@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/@sap/cds-mtxs/srv/plugins/hana/hdi-native.js

@@ -0,0 +1,752 @@
+const { join, sep, posix, matchesGlob } = require('path')
+const { createReadStream, createWriteStream, existsSync } = require('fs')
+const { promises: fsp } = require('fs')
+const { createHash } = require('crypto')
+const cds = require('@sap/cds/lib')
+const LOG = cds.log('mtx'), LOG_DEPLOY = cds.log('deploy'), DEBUG = LOG_DEPLOY._debug ? cds.debug('deploy') : cds.debug('mtx')
+const { fs, mkdirp, merge } = cds.utils
+const { deepMerge } = require('../../../lib/utils')
+const TEMP_DIR = fs.realpathSync(require('os').tmpdir())
+const WRITE_BATCH_ROWS = 8000
+const WRITE_BATCH_BYTES = 8 * 1024 * 1024
+const STREAM_THRESHOLD_BYTES = 1024 * 1024
+const FILE_CACHE_BYTES = 32 * 1024 * 1024
+const HASH_CONCURRENCY = 16
+
+const _DEPLOYER_ENV_KEYS = [
+  'APPLICATION_ID',
+  'APPLICATION_VERSION_INFO',
+  'EXIT',
+  'HDI_DEPLOY_OPTIONS',
+  'HDI_DEPLOY_MODE',
+  'DEPLOY_ID',
+  'TRACE',
+  'ROOT',
+  'SERVICE_REPLACEMENTS',
+  'TARGET_CONTAINER',
+  'HDI_DEPLOY_ZDM_ACTION'
+]
+
+exports._logDirectory = async () => {
+  const defaultDir = join(cds.root, 'logs')
+  try {
+    await mkdirp(defaultDir)
+    return defaultDir
+  } catch (e) {
+    if (e.code !== 'EACCES' && e.code !== 'EROFS' && e.code !== 'ENOENT') throw e
+    LOG?.(`using temporary directory ${TEMP_DIR} for deployment logs`)
+    return join(TEMP_DIR, 'logs')
+  }
+}
+
+const _createSafeStream = logPath => {
+  const stream = createWriteStream(logPath)
+
+  stream.on('error', err => LOG.error('Stream error:', err))
+
+  return {
+    write: buffer => {
+      if (!stream.destroyed && stream.writable) {
+        stream.write(buffer)
+      }
+    },
+    end: () => {
+      if (!stream.destroyed && !stream.writableEnded) {
+        stream.end()
+      }
+    }
+  }
+}
+
+exports.deploy = async (hana, tenant, cwd, options, deployEnv) => {
+  const env = await exports._hdi_env4(tenant,hana,options,deployEnv)
+  DEBUG?.('deployment directory:', cwd)
+  DEBUG?.('effective HDI options:', env.HDI_DEPLOY_OPTIONS)
+
+  const logDir = await exports._logDirectory()
+  const logPath = join(logDir, `${cds.context.tenant}.log`)
+  await mkdirp(logDir)
+  const safeStream = _createSafeStream(logPath)
+  DEBUG?.('------------[BEGIN HDI-DEPLOY-OUTPUT]---------------')
+  try {
+    const started = Date.now()
+    try {
+      await _deploy(cwd, env, {
+        stderrCB: buffer => {
+          LOG.error(buffer.toString())
+          safeStream.write(buffer)
+        },
+        stdoutCB: buffer => {
+          DEBUG?.(buffer.toString())
+          safeStream.write(buffer)
+        },
+        warnCB: buffer => {
+          LOG.warn(buffer.toString())
+          safeStream.write(buffer)
+        }
+      })
+    } catch (error) {
