sap-ai-dev-toolkit 0.5.0 → 0.5.6

package/test/cf-connectivity.test.mjs

@@ -1,287 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createServer, request as httpRequest } from 'node:http';
-import net from 'node:net';
-import { createCfConnectivityProxy } from '../src/cf-connectivity.mjs';
-
-async function listen(server) {
-  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
-  return server.address().port;
-}
-
-async function close(server) {
-  if (!server.listening) return;
-  server.closeAllConnections?.();
-  for (const socket of server.__sockets || []) socket.destroy();
-  await new Promise(resolve => server.close(resolve));
-}
-
-function trackSockets(server) {
-  server.__sockets = new Set();
-  server.on('connection', socket => {
-    server.__sockets.add(socket);
-    socket.once('close', () => server.__sockets.delete(socket));
-  });
-  return server;
-}
-
-function responseToken(token, expires = 300) {
-  return new Response(JSON.stringify({ access_token: token, expires_in: expires }), {
-    status: 200,
-    headers: { 'content-type': 'application/json' }
-  });
-}
-
-const connectivityCredentials = port => ({
-  onpremise_proxy_host: '127.0.0.1',
-  onpremise_proxy_http_port: port,
-  token_service_url: 'https://token.example',
-  clientid: 'connectivity-client',
-  clientsecret: 'connectivity-secret'
-});
-
-test('routes HTTP ADT traffic through Connectivity with scoped bearer and location headers', async t => {
-  const observed = { token: [], proxy: [], target: [] };
-  const target = trackSockets(createServer((request, response) => {
-    observed.target.push({ path: request.url, authorization: request.headers.authorization });
-    response.writeHead(200, { 'content-type': 'text/plain' });
-    response.end('ADT response');
-  }));
-  const targetPort = await listen(target);
-  t.after(() => close(target));
-
-  const btpProxy = trackSockets(createServer((request, response) => {
-    observed.proxy.push({
-      authorization: request.headers['proxy-authorization'],
-      location: request.headers['sap-connectivity-scc-location_id'],
-      path: request.url
-    });
-    if (request.headers['proxy-authorization'] !== 'Bearer application-token' || request.headers['sap-connectivity-scc-location_id'] !== 'scc-east') {
-      response.writeHead(403);
-      response.end('proxy credentials rejected');
-      return;
-    }
-    const targetUrl = new URL(request.url);
-    const headers = { ...request.headers, host: targetUrl.host };
-    delete headers['proxy-authorization'];
-    delete headers['sap-connectivity-scc-location_id'];
-    forwardHttpRequest(targetUrl, request.method, headers, response);
-    request.resume();
-  }));
-  const btpPort = await listen(btpProxy);
-  t.after(() => close(btpProxy));
-
-  const tokenRequests = [];
-  const route = await createCfConnectivityProxy({
-    destinationUrl: `http://127.0.0.1:${targetPort}`,
-    connectivityCredentials: connectivityCredentials(btpPort),
-    locationId: 'scc-east',
-    authMode: 'application',
-    fetchImpl: async (url, options) => {
-      tokenRequests.push({ url: String(url), headers: options.headers, body: new URLSearchParams(options.body) });
-      return responseToken('application-token');
-    }
-  });
-  t.after(() => route.close());
-  assert.deepEqual(Object.keys(route).sort(), ['close', 'url']);
-  assert.equal(tokenRequests.length, 1);
-  assert.equal(tokenRequests[0].url, 'https://token.example/oauth/token');
-  assert.equal(tokenRequests[0].headers.authorization, `Basic ${Buffer.from('connectivity-client:connectivity-secret').toString('base64')}`);
-  assert.equal(tokenRequests[0].body.get('grant_type'), 'client_credentials');
-
-  const response = await proxyRequest(route.url, `http://127.0.0.1:${targetPort}/sap/bc/adt/discovery`, {
-    authorization: 'Basic sap-user:sap-password'
-  });
