sap-ai-dev-toolkit 0.5.0 → 0.5.6

package/test/discovery.test.mjs

@@ -1,257 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { createServer } from 'node:http';
-import { normalizeDestination, destinationUrl, discoverDestinations, fetchDestinationList, redact, sanitizeChildEnv, slugifyDestination } from '../src/bas-discovery.mjs';
-
-test('normalizes destination metadata case-insensitively', () => {
-  const destination = normalizeDestination({
-    Name: 'DEV-ABAP',
-    Properties: { 'WebIDEEnabled': 'true', 'HTML5.DynamicDestination': true, 'WebIDEUsage': 'dev_abap', 'SAP-Client': '200', Authentication: 'PrincipalPropagation', URL: 'https://backend.example' }
-  });
-  assert.deepEqual(destination, {
-    name: 'DEV-ABAP', authentication: 'PrincipalPropagation', client: '200',
-    url: 'http://DEV-ABAP.dest', backendUrl: 'https://backend.example', proxyType: null, rawKeys: ['Name', 'Properties']
-  });
-});
-
-test('returns every named destination regardless of ADT probe and preserves allowlists', async () => {
-  const body = { DESTINATIONS: [
-    { Name: 'z-system', WebIDEEnabled: true, 'HTML5.DynamicDestination': false, WebIDEUsage: 'ui5' },
-    { Name: 'b-system', WebIDEEnabled: false, 'HTML5.DynamicDestination': false, WebIDEUsage: 'ui5' },
-    { Name: 'a-system', WebIDEEnabled: false, 'HTML5.DynamicDestination': false, WebIDEUsage: 'ui5' }
-  ] };
-  const probeImpl = async url => ({ status: url.includes('a-system') ? 403 : url.includes('b-system') ? 200 : 404 });
-  const allowlisted = await discoverDestinations({
-    body,
-    env: { SAP_AI_DEV_TOOLKIT_DESTINATION: 'a-system,b-system' },
-    probeImpl
-  });
-  assert.deepEqual(allowlisted.map(item => [item.name, item.client, item.probe.status]), [
-    ['a-system', '001', 'auth-required'],
-    ['b-system', '001', 'available']
-  ]);
-
-  const all = await discoverDestinations({ body, env: {}, probeImpl });
-  assert.deepEqual(all.map(item => [item.name, item.probe.status]), [
-    ['a-system', 'auth-required'],
-    ['b-system', 'available'],
-    ['z-system', 'not-found']
-  ]);
-});
-
-test('accepts the previous destination environment variable during upgrades', async () => {
-  const destinations = await discoverDestinations({
-    body: [{ Name: 'legacy-system' }, { Name: 'other-system' }],
-    env: { BAS_VSP_DESTINATION: 'legacy-system' },
-    skipProbe: true
-  });
-  assert.deepEqual(destinations.map(destination => destination.name), ['legacy-system']);
-});
-test('parses sample-style destination records and enables every ADT heartbeat response', async () => {
-  const body = [
-    {
-      Type: 'HTTP',
-      'HTML5.DynamicDestination': 'true',
-      Authentication: 'PrincipalPropagation',
-      'sap-client': '200',
-      Name: 'DGT_200',
-      WebIDEUsage: 'odata_abap,ui5_execute_abap,dev_abap',
-      WebIDEEnabled: 'true'
-    },
-    {
-      Name: 'S4D_100',
-      Type: 'HTTP',
-      Authentication: 'PrincipalPropagation',
-      'HTML5.DynamicDestination': 'true',
-      'sap-client': '100',
-      WebIDEUsage: 'odata_abap',
-      WebIDEEnabled: 'true'
-    },
-    {
-      Name: 'SUP_BACKEND',
-      Type: 'HTTP',
-      Authentication: 'OAuth2ClientCredentials',
-      'HTML5.DynamicDestination': 'true',
-      WebIDEUsage: 'true',
-      WebIDEEnabled: 'true'
-    }
-  ];
-  const probed = [];
-  const destinations = await discoverDestinations({
-    body,
-    env: {},
-    probeImpl: async url => {
-      probed.push(url);
-      if (url.includes('DGT_200.dest')) return { status: 200 };
