From d443c70bb554c0bb03edca0533c282928a569256 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 10:34:06 -0400
Subject: [PATCH 01/46] docs(api): update MCP signed-in auth to IAS native-HTTP
 OAuth

The /api-docs page documented the old XSUAA + mcp-remote bridge for the
/mcp-auth/* tier. Production now fronts it with SAP Identity
Authentication Service (IAS): OAuth 2.1 authorization-code + PKCE,
public client (no secret), discovery via RFC 9728 protected-resource
metadata. Native-HTTP-OAuth MCP clients point straight at the mount; no
mcp-remote bridge needed.

A2A remains XSUAA client-credentials (not migrated); its section is
unchanged, tracked separately.
---
 hugo/content/api-docs/_index.md | 4 ++--
 hugo/data/api_endpoints.yaml    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hugo/content/api-docs/_index.md b/hugo/content/api-docs/_index.md
index eebdf3ffa..f6d375437 100644
--- a/hugo/content/api-docs/_index.md
+++ b/hugo/content/api-docs/_index.md
@@ -107,10 +107,10 @@ Each CDS service is mounted separately under `/mcp/*` over the [Model Context Pr
 
 **Signed-in tools** (your progress, recommendations, marking steps done) live behind two authenticated tiers:
 
-- **`/mcp-auth/*`** — OAuth 2.1 + PKCE. Requires the `Tutorial.MCP` scope (**Tutorials MCP Users** role collection). XSUAA has no dynamic client registration, so bridge through [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) with the pre-registered public client.
+- **`/mcp-auth/*`** — OAuth 2.1 authorization-code + PKCE against SAP Identity Authentication Service (IAS), as a **public client** (no secret). Point an MCP client with native HTTP OAuth straight at the mount — the authorization server, scopes, and PKCE method are advertised via [`/.well-known/oauth-protected-resource`](https://developers.sap.com/.well-known/oauth-protected-resource) and [`/.well-known/oauth-authorization-server`](https://developers.sap.com/.well-known/oauth-authorization-server), so no `mcp-remote` bridge is needed. In Claude Code: `"sap-developers-auth": { "type": "http", "url": "https://developers.sap.com/mcp-auth/api" }` — approve, and the browser sign-in completes the flow.
 - **`/mcp-pat/*`** — a **Personal Access Token** for headless / CI clients that can't do a browser flow. Mint one at [`/me/tokens/`](/me/tokens/) (self-service; requires the **Tutorials MCP Users** role collection), then send `Authorization: Bearer pat_...`. Scopes: `read` (read tools) or `write` (also allows `complete_step` / `reset_tutorial_progress`). The plaintext token is shown once.
 
-Full connection walkthrough (Claude Desktop, Claude Code, `mcp-remote`, PATs, troubleshooting): [MCP Quickstart](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/end-users/mcp-quickstart.md). Tool + parameter reference: [mcp-server.md](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/developers/reference/mcp-server.md).
+Full connection walkthrough (Claude Desktop, Claude Code, native HTTP OAuth, PATs, troubleshooting): [MCP Quickstart](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/end-users/mcp-quickstart.md). Tool + parameter reference: [mcp-server.md](https://github.com/sap-tutorials/tutorials-ims/blob/main/docs/developers/reference/mcp-server.md).
 
 ### Local `sap-devs` CLI MCP (over stdio)
 
diff --git a/hugo/data/api_endpoints.yaml b/hugo/data/api_endpoints.yaml
index ecb74ecb7..19d8342cc 100644
--- a/hugo/data/api_endpoints.yaml
+++ b/hugo/data/api_endpoints.yaml
@@ -116,8 +116,8 @@ sections:
         auth: "XSUAA"
         purpose: 'Joule chat streaming endpoint (Server-Sent Events).'
       - path: "/mcp-auth/*"
-        auth: "XSUAA"
-        purpose: 'Hosted MCP — OAuth/JWT tier (scope <code>Tutorial.MCP</code>). Forwards your JWT to the user-scoped mounts (<code>/mcp/api</code> DeveloperService, <code>/mcp/homepage</code>): your progress, missions, events, recommendations. Bridge via <code>mcp-remote</code> with the pre-registered client.'
+        auth: "IAS (OAuth2 + PKCE)"
+        purpose: 'Hosted MCP — OAuth tier (SAP IAS, authorization-code + PKCE, public client, no secret). Forwards your token to the user-scoped mounts (<code>/mcp/api</code> DeveloperService, <code>/mcp/homepage</code>): your progress, missions, events, recommendations. Point a native-HTTP-OAuth MCP client straight at the mount — no <code>mcp-remote</code> bridge.'
         driftMarkers:
           - "/mcp-auth/*"
           - "/mcp/api"

From 0437ff102af8ac907fa45e38e3592c1a7da10c0a Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 11:02:40 -0400
Subject: [PATCH 02/46] fix(173): load os-toggle.ts on object-page layout so OS
 picker hydrates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The u1-object-page layout wired the OS picker markup and os-toggle.css but
never loaded the compiled os-toggle.ts runtime. Result: no element ever got
[data-os-options-hydrated], so the hide/show CSS stayed inert and every OS
panel rendered stacked with a non-functional picker (visible on the feature
cookbook tutorial, Step 1).

Add a hasOsOptions-guarded js.Build + script include mirroring the existing
tutorial.ts pattern and the picker's own guard. os-toggle.ts and its 16-test
unit suite were already present and passing — this is pure wiring.

Verified: scoped Hugo build of the feature-cookbook page now emits
<script src="/js/os-toggle.js"> alongside the picker and panels.
---
 hugo/layouts/tutorials/u1-object-page.html | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hugo/layouts/tutorials/u1-object-page.html b/hugo/layouts/tutorials/u1-object-page.html
index 2ff6c5edd..8ae0ca5b4 100644
--- a/hugo/layouts/tutorials/u1-object-page.html
+++ b/hugo/layouts/tutorials/u1-object-page.html
@@ -499,6 +499,15 @@ <h2 class="op-section__heading">Discussion</h2>
 {{ $js := resources.Get "js/tutorial.ts" | js.Build (dict "minify" true) }}
 <script src="{{ $js.RelPermalink }}" defer></script>
 {{ end }}
+{{/* Issue #173: load the OS-picker runtime only when the page has OS-flavored
+     option blocks (hasOsOptions=true) — matches the picker guard above. Without
+     this, os-toggle.ts never mounts, the picker stays inert, and every OS panel
+     renders stacked (the CSS hide/show rules are gated on [data-os-options-hydrated],
+     which only this script sets). */}}
+{{ if and .Params.hasOsOptions (not site.Params.previewMode) }}
+{{ $osToggle := resources.Get "js/os-toggle.ts" | js.Build (dict "minify" true) }}
+<script src="{{ $osToggle.RelPermalink }}" defer></script>
+{{ end }}
 <script type="module" src="{{ partial "island-src.html" "nav-dropdown" }}"></script>
 {{ if and (not site.Params.qa) (not site.Params.previewMode) }}<script type="module" src="{{ partial "island-src.html" "tutorial-pip-launcher" }}"></script>{{ end }}
 {{ if and (not site.Params.qa) (not site.Params.previewMode) }}<script type="module" src="{{ partial "island-src.html" "tutorial-rating" }}" defer></script>{{ end }}

From 60c6a5bda89ca543a668085e67a07808e33509d2 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 11:19:18 -0400
Subject: [PATCH 03/46] fix(identity): run identity-pin on the request tx to
 end SQLite deadlock (#2552)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The global identity-pin before('*') hook (#2571) called pinResolvedUser
with the resolver's bare top-level SELECT/INSERT CDS QL globals, which bind
to cds.db on a fresh ambient autocommit transaction. On single-connection
in-memory SQLite (unit tests) that ambient tx deadlocks against a handler's
own root cds.tx(...) — one connection, two contending root transactions —
producing the 30s timeout in admin-featured-topics-crud.test.js seen on
every CI run since PR #2571. HANA (pooled) does not deadlock, so it only
surfaced in tests.

