arc-1 1.5.2 → 1.7.0

package/dist/server/multi-target-authorization-audit.js

@@ -0,0 +1,18 @@
+import { logger } from './logger.js';
+export function auditTargetGrantDenial(grant, authInfo, requestId, tool, target) {
+    logger.emitAudit({
+        timestamp: new Date().toISOString(),
+        level: 'warn',
+        event: 'target_resolution_failed',
+        requestId,
+        user: authInfo?.extra?.userName,
+        clientId: authInfo?.clientId,
+        tool,
+        target,
+        errorCode: grant.mode === 'none' ? grant.status : 'TARGET_NOT_GRANTED',
+        targetAccessMode: 'xsuaa-attribute',
+        grantMode: grant.mode,
+        ...(grant.mode === 'exact' ? { exactGrantCount: grant.exactGrantCount } : {}),
+    });
+}
+//# sourceMappingURL=multi-target-authorization-audit.js.map

package/dist/server/multi-target-authorization-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-authorization-audit.js","sourceRoot":"","sources":["../../src/server/multi-target-authorization-audit.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAGrC,MAAM,UAAU,sBAAsB,CACpC,KAAkB,EAClB,QAA8B,EAC9B,SAAiB,EACjB,IAAY,EACZ,MAAe;IAEf,MAAM,CAAC,SAAS,CAAC;QACf,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,0BAA0B;QACjC,SAAS;QACT,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAA8B;QACrD,QAAQ,EAAE,QAAQ,EAAE,QAAQ;QAC5B,IAAI;QACJ,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;QACtE,gBAAgB,EAAE,iBAAiB;QACnC,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC,CAAC;AACL,CAAC"}

package/dist/server/multi-target-authorization-startup.d.ts

@@ -0,0 +1,8 @@
+/** Reject alternate independent connections before any startup authentication or network contact. */
+import type { BTPConfig } from '@arc-mcp/xsuaa-auth/btp';
+import { DestinationRegistry } from './destination-registry.js';
+import type { ServerConfig } from './types.js';
+/** Registry discovery uses the same mode as request enforcement and its catalog limits. */
+export declare function discoverMultiTargetRegistry(config: ServerConfig, btpConfig: BTPConfig): Promise<DestinationRegistry>;
+export declare function assertMultiTargetAuthorizationStartup(config: ServerConfig, env?: NodeJS.ProcessEnv): void;
+//# sourceMappingURL=multi-target-authorization-startup.d.ts.map

package/dist/server/multi-target-authorization-startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-authorization-startup.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-authorization-startup.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAErG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAGhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,2FAA2F;AAC3F,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,YAAY,EACpB,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAgB9B;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,YAAY,EACpB,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,IAAI,CAmBN"}

package/dist/server/multi-target-authorization-startup.js

@@ -0,0 +1,38 @@
+/** Reject alternate independent connections before any startup authentication or network contact. */
+import { DestinationRegistry } from './destination-registry.js';
+import { logger } from './logger.js';
+import { MULTI_TARGET_MAX } from './multi-target-identity.js';
+/** Registry discovery uses the same mode as request enforcement and its catalog limits. */
+export async function discoverMultiTargetRegistry(config, btpConfig) {
+    logger.info(config.multiTargetAuthorization === 'xsuaa-attribute'
+        ? `Multi-target authorization enforced; catalog bounded to ${MULTI_TARGET_MAX} ARC-related destinations.`
+        : 'Standard multi-target authorization: per-target grants are not enforced.', { mode: config.multiTargetAuthorization ?? 'standard' });
+    const options = { authorizationMode: config.multiTargetAuthorization };
+    try {
+        const { discoverDestinations } = await import('./destination-discovery.js');
+        return DestinationRegistry.fromDiscovery(await discoverDestinations(btpConfig, options), config, options);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Destination discovery failed.';
+        logger.error('Multi-target destination discovery failed', { error: message });
+        return DestinationRegistry.unavailable({ code: 'REGISTRY_DISCOVERY_ERROR', message }, options);
+    }
+}
+export function assertMultiTargetAuthorizationStartup(config, env = process.env) {
+    if (config.multiTargetAuthorization !== 'xsuaa-attribute')
+        return;
+    if (!config.multiTargetEndpoints) {
+        throw new Error('ARC1_MULTI_TARGET_AUTHORIZATION=xsuaa-attribute requires ARC1_MULTI_TARGET_ENDPOINTS=true.');
+    }
+    if (config.url ||
+        config.username ||
+        config.password ||
+        config.destinationName ||
+        config.btpServiceKey ||
+        config.btpServiceKeyFile ||
+        env.SAP_BTP_DESTINATION ||
+        env.SAP_BTP_PP_DESTINATION) {
+        throw new Error('Enforced multi-target authorization requires a multi-only deployment. Remove single-target connection settings; use a separate application and XSUAA identity for single-target access.');
+    }
+}
+//# sourceMappingURL=multi-target-authorization-startup.js.map

package/dist/server/multi-target-authorization-startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-authorization-startup.js","sourceRoot":"","sources":["../../src/server/multi-target-authorization-startup.ts"],"names":[],"mappings":"AAAA,qGAAqG;AAGrG,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAoB,EACpB,SAAoB;IAEpB,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,wBAAwB,KAAK,iBAAiB;QACnD,CAAC,CAAC,2DAA2D,gBAAgB,4BAA4B;QACzG,CAAC,CAAC,0EAA0E,EAC9E,EAAE,IAAI,EAAE,MAAM,CAAC,wBAAwB,IAAI,UAAU,EAAE,CACxD,CAAC;IACF,MAAM,OAAO,GAAG,EAAE,iBAAiB,EAAE,MAAM,CAAC,wBAAwB,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,4BAA4B,CAAC,CAAC;QAC5E,OAAO,mBAAmB,CAAC,aAAa,CAAC,MAAM,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9E,OAAO,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,OAAO,CAAC,CAAC;IACjG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,MAAoB,EACpB,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,IAAI,MAAM,CAAC,wBAAwB,KAAK,iBAAiB;QAAE,OAAO;IAClE,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,IACE,MAAM,CAAC,GAAG;QACV,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,QAAQ;QACf,MAAM,CAAC,eAAe;QACtB,MAAM,CAAC,aAAa;QACpB,MAAM,CAAC,iBAAiB;QACxB,GAAG,CAAC,mBAAmB;QACvB,GAAG,CAAC,sBAAsB,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yLAAyL,CAC1L,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/server/multi-target-authorization.d.ts