-      if (url.includes('S4D_100.dest')) return { status: 403 };
-      return { status: 404 };
-    }
-  });
-
-  assert.deepEqual(probed, [
-    'http://DGT_200.dest/sap/bc/adt/discovery',
-    'http://S4D_100.dest/sap/bc/adt/discovery',
-    'http://SUP_BACKEND.dest/sap/bc/adt/discovery'
-  ]);
-  assert.deepEqual(destinations.map(({ name, client, authentication, probe }) => [
-    name, client, authentication, probe.status, probe.available
-  ]), [
-    ['DGT_200', '200', 'PrincipalPropagation', 'available', true],
-    ['S4D_100', '100', 'PrincipalPropagation', 'auth-required', true],
-    ['SUP_BACKEND', '001', 'OAuth2ClientCredentials', 'not-found', false]
-  ]);
-});
-
-test('keeps T4D destinations when their ADT probes fail', async () => {
-  const destinations = await discoverDestinations({
-    body: [
-      { Name: 'T4D_100', 'sap-client': '100' },
-      { Name: 'T4D_200', 'sap-client': '200' }
-    ],
-    env: {},
-    probeImpl: async url => ({ status: url.includes('T4D_100') ? 503 : 404 })
-  });
-
-  assert.deepEqual(destinations.map(({ name, client, probe }) => [
-    name, client, probe.status, probe.httpStatus, probe.available
-  ]), [
-    ['T4D_100', '100', 'unavailable', 503, false],
-    ['T4D_200', '200', 'not-found', 404, false]
-  ]);
-});
-
-
-test('rejects invalid destination URL names and creates deterministic collision slugs', () => {
-  assert.equal(destinationUrl('A-1_2'), 'http://A-1_2.dest');
-  assert.throws(() => destinationUrl('backend.example/path'), /Invalid BAS destination name/);
-  const used = new Map();
-  assert.deepEqual(['Dev System', 'dev-system', 'DEV_SYSTEM'].map(name => slugifyDestination(name, used)), ['dev-system', 'dev-system-2', 'dev-system-3']);
-});
-
-test('sanitizes child identity material and preserves caller proxy safety settings', () => {
-  const env = sanitizeChildEnv({ HTTP_PROXY: 'http://proxy:8887', NO_PROXY: 'localhost,.dest,127.0.0.1', Authorization: 'Bearer secret', Cookie: 'SAP_SESSION=secret', SAP_USER: 'alice', SAP_PASSWORD: 'secret', SAP_READ_ONLY: 'true' });
-  assert.equal(env.SAP_PROXY_CONTEXTID_GUARD, 'true');
-  assert.equal(env.HTTP_PROXY, 'http://proxy:8887');
-  assert.equal(env.NO_PROXY, 'localhost,127.0.0.1');
-  assert.equal(env.SAP_READ_ONLY, 'true');
-  assert.equal(env.Authorization, undefined);
-  assert.equal(env.Cookie, undefined);
-  assert.equal(env.SAP_USER, undefined);
-  assert.equal(env.SAP_PASSWORD, undefined);
-});
-
-test('probes .dest only through configured HTTP proxy and accepts proxy-auth responses', async () => {
-  const requests = [];
-  const proxy = createServer((request, response) => {
-    requests.push({ host: request.headers.host, path: request.url });
-    response.writeHead(401);
-    response.end();
-  });
-  await new Promise(resolve => proxy.listen(0, '127.0.0.1', resolve));
-  const port = proxy.address().port;
-  const found = await discoverDestinations({
-    body: [{ Name: 'proxy-system' }],
-    env: { HTTP_PROXY: `http://127.0.0.1:${port}` }
-  });
-  await new Promise(resolve => proxy.close(resolve));
-  assert.equal(found[0].probe.status, 'auth-required');
-  assert.deepEqual(requests, [{ host: 'proxy-system.dest', path: 'http://proxy-system.dest/sap/bc/adt/discovery' }]);
-});
-
-test('uses the documented branded HTTP proxy for destination probes and respects explicit direct mode', async t => {
-  const requests = [];
-  const proxy = createServer((request, response) => {
-    requests.push({ host: request.headers.host, path: request.url });
-    response.writeHead(200);
-    response.end('<ok/>');
