sap-ai-dev-toolkit 0.9.9920 → 0.9.9921

package/README.md

@@ -234,7 +234,7 @@ The separate `integration-suite` stdio MCP server covers bounded discovery, auth
 Interactive `sap-ai-dev --setup` asks **"Add the SAP Integration Suite tools?"** before writing MCP configuration, preserves existing entries, and shows configured identities without credential values. Enter defaults to yes when credentials exist, no otherwise. `--tools` includes the companion checkbox; the empty-landscape menu offers Integration Suite-only setup. Run **`sap-ai-dev --setup-integration`** to configure only this server.
 
 - Detected credentials receive read-only capability checks. Core Cloud Foundry setup discovers `it-rt/api`, `apimanagement-apiportal/apiportal-apiaccess` and `apimanagement-devportal/devportal-apiaccess`; it can reuse/create the `sap-ai-dev-integration` key and, with explicit approval, dedicated `sap-ai-dev-integration-cpi`, `sap-ai-dev-integration-apim` or `sap-ai-dev-integration-devhub` instances. It pins plans/brokers visible to the targeted space, rejects ambiguous or other-organization plans, and does not grant entitlements.
-- Core service keys and separately typed optional records can be pasted as hidden JSON or supplied by downloaded file path. The user-only `~/.config/sap-ai-dev-toolkit/integration-suite.json` stores only normalized credentials (directory 0700/file 0600), never `mcp.json`; saving a key that cannot sign in requires confirmation.
+- Core service keys and separately typed optional records can be pasted as hidden JSON or supplied by downloaded file path; the paste option first asks which service the key is for (Cloud Integration, API Management, Developer Hub or an optional record). The user-only `~/.config/sap-ai-dev-toolkit/integration-suite.json` stores only normalized credentials (directory 0700/file 0600), never `mcp.json`; saving a key that cannot sign in requires confirmation.
 - Optional discovery/setup accepts **existing credentials only**. It does not provision services, create optional service keys, activate capabilities, assign roles or retarget Cloud Foundry. Startup and capability probes never provision anything.
 
 Core precedence remains per-side: complete explicit `CPI_URL/CPI_TOKEN_URL/CPI_CLIENT_ID/CPI_CLIENT_SECRET` (or `APIM_*` / `DEVHUB_*`) → matching `*_SERVICE_KEY` JSON → one unambiguous `VCAP_SERVICES` binding → saved setup key. `*_VCAP_SERVICE` and `*_BINDING` select custom labels/instances. Certificate-based core keys are rejected. Optional environment JSON overrides only its matching stored record; malformed optional input disables that adapter, not usable core clients.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sap-ai-dev-toolkit",
-  "version": "0.9.9920",
+  "version": "0.9.9921",
   "description": "SAP AI development toolkit for BAS, ABAP, RAP, CAP, HANA Cloud, Fiori, UI5, and MCP",
   "author": "Gurkan Yilmaz",
   "type": "module",

package/scripts/run-live-integration.mjs

@@ -30,7 +30,7 @@ const PROXY_URL = `ZAI_SmokeUrl${RUN}`;
 const PROXY_ODATA = `ZAI_SmokeOData${RUN}`;
 const PROXY_CPI = `ZAI_SmokeCpi${RUN}`;
 const config = resolveIntegrationConfig(process.env, { stored: readStoredIntegrationKeys() });
-const SECRETS = Object.values(config).filter(Boolean).map(side => side.clientSecret);
+const SECRETS = Object.values(config).filter(Boolean).map(side => side.clientSecret).filter(Boolean);
 const PRODUCT = `ZAI_SmokeProduct${RUN}`;
 const KVM = `ZAI_SmokeKvm${RUN}`;
 const CREDENTIAL = `ZAI_SMOKE_USER_${RUN}`;
@@ -99,7 +99,7 @@ async function invoke(url, { method = 'POST', body, headers = {}, auth = true, d
     const text = await response.text();
     let json;
     try { json = JSON.parse(text); } catch { /* not JSON */ }
-    result = { status: response.status, text, json };
+    result = { status: response.status, headers: Object.fromEntries(response.headers), text, json };
     if (done(result)) return result;
     await sleep(5000);
   }
@@ -562,7 +562,7 @@ await scenario('S41', 'runtime call to the template iFlow passes body and query
   expect(/\/anything\/configured/.test(result.json.url), `receiver url ${result.json.url}`);
   expect(result.json.args.probe === RUN, `query ${JSON.stringify(result.json.args)}`);
   expect(JSON.parse(result.json.data).kind === 'direct', `body ${result.json.data}`);
-  ctx.directGuid = result.json.headers['Sap-Messageprocessinglogid'];
+  ctx.directGuid = result.headers['sap_messageprocessinglogid'];
   expect(ctx.directGuid, 'no MPL id header forwarded');
   return `MPL ${ctx.directGuid}`;
 });
@@ -579,7 +579,7 @@ await scenario('S43', 'APIM proxy in front of CPI forwards the caller bearer tok
   const result = await invoke(proxy.runtime_url, { body: JSON.stringify({ via: 'apim-url-target', run: RUN }) });
   expect(result.status === 200, `HTTP ${result.status}: ${result.text.slice(0, 200)}`);
   expect(JSON.parse(result.json.data).via === 'apim-url-target', result.json.data);
-  ctx.apimGuid = result.json.headers['Sap-Messageprocessinglogid'];
+  ctx.apimGuid = result.headers['sap_messageprocessinglogid'];
   return `${proxy.runtime_url} → CPI → httpbin`;
 });
 