+      const logs = (error.result?.messages ?? [])
+        .filter(message => (message.SEVERITY ?? message.severity) === 'ERROR')
+        .map(message => message.MESSAGE ?? message.message ?? JSON.stringify(message))
+        .join('\n')
+      let message = `HDI deployment failed. Correlation ID: ${cds.context.id}`
+      if (logs) message += `, Logs:\n${logs}`
+      else if (error?.message) message += `. ${error.message}`
+      throw new Error(message, { cause: error })
+    } finally {
+      LOG.info(`deployed ${tenant} in ${((Date.now() - started) / 1000).toFixed(2)}s`)
+    }
+
+  } finally {
+    DEBUG?.('-------------[END HDI-DEPLOY-OUTPUT]----------------')
+    safeStream.end()
+    LOG.info('written deployment logs', { to: logPath })
+  }
+}
+/**
+ *
+ * @param {String} t tenant
+ * @param {Object} container container credentials
+ * @param {Object} options only contains HDI_DEPLOY_OPTIONS
+ * @param {Object} deployEnv custom environment variables
+ * @returns environment variables for HDI deployment
+ */
+exports._hdi_env4 = async (t,container,options,deployEnv)=>{
+
+  let vcapFromFile
+  if (process.env.VCAP_SERVICES_FILE_PATH) {
+    try {
+      vcapFromFile = await fs.read(process.env.VCAP_SERVICES_FILE_PATH, 'utf-8')
+    } catch (e) {
+      LOG.warn(`Could not read or parse VCAP_SERVICES_FILE_PATH at ${process.env.VCAP_SERVICES_FILE_PATH}: ${e.message}`)
+    }
+  }
+
+  const env = {
+    ..._clean_env(process.env),
+    TARGET_CONTAINER:t,
+    SERVICE_REPLACEMENTS: process.env.SERVICE_REPLACEMENTS,
+    APPLICATION_ID: process.env.APPLICATION_ID,
+    APPLICATION_VERSION_INFO: process.env.APPLICATION_VERSION_INFO,
+    DEPLOY_ID: process.env.DEPLOY_ID,
+    ...deployEnv // Although VCAP is in here, it will be overwritten
+  }
+
+  const vcapEnv = vcapFromFile ? { VCAP_SERVICES: vcapFromFile } : process.env
+  const { hana=[], 'user-provided':up=[] } = _parse_env (vcapEnv, 'VCAP_SERVICES')
+  const { hana: customEnvHana=[], 'user-provided':customEnvUp=[] } = _parse_env(deployEnv ?? {}, 'VCAP_SERVICES')
+
+  const vcapFromEnv = {
+    hana:[ { ...container, name:t, tenant_id:t }, ...hana, ...customEnvHana ],
+    'user-provided': [ ...up, ...customEnvUp ]
+  }
+  const emulatedVcap = _emulated_vcap_services()
+  env.VCAP_SERVICES = JSON.stringify ({ ...vcapFromEnv, ...emulatedVcap})
+
+  env.HDI_DEPLOY_OPTIONS = JSON.stringify(_parse_env(process.env, 'HDI_DEPLOY_OPTIONS', options))
+  delete env.VCAP_SERVICES_FILE_PATH
+  return env
+}
+
+async function _deploy(cwd, env, io = {}) {
+  if (!existsSync(cwd)) throw new Error(`Content directory ${cwd} does not exist.`)
+
+  const hdiOptions = _parse_env(env, 'HDI_DEPLOY_OPTIONS')
+  const credentials = _credentials4(env)
+  const schema = credentials?.schema
+  if (!schema) throw new Error('No HDI schema found in target credentials.')
