@sap/cds-dk 10.2.0 → 10.2.1

package/node_modules/@cap-js/asyncapi/lib/import/utils.js

@@ -0,0 +1,85 @@
+const messages = require('./message')
+
+function validateAsyncAPI(content) {
+    if ('channels' in content && 'components' in content && 'messages' in content.components) {
+        return
+    }
+
+    throw new Error(messages.INVALID_ASYNCAPI_FILE)
+}
+
+/**
+ * Accepted scenarios:
+ * * with version info : <namespace>.<businessObject>.<operation>.<version>
+ * * without version info : <namespace>.<businessObject>.<operation>
+ *
+ * ? Is it mandatory for <namespace> to always follow small case notation?
+ * ? Is it mandatory for <businessObject> to follow Camel Case or Upper Came Case notation?
+ *
+ * ToDo: Can we support `-` in operations?
+ */
+const regExp = new RegExp(
+    '^(?<namespace>(?:[a-z][a-z0-9]*)(?:[.][a-z][a-z0-9]*)+)[.](?<businessObject>[a-zA-Z0-9]+)[.](?<operation>[a-zA-Z0-9]+)[.]?(?<version>v(?:[0-9]|[1-9][0-9]*))?$'
+)
+
+/**
+ * Validates the messages' `key` with the regExp and returns the regEx groups.
+ * @returns regexGroups
+ */
+function getRegExpGroups(key) {
+    /**
+     * Result format:
+     * index 0: key
+     * index 1: <namespace> value
+     * index 2: <businessObject> value
+     * index 3: <operation> value
+     * index 4: <version> value; undefined if <version> is optional
+     */
+    const regExpGroups = regExp.exec(key)
+
+    if (regExpGroups == null) {
+        throw new Error(messages.INVALID_MESSAGE_NAME)
+    }
+    return regExpGroups
+}
+
+/**
+ * Parses a message name into a [fullName, serviceName] pair.
+ *
+ * Two formats are supported:
+ *
+ * 1. SAP event-catalog format: `<namespace>.<BusinessObject>.<Operation>[.v<n>]`
+ *    where <namespace> is ≥2 lowercase dot-separated segments (e.g. `sap.s4.beh`).
+ *    Detected by matching the strict regex; service key = namespace + '.' + businessObject.
+ *
+ * 2. CAP-produced format: `<ServiceName>.<EventName>` (optionally nested), where the
+ *    first segment is always the PascalCase CDS service name.
+ *    Detected by the presence of `x-sap-application-namespace` in the AsyncAPI document.
+ *
+ * @param {string} key - The message name to parse
+ * @param {string|undefined} applicationNamespace - Value of `x-sap-application-namespace`
+ *   from the AsyncAPI document, or undefined if absent
+ * @returns {Array} [fullName, serviceName]
+ */
+function parseMessageName(key, applicationNamespace) {
+    const regExpGroups = regExp.exec(key)
+    if (regExpGroups != null) {
+        const serviceKey = regExpGroups[1] + '.' + regExpGroups[2]
+        return [regExpGroups[0], serviceKey]
+    }
+
+    if (applicationNamespace) {
+        const segments = key.split('.')
+        if (segments.length >= 2) {
+            return [key, segments[0]]
+        }
+    }
+
+    throw new Error(messages.INVALID_MESSAGE_NAME)
+}
+
+module.exports = {
+    validateAsyncAPI,
+    getRegExpGroups,
+    parseMessageName
+}

