Jobs {

package/node_modules/@sap/cds-mtxs/lib/utils.js

@@ -1,9 +1,28 @@
 const cds = require('@sap/cds')
-const LOG = cds.log('mtx'), DEBUG = cds.debug('mtx'), { read, readdir, path, tar } = cds.utils
+const LOG = cds.log('mtx'), DEBUG = cds.debug('mtx'), { read, readdir, path } = cds.utils
+const nodeTar = require('tar')
+const { Readable } = require('node:stream')
 const { inspect, promisify } = require('node:util')
 
+// Extracts a gzipped tar (Buffer or base64) into 'root', guarded against
+// Tar-Slip: node-tar rejects '..'/absolute escapes and the filter drops links.
+const safeUntar = function (extension, root) {
+  const buf = typeof extension === 'string' ? Buffer.from(extension, 'base64') : extension
+  return new Promise((resolve, reject) => {
+    const extract = nodeTar.x({
+      cwd: root,
+      gzip: true,
+      strict: true,
+      filter: (_p, entry) => entry.type !== 'SymbolicLink' && entry.type !== 'Link'
+    })
+    Readable.from(buf).pipe(extract)
+    extract.on('close', resolve)
+    extract.on('error', reject)
+  })
+}
+
 const readData = async function (extension, root) {
-  await tar.xvz(extension).to(root)
+  await safeUntar(extension, root)
 
   let extCsn = {}
   try { extCsn = JSON.parse(await read(path.join(root, 'extension.csn'))) }
@@ -26,7 +45,7 @@ const readData = async function (extension, root) {
 }
 
 const readDataCsv = async function (extension, root) {
-  await tar.xvz(extension).to(root)
+  await safeUntar(extension, root)
 
   const csvs = []
   try {
@@ -104,10 +123,75 @@ function authUrl(baseUrl, subdomain, pathname) {
   return u
 }
 