+
+  _stdout(io, `Target schema: ${schema}`)
+
+  const apiSchema = _api_schema(schema)
+
+  const needStatus = !hdiOptions.treat_unmodified_as_modified
+  const optimiseFileUpload = hdiOptions.optimise_file_upload !== false
+  const connecting = _connect(credentials)
+  const discovering = _content4(cwd)
+  let client
+  const tables = new Set()
+
+  try {
+    const [connected, content] = await Promise.all([connecting, discovering])
+    client = connected
+    const localFiles = content.files.map(file => file.path)
+    const statusRows = optimiseFileUpload
+      ? await _syncDelta(client, apiSchema, content, tables, io)
+      : await _syncAll(client, apiSchema, content, tables, needStatus, io)
+
+    const deployPaths = _deploy4(localFiles, statusRows, hdiOptions)
+    const undeploy = await _undeploy4(cwd, statusRows, hdiOptions)
+
+    await _fill(client, apiSchema, '#DEPLOY_PATHS', deployPaths.map(path => [path]), tables)
+    await _fill(client, apiSchema, '#UNDEPLOY_PATHS', undeploy.map(path => [path]), tables)
+    await _fill(client, apiSchema, '#PATH_PARAMETERS', [], tables)
+    await _fill(client, apiSchema, '#PARAMETERS', _parameters4(hdiOptions), tables)
+
+    const make = await _call(client,
+      `call ${apiSchema}.MAKE(${apiSchema}.#DEPLOY_PATHS, ${apiSchema}.#UNDEPLOY_PATHS, ${apiSchema}.#PATH_PARAMETERS, ${apiSchema}.#PARAMETERS, ?, ?, ?)`)
+    _throw_on_failure('MAKE', make)
+    _logMessages(make.messages, io)
+  } finally {
+    const [connection] = await Promise.allSettled([connecting])
+    await _disconnect(client ?? connection.value)
+  }
+}
+
+async function _syncDelta(client, schema, content, tables, io) {
+  if (content.roots.length === 0) return []
+
+  const cache = { bytes: 0 }
+  const hashing = _mapLimit(content.files, HASH_CONCURRENCY, async file => ({ ...file, ...await _fingerprint(file.abs, cache) }))
+
+  await _fill(client, schema, '#PATHS', [['/']], tables)
+  await _fill(client, schema, '#PARAMETERS', [['RECURSIVE', 'TRUE']], tables)
+  const listed = await _call(client, `call ${schema}.LIST_DEPLOYED(${schema}.#PATHS, ${schema}.#PARAMETERS, ?, ?, ?, ?)`)
+  _throw_on_failure('LIST_DEPLOYED', listed)
+
+  const localFiles = await hashing
+  const localPaths = new Set([...content.directories, ...localFiles.map(file => file.path)])
+  const remoteRows = (listed.results ?? []).map(_normalizeMetadata).filter(row => row.path)
+  const remoteByPath = new Map(remoteRows.map(row => [row.path, row]))
+  const statusRows = localFiles.map(file => {
+    const remote = remoteByPath.get(file.path)
+    const status = !remote ? 'A' : remote.sha256?.toLowerCase() === file.sha256 ? 'U' : 'M'
+    return { path: file.path, status }
+  })
+  const deleted = remoteRows.filter(row => !_isDir(row.path) && !localPaths.has(row.path))
+  statusRows.push(...deleted.map(row => ({ path: row.path, status: 'D' })))
+
+  await _delete(client, schema, deleted.map(row => row.path), tables, io)
+
+  const changed = new Set(statusRows.filter(row => row.status === 'A' || row.status === 'M').map(row => row.path))
+  const directories = content.directories.filter(path => !remoteByPath.has(path))
+  const files = localFiles.filter(file => changed.has(file.path))
+  await _write(client, schema, directories, files, tables, io)
+
+  return statusRows
+}
+
+async function _syncAll(client, schema, content, tables, needStatus, io) {
+  await _delete(client, schema, content.roots, tables, io, true)
+  await _write(client, schema, content.directories, content.files, tables, io)