@@ -611,8 +611,8 @@ await scenario('S46', 'iFlow with Unicode description, POST receiver and static
   const { runtime } = await deployAndWait(IFLOW_POST);
   expect(runtime.Status === 'STARTED', JSON.stringify(runtime));
   const endpoints = ok(await call('cpi_list_service_endpoints', { iflow_id: IFLOW_POST }), 'endpoints').items;
-  ctx.postEndpoint = endpoints.flatMap(entry => entry.urls)[0] ?? ctx.cpiEndpoint.replace(`/http/ai/smoke${RUN}`, `/http/ai/post${RUN}`);
-  return `description "${listed.Description}"`;
+  ctx.postEndpoint = endpoints.flatMap(entry => entry.urls)[0] ?? ctx.cpiEndpoint?.replace(`/http/ai/smoke${RUN}`, `/http/ai/post${RUN}`);
+  expect(ctx.postEndpoint, 'no POST endpoint; run with S18 in ONLY');
 });
 
 await scenario('S47', 'POST receiver gets method, static query and body', async () => {
@@ -914,7 +914,7 @@ await scenario('S79', 'full chain after recovery: client → APIM (provider) →
   const proxy = ok(await call('apim_get_api_proxy', { name: PROXY_CPI_PROVIDER }), 'get');
   const result = await invoke(proxy.runtime_url, { body: '{"final":true}', done: response => response.status === 200 && /restored/.test(response.json?.url || '') });
   expect(result.status === 200 && JSON.parse(result.json.data).final === true, `HTTP ${result.status}`);
-  const detail = await waitForGuid(result.json.headers['Sap-Messageprocessinglogid']);
+  const detail = await waitForGuid(result.headers['sap_messageprocessinglogid']);
   expect(detail.log.Status === 'COMPLETED', detail.log.Status);
 });
 

package/src/setup.mjs

@@ -292,18 +292,20 @@ export function integrationSuiteCredentialStatus(env = process.env) {
     const config = resolveIntegrationConfig(env, { stored: readStoredIntegrationKeys(env) });
     const keys = ['cpi', 'apim', 'devhub', ...OPTIONAL_COMPONENT_KEYS];
     const side = (key, value) => {
-      if (!value) return 'not configured';
       const host = value.url ? new URL(value.url).host : key === 'aem' ? 'api.solace.cloud' : 'unknown';
       return `configured from ${value.source}${value.bindingName ? ` (${value.bindingName})` : ''}, host ${host}`;
     };
-    return { found: keys.some(key => Boolean(config[key])), config, lines: [
-      `Environment label: ${config.environment ?? 'default'} (tenant authority remains bound host identity)`,
-      ...keys.map(key => `${key.toUpperCase()}: ${side(key, config[key])}`),
-      ...(config.optional_config_errors ?? []).map(error => `${error.component.toUpperCase()}: invalid optional configuration (${error.source}); adapter disabled`)
+    const configured = keys.filter(key => config[key]);
+    const errors = (config.optional_config_errors ?? []).map(error => `${error.component.toUpperCase()}: invalid optional configuration (${error.source}); adapter disabled`);
+    if (!configured.length && !errors.length) return { found: false, config, lines: ['No Integration Suite credentials configured yet.'] };
+    return { found: configured.length > 0, config, lines: [
+      ...(config.environment ? [`Environment label: ${config.environment}`] : []),
+      ...configured.map(key => `${key.toUpperCase()}: ${side(key, config[key])}`),
+      ...errors
     ] };
   } catch (error) {
     const message = String(error?.message || '');
-    if (/^Configure CPI/.test(message)) return { found: false, config: null, lines: ['No Integration Suite component credentials were found in this environment.'] };
+    if (/^Configure CPI/.test(message)) return { found: false, config: null, lines: ['No Integration Suite credentials configured yet.'] };
     return { found: false, config: null, lines: [`Credentials found but not usable: ${message}`] };
   }
 }
@@ -330,7 +332,7 @@ function pastedServiceKey(side, value, env) {
 }
 