-  });
-  await new Promise(resolve => proxy.listen(0, '127.0.0.1', resolve));
-  t.after(() => new Promise(resolve => proxy.close(resolve)));
-  const proxyUrl = `http://127.0.0.1:${proxy.address().port}`;
-  const found = await discoverDestinations({
-    body: [{ Name: 'branded-proxy-system' }],
-    env: { HTTP_PROXY: 'http://127.0.0.1:1', SAP_AI_DEV_TOOLKIT_HTTP_PROXY: proxyUrl }
-  });
-  assert.equal(found[0].probe.status, 'available');
-  assert.deepEqual(requests, [{ host: 'branded-proxy-system.dest', path: 'http://branded-proxy-system.dest/sap/bc/adt/discovery' }]);
-
-  const direct = await discoverDestinations({
-    body: [{ Name: 'direct-system' }],
-    env: { HTTP_PROXY: proxyUrl, SAP_AI_DEV_TOOLKIT_HTTP_PROXY: '' },
-    probeImpl: async (_url, options) => {
-      assert.equal(options.proxyUrl, '', 'explicit empty branded proxy must bypass the configured proxy');
-      return { status: 200 };
-    }
-  });
-  assert.equal(direct[0].probe.status, 'available');
-  assert.equal(requests.length, 1);
-});
-
-test('fetches BAS destination lists through configured HTTP and HTTPS proxies', async t => {
-  const proxyRequests = [];
-  const directRequests = [];
-  const target = createServer((request, response) => {
-    directRequests.push({ method: request.method, host: request.headers.host, path: request.url });
-    response.writeHead(200, { 'content-type': 'application/json' });
-    response.end(JSON.stringify([{ Name: 'direct-system' }]));
-  });
-  await new Promise(resolve => target.listen(0, '127.0.0.1', resolve));
-  const proxy = createServer((request, response) => {
-    proxyRequests.push({ method: request.method, host: request.headers.host, path: request.url });
-    response.writeHead(200, { 'content-type': 'application/json' });
-    response.end(JSON.stringify([{ Name: 'proxied-system' }]));
-  });
-  proxy.on('connect', (request, socket) => {
-    proxyRequests.push({ method: request.method, host: request.url });
-    socket.end('HTTP/1.1 502 Bad Gateway\r\n\r\n');
-  });
-  await new Promise(resolve => proxy.listen(0, '127.0.0.1', resolve));
-  t.after(async () => {
-    await Promise.all([target, proxy].map(server => new Promise(resolve => server.close(resolve))));
-  });
-  const proxyUrl = `http://127.0.0.1:${proxy.address().port}`;
-  const env = { http_proxy: proxyUrl, https_proxy: proxyUrl, no_proxy: '' };
-  const body = await fetchDestinationList('http://bas.example', { env, timeoutMs: 1000 });
-  assert.deepEqual(body, [{ Name: 'proxied-system' }]);
-  await assert.rejects(fetchDestinationList('https://bas.example', { env, timeoutMs: 1000 }));
-  assert.deepEqual(proxyRequests, [
-    { method: 'GET', host: 'bas.example', path: 'http://bas.example/api/listDestinations' },
-    { method: 'CONNECT', host: 'bas.example:443' }
-  ]);
-  const directBody = await fetchDestinationList(`http://127.0.0.1:${target.address().port}`, {
-    env: { HTTP_PROXY: proxyUrl, NO_PROXY: '127.0.0.1' },
-    timeoutMs: 1000
-  });
-  assert.deepEqual(directBody, [{ Name: 'direct-system' }]);
-  assert.deepEqual(directRequests, [{
-    method: 'GET',
-    host: `127.0.0.1:${target.address().port}`,
-    path: '/api/listDestinations'
-  }]);
-  assert.equal(proxyRequests.length, 2);
-});
-
-test('branded HTTP proxy takes precedence over HTTPS_PROXY for secure BAS discovery', async () => {
-  let capturedDispatcher = 'not-called';
-  const body = await fetchDestinationList('https://bas.example', {
-    env: {
-      SAP_AI_DEV_TOOLKIT_HTTP_PROXY: '',
-      HTTPS_PROXY: 'http://127.0.0.1:1',