-  assert.equal(response.status, 200);
-  assert.equal(response.body, 'ADT response');
-  assert.deepEqual(observed.proxy.map(request => [request.authorization, request.location]), [['Bearer application-token', 'scc-east']]);
-  assert.deepEqual(observed.target.map(request => [request.path, request.authorization]), [['/sap/bc/adt/discovery', 'Basic sap-user:sap-password']]);
-
-  const forbidden = await proxyRequest(route.url, 'http://not-the-selected-host.example/sap/bc/adt/discovery');
-  assert.equal(forbidden.status, 403);
-  assert.equal(observed.proxy.length, 1, 'unauthorized targets never reach the BTP proxy');
-});
-test('closes stalled Connectivity HTTP forwarding when the route shuts down', async t => {
-  let requestReceived;
-  const receivedRequest = new Promise(resolve => { requestReceived = resolve; });
-  const btpProxy = trackSockets(createServer(request => {
-    request.resume();
-    requestReceived();
-  }));
-  const btpPort = await listen(btpProxy);
-  t.after(() => close(btpProxy));
-  const route = await createCfConnectivityProxy({
-    destinationUrl: 'http://sap.example:8080',
-    connectivityCredentials: connectivityCredentials(btpPort),
-    authMode: 'application',
-    fetchImpl: async () => responseToken('application-token')
-  });
-  t.after(() => route.close());
-
-  const response = proxyRequest(route.url, 'http://sap.example:8080/sap/bc/adt/discovery', {}, 1_000);
-  await receivedRequest;
-  await route.close();
-  await assert.rejects(response);
-  await new Promise(resolve => setTimeout(resolve, 0));
-  assert.equal(btpProxy.__sockets.size, 0, 'route shutdown closes its outstanding BTP request');
-});
-
-test('uses the CF user JWT for PrincipalPropagation CONNECT and never falls back to an application token', async t => {
-  const observed = { connect: [], tunnel: [] };
-  const btpProxy = trackSockets(createServer());
-  btpProxy.on('connect', (request, socket, head) => {
-    observed.connect.push({
-      target: request.url,
-      authorization: request.headers['proxy-authorization'],
-      location: request.headers['sap-connectivity-scc-location_id']
-    });
-    if (request.headers['proxy-authorization'] !== 'Bearer user-exchange-token' || request.headers['sap-connectivity-scc-location_id'] !== 'scc-west') {
-      socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
-      return;
-    }
-    socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
-    if (head.length) observed.tunnel.push(head.toString());
-    socket.on('data', data => observed.tunnel.push(data.toString()));
-  });
-  const btpPort = await listen(btpProxy);
-  t.after(() => close(btpProxy));
-
-  const tokenRequests = [];
-  let userTokenCalls = 0;
-  const route = await createCfConnectivityProxy({
-    destinationUrl: 'https://sap.example:8443',
-    connectivityCredentials: connectivityCredentials(btpPort),
-    locationId: 'scc-west',
-    authMode: 'principal-propagation',
-    userTokenProvider: async () => { userTokenCalls += 1; return 'current-cf-user-jwt'; },
-    fetchImpl: async (url, options) => {
-      tokenRequests.push({ url: String(url), headers: options.headers, body: new URLSearchParams(options.body) });
-      return responseToken('user-exchange-token');
-    }
-  });
-  t.after(() => route.close());
-  assert.equal(userTokenCalls, 1);
-  assert.equal(tokenRequests.length, 1);
-  assert.equal(tokenRequests[0].headers.authorization, `Basic ${Buffer.from('connectivity-client:connectivity-secret').toString('base64')}`);
-  assert.deepEqual(Object.fromEntries(tokenRequests[0].body), {
-    grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
-    assertion: 'current-cf-user-jwt',
-    token_format: 'jwt',
-    response_type: 'token'
-  });
-
-  const port = Number(new URL(route.url).port);
-  const socket = net.connect(port, '127.0.0.1');
-  t.after(() => socket.destroy());