- srv/server.js: pass cds.tx(req) to pinResolvedUser so the resolver joins
  the request's own transaction instead of opening a new ambient one.
- packages/core/resolve-db-user.js: thread an optional db runner through
  pinResolvedUser -> resolveUser -> writeIdentityLink; (db ? db.run(stmt) :
  stmt) preserves the existing no-arg/mock behavior for all other callers.
- srv/admin-service.js: recomputeFeaturedTopics + the FeaturedTopics
  after-write hook now join cds.tx(req) instead of opening a second root
  cds.tx(async tx => ...), the actual deadlock partner.

The gitignored srv/lib/_shared/core.bundle.mjs is regenerated by the
prebuild hook on build/deploy; no bundle commit needed.
---
 packages/core/resolve-db-user.js | 35 +++++++++++++++++++++-----------
 srv/admin-service.js             | 10 ++++++---
 srv/server.js                    |  6 +++++-
 3 files changed, 35 insertions(+), 16 deletions(-)

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 2a61e3582..64735e990 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -83,12 +83,14 @@ export function issuerSubjectFromUser(user) {
  * @param {string} user_ID — the Users.ID to link.
  * @param {{issuer:string, subject:string}} isu
  * @param {{provider?:string, email?:string, emailVerified?:boolean}} [meta]
+ * @param {object} [db] — optional tx/service runner (e.g. cds.tx(req)); when
+ *   given, the INSERT runs on that transaction instead of a fresh ambient one.
  */
-export async function writeIdentityLink(user_ID, isu, meta = {}) {
+export async function writeIdentityLink(user_ID, isu, meta = {}, db) {
   if (!user_ID || !isu) return;
   try {
     const { UserIdentities } = cds.entities('com.sap.developers.ims');
-    await INSERT.into(UserIdentities).entries({
+    const stmt = INSERT.into(UserIdentities).entries({
       ID: cds.utils.uuid(),
       user_ID,
       issuer: isu.issuer,
@@ -98,6 +100,7 @@ export async function writeIdentityLink(user_ID, isu, meta = {}) {
       emailVerified: meta.emailVerified ?? false,
       linkedAt: new Date().toISOString(),
     });
+    await (db ? db.run(stmt) : stmt);
   } catch (err) {
     if (!/unique|duplicate/i.test(String(err?.message ?? ''))) throw err;
   }
@@ -130,20 +133,25 @@ const SCIM_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{
  * Miss on all tiers → null (caller stays fail-closed).
  *
  * @param {object} user — CAP cds.context.user / req.user.
+ * @param {object} [db] — optional tx/service runner (e.g. cds.tx(req)); when
+ *   given, all reads/writes run on that transaction instead of a fresh ambient
+ *   one. Prevents single-connection SQLite deadlocks when a handler already
+ *   holds the request tx (#2552).
  * @returns {Promise<object|null>} the full Users row, or null.
  */
-export async function resolveUser(user) {
+export async function resolveUser(user, db) {
   if (!user || !user.id || user.id === 'anonymous') return null;
   const { Users, UserIdentities } = cds.entities('com.sap.developers.ims');
+  const run = (stmt) => (db ? db.run(stmt) : stmt);
 
   // ── Tier 1: (issuer, subject) link ──────────────────────────────────────
   const isu = issuerSubjectFromUser(user);
   if (isu) {
-    const link = await SELECT.one.from(UserIdentities)
+    const link = await run(SELECT.one.from(UserIdentities)
       .columns('user_ID')
-      .where({ issuer: isu.issuer, subject: isu.subject });
+      .where({ issuer: isu.issuer, subject: isu.subject }));
     if (link?.user_ID) {
-      const row = await SELECT.one.from(Users).where({ ID: link.user_ID });
+      const row = await run(SELECT.one.from(Users).where({ ID: link.user_ID }));
       if (row) return row;
     }
   }
@@ -155,14 +163,14 @@ export async function resolveUser(user) {
   // canonical value as a Tier-2 key — a SCIM-UUID or email here is not a sapId.
   const canonicalSapId = sapId && !SCIM_UUID_RE.test(sapId) && !sapId.includes('@') ? sapId : null;
   if (canonicalSapId) {
-    const row = await SELECT.one.from(Users).where({ sapId: canonicalSapId });
+    const row = await run(SELECT.one.from(Users).where({ sapId: canonicalSapId }));
     if (row) {
       if (isu) {
         await writeIdentityLink(row.ID, isu, {
           provider: providerFromIssuer(isu.issuer),
           email: user.authInfo?.token?.payload?.email ?? null,
           emailVerified: true,
-        });
+        }, db);
       }
       return row;
     }
@@ -171,7 +179,7 @@ export async function resolveUser(user) {
   // ── Tier 3: trusted-token-email → Users.email (+ self-heal link write) ──
   const email = tokenEmail(user);
   if (email) {
-    const rows = await SELECT.from(Users).where`lower(email) = ${email}`;
+    const rows = await run(SELECT.from(Users).where`lower(email) = ${email}`);
     const candidates = (rows ?? []).filter(
       (r) => r.email && !NOREPLY_GITHUB_RE.test(r.email),
     );
@@ -185,7 +193,7 @@ export async function resolveUser(user) {
           provider: providerFromIssuer(isu.issuer),
           email,
           emailVerified: true,
-        });
+        }, db);
       }
       return row;
     }
@@ -205,15 +213,18 @@ export async function resolveUser(user) {
  * fail-closed guard then applies.
  *
  * @param {object} user — CAP cds.context.user / req.user (mutated in place).
+ * @param {object} [db] — optional tx/service runner (e.g. cds.tx(req)) threaded
+ *   through to resolveUser so the pin's lookups join the request transaction
+ *   instead of opening a deadlock-prone ambient one on SQLite (#2552).
  * @returns {Promise<object|null>} the resolved Users row, or null.
  */
-export async function pinResolvedUser(user) {
+export async function pinResolvedUser(user, db) {
   if (!user || !user.id || user.id === 'anonymous') return null;
   // Idempotent: if already pinned this request, don't re-resolve.
   if (user.attr?.dbUserId) return { ID: user.attr.dbUserId, sapId: user.authInfo?.token?.userId ?? null };
   let row;
   try {
-    row = await resolveUser(user);
+    row = await resolveUser(user, db);
   } catch (err) {
     cds.log('resolve-db-user').warn('[pinResolvedUser] resolve failed',
       { email: tokenEmail(user), isu: issuerSubjectFromUser(user), msg: err?.message ?? err });
diff --git a/srv/admin-service.js b/srv/admin-service.js
index d7d6e359d..bac429fa6 100644
--- a/srv/admin-service.js
+++ b/srv/admin-service.js
@@ -4077,8 +4077,12 @@ export default class AdminService extends cds.ApplicationService {
     // ── (#1032) Featured missions carousel admin handlers ──
     // recomputeFeaturedTopics — SuperAdmin manual trigger to force a fresh
     // snapshot materialisation without waiting for the nightly job.
-    this.on('recomputeFeaturedTopics', async () => {
-      const { count, computedAt } = await cds.tx(async (tx) => recomputeSnapshot(tx));
+    this.on('recomputeFeaturedTopics', async (req) => {
+      // Join the request's own DB transaction (cds.tx(req)) instead of opening
+      // a new root tx with cds.tx(async tx => ...). On single-connection
+      // in-memory SQLite a second root tx deadlocks against the identity-pin
+      // before('*') hook's request-tx read (#2552).
+      const { count, computedAt } = await recomputeSnapshot(cds.tx(req));
       resetFtCache();
       return { count, computedAt };
     });
@@ -4095,7 +4099,7 @@ export default class AdminService extends cds.ApplicationService {
     // fire a debounced rebuild so hugo/data/featured_topics.json refreshes.
     this.after(['CREATE', 'UPDATE', 'DELETE'], 'FeaturedTopics', async (_data, req) => {
       try {
-        await cds.tx(async (tx) => recomputeSnapshot(tx));
+        await recomputeSnapshot(cds.tx(req));
         resetFtCache();
       } catch (err) {
         cds.log('admin-featured').warn('inline recompute failed after write:', err.message);
diff --git a/srv/server.js b/srv/server.js
index 683df3f86..30cfbb7f9 100644
--- a/srv/server.js
+++ b/srv/server.js
@@ -2269,8 +2269,12 @@ cds.on('served', async () => {
     srv.before('*', async (req) => {
       // Only authenticated requests carry a resolvable identity; anonymous
       // and tech-user paths no-op inside pinResolvedUser.
+      // Run the resolver's reads/writes on the REQUEST's own transaction
+      // (cds.tx(req)) rather than letting the bare SELECT/INSERT globals open a
+      // fresh ambient autocommit tx — on single-connection in-memory SQLite the
+      // ambient tx deadlocks against a handler's own cds.tx(...) (#2552).
       try {
-        await pinResolvedUser(req.user);
+        await pinResolvedUser(req.user, cds.tx(req));
       } catch (err) {
         cds.log('identity-pin').warn('[before *] pin failed',
           { service: srv.name, msg: err?.message ?? err });