-async function token(credentials, { query = {}, form = {}, subdomain, path = '/oauth/token' } = {}) {
+// IAS OAuth2 endpoint paths (differ from XSUAA).
+const IAS_AUTHORIZE_PATH = '/oauth2/authorize'
+const IAS_TOKEN_PATH = '/oauth2/token'
+
+// IAS uses a fixed tenant host (tenant not encoded as subdomain), so don't rewrite the host.
+function _iasUrl(baseUrl, pathname) {
+  const u = new URL(baseUrl)
+  u.pathname = pathname
+  return u
+}
+
+// Authorization endpoint (browser) → plain (non-cert) URL.
+function iasAuthorizeUrl(credentials) {
+  const { url, certurl } = credentials ?? {}
+  return _iasUrl(url || certurl, IAS_AUTHORIZE_PATH).toString()
+}
+
+// Token endpoint → prefer cert URL for mTLS.
+function iasTokenUrl(credentials) {
+  const { url, certurl } = credentials ?? {}
+  return _iasUrl(certurl || url, IAS_TOKEN_PATH).toString()
+}
+
+// Resolves the landscape API host that serves `tenantLoginInfo`. Prefers the authoritative
+// `btp-tenant-api` base injected into the binding; otherwise derives it from the binding URL
+// (e.g. `https://<label>.authentication.eu12.hana.ondemand.com` → `api.authentication.eu12.hana.ondemand.com`).
+// Returns undefined when neither yields a usable host.
+function tenantLoginInfoHost(credentials) {
+  const c = credentials ?? {}
+  // Authoritative BTP landscape API base, injected into the binding.
+  const api = c['btp-tenant-api'] ?? c.btp_tenant_api
+  if (api) { try { return new URL(api).host } catch { /* ignore */ } }
+  // Fallback: derive from the binding URL by replacing the leftmost label with `api`.
+  const base = c.url || c.certurl
+  if (!base) return undefined
+  try {
+    const { hostname } = new URL(base)
+    const dot = hostname.indexOf('.')
+    // Only rewrite when there is a domain part to keep.
+    return dot >= 0 ? 'api' + hostname.slice(dot) : undefined
+  } catch { return undefined }
+}
+
+// Fetches IAS login info for a subscriber subdomain from the landscape endpoint
+// `https://<apiHost>/sap/rest/tenantLoginInfo?subdomain=<subdomain>`.
+// Returns `{ app_tid, tenantHost }` for a trusted/active IAS tenant, otherwise undefined.
+async function tenantLoginInfo(apiHost, subdomain) {
+  if (!apiHost || typeof subdomain !== 'string' || !SUBDOMAIN_RE.test(subdomain)) return undefined
+  const url = `https://${apiHost}/sap/rest/tenantLoginInfo?subdomain=${encodeURIComponent(subdomain)}`
+  try {
+    const { data } = await fetchResiliently(url, { method: 'GET', headers: { Accept: 'application/json' } })
+    const info = typeof data === 'string' ? JSON.parse(data) : data
+    // An untrusted/unknown subdomain yields e.g. `{ status: 'NOTRUST', authentication: 'xsuaa' }`.
+    if (!info || !info.app_tid) return undefined
+    let tenantHost
+    try { tenantHost = info.authorization_endpoint && new URL(info.authorization_endpoint).host } catch { /* ignore */ }
+    return { app_tid: info.app_tid, tenantHost }
+  } catch (err) {
+    DEBUG?.('tenantLoginInfo lookup failed for subdomain', subdomain, '-', err.message)
+    return undefined
+  }
+}
+
+// `endpoint`, when given, is the absolute token URL and overrides the binding-derived
+// host; mTLS cert/key and client_id still come from `credentials`.
+async function token(credentials, { query = {}, form = {}, subdomain, path = '/oauth/token', endpoint } = {}) {
   const { clientid, clientsecret, certurl, url, certificate, key } = credentials ?? {}
   if (!form.grant_type) throw cds.error('grant_type is required', { status: 400 })
-  const u = authUrl(certurl || url, subdomain, path)
+  const u = endpoint ? new URL(endpoint) : authUrl(certurl || url, subdomain, path)
   Object.entries(query).forEach(([k, v]) => u.searchParams.append(k, v))
   const body = new URLSearchParams({ client_id: clientid, ...form })
   const headers = { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' }
@@ -134,7 +218,10 @@ async function token(credentials, { query = {}, form = {}, subdomain, path = '/o
       req.end(body.toString())
     })
   } else {
-    headers.Authorization = 'Basic ' + Buffer.from(`${clientid}:${clientsecret}`).toString('base64')
+    // Confidential client → Basic auth; public client (PKCE) → no auth (client_id is in the body).
+    if (clientsecret) {
+      headers.Authorization = 'Basic ' + Buffer.from(`${clientid}:${clientsecret}`).toString('base64')
+    }
     const res = await fetchResiliently(u.toString(), { method: 'POST', headers, body: body.toString() })
     raw = typeof res.data === 'string' ? res.data : JSON.stringify(res.data)
   }
@@ -142,15 +229,18 @@ async function token(credentials, { query = {}, form = {}, subdomain, path = '/o
 }
 
 const maxRetries = cds.requires?.multitenancy?.serviceManager?.retries ?? 3 // compat
+const retryHeaders = new Set(['retry-after', 'x-ratelimit-retry-after', 'x-ratelimit-limit', 'x-ratelimit-remaining', 'x-request-id', 'x-correlation-id'])
+
+async function fetchResiliently(url, req, { retries = maxRetries, retriesLeft = retries, maxRetryAfter = 5000, failures = 0, retryUntil } = {}) {
+  const _backoff = async (attempt, minDelay = 200, error) => {
+    const maxDelay = maxRetryAfter
+    const baseDelay = Math.max(200 * 2.5 ** attempt, minDelay)
+    const delay = Math.max(minDelay, Math.min(maxDelay, baseDelay * (0.5 + Math.random())))
 
-async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAfter = 5000, failures = 0, retryUntil } = {}) {
-  const _backoff = async (attempt, minDelay = 200) => {
-    const maxDelay = 32_000
-    const delay = Math.max(200, Math.min(maxDelay, minDelay * 2 ** attempt))
     if (retryUntil && Date.now() + delay > retryUntil) {
       throw new Error('Retry delay threshold exceeded')
     }
-    LOG.info('attempt', attempt, 'failed – retrying with', delay / 1000, 's delay')
+    LOG.info('attempt', attempt, 'failed', ...(error ? ['with', error.message ?? error] : []), '– retrying with', (delay / 1000).toFixed(1), 's delay')
     await new Promise(resolve => setTimeout(resolve, delay))
   }
 
