sap-ai-dev-toolkit 0.2.5

package/scripts/postinstall.mjs

@@ -0,0 +1,269 @@
+import { open, readFile } from 'node:fs/promises';
+import { closeSync, openSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ensureGo } from './ensure-go.mjs';
+import { installBinary } from '../src/binary.mjs';
+import { runSetup } from '../src/setup.mjs';
+import { installUserCopilotAssets } from './install-user-copilot-assets.mjs';
+import { createInterface } from 'node:readline/promises';
+import { ReadStream as TTYReadStream, WriteStream as TTYWriteStream } from 'node:tty';
+import { homedir } from 'node:os';
+import { colorText, formatStatus } from '../src/terminal-ui.mjs';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const pkg = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+
+async function announce(message, tone = 'info') {
+  const content = message.replace(/^sap-ai-dev-toolkit:\s*/, '');
+  let terminal;
+  try {
+    terminal = await open(process.platform === 'win32' ? 'CONOUT$' : '/dev/tty', 'w');
+    await terminal.write(`${formatStatus(content, tone, true)}\n`);
+  } catch {
+    console.error(formatStatus(content, tone, process.stderr));
+  } finally {
+    await terminal?.close().catch(() => {});
+  }
+}
+
+function openControllingTerminal() {
+  const inputPath = process.platform === 'win32' ? 'CONIN$' : '/dev/tty';
+  const outputPath = process.platform === 'win32' ? 'CONOUT$' : '/dev/tty';
+  const inputFd = openSync(inputPath, 'r');
+  let outputFd;
+  try {
+    outputFd = openSync(outputPath, 'w');
+    return { input: new TTYReadStream(inputFd), output: new TTYWriteStream(outputFd) };
+  } catch (error) {
+    closeSync(inputFd);
+    if (outputFd !== undefined) closeSync(outputFd);
+    throw error;
+  }
+}
+
+async function withInstallTerminal(action) {
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    return action({ input: process.stdin, output: process.stdout });
+  }
+  let terminal;
+  try {
+    terminal = openControllingTerminal();
+  } catch {
+    return action(null);
+  }
+  try {
+    return await action(terminal);
+  } finally {
+    terminal.input.destroy();
+    terminal.output.destroy();
+  }
+}
+
+async function runInstallSetup() {
+  return withInstallTerminal(terminal => runSetup(terminal || undefined));
+}
+
+async function runCopilotAssetInstall() {
+  await withInstallTerminal(async terminal => {
+    if (!terminal) {
+      await announce('Optional Copilot installation skipped because no interactive terminal is available.', 'warning');
+      return;
+    }
+    const copilotRoot = join(process.env.HOME || homedir(), '.copilot');
+    await announce([
+      'Optional Copilot setup is waiting for your choice.',
+      '',
+      'Press Enter to install the bundled agents and eleven skills in the path shown below; type n then press Enter to skip.',
+      '',
+      `${colorText('✅ Press Enter', 'green', true)} to install the bundled agents and eleven skills.`,
+      `${colorText('⏭️  Type n then Enter', 'yellow', true)} to skip this optional step.`,
+      '',
+      `${colorText('📁 Target folder:', 'cyan', true)}`,
+      `   ${copilotRoot}`,
+      ''
+    ].join('\n'), 'copilot');
+    const prompt = createInterface({ input: terminal.input, output: terminal.output });
+    let answer;
+    try {
+      answer = await prompt.question(`${colorText('🤖 Install the bundled agents and eleven skills?', 'magenta', terminal.output)} ${colorText('[Y/n]', 'yellow', terminal.output)} `);
+    } finally {
+      prompt.close();
+    }
+    if (/^n(?:o)?$/i.test(answer.trim())) {
+      await announce('Copilot agent and skills were skipped. Your files were not changed.', 'info');
+      return;
+    }
+    const assets = await installUserCopilotAssets({ root });
+    const installed = assets.installed + assets.updated;
+    await announce(`Installed ${installed} Copilot files in ${assets.root}; ${assets.unchanged} already current.`, 'success');
+    if (assets.conflicts.length > 0) {
+      const paths = assets.conflicts.map(path => join(assets.root, path)).join(', ');