@@ -0,0 +1,29 @@
+/** Pure, fail-closed target grants from the verified XSUAA attribute boundary. */
+import type { AuthInfo } from '@modelcontextprotocol/sdk/server/auth/types.js';
+export type MultiTargetAuthorizationMode = 'standard' | 'xsuaa-attribute';
+export type TargetGrantFailure = 'TARGET_GRANT_MISSING' | 'TARGET_GRANT_MALFORMED' | 'TARGET_GRANT_LIMIT_EXCEEDED';
+export type TargetGrant = Readonly<{
+    mode: 'none';
+    status: TargetGrantFailure;
+}> | Readonly<{
+    mode: 'exact';
+    status: 'valid';
+    targets: readonly string[];
+    exactGrantCount: number;
+}> | Readonly<{
+    mode: 'all';
+    status: 'valid';
+}>;
+/**
+ * Consume only the auth package's verified, allowlisted values and extraction status.
+ * This function neither verifies JWTs nor authorizes standard mode. The HTTP boundary must
+ * supply AuthInfo from its configured XSUAA verifier; callers cannot supply their own extra.
+ */
+export declare function parseTargetGrant(authInfo?: Pick<AuthInfo, 'extra'>): TargetGrant;
+/** The requested ID must already be canonical; even all-target grants never accept bad syntax. */
+export declare function isTargetGranted(grant: TargetGrant, targetId: string): boolean;
+/** Filter an immutable registry projection without mutating it or revealing unknown grants. */
+export declare function projectGrantedTargets<T extends {
+    readonly target: string;
+}>(targets: readonly T[], grant: TargetGrant): readonly T[];
+//# sourceMappingURL=multi-target-authorization.d.ts.map

package/dist/server/multi-target-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-authorization.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-authorization.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAElF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gDAAgD,CAAC;AAG/E,MAAM,MAAM,4BAA4B,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAC1E,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,GAAG,wBAAwB,GAAG,6BAA6B,CAAC;AAEnH,MAAM,MAAM,WAAW,GACnB,QAAQ,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,CAAC,GACtD,QAAQ,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,GACjG,QAAQ,CAAC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAoB/C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,WAAW,CA6ChF;AAED,kGAAkG;AAClG,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAU7E;AAED,+FAA+F;AAC/F,wBAAgB,qBAAqB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACzE,OAAO,EAAE,SAAS,CAAC,EAAE,EACrB,KAAK,EAAE,WAAW,GACjB,SAAS,CAAC,EAAE,CAGd"}

