arc-1 0.9.27 → 1.0.0

package/dist/server/multi-target-catalog.d.ts

@@ -0,0 +1,33 @@
+/** Secret-safe reader and administrator views for the SAPTargets MCP tool. */
+import type { DestinationRegistry, TargetDescriptor } from './destination-registry.js';
+export declare const TARGET_CATALOG_DIAGNOSTIC_LIMIT = 50;
+export declare const TARGET_CATALOG_SHARED_AUTH_EXCEPTION_LIMIT = 8;
+export declare const TARGET_CATALOG_MAX_OFFSET = 1000000;
+export declare const TARGET_CATALOG_MAX_QUERY_LENGTH = 160;
+export interface TargetCatalogOptions {
+    admin: boolean;
+    query?: string;
+    offset?: number;
+    /** Passive process-local health only; this callback must never probe SAP. */
+    runtimeAuth?: (target: string) => {
+        status: string;
+        checkedAt?: string;
+    };
+}
+/**
+ * Build the role-sensitive SAPTargets result.
+ *
+ * Readers retain the deliberately small `{target, description}[]` response. Admins additionally
+ * receive registry state and diagnostics. To keep the default result practical at 100–256 targets,
+ * the unfiltered admin view includes details only for non-active destinations; accepted targets in
+ * the public list are active by definition. Supplying `query` includes matching active diagnostics,
+ * and `offset` pages the deterministically sorted, bounded diagnostic result.
+ * Destination URLs, credentials, tokens, certificates, and raw Cloud Connector location IDs are not
+ * retained by DestinationRegistry and cannot enter this result.
+ */
+export declare function buildTargetCatalog(registry: DestinationRegistry, options: TargetCatalogOptions): Record<string, unknown> | Array<{
+    target: string;
+    description: string;
+    identity: TargetDescriptor['identity'];
+}>;
+//# sourceMappingURL=multi-target-catalog.d.ts.map

package/dist/server/multi-target-catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-catalog.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-catalog.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,KAAK,EAAE,mBAAmB,EAAE,gBAAgB,EAAoB,MAAM,2BAA2B,CAAC;AAEzG,eAAO,MAAM,+BAA+B,KAAK,CAAC;AAClD,eAAO,MAAM,0CAA0C,IAAI,CAAC;AAC5D,eAAO,MAAM,yBAAyB,UAAY,CAAC;AACnD,eAAO,MAAM,+BAA+B,MAAM,CAAC;AAanD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAgCD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,CAAA;CAAE,CAAC,CAsFlH"}