+
+  if (!needStatus || content.roots.length === 0) return []
+  await _fill(client, schema, '#PATHS', content.roots.map(path => [path]), tables)
+  await _fill(client, schema, '#PARAMETERS', [], tables)
+  const status = await _call(client, `call ${schema}.STATUS(${schema}.#PATHS, ${schema}.#PARAMETERS, ?, ?, ?, ?)`)
+  _throw_on_failure('STATUS', status)
+  return (status.results ?? []).map(_normalizeStatus)
+}
+
+async function _delete(client, schema, paths, tables, io, recursive = false) {
+  if (paths.length === 0) return
+
+  await _fill(client, schema, '#PATHS', paths.map(path => [path]), tables)
+  await _fill(client, schema, '#PARAMETERS', [
+    ...(recursive ? [['RECURSIVE', 'TRUE']] : []),
+    ['IGNORE_NON_EXISTING_PATHS', 'TRUE']
+  ], tables)
+  const result = await _call(client, `call ${schema}.DELETE(${schema}.#PATHS, ${schema}.#PARAMETERS, ?, ?, ?)`)
+  _throw_on_failure('DELETE', result)
+  _logMessages(result.messages, io)
+}
+
+async function _write(client, schema, directories, files, tables, io) {
+  if (directories.length === 0 && files.length === 0) return
+
+  const sizedFiles = await _mapLimit(files, HASH_CONCURRENCY, async file =>
+    file.size === undefined ? { ...file, size: (await fsp.stat(file.abs)).size } : file)
+  await _fillContent(client, schema, directories, sizedFiles, tables)
+  await _fill(client, schema, '#PARAMETERS', [], tables)
+  const result = await _call(client, `call ${schema}.WRITE(${schema}.#PATHS_CONTENT, ${schema}.#PARAMETERS, ?, ?, ?)`)
+  _throw_on_failure('WRITE', result)
+  _logMessages(result.messages, io)
+}
+
+const _HELPER_TABLES = {
+  '#PARAMETERS': { type: 'TT_PARAMETERS', fields: ['KEY', 'VALUE'] },
+  '#PATHS': { type: 'TT_FILESFOLDERS', fields: ['PATH'] },
+  '#PATHS_CONTENT': { type: 'TT_FILESFOLDERS_CONTENT', fields: ['PATH', 'CONTENT'] },
+  '#DEPLOY_PATHS': { type: 'TT_FILESFOLDERS', fields: ['PATH'] },
+  '#UNDEPLOY_PATHS': { type: 'TT_FILESFOLDERS', fields: ['PATH'] },
+  '#PATH_PARAMETERS': { type: 'TT_FILESFOLDERS_PARAMETERS', fields: ['PATH', 'KEY', 'VALUE'] }
+}
+
+function _api_schema(schema) {
+  return `"${schema.replace(/"/g, '""')}#DI"`
+}
+
+async function _connect(credentials) {
+  const normalized = _normalize_credentials(credentials)
+  const raw = require('hdb').createClient(normalized)
+  await new Promise((resolve, reject) => raw.connect(error => error ? reject(error) : resolve()))
+  return { raw }
+}
+
+async function _disconnect(client) {
+  if (!client?.raw) return
+  await new Promise(resolve => {
+    try {
+      client.raw.end()
+    } finally {
+      resolve()
+    }
+  })
+}
+
+function _normalize_credentials(credentials) {
+  const normalized = { ...credentials }
+  normalized.user = credentials.hdi_user ?? credentials.hdiUser ?? credentials.user
+  normalized.password = credentials.hdi_user || credentials.hdiUser ? (credentials.hdi_password ?? credentials.hdiPassword) : credentials.password
+
+  const db_hosts = credentials.db_hosts ?? credentials.dbhosts
+  if (Array.isArray(db_hosts)) {
+    normalized.hosts = db_hosts.map(entry => ({ ...entry, port: entry.port ? `${entry.port}` : entry.port }))
+  } else if (credentials.host) {
+    normalized.host = credentials.host
+    if (credentials.port) normalized.port = credentials.port
+  }
+
+  if (credentials.certificate) normalized.ca = Array.isArray(credentials.certificate) ? credentials.certificate : [credentials.certificate]
+  if (credentials.hostname_in_certificate) normalized.sslHostNameInCertificate = credentials.hostname_in_certificate