package/dist/server/multi-target-authorization.js

@@ -0,0 +1,97 @@
+/** Pure, fail-closed target grants from the verified XSUAA attribute boundary. */
+import { TARGET_ID_PATTERN } from './multi-target-identity.js';
+const ATTRIBUTE = 'arc1_targets';
+const MAX_RAW_VALUES = 1_024;
+const MAX_VALUE_BYTES = 128;
+const MAX_TOTAL_BYTES = 16 * 1_024;
+const MAX_UNIQUE_VALUES = 256;
+const MAX_TARGET_LENGTH = 36;
+const EMPTY_TARGETS = Object.freeze([]);
+function none(status) {
+    return Object.freeze({ mode: 'none', status });
+}
+/** Only own data properties are accepted; inherited values/accessors are not claims. */
+function ownValue(value, key) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    return Object.getOwnPropertyDescriptor(value, key)?.value;
+}
+/**
+ * Consume only the auth package's verified, allowlisted values and extraction status.
+ * This function neither verifies JWTs nor authorizes standard mode. The HTTP boundary must
+ * supply AuthInfo from its configured XSUAA verifier; callers cannot supply their own extra.
+ */
+export function parseTargetGrant(authInfo) {
+    const extra = ownValue(authInfo, 'extra');
+    const values = ownValue(ownValue(extra, 'xsuaaUserAttributes'), ATTRIBUTE);
+    const status = ownValue(ownValue(extra, 'xsuaaUserAttributeStatus'), ATTRIBUTE);
+    if (status === 'missing')
+        return none('TARGET_GRANT_MISSING');
+    if (status === 'invalid')
+        return none('TARGET_GRANT_MALFORMED');
+    if (status === 'limit_exceeded')
+        return none('TARGET_GRANT_LIMIT_EXCEEDED');
+    if (status === undefined && values === undefined)
+        return none('TARGET_GRANT_MISSING');
+    if (status !== 'valid')
+        return none('TARGET_GRANT_MALFORMED');
+    if (typeof values !== 'string' && !Array.isArray(values))
+        return none('TARGET_GRANT_MALFORMED');
+    const rawValues = typeof values === 'string' ? [values] : values;
+    if (rawValues.length > MAX_RAW_VALUES)
+        return none('TARGET_GRANT_LIMIT_EXCEEDED');
+    if (rawValues.length === 0)
+        return none('TARGET_GRANT_MISSING');
+    // Bound every original value before trimming or deduplication. The cheap code-unit
+    // guard avoids scanning an arbitrarily large string merely to measure its UTF-8 bytes.
+    let totalBytes = 0;
+    for (const value of rawValues) {
+        if (typeof value !== 'string')
+            return none('TARGET_GRANT_MALFORMED');
+        if (value.length > MAX_VALUE_BYTES)
+            return none('TARGET_GRANT_LIMIT_EXCEEDED');
+        const bytes = Buffer.byteLength(value, 'utf8');
+        totalBytes += bytes;
+        if (bytes > MAX_VALUE_BYTES || totalBytes > MAX_TOTAL_BYTES)
+            return none('TARGET_GRANT_LIMIT_EXCEEDED');
+    }
+    const canonical = new Set();
+    for (const value of rawValues) {
+        // IAM values must be ASCII before normalization: Unicode case folding and
+        // whitespace removal must never manufacture an exact ID or the all-target grant.
+        if (!/^[\t\n\v\f\r -~]*$/.test(value))
+            return none('TARGET_GRANT_MALFORMED');
+        const trimmed = value.trim();
+        const slash = trimmed.indexOf('/');
+        // Unlike forgiving tool arguments, grants reject non-ASCII above. Uppercase only
+        // the system segment; never split CSV, Unicode-fold an ID, or expand globs.
+        const normalized = slash >= 0 ? `${trimmed.slice(0, slash).toUpperCase()}${trimmed.slice(slash)}` : trimmed;
+        if (normalized !== '*' && !TARGET_ID_PATTERN.test(normalized))
+            return none('TARGET_GRANT_MALFORMED');
+        canonical.add(normalized);
+        if (canonical.size > MAX_UNIQUE_VALUES)
+            return none('TARGET_GRANT_LIMIT_EXCEEDED');
+    }
+    // A broad grant must not conceal a later malformed value or exceed the unique bound.
+    if (canonical.has('*'))
+        return Object.freeze({ mode: 'all', status: 'valid' });
+    const targets = Object.freeze([...canonical].sort());
+    return Object.freeze({ mode: 'exact', status: 'valid', targets, exactGrantCount: targets.length });
+}
+/** The requested ID must already be canonical; even all-target grants never accept bad syntax. */
+export function isTargetGranted(grant, targetId) {
+    if (typeof targetId !== 'string' ||
+        targetId.length > MAX_TARGET_LENGTH ||
+        targetId !== targetId.trim() ||
+        !TARGET_ID_PATTERN.test(targetId)) {
+        return false;
+    }
+    return grant.mode === 'all' || (grant.mode === 'exact' && grant.targets.includes(targetId));
+}
+/** Filter an immutable registry projection without mutating it or revealing unknown grants. */
+export function projectGrantedTargets(targets, grant) {
+    if (grant.mode === 'none')
+        return EMPTY_TARGETS;
+    return Object.freeze(targets.filter((target) => isTargetGranted(grant, target.target)));
+}
+//# sourceMappingURL=multi-target-authorization.js.map

package/dist/server/multi-target-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-authorization.js","sourceRoot":"","sources":["../../src/server/multi-target-authorization.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAGlF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAU/D,MAAM,SAAS,GAAG,cAAc,CAAC;AACjC,MAAM,cAAc,GAAG,KAAK,CAAC;AAC7B,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,eAAe,GAAG,EAAE,GAAG,KAAK,CAAC;AACnC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE1D,SAAS,IAAI,CAAC,MAA0B;IACtC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,wFAAwF;AACxF,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAW;IAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkC;IACjE,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,0BAA0B,CAAC,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC5E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACtF,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC9D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAEhG,MAAM,SAAS,GAAuB,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrF,IAAI,SAAS,CAAC,MAAM,GAAG,cAAc;QAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAClF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAEhE,mFAAmF;IACnF,uFAAuF;IACvF,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrE,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/C,UAAU,IAAI,KAAK,CAAC;QACpB,IAAI,KAAK,GAAG,eAAe,IAAI,UAAU,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IAC1G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,SAA8B,EAAE,CAAC;QACnD,0EAA0E;QAC1E,iFAAiF;QACjF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,iFAAiF;QACjF,4EAA4E;QAC5E,MAAM,UAAU,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5G,IAAI,UAAU,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACrG,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1B,IAAI,SAAS,CAAC,IAAI,GAAG,iBAAiB;YAAE,OAAO,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACrF,CAAC;IAED,qFAAqF;IACrF,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACrG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,eAAe,CAAC,KAAkB,EAAE,QAAgB;IAClE,IACE,OAAO,QAAQ,KAAK,QAAQ;QAC5B,QAAQ,CAAC,MAAM,GAAG,iBAAiB;QACnC,QAAQ,KAAK,QAAQ,CAAC,IAAI,EAAE;QAC5B,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EACjC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9F,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,qBAAqB,CACnC,OAAqB,EACrB,KAAkB;IAElB,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,aAAa,CAAC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC"}

package/dist/server/multi-target-bearer-auth.d.ts

@@ -0,0 +1,5 @@
+/** Principal denials intentionally omit the SDK's insufficient_scope/re-login challenge. */
+import { type Verifier } from '@arc-mcp/xsuaa-auth';
+import type { RequestHandler } from 'express';
+export declare function requireXsuaaUserBearerAuth(verifier: Verifier, resourceMetadataUrl: string): RequestHandler;
+//# sourceMappingURL=multi-target-bearer-auth.d.ts.map

package/dist/server/multi-target-bearer-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-bearer-auth.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-bearer-auth.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAE,KAAK,QAAQ,EAA+B,MAAM,qBAAqB,CAAC;AAEjF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,QAAQ,EAAE,mBAAmB,EAAE,MAAM,GAAG,cAAc,CAiC1G"}