package/dist/server/multi-target-catalog.js

@@ -0,0 +1,130 @@
+/** Secret-safe reader and administrator views for the SAPTargets MCP tool. */
+export const TARGET_CATALOG_DIAGNOSTIC_LIMIT = 50;
+export const TARGET_CATALOG_SHARED_AUTH_EXCEPTION_LIMIT = 8;
+export const TARGET_CATALOG_MAX_OFFSET = 1_000_000;
+export const TARGET_CATALOG_MAX_QUERY_LENGTH = 160;
+function targetMatches(target, query) {
+    return !query || target.target.toLowerCase().includes(query) || target.description.toLowerCase().includes(query);
+}
+function diagnosticMatches(entry, query) {
+    if (!query)
+        return true;
+    return [entry.destinationName, entry.target, entry.status, entry.code, entry.message, entry.description]
+        .filter((value) => typeof value === 'string')
+        .some((value) => value.toLowerCase().includes(query));
+}
+// `checking` is an ordinary in-flight canary, not an operator exception. Completed failures such
+// as `temporarily_unavailable` deliberately remain exceptional and visible to administrators.
+const NORMAL_SHARED_AUTH_STATES = new Set(['not_checked', 'checking', 'healthy']);
+function incrementStatus(counts, status) {
+    counts[status] = (counts[status] ?? 0) + 1;
+}
+function safeDiagnostic(entry) {
+    return {
+        destinationName: entry.destinationName,
+        target: entry.target,
+        status: entry.status,
+        code: entry.code,
+        message: entry.message,
+        description: entry.description,
+        type: entry.type,
+        proxyType: entry.proxyType,
+        sid: entry.sid,
+        client: entry.client,
+        language: entry.language,
+        hasCloudConnectorLocationId: entry.hasCloudConnectorLocationId,
+        arcConfig: entry.arcConfig,
+        requestedPolicy: entry.requestedPolicy,
+        effectivePolicy: entry.effectivePolicy,
+        limitedByInstance: entry.limitedByInstance,
+        warnings: entry.warnings,
+    };
+}
+/**
+ * Build the role-sensitive SAPTargets result.
+ *
+ * Readers retain the deliberately small `{target, description}[]` response. Admins additionally
+ * receive registry state and diagnostics. To keep the default result practical at 100–256 targets,
+ * the unfiltered admin view includes details only for non-active destinations; accepted targets in
+ * the public list are active by definition. Supplying `query` includes matching active diagnostics,
+ * and `offset` pages the deterministically sorted, bounded diagnostic result.
+ * Destination URLs, credentials, tokens, certificates, and raw Cloud Connector location IDs are not
+ * retained by DestinationRegistry and cannot enter this result.
+ */
+export function buildTargetCatalog(registry, options) {
+    const query = options.query?.trim().toLowerCase() ?? '';
+    const targets = registry.targets.filter((target) => targetMatches(target, query));
+    if (!options.admin) {
+        return targets.map((target) => ({
+            target: target.target,
+            description: target.description,
+            identity: target.identity,
+        }));
+    }
+    const sharedAuthStatusCounts = {};
+    const sharedAuthExceptions = [];
+    let sharedAuthTargetCount = 0;
+    const publicTargets = targets.map((target) => {
+        const runtimeAuth = target.authentication === 'BasicAuthentication' && options.runtimeAuth
+            ? options.runtimeAuth(target.target)
+            : undefined;
+        if (runtimeAuth) {
+            sharedAuthTargetCount += 1;
+            incrementStatus(sharedAuthStatusCounts, runtimeAuth.status);
+            if (!NORMAL_SHARED_AUTH_STATES.has(runtimeAuth.status)) {
+                sharedAuthExceptions.push({ target: target.target, ...runtimeAuth });
+            }
+        }
+        return {
+            target: target.target,
+            description: target.description,
+            identity: target.identity,
+        };
+    });
+    const diagnosticOffset = options.offset ?? 0;
+    const matchingDiagnostics = registry.diagnostics
+        .filter((entry) => (query ? diagnosticMatches(entry, query) : entry.status !== 'active'))
+        .sort((left, right) => `${left.destinationName}\0${left.target ?? ''}\0${left.code}`.localeCompare(`${right.destinationName}\0${right.target ?? ''}\0${right.code}`));
+    const diagnostics = matchingDiagnostics
+        .slice(diagnosticOffset, diagnosticOffset + TARGET_CATALOG_DIAGNOSTIC_LIMIT)
+        .map(safeDiagnostic);
+    const diagnosticNextOffset = diagnosticOffset + diagnostics.length < matchingDiagnostics.length
+        ? diagnosticOffset + diagnostics.length
+        : undefined;
+    sharedAuthExceptions.sort((left, right) => String(left.target).localeCompare(String(right.target)));
+    return {
+        targets: publicTargets,
+        admin: {
+            state: registry.failure ? 'error' : registry.counts.quarantined > 0 ? 'degraded' : 'ready',
+            source: 'btp-subaccount',
+            loadedAt: registry.loadedAt,
+            revision: registry.revision,
+            counts: registry.counts,
+            ...(sharedAuthTargetCount > 0
+                ? {
+                    sharedAuthentication: {
+                        targets: sharedAuthTargetCount,
+                        statusCounts: sharedAuthStatusCounts,
+                        ...(sharedAuthExceptions.length > 0
+                            ? {
+                                exceptionTotal: sharedAuthExceptions.length,
+                                exceptionReturned: Math.min(sharedAuthExceptions.length, TARGET_CATALOG_SHARED_AUTH_EXCEPTION_LIMIT),
+                                exceptionsTruncated: sharedAuthExceptions.length > TARGET_CATALOG_SHARED_AUTH_EXCEPTION_LIMIT,
+                                exceptions: sharedAuthExceptions.slice(0, TARGET_CATALOG_SHARED_AUTH_EXCEPTION_LIMIT),
+                            }
+                            : {}),
+                    },
+                }
+                : {}),
+            failure: registry.failure,
+            diagnosticMode: query ? 'matching' : 'exceptions',
+            diagnosticOffset,
+            diagnosticTotal: matchingDiagnostics.length,
+            diagnosticReturned: diagnostics.length,
+            diagnosticsTruncated: diagnosticOffset > 0 || diagnosticNextOffset !== undefined,
+            diagnosticNextOffset,
+            destinations: diagnostics,
+        },
+    };
+}
+//# sourceMappingURL=multi-target-catalog.js.map