@@ -177,8 +267,11 @@ async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAf
     const data = contentType.includes('application/json') ? await res.json() : await res.text()
 
     if (!res.ok) {
-      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause, typeof data?.details === 'object' ? JSON.stringify(data.details) : data?.details].filter(Boolean).join(' – ')
-      if (res.status === 429 && res.headers.get('retry-after')) msg += ` – retry after ${res.headers.get('retry-after')}`
+      let msg = [status, statusText, data?.message, typeof data?.error === 'object' ? JSON.stringify(data.error) : data?.error, data?.description, data?.cause].filter(Boolean).join(' – ')
+      if (res.status === 429) {
+        const relevantHeaders = Object.fromEntries(Object.entries(headers).filter(([name]) => retryHeaders.has(name)))
+        msg += ` – headers: ${inspect(relevantHeaders)}`
+      }
       throw Object.assign(new Error(msg), { status, statusText, headers, code: data?.error?.code })
     }
     const response = { status, statusText, headers, data }
@@ -186,10 +279,13 @@ async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAf
     return response
   } catch (error) {
     const { status } = error ?? { status: 500 }
-    if (status in { 400: 1, 401: 1, 403: 1, 404: 1, 409: 1 } || retriesLeft === 0) return Promise.reject(error)
-    const minDelay = parseRetryAfter(error.headers || {})
-    if (status === 429 && (minDelay < 0 || minDelay > maxRetryAfter) || retriesLeft === 0) return Promise.reject(error)
-    const attempt = Math.max(maxRetries - retriesLeft + 1, failures)
+    if (status in { 400: 1, 401: 1, 403: 1, 404: 1, 409: 1, 422: 1 } || retriesLeft === 0) return Promise.reject(error)
+    const parsedRetryAfter = parseRetryAfter(error.headers || {})
+    const minDelay = status === 429
+      ? (parsedRetryAfter >= 0 ? Math.max(1000, parsedRetryAfter) : 1000)
+      : Math.max(200, parsedRetryAfter)
+    if (status === 429 && minDelay > maxRetryAfter || retriesLeft === 0) return Promise.reject(error)
+    const attempt = Math.max(retries - retriesLeft + 1, failures)
     if (LOG._debug) {
       const e = error.toJSON?.() ?? error
       DEBUG(`fetching ${url} attempt ${attempt} failed with`, {
@@ -198,14 +294,20 @@ async function fetchResiliently(url, req, { retriesLeft = maxRetries, maxRetryAf
         ...(e.description && { description: e.description })
       })
     }
-    await _backoff(attempt, minDelay)
-    return fetchResiliently(url, req, { retriesLeft: retriesLeft - 1, failures, retryUntil })
+    await _backoff(attempt, minDelay, error)
+    return fetchResiliently(url, req, {
+      retries,
+      retriesLeft: retriesLeft - 1,
+      maxRetryAfter,
+      failures,
+      retryUntil
+    })
   }
 }
 
 // TODO define max acceptable retry-after value?
 function parseRetryAfter(headers) {
-  const retryAfter = headers['retry-after']
+  const retryAfter = headers['retry-after'] ?? headers['x-ratelimit-retry-after']
   // Handle seconds format (most common)
   if (/^\d+$/.test(retryAfter)) {
     return parseInt(retryAfter, 10) * 1000 // Convert to milliseconds
@@ -263,8 +365,15 @@ module.exports = {
   retry,
   readData,
   readDataCsv,
+  safeUntar,
   token,
   authUrl,
+  iasAuthorizeUrl,
+  iasTokenUrl,
+  tenantLoginInfoHost,
+  tenantLoginInfo,
+  IAS_AUTHORIZE_PATH,
+  IAS_TOKEN_PATH,
   fetchResiliently,
   getAppId,
   deepMerge