+  if (credentials.validate_certificate !== undefined && credentials.validate_certificate !== null) {
+    normalized.sslValidateCertificate = credentials.validate_certificate
+  }
+
+  if (credentials.encrypt !== undefined && credentials.encrypt !== null) {
+    normalized.encrypt = credentials.encrypt
+    normalized.useTLS = credentials.encrypt
+  }
+
+  if (credentials.client_authentication_private_key) normalized.key = credentials.client_authentication_private_key
+  if (credentials.client_authentication_certificate) normalized.cert = credentials.client_authentication_certificate
+  if (normalized.key && normalized.cert) normalized.authenticationX509 = `${normalized.key}\n${normalized.cert}`
+
+  return normalized
+}
+
+async function _fill(client, schema, table, rows, createdTables) {
+  const helper = _HELPER_TABLES[table]
+  if (!helper) throw new Error(`Unknown helper table ${table}`)
+
+  await _resetHelperTable(client, schema, table, helper, createdTables)
+  if (!rows.length) return
+
+  const placeholders = helper.fields.map(() => '?').join(', ')
+  const sql = `insert into ${schema}.${table} (${helper.fields.join(', ')}) values (${placeholders})`
+  const statement = await _prepare(client, sql)
+  try {
+    await _run(statement, rows)
+  } finally {
+    await _drop(statement)
+  }
+}
+
+async function _fillContent(client, schema, directories, files, createdTables) {
+  const table = '#PATHS_CONTENT'
+  const helper = _HELPER_TABLES[table]
+  await _resetHelperTable(client, schema, table, helper, createdTables)
+
+  const sql = `insert into ${schema}.${table} (${helper.fields.join(', ')}) values (?, ?)`
+  const statement = await _prepare(client, sql)
+  let batch = []
+  let bytes = 0
+
+  const flush = async () => {
+    if (batch.length === 0) return
+    const rows = await _mapLimit(batch, HASH_CONCURRENCY, async item => [
+      item.path,
+      item.content ?? (item.abs ? await fsp.readFile(item.abs) : Buffer.alloc(0))
+    ])
+    await _run(statement, rows)
+    batch = []
+    bytes = 0
+  }
+
+  try {
+    for (const path of directories) {
+      batch.push({ path })
+      if (batch.length >= WRITE_BATCH_ROWS) await flush()
+    }
+
+    for (const file of files) {
+      if (file.size > STREAM_THRESHOLD_BYTES) {
+        await flush()
+        await _run(statement, [file.path, createReadStream(file.abs)])
+        continue
+      }
+
+      if (batch.length >= WRITE_BATCH_ROWS || bytes + file.size > WRITE_BATCH_BYTES) await flush()
+      batch.push(file)
+      bytes += file.size
+    }
+    await flush()
+  } finally {
+    await _drop(statement)
+  }
+}
+
+async function _resetHelperTable(client, schema, table, helper, createdTables) {
+  if (createdTables.has(table)) {
+    await _exec(client, `truncate table ${schema}.${table}`)
+  } else {
+    await _exec(client, `create local temporary column table ${schema}.${table} like _SYS_DI.${helper.type}`)
+    createdTables.add(table)
+  }
+}
+
+async function _call(client, sql, params = {}) {
+  const statement = await _prepare(client, sql)
+  try {
+    const [parameters, messages, results] = await _run(statement, params)
+    return {
+      parameters: parameters ?? {},
+      messages: messages ?? [],
+      results: results ?? []
+    }
+  } finally {
+    await _drop(statement)
+  }
+}
+
+async function _prepare(client, sql) {
+  return new Promise((resolve, reject) => {
+    client.raw.prepare(sql, (error, statement) => error ? reject(error) : resolve(statement))