package/dist/server/multi-target-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-catalog.js","sourceRoot":"","sources":["../../src/server/multi-target-catalog.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAI9E,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAClD,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,yBAAyB,GAAG,SAAS,CAAC;AACnD,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAEnD,SAAS,aAAa,CAAC,MAAwB,EAAE,KAAa;IAC5D,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiD,EAAE,KAAa;IACzF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC;SACrG,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAUD,iGAAiG;AACjG,8FAA8F;AAC9F,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAElF,SAAS,eAAe,CAAC,MAA8B,EAAE,MAAc;IACrE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,cAAc,CAAC,KAAuB;IAC7C,OAAO;QACL,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,2BAA2B,EAAE,KAAK,CAAC,2BAA2B;QAC9D,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA6B,EAC7B,OAA6B;IAE7B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,MAAM,sBAAsB,GAA2B,EAAE,CAAC;IAC1D,MAAM,oBAAoB,GAAkE,EAAE,CAAC;IAC/F,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;QAC3C,MAAM,WAAW,GACf,MAAM,CAAC,cAAc,KAAK,qBAAqB,IAAI,OAAO,CAAC,WAAW;YACpE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC;YACpC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,WAAW,EAAE,CAAC;YAChB,qBAAqB,IAAI,CAAC,CAAC;YAC3B,eAAe,CAAC,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvD,oBAAoB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW;SAC7C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;SACxF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACpB,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,MAAM,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,aAAa,CACzE,GAAG,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC,MAAM,IAAI,EAAE,KAAK,KAAK,CAAC,IAAI,EAAE,CACjE,CACF,CAAC;IACJ,MAAM,WAAW,GAAG,mBAAmB;SACpC,KAAK,CAAC,gBAAgB,EAAE,gBAAgB,GAAG,+BAA+B,CAAC;SAC3E,GAAG,CAAC,cAAc,CAAC,CAAC;IACvB,MAAM,oBAAoB,GACxB,gBAAgB,GAAG,WAAW,CAAC,MAAM,GAAG,mBAAmB,CAAC,MAAM;QAChE,CAAC,CAAC,gBAAgB,GAAG,WAAW,CAAC,MAAM;QACvC,CAAC,CAAC,SAAS,CAAC;IAChB,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEpG,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;YAC1F,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG,CAAC,qBAAqB,GAAG,CAAC;gBAC3B,CAAC,CAAC;oBACE,oBAAoB,EAAE;wBACpB,OAAO,EAAE,qBAAqB;wBAC9B,YAAY,EAAE,sBAAsB;wBACpC,GAAG,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;4BACjC,CAAC,CAAC;gCACE,cAAc,EAAE,oBAAoB,CAAC,MAAM;gCAC3C,iBAAiB,EAAE,IAAI,CAAC,GAAG,CACzB,oBAAoB,CAAC,MAAM,EAC3B,0CAA0C,CAC3C;gCACD,mBAAmB,EAAE,oBAAoB,CAAC,MAAM,GAAG,0CAA0C;gCAC7F,UAAU,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,0CAA0C,CAAC;6BACtF;4BACH,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY;YACjD,gBAAgB;YAChB,eAAe,EAAE,mBAAmB,CAAC,MAAM;YAC3C,kBAAkB,EAAE,WAAW,CAAC,MAAM;YACtC,oBAAoB,EAAE,gBAAgB,GAAG,CAAC,IAAI,oBAAoB,KAAK,SAAS;YAChF,oBAAoB;YACpB,YAAY,EAAE,WAAW;SAC1B;KACF,CAAC;AACJ,CAAC"}

package/dist/server/multi-target-destination-config.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Destination-property contract for multi-target v1.
+ *
+ * Keep this file deliberately small: discovery, startup validation, and runtime
+ * drift checks must all agree on the exact same property names and value syntax.
+ */
+export declare const MULTI_TARGET_ARC_PROPERTIES: readonly string[];
+export declare function isSupportedMultiTargetArcProperty(key: string): boolean;
+export declare function isWriteRelatedArcProperty(key: string): boolean;
+/** Parse the destination-service boolean format without inventing a default. */
+export declare function parseDestinationBoolean(value: string | undefined): boolean | undefined;
+//# sourceMappingURL=multi-target-destination-config.d.ts.map

package/dist/server/multi-target-destination-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-destination-config.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-destination-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,2BAA2B,mBAKtC,CAAC;AAUH,wBAAgB,iCAAiC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEtE;AAED,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,gFAAgF;AAChF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAMtF"}

package/dist/server/multi-target-destination-config.js

@@ -0,0 +1,37 @@
+/**
+ * Destination-property contract for multi-target v1.
+ *
+ * Keep this file deliberately small: discovery, startup validation, and runtime
+ * drift checks must all agree on the exact same property names and value syntax.
+ */
+export const MULTI_TARGET_ARC_PROPERTIES = Object.freeze([
+    'arc1.enabled',
+    'arc1.allow_data_preview',
+    'arc1.allow_free_sql',
+    'arc1.target_alias',
+]);
+const SUPPORTED_ARC_PROPERTIES = new Set(MULTI_TARGET_ARC_PROPERTIES);
+const WRITE_ARC_PROPERTIES = new Set([
+    'arc1.allow_writes',
+    'arc1.allowed_packages',
+    'arc1.allow_transport_writes',
+    'arc1.allow_git_writes',
+]);
+export function isSupportedMultiTargetArcProperty(key) {
+    return SUPPORTED_ARC_PROPERTIES.has(key);
+}
+export function isWriteRelatedArcProperty(key) {
+    return WRITE_ARC_PROPERTIES.has(key);
+}
+/** Parse the destination-service boolean format without inventing a default. */
+export function parseDestinationBoolean(value) {
+    if (value === undefined)
+        return undefined;
+    const normalized = value.trim().toLowerCase();
+    if (normalized === 'true')
+        return true;
+    if (normalized === 'false')
+        return false;
+    return undefined;
+}
+//# sourceMappingURL=multi-target-destination-config.js.map

package/dist/server/multi-target-destination-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-destination-config.js","sourceRoot":"","sources":["../../src/server/multi-target-destination-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,cAAc;IACd,yBAAyB;IACzB,qBAAqB;IACrB,mBAAmB;CACpB,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,2BAA2B,CAAC,CAAC;AACtE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,mBAAmB;IACnB,uBAAuB;IACvB,6BAA6B;IAC7B,uBAAuB;CACxB,CAAC,CAAC;AAEH,MAAM,UAAU,iCAAiC,CAAC,GAAW;IAC3D,OAAO,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,OAAO,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,uBAAuB,CAAC,KAAyB;IAC/D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/server/multi-target-destination-runtime.d.ts