-  const handshake = await new Promise((resolve, reject) => {
-    let data = '';
-    socket.once('error', reject);
-    socket.on('data', chunk => {
-      data += chunk.toString();
-      if (data.includes('\r\n\r\n')) resolve(data);
-    });
-    socket.once('connect', () => socket.write('CONNECT sap.example:8443 HTTP/1.1\r\nHost: sap.example:8443\r\n\r\n'));
-  });
-  assert.match(handshake, /^HTTP\/1\.1 200 Connection Established/);
-  assert.deepEqual(observed.connect, [{
-    target: 'sap.example:8443',
-    authorization: 'Bearer user-exchange-token',
-    location: 'scc-west'
-  }]);
-
-  await route.close();
-  const failedRequests = [];
-  await assert.rejects(() => createCfConnectivityProxy({
-    destinationUrl: 'https://sap.example:8443',
-    connectivityCredentials: connectivityCredentials(btpPort),
-    authMode: 'principal-propagation',
-    userTokenProvider: async () => 'current-cf-user-jwt',
-    fetchImpl: async (_url, options) => {
-      failedRequests.push(new URLSearchParams(options.body));
-      return new Response(JSON.stringify({ error: 'jwt exchange rejected' }), { status: 401 });
-    }
-  }), /Connectivity token exchange was rejected/);
-  assert.equal(failedRequests.length, 1);
-  assert.equal(failedRequests[0].get('grant_type'), 'urn:ietf:params:oauth:grant-type:jwt-bearer');
-  assert.equal(failedRequests[0].has('assertion'), true);
-});
-
-function forwardHttpRequest(target, method, headers, response) {
-  const upstream = httpRequest({
-    hostname: target.hostname,
-    port: Number(target.port || 80),
-    method,
-    path: `${target.pathname}${target.search}`,
-    headers
-  }, upstreamResponse => {
-    response.writeHead(upstreamResponse.statusCode || 502, upstreamResponse.headers);
-    upstreamResponse.pipe(response);
-  });
-  upstream.on('error', () => {
-    if (!response.headersSent) response.writeHead(502);
-    response.end();
-  });
-  upstream.end();
-}
-function proxyRequest(proxyUrl, targetUrl, headers = {}, timeoutMs = 5_000) {
-  return new Promise((resolve, reject) => {
-    const proxy = new URL(proxyUrl);
-    const request = httpRequest({
-      hostname: proxy.hostname,
-      port: Number(proxy.port),
-      method: 'GET',
-      path: targetUrl,
-      headers: { host: new URL(targetUrl).host, ...headers }
-    }, response => {
-      let body = '';
-      response.setEncoding('utf8');
-      response.on('data', chunk => { body += chunk; });
-      response.on('end', () => resolve({ status: response.statusCode || 0, body }));
-    });
-    request.setTimeout(timeoutMs, () => request.destroy(new Error('proxy request timed out')));
-    request.on('error', reject);
-    request.end();
-  });
-}
-test('refreshes a PrincipalPropagation token 60 seconds before expiry with a fresh CF JWT', async () => {
-  const originalNow = Date.now;
-  let now = 1_000;
-  Date.now = () => now;
-  const proxyHeaders = [];
-  const btpProxy = trackSockets(createServer((request, response) => {
-    proxyHeaders.push(request.headers['proxy-authorization']);
-    response.writeHead(204);
-    response.end();
-  }));
-  let route;
-  try {
-    const port = await listen(btpProxy);
-    let userTokenCalls = 0;
-    const tokenRequests = [];
-    route = await createCfConnectivityProxy({
-      destinationUrl: 'http://sap.example:8080',
-      connectivityCredentials: connectivityCredentials(port),
-      authMode: 'principal-propagation',
-      userTokenProvider: async () => `current-user-jwt-${++userTokenCalls}`,
-      fetchImpl: async (_url, options) => {
-        tokenRequests.push(new URLSearchParams(options.body));
-        return responseToken(`user-token-${tokenRequests.length}`, 100);
-      }
-    });
-    assert.equal(tokenRequests.length, 1);
-    const first = await proxyRequest(route.url, 'http://sap.example:8080/first');
-    assert.equal(first.status, 204);