From e68926622745bf4158ac90de155e58f2372611cd Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:20:40 -0400
Subject: [PATCH 04/46] feat(petoberfest-admin): enlarge photos, uploader
 email, pending filter, submit alerts (#2597)

Admin moderation-queue enhancements requested in #2597:

- A: Click a submission thumbnail to open a centered, full-size (1280px)
  preview dialog (keyboard/touch accessible). Replaces the non-functional
  "Open in New Tab"; sap.m.Image has no hover event, so press is used.
  First JS extension in this FE app (ext/PhotoThumb.js, CSP-safe core:require).
- B: Uploader was blank when the uploader's token lacked given_name/
  family_name. Flatten user.email into the PetSubmissions projection as
  uploaderEmail and show it as an "Email" column beside "Uploader".
- C: One-click "Pending" vs "All" quick-filter tabs with counts
  (UI.SelectionVariant + manifest quickVariantSelection, annotation-only).
- D: Notify DevRel when a new submission lands in the moderation queue via
  the existing ANS alerting path (mirrors channel-submission-service.js):
  fire-and-forget, DB-gated (ChatSettings.alertsEnabled), fail-open, with a
  pure testable buildPetoberfestSubmissionAlert() builder.

Tests: builder unit tests + a projection-shape test for uploaderEmail.
EDMX compiles; UI5 linter clean on the new files (pre-existing manifest-v2
findings untouched).
---
 app/admin-annotations.cds                     | 21 ++++++
 .../webapp/ext/PhotoThumb.fragment.xml        | 10 ++-
 .../petoberfest/webapp/ext/PhotoThumb.js      | 68 +++++++++++++++++++
 app/admin/petoberfest/webapp/manifest.json    | 13 ++++
 srv/admin-service.cds                         |  6 ++
 srv/lib/petoberfest-upload.js                 | 50 ++++++++++++++
 test/unit/petoberfest-admin.test.js           | 13 +++-
 .../unit/petoberfest-submission-alert.test.js | 52 ++++++++++++++
 8 files changed, 230 insertions(+), 3 deletions(-)
 create mode 100644 app/admin/petoberfest/webapp/ext/PhotoThumb.js
 create mode 100644 test/unit/petoberfest-submission-alert.test.js

diff --git a/app/admin-annotations.cds b/app/admin-annotations.cds
index 2fb8c45c1..20f1137c7 100644
--- a/app/admin-annotations.cds
+++ b/app/admin-annotations.cds
@@ -4229,6 +4229,7 @@ annotate AdminService.PetSubmissions with @(
   UI.LineItem: [
     { $Type: 'UI.DataField', Value: petName,      Label: 'Pet Name' },
     { $Type: 'UI.DataField', Value: uploaderName, Label: 'Uploader' },
+    { $Type: 'UI.DataField', Value: uploaderEmail, Label: 'Email' },
     { $Type: 'UI.DataField', Value: contestTitle, Label: 'Contest' },
     { $Type: 'UI.DataField', Value: moderation,   Label: 'Status' },
     { $Type: 'UI.DataField', Value: uploadedAt,   Label: 'Uploaded' },
@@ -4246,6 +4247,7 @@ annotate AdminService.PetSubmissions with @(
   UI.FieldGroup#Details: { Data: [
     { Value: petName,      Label: 'Pet Name' },
     { Value: uploaderName, Label: 'Uploader' },
+    { Value: uploaderEmail, Label: 'Email' },
     { Value: contestTitle, Label: 'Contest' },
     { Value: contestSlug,  Label: 'Contest Slug' },
     { Value: moderation,   Label: 'Status' },
@@ -4265,10 +4267,29 @@ annotate AdminService.PetSubmissions with @(
   Capabilities.UpdateRestrictions: { Updatable: false }
 );
 