-      https_proxy: 'http://127.0.0.1:1'
-    },
-    fetchImpl: async (_url, options) => {
-      capturedDispatcher = options.dispatcher;
-      return new Response(JSON.stringify([{ Name: 'secure-system' }]), {
-        status: 200,
-        headers: { 'content-type': 'application/json' }
-      });
-    }
-  });
-  assert.deepEqual(body, [{ Name: 'secure-system' }]);
-  assert.equal(capturedDispatcher, undefined, 'explicit branded empty proxy must disable inherited HTTPS_PROXY too');
-});
-
-test('redacts credential-bearing diagnostics without exposing payloads', () => {
-  const value = redact({ name: 'dev', password: 'secret', authorization: 'Bearer abc', nested: { cookie: 'x', ok: 'visible' } });
-  assert.deepEqual(value, { name: 'dev', password: '[redacted]', authorization: '[redacted]', nested: { cookie: '[redacted]', ok: 'visible' } });
-});

package/test/fixtures/fake-vsp.mjs

@@ -1,263 +0,0 @@
-#!/usr/bin/env node
-import { appendFileSync } from 'node:fs';
-import { request as httpRequest } from 'node:http';
-
-const args = process.argv.slice(2);
-const mode = args[args.indexOf('--mode') + 1] || 'focused';
-const url = args[args.indexOf('--url') + 1] || 'unknown';
-const destination = url.replace(/^https?:\/\//, '').replace(/\.dest$/, '');
-const logPath = process.env.FAKE_LOG;
-function log(entry) { if (logPath) appendFileSync(logPath, `${JSON.stringify({ destination, ...entry })}\n`); }
-function reply(id, result) { process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id, result })}\n`); }
-function requestADTThroughProxy(targetUrl, proxyUrl, { method = 'GET', body = '', bypassProxyForLoopback = false } = {}) {
-  const target = new URL(targetUrl);
-  const proxy = new URL(proxyUrl);
-  if (target.protocol !== 'http:') throw new Error('fixture ADT request supports HTTP only');
-  const headers = { host: target.host, accept: 'application/xml,text/xml,*/*' };
-  if (body) headers['content-type'] = 'application/xml';
-  if (process.env.SAP_USER && process.env.SAP_PASSWORD) {
-    headers.authorization = `Basic ${Buffer.from(`${process.env.SAP_USER}:${process.env.SAP_PASSWORD}`).toString('base64')}`;
-  }
-  const loopback = bypassProxyForLoopback && ['127.0.0.1', 'localhost'].includes(target.hostname);
-  return new Promise((resolve, reject) => {
-    const requestOptions = loopback ? {
-      hostname: target.hostname,
-      port: Number(target.port),
-      method,
-      path: `${target.pathname}${target.search}`,
-      headers
-    } : {
-      hostname: proxy.hostname,
-      port: Number(proxy.port),
-      method,
-      path: target.href,
-      headers
-    };
-    const request = httpRequest(requestOptions, response => {
-      let body = '';
-      response.setEncoding('utf8');
-      response.on('data', chunk => { body += chunk; });
-      response.on('end', () => resolve({ status: response.statusCode || 0, body }));
-    });
-    request.setTimeout(5_000, () => request.destroy(new Error('fixture ADT request timed out')));
-    request.on('error', reject);
-    if (body) request.write(body);
-    request.end();
-  });
-}
-const toolNames = [
-  'GetSource',
-  'WriteSource',
-  'EditSource',
-  'SearchObject',
-  'GrepObjects',
-  'GrepPackages',
-  'FindDefinition',
-  'FindReferences',
-  'GetContext',
-  'SyntaxCheck',
-  'Activate',
-  'ActivatePackage',
-  'CompareSource',
-  'GetClassInfo',
-  'CreatePackage',
-  'CreateTable',
-  'GetTable',
-  'GetTableContents',
-  'GetTransport',
-  'ListTransports',
-  'GetTransportInfo',
-  'GetUserTransports',
-  'RunQuery',