-    assert.equal(tokenRequests.length, 1);
-    now = 41_000;
-    const second = await proxyRequest(route.url, 'http://sap.example:8080/second');
-    assert.equal(second.status, 204);
-    assert.equal(tokenRequests.length, 2);
-    assert.equal(userTokenCalls, 2);
-    assert.deepEqual(proxyHeaders, ['Bearer user-token-1', 'Bearer user-token-2']);
-    assert.deepEqual(tokenRequests.map(body => body.get('assertion')), ['current-user-jwt-1', 'current-user-jwt-2']);
-  } finally {
-    Date.now = originalNow;
-    await route?.close();
-    await close(btpProxy);
-  }
-});

package/test/cf-destination.test.mjs

@@ -1,307 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createServer } from 'node:http';
-import { discoverCloudFoundryDestinations, getCloudFoundryTarget, resolveConfiguredCloudFoundryDestination } from '../src/cf-destination.mjs';
-
-const SPACE_GUID = 'space-123';
-const DESTINATION_GUID = 'destination-instance-123';
-const DESTINATION_INSTANCE = 'destination-service';
-
-async function listen(server) {
-  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
-  return `http://127.0.0.1:${server.address().port}`;
-}
-
-function mockCf({ origin, instances = true, spaceGuid = SPACE_GUID } = {}) {
-  const calls = [];
-  const createdKeys = [];
-  const credentials = {
-    uri: origin,
-    url: `${origin}/uaa`,
-    clientid: 'destination-client',
-    clientsecret: 'destination-service-secret'
-  };
-  const execFileImpl = (_command, args, _options, callback) => {
-    calls.push([...args]);
-    let output = '';
-    const path = args[0] === 'curl' ? args[1] : '';
-    if (args[0] === 'version') output = 'cf version 8.18.0+1234567';
-    else if (args[0] === 'target') output = 'space: MASS\n';
-    else if (args[0] === 'space' && args[1] === 'MASS' && args[2] === '--guid') output = `${spaceGuid}\n`;
-    else if (args[0] === 'oauth-token') output = 'bearer cf-user-jwt';
-    else if (args[0] === 'curl' && path.startsWith('/v3/service_instances?')) {
-      output = JSON.stringify({ resources: instances ? [{
-        guid: DESTINATION_GUID,
-        name: DESTINATION_INSTANCE,
-        relationships: {
-          service_plan: { data: { guid: 'plan-guid' } },
-          space: { data: { guid: SPACE_GUID } }
-        }
-      }] : [] });
-    } else if (args[0] === 'curl' && path === `/v3/service_instances/${DESTINATION_GUID}`) {
-      output = JSON.stringify({
-        guid: DESTINATION_GUID,
-        name: DESTINATION_INSTANCE,
-        relationships: { space: { data: { guid: SPACE_GUID } } }
-      });
-    } else if (args[0] === 'curl' && path === '/v3/service_plans/plan-guid') {
-      output = JSON.stringify({ relationships: { service_offering: { data: { guid: 'offering-guid' } } } });
-    } else if (args[0] === 'curl' && path === '/v3/service_offerings/offering-guid') {
-      output = JSON.stringify({ name: 'Destination' });
-    } else if (args[0] === 'create-service-key') {
-      createdKeys.push({ instanceName: args[1], keyName: args[2] });
-    } else if (args[0] === 'service-key' && args[1] === '--json') {
-      output = JSON.stringify({ credentials: { ...credentials, uri: origin } });
-    } else {
-      callback(new Error('untrusted CLI stderr with secret=must-not-leak'), '', 'secret=must-not-leak');
-      return;
-    }
-    callback(null, output, '');
-  };
-  return { calls, createdKeys, credentials, execFileImpl };
-}
-
-function destinationApi(records, detail) {
-  const observed = { tokenAuthorization: [], listAuthorization: [], adtAuthorization: [], detailRequests: [] };
-  const server = createServer((request, response) => {
-    if (request.url === '/uaa/oauth/token') {
-      observed.tokenAuthorization.push(request.headers.authorization);
-      response.writeHead(200, { 'content-type': 'application/json' });
-      response.end(JSON.stringify({ access_token: 'api-access-token', expires_in: 300 }));