+// Quick-filter tabs (#2597): one-click "Pending" vs "All" views with counts.
+// Wired as single-table quickVariantSelection in the FE manifest's
+// controlConfiguration for the LineItem. SelectionVariant#All uses an empty
+// SelectOptions so it shows the full queue.
+annotate AdminService.PetSubmissions with @(
+  UI.SelectionVariant #All: {
+    Text: 'All',
+    SelectOptions: []
+  },
+  UI.SelectionVariant #Pending: {
+    Text: 'Pending',
+    SelectOptions: [{
+      PropertyName: moderation,
+      Ranges: [{ Sign: #I, Option: #EQ, Low: 'PENDING' }]
+    }]
+  }
+);
+
 annotate AdminService.PetSubmissions with {
   ID           @Common.Label: 'ID';
   petName      @Common.Label: 'Pet Name';
   uploaderName @Common.Label: 'Uploader';
+  uploaderEmail @Common.Label: 'Email';
   moderation   @Common.Label: 'Status';
   sizeBytes    @Common.Label: 'Size (bytes)';
   uploadedAt   @Common.Label: 'Uploaded At';
diff --git a/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml b/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml
index 6d78237e8..52beae5cd 100644
--- a/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml
+++ b/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml
@@ -1,11 +1,17 @@
 <core:FragmentDefinition
   xmlns:core="sap.ui.core"
-  xmlns:m="sap.m">
+  xmlns:m="sap.m"
+  core:require="{ handler: 'sap/tutorials/admin/petoberfest/ext/PhotoThumb' }">
+  <!-- Issue #2597: press the thumbnail to open a centered, full-size preview
+       (replaces the non-functional "Open in New Tab"). sap.m.Image has no
+       hover event, so press is used — also keyboard/touch accessible. -->
   <m:Image
     src="{= '/admin/petoberfest/photo/' + ${ID} + '?size=thumb' }"
     width="60px"
     height="60px"
-    decorative="true"
     densityAware="false"
+    press="handler.onEnlarge"
+    alt="{= 'Photo of ' + (${petName} || 'submission') + ' — click to enlarge' }"
+    tooltip="Click to enlarge"
     class="sapUiTinyMargin" />
 </core:FragmentDefinition>
diff --git a/app/admin/petoberfest/webapp/ext/PhotoThumb.js b/app/admin/petoberfest/webapp/ext/PhotoThumb.js
new file mode 100644
index 000000000..041ebc8e5
--- /dev/null
+++ b/app/admin/petoberfest/webapp/ext/PhotoThumb.js
@@ -0,0 +1,68 @@
+sap.ui.define([
+	"sap/m/Dialog",
+	"sap/m/Image",
+	"sap/m/Button"
+], function (Dialog, Image, Button) {
+	"use strict";
+
+	// Issue #2597: moderators asked to "see the pictures larger before
+	// approving" and for a centered large version — the old "Open in New Tab"
+	// did nothing. sap.m.Image exposes no hover event, so we enlarge on press
+	// (click / Enter / Space), which is also keyboard- and touch-accessible.
+	// The full-size (1280px) image is the same auth-gated express route as the
+	// thumbnail, just without ?size=thumb.
+	return {
+		/**
+		 * Open a centered modal dialog showing the full-size submission photo.
+		 * Bound from PhotoThumb.fragment.xml via core:require.
+		 * @param {sap.ui.base.Event} oEvent press event from the thumbnail Image
+		 */
+		onEnlarge: function (oEvent) {
+			var oImageCtrl = oEvent.getSource();
+			var oContext = oImageCtrl.getBindingContext();
+			if (!oContext) {
+				return;
+			}
+			var sId = oContext.getProperty("ID");
+			var sPetName = oContext.getProperty("petName") || "Submission";
+			if (!sId) {
+				return;
+			}
+
+			var oDialog = new Dialog({
+				title: sPetName,
+				// Cap the dialog to the viewport so very large photos stay
+				// centered and fully visible; the image scales within.
+				contentWidth: "90vw",
+				contentHeight: "90vh",
+				horizontalScrolling: true,
+				verticalScrolling: true,
+				resizable: true,
+				draggable: true,
+				content: [
+					new Image({
+						// Omit ?size=thumb to fetch the 1280px display render.
+						src: "/admin/petoberfest/photo/" + encodeURIComponent(sId),
+						densityAware: false,
+						alt: "Full-size photo of " + sPetName,
+						// Fit the width of the dialog content; height follows
+						// the image aspect ratio.
+						width: "100%"
+					})
+				],
+				endButton: new Button({
+					text: "Close",
+					press: function () {
+						oDialog.close();
+					}
+				}),
+				afterClose: function () {
+					oDialog.destroy();
+				}
+			});
+
+			oDialog.addStyleClass("sapUiContentPadding");
+			oDialog.open();
+		}
+	};
+});
diff --git a/app/admin/petoberfest/webapp/manifest.json b/app/admin/petoberfest/webapp/manifest.json
index 1cf121cba..5534ad4ce 100644
--- a/app/admin/petoberfest/webapp/manifest.json
+++ b/app/admin/petoberfest/webapp/manifest.json
@@ -87,6 +87,19 @@
                   "tableSettings": {
                     "selectionMode": "ForceMulti"
                   },
+                  "quickVariantSelection": {
+                    "showCounts": true,
+                    "paths": [
+                      {
+                        "key": "All",
+                        "annotationPath": "com.sap.vocabularies.UI.v1.SelectionVariant#All"
+                      },
+                      {
+                        "key": "Pending",
+                        "annotationPath": "com.sap.vocabularies.UI.v1.SelectionVariant#Pending"
+                      }
+                    ]
+                  },
                   "columns": {
                     "PhotoThumbColumn": {
                       "header": "Photo",
diff --git a/srv/admin-service.cds b/srv/admin-service.cds
index 5103bb37c..a4b55e911 100644
--- a/srv/admin-service.cds
+++ b/srv/admin-service.cds
@@ -173,6 +173,12 @@ service AdminService {
   // A Tutorial.Author-only user (without Admin) cannot reach this service.
   entity PetSubmissions as projection on ims.PetSubmissions {
     ID, petName, uploaderName, moderation, sizeBytes, uploadedAt,
+    // uploaderName is NULL when the uploader's token lacked given_name/
+    // family_name claims (#2597). Flatten the uploader's email from the
+    // user association so moderators can always identify/contact the
+    // submitter. Scalar path expression (like contestSlug below) — no LOB,
+    // no redirect (Users is not projected into AdminService).
+    user.email as uploaderEmail,
     petoberfest.slug as contestSlug, petoberfest.title as contestTitle
   } actions {
     @(requires: ['Tutorial.Author', 'Admin'])
diff --git a/srv/lib/petoberfest-upload.js b/srv/lib/petoberfest-upload.js
index 6c73e5ffd..c3ddf844f 100644
--- a/srv/lib/petoberfest-upload.js
+++ b/srv/lib/petoberfest-upload.js
@@ -4,12 +4,40 @@ import { resolveOrCreatePetUser } from '../petoberfest-service.js';
 import { getNextLegacyId } from './legacy-id.js';
 import { stampSubmissionId } from './task-record-submission-id.js';
 import { rollUpParentsForCompletion } from './completion-rollup.js';
+import * as alerting from './alerting.js';
+
+const LOG = cds.log('petoberfest-upload');
 
 const SLUG_RE = /^[a-z0-9][a-z0-9-]{0,254}$/;
 
 /** Decoded-image size cap (mirrors the former multer limit). */
 export const MAX_PHOTO_BYTES = 10 * 1024 * 1024;
 
+// Pure alert builder (mirrors buildChannelSubmissionAlert in
+// channel-submission-service.js): takes the freshly-inserted submission facts
+// and returns the ANS alert envelope to raise, or null when there is nothing to
+// announce. No I/O, so subject/body are testable in isolation (#2597). A new
+// pet-photo submission awaiting moderation is informational, not urgent →
+// NOTICE, which routes to the devrel-deploys channel only, never paging on-call.
+export function buildPetoberfestSubmissionAlert(submission = {}) {
+  const id = submission.id || submission.ID;
+  if (!id) return null;
+  const contest = submission.contestTitle || submission.contestSlug || 'a contest';
+  const uploader = (submission.uploaderName || '').trim() || submission.uploaderEmail || 'an entrant';
+  const petName = (submission.petName || '').trim();
+  const bodyLines = [
+    `A new Petoberfest photo submission${petName ? ` ("${petName}")` : ''} from ${uploader} for ${contest} is awaiting approval.`,
+    'Review it in the admin moderation queue: /admin-ui/#Petoberfest-manage',
+  ];
+  return {
+    eventType: 'PetoberfestSubmissionPending',
+    severity: 'NOTICE',
+    subject: `Petoberfest submission awaiting approval: ${petName || contest}`,
+    body: bodyLines.join(' '),
+  };
+}
+
+
 /**
  * Decode a JSON upload payload into a raw image Buffer.
  * Accepts a bare base64 string or a `data:<mime>;base64,<...>` URL.
@@ -60,6 +88,28 @@ export async function uploadPetSubmission(db, { slug, user, buffer, mimeType, pe
     uploaderName, ...processed,
   });
 