+      await announce(`Existing Copilot customizations were preserved; review these paths: ${paths}`, 'warning');
+    }
+  });
+}
+
+
+function probeCell(destination) {
+  const probe = destination.probe || {};
+  if (probe.status === 'skipped') return { text: 'SKIPPED (probe disabled)', color: 'yellow' };
+  const error = destination.source === 'cloud-foundry' ? '' : String(probe.error || '')
+    .replace(/(authorization|cookie|password|secret|token)\s*[:=]\s*[^\s,;]+/gi, '$1=[redacted]')
+    .replace(/[\u0000-\u001f\u007f]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .slice(0, 100);
+  const details = [
+    probe.httpStatus ? `HTTP ${probe.httpStatus}` : '',
+    error
+  ].filter(Boolean).join('; ');
+  if (probe.available) {
+    return { text: `PASS ${probe.status || 'reachable'}${details ? ` (${details})` : ''}`, color: 'green' };
+  }
+  return { text: `FAIL ${probe.status || 'unknown'}${details ? ` (${details})` : ''}`, color: 'red' };
+}
+
+export function destinationTable(destinations, registeredNames) {
+  const headings = ['Destination', 'Source', 'Client', 'Authentication', 'ADT probe', 'MCP server'];
+  const rows = destinations.map(destination => {
+    const probe = probeCell(destination);
+    const registered = registeredNames.has(destination.serverName || destination.name);
+    const source = destination.source === 'cloud-foundry'
+      ? `CF ${destination.cf?.destinationInstanceName || 'unknown instance'}`
+      : 'BAS';
+    return [
+      { text: destination.name, output: destination.name },
+      { text: source, output: source },
+      { text: String(destination.client || '001'), output: String(destination.client || '001') },
+      { text: String(destination.authentication || 'Unknown'), output: String(destination.authentication || 'Unknown') },
+      { text: probe.text, output: colorText(probe.text, probe.color, true) },
+      { text: registered ? 'REGISTERED' : 'NOT REGISTERED', output: colorText(registered ? 'REGISTERED' : 'NOT REGISTERED', registered ? 'green' : 'red', true) }
+    ];
+  });
+  const widths = headings.map((heading, index) => Math.max(heading.length, ...rows.map(row => row[index].text.length)));
+  const border = `+${widths.map(width => '-'.repeat(width + 2)).join('+')}+`;
+  const formatRow = cells => `|${cells.map((cell, index) => ` ${cell.output}${' '.repeat(widths[index] - cell.text.length)} `).join('|')}|`;
+  const coloredBorder = colorText(border, 'cyan', true);
+  const coloredHeadings = formatRow(headings.map(text => ({ text, output: colorText(text, 'cyan', true) })));
+  return [coloredBorder, coloredHeadings, coloredBorder, ...rows.map(formatRow), coloredBorder].join('\n');
+}
+async function announceSetup(result) {
+  if (result?.reason === 'non-bas') {
+    await announce('BAS destination setup was skipped because H2O_URL is not set.\nMCP config was not changed.\nRun sap-ai-dev --setup from a BAS dev space when you are ready.', 'info');
+    return;
+  }
+  if (result?.reason === 'non-tty') {
+    await announce('Destination selection was skipped because npm did not provide an interactive terminal.\nMCP config was not changed.\nRun sap-ai-dev --setup from an interactive BAS terminal, or run npx --yes --ignore-scripts --package=sap-ai-dev-toolkit sap-ai-dev --setup --npx.', 'warning');
+    return;
+  }
+  if (result?.reason === 'no-destinations') {
+    const details = (result.warnings || []).map(warning => `• ${warning}`).join('\n');
+    await announce(`No selectable BAS or Cloud Foundry destinations were found; MCP config was not changed.\nRun sap-ai-dev --setup to retry.${details ? `\n${details}` : ''}`, 'warning');
+    return;
+  }
+
+  const servers = Object.entries(result?.servers || {});
+  const path = result?.path || '(path unavailable)';
+  if (!servers.length) {
+    await announce([
+      'No MCP server entries are configured for this add-on.',
+      `MCP config file: ${path}`,
+      'No destinations were selected, so previously managed entries were removed. Other servers and settings were preserved.',
+      'Run sap-ai-dev --setup to choose destinations later.'