+  })
+}
+
+async function _drop(statement) {
+  if (typeof statement?.drop !== 'function') return
+  await new Promise(resolve => statement.drop(() => resolve()))
+}
+
+async function _run(statement, params) {
+  return new Promise((resolve, reject) => {
+    statement.exec(params, (error, ...result) => error ? reject(error) : resolve(result))
+  })
+}
+
+async function _exec(client, sql) {
+  return new Promise((resolve, reject) => {
+    client.raw.exec(sql, (error, result) => error ? reject(error) : resolve(result))
+  })
+}
+
+function _throw_on_failure(op, result) {
+  const rc = result?.parameters?.RETURN_CODE
+  if (typeof rc === 'number' && rc < 0) {
+    const error = new Error(`${op} failed`)
+    error.result = { ...result, exitCode: rc }
+    throw error
+  }
+}
+
+function _clean_env(env) {
+  const copy = { ...env }
+  for (const key of _DEPLOYER_ENV_KEYS) delete copy[key]
+  return copy
+}
+
+function _credentials4(env) {
+  const target = _targetContainer4(env)
+  const vcap = _parse_env(env, 'VCAP_SERVICES')
+  const hana = _hanaServices(vcap)
+
+  if (target) {
+    const byName = hana.find(service => service.name === target)
+    if (byName?.credentials) return byName.credentials
+  }
+
+  if (hana.length === 0) {
+    throw new Error('No HANA service definition found for deployment target.')
+  }
+
+  if (hana.length === 1) return hana[0].credentials
+
+  const hdi = hana.filter(service => service.plan === 'hdi-shared' || service?.credentials?.hdi_user || service?.credentials?.hdiUser)
+  if (hdi.length === 1) return hdi[0].credentials
+
+  throw new Error('More than one HANA service definition found, but no unique deployment target could be resolved.')
+}
+
+function _targetContainer4(env) {
+  if (!env.TARGET_CONTAINER) return env.TARGET_CONTAINER
+
+  const replacements = _parse_env(env, 'SERVICE_REPLACEMENTS')
+  if (Array.isArray(replacements)) {
+    const replacement = replacements.find(entry => entry?.key === env.TARGET_CONTAINER)
+    if (replacement?.service) return replacement.service
+  }
+  return env.TARGET_CONTAINER
+}
+
+function _hanaServices(vcap) {
+  const services = []
+  for (const [label, entries] of Object.entries(vcap ?? {})) {
+    if (!Array.isArray(entries)) continue
+    for (const service of entries) {
+      if (!service?.credentials) continue
+      const tags = service.tags ?? service.credentials.tags ?? []
+      const isHana = label === 'hana' || tags.includes('hana') || service.plan === 'hdi-shared' || service.credentials.hdi_user || service.credentials.hdiUser
+      if (isHana) services.push(service)
+    }
+  }
+  return services
+}
+
+async function _content4(cwd) {
+  const roots = []
+  const directories = []
+  const files = []
+
+  for (const root of ['src', 'cfg', 'lib'].map(_toPosix)) {
+    const dir = join(cwd, root)
+    if (!existsSync(dir)) continue
+    roots.push(_asDir(root))
+    await _collect(dir, root, directories, files)
+  }
+
+  directories.sort()
+  files.sort((a, b) => a.path.localeCompare(b.path))
+
+  return {
+    roots,
+    directories,
+    files
+  }
+}
+
+function _normalizeStatus(row) {
+  return {
+    path: row.path ?? row.PATH,
+    status: row.status ?? row.STATUS
+  }
+}
+
+function _normalizeMetadata(row) {
+  return {
+    path: row.path ?? row.PATH,
+    sha256: row.sha256 ?? row.SHA256
+  }
+}
+
+async function _fingerprint(file, cache) {
+  const hash = createHash('sha256')
+  const chunks = []
+  let size = 0
+  let cached = 0