+  // #2597: notify DevRel that a new submission landed in the moderation queue.
+  // Fire-and-forget beside the persisted row — alerting.raise is itself
+  // fail-open (DB-gated via ChatSettings.alertsEnabled, 5s-capped, never
+  // throws), so a degraded ANS path can never break or slow the entrant's
+  // upload. Mirrors channel-submission-service.js. A per-ID resourceName keeps
+  // each distinct submission outside the plugin's dedup window. uploaderName is
+  // often null (token lacks given_name/family_name), so the builder falls back
+  // to the email for a useful alert body.
+  const alert = buildPetoberfestSubmissionAlert({
+    id,
+    petName,
+    uploaderName,
+    uploaderEmail: user.attr?.email,
+    contestTitle: contest.title,
+    contestSlug: contest.slug,
+  });
+  if (alert) {
+    alerting
+      .raise({ ...alert, category: 'ALERT', resource: { resourceName: `petoberfest-submission-${id}`, resourceType: 'moderation-queue' } })
+      .catch((err) => LOG.warn('petoberfest submission alert raise failed (swallowed):', err?.message ?? err));
+  }
+
   // Idempotent award: skip if a non-SUPERSEDED PETOBERFEST record already exists for this user+contest.
   const existing = await db.run(SELECT.one.from(TaskRecords).where({
     user_ID: dbUser.ID, taskLegacyId: contest.legacyId, taskType: 'PETOBERFEST', status: { '!=': 'SUPERSEDED' },
diff --git a/test/unit/petoberfest-admin.test.js b/test/unit/petoberfest-admin.test.js
index 5e6237e36..e7c40ddf0 100644
--- a/test/unit/petoberfest-admin.test.js
+++ b/test/unit/petoberfest-admin.test.js
@@ -12,10 +12,21 @@ beforeAll(async () => {
   db = await cds.connect.to('db');
   const { Petoberfests, PetSubmissions, Users } = cds.entities('com.sap.developers.ims');
   await db.run(INSERT.into(Petoberfests).entries({ ID: 'p1', legacyId: 9001, slug: 'petoberfest-2026', title: 'P26', status: 'ACTIVE' }));
-  await db.run(INSERT.into(Users).entries({ ID: 'u1', sapId: 's1' }));
+  await db.run(INSERT.into(Users).entries({ ID: 'u1', sapId: 's1', email: 'tom@example.com' }));
   await db.run(INSERT.into(PetSubmissions).entries({ ID: 's1', petoberfest_ID: 'p1', user_ID: 'u1', petName: 'Rex', moderation: 'PENDING', mimeType: 'image/webp', uploadedAt: '2026-08-01T00:00:00Z' }));
 });
 
+test('PetSubmissions projection exposes uploaderEmail flattened from the user association (#2597)', async () => {
+  // uploaderName is often NULL (token lacked given_name/family_name), so the
+  // admin UI shows the uploader's email as a fallback. Verify the projection
+  // actually surfaces it from user.email — a scalar path expression, no LOB.
+  const srv = await cds.connect.to('AdminService');
+  const row = await srv.tx({ user: ADMIN_USER }, (tx) =>
+    tx.run(SELECT.one.from('AdminService.PetSubmissions').columns('ID', 'uploaderEmail').where({ ID: 's1' })));
+  expect(row).toBeDefined();
+  expect(row.uploaderEmail).toBe('tom@example.com');
+});
+
 test('approve sets moderation APPROVED', async () => {
   const srv = await cds.connect.to('AdminService');
   await srv.tx({ user: ADMIN_USER }, async (tx) => {
diff --git a/test/unit/petoberfest-submission-alert.test.js b/test/unit/petoberfest-submission-alert.test.js
new file mode 100644
index 000000000..d055c2fa3
--- /dev/null
+++ b/test/unit/petoberfest-submission-alert.test.js
@@ -0,0 +1,52 @@
+// test/unit/petoberfest-submission-alert.test.js
+// Pure, I/O-free tests for the Petoberfest moderation-queue alert builder (#2597).
+// Mirrors the channel-submission builder test: assert the ANS envelope shape
+// without touching alerting.raise / the DB.
+import { describe, test, expect } from 'vitest';
+import { buildPetoberfestSubmissionAlert } from '../../srv/lib/petoberfest-upload.js';
+
+describe('buildPetoberfestSubmissionAlert', () => {
+  test('returns null when there is no submission id (nothing to announce)', () => {
+    expect(buildPetoberfestSubmissionAlert({})).toBeNull();
+    expect(buildPetoberfestSubmissionAlert({ petName: 'Rex' })).toBeNull();
+  });
+
+  test('builds a NOTICE envelope with pet name, uploader name, contest and a deep link', () => {
+    const alert = buildPetoberfestSubmissionAlert({
+      id: 'abc-123',
+      petName: 'Rex',
+      uploaderName: 'Tom Jung',
+      contestTitle: 'Petoberfest 2026',
+    });
+    expect(alert).toMatchObject({
+      eventType: 'PetoberfestSubmissionPending',
+      severity: 'NOTICE',
+    });
+    expect(alert.subject).toContain('Rex');
+    expect(alert.body).toContain('Rex');
+    expect(alert.body).toContain('Tom Jung');
+    expect(alert.body).toContain('Petoberfest 2026');
+    // Deep link into the admin moderation queue (shell inbound Petoberfest-manage).
+    expect(alert.body).toContain('/admin-ui/#Petoberfest-manage');
+  });
+
+  test('falls back to uploaderEmail when uploaderName is null (common: token lacks given/family name)', () => {
+    const alert = buildPetoberfestSubmissionAlert({
+      id: 'abc-123',
+      petName: 'Rex',
+      uploaderName: null,
+      uploaderEmail: 'tom@example.com',
+      contestTitle: 'Petoberfest 2026',
+    });
+    expect(alert.body).toContain('tom@example.com');
+    expect(alert.body).not.toContain('null');
+  });
+
+  test('falls back to a generic entrant label when both name and email are absent', () => {
+    const alert = buildPetoberfestSubmissionAlert({ id: 'abc-123', contestSlug: 'petoberfest-2026' });
+    expect(alert.body).toContain('an entrant');
+    expect(alert.body).not.toContain('undefined');
+    // Uses contestSlug when contestTitle is absent.
+    expect(alert.body).toContain('petoberfest-2026');
+  });
+});

From 857216d12c84fb890174f33b047e563b24d85a3e Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:38:15 -0400
Subject: [PATCH 05/46] docs(auth): design spec for IAS social login, no IdP
 chooser (#2506)

---
 .../2026-10-02-ias-social-login-design.md     | 127 ++++++++++++++++++
 1 file changed, 127 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-10-02-ias-social-login-design.md