-      return;
-    }
-    if (request.url === '/destination-configuration/v1/instanceDestinations') {
-      observed.listAuthorization.push(request.headers.authorization);
-      response.writeHead(200, { 'content-type': 'application/json' });
-      response.end(JSON.stringify(records));
-      return;
-    }
-    if (request.url === `/destination-configuration/v1/instanceDestinations/${encodeURIComponent(detail?.name || '')}` && detail) {
-      observed.detailRequests.push(request.url);
-      response.writeHead(200, { 'content-type': 'application/json' });
-      response.end(JSON.stringify(detail.body));
-      return;
-    }
-    if (request.url === '/sap/bc/adt/discovery') {
-      observed.adtAuthorization.push(request.headers.authorization);
-      response.writeHead(401);
-      response.end();
-      return;
-    }
-    response.writeHead(404);
-    response.end();
-  });
-  return { server, observed };
-}
-
-const envForLocal = () => ({ PATH: process.env.PATH, HTTP_PROXY: '', HTTPS_PROXY: '', NO_PROXY: '127.0.0.1,localhost' });
-
-test('imports instance Destination records with redacted descriptors and disables unsupported records', async t => {
-  let origin;
-  const records = [
-    {
-      Name: 'internet-basic',
-      Type: 'hTtP',
-      URL: 'http://127.0.0.1:1',
-      Authentication: 'bAsIcAuThEnTiCaTiOn',
-      ProxyType: 'iNtErNeT',
-      Properties: [
-        { Key: 'sap-client', Value: '123' },
-        { Key: 'User', Value: 'sap-user' },
-        { Key: 'Password', Value: 'sap-password' }
-      ]
-    },
-    { Name: 'detail system' },
-    { Name: 'not-http', Type: 'RFC', URL: 'http://127.0.0.1:1', Authentication: 'NoAuthentication', ProxyType: 'Internet' },
-    { Name: 'userinfo-url', Type: 'HTTP', URL: 'http://user:password@127.0.0.1:1', Authentication: 'NoAuthentication', ProxyType: 'Internet' },
-    { Name: 'incomplete-basic', Type: 'HTTP', URL: 'http://127.0.0.1:1', Authentication: 'BasicAuthentication', ProxyType: 'Internet', User: 'only-user' },
-    { Name: '', Type: 'HTTP', URL: 'http://127.0.0.1:1', Authentication: 'NoAuthentication', ProxyType: 'Internet' }
-  ];
-  const api = destinationApi(records, {
-    name: 'detail system',
-    body: { destinationConfiguration: {
-      Name: 'detail system', Type: 'HTTP', URL: 'http://127.0.0.1:1',
-      Authentication: 'NoAuthentication', ProxyType: 'Internet',
-      Properties: [{ Key: 'sap-client', Value: '250' }]
-    } }
-  });
-  origin = await listen(api.server);
-  // Point service-key credentials at the local Destination API while retaining a separate SAP target.
-  const targetServer = createServer((request, response) => {
-    if (request.url === '/sap/bc/adt/discovery') {
-      api.observed.adtAuthorization.push(request.headers.authorization);
-      response.writeHead(403);
-      response.end();
-      return;
-    }
-    response.writeHead(404);
-    response.end();
-  });
-  const targetOrigin = await listen(targetServer);
-  t.after(async () => {
-    await new Promise(resolve => api.server.close(resolve));
-    await new Promise(resolve => targetServer.close(resolve));
-  });
-
-  records[0].URL = targetOrigin;
-  records[1] = { Name: 'detail system' };
-  api.server.removeAllListeners('request');
-  api.server.on('request', (request, response) => {
-    if (request.url === '/uaa/oauth/token') {
-      api.observed.tokenAuthorization.push(request.headers.authorization);
-      response.writeHead(200, { 'content-type': 'application/json' });
-      response.end(JSON.stringify({ access_token: 'api-access-token', expires_in: 300 }));
-    } else if (request.url === '/destination-configuration/v1/instanceDestinations') {
-      api.observed.listAuthorization.push(request.headers.authorization);
-      response.writeHead(200, { 'content-type': 'application/json' });