package/dist/server/multi-target-bearer-auth.js

@@ -0,0 +1,39 @@
+/** Principal denials intentionally omit the SDK's insufficient_scope/re-login challenge. */
+import { XsuaaUserTokenRequiredError } from '@arc-mcp/xsuaa-auth';
+import { requireBearerAuth } from '@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js';
+export function requireXsuaaUserBearerAuth(verifier, resourceMetadataUrl) {
+    return async (req, res, next) => {
+        // Keep the SDK's header parsing and token-expiry checks authoritative. Only valid-looking
+        // headers need preverification to distinguish principal rejection from missing scope.
+        // xsuaa-auth 1.1.0 already maps to SDK 403; this adapter preserves ADR-0008's
+        // forbidden response without a WWW-Authenticate challenge inviting futile login retries.
+        const [kind, token] = req.headers.authorization?.split(' ') ?? [];
+        if (kind?.toLowerCase() !== 'bearer' || !token) {
+            await requireBearerAuth({ verifier: { verifyAccessToken: verifier }, resourceMetadataUrl })(req, res, next);
+            return;
+        }
+        try {
+            const auth = await verifier(token);
+            await requireBearerAuth({
+                verifier: { verifyAccessToken: async () => auth },
+                resourceMetadataUrl,
+            })(req, res, next);
+        }
+        catch (error) {
+            if (error instanceof XsuaaUserTokenRequiredError) {
+                res.status(403).json({ error: 'forbidden', error_description: 'A supported XSUAA user token is required.' });
+                return;
+            }
+            // Preserve SDK 401/500 classification without performing signature verification twice.
+            await requireBearerAuth({
+                verifier: {
+                    verifyAccessToken: async () => {
+                        throw error;
+                    },
+                },
+                resourceMetadataUrl,
+            })(req, res, next);
+        }
+    };
+}
+//# sourceMappingURL=multi-target-bearer-auth.js.map

package/dist/server/multi-target-bearer-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-bearer-auth.js","sourceRoot":"","sources":["../../src/server/multi-target-bearer-auth.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,OAAO,EAAiB,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gEAAgE,CAAC;AAGnG,MAAM,UAAU,0BAA0B,CAAC,QAAkB,EAAE,mBAA2B;IACxF,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC9B,0FAA0F;QAC1F,sFAAsF;QACtF,8EAA8E;QAC9E,yFAAyF;QACzF,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAClE,IAAI,IAAI,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,iBAAiB,CAAC,EAAE,QAAQ,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,iBAAiB,CAAC;gBACtB,QAAQ,EAAE,EAAE,iBAAiB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE;gBACjD,mBAAmB;aACpB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAA2B,EAAE,CAAC;gBACjD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,iBAAiB,EAAE,2CAA2C,EAAE,CAAC,CAAC;gBAC7G,OAAO;YACT,CAAC;YACD,uFAAuF;YACvF,MAAM,iBAAiB,CAAC;gBACtB,QAAQ,EAAE;oBACR,iBAAiB,EAAE,KAAK,IAAI,EAAE;wBAC5B,MAAM,KAAK,CAAC;oBACd,CAAC;iBACF;gBACD,mBAAmB;aACpB,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/multi-target-catalog-enforced.d.ts

@@ -0,0 +1,29 @@
+/** Complete, caller-sensitive catalog for the explicitly opted-in authorization mode. */
+import type { ToolResult } from '../handlers/shared.js';
+import type { DestinationRegistry } from './destination-registry.js';
+export declare const TARGET_CATALOG_MAX_RESULT_BYTES: number;
+export interface TargetCatalogEnforcement {
+    readonly allowsTarget: (target: string) => boolean;
+    readonly authorization: Readonly<{
+        mode: 'xsuaa-attribute';
+        grantMode: 'none' | 'exact' | 'all';
+        status: 'valid' | 'TARGET_GRANT_MISSING' | 'TARGET_GRANT_MALFORMED' | 'TARGET_GRANT_LIMIT_EXCEEDED';
+        exactGrantCount?: number;
+    }>;
+}
+export interface EnforcedCatalogOptions {
+    admin: boolean;
+    query?: string;
+    enforcement: TargetCatalogEnforcement;
+    runtimeAuth?: (target: string) => {
+        status: string;
+        checkedAt?: string;
+    };
+}
+export declare function buildEnforcedTargetCatalog(registry: DestinationRegistry, options: EnforcedCatalogOptions): unknown;
+export declare function catalogResultWithinBudget(result: ToolResult): boolean;
+/** The budget covers the entire wire wrapper, including escaped JSON text. */
+export declare function buildEnforcedTargetCatalogResult(registry: DestinationRegistry, options: EnforcedCatalogOptions): ToolResult;
+/** Reserve the complete operator view and maximum bounded passive-health fields at startup. */
+export declare function enforcedCatalogFitsSnapshot(registry: DestinationRegistry): boolean;
+//# sourceMappingURL=multi-target-catalog-enforced.d.ts.map

package/dist/server/multi-target-catalog-enforced.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-catalog-enforced.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-catalog-enforced.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,KAAK,EAAE,mBAAmB,EAAoB,MAAM,2BAA2B,CAAC;AAGvF,eAAO,MAAM,+BAA+B,QAAa,CAAC;AAE1D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC/B,IAAI,EAAE,iBAAiB,CAAC;QACxB,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;QACpC,MAAM,EAAE,OAAO,GAAG,sBAAsB,GAAG,wBAAwB,GAAG,6BAA6B,CAAC;QACpG,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,wBAAwB,CAAC;IACtC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAkDD,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,mBAAmB,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAmElH;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAErE;AAED,8EAA8E;AAC9E,wBAAgB,gCAAgC,CAC9C,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,sBAAsB,GAC9B,UAAU,CAiBZ;AAED,+FAA+F;AAC/F,wBAAgB,2BAA2B,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAmBlF"}