diff --git a/docs/superpowers/specs/2026-10-02-ias-social-login-design.md b/docs/superpowers/specs/2026-10-02-ias-social-login-design.md
new file mode 100644
index 000000000..16b45d487
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-02-ias-social-login-design.md
@@ -0,0 +1,127 @@
+# IAS Social Login — additive, no IdP chooser (#2506)
+
+**Date:** 2026-10-02
+**Issue:** [#2506](https://github.com/sap-tutorials/tutorials-ims/issues/2506) — continue IAS usage: enable social login on the IAS infrastructure without breaking the existing default IdP login.
+**Status:** Design — pending user review.
+**Depends on:** #2552 identity-linkage layer (`(issuer, subject)` resolver) — **already merged + in PROD** (Release 1.33.0, 2026-10-01).
+
+## Goal
+
+Let a developer sign in with a **social provider** (Google etc., surfaced inside IAS) while the existing **SAP ID Service** login keeps working exactly as today, and **neither path shows an IdP selection screen**. Social-authenticated users resolve to the **same `user_uuid`** as their SAP ID login (merge by email), so progress/completions carry across.
+
+## What is already in place (verified 2026-10-02)
+
+This feature is mostly *configuration that already exists*; the code change is small.
+
+1. **Subaccount trusts two OIDC IdPs** (live `btp list security/trust`, Tutorial System subaccount `3c6fa3f1-…`):
+
+   | IdP | originKey | protocol | status |
+   |---|---|---|---|
+   | SAP ID Service (default) | `sap.default` | OpenID Connect | active |
+   | IAS tenant `atxgsg7zi` (business users) | `sap.custom` | OpenID Connect | active |
+
+2. **Social providers are enabled inside the IAS tenant** and verified visible on the IAS login page (user-confirmed 2026-10-02). Enabling/adding social providers is an IAS admin-console action — no app change.
+
+3. **XSUAA federation re-issues its own token.** The main app binds only `tutorials-xsuaa`. When a user picks `sap.custom`, XSUAA federates to IAS, then re-issues an **XSUAA** token to the app. The main CAP `srv` therefore needs **no** `auth:{kind:ias}` change — it already accepts the token for both IdPs. User-confirmed: logging in via *either* IdP reached real authenticated app pages.
+
+4. **Identity merge is already deployed.** `packages/core/resolve-db-user.js` (#2552) resolves `(iss, sub)` across providers (Tier 1), self-heals by canonical sapId (Tier 2), and matches trusted token-email → `Users.email` (Tier 3), merging SAP-ID and IAS/social logins onto one `Users` row. `providerFromIssuer` already maps `*.accounts.ondemand.com → 'ias'`. **No resolver change needed.**
+
+5. **approuter supports IdP pinning.** Installed `@sap/approuter` **v16.9.0** honors the `sap_idp=<originKey>` query param (translated to XSUAA `login_hint={"origin":"<originKey>"}`), **gated by `dynamicIdentityProvider`** — currently **off**.
+
+## The gap (what this build actually does)
+
+Two things, both small:
+
+1. **Turn on IdP pinning** — enable `dynamicIdentityProvider` so `sap_idp` is honored. Without it, `sap_idp` is silently ignored (`path-rewriter.js:136`).
+2. **A two-button sign-in landing page** — app-controlled HTML with two pinned entries so users never see XSUAA's raw chooser:
+   - **[Sign in with SAP]** → `…?sap_idp=sap.default` → SAP ID Service (today's path).
+   - **[Sign in with SAP Universal ID]** → `…?sap_idp=sap.custom` → IAS page (social + IAS-local).
+
+   The button label is **not** "Sign in with Google" — our page names the SAP Universal ID / IAS entry; the social provider buttons live *inside* IAS. This keeps the page provider-agnostic (add more social IdPs in IAS with no page change).
+
+## Section 1 — Architecture
+
+```
+                 ┌───────────────────────────────────────┐
+   GET /signin   │  App landing page (approuter static)   │
+  ──────────────▶│  [ Sign in with SAP ]                  │
+                 │  [ Sign in with SAP Universal ID ]     │
+                 └──────┬──────────────────────┬──────────┘
+      sap_idp=sap.default                      sap_idp=sap.custom
+                        ▼                       ▼
+                 approuter /login (xsuaa, dynamicIdentityProvider:true)
+                        │  login_hint={"origin":"sap.default"}  │ {"origin":"sap.custom"}
+                        ▼                       ▼
+                     XSUAA ───────────────► federates to IdP
+                        │ SAP ID Service        │ IAS atxgsg7zi (social + local)
+                        └──────────┬────────────┘
+                       XSUAA re-issues its OWN token (both branches)
+                                   ▼
+                           main approuter + main srv (unchanged)
+                                   ▼
+                 (iss,sub) resolver merges by email → one user_uuid
+```
+
+- Main approuter login binding (`tutorials-xsuaa`) **unchanged** — no second approuter, no custom OIDC code.
+- Main srv auth **unchanged** — XSUAA token for both branches.
+- No new service bindings. No MTA resource changes.
+
+## Section 2 — The no-chooser mechanism
+
+- `sap_idp=<originKey>` on an xsuaa-protected URL → approuter emits `login_hint={"origin":"<originKey>"}` on the XSUAA authorize request → XSUAA jumps straight to that IdP, no selection screen (`oauth2.js:31-42`, README v16.9.0 §Dynamic Identity Provider).
+- **Gate:** `dynamicIdentityProvider` must be true, set either:
+  - globally via approuter env `DYNAMIC_IDENTITY_PROVIDER: true` (standalone approuter → applies to all routes), **or**
+  - per-route `"dynamicIdentityProvider": true` on the sign-in route(s) in `xs-app.json`.
+
+  **Decision (recommended): per-route**, scoped to the sign-in entry route(s), not global — smallest blast radius; leaves all other routes' login behavior exactly as today. (Open for review — see Open Questions.)
+- **Session caching:** once XSUAA issues the session cookie, the landing page is not seen again until logout/expiry — the "unobtrusive but powerful, seen once" UX.
+- **Caveat — IdP switch needs logout first** (approuter README:932): a user already logged in via one IdP must hit `/logout` before the other `sap_idp` takes effect. The landing page / account menu must route IdP-switch through logout. This is the one real UX wrinkle.
+
+## Section 3 — Identity continuity (already solved, just verified)
+
+No code here — this section is a **verification obligation**, not a change.
+
+- Social/IAS login via `sap.custom` → XSUAA token with IAS-derived `(iss, sub)`.
+- First hit: resolver Tier-3 matches the trusted token email to the existing `Users.email` row (the user's SAP ID account), writes a `UserIdentities` link, returns that row → **same `user_uuid`**.
+- Subsequent hits: Tier-1 `(iss, sub)` → O(1), no email dependency.
+- Grounding risk (from #2552): `Users.email` is NULL on ~97.6% of PROD rows and backfills lazily on login. A social user whose SAP-ID row has **no email yet** will Tier-3-miss and get a **separate** `Users` row (separate `user_uuid`) until a later explicit account-merge. This is the known, accepted #2552 boundary — call it out in testing, do not try to re-solve it here.
+
+## Section 4 — Scope
+
+**In scope (code):**
+1. `approuter/static/` sign-in landing page (two pinned buttons) + a route for it in `approuter/xs-app.json`.
+2. Enable `dynamicIdentityProvider` (per-route) on the sign-in / login route(s) in `approuter/xs-app.json`.
+3. IdP-switch-via-logout wiring on the landing page / account menu (handle README:932 caveat).
+4. Optional: redirect unauthenticated entry to `/signin` instead of the default XSUAA chooser (so the chooser is never reachable by normal navigation).
+
+**In scope (config / console, no code):**
+5. Confirm IAS social providers enabled (done) + branding of the IAS login page is a separate follow-up (#2506 notes branding is deferred).
+
+**Out of scope / unchanged:**
+- Main srv auth config, identity resolver (`resolve-db-user.js`), XSUAA bindings, second approuter, MTA resources — all untouched.
+- Cross-provider explicit account-merge UX (same human, SAP then social, when email was absent) — deferred per #2552.
+- IAS login-page branding/custom domain — separate follow-up.
+
+## Section 5 — Testing
+
+1. **Both buttons, no chooser:** `/signin` → [SAP] lands on SAP ID Service directly; [SAP Universal ID] lands on IAS page directly; XSUAA selection screen never shown.
+2. **Default path regression:** existing deep links / normal navigation for already-authenticated users behave exactly as today; a logged-in session is not forced back through `/signin`.
+3. **Identity continuity (happy path):** a user with a populated `Users.email` logs in via social → resolves to the **same `user_uuid`** as their prior SAP ID login; progress visible.
+4. **Identity boundary (known #2552 limit):** a user whose SAP-ID row has NULL email logs in via social → gets a separate row; documented, not a regression.
+5. **IdP switch:** logged in as SAP, choose Universal ID → confirm logout-first flow works and does not 400/loop.
+6. **Role-collection authorization:** an admin/author identity asserted via IAS still authorizes role-gated pages (role collections resolve by identity).
+7. **DEV first**, then PROD — same trust config exists on the shared subaccount.
+
+## Verification before calling done
+
+- `dynamicIdentityProvider` actually honored on DEV (not silently ignored): confirm `sap_idp` produces a direct IdP jump, inspect the authorize URL carries `login_hint`.
+- Admin-UI changes rule (CLAUDE.md): the landing page ships via the approuter static copy at `mbt build` — a FULL deploy, no `--skip-build`, no `-m` scoping; Step 3.5 bundle check applies.
+- `cf target` before any push; deploy from fresh `origin/DEV`, never a feature branch.
+
+## Open questions for review
+
+1. **Gate scope:** per-route `dynamicIdentityProvider` on the sign-in route (recommended, minimal) vs. global `DYNAMIC_IDENTITY_PROVIDER` env (simpler, broader). Any route accepting `sap_idp` lets a crafted URL steer the IdP — per-route limits that surface.
+2. **Entry point:** add a NEW `/signin` page, or convert the existing `/login` → `/login-redirect.html` route into the two-button page? (Existing route at `xs-app.json:116-121`.)
+3. **Label:** "Sign in with SAP Universal ID" — confirm wording for the IAS button.
+4. **Default unauthenticated behavior:** force all unauthenticated entry to `/signin` (never reach XSUAA's chooser), or only use `/signin` as an explicit opt-in link? Forcing it is the true "no chooser ever" guarantee but touches the default path more.
+5. **Tenant drift:** a recalled note mentions a later swap to IAS tenant `alzmza7li`; live trust shows `atxgsg7zi` as the active `sap.custom`. Spec uses the live value. Confirm no pending re-trust.