package/node_modules/@cap-js/asyncapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cap-js/asyncapi",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "CAP tool for AsyncAPI",
   "repository": {
     "type": "git",
@@ -16,9 +16,14 @@
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",
   "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./cds-plugin": "./cds-plugin.js"
+  },
   "files": [
     "lib/",
     "index.js",
+    "cds-plugin.js",
     "LICENSE"
   ],
   "scripts": {
@@ -29,6 +34,89 @@
     "@sap/cds": ">=7.6"
   },
   "devDependencies": {
+    "@sap/cds-dk": "^10",
     "eslint": "^10.0.0"
+  },
+  "cds": {
+    "schema": {
+      "export": {
+        "asyncapi": {
+          "type": "object",
+          "description": "AsyncAPI settings for cds compile",
+          "additionalProperties": false,
+          "properties": {
+            "application_namespace": {
+              "type": "string",
+              "description": "The registered namespace of the application"
+            },
+            "merged": {
+              "type": "object",
+              "description": "properties that needs to be there when merged option is used",
+              "additionalProperties": false,
+              "properties": {
+                "title": {
+                  "type": "string",
+                  "description": "Title to be used for merged doc"
+                },
+                "version": {
+                  "type": "string",
+                  "description": "Version to be used for merged doc"
+                },
+                "short_text": {
+                  "type": "string",
+                  "description": "Short description of the AsyncAPIs"
+                },
+                "description": {
+                  "type": "string",
+                  "description": "Description to be used for the merged doc"
+                }
+              }
+            },
+            "event_spec_version": {
+              "type": "string",
+              "description": "Mentions the version of AsyncAPI spec"
+            },
+            "event_source": {
+              "type": "string",
+              "description": "Event source information",
+              "default": "{region}/{applicationNamespace}/{instanceId}"
+            },
+            "event_source_params": {
+              "type": "object",
+              "description": "Parameters related to the source of event",
+              "default": {
+                "region": "the region",
+                "applicationNamespace": "the namespace",
+                "instanceId": "the instance id"
+              },
+              "additionalProperties": false,
+              "properties": {
+                "region": {
+                  "type": "string",
+                  "description": "The regional context of the application"
+                },
+                "applicationNamespace": {
+                  "type": "string",
+                  "description": "The registered namespace of the application"
+                },
+                "instanceId": {
+                  "type": "string",
+                  "description": "The instance id (tenant, installation, ...) of the application."
+                }
+              }
+            },
+            "event_characteristics": {
+              "type": "object",
+              "description": "The characteristics defined for events",
+              "additionalProperties": true
+            }
+          }
+        }
+      },
+      "importFrom": {
+        "const": "asyncapi",
+        "description": "AsyncAPI specification"
+      }
+    }
   }
 }

package/node_modules/@sap/cds/CHANGELOG.md

@@ -4,6 +4,16 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 10.2.2 - 2026-10-28
+
+### Fixed
+
+- App index page no longer generates links with a double slash (e.g. `//bookshop`) for app links that already start with `/`
+- Prevent more than one concurrent `AMQP` client reconnect loop
+- Translation of messages in `sap-messages` header
+- Legacy event queue: `TimeoutOverflowWarning` no longer emitted when tasks are scheduled with a retention period exceeding 24.8 days (e.g. `cds.env.agents.retention = '31d'`)
+- CDS config JSON schema: corrected invalid/misplaced `additionalProperties` keywords so extra properties are validated as intended
+
 ## Version 10.2.1 - 2026-10-20
 
 ### Fixed

package/node_modules/@sap/cds/app/index.js

@@ -38,7 +38,7 @@ const app_info = {
     return find (folder, ['*.html', '*/*.html', '*/*/*.html'])
     .map (file => path.relative(folder,file).replace(/\\/g,'/'))
     .concat (cds.app._app_links||[]) // concatenate additional app links
-    .map (href => ({ href: '/'+href, label: href.replace('/index.html','') }))
+    .map (href => ({ href: href[0]==='/' ? href : '/'+href, label: href.replace('/index.html','') }))
   },
 
   get agents() {

package/node_modules/@sap/cds/lib/env/schemas/cds-package.js

@@ -17,8 +17,6 @@ module.exports = {
       type: 'string'
     },
     cds: {
-      type: 'object',
-      additionalProperties: true,
       $ref: 'cdsjsonschema://schemas/cds-rc.json#/$defs/cdsRoot',
       description: 'CDS configuration root',
       default: {}

package/node_modules/@sap/cds/lib/env/schemas/cds-rc.js

@@ -29,7 +29,7 @@ module.exports = {
 
   $defs: {
     cdsRoot: {
-      allowAdditionalProperties: true,
+      additionalProperties: true,
       patternProperties: {
         '\\[.+\\]': {
           default: {},
@@ -489,12 +489,12 @@ module.exports = {
                         create: {
                           type: 'object',
                           description: 'HDI container provisioning parameters.',
+                          additionalProperties: true,
                           properties: {
                             database_id: {
                               type: 'string',
                               description: 'HANA Cloud instance ID.'
-                            },
-                            additionalProperties: true
+                            }
                           }
                         },
                         bind: {