package/dist/server/multi-target-catalog-enforced.js

@@ -0,0 +1,142 @@
+import { textResult, toolJson } from '../handlers/shared.js';
+import { compareCatalogStrings, projectEnforcedDiagnostic } from './multi-target-catalog-projection.js';
+export const TARGET_CATALOG_MAX_RESULT_BYTES = 512 * 1024;
+const SHARED_AUTH_STATES = new Set([
+    'not_checked',
+    'checking',
+    'healthy',
+    'configuration_invalid',
+    'authentication_failed',
+    'authorization_failed',
+    'temporarily_unavailable',
+]);
+const NORMAL_SHARED_AUTH_STATES = new Set(['not_checked', 'checking', 'healthy']);
+const CHECKED_AT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function matchesTarget(target, query) {
+    return !query || target.target.toLowerCase().includes(query) || target.description.toLowerCase().includes(query);
+}
+function authorizationView(enforcement) {
+    const value = enforcement.authorization;
+    return {
+        mode: 'xsuaa-attribute',
+        grantMode: value.grantMode,
+        status: value.status,
+        ...(value.grantMode === 'exact' ? { exactGrantCount: value.exactGrantCount } : {}),
+    };
+}
+function failureView(registry, enforcement, failure = registry.failure) {
+    return {
+        targets: [],
+        admin: {
+            state: 'error',
+            source: 'btp-subaccount',
+            loadedAt: registry.loadedAt,
+            revision: registry.revision,
+            authorization: authorizationView(enforcement),
+            countsComplete: registry.countsComplete,
+            ...(registry.countsComplete ? { counts: registry.counts } : {}),
+            ...(registry.arcRelatedAtLeast === undefined ? {} : { arcRelatedAtLeast: registry.arcRelatedAtLeast }),
+            failure,
+            destinations: [],
+        },
+    };
+}
+export function buildEnforcedTargetCatalog(registry, options) {
+    if (registry.failure)
+        return options.admin ? failureView(registry, options.enforcement) : [];
+    const query = options.query?.trim().toLowerCase() ?? '';
+    const targets = registry.targets
+        .filter((target) => matchesTarget(target, query))
+        .sort((a, b) => compareCatalogStrings(a.target, b.target));
+    const publicTargets = targets
+        .filter((target) => options.admin || options.enforcement.allowsTarget(target.target))
+        .map((target) => ({
+        target: target.target,
+        description: target.description,
+        identity: target.identity,
+        ...(options.admin ? { granted: options.enforcement.allowsTarget(target.target) } : {}),
+    }));
+    if (!options.admin)
+        return publicTargets;
+    const shared = registry.targets.filter((target) => target.identity === 'shared');
+    const statusCounts = {};
+    const exceptions = [];
+    for (const target of shared) {
+        const state = options.runtimeAuth?.(target.target) ?? { status: 'not_checked' };
+        const status = SHARED_AUTH_STATES.has(state.status) ? state.status : 'temporarily_unavailable';
+        statusCounts[status] = (statusCounts[status] ?? 0) + 1;
+        if (!NORMAL_SHARED_AUTH_STATES.has(status) && matchesTarget(target, query)) {
+            const checkedAt = state.checkedAt && CHECKED_AT.test(state.checkedAt) ? state.checkedAt : undefined;
+            exceptions.push({ target: target.target, status, ...(checkedAt ? { checkedAt } : {}) });
+        }
+    }
+    exceptions.sort((a, b) => compareCatalogStrings(a.target, b.target));
+    const destinations = registry.diagnostics
+        .map(projectEnforcedDiagnostic)
+        .map((entry) => ({ ...entry, destinationName: entry.destinationName || undefined }))
+        .filter((entry) => !query ||
+        [entry.destinationName, entry.target, entry.description, entry.status, entry.code, entry.message].some((value) => value?.toLowerCase().includes(query)))
+        .sort((a, b) => compareCatalogStrings(`${a.destinationName ?? ''}\0${a.target ?? ''}\0${a.code}`, `${b.destinationName ?? ''}\0${b.target ?? ''}\0${b.code}`));
+    return {
+        targets: publicTargets,
+        admin: {
+            state: registry.counts.quarantined ? 'degraded' : 'ready',
+            source: 'btp-subaccount',
+            loadedAt: registry.loadedAt,
+            revision: registry.revision,
+            counts: registry.counts,
+            countsComplete: true,
+            authorization: authorizationView(options.enforcement),
+            ...(shared.length
+                ? {
+                    sharedAuthentication: {
+                        targets: shared.length,
+                        statusCounts,
+                        ...(exceptions.length ? { exceptions } : {}),
+                    },
+                }
+                : {}),
+            destinations,
+        },
+    };
+}
+export function catalogResultWithinBudget(result) {
+    return Buffer.byteLength(JSON.stringify(result), 'utf8') <= TARGET_CATALOG_MAX_RESULT_BYTES;
+}
+/** The budget covers the entire wire wrapper, including escaped JSON text. */
+export function buildEnforcedTargetCatalogResult(registry, options) {
+    const result = textResult(toolJson(buildEnforcedTargetCatalog(registry, options)));
+    if (registry.failure)
+        result.isError = true;
+    if (catalogResultWithinBudget(result))
+        return result;
+    return {
+        ...textResult(toolJson(options.admin
+            ? failureView(registry, options.enforcement, {
+                code: 'CATALOG_SIZE_LIMIT_EXCEEDED',
+                message: 'Complete target catalog exceeds its size limit; no partial inventory is returned.',
+            })
+            : { error: 'CATALOG_SIZE_LIMIT_EXCEEDED', message: 'Target catalog exceeds its size limit.' })),
+        isError: true,
+    };
+}
+/** Reserve the complete operator view and maximum bounded passive-health fields at startup. */
+export function enforcedCatalogFitsSnapshot(registry) {
+    const payload = buildEnforcedTargetCatalog(registry, {
+        admin: true,
+        enforcement: {
+            allowsTarget: () => false,
+            authorization: {
+                mode: 'xsuaa-attribute',
+                grantMode: 'exact',
+                status: 'valid',
+                exactGrantCount: 256,
+            },
+        },
+        runtimeAuth: () => ({ status: 'temporarily_unavailable', checkedAt: '9999-12-31T23:59:59.999Z' }),
+    });
+    // Mixed passive-state counts and the longest grant-error status add small metadata differences.
+    // Reserve these before accepting a snapshot; the final serialized-result guard remains authoritative.
+    return (Buffer.byteLength(JSON.stringify(textResult(toolJson(payload))), 'utf8') + 1024 <= TARGET_CATALOG_MAX_RESULT_BYTES);
+}
+//# sourceMappingURL=multi-target-catalog-enforced.js.map