From 62f1813c06799359edfcd1781d8b69d105493440 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:43:44 -0400
Subject: [PATCH 06/46] docs(auth): add styling recipe + resolve decisions in
 IAS social-login spec (#2506)

---
 .../2026-10-02-ias-social-login-design.md     | 30 +++++++++++++++----
 1 file changed, 24 insertions(+), 6 deletions(-)

diff --git a/docs/superpowers/specs/2026-10-02-ias-social-login-design.md b/docs/superpowers/specs/2026-10-02-ias-social-login-design.md
index 16b45d487..77dde2ba9 100644
--- a/docs/superpowers/specs/2026-10-02-ias-social-login-design.md
+++ b/docs/superpowers/specs/2026-10-02-ias-social-login-design.md
@@ -86,6 +86,20 @@ No code here — this section is a **verification obligation**, not a change.
 - Subsequent hits: Tier-1 `(iss, sub)` → O(1), no email dependency.
 - Grounding risk (from #2552): `Users.email` is NULL on ~97.6% of PROD rows and backfills lazily on login. A social user whose SAP-ID row has **no email yet** will Tier-3-miss and get a **separate** `Users` row (separate `user_uuid`) until a later explicit account-merge. This is the known, accepted #2552 boundary — call it out in testing, do not try to re-solve it here.
 
+## Section 3.5 — Styling (user requirement)
+
+The sign-in landing page must **match the site theme** — light/dark mode and our styles — the same way the **error pages** do. It should evoke the SAP Universal ID experience but rendered in our skin (not a raw SAP/IAS screen; that screen appears only *after* the user picks the Universal ID button and is handed to IAS).
+
+**Author it as a Hugo layout, NOT a hand-written approuter static file.** The error pages (403/404/500…) are Hugo-generated and copied into `approuter/static/` at build (`mta.yaml:98` `cp -r hugo/public/. approuter/static/`). A Hugo-sourced page inherits theming, build, and deploy automatically; a hand-edited `approuter/static/*.html` would be overwritten by the build (and is exactly the "ships dead / not deployed" trap in CLAUDE.md).
+
+Recipe (verified 2026-10-02):
+- **Clone** `hugo/layouts/403.html` — the closest auth-context analog (uses `fd-button`, `/logout`, `<ui5-illustrated-message>`). It's just a `{{ define "main" }}…{{ end }}` block; `<head>`, shellbar, footer, CSS links, and the theme script all come from `hugo/layouts/_default/baseof.html` + `partials/head.html`.
+- **Site CSS:** inherited via the shared head `<link>` chain (`fundamental-styles-icon`, `sap-theme-vars`, `sap-horizon-dark`, `chroma-light/dark`, `sap-fundamental`, `ui5-overrides`). Page-specific `<style>` uses `fd-*` classes + `var(--sap*)` tokens (`--sapBackgroundColor`, `--sapTextColor`, `--sapTile_Background`).
+- **Light/dark:** inherited for free from `head.html` pre-paint script — reads localStorage key **`theme`** (`"dark"`/`"light"`), falls back to `prefers-color-scheme`, sets `<html data-theme>` + `.dark` before first paint (no flash). Consistent cold or from an already-themed session. Toggle via the shared shellbar `[data-action="toggle-theme"]`.
+- **Logo/brand:** `/img/sap-logo.svg`, favicons `/favicon.svg` / `/favicon.ico` (root-absolute, served after the static copy).
+- **Buttons:** two `fd-button`s styled as site primary/secondary (`fd-button--emphasized` for the primary). The IAS/Universal ID button on-brand but visually distinct. Each is a link to the pinned `?sap_idp=` entry (Section 2).
+- **Ships via:** `build:hugo` → `hugo/public/` → `mta.yaml:98` copy → `mbt build`/`npm run deploy`. No manual copy into `approuter/static/`.
+
 ## Section 4 — Scope
 
 **In scope (code):**
@@ -118,10 +132,14 @@ No code here — this section is a **verification obligation**, not a change.
 - Admin-UI changes rule (CLAUDE.md): the landing page ships via the approuter static copy at `mbt build` — a FULL deploy, no `--skip-build`, no `-m` scoping; Step 3.5 bundle check applies.
 - `cf target` before any push; deploy from fresh `origin/DEV`, never a feature branch.
 
-## Open questions for review
+## Decisions (resolved 2026-10-02)
+
+1. **Gate scope:** per-route `dynamicIdentityProvider` on the sign-in route only — minimal blast radius; other routes' login behavior unchanged. *(recommended, accepted)*
+2. **Entry point:** add a NEW `/signin` page; leave the existing `/login` → `/login-redirect.html` route in place as the callback-side plumbing. The two buttons live on `/signin`.
+3. **Label:** "Sign in with SAP Universal ID" for the IAS button, "Sign in with SAP" for the default. *(wording confirmable at implementation; not blocking)*
+4. **Default unauthenticated behavior:** force unauthenticated entry to `/signin` so XSUAA's raw chooser is never reachable by normal navigation — the true "no chooser ever" guarantee. Regression-test the default path (Section 5 #2) to ensure already-authenticated sessions are not bounced through `/signin`.
+5. **Styling:** Hugo-sourced sign-in layout cloned from `hugo/layouts/403.html`, inheriting site CSS + light/dark (localStorage `theme` key) + logo + build copy — per Section 3.5. *(user requirement, accepted)*
+
+## Open question — needs user confirm
 
-1. **Gate scope:** per-route `dynamicIdentityProvider` on the sign-in route (recommended, minimal) vs. global `DYNAMIC_IDENTITY_PROVIDER` env (simpler, broader). Any route accepting `sap_idp` lets a crafted URL steer the IdP — per-route limits that surface.
-2. **Entry point:** add a NEW `/signin` page, or convert the existing `/login` → `/login-redirect.html` route into the two-button page? (Existing route at `xs-app.json:116-121`.)
-3. **Label:** "Sign in with SAP Universal ID" — confirm wording for the IAS button.
-4. **Default unauthenticated behavior:** force all unauthenticated entry to `/signin` (never reach XSUAA's chooser), or only use `/signin` as an explicit opt-in link? Forcing it is the true "no chooser ever" guarantee but touches the default path more.
-5. **Tenant drift:** a recalled note mentions a later swap to IAS tenant `alzmza7li`; live trust shows `atxgsg7zi` as the active `sap.custom`. Spec uses the live value. Confirm no pending re-trust.
+- **Tenant drift (Q5):** a recalled note mentions a later swap to IAS tenant `alzmza7li`; live `btp list security/trust` shows `atxgsg7zi` as the active `sap.custom`. Spec/plan use the **live** value `atxgsg7zi`/`sap.custom`. Confirm no pending re-trust to `alzmza7li` before implementation, or the `sap_idp` origin key stays `sap.custom` regardless of tenant (origin key is stable across tenant swap unless the trust was re-created with a new key).