package/node_modules/@sap/cds/lib/env/schemas/index.js

@@ -1,12 +1,12 @@
-const { join } = require('path')
+const { join, parse } = require('node:path')
 
 module.exports = new class {
   async default4(name) {
-    const file = join(__dirname, name.replace(/\.\w+$/, ''))
+    const file = join(__dirname, parse(name).name)
     try {
       return structuredClone(require(file))
-    } catch {
-      throw new Error(`ENOENT: Could not load schema '${name}' from ${file}`)
+    } catch (e) {
+      throw new Error(`ENOENT: Could not load schema '${name}'`, { cause: e })
     }
   }
 }

package/node_modules/@sap/cds/lib/utils/cds-utils.js

@@ -203,20 +203,33 @@ exports.write = function write (file, data, o) {
 }
 
 const { setTimeout: sleep } = require('node:timers/promises')
-exports.lock = async function (file, retries = 10, delay = 20) {
+exports.lock = async function (file, retries = 10, delay = 20, stale = 5_000) {
   file = resolve (cds.root, file)
-  const { open, unlink } = fs.promises
-  for (let i = 0; i < retries; i++) try {
-    const handle = await open (file+'.lock', 'wx')
+  const lockfile = file + '.lock'
+  const { open, unlink, stat } = fs.promises
+  // `retries` bounds waits on a live lock and, independently, reclaim attempts:
+  // a stale reclaim or a vanished-lock race retries the acquire at once — so the
+  // final reclaim still gets a matching attempt — without spinning unbounded.
+  for (let waited = 0, reclaims = 0; ;) try {
+    const handle = await open (lockfile, 'wx')
     await handle.close()
-    return {release:() => unlink (file+'.lock') .catch (err => {
+    return {release:() => unlink (lockfile) .catch (err => {
       if (err.code !== 'ENOENT') throw err // ignore if already deleted
     })}
   } catch (err) {
-    if (err.code === 'EEXIST') await sleep (delay)
-    else throw err
+    if (err.code !== 'EEXIST') throw err
+    // Config edits normally complete quickly, so a lock older than `stale`
+    // likely belongs to a process that crashed mid-edit. A negative age means
+    // the lock vanished between the failed open and the stat — retry at once.
+    const age = await stat (lockfile) .then (s => Date.now() - s.mtimeMs, () => -1)
+    if (age < 0 || age > stale) {           // vanished, or stale → reclaim and retry now
+      if (age > stale) await unlink (lockfile) .catch (() => {})
+      if (reclaims++ < retries) continue
+    } else if (waited++ < retries) {        // held by a live process → wait and retry
+      await sleep (delay); continue
+    }
+    throw new Error (`Could not acquire lock on ${file}`, { cause: err })
   }
-  throw new Error('Could not acquire lock: connection timed out')
 }
 
 

package/node_modules/@sap/cds/libx/_runtime/messaging/common-utils/connections.js

@@ -10,45 +10,24 @@ const connect = (client, LOG, keepAlive) => {
   return new Promise((resolve, reject) => {
     _rmHandlers(client)
 
-    client
-      .once('connected', function () {
-        _rmHandlers(client)
-
-        // It's important to _always_ keep an error listener,
-        // otherwise it will throw and crash the server
-        client.on('error', err => LOG(err?.message))
-
-        if (keepAlive) {
-          client.on('disconnected', () => {
-            let connected = false
-            client.once('connected', () => {
-              LOG('Reconnected')
-              connected = true
-            })
-            let x = 1
-            const _untilConnected = async () => {
-              if (!connected) {
-                LOG('Reconnecting')
-                try {
-                  client.connect()
-                } catch {
-                  // we try again...
-                }
-                setTimeout(_untilConnected, waitingTime(x++)).unref()
-              }
-            }
-            _untilConnected()
-          })
-        }
-
-        resolve(client)
-      })
-      .once('error', err => {
-        _rmHandlers(client)
-        const e = new Error('Connection error')
-        e.cause = err
-        reject(e)
-      })
+    client.once('connected', function () {
+      _rmHandlers(client)
+
+      // It's important to _always_ keep an error listener,
+      // otherwise it will throw and crash the server
+      client.on('error', err => LOG(err?.message))
+
+      if (keepAlive) client.once('disconnected', reconnect(client, LOG))
+
+      resolve(client)
+    })
+
+    client.once('error', err => {
+      _rmHandlers(client)
+      const e = new Error('Connection error')
+      e.cause = err
+      reject(e)
+    })
 
     try {
       client.connect()
@@ -58,6 +37,33 @@ const connect = (client, LOG, keepAlive) => {
   })
 }
 