package/dist/server/multi-target-catalog-enforced.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-catalog-enforced.js","sourceRoot":"","sources":["../../src/server/multi-target-catalog-enforced.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE7D,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAC;AAExG,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AAmB1D,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IACjC,aAAa;IACb,UAAU;IACV,SAAS;IACT,uBAAuB;IACvB,uBAAuB;IACvB,sBAAsB;IACtB,yBAAyB;CAC1B,CAAC,CAAC;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AAClF,MAAM,UAAU,GAAG,+CAA+C,CAAC;AAEnE,SAAS,aAAa,CAAC,MAAwB,EAAE,KAAa;IAC5D,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAqC;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnF,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,QAA6B,EAC7B,WAAqC,EACrC,OAAO,GAAG,QAAQ,CAAC,OAAO;IAE1B,OAAO;QACL,OAAO,EAAE,EAAE;QACX,KAAK,EAAE;YACL,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,aAAa,EAAE,iBAAiB,CAAC,WAAW,CAAC;YAC7C,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,QAAQ,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YACtG,OAAO;YACP,YAAY,EAAE,EAAE;SACjB;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAA6B,EAAE,OAA+B;IACvG,IAAI,QAAQ,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO;SAC7B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;SAChD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO;SAC1B,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SACpF,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC,CAAC;IACN,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IAEzC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACjF,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,MAAM,UAAU,GAAkE,EAAE,CAAC;IACrF,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC/F,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;YAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YACpG,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW;SACtC,GAAG,CAAC,yBAAyB,CAAC;SAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,SAAS,EAAE,CAAC,CAAC;SACnF,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,CAAC,KAAK;QACN,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CACpG,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAChD,CACJ;SACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,qBAAqB,CACnB,GAAG,CAAC,CAAC,eAAe,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,EAC1D,GAAG,CAAC,CAAC,eAAe,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAC3D,CACF,CAAC;IACJ,OAAO;QACL,OAAO,EAAE,aAAa;QACtB,KAAK,EAAE;YACL,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO;YACzD,MAAM,EAAE,gBAAgB;YACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC;YACrD,GAAG,CAAC,MAAM,CAAC,MAAM;gBACf,CAAC,CAAC;oBACE,oBAAoB,EAAE;wBACpB,OAAO,EAAE,MAAM,CAAC,MAAM;wBACtB,YAAY;wBACZ,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7C;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,YAAY;SACb;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,MAAkB;IAC1D,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,+BAA+B,CAAC;AAC9F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,gCAAgC,CAC9C,QAA6B,EAC7B,OAA+B;IAE/B,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,0BAA0B,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IAC5C,IAAI,yBAAyB,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACrD,OAAO;QACL,GAAG,UAAU,CACX,QAAQ,CACN,OAAO,CAAC,KAAK;YACX,CAAC,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE;gBACzC,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,mFAAmF;aAC7F,CAAC;YACJ,CAAC,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAChG,CACF;QACD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,2BAA2B,CAAC,QAA6B;IACvE,MAAM,OAAO,GAAG,0BAA0B,CAAC,QAAQ,EAAE;QACnD,KAAK,EAAE,IAAI;QACX,WAAW,EAAE;YACX,YAAY,EAAE,GAAG,EAAE,CAAC,KAAK;YACzB,aAAa,EAAE;gBACb,IAAI,EAAE,iBAAiB;gBACvB,SAAS,EAAE,OAAO;gBAClB,MAAM,EAAE,OAAO;gBACf,eAAe,EAAE,GAAG;aACrB;SACF;QACD,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,SAAS,EAAE,0BAA0B,EAAE,CAAC;KAClG,CAAC,CAAC;IACH,gGAAgG;IAChG,sGAAsG;IACtG,OAAO,CACL,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,IAAI,IAAI,+BAA+B,CACnH,CAAC;AACJ,CAAC"}

package/dist/server/multi-target-catalog-projection.d.ts

@@ -0,0 +1,7 @@
+/** Bounded display-only projection. Never use these fields for connection validation or drift. */
+import type { TargetDiagnostic } from './destination-registry.js';
+export declare function boundedCatalogText(value: string | undefined, maximum: number): string | undefined;
+export declare function projectEnforcedDiagnostic(entry: TargetDiagnostic): TargetDiagnostic;
+/** Code-unit order is independent of operating-system locale and ICU version. */
+export declare function compareCatalogStrings(left: string, right: string): number;
+//# sourceMappingURL=multi-target-catalog-projection.d.ts.map

package/dist/server/multi-target-catalog-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-catalog-projection.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-catalog-projection.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAWlE,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIjG;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,gBAAgB,GAAG,gBAAgB,CAyCnF;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE"}