+  for await (const chunk of createReadStream(file)) {
+    hash.update(chunk)
+    size += chunk.length
+    if (size <= STREAM_THRESHOLD_BYTES && cache.bytes + chunk.length <= FILE_CACHE_BYTES) {
+      chunks.push(chunk)
+      cache.bytes += chunk.length
+      cached += chunk.length
+    } else if (chunks.length > 0) {
+      cache.bytes -= cached
+      chunks.length = 0
+    }
+  }
+  return {
+    sha256: hash.digest('hex'),
+    size,
+    content: chunks.length > 0 || size === 0 ? Buffer.concat(chunks, size) : undefined
+  }
+}
+
+async function _mapLimit(items, concurrency, mapper) {
+  const result = new Array(items.length)
+  let next = 0
+
+  await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, async () => {
+    while (next < items.length) {
+      const index = next++
+      result[index] = await mapper(items[index], index)
+    }
+  }))
+
+  return result
+}
+
+async function _collect(abs, rel, directories, files) {
+  directories.push(_asDir(_toPosix(rel)))
+
+  for (const entry of await fsp.readdir(abs, { withFileTypes: true })) {
+    if (entry.name === '.gitignore') continue
+
+    const childAbs = join(abs, entry.name)
+    const childRel = _toPosix(join(rel, entry.name))
+
+    if (entry.isDirectory()) {
+      await _collect(childAbs, childRel, directories, files)
+      continue
+    }
+
+    if (entry.isFile()) {
+      files.push({ abs: childAbs, path: _deployPath(childRel) })
+    }
+  }
+}
+
+function _deployPath(file) {
+  if (file.endsWith('.hdbsynonymtemplate')) {
+    return file.replace(/\.hdbsynonymtemplate$/, '.hdbsynonymconfig')
+  }
+  return file
+}
+
+async function _undeploy4(cwd, statusRows, options) {
+  const deletedFiles = statusRows
+    .filter(({ status, path }) => status === 'D' && !_isDir(path))
+    .map(({ path }) => path)
+  const deployedState = new Set(statusRows.map(({ path }) => path).filter(path => path && !_isDir(path)))
+
+  const explicitUndeploy = _explicitUndeploy4(options)
+  if (deletedFiles.length === 0) return explicitUndeploy
+  if (options.auto_undeploy) return deletedFiles
+
+  const undeployJson = join(cwd, 'undeploy.json')
+  if (!existsSync(undeployJson)) return explicitUndeploy
+
+  const config = JSON.parse(await fsp.readFile(undeployJson, 'utf-8'))
+  if (!Array.isArray(config)) return explicitUndeploy
+
+  const allowedDeleted = deletedFiles.filter(file => config.some(pattern => _matches(file, _toPosix(pattern))))
+  const explicitAllowed = explicitUndeploy.filter(file => !deployedState.has(file) || config.some(pattern => _matches(file, _toPosix(pattern))))
+  return [...new Set([...allowedDeleted, ...explicitAllowed])]
+}
+
+function _deploy4(localFiles, statusRows, options) {
+  let deployFiles = statusRows
+    .filter(({ status, path }) => (status === 'A' || status === 'M') && path && !_isDir(path))
+    .map(({ path }) => path)
+
+  if (options.treat_unmodified_as_modified) {
+    deployFiles = [...localFiles]
+  }
+
+  const explicitDeploy = _explicitDeploy4(options)
+  return [...new Set([...deployFiles, ...explicitDeploy])]
+}
+
+function _explicitDeploy4(options) {
+  const explicit = options?.deploy
+  if (!explicit) return []
+  if (Array.isArray(explicit)) return explicit
+  if (Array.isArray(explicit.files)) return explicit.files
+  return Object.keys(explicit.files ?? {})
+}
+
+function _explicitUndeploy4(options) {
+  const explicit = options?.undeploy
+  if (!explicit) return []
+  if (Array.isArray(explicit)) return explicit
+  if (Array.isArray(explicit.files)) return explicit.files