-  'GetPackage',
-  'GetFunctionGroup',
-  'GetCDSDependencies',
-  'GetCDSImpactAnalysis',
-  'GetAPIReleaseState',
-  'GetCDSElementInfo',
-  'GetMessages',
-  'GetFeatures',
-  'PrettyPrint',
-  'GetSystemInfo',
-  'GetInstalledComponents',
-  'RunUnitTests',
-  'RunATCCheck',
-  'GetInactiveObjects',
-  'DeleteObject',
-  'DebuggerAttach',
-  'ListSQLTraces',
-  'CreateTransport',
-  'ReleaseTransport',
-  'DeleteTransport',
-  'AnalyzeABAPCode',
-  'AnalyzeCallGraph',
-  'CodeCompletion',
-  'GetAbapHelp',
-  'GetCallGraph',
-  'GetCalleesOf',
-  'GetCallersOf',
-  'GetCodeCoverage',
-  'GetConnectionInfo',
-  'GetObjectStructure',
-  'GetTypeHierarchy',
-  'GetTypeInfo',
-  'GrepObject',
-  'GrepPackage',
-  'CallRFC',
-  'DebuggerDetach',
-  'DebuggerGetStack',
-  'DebuggerGetVariables',
-  'DebuggerListen',
-  'DebuggerStep',
-  'DeleteBreakpoint',
-  'GetBreakpoints',
-  'GetDump',
-  'GetSQLTraceState',
-  'GetTrace',
-  'ListDumps',
-  'SetBreakpoint',
-  'CloneObject',
-  'CreateAndActivateProgram',
-  'CreateClassWithTests',
-  'CreateObject',
-  'CreateTestInclude',
-  'ExecuteABAP',
-  'GetClass',
-  'GetClassComponents',
-  'GetClassInclude',
-  'GetFunction',
-  'GetInclude',
-  'GetInterface',
-  'GetProgram',
-  'GetStructure',
-  'GetTransaction',
-  'LockObject',
-  'MoveObject',
-  'RecoverFailedCreate',
-  'RenameObject',
-  'SaveToFile',
-  'UnlockObject',
-  'UpdateClassInclude',
-  'UpdateSource',
-  'WriteClass',
-  'WriteProgram',
-  'ListDependencies',
-  'PublishServiceBinding',
-  'UnpublishServiceBinding'
-];
-if (mode === 'expert') toolNames.push('ActivateMultiple', 'SAP');
-
-function toolDefinition(name) {
-  const schemas = {
-    RunQuery: {
-      type: 'object',
-      properties: {
-        sql_query: { type: 'string' },
-        max_rows: { type: 'number' },
-        all_rows: { type: 'boolean' }
-      },
-      required: ['sql_query']
-    },
-    GetAPIReleaseState: { type: 'object', properties: { object_uri: { type: 'string' } }, required: ['object_uri'] },
-    PrettyPrint: { type: 'object', properties: { source: { type: 'string' } }, required: ['source'] },
-    GetTransport: { type: 'object', properties: { transport: { type: 'string' } }, required: ['transport'] },
-    GetTransportInfo: {
-      type: 'object',
-      properties: { object_url: { type: 'string' }, dev_class: { type: 'string' } },
-      required: ['object_url', 'dev_class']
-    },
-    GetUserTransports: {
-      type: 'object',
-      properties: { user_name: { type: 'string' } },
-      required: []
-    },
-    ActivateMultiple: {
-      type: 'object',
-      properties: {
-        objects: {
-          type: 'array',
-          items: {
-            anyOf: [
-              {
-                type: 'object',
-                properties: { url: { type: 'string' }, name: { type: 'string' } },
-                required: ['url', 'name']
-              },
-              { type: 'string' }
-            ]
-          }
-        }
-      },
-      required: ['objects']
-    }
-  };
-  return { name, description: name, inputSchema: schemas[name] || { type: 'object', properties: {}, required: [] } };
-}
-
-let buffer = '';
-process.stdin.setEncoding('utf8');
-process.stdin.on('data', async chunk => {
-  buffer += chunk;
-  let end;
-  while ((end = buffer.indexOf('\n')) >= 0) {
-    const line = buffer.slice(0, end).trim();
-    buffer = buffer.slice(end + 1);
-    if (!line) continue;
-    const message = JSON.parse(line);
-    if (message.method === 'initialize') {