+const reconnect = (client, LOG) => () => {
+  let connected = false
+  
+  client.once('connected', () => {
+    LOG('Reconnected')
+    connected = true
+    client.once('disconnected', reconnect(client, LOG))
+  })
+
+  let retries = 1
+  const _untilConnected = async () => {
+    if (!connected) {
+      LOG('Reconnecting')
+
+      try {
+        client.connect()
+      } catch {
+        // we try again ...
+      }
+
+      setTimeout(_untilConnected, waitingTime(retries++)).unref()
+    }
+  }
+
+  _untilConnected()
+}
+
 const disconnect = client => {
   return new Promise((resolve, reject) => {
     _rmHandlers(client)

package/node_modules/@sap/cds/libx/odata/ODataAdapter.js

@@ -111,7 +111,7 @@ class ODataAdapter extends HttpAdapter {
     if (res.headersSent || !cdsReq.messages?.length) return
     const messages = cdsReq.messages.map(err => {
       if (!err.code) err.code = '' // default to empty string if not provided
-      const { code, message, numericSeverity, longtextUrl, target, additionalTargets } = this.normalized(err)
+      const { code, message, numericSeverity, longtextUrl, target, additionalTargets } = this.localized(this.normalized(err))
       // only return allowed subset of properties
       return { code, message, numericSeverity, longtextUrl, target, additionalTargets }
     })

package/node_modules/@sap/cds/libx/queue/TaskRunner.js

@@ -4,6 +4,26 @@ const QUEUED = 'queued'
 const PLANNED = 'planned'
 const CALLBACKS = 'callbacks'
 
+// Node's setTimeout delay is a 32-bit signed int; delays > MAX_TIMEOUT_MS emit a
+// TimeoutOverflowWarning and fire almost immediately. Chain segments so the callback
+// fires at the correct time. Returns a handle with cancel() that always clears the
+// currently-active segment — not just the first — so re-plans work at any point in the chain.
+const MAX_TIMEOUT_MS = 2 ** 31 - 1
+const _setLongTimeout = (cb, delay) => {
+  const deadline = Date.now() + delay
+  const handle = {}
+  const schedule = () => {
+    // Re-derive the step from the absolute deadline each segment, so lateness in one
+    // segment (process suspension, blocked event loop) doesn't compound across the chain.
+    const remaining = deadline - Date.now()
+    const step = Math.min(Math.max(remaining, 0), MAX_TIMEOUT_MS)
+    const t = setTimeout(remaining > MAX_TIMEOUT_MS ? schedule : cb, step).unref()
+    handle.cancel = () => clearTimeout(t)
+  }
+  schedule()
+  return handle
+}
+
 module.exports = class TaskRunner {
   constructor() {
     this.states = new Map()
@@ -49,11 +69,8 @@ module.exports = class TaskRunner {
     const newDate = Date.now() + waitingTime
     const alreadyPlanned = this._getStateProp(PLANNED, { name, tenant })
     if (!alreadyPlanned || alreadyPlanned.date > newDate) {
-      if (alreadyPlanned) clearInterval(alreadyPlanned.timer)
-      const timer = setTimeout(
-        () => (this._setStateProp(PLANNED, undefined, { name, tenant }), cb()),
-        waitingTime
-      ).unref()
+      if (alreadyPlanned) alreadyPlanned.timer.cancel()
+      const timer = _setLongTimeout(() => (this._setStateProp(PLANNED, undefined, { name, tenant }), cb()), waitingTime)
       this._setStateProp(PLANNED, { date: newDate, timer }, { name, tenant })
     }
   }

package/node_modules/@sap/cds/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "10.2.1",
+  "version": "10.2.2",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-mtxs/CHANGELOG.md