@@ -0,0 +1,20 @@
+/** Level-pinned Destination Service resolution for multi-target request paths. */
+import type { BTPConfig, Destination, PerUserAuthTokens } from '@arc-mcp/xsuaa-auth/btp';
+export type RuntimeDestinationLevelCode = 'DESTINATION_NOT_FOUND_AT_SUBACCOUNT' | 'INSTANCE_DESTINATION_SHADOW';
+export declare class RuntimeDestinationLevelError extends Error {
+    readonly code: RuntimeDestinationLevelCode;
+    readonly destinationName: string;
+    constructor(code: RuntimeDestinationLevelCode, destinationName: string);
+}
+/**
+ * Resolve the current destination through Find, but accept it only when Destination Service reports
+ * a subaccount owner. This keeps request-time Basic rotation and PP drift checks efficient while
+ * rejecting the instance-over-subaccount precedence that the generic Find API normally applies.
+ */
+export declare function resolveRuntimeSubaccountDestination(btpConfig: BTPConfig, destinationName: string): Promise<Destination>;
+/** Resolve PP from an owner-confirmed subaccount destination and verified user JWT. */
+export declare function resolveRuntimeSubaccountPpDestination(btpConfig: BTPConfig, destinationName: string, userJwt: string): Promise<{
+    destination: Destination;
+    authTokens: PerUserAuthTokens;
+}>;
+//# sourceMappingURL=multi-target-destination-runtime.d.ts.map

package/dist/server/multi-target-destination-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-destination-runtime.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-destination-runtime.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAOzF,MAAM,MAAM,2BAA2B,GAAG,qCAAqC,GAAG,6BAA6B,CAAC;AAEhH,qBAAa,4BAA6B,SAAQ,KAAK;IAEnD,QAAQ,CAAC,IAAI,EAAE,2BAA2B;IAC1C,QAAQ,CAAC,eAAe,EAAE,MAAM;IAFlC,YACW,IAAI,EAAE,2BAA2B,EACjC,eAAe,EAAE,MAAM,EAQjC;CACF;AAmGD;;;;GAIG;AACH,wBAAsB,mCAAmC,CACvD,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,WAAW,CAAC,CAgCtB;AAwCD,uFAAuF;AACvF,wBAAsB,qCAAqC,CACzD,SAAS,EAAE,SAAS,EACpB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;IAAE,WAAW,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,iBAAiB,CAAA;CAAE,CAAC,CAStE"}