package/dist/server/multi-target-catalog-projection.js

@@ -0,0 +1,52 @@
+import { normalizeTargetDisplayText, SAP_SYSID_PATTERN, TARGET_ID_PATTERN, TARGET_SYSTEM_ALIAS_PATTERN, } from './multi-target-identity.js';
+const SAFE_NAME = /^[A-Za-z0-9_.-]{1,200}$/;
+const SAFE_CODE = /^[A-Z][A-Z0-9_]{0,63}$/;
+export function boundedCatalogText(value, maximum) {
+    if (typeof value !== 'string' || value.length > maximum * 4)
+        return undefined;
+    const normalized = normalizeTargetDisplayText(value);
+    return normalized && normalized.length <= maximum ? normalized : undefined;
+}
+export function projectEnforcedDiagnostic(entry) {
+    const unknownPropertyCount = Math.max(entry.arcConfig.unknownPropertyCount ?? 0, entry.arcConfig.unknownProperties?.length ?? 0);
+    const arcConfig = Object.freeze({
+        ...(typeof entry.arcConfig.enabled === 'boolean' ? { enabled: entry.arcConfig.enabled } : {}),
+        ...(typeof entry.arcConfig.allowDataPreview === 'boolean'
+            ? { allowDataPreview: entry.arcConfig.allowDataPreview }
+            : {}),
+        ...(typeof entry.arcConfig.allowFreeSQL === 'boolean' ? { allowFreeSQL: entry.arcConfig.allowFreeSQL } : {}),
+        ...(TARGET_SYSTEM_ALIAS_PATTERN.test(entry.arcConfig.targetAlias ?? '')
+            ? { targetAlias: entry.arcConfig.targetAlias }
+            : {}),
+        ...(unknownPropertyCount ? { unknownPropertyCount } : {}),
+    });
+    return Object.freeze({
+        destinationName: SAFE_NAME.test(entry.destinationName) ? entry.destinationName : '',
+        ...(TARGET_ID_PATTERN.test(entry.target ?? '') ? { target: entry.target } : {}),
+        status: entry.status,
+        code: entry.code,
+        message: entry.code === 'UNKNOWN_ARC1_PROPERTY'
+            ? 'Unsupported ARC-1 destination properties; inspect the configuration in BTP Cockpit.'
+            : (boundedCatalogText(entry.message, 256) ?? 'Destination configuration requires administrator review.'),
+        ...(boundedCatalogText(entry.description, 160) ? { description: boundedCatalogText(entry.description, 160) } : {}),
+        ...(entry.type === 'HTTP' ? { type: entry.type } : {}),
+        ...(entry.authentication === 'PrincipalPropagation' || entry.authentication === 'BasicAuthentication'
+            ? { authentication: entry.authentication }
+            : {}),
+        ...(entry.proxyType === 'OnPremise' ? { proxyType: entry.proxyType } : {}),
+        ...(SAP_SYSID_PATTERN.test(entry.sid ?? '') ? { sid: entry.sid } : {}),
+        ...(/^\d{3}$/.test(entry.client ?? '') ? { client: entry.client } : {}),
+        ...(/^[A-Z]{2}$/.test(entry.language ?? '') ? { language: entry.language } : {}),
+        hasCloudConnectorLocationId: entry.hasCloudConnectorLocationId === true,
+        ...(entry.requestedPolicy ? { requestedPolicy: entry.requestedPolicy } : {}),
+        ...(entry.effectivePolicy ? { effectivePolicy: entry.effectivePolicy } : {}),
+        ...(entry.limitedByInstance ? { limitedByInstance: true } : {}),
+        arcConfig,
+        warnings: Object.freeze([...new Set(entry.warnings.filter((code) => SAFE_CODE.test(code)))].sort().slice(0, 16)),
+    });
+}
+/** Code-unit order is independent of operating-system locale and ICU version. */
+export function compareCatalogStrings(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+//# sourceMappingURL=multi-target-catalog-projection.js.map

package/dist/server/multi-target-catalog-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-target-catalog-projection.js","sourceRoot":"","sources":["../../src/server/multi-target-catalog-projection.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,4BAA4B,CAAC;AAEpC,MAAM,SAAS,GAAG,yBAAyB,CAAC;AAC5C,MAAM,SAAS,GAAG,wBAAwB,CAAC;AAE3C,MAAM,UAAU,kBAAkB,CAAC,KAAyB,EAAE,OAAe;IAC3E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9E,MAAM,UAAU,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAuB;IAC/D,MAAM,oBAAoB,GAAG,IAAI,CAAC,GAAG,CACnC,KAAK,CAAC,SAAS,CAAC,oBAAoB,IAAI,CAAC,EACzC,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,MAAM,IAAI,CAAC,CAC/C,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,CAAC,gBAAgB,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,SAAS,CAAC,gBAAgB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,KAAK,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,GAAG,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;YACrE,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE;YAC9C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,eAAe,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE;QACnF,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EACL,KAAK,CAAC,IAAI,KAAK,uBAAuB;YACpC,CAAC,CAAC,qFAAqF;YACvF,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,0DAA0D,CAAC;QAC5G,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,sBAAsB,IAAI,KAAK,CAAC,cAAc,KAAK,qBAAqB;YACnG,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,2BAA2B,EAAE,KAAK,CAAC,2BAA2B,KAAK,IAAI;QACvE,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,SAAS;QACT,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjH,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAa;IAC/D,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC"}