-      response.end(JSON.stringify(records));
-    } else if (request.url === `/destination-configuration/v1/instanceDestinations/detail%20system`) {
-      api.observed.detailRequests.push(request.url);
-      response.writeHead(200, { 'content-type': 'application/json' });
-      response.end(JSON.stringify({ destinationConfiguration: {
-        Name: 'detail system', Type: 'HTTP', URL: targetOrigin,
-        Authentication: 'NoAuthentication', ProxyType: 'Internet',
-        Properties: [{ Key: 'sap-client', Value: '250' }]
-      } }));
-    } else {
-      response.writeHead(404);
-      response.end();
-    }
-  });
-
-  const cf = mockCf({ origin });
-  const result = await discoverCloudFoundryDestinations({
-    env: envForLocal(), spaceGuid: SPACE_GUID, execFileImpl: cf.execFileImpl,
-    fetchImpl: globalThis.fetch, input: process.stdin, output: process.stdout
-  });
-
-  assert.equal(cf.createdKeys.length, 1);
-  assert.match(cf.createdKeys[0].keyName, /^sap-ai-dev-toolkit-[0-9a-f-]{36}$/);
-  assert.deepEqual(result.createdKeys.map(({ kind, spaceGuid, instanceGuid, instanceName, keyName }) => [kind, spaceGuid, instanceGuid, instanceName, keyName]), [
-    ['destination', SPACE_GUID, DESTINATION_GUID, DESTINATION_INSTANCE, cf.createdKeys[0].keyName]
-  ]);
-  const imported = result.destinations.find(item => item.name === 'internet-basic');
-  assert.equal(imported.source, 'cloud-foundry');
-  assert.equal(imported.serverName, `cf:${SPACE_GUID}:${DESTINATION_GUID}:internet-basic`);
-  assert.equal(imported.client, '123');
-  assert.equal(imported.authentication, 'BasicAuthentication');
-  assert.equal(imported.proxyType, 'Internet');
-  assert.equal(imported.probe.status, 'auth-required');
-  assert.deepEqual(imported.cf, {
-    spaceGuid: SPACE_GUID,
-    destinationInstanceGuid: DESTINATION_GUID,
-    destinationInstanceName: DESTINATION_INSTANCE,
-    destinationKeyName: cf.createdKeys[0].keyName
-  });
-  assert.equal(result.destinations.find(item => item.name === 'detail system').client, '250');
-  assert.equal(api.observed.detailRequests.length, 1);
-  assert.match(result.destinations.find(item => item.name === 'not-http').disabledReason, /Type must be HTTP/);
-  assert.match(result.destinations.find(item => item.name === 'userinfo-url').disabledReason, /embedded user information/);
-  assert.match(result.destinations.find(item => item.name === 'incomplete-basic').disabledReason, /requires both User and Password/);
-  assert.ok(result.warnings.some(warning => /Skipped 1 unnamed destination record/.test(warning)));
-  assert.deepEqual(api.observed.tokenAuthorization, [`Basic ${Buffer.from('destination-client:destination-service-secret').toString('base64')}`]);
-  assert.deepEqual(api.observed.listAuthorization, ['Bearer api-access-token']);
-  assert.ok(api.observed.adtAuthorization.includes(`Basic ${Buffer.from('sap-user:sap-password').toString('base64')}`));
-  const safe = JSON.stringify({ destinations: result.destinations, createdKeys: result.createdKeys, warnings: result.warnings });
-  for (const secret of ['destination-service-secret', 'api-access-token', 'sap-password', 'sap-user', 'http://127.0.0.1']) assert.equal(safe.includes(secret), false);
-});
-
-test('probes HTTP destinations through forward proxies without CONNECT', async t => {
-  const api = destinationApi([{
-    Name: 'proxied-http',
-    Type: 'HTTP',
-    URL: 'http://abap.virtual:1443',
-    Authentication: 'NoAuthentication',
-    ProxyType: 'Internet'
-  }]);
-  const apiOrigin = await listen(api.server);
-  const proxyRequests = [];
-  const proxyServer = createServer((request, response) => {
-    proxyRequests.push({ method: request.method, url: request.url, host: request.headers.host });
-    response.writeHead(401);
-    response.end();
-  });
-  proxyServer.on('connect', (request, socket) => {