 async function printIntegrationVerification(config, { env, output, verifyIntegration }) {
-  const stop = startProgress('Checking configured core and optional Integration Suite access', { output, env, label: 'Integration Suite' });
+  const stop = startProgress('Checking Integration Suite access', { output, env, label: 'Integration Suite' });
   let report;
   try { report = await verifyIntegration(config, { env }); }
   finally { stop(); }
@@ -344,12 +346,12 @@ async function printIntegrationVerification(config, { env, output, verifyIntegra
   }
   const core = [report.cpi, report.apim, report.devhub].filter(side => side?.configured);
   const denied = core.flatMap(side => side.checks ?? []).filter(check => check.result === 'forbidden').length;
-  const message = !core.length ? 'No core clients configured; optional checks are reported separately.'
-    : report.ok ? `Configured core access verified${denied ? `; ${denied} capability checks were access-denied (cause not established)` : ''}.`
-      : 'Configured core reads did not pass. Inspect the individual access evidence; a role or entitlement diagnosis is not established.';
+  const message = !core.length ? 'No core service configured yet.'
+    : report.ok ? (denied ? `Connected; ${denied} area(s) were access-denied — the key may lack roles.` : 'Connection verified.')
+      : 'Sign-in or core read failed; see the lines above.';
   print(output, formatStatus(message, report.ok && !denied ? 'success' : 'warning', output, 'Integration Suite'));
   const optional = OPTIONAL_COMPONENT_KEYS.filter(side => report[side]?.configured);
-  if (optional.length) print(output, `  Optional capability completeness: ${report.optional_completeness?.complete === true ? 'complete' : 'unverified/partial'}; core access is a separate result.`);
+  if (optional.length) print(output, `  Optional services: ${report.optional_completeness?.complete === true ? 'all verified' : 'not fully verified'} (separate from core access).`);
   return report;
 }
 
@@ -470,6 +472,26 @@ async function useCloudFoundrySpace(target, context) {
   }
 }
 