package/dist/server/multi-target-destination-runtime.js

@@ -0,0 +1,191 @@
+/** Level-pinned Destination Service resolution for multi-target request paths. */
+import { logger } from './logger.js';
+import { isSupportedMultiTargetArcProperty } from './multi-target-destination-config.js';
+const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;
+const MAX_REQUEST_TIMEOUT_MS = 60_000;
+export class RuntimeDestinationLevelError extends Error {
+    code;
+    destinationName;
+    constructor(code, destinationName) {
+        super(code === 'INSTANCE_DESTINATION_SHADOW'
+            ? `Destination '${destinationName}' is shadowed by a service-instance destination. Remove the instance-level destination and restart ARC-1.`
+            : `Destination '${destinationName}' no longer exists at subaccount level. Restore it and restart ARC-1.`);
+        this.code = code;
+        this.destinationName = destinationName;
+        this.name = 'RuntimeDestinationLevelError';
+    }
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function stringProperty(properties, key) {
+    const value = properties[key];
+    return typeof value === 'string' ? value : '';
+}
+function boundedTimeoutMs(configured) {
+    if (configured === undefined || !Number.isFinite(configured) || configured <= 0) {
+        return DEFAULT_REQUEST_TIMEOUT_MS;
+    }
+    return Math.max(1, Math.min(Math.floor(configured), MAX_REQUEST_TIMEOUT_MS));
+}
+async function withRequestTimeout(configuredTimeoutMs, operation) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), boundedTimeoutMs(configuredTimeoutMs));
+    timer.unref?.();
+    try {
+        return await operation(controller.signal);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function destinationServiceAccessToken(btpConfig) {
+    const tokenUrl = btpConfig.destinationTokenUrl || `${btpConfig.xsuaaUrl.replace(/\/$/, '')}/oauth/token`;
+    return withRequestTimeout(btpConfig.requestTimeoutMs, async (signal) => {
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: new URLSearchParams({
+                grant_type: 'client_credentials',
+                client_id: btpConfig.destinationClientId,
+                client_secret: btpConfig.destinationSecret,
+            }).toString(),
+            signal,
+        });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`Destination Service token request returned HTTP ${response.status}`);
+        }
+        const data = await response.json();
+        if (!isRecord(data) || typeof data.access_token !== 'string' || data.access_token.length === 0) {
+            throw new Error('Destination Service token response was invalid');
+        }
+        return data.access_token;
+    });
+}
+function safeOriginalProperties(configuration) {
+    const safe = {};
+    const standardKeys = [
+        'Name',
+        'Type',
+        'URL',
+        'Authentication',
+        'ProxyType',
+        'sap-sysid',
+        'sap-client',
+        'sap-language',
+        'Description',
+        'CloudConnectorLocationId',
+        'Preemptive',
+    ];
+    for (const key of standardKeys) {
+        if (configuration[key] !== undefined)
+            safe[key] = configuration[key];
+    }
+    for (const [key, value] of Object.entries(configuration)) {
+        if (!key.toLowerCase().startsWith('arc1.'))
+            continue;
+        // Unknown/wrong-case ARC keys must remain visible to fail-closed validation, but their
+        // untrusted values are unnecessary and could themselves contain sensitive material.
+        safe[key] = isSupportedMultiTargetArcProperty(key) ? value : '';
+    }
+    return Object.freeze(safe);
+}
+function destinationFromConfiguration(configuration) {
+    return {
+        Name: stringProperty(configuration, 'Name'),
+        URL: stringProperty(configuration, 'URL'),
+        Authentication: stringProperty(configuration, 'Authentication'),
+        ProxyType: stringProperty(configuration, 'ProxyType'),
+        User: stringProperty(configuration, 'User'),
+        Password: stringProperty(configuration, 'Password'),
+        Type: stringProperty(configuration, 'Type') || undefined,
+        'sap-client': stringProperty(configuration, 'sap-client') || undefined,
+        CloudConnectorLocationId: stringProperty(configuration, 'CloudConnectorLocationId') || undefined,
+        originalProperties: safeOriginalProperties(configuration),
+    };
+}
+/**
+ * Resolve the current destination through Find, but accept it only when Destination Service reports
+ * a subaccount owner. This keeps request-time Basic rotation and PP drift checks efficient while
+ * rejecting the instance-over-subaccount precedence that the generic Find API normally applies.
+ */
+export async function resolveRuntimeSubaccountDestination(btpConfig, destinationName) {
+    const accessToken = await destinationServiceAccessToken(btpConfig);
+    const baseUrl = btpConfig.destinationUrl.replace(/\/$/, '');
+    const url = `${baseUrl}/destination-configuration/v1/destinations/${encodeURIComponent(destinationName)}?$skipTokenRetrieval=true`;
+    return withRequestTimeout(btpConfig.requestTimeoutMs, async (signal) => {
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${accessToken}` },
+            signal,
+        });
+        if (response.status === 404) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new RuntimeDestinationLevelError('DESTINATION_NOT_FOUND_AT_SUBACCOUNT', destinationName);
+        }
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`Destination Service runtime lookup returned HTTP ${response.status}`);
+        }
+        const data = await response.json();
+        if (!isRecord(data) || !isRecord(data.owner)) {
+            throw new Error('Destination Service runtime lookup returned an invalid response');
+        }
+        if (typeof data.owner.InstanceId === 'string' && data.owner.InstanceId.length > 0) {
+            throw new RuntimeDestinationLevelError('INSTANCE_DESTINATION_SHADOW', destinationName);
+        }
+        if (typeof data.owner.SubaccountId !== 'string' || data.owner.SubaccountId.length === 0) {
+            throw new RuntimeDestinationLevelError('DESTINATION_NOT_FOUND_AT_SUBACCOUNT', destinationName);
+        }
+        if (!isRecord(data.destinationConfiguration)) {
+            throw new Error('Destination Service runtime lookup returned an invalid destination configuration');
+        }
+        return destinationFromConfiguration(data.destinationConfiguration);
+    });
+}
+async function validateJwtForConnectivity(btpConfig, destinationName, userJwt) {
+    if (!btpConfig.connectivityClientId || !btpConfig.connectivitySecret || !btpConfig.connectivityTokenUrl) {
+        return false;
+    }
+    try {
+        return await withRequestTimeout(btpConfig.requestTimeoutMs, async (signal) => {
+            const response = await fetch(btpConfig.connectivityTokenUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+                    client_id: btpConfig.connectivityClientId,
+                    client_secret: btpConfig.connectivitySecret,
+                    assertion: userJwt,
+                    token_format: 'jwt',
+                    response_type: 'token',
+                }).toString(),
+                signal,
+            });
+            await response.arrayBuffer();
+            if (!response.ok) {
+                logger.warn('PP jwt-bearer validation failed', { destination: destinationName, status: response.status });
+            }
+            return response.ok;
+        });
+    }
+    catch (error) {
+        logger.warn('PP jwt-bearer validation failed', {
+            destination: destinationName,
+            reason: error instanceof Error && error.name === 'AbortError' ? 'timeout' : 'request_failed',
+        });
+        return false;
+    }
+}
+/** Resolve PP from an owner-confirmed subaccount destination and verified user JWT. */
+export async function resolveRuntimeSubaccountPpDestination(btpConfig, destinationName, userJwt) {
+    const destination = await resolveRuntimeSubaccountDestination(btpConfig, destinationName);
+    const authTokens = {};
+    if (await validateJwtForConnectivity(btpConfig, destinationName, userJwt)) {
+        // PP Option 2: the exchange validates the user token; Cloud Connector consumes the original
+        // token from SAP-Connectivity-Authentication to create the short-lived user certificate.
+        authTokens.sapConnectivityAuth = `Bearer ${userJwt}`;
+    }
+    return { destination, authTokens };
+}
+//# sourceMappingURL=multi-target-destination-runtime.js.map