+    ].join('\n'), 'info');
+    return;
+  }
+
+  const selected = result.selected || [];
+  const destinationsByServer = new Map(selected.map(destination => [
+    destination.serverName || destination.name,
+    destination
+  ]));
+  const registeredNames = new Set(servers.map(([name]) => name));
+  const entryDetails = servers.flatMap(([name, entry]) => {
+    const destination = destinationsByServer.get(name);
+    const source = entry.env?.BAS_VSP_DESTINATION_SOURCE === 'cloud-foundry' || destination?.source === 'cloud-foundry'
+      ? 'Cloud Foundry'
+      : 'BAS';
+    const destinationName = entry.env?.BAS_VSP_DESTINATION || destination?.name || 'unknown';
+    const client = destination?.client || '001';
+    const authentication = destination?.authentication || 'unknown';
+    const args = Array.isArray(entry.args) ? entry.args : [];
+    const command = [entry.command, ...args].filter(value => typeof value === 'string' && value.length > 0).join(' ');
+    const environmentKeys = Object.keys(entry.env || {}).sort().join(', ');
+    return [
+      `• ${colorText(name, 'cyan', true)}`,
+      `  Destination: ${source} · ${destinationName} · client ${client} · ${authentication}`,
+      `  Launch: ${entry.type || 'stdio'} · ${command || '(command unavailable)'}`,
+      `  Environment keys: ${environmentKeys || '(none)'}`
+    ];
+  });
+  const message = [
+    'Installation configuration summary',
+    `MCP config file: ${path}`,
+    `Configured MCP entries (${servers.length}):`,
+    ...entryDetails,
+    '',
+    destinationTable(selected, registeredNames),
+    `Probe guide: ${colorText('PASS', 'green', true)} = ADT responded (2xx/401/403) · ${colorText('FAIL', 'red', true)} = probe failed · ${colorText('SKIPPED', 'yellow', true)} = probe disabled.`,
+    'Probe results are informational; only selected destinations are registered.',
+    'Unrelated MCP servers and settings were preserved. Authentication remains in BAS/Cloud Foundry; credentials were not copied into the MCP file.',
+    'Inspect: BAS/VS Code → “MCP: Open User Configuration”. Start: “MCP: List Servers” → select a generated server → “Start Server”.'
+  ].join('\n');
+  await announce(message, 'success');
+}
+
+async function main() {
+  if (process.env.npm_config_ignore_scripts === 'true') return;
+
+  try {
+    if (process.env.BAS_VSP_BINARY) {
+      await announce('Using the BAS_VSP_BINARY override.', 'info');
+    } else {
+      await announce('Checking for Go. The supported version installs automatically if needed; this may take a few minutes.', 'progress');
+      try {
+        await ensureGo();
+        await announce('Go is ready.', 'success');
+      } catch (error) {
+        throw new Error(`Go provisioning failed: ${error.message}`);
+      }
+      await announce('Preparing the pinned VSP runtime for this platform.', 'progress');
+      try {
+        await installBinary(pkg);
+        await announce('Pinned VSP binary installed and ready.', 'success');
+      } catch (error) {
+        throw new Error(`VSP binary provisioning failed: ${error.message}`);
+      }
+    }
+  } catch (error) {
+    await announce(error.message, 'error');
+    await announce('Go is provisioned automatically. Set BAS_VSP_BINARY only when supplying a trusted prebuilt VSP executable.', 'info');
+    process.exitCode = 1;
+    return;
+  }
+
+  let setupResult;
+  let setupCompleted = false;
+  try {
+    setupResult = await runInstallSetup();
+    setupCompleted = true;
+  } catch (error) {
+    await announce(`BAS MCP setup failed: ${error.message}`, 'error');
+    await announce('Rerun sap-ai-dev --setup.', 'info');
+  }
+
+  try {
+    await runCopilotAssetInstall();
+  } catch (error) {
+    await announce(`Copilot agent and skill installation failed: ${error.message}`, 'error');
+  }
+  if (setupCompleted) await announceSetup(setupResult);
+}
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main().catch(error => {
+    console.error(formatStatus(`Postinstall failed: ${error.message}`, 'error', process.stderr));
+    process.exitCode = 1;
+  });
+}
+
+

package/scripts/publish-npm.mjs

@@ -0,0 +1,97 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { tmpdir } from 'node:os';
+