-      log({ event: 'initialize', argv: args, env: { guard: process.env.SAP_PROXY_CONTEXTID_GUARD, authorization: process.env.Authorization, cookie: process.env.Cookie, user: process.env.SAP_USER, password: process.env.SAP_PASSWORD, verbose: process.env.SAP_VERBOSE, httpProxy: process.env.HTTP_PROXY, httpsProxy: process.env.HTTPS_PROXY, noProxy: process.env.NO_PROXY, allowTransportableEdits: process.env.SAP_ALLOW_TRANSPORTABLE_EDITS } });
-      if (destination === 'broken') process.exit(2);
-      reply(message.id, { protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: { name: destination, version: 'fixture' } });
-    } else if (message.method === 'tools/list') {
-      reply(message.id, message.params?.cursor
-        ? { tools: toolNames.slice(15).map(toolDefinition) }
-        : { tools: toolNames.slice(0, 15).map(toolDefinition), nextCursor: 'page-2' });
-    } else if (message.method === 'tools/call') {
-      const name = message.params?.name;
-      log({ event: 'call', name, arguments: message.params?.arguments });
-      if (message.params?.arguments?.emitNotification) {
-        process.stdout.write(`${JSON.stringify({
-          jsonrpc: '2.0',
-          method: 'notifications/message',
-          params: { level: 'info', logger: 'fake-vsp', data: 'fixture log notification' }
-        })}\n`);
-      }
-      const transportTools = [
-        'ListTransports', 'GetTransport', 'GetUserTransports', 'GetTransportInfo',
-        'CreateTransport', 'ReleaseTransport', 'DeleteTransport'
-      ];
-      const disabledTransportOperation = transportTools.includes(name)
-        && (!args.includes('--enable-transports')
-          || (['CreateTransport', 'ReleaseTransport', 'DeleteTransport'].includes(name) && args.includes('--transport-read-only')));
-      if (disabledTransportOperation) {
-        reply(message.id, { content: [{ type: 'text', text: 'transport operation is not enabled' }], isError: true });
-      } else if (message.params?.arguments?.object === 'RPC_ERROR') {
-        process.stdout.write(`${JSON.stringify({ jsonrpc: '2.0', id: message.id, error: { code: -32042, message: 'backend connection refused; password=must-not-log' } })}\n`);
-      } else if (message.params?.arguments?.object === 'TOOL_ERROR') {
-        reply(message.id, { content: [{ type: 'text', text: 'backend timeout; token=must-not-log' }], isError: true });
-      } else if (process.env.FAKE_CF_ADT_TEST === 'true' && name === 'GetSystemInfo') {
-        try {
-          const target = new URL('/sap/bc/adt/discovery', url);
-          const proxy = process.env.HTTP_PROXY || process.env.http_proxy;
-          const adt = await requestADTThroughProxy(target.href, proxy);
-          reply(message.id, { content: [{ type: 'text', text: adt.body }], isError: false });
-        } catch {
-          reply(message.id, { content: [{ type: 'text', text: 'fixture ADT request failed' }], isError: true });
-        }
-      } else if (process.env.FAKE_RELAY_CSRF_TEST === 'true' && name === 'GetSystemInfo') {
-        try {
-          const target = new URL('/sap/bc/adt/datapreview/freestyle', url);
-          const proxy = process.env.HTTP_PROXY || process.env.http_proxy;
-          const adt = await requestADTThroughProxy(target.href, proxy, { method: 'POST', body: '<probe/>', bypassProxyForLoopback: true });
-          reply(message.id, { content: [{ type: 'text', text: `fixture ADT HTTP ${adt.status}: ${adt.body}` }], isError: adt.status < 200 || adt.status >= 300 });
-        } catch {
-          reply(message.id, { content: [{ type: 'text', text: 'fixture ADT write failed' }], isError: true });