package/dist/server/multi-target-destination-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-destination-runtime.js","sourceRoot":"","sources":["../../src/server/multi-target-destination-runtime.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAGlF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,iCAAiC,EAAE,MAAM,sCAAsC,CAAC;AAEzF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAItC,MAAM,OAAO,4BAA6B,SAAQ,KAAK;IAE1C,IAAI;IACJ,eAAe;IAF1B,YACW,IAAiC,EACjC,eAAuB;QAEhC,KAAK,CACH,IAAI,KAAK,6BAA6B;YACpC,CAAC,CAAC,gBAAgB,eAAe,2GAA2G;YAC5I,CAAC,CAAC,gBAAgB,eAAe,uEAAuE,CAC3G,CAAC;oBAPO,IAAI;+BACJ,eAAe;QAOxB,IAAI,CAAC,IAAI,GAAG,8BAA8B,CAAC;IAC7C,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,cAAc,CAAC,UAA6C,EAAE,GAAW;IAChF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,UAA8B;IACtD,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,mBAAuC,EACvC,SAA8C;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC1F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B,CAAC,SAAoB;IAC/D,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC;IACzG,OAAO,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,UAAU,EAAE,oBAAoB;gBAChC,SAAS,EAAE,SAAS,CAAC,mBAAmB;gBACxC,aAAa,EAAE,SAAS,CAAC,iBAAiB;aAC3C,CAAC,CAAC,QAAQ,EAAE;YACb,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,mDAAmD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/F,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sBAAsB,CAAC,aAAgD;IAC9E,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG;QACnB,MAAM;QACN,MAAM;QACN,KAAK;QACL,gBAAgB;QAChB,WAAW;QACX,WAAW;QACX,YAAY;QACZ,cAAc;QACd,aAAa;QACb,0BAA0B;QAC1B,YAAY;KACb,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACrD,uFAAuF;QACvF,oFAAoF;QACpF,IAAI,CAAC,GAAG,CAAC,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,4BAA4B,CAAC,aAAgD;IACpF,OAAO;QACL,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC;QAC3C,GAAG,EAAE,cAAc,CAAC,aAAa,EAAE,KAAK,CAAC;QACzC,cAAc,EAAE,cAAc,CAAC,aAAa,EAAE,gBAAgB,CAAC;QAC/D,SAAS,EAAE,cAAc,CAAC,aAAa,EAAE,WAAW,CAAC;QACrD,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC;QAC3C,QAAQ,EAAE,cAAc,CAAC,aAAa,EAAE,UAAU,CAAC;QACnD,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,SAAS;QACxD,YAAY,EAAE,cAAc,CAAC,aAAa,EAAE,YAAY,CAAC,IAAI,SAAS;QACtE,wBAAwB,EAAE,cAAc,CAAC,aAAa,EAAE,0BAA0B,CAAC,IAAI,SAAS;QAChG,kBAAkB,EAAE,sBAAsB,CAAC,aAAa,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,SAAoB,EACpB,eAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,OAAO,8CAA8C,kBAAkB,CAAC,eAAe,CAAC,2BAA2B,CAAC;IACnI,OAAO,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;YACnD,MAAM;SACP,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,4BAA4B,CAAC,qCAAqC,EAAE,eAAe,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,oDAAoD,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,4BAA4B,CAAC,6BAA6B,EAAE,eAAe,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxF,MAAM,IAAI,4BAA4B,CAAC,qCAAqC,EAAE,eAAe,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,4BAA4B,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,SAAoB,EACpB,eAAuB,EACvB,OAAe;IAEf,IAAI,CAAC,SAAS,CAAC,oBAAoB,IAAI,CAAC,SAAS,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,oBAAoB,EAAE,CAAC;QACxG,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YAC3E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,oBAAoB,EAAE;gBAC3D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,6CAA6C;oBACzD,SAAS,EAAE,SAAS,CAAC,oBAAoB;oBACzC,aAAa,EAAE,SAAS,CAAC,kBAAkB;oBAC3C,SAAS,EAAE,OAAO;oBAClB,YAAY,EAAE,KAAK;oBACnB,aAAa,EAAE,OAAO;iBACvB,CAAC,CAAC,QAAQ,EAAE;gBACb,MAAM;aACP,CAAC,CAAC;YACH,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;YAC7C,WAAW,EAAE,eAAe;YAC5B,MAAM,EAAE,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB;SAC7F,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,SAAoB,EACpB,eAAuB,EACvB,OAAe;IAEf,MAAM,WAAW,GAAG,MAAM,mCAAmC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAC1F,MAAM,UAAU,GAAsB,EAAE,CAAC;IACzC,IAAI,MAAM,0BAA0B,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;QAC1E,4FAA4F;QAC5F,yFAAyF;QACzF,UAAU,CAAC,mBAAmB,GAAG,UAAU,OAAO,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC"}