+const root = dirname(dirname(fileURLToPath(import.meta.url)));
+const args = new Set(process.argv.slice(2));
+const allowedArgs = new Set(['--patch', '--dry-run']);
+
+function parseToken(value) {
+  const tokenValue = value.trim();
+  if (!tokenValue) return '';
+  if (tokenValue[0] === '"' || tokenValue[0] === "'") {
+    const quote = tokenValue[0];
+    const closingQuote = tokenValue.indexOf(quote, 1);
+    if (closingQuote < 0 || (tokenValue.slice(closingQuote + 1).trim() && !tokenValue.slice(closingQuote + 1).trim().startsWith('#'))) {
+      throw new Error('Malformed NPM_PUBLISH_TOKEN value in .env');
+    }
+    return tokenValue.slice(1, closingQuote);
+  }
+  return tokenValue.replace(/\s+#.*$/, '').trim();
+}
+
+async function npmToken() {
+  if (process.env.NPM_PUBLISH_TOKEN?.trim()) return process.env.NPM_PUBLISH_TOKEN;
+  let envFile;
+  try {
+    envFile = await readFile(join(root, '.env'), 'utf8');
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+    throw new Error('Set NPM_PUBLISH_TOKEN in the project .env file or environment before publishing');
+  }
+
+  let token = '';
+  for (const line of envFile.split(/\r?\n/)) {
+    const assignment = line.match(/^\s*(?:export\s+)?NPM_PUBLISH_TOKEN\s*=\s*(.*?)\s*$/);
+    if (assignment) token = parseToken(assignment[1]);
+  }
+  if (!token) throw new Error('NPM_PUBLISH_TOKEN is missing or empty in the project .env file');
+  return token;
+}
+
+function runNpm(npmArgs, env) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.platform === 'win32' ? 'npm.cmd' : 'npm', npmArgs, {
+      cwd: root,
+      env,
+      stdio: 'inherit',
+      ...(process.platform === 'win32' ? { shell: true } : {})
+    });
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      if (code === 0) resolve();
+      else reject(new Error(signal ? `npm ${npmArgs[0]} terminated by ${signal}` : `npm ${npmArgs[0]} exited with status ${code}`));
+    });
+  });
+}
+
+async function main() {
+  for (const argument of args) {
+    if (!allowedArgs.has(argument)) throw new Error(`Unknown option: ${argument}`);
+  }
+  const dryRun = args.has('--dry-run');
+  const patch = args.has('--patch');
+  if (dryRun && patch) throw new Error('--dry-run cannot be combined with --patch; it never changes the package version');
+
+  let authDirectory;
+  try {
+    let env = { ...process.env };
+    if (!dryRun) {
+      const token = await npmToken();
+      authDirectory = await mkdtemp(join(tmpdir(), 'sap-ai-dev-toolkit-npm-'));
+      const userConfig = join(authDirectory, '.npmrc');
+      await writeFile(userConfig, '//registry.npmjs.org/:_authToken=${NPM_PUBLISH_TOKEN}\n', { encoding: 'utf8', mode: 0o600 });
+      env = {
+        ...env,
+        NPM_PUBLISH_TOKEN: token,
+        npm_config_userconfig: userConfig,
+        NPM_CONFIG_USERCONFIG: userConfig
+      };
+    }
+
+    if (patch) await runNpm(['version', 'patch', '--no-git-tag-version'], env);
+    const packageJson = JSON.parse(await readFile(join(root, 'package.json'), 'utf8'));
+    const publishArgs = ['publish', '--access', 'public', ...(dryRun ? ['--dry-run'] : [])];
+    console.error(`${dryRun ? 'Dry-running' : 'Publishing'} ${packageJson.name}@${packageJson.version}${dryRun ? '' : ' to npm'}...`);
+    await runNpm(publishArgs, env);
+  } finally {
+    if (authDirectory) await rm(authDirectory, { recursive: true, force: true });
+  }
+}
+
+main().catch(error => {
+  console.error(`publish:npm: ${error.message}`);
+  process.exitCode = 1;
+});

package/src/abaplint.mjs

@@ -0,0 +1,105 @@
+import { Config, MemoryFile, Registry } from '@abaplint/core';
+
+export const ABAP_LINT_TOOL = {
+  name: 'LintABAP',
+  description: 'Run abaplint on caller-supplied ABAPGit-serialized files in memory; does not read workspace files or call SAP.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      files: {
+        type: 'array',
+        minItems: 1,
+        items: {
+          type: 'object',
+          properties: {
+            filename: { type: 'string', minLength: 1 },
+            source: { type: 'string' }
+          },
+          required: ['filename', 'source'],
+          additionalProperties: false
+        }
+      },
+      config: { type: 'object' }
+    },