-        }
-      } else {
-        reply(message.id, { content: [{ type: 'text', text: `${destination}:${name}` }], isError: false });
-      }
-    } else if (message.id !== undefined) reply(message.id, {});
-  }
-});
-process.stdin.on('end', () => { log({ event: 'end' }); });
-process.on('SIGTERM', () => { log({ event: 'term' }); process.exit(0); });

package/test/hana-config.test.mjs

@@ -1,168 +0,0 @@
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { quoteHanaIdentifier, resolveHanaReadOnlyConfig } from '../src/hana-config.mjs';
-import { hanaConnectionOptions, HanaDatabase } from '../src/hana-database.mjs';
-
-const explicitEnv = {
-  HANA_RO_HOST: 'hana.example.test',
-  HANA_RO_PORT: '443',
-  HANA_RO_USER: 'INSPECTOR',
-  HANA_RO_PASSWORD: 'do-not-print-this',
-  HANA_RO_SCHEMA: 'HDI_CONTAINER_SCHEMA'
-};
-
-function vcapBinding(name, user = 'INSPECTOR') {
-  return {
-    name,
-    binding_name: name,
-    credentials: {
-      host: 'hana.example.test',
-      port: 443,
-      user,
-      password: 'vcap-secret-not-for-output',
-      schema: 'HDI_CONTAINER_SCHEMA',
-      hdi_user: 'HDI_DEPLOYER',
-      hdi_password: 'never-use-this'
-    }
-  };
-}
-
-test('resolves explicit read-only configuration and never disables TLS verification', () => {
-  const config = resolveHanaReadOnlyConfig(explicitEnv);
-  assert.equal(config.source, 'environment');
-  assert.equal(config.user, 'INSPECTOR');
-  assert.equal(config.password, 'do-not-print-this');
-  assert.equal(config.schema, 'HDI_CONTAINER_SCHEMA');
-  assert.equal(Object.isFrozen(config), true);
-  const options = hanaConnectionOptions(config);
-  assert.equal(options.encrypt, true);
-  assert.equal(options.sslValidateCertificate, true);
-  assert.equal(options.currentSchema, 'HDI_CONTAINER_SCHEMA');
-  assert.equal(options.pwd, 'do-not-print-this');
-});
-
-test('rejects incomplete explicit credentials instead of falling back to VCAP', () => {
-  assert.throws(() => resolveHanaReadOnlyConfig({
-    ...explicitEnv,
-    HANA_RO_PASSWORD: '',
-    VCAP_SERVICES: JSON.stringify({ hana: [vcapBinding('fallback')] })
-  }), /Explicit HANA read-only configuration is incomplete/);
-});
-
-test('resolves one selected HANA VCAP binding without using HDI deployment credentials', () => {
-  const config = resolveHanaReadOnlyConfig({
-    VCAP_SERVICES: JSON.stringify({ hana: [vcapBinding('inspection-binding')] }),
-    HANA_RO_BINDING: 'inspection-binding'
-  });
-  assert.equal(config.source, 'vcap-services');
-  assert.equal(config.bindingName, 'inspection-binding');
-  assert.equal(config.serviceName, 'hana');
-  assert.equal(config.user, 'INSPECTOR');
-  assert.equal(config.schema, 'HDI_CONTAINER_SCHEMA');
-  assert.equal(config.password, 'vcap-secret-not-for-output');
-});
-
-test('fails closed when VCAP contains multiple HANA bindings', () => {
-  const env = {
-    VCAP_SERVICES: JSON.stringify({ hana: [vcapBinding('first'), vcapBinding('second')] })
-  };
-  assert.throws(() => resolveHanaReadOnlyConfig(env), /Multiple HANA VCAP bindings/);
-  assert.equal(resolveHanaReadOnlyConfig({ ...env, HANA_RO_BINDING: 'second' }).bindingName, 'second');
-});
-
-test('rejects an HDI-deployer-only binding and does not disclose its credentials', () => {
-  const deployerOnly = {
-    name: 'deployer-only',
-    credentials: {
-      host: 'hana.example.test',
-      port: 443,
-      schema: 'HDI_CONTAINER_SCHEMA',
-      hdi_user: 'HDI_DEPLOYER',
-      hdi_password: 'never-use-this'
-    }
-  };