From aa7a98606b236e985d76264ecf18b7d14e92effb Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:44:52 -0400
Subject: [PATCH 07/46] docs(2595): design spec for semantic blockquote alert
 variants

---
 ...-10-02-blockquote-alert-variants-design.md | 183 ++++++++++++++++++
 1 file changed, 183 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md

diff --git a/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md b/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md
new file mode 100644
index 000000000..5ac3ad3aa
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md
@@ -0,0 +1,183 @@
+# Semantic alert variants for tutorial blockquotes — Design (#2595)
+
+- **Issue:** [sap-tutorials/tutorials-ims#2595](https://github.com/sap-tutorials/tutorials-ims/issues/2595) — "Blockquote Emphasis"
+- **Date:** 2026-10-02
+- **Status:** Approved design, pre-implementation
+- **Branch:** `feat/2595-blockquote-alert-variants` (off `origin/DEV`)
+
+## Problem
+
+Reviewer feedback (Shadida): some client tutorials read as "too much emphasis."
+Every `>` blockquote currently renders as a loud **Information message strip**
+(blue left border + blue fill) via the global rule in
+`hugo/assets/css/sap-fundamental.src.css:873`. AEM's old renderer used a quiet
+grey side bar with no fill, so the new output reads louder than before. There is
+also a distinct use case — an *additional note* (e.g.
+`hana-clients-install#step-2`) — that authors want to render with a different,
+author-chosen emphasis.
+
+The rendering is faithful; the design choice is simply louder than AEM and
+offers authors no way to vary it.
+
+## Decision (scope)
+
+**Keep today's blue blockquote as the default.** Plain `>` stays byte-identical
+to current output — the maintainer explicitly likes it and it must not change.
+
+**Add 4 SAP-semantic alert variants on top**, which authors opt into with
+GitHub-style alert syntax (`> [!NOTE]` etc.), so authors who want a different
+emphasis can choose one. **Color-only** (left-border + fill), **no heading row
+or icon**.
+
+### 5→4 type mapping (GitHub alert types → SAP MessageStrip states)
+
+| Author writes | SAP state | Border / fill CSS vars | Visual |
+|---|---|---|---|
+| `> [!NOTE]` | Information | `--sapInformationBorderColor` / `--sapInformationBackground` | blue (= today's default) |
+| `> [!IMPORTANT]` | Information | same as NOTE | blue |
+| `> [!TIP]` | Success | `--sapSuccessBorderColor` / `--sapSuccessBackground` | green |
+| `> [!WARNING]` | Warning | `--sapWarningBorderColor` / `--sapWarningBackground` | amber |
+| `> [!CAUTION]` | Error | `--sapErrorBorderColor` / `--sapErrorBackground` | red |
+
+Plain `>` (no designator) → unchanged blue default blockquote.
+
+## How Hugo alerts actually work (corrects the issue comment)
+
+The issue comment proposed enabling `[markup.goldmark.extensions.extras.alert]`.
+**That config key does not exist.** Hugo's `extras` extension covers
+delete/insert/mark/subscript/superscript only.
+
+GitHub-style alerts are handled by a **blockquote render hook**. Hugo recognizes
+the `> [!TYPE]` designator automatically (no `hugo.toml` change needed) and
+exposes `.AlertType` (lowercased type, or `""`/`regular` for a plain blockquote)
+to a `render-blockquote.html` template. Today the repo has **no** blockquote
+render hook, so `> [!NOTE]` falls through to Goldmark's default `<blockquote>`
+and picks up the global blue CSS. Adding the hook is what lights up the feature.
+
+Verified: Hugo v0.147.7 (extended) — alerts GA since 0.132. Render-hook docs:
+<https://gohugo.io/render-hooks/blockquotes/>.
+
+## Components
+
+### 1. Blockquote render hook — `hugo/layouts/_default/_markup/render-blockquote.html` (NEW)
+
+A blockquote render hook replaces Hugo's built-in rendering for **every** `>`
+blockquote across the whole Hugo site, so the plain path must reproduce today's
+output exactly.
+
+```go-html-template
+{{- if eq .AlertType "" -}}
+  <blockquote>{{ .Text }}</blockquote>
+{{- else -}}
+  <blockquote class="alert alert-{{ .AlertType }}">{{ .Text }}</blockquote>
+{{- end -}}
+```
+
+- **Plain `>`** (`.AlertType == ""`) → bare `<blockquote>…</blockquote>`, no
+  class. This keeps BOTH existing CSS paths matching unchanged:
+  - global blue `blockquote` rule (`sap-fundamental.src.css:873`), and
+  - the orange `.generic-page__content blockquote` inline style in
+    `hugo/layouts/_default/single.html:11` (the api-docs page).
+- **Alert** → `<blockquote class="alert alert-<type>">`. `<type>` is one of
+  `note|tip|important|warning|caution` (Hugo lowercases; unknown designators
+  resolve to `regular`/`""` and take the plain path, so no bad class leaks).
+- Idiomatic: the `_markup/` dir already holds `render-codeblock.html`,
+  `render-image.html`, `render-link.html`.
+
+### 2. CSS — `hugo/assets/css/sap-fundamental.src.css`
+
+Leave the base `blockquote` rule (line ~873) untouched. Append 4 variant classes
+that override border + fill only (color-only, no heading):
+
+```css
+/* Semantic alert callouts (#2595) — author opt-in via `> [!TYPE]`.
+   Base blockquote (blue Information) stays the default for plain `>`. */
+blockquote.alert-note,
+blockquote.alert-important {
+  border-left-color: var(--sapInformationBorderColor, #0070f2);
+  background-color: var(--sapInformationBackground, #e1f4ff);
+}
+blockquote.alert-tip {
+  border-left-color: var(--sapSuccessBorderColor, #30914c);
+  background-color: var(--sapSuccessBackground, #f1fdf6);
+}
+blockquote.alert-warning {
+  border-left-color: var(--sapWarningBorderColor, #e76500);
+  background-color: var(--sapWarningBackground, #fef7f1);
+}
+blockquote.alert-caution {
+  border-left-color: var(--sapErrorBorderColor, #e90b0b);
+  background-color: var(--sapErrorBackground, #ffeaf4);
+}
+```
+
+(Exact fallback hex values to be read from the active Horizon token set during
+implementation; the `var(--sap…)` token is authoritative, the hex is only a
+fallback.)
+
+Then `npm run build:css` regenerates `sap-fundamental.css`. The generated file is
+committed (repo commits built CSS).
+
+### 3. Authoring docs — `docs/authors/writing-tutorials.md`
+
+Add an "Alert callouts" subsection: the 5 types, the 4-state color mapping table
+above, and the explicit note that plain `>` stays blue. The doc already *uses*
+`[!NOTE]`/`[!TIP]`/`[!IMPORTANT]` in its own prose (GitHub-rendered), which the
+reader will now understand maps to real rendered variants.
+
+### 4. Migration — none in this PR
+
+Authors adopt going forward. Shadida promotes specific notes to variants in the
+`sap-tutorials` **source** repos later. No edits to generated
+`hugo/content/tutorials/`.
+
+## Data flow
+
+```text
+tutorial source markdown (sap-tutorials repos)
+  → fetch-tutorials + scripts/parsers/compose.ts
+      (blockquote-fence + blockquote-notes normalize `>` structure;
+       they do NOT emit [!TYPE] designators)
+  → hugo/content/tutorials/*.md  (contains `> [!TYPE]` if author wrote it)
+  → Hugo build + render-blockquote.html hook
+      → plain `>`  → <blockquote>            (blue default, unchanged)
+      → `> [!TIP]` → <blockquote class="alert alert-tip">  (green)
+  → sap-fundamental.css variant classes