+    required: ['files'],
+    additionalProperties: false
+  }
+};
+
+function isObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function rejectUnknownFields(value, allowed, label) {
+  for (const field of Object.keys(value)) {
+    if (!allowed.has(field)) throw new Error(`Unknown ${label} field: ${field}`);
+  }
+}
+
+function validateArguments(arguments_) {
+  if (!isObject(arguments_)) throw new Error('Arguments must be an object');
+  rejectUnknownFields(arguments_, new Set(['files', 'config']), 'argument');
+  if (!Array.isArray(arguments_.files) || arguments_.files.length === 0) {
+    throw new Error('files must be a nonempty array');
+  }
+  for (const file of arguments_.files) {
+    if (!isObject(file)) throw new Error('Each file must be an object');
+    rejectUnknownFields(file, new Set(['filename', 'source']), 'file');
+    if (typeof file.filename !== 'string' || typeof file.source !== 'string') {
+      throw new Error('Each file must contain string filename and source fields');
+    }
+    const basename = file.filename.split(/[\\/]/).at(-1);
+    if (!/^[^.]+\.[^.]+\.[^.]+$/.test(basename)) {
+      throw new Error('Each filename must have an abapGit object.type.extension basename');
+    }
+  }
+  if (arguments_.config !== undefined && !isObject(arguments_.config)) {
+    throw new Error('config must be an object');
+  }
+}
+
+function errorResult(error) {
+  return {
+    isError: true,
+    content: [{ type: 'text', text: JSON.stringify({ error: error.message || String(error) }) }]
+  };
+}
+
+export async function runABAPLint(arguments_) {
+  try {
+    validateArguments(arguments_);
+    const config = arguments_.config === undefined
+      ? Config.getDefault()
+      : new Config(JSON.stringify(arguments_.config));
+    const files = arguments_.files.map(({ filename, source }) => new MemoryFile(filename, source));
+    const registry = new Registry(config).addFiles(files);
+    await registry.parseAsync();
+    const issues = registry.findIssues();
+    const counts = { Error: 0, Warning: 0, Info: 0 };
+    const reportIssues = issues.map(issue => {
+      counts[issue.getSeverity()] += 1;
+      const start = issue.getStart();
+      const end = issue.getEnd();
+      return {
+        filename: issue.getFilename(),
+        rule: issue.getKey(),
+        severity: issue.getSeverity(),
+        message: issue.getMessage(),
+        start: { line: start.getRow(), column: start.getCol() },
+        end: { line: end.getRow(), column: end.getCol() }
+      };
+    });
+    const report = {
+      status: reportIssues.length === 0 ? 'clean' : 'issues',
+      filesChecked: files.length,
+      issueCount: reportIssues.length,
+      errors: counts.Error,
+      warnings: counts.Warning,
+      infos: counts.Info,
+      issues: reportIssues
+    };
+    return { isError: false, content: [{ type: 'text', text: JSON.stringify(report) }] };
+  } catch (error) {
+    return errorResult(error);
+  }
+}

package/src/bas-discovery.mjs

@@ -0,0 +1,210 @@
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { ProxyAgent, fetch as undiciFetch } from 'undici';
+
+const SECRET_KEY = /^(authorization|cookie|set-cookie|username|user|sap[_-](user(name)?|password|pass|token|saml[_-]?(user|password)|cookie[_-]?(file|string)|browser[_-]?auth|sso|credential[_-]?cmd))$|.*(password|passwd|secret|bearer|credential).*/i;
+const DEFAULT_PROXY = 'http://127.0.0.1:8887';
+
+function keyName(value) {
+  return String(value).toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+
+function scalar(value) {
+  if (Array.isArray(value)) return value.length === 1 ? scalar(value[0]) : value;
+  if (value && typeof value === 'object' && 'value' in value) return scalar(value.value);
+  return value;
+}
+
+function propertiesOf(item) {
+  const result = {};
+  for (const [key, value] of Object.entries(item || {})) result[keyName(key)] = scalar(value);
+  const maps = Object.entries(item || {}).filter(([key]) => ['properties', 'propertymap', 'destinationproperties', 'configuration'].includes(keyName(key))).map(([, value]) => value);
+  for (const map of maps) {
+    if (Array.isArray(map)) {
+      for (const entry of map) {
+        const key = entry?.key ?? entry?.name ?? entry?.property;