-  assert.throws(() => resolveHanaReadOnlyConfig({
-    VCAP_SERVICES: JSON.stringify({ hana: [deployerOnly] })
-  }), error => {
-    assert.match(error.message, /separate read-only binding/);
-    assert.doesNotMatch(error.message, /never-use-this/);
-    return true;
-  });
-});
-
-test('rejects a VCAP binding that aliases its read-only and deployment usernames', () => {
-  const binding = vcapBinding('aliased-binding', 'HDI_DEPLOYER');
-  assert.throws(() => resolveHanaReadOnlyConfig({
-    VCAP_SERVICES: JSON.stringify({ hana: [binding] })
-  }), /aliases its read-only and HDI deployment users/);
-});
-
-test('rejects bad host, port, missing schema, and missing VCAP configuration', () => {
-  assert.throws(() => resolveHanaReadOnlyConfig({ ...explicitEnv, HANA_RO_HOST: 'https://hana.example.test' }), /hostname/);
-  assert.throws(() => resolveHanaReadOnlyConfig({ ...explicitEnv, HANA_RO_PORT: '70000' }), /between 1 and 65535/);
-  assert.throws(() => resolveHanaReadOnlyConfig({ ...explicitEnv, HANA_RO_SCHEMA: '' }), /incomplete/);
-  assert.throws(() => resolveHanaReadOnlyConfig({}), /Set HANA_RO_\*/);
-});
-
-test('quotes identifiers by doubling embedded quotes and rejects control characters', () => {
-  assert.equal(quoteHanaIdentifier('A"B'), '"A""B"');
-  assert.throws(() => quoteHanaIdentifier('bad\nname'), /identifier is invalid/);
-});
-
-test('serializes database calls, passes bind values, and redacts native driver errors', async () => {
-  const calls = [];
-  let disconnects = 0;
-  const connection = {
-    connect(options, callback) {
-      calls.push({ type: 'connect', options });
-      callback(null);
-    },
-    exec(sql, params, options, callback) {
-      calls.push({ type: 'exec', sql, params, options });
-      if (sql === 'FAIL') callback(Object.assign(new Error('password=do-not-print-this'), { code: 'HY000' }));
-      else callback(null, [{ OK: true }]);
-    },
-    disconnect(callback) {
-      disconnects += 1;
-      callback(null);
-    }
-  };
-  const db = new HanaDatabase(connection, resolveHanaReadOnlyConfig(explicitEnv));
-  await db.connect();
-  assert.deepEqual(await db.query('SELECT ? FROM DUMMY', ['value']), [{ OK: true }]);
-  await assert.rejects(db.query('FAIL'), error => {
-    assert.equal(error.name, 'HanaDatabaseError');
-    assert.match(error.message, /HANA error HY000/);
-    assert.doesNotMatch(error.message, /do-not-print-this/);
-    return true;
-  });
-  assert.equal(calls[0].options.sslValidateCertificate, true);
-  assert.equal(calls[1].params[0], 'value');
-  assert.deepEqual(calls[1].options, {});
-  await db.close();
-  await db.close();
-  assert.equal(disconnects, 1);
-});
-
-test('times out a hung read, requests cancellation, and retires its connection', async () => {
-  let cancels = 0;
-  let disconnects = 0;
-  const connection = {
-    connect(_options, callback) { callback(null); },
-    exec() {},
-    cancel() { cancels += 1; },
-    disconnect(callback) { disconnects += 1; callback(null); }
-  };
-  const db = new HanaDatabase(connection, resolveHanaReadOnlyConfig(explicitEnv), { queryTimeoutMs: 5 });
-  await db.connect();
-  await assert.rejects(db.query('SELECT HANG FROM DUMMY'), error => {
-    assert.equal(error.name, 'HanaQueryTimeoutError');
-    assert.match(error.message, /time limit/);
-    assert.doesNotMatch(error.message, /do-not-print-this/);
-    return true;
-  });
-  assert.equal(cancels, 1);
-  assert.equal(disconnects, 1);
-  assert.equal(db.unusable, true);
-  await assert.rejects(db.query('SELECT 1 FROM DUMMY'), /not available/);
-});