package/dist/server/multi-target-feature-state.d.ts

@@ -1,6 +1,4 @@
 /** Authorization-safe, success-only feature state for discovered targets. */
-import type { ResolvedFeatures } from '../adt/types.js';
-export declare function hasAuthorizationLimitedFeatureEvidence(features: ResolvedFeatures): boolean;
 /** One in-flight probe per target. Rejections are observed, cleared, and never cached. */
 export declare function ensureMultiTargetFeatureProbe(target: string | undefined, alreadyKnown: boolean, probe: () => Promise<void>, clearFailedEvidence: () => void): Promise<void>;
 //# sourceMappingURL=multi-target-feature-state.d.ts.map

package/dist/server/multi-target-feature-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-target-feature-state.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-feature-state.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAIxD,wBAAgB,sCAAsC,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAkB1F;AAED,0FAA0F;AAC1F,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,OAAO,EACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC1B,mBAAmB,EAAE,MAAM,IAAI,GAC9B,OAAO,CAAC,IAAI,CAAC,CAef"}
+{"version":3,"file":"multi-target-feature-state.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-feature-state.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAI7E,0FAA0F;AAC1F,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,YAAY,EAAE,OAAO,EACrB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAC1B,mBAAmB,EAAE,MAAM,IAAI,GAC9B,OAAO,CAAC,IAAI,CAAC,CAef"}

package/dist/server/multi-target-feature-state.js

@@ -1,24 +1,5 @@
 /** Authorization-safe, success-only feature state for discovered targets. */
 const probeFlights = new Map();
-export function hasAuthorizationLimitedFeatureEvidence(features) {
-    const authMarker = /(authorization|auth failure|forbidden|\b401\b|\b403\b)/i;
-    const featureStatuses = [
-        features.hana,
-        features.abapGit,
-        features.gcts,
-        features.rap,
-        features.amdp,
-        features.ui5,
-        features.transport,
-        features.ui5repo,
-        features.flp,
-    ];
-    if (featureStatuses.some((status) => !status.available && authMarker.test(status.message ?? '')))
-        return true;
-    if (!features.textSearch?.available && authMarker.test(features.textSearch?.reason ?? ''))
-        return true;
-    return [features.authProbe?.searchReason, features.authProbe?.transportReason].some((reason) => authMarker.test(reason ?? ''));
-}
 /** One in-flight probe per target. Rejections are observed, cleared, and never cached. */
 export async function ensureMultiTargetFeatureProbe(target, alreadyKnown, probe, clearFailedEvidence) {
     if (!target || alreadyKnown)

package/dist/server/multi-target-feature-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"multi-target-feature-state.js","sourceRoot":"","sources":["../../src/server/multi-target-feature-state.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAI7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEtD,MAAM,UAAU,sCAAsC,CAAC,QAA0B;IAC/E,MAAM,UAAU,GAAG,yDAAyD,CAAC;IAC7E,MAAM,eAAe,GAAG;QACtB,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,OAAO;QAChB,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,IAAI;QACb,QAAQ,CAAC,GAAG;QACZ,QAAQ,CAAC,SAAS;QAClB,QAAQ,CAAC,OAAO;QAChB,QAAQ,CAAC,GAAG;KACb,CAAC;IACF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9G,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,IAAI,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7F,UAAU,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAA0B,EAC1B,YAAqB,EACrB,KAA0B,EAC1B,mBAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO;IACpC,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,mBAAmB,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,CAAC;AACf,CAAC"}
+{"version":3,"file":"multi-target-feature-state.js","sourceRoot":"","sources":["../../src/server/multi-target-feature-state.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAE7E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAyB,CAAC;AAEtD,0FAA0F;AAC1F,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,MAA0B,EAC1B,YAAqB,EACrB,KAA0B,EAC1B,mBAA+B;IAE/B,IAAI,CAAC,MAAM,IAAI,YAAY;QAAE,OAAO;IACpC,IAAI,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,KAAK,EAAE,CAAC;QACjB,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,EAAE;YACnB,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM;gBAAE,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACxB,mBAAmB,EAAE,CAAC;YACtB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,CAAC;AACf,CAAC"}

package/dist/server/multi-target-identity.d.ts

@@ -1,5 +1,8 @@
 /** Public target-ID and HTTP-route syntax for destination-discovered multi-target mode. */
 export declare const SAP_SYSID_PATTERN: RegExp;
+export declare const MULTI_TARGET_MAX = 256;
+/** Display labels only: never use normalization to validate a connection or grant. */
+export declare function normalizeTargetDisplayText(value: string): string;
 export declare const TARGET_SYSTEM_SEGMENT_SOURCE = "[A-Z][A-Z0-9-]{1,30}[A-Z0-9]";
 export declare const TARGET_SYSTEM_ALIAS_PATTERN: RegExp;
 export declare const TARGET_ID_PATTERN: RegExp;

package/dist/server/multi-target-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"multi-target-identity.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AAKtD,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAC3E,eAAO,MAAM,2BAA2B,QAAkD,CAAC;AAC3F,eAAO,MAAM,iBAAiB,QAA2D,CAAC;AAC1F,eAAO,MAAM,uBAAuB,QAAoE,CAAC;AACzG,eAAO,MAAM,qCAAqC,QAEjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxE"}
+{"version":3,"file":"multi-target-identity.d.ts","sourceRoot":"","sources":["../../src/server/multi-target-identity.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAE3F,eAAO,MAAM,iBAAiB,QAAuB,CAAC;AACtD,eAAO,MAAM,gBAAgB,MAAM,CAAC;AAEpC,sFAAsF;AACtF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMhE;AAKD,eAAO,MAAM,4BAA4B,iCAAiC,CAAC;AAC3E,eAAO,MAAM,2BAA2B,QAAkD,CAAC;AAC3F,eAAO,MAAM,iBAAiB,QAA2D,CAAC;AAC1F,eAAO,MAAM,uBAAuB,QAAoE,CAAC;AACzG,eAAO,MAAM,qCAAqC,QAEjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjF;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGxE"}