+        if (key != null) result[keyName(key)] = scalar(entry?.value ?? entry?.val);
+      }
+    } else if (map && typeof map === 'object') {
+      for (const [key, value] of Object.entries(map)) result[keyName(key)] = scalar(value);
+    }
+  }
+  return result;
+}
+
+
+function text(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function listFromBody(body) {
+  if (Array.isArray(body)) return body;
+  if (!body || typeof body !== 'object') return null;
+  for (const [key, value] of Object.entries(body)) {
+    if (['destinations', 'data'].includes(keyName(key)) && Array.isArray(value)) return value;
+  }
+  return null;
+}
+
+export function normalizeDestination(item) {
+  const values = propertiesOf(item);
+  const name = text(values.name || values.destinationname || values.destname);
+  const authentication = text(values.authentication || values.authtype || values.auth);
+  const client = text(values.sapclient || values.client) || '001';
+  return {
+    name,
+    authentication: authentication || 'Unknown',
+    client,
+    url: name ? destinationUrl(name) : null,
+    rawKeys: Object.keys(item || {}).map(String)
+  };
+}
+
+export function destinationUrl(name) {
+  const value = text(name);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(value)) throw new Error(`Invalid BAS destination name: ${value || '<empty>'}`);
+  return `http://${value}.dest`;
+}
+
+export function slugifyDestination(name, used = new Map()) {
+  const base = text(name).toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '') || 'destination';
+  const count = (used.get(base) || 0) + 1;
+  used.set(base, count);
+  return count === 1 ? base : `${base}-${count}`;
+}
+
+export function redact(value) {
+  if (Array.isArray(value)) return value.map(redact);
+  if (!value || typeof value !== 'object') return value;
+  const result = {};
+  for (const [key, entry] of Object.entries(value)) result[key] = SECRET_KEY.test(key) ? '[redacted]' : redact(entry);
+  return result;
+}
+
+export function sanitizeChildEnv(input = process.env) {
+  const env = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (!SECRET_KEY.test(key)) env[key] = value;
+  }
+  env.SAP_PROXY_CONTEXTID_GUARD = 'true';
+  const proxy = env.HTTP_PROXY || env.http_proxy || DEFAULT_PROXY;
+  if (!env.HTTP_PROXY && !env.http_proxy) env.HTTP_PROXY = proxy;
+  if (!env.HTTPS_PROXY && !env.https_proxy) env.HTTPS_PROXY = proxy;
+  const noProxyKey = env.NO_PROXY != null ? 'NO_PROXY' : (env.no_proxy != null ? 'no_proxy' : 'NO_PROXY');
+  const entries = String(env[noProxyKey] || '').split(',').map(value => value.trim()).filter(Boolean).filter(value => !value.toLowerCase().includes('.dest'));
+  env[noProxyKey] = entries.join(',');
+  return env;
+}
+
+function timeoutSignal(timeoutMs) {
+  return AbortSignal.timeout(timeoutMs);
+}
+
+function proxyBypasses(url, noProxy) {
+  const hostname = url.host.replace(/:\d*$/, '').toLowerCase();
+  const port = Number(url.port) || (url.protocol === 'https:' ? 443 : 80);
+  return String(noProxy).split(/[,\s]/).some(entry => {
+    if (!entry) return false;
+    const match = entry.match(/^(.+):(\d+)$/);
+    const candidate = (match ? match[1] : entry).toLowerCase();
+    if (match && Number(match[2]) !== port) return false;
+    if (/^[.*]/.test(candidate)) return hostname.endsWith(candidate.replace(/^\*/, ''));
+    return hostname === candidate;
+  });
+}
+
+function proxyDispatcher(target, env) {
+  const url = new URL(target);
+  const httpProxy = env.http_proxy ?? env.HTTP_PROXY ?? '';
+  const httpsProxy = env.https_proxy ?? env.HTTPS_PROXY ?? '';
+  const proxy = url.protocol === 'https:' ? httpsProxy || httpProxy : httpProxy;
+  const noProxy = env.no_proxy ?? env.NO_PROXY ?? '';
+  if (!proxy || proxyBypasses(url, noProxy)) return undefined;
+  return new ProxyAgent({ uri: proxy, proxyTunnel: false });
+}
+
+export async function fetchDestinationList(h2oUrl, options = {}) {
+  if (!h2oUrl) throw new Error('H2O_URL is required for BAS destination discovery');
+  const url = `${String(h2oUrl).replace(/\/$/, '')}/api/listDestinations`;
+  const env = options.env || process.env;
+  const dispatcher = proxyDispatcher(url, env);
+  try {