package/dist/server/multi-target-feature-state.d.ts

@@ -0,0 +1,6 @@
+/** Authorization-safe, success-only feature state for discovered targets. */
+import type { ResolvedFeatures } from '../adt/types.js';
+export declare function hasAuthorizationLimitedFeatureEvidence(features: ResolvedFeatures): boolean;
+/** One in-flight probe per target. Rejections are observed, cleared, and never cached. */
+export declare function ensureMultiTargetFeatureProbe(target: string | undefined, alreadyKnown: boolean, probe: () => Promise<void>, clearFailedEvidence: () => void): Promise<void>;
+//# sourceMappingURL=multi-target-feature-state.d.ts.map

package/dist/server/multi-target-feature-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-feature-state.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-feature-state.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAIxD,wBAAgB,sCAAsC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAkB1F;AAED,0FAA0F;AAC1F,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,OAAO,EACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC1B,mBAAmB,EAAE,MAAM,IAAI,GAC9B,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/server/multi-target-feature-state.js

@@ -0,0 +1,41 @@
+/** Authorization-safe, success-only feature state for discovered targets. */
+const probeFlights = new Map();
+export function hasAuthorizationLimitedFeatureEvidence(features) {
+    const authMarker = /(authorization|auth failure|forbidden|\b401\b|\b403\b)/i;
+    const featureStatuses = [
+        features.hana,
+        features.abapGit,
+        features.gcts,
+        features.rap,
+        features.amdp,
+        features.ui5,
+        features.transport,
+        features.ui5repo,
+        features.flp,
+    ];
+    if (featureStatuses.some((status) => !status.available && authMarker.test(status.message ?? '')))
+        return true;
+    if (!features.textSearch?.available && authMarker.test(features.textSearch?.reason ?? ''))
+        return true;
+    return [features.authProbe?.searchReason, features.authProbe?.transportReason].some((reason) => authMarker.test(reason ?? ''));
+}
+/** One in-flight probe per target. Rejections are observed, cleared, and never cached. */
+export async function ensureMultiTargetFeatureProbe(target, alreadyKnown, probe, clearFailedEvidence) {
+    if (!target || alreadyKnown)
+        return;
+    let flight = probeFlights.get(target);
+    if (!flight) {
+        flight = probe();
+        probeFlights.set(target, flight);
+        const cleanup = () => {
+            if (probeFlights.get(target) === flight)
+                probeFlights.delete(target);
+        };
+        flight.then(cleanup, () => {
+            clearFailedEvidence();
+            cleanup();
+        });
+    }
+    await flight;
+}
+//# sourceMappingURL=multi-target-feature-state.js.map

package/dist/server/multi-target-feature-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-feature-state.js","sourceRoot":"","sources":["../../src/server/multi-target-feature-state.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAI7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEtD,MAAM,UAAU,sCAAsC,CAAC,QAA0B;IAC/E,MAAM,UAAU,GAAG,yDAAyD,CAAC;IAC7E,MAAM,eAAe,GAAG;QACtB,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,OAAO;QAChB,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,SAAS;QAClB,QAAQ,CAAC,OAAO;QAChB,QAAQ,CAAC,GAAG;KACb,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9G,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7F,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAA0B,EAC1B,YAAqB,EACrB,KAA0B,EAC1B,mBAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO;IACpC,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,mBAAmB,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,CAAC;AACf,CAAC"}

package/dist/server/multi-target-identity.d.ts

@@ -0,0 +1,10 @@
+/** Public target-ID and HTTP-route syntax for destination-discovered multi-target mode. */
+export declare const SAP_SYSID_PATTERN: RegExp;
+export declare const TARGET_SYSTEM_SEGMENT_SOURCE = "[A-Z][A-Z0-9-]{1,30}[A-Z0-9]";
+export declare const TARGET_SYSTEM_ALIAS_PATTERN: RegExp;
+export declare const TARGET_ID_PATTERN: RegExp;
+export declare const PINNED_MCP_PATH_PATTERN: RegExp;
+export declare const PINNED_RESOURCE_METADATA_PATH_PATTERN: RegExp;
+export declare function buildTargetId(sid: string, client: string, alias?: string): string;
+export declare function targetFromPinnedMcpPath(path: string): string | undefined;
+//# sourceMappingURL=multi-target-identity.d.ts.map

package/dist/server/multi-target-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-identity.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAKtD,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAC3E,eAAO,MAAM,2BAA2B,QAAkD,CAAC;AAC3F,eAAO,MAAM,iBAAiB,QAA2D,CAAC;AAC1F,eAAO,MAAM,uBAAuB,QAAoE,CAAC;AACzG,eAAO,MAAM,qCAAqC,QAEjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxE"}