-    proxyRequests.push({ method: 'CONNECT', url: request.url, host: request.headers.host });
-    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-  });
-  const proxyOrigin = await listen(proxyServer);
-  t.after(async () => {
-    await new Promise(resolve => api.server.close(resolve));
-    await new Promise(resolve => proxyServer.close(resolve));
-  });
-
-  const cf = mockCf({ origin: apiOrigin });
-  const result = await discoverCloudFoundryDestinations({
-    env: { ...envForLocal(), HTTP_PROXY: proxyOrigin },
-    spaceGuid: SPACE_GUID,
-    execFileImpl: cf.execFileImpl,
-    fetchImpl: globalThis.fetch,
-    input: process.stdin,
-    output: process.stdout
-  });
-
-  assert.deepEqual(proxyRequests, [{
-    method: 'GET',
-    url: 'http://abap.virtual:1443/sap/bc/adt/discovery',
-    host: 'abap.virtual:1443'
-  }]);
-  assert.equal(result.destinations[0].probe.status, 'auth-required');
-});
-
-test('skips CF import without creating a key when no Destination service exists', async () => {
-  const cf = mockCf({ instances: false, origin: 'http://127.0.0.1:1' });
-  const result = await discoverCloudFoundryDestinations({
-    env: envForLocal(), spaceGuid: SPACE_GUID, execFileImpl: cf.execFileImpl,
-    input: process.stdin, output: process.stdout
-  });
-  assert.deepEqual(result.destinations, []);
-  assert.deepEqual(result.createdKeys, []);
-  assert.equal(cf.createdKeys.length, 0);
-  assert.ok(result.warnings.some(warning => /No Destination service instance/.test(warning)));
-});
-
-test('resolves a CF Basic destination only after matching the active space', async t => {
-  const records = [{
-    Name: 'runtime-basic', Type: 'HTTP', URL: 'http://sap.example',
-    Authentication: 'BasicAuthentication', ProxyType: 'Internet',
-    User: 'runtime-user', Password: 'runtime-password', 'sap-client': '007'
-  }];
-  const api = destinationApi(records);
-  const origin = await listen(api.server);
-  t.after(() => new Promise(resolve => api.server.close(resolve)));
-  const cf = mockCf({ origin });
-  const env = {
-    ...envForLocal(),
-    SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'cloud-foundry',
-    SAP_AI_DEV_TOOLKIT_DESTINATION: 'runtime-basic',
-    BAS_CF_SPACE_GUID: SPACE_GUID,
-    BAS_CF_DESTINATION_INSTANCE_GUID: DESTINATION_GUID,
-    BAS_CF_DESTINATION_INSTANCE: DESTINATION_INSTANCE,
-    BAS_CF_DESTINATION_KEY: 'managed-destination-key',
-    BAS_CF_DESTINATION_NAME: 'runtime-basic'
-  };
-  const runtime = await resolveConfiguredCloudFoundryDestination({ env, execFileImpl: cf.execFileImpl });
-  assert.equal(runtime.source, 'cloud-foundry');
-  assert.equal(runtime.name, 'runtime-basic');
-  assert.equal(runtime.serverName, `cf:${SPACE_GUID}:${DESTINATION_GUID}:runtime-basic`);
-  assert.equal(runtime.client, '007');
-  assert.deepEqual(runtime.childEnv, { SAP_USER: 'runtime-user', SAP_PASSWORD: 'runtime-password', SAP_VERBOSE: 'false' });
-  assert.equal(cf.calls.some(args => args[0] === 'service-key' && args.at(-1) === 'managed-destination-key'), true);
-  await assert.rejects(
-    () => resolveConfiguredCloudFoundryDestination({ env: { ...env, BAS_CF_SPACE_GUID: 'different-space' }, execFileImpl: cf.execFileImpl }),
-    /does not match configured space different-space/
-  );
-  assert.equal(JSON.stringify(cf.calls).includes('runtime-password'), false);
-  assert.equal(JSON.stringify(runtime.childEnv).includes('destination-service-secret'), false);
-});
-
-test('requires cf CLI 8.18 and a targeted space before prompting', async () => {
-  const oldCli = (_command, args, _options, callback) => {
-    callback(null, args[0] === 'version' ? 'cf version 8.17.1' : '', '');
-  };
-  assert.deepEqual(await getCloudFoundryTarget({ env: {}, execFileImpl: oldCli }), {
-    available: false,
-    reason: 'Cloud Foundry CLI 8.18 or newer is required; CF destinations were skipped.'
-  });
-});