+// The paste flow asks which service the key belongs to; APIM and Developer Hub keys share one OAuth shape,
+// so the type is never guessed from the key itself.
+async function chooseKeyType({ input, output, status }) {
+  return await selectPrompt({
+    message: colorText('Which service is this key for?', 'cyan', output),
+    defaultValue: ['CPI', 'APIM', 'DEVHUB'].find(side => !status.config?.[side.toLowerCase()]) ?? 'CPI',
+    choices: [
+      { value: 'CPI', shortcut: 'i', name: 'Cloud Integration (CPI) — Process Integration Runtime, plan api' },
+      { value: 'APIM', shortcut: 'a', name: 'API Management — plan apiportal-apiaccess' },
+      { value: 'DEVHUB', shortcut: 'd', name: 'Developer Hub — plan devportal-apiaccess (AuthGroup.API.Admin)' },
+      ...OPTIONAL_COMPONENT_KEYS.map(side => ({
+        value: side.toUpperCase(),
+        shortcut: { ctms: 't', ans: 'n', event_mesh: 'e', aem: 'm', aem_semp: 's', open_connectors: 'o', edge: 'g' }[side],
+        name: `Optional: ${OPTIONAL_INPUTS[side].label} (${OPTIONAL_INPUTS[side].variable}, existing credentials only)`
+      })),
+      { value: '', shortcut: 'b', name: 'Back' }
+    ]
+  }, { input, output });
+}
+
 // Verify the detected credentials online and let the user take CPI/APIM/DEVHUB keys from the logged-in CF space or
 // paste them. A key is checked online first and saved to the user-only store (never to mcp.json); it is used
 // when the environment has no key.
@@ -502,20 +524,13 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
       : [];
     const choice = await selectPrompt({
       message: colorText('🔑 Integration Suite credentials', 'cyan', output),
-      defaultValue: healthy ? 'done' : (fixes[0]?.value ?? (target.available ? 'cf' : (status.found ? 'done' : 'cpi'))),
+      defaultValue: healthy ? 'done' : (fixes[0]?.value ?? (target.available ? 'cf' : (status.found ? 'done' : 'paste'))),
       choices: [
         ...fixes,
-        { name: !status.found ? 'Continue without credentials (operational tools need configured component access)' : (healthy ? 'Continue' : 'Continue with current access (unavailable capabilities remain unverified)'), value: 'done', shortcut: 'c' },
-        ...(target.available ? [{ name: `Use the logged-in CF space (${space}): find instances, reuse or create keys`, value: 'cf', shortcut: 'f' }] : []),
-        { name: 'Paste a Cloud Integration (CPI) service key — Process Integration Runtime, plan api', value: 'cpi', shortcut: 'p' },
-        { name: 'Paste an API Management service key — API Management, plan apiportal-apiaccess', value: 'apim', shortcut: 'a' },
-        { name: 'Paste a Developer Hub service key — API Management, Developer Hub, plan devportal-apiaccess (AuthGroup.API.Admin)', value: 'devhub', shortcut: 'd' },
-        ...OPTIONAL_COMPONENT_KEYS.map(side => ({
-          name: `Paste existing ${OPTIONAL_INPUTS[side].label} configuration — ${OPTIONAL_INPUTS[side].variable} (no provisioning)`,
-          value: `optional-${side}`,
-          shortcut: { ctms: 't', ans: 'n', event_mesh: 'e', aem: 'm', aem_semp: 's', open_connectors: 'o', edge: 'g' }[side]
-        })),
-        ...(status.found ? [{ name: 'Check the configured credentials online again', value: 'verify', shortcut: 'v' }] : [])
+        ...(target.available ? [{ value: 'cf', shortcut: 'f', name: `Get keys from Cloud Foundry (${space})` }] : []),
+        { value: 'paste', shortcut: 'p', name: 'Paste a service key (JSON or path to a .json file)' },
+        ...(status.found ? [{ value: 'verify', shortcut: 'v', name: 'Check credentials again' }] : []),
+        { value: 'done', shortcut: 'c', name: status.found ? (healthy ? 'Done' : 'Done (some checks did not pass)') : 'Skip for now (run sap-ai-dev --setup-integration later)' }
       ]
     }, { input, output });
     if (choice === 'done') return status;
@@ -527,8 +542,9 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
       await createDedicatedInstance(choice.slice('create-'.length).toUpperCase(), context);
     } else if (choice === 'cf') {
       await useCloudFoundrySpace(target, context);
-    } else {
-      const side = (choice.startsWith('optional-') ? choice.slice('optional-'.length) : choice).toUpperCase();
+    } else if (choice === 'paste') {
+      const side = await chooseKeyType({ input, output, status });
+      if (!side) continue; // Back: show the menu again without refreshing status.
       const pasted = await textPrompt({
         message: `Paste existing ${side} credential JSON or the path to its .json file`,
         secret: true,
@@ -550,16 +566,12 @@ async function configureIntegrationCredentials({ env, input, output, verifyInteg
 
 async function promptIntegrationSuite({ env, alreadyConfigured, input, output, verifyIntegration = defaultVerifyIntegration, integrationCloudFoundry, ask = true }) {
   print(output, '');
-  print(output, formatStatus('SAP Integration Suite tools (core lifecycle and separately credentialed optional services).', 'step', output, 'Integration Suite'));
-  print(output, '  Adds the sap-ai-integration MCP server: author/configure/release, bounded monitoring and diagnosis, guarded recovery/retirement, and evidence-backed optional/native workflows.');
-  print(output, '  Writes require exact approval; private previews are not approval. Optional setup accepts existing credentials only, without provisioning. Agents: SAP Integration Architect, SAP Integration Developer.');
+  print(output, formatStatus('SAP Integration Suite tools', 'step', output, 'Integration Suite'));
+  print(output, '  Connects your AI agent to Cloud Integration (CPI), API Management and Developer Hub. Keys are checked read-only and stored only for you, never in mcp.json.');
   if (alreadyConfigured) print(output, '  Already configured in this MCP config; keeping it and refreshing its version.');
   const status = integrationSuiteCredentialStatus(env);
   for (const line of status.lines) print(output, `  ${line}`);
-  if (!status.found) {
-    print(output, '  Configure existing core or optional component credentials in the MCP host environment,');
-    print(output, '  or paste typed credential JSON in the next hidden step. Credentials are verified read-only and stored user-only, never in mcp.json.');
-  }
+  if (!status.found) print(output, '  No credentials found yet. Next you can get them from your Cloud Foundry space or paste a service key.');
   if (ask && !alreadyConfigured) {
     print(output, '');
     const defaultYes = status.found;