+  return Object.keys(explicit.files ?? {})
+}
+
+function _matches(file, pattern) {
+  if (typeof matchesGlob === 'function') return matchesGlob(file, pattern)
+
+  const esc = str => str.replace(/[.+^${}()|[\]\\]/g, '\\$&')
+  const re = '^' + esc(pattern)
+    .replace(/\\\*\\\*/g, '\\u0000')
+    .replace(/\\\*/g, '[^/]*')
+    .replace(/\\u0000/g, '.*') + '$'
+  return new RegExp(re).test(file)
+}
+
+function _parameters4(options) {
+  const params = []
+
+  const addBool = (key, value) => {
+    if (value === true) params.push([key, 'TRUE'])
+    else if (value === false) params.push([key, 'FALSE'])
+  }
+
+  addBool('STOP_ON_ERROR', options.stop_on_error)
+  addBool('TREAT_WARNINGS_AS_ERRORS', options.treat_warnings_as_errors)
+  addBool('SIMULATE_MAKE', options.simulate_make)
+  addBool('VALIDATE_EXTERNAL_DEPENDENCIES', options.validate_external_dependencies)
+
+  if (options.migrationtable_development_mode) {
+    params.push(['COM.SAP.HANA.DI.TABLE.MIGRATION/DEVELOPMENT_MODE', 'TRUE'])
+  }
+
+  for (const [key, value] of Object.entries(options.parameter ?? {})) {
+    params.push([key.toUpperCase(), `${value}`])
+  }
+
+  return params
+}
+
+function _logMessages(messages, io) {
+  for (const message of messages ?? []) {
+    const severity = (message.SEVERITY ?? message.severity ?? 'INFO').toUpperCase()
+    const text = message.MESSAGE ?? message.message ?? JSON.stringify(message)
+
+    if (severity === 'ERROR') _stderr(io, `${severity}: ${text}`)
+    else _stdout(io, `${severity}: ${text}`)
+  }
+}
+
+function _stdout(io, text) {
+  io.stdoutCB?.(Buffer.from(text + '\n'))
+}
+
+function _stderr(io, text) {
+  io.stderrCB?.(Buffer.from(text + '\n'))
+}
+
+function _isDir(path) {
+  return typeof path === 'string' && path.endsWith('/')
+}
+
+function _asDir(path) {
+  return path.endsWith('/') ? path : `${path}/`
+}
+
+function _toPosix(path) {
+  return path.split(sep).join(posix.sep)
+}
+
+// TODO remove with next major release, deepMerge is now available via cds.utils.merge with cds 9 only
+const _merge = merge ?? deepMerge
+
+const _parse_env = (env, key, options) => {
+  const val = env[key]; if (!val) return { ...options }
+  try {
+    const parsed = typeof val === 'string' ? JSON.parse(val) : val
+    return _merge(parsed, options)
+  } catch (e) {
+    e.message = `Invalid ${key} options: ${e.message} ${val}`
+    e.code = e.statusCode = 400
+    throw e
+  }
+}
+
+/**
+  * Build VCAP_SERVICES for compatibility (for example for CloudSDK) or for running
+  * locally with credentials (hybrid mode).
+  * Copied from @sap/cds/lib/env/cds-env.js#L333
+  */
+function _emulated_vcap_services() {
+  const vcap_services = {}, names = new Set()
+  for (const service in cds.env.requires) {
+    let { vcap, credentials, binding } = cds.env.requires[service]
+    // "binding.vcap" is chosen over "vcap" because it is meta data resolved from the real service (-> cds bind)
+    if (binding && binding.vcap) vcap = binding.vcap
+    if (vcap && vcap.label && credentials && Object.keys(credentials).length > 0) {
+      // Only one entry for a (instance) name. Generate name from label and plan if not given.
+      const { label, plan } = vcap
+      const name = vcap.name || `instance:${label}:${plan || ""}`
+      if (names.has(name)) continue
+      names.add(name)
+
+      if (!vcap_services[label]) vcap_services[label] = []
+      vcap_services[label].push(Object.assign({ name }, vcap, { credentials }))
+    }
+  }
+  return vcap_services
+}