package/dist/server/multi-target-identity.js

@@ -0,0 +1,18 @@
+/** Public target-ID and HTTP-route syntax for destination-discovered multi-target mode. */
+export const SAP_SYSID_PATTERN = /^[A-Z][A-Z0-9]{2}$/;
+// A route alias is useful when separate SAP systems reuse the same SID and client.
+// Keep it URL-friendly, case-sensitive, and bounded: 3-32 characters, with no
+// leading or trailing hyphen. The real SAP identity remains sap-sysid/sap-client.
+export const TARGET_SYSTEM_SEGMENT_SOURCE = '[A-Z][A-Z0-9-]{1,30}[A-Z0-9]';
+export const TARGET_SYSTEM_ALIAS_PATTERN = new RegExp(`^${TARGET_SYSTEM_SEGMENT_SOURCE}$`);
+export const TARGET_ID_PATTERN = new RegExp(`^${TARGET_SYSTEM_SEGMENT_SOURCE}/[0-9]{3}$`);
+export const PINNED_MCP_PATH_PATTERN = new RegExp(`^/(${TARGET_SYSTEM_SEGMENT_SOURCE})/([0-9]{3})/mcp$`);
+export const PINNED_RESOURCE_METADATA_PATH_PATTERN = new RegExp(`^/\\.well-known/oauth-protected-resource/(${TARGET_SYSTEM_SEGMENT_SOURCE})/([0-9]{3})/mcp$`);
+export function buildTargetId(sid, client, alias) {
+    return `${alias ?? sid}/${client}`;
+}
+export function targetFromPinnedMcpPath(path) {
+    const match = path.match(PINNED_MCP_PATH_PATTERN);
+    return match ? `${match[1]}/${match[2]}` : undefined;
+}
+//# sourceMappingURL=multi-target-identity.js.map

package/dist/server/multi-target-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-identity.js","sourceRoot":"","sources":["../../src/server/multi-target-identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD,mFAAmF;AACnF,8EAA8E;AAC9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,4BAA4B,GAAG,8BAA8B,CAAC;AAC3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAAC,IAAI,4BAA4B,GAAG,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,MAAM,CAAC,IAAI,4BAA4B,YAAY,CAAC,CAAC;AAC1F,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,MAAM,CAAC,MAAM,4BAA4B,mBAAmB,CAAC,CAAC;AACzG,MAAM,CAAC,MAAM,qCAAqC,GAAG,IAAI,MAAM,CAC7D,6CAA6C,4BAA4B,mBAAmB,CAC7F,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,MAAc,EAAE,KAAc;IACvE,OAAO,GAAG,KAAK,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAClD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/server/multi-target-runtime.d.ts

@@ -0,0 +1,27 @@
+/** Per-target configuration construction and uncached Destination drift validation. */
+import type { Destination } from '@arc-mcp/xsuaa-auth/btp';
+import { type TargetDescriptor } from './destination-registry.js';
+import type { ServerConfig } from './types.js';
+/** Build the isolated runtime for one discovered target. */
+export declare function buildMultiTargetConfig(base: ServerConfig, target: TargetDescriptor): ServerConfig;
+/**
+ * Build only the union needed to advertise the aggregate tools/list surface.
+ * Every tool call replaces this with buildMultiTargetConfig for its selected target.
+ */
+export declare function buildAggregateToolSurfaceConfig(base: ServerConfig, targets: readonly TargetDescriptor[]): ServerConfig;
+export type DriftResult = {
+    ok: true;
+    url: string;
+} | {
+    ok: false;
+    code: 'TARGET_CONFIG_CHANGED';
+    message: string;
+};
+export declare class TargetConfigChangedError extends Error {
+    readonly target: string;
+    readonly code = "TARGET_CONFIG_CHANGED";
+    constructor(target: string, message: string);
+}
+/** Compare a fresh uncached Find result with the immutable startup snapshot. */
+export declare function validateTargetDrift(destination: Destination, target: TargetDescriptor, base: ServerConfig): DriftResult;
+//# sourceMappingURL=multi-target-runtime.d.ts.map

package/dist/server/multi-target-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-runtime.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-runtime.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAEvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,OAAO,EAGL,KAAK,gBAAgB,EAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyE/C,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,GAAG,YAAY,CAEjG;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,SAAS,gBAAgB,EAAE,GACnC,YAAY,CAQd;AAED,MAAM,MAAM,WAAW,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,uBAAuB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpH,qBAAa,wBAAyB,SAAQ,KAAK;IAI/C,QAAQ,CAAC,MAAM,EAAE,MAAM;IAHzB,QAAQ,CAAC,IAAI,2BAA2B;IAExC,YACW,MAAM,EAAE,MAAM,EACvB,OAAO,EAAE,MAAM,EAIhB;CACF;AAUD,gFAAgF;AAChF,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,YAAY,GACjB,WAAW,CAQb"}