+    const response = await (options.fetchImpl || undiciFetch)(url, {
+      signal: options.signal || timeoutSignal(options.timeoutMs || 10000),
+      headers: { accept: 'application/json' },
+      ...(dispatcher ? { dispatcher } : {})
+    });
+    if (!response.ok) throw new Error(`BAS destination discovery failed with HTTP ${response.status}`);
+    return await response.json();
+  } finally {
+    await dispatcher?.close();
+  }
+}
+
+
+function requestProbe(target, proxyUrl, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const targetUrl = new URL(target);
+    const proxy = proxyUrl ? new URL(proxyUrl) : null;
+    const throughProxy = proxy && targetUrl.protocol === 'http:' && proxy.protocol === 'http:';
+    const transport = throughProxy ? httpRequest : (targetUrl.protocol === 'https:' ? httpsRequest : httpRequest);
+    const requestOptions = throughProxy ? {
+      protocol: proxy.protocol,
+      hostname: proxy.hostname,
+      port: proxy.port || 80,
+      method: 'GET',
+      path: targetUrl.href,
+      headers: { host: targetUrl.host, accept: 'application/xml,text/xml,*/*' }
+    } : {
+      protocol: targetUrl.protocol,
+      hostname: targetUrl.hostname,
+      port: targetUrl.port || (targetUrl.protocol === 'https:' ? 443 : 80),
+      method: 'GET',
+      path: `${targetUrl.pathname}${targetUrl.search}`,
+      headers: { host: targetUrl.host, accept: 'application/xml,text/xml,*/*' }
+    };
+    const req = transport(requestOptions, response => {
+      response.resume();
+      resolve({ status: response.statusCode || 0, throughProxy });
+    });
+    req.setTimeout(timeoutMs, () => req.destroy(new Error('probe timeout')));
+    req.on('error', reject);
+    req.end();
+  });
+}
+
+export async function probeADT(destination, options = {}) {
+  const url = `${destinationUrl(destination.name)}/sap/bc/adt/discovery`;
+  if (options.skipProbe) return { status: 'skipped', available: true, url };
+  try {
+    const result = options.probeImpl ? await options.probeImpl(url, options) : await requestProbe(url, options.proxyUrl || DEFAULT_PROXY, options.timeoutMs || 5000);
+    if ([401, 403].includes(result.status) || (result.status >= 200 && result.status < 300)) return { status: result.status === 401 || result.status === 403 ? 'auth-required' : 'available', available: true, httpStatus: result.status, url };
+    if (result.status === 404) return { status: 'not-found', available: false, httpStatus: result.status, url };
+    return { status: 'unavailable', available: false, httpStatus: result.status, url };
+  } catch (error) {
+    return { status: error?.message === 'probe timeout' ? 'timeout' : 'network-error', available: false, error: error?.message || 'network error', url };
+  }
+}
+
+export async function discoverDestinations(options = {}) {
+  const env = options.env || process.env;
+  const body = options.body ?? await fetchDestinationList(env.H2O_URL, options);
+  const list = listFromBody(body);
+  if (!list) throw new Error(`Unrecognized BAS destination response shape; top-level keys: ${Object.keys(body || {}).map(String).join(', ') || '<none>'}`);
+  const allow = text(env.BAS_VSP_DESTINATION).split(',').map(value => value.trim().toLowerCase()).filter(Boolean);
+  const normalized = list.map(normalizeDestination).filter(item => item.name).filter(item => !allow.length || allow.includes(item.name.toLowerCase()));
+  const proxyUrl = env.HTTP_PROXY || env.http_proxy || DEFAULT_PROXY;
+  const skipProbe = String(env.BAS_VSP_SKIP_PROBE || '').toLowerCase() === 'true' || options.skipProbe;
+  const result = [];
+  for (const destination of normalized.sort((a, b) => a.name.localeCompare(b.name))) {
+    const probe = await probeADT(destination, { ...options, proxyUrl, skipProbe });
+    result.push({ ...destination, probe });
+  }
+  return result;
+}
+
+export function statusRows(destinations) {
+  return destinations.map(destination => ({ name: destination.name, client: destination.client, authentication: destination.authentication, probe: destination.probe?.status || 'unknown' }));
+}
+
+export const remediation = 'No named BAS destinations were returned. Check H2O_URL, Cloud Connector /sap/bc/adt, and run curl "$H2O_URL/api/listDestinations".';