@@ -6,6 +6,14 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 4.2.1 - 2026-10-28
+
+### Fixed
+
+- Extensibility login now falls back to XSUAA when required IAS login metadata is unavailable, instead of using provider IAS metadata for an unresolved subscriber.
+- `cds.xt.DeploymentService` now reuses extracted HANA deployment resources across tenant subscriptions when extensibility is disabled.
+- Database and CSN compilation errors during HANA tenant upgrades now fail only the affected tenant instead of shutting down the server and stopping the entire upgrade job.
+
 ## Version 4.2.0 - 2026-10-21
 
 ### Added

package/node_modules/@sap/cds-mtxs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-mtxs",
-  "version": "4.2.0",
+  "version": "4.2.1",
   "description": "SAP Cloud Application Programming Model - Multitenancy library",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [

package/node_modules/@sap/cds-mtxs/srv/extensibility-service.js

@@ -443,12 +443,15 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
     cds.on('served', () => {
       cds.app?.post('/-/cds/login/grant', express.urlencoded({ extended: false }), async (req, res) => {
         try {
-          const cred = cds.env.requires.auth.credentials || {}
-          if (!cred.clientid) throw cds.error('missing authentication service binding', { status: 500 })
-
           const query = req.body || {}
+          const meta = _isIas() ? await _iasMetadata(query) : undefined
+           if (!meta && _isIas() && typeof query.authorization_code === 'string') {
+            throw cds.error('IAS login metadata is unavailable', { status: 503 })
+          }
+          const cred = meta ? cds.env.requires.auth.credentials : _xsuaaCredentials()
+          if (!cred.clientid) throw cds.error('missing authentication service binding', { status: 500 })
 
-          const raw = _isIas() ? await _iasGrant(cred, query) : await _xsuaaGrant(cred, query)
+          const raw = meta ? await _iasGrant(cred, query, meta) : await _xsuaaGrant(cred, query)
           const data = JSON.parse(raw)
           if (data.error) return res.status(401).json(data)
           res.json(data)
@@ -542,6 +545,13 @@ function _isIas() {
   return cds.env.requires?.auth?.kind === 'ias'
 }
 
+function _xsuaaCredentials() {
+  const auth = cds.env.requires?.auth
+  const cred = _isIas() ? cds.env.requires[auth.xsuaa || 'xsuaa']?.credentials : auth?.credentials
+  if (!cred) throw cds.error('missing XSUAA service binding', { status: 500 })
+  return cred
+}
+
 // XSUAA login: exchange passcode or refresh_token for a token with the
 // `<xsappname>.cds.ExtensionDeveloper` scope.
 async function _xsuaaGrant(cred, query) {
@@ -556,11 +566,12 @@ async function _xsuaaGrant(cred, query) {
   return authToken(cred, { form, subdomain: query.subdomain })
 }
 
-// Resolves the subscriber's IAS login target: `app_tid` (request → subscriber by subdomain
-// → provider binding) and the subscriber's IAS `tenantHost` (undefined → provider host).
+// A requested subscriber must have its own IAS tenant; never substitute the provider.
+// Without a subdomain, use the explicit app_tid or provider binding.
 async function _iasLoginTarget(cred, query = {}) {
   const subdomain = typeof query.subdomain === 'string' ? query.subdomain : undefined
   const tenant = subdomain ? await _subscriberTenant(subdomain, cred) : undefined
+  if (subdomain && (!tenant?.app_tid || !tenant?.tenantHost)) return {}
   const app_tid =
     (typeof query.app_tid === 'string' && query.app_tid) ||
     tenant?.app_tid ||
@@ -621,14 +632,13 @@ async function _subscriberTenant(subdomain, cred) {
 
 // IAS login: exchange the authorization_code (browser PKCE flow) or a refresh_token
 // for a token. Authorization as `cds.ExtensionDeveloper` comes from AMS policies, not scopes.
-async function _iasGrant(cred, query) {
+async function _iasGrant(cred, query, meta) {
   const refresh_token = typeof query.refresh_token === 'string' ? query.refresh_token : undefined
   const code = typeof query.authorization_code === 'string' ? query.authorization_code : undefined
   if (!refresh_token && !code)
     throw cds.error('missing authorization_code or refresh_token', { status: 400 })
 
-  // Redeem the code at the (consumer) tenant that issued it; fall back to the provider host.
-  const { app_tid, tenantHost } = await _iasLoginTarget(cred, query)
+  const { app_tid, token_endpoint } = meta
 
   const form = refresh_token
     ? { grant_type: 'refresh_token', refresh_token }
@@ -640,42 +650,49 @@ async function _iasGrant(cred, query) {
       }
   if (app_tid) form.app_tid = app_tid
 
-  // mTLS via the provider's X509 client; host is the consumer tenant when resolved, else
-  // the fixed provider host (no `subdomain`).
-  return authToken(cred, tenantHost
-    ? { form, endpoint: `https://${tenantHost}${IAS_TOKEN_PATH}` }
-    : { form, path: IAS_TOKEN_PATH })
+  return authToken(cred, { form, endpoint: token_endpoint })
 }
 
-async function authMeta(req, res) {
+async function _iasMetadata(query = {}) {
   const cred = cds.env.requires?.auth?.credentials || {}
   try {
-    if (_isIas()) {
-      // Redirect the browser to the subscriber's own IAS tenant; fall back to the provider host.
-      const { app_tid, tenantHost } = await _iasLoginTarget(cred, req.query || {})
-      const meta = {
-        flow: 'authorization_code',
-        pkce: true,
-        client_id: cred.clientid,
-        scope: 'openid',
-        authorization_endpoint: tenantHost ? `https://${tenantHost}${IAS_AUTHORIZE_PATH}` : iasAuthorizeUrl(cred),
-        token_endpoint: tenantHost ? `https://${tenantHost}${IAS_TOKEN_PATH}` : iasTokenUrl(cred),
-        ...(app_tid && { app_tid }) // sent on both authorize and token
-      }
-      DEBUG?.('IAS login metadata:', {
-        client_id: meta.client_id,
-        requested_subdomain: req.query?.subdomain,
-        app_tid: meta.app_tid,
-        binding_app_tid: cred.app_tid || cred.appTid || cred.zone_uuid,
-        tenant_host: tenantHost,
-        authorization_endpoint: meta.authorization_endpoint,
-        token_endpoint: meta.token_endpoint,
-        binding_url: cred.url,
-        binding_certurl: cred.certurl
-      })
-      return res.send(meta)
+    const { app_tid, tenantHost } = await _iasLoginTarget(cred, query)
+    if (typeof cred.clientid !== 'string' || !cred.clientid.trim() ||
+        typeof app_tid !== 'string' || !app_tid.trim()) return undefined
+    const meta = {
+      flow: 'authorization_code',
+      pkce: true,
+      client_id: cred.clientid,
+      scope: 'openid',
+      authorization_endpoint: tenantHost ? `https://${tenantHost}${IAS_AUTHORIZE_PATH}` : iasAuthorizeUrl(cred),
+      token_endpoint: tenantHost ? `https://${tenantHost}${IAS_TOKEN_PATH}` : iasTokenUrl(cred),
+      app_tid // sent on both authorize and token
     }
-    res.send({ passcode_url: _passcodeUrl(cred, req.query?.subdomain) })
+    for (const endpoint of [meta.authorization_endpoint, meta.token_endpoint]) {
+      if (new URL(endpoint).protocol !== 'https:') return undefined
+    }
+    DEBUG?.('IAS login metadata:', {
+      client_id: meta.client_id,
+      requested_subdomain: query.subdomain,
+      app_tid: meta.app_tid,
+      binding_app_tid: cred.app_tid || cred.appTid || cred.zone_uuid,
+      tenant_host: tenantHost,
+      authorization_endpoint: meta.authorization_endpoint,
+      token_endpoint: meta.token_endpoint,
+      binding_url: cred.url,
+      binding_certurl: cred.certurl
+    })
+    return meta
+  } catch (err) {
+    DEBUG?.('Failed to resolve IAS login metadata; falling back to XSUAA:', err.message)
+    return undefined
+  }
+}
+
+async function authMeta(req, res) {
+  try {
+    const meta = _isIas() ? await _iasMetadata(req.query || {}) : undefined
+    res.send(meta || { passcode_url: _passcodeUrl(_xsuaaCredentials(), req.query?.subdomain) })
   } catch (err) {
     res.status(err.status || err.statusCode || 500).json({ error: err.message })
   }
@@ -715,4 +732,3 @@ const _decodeError = (activationError) => {
     return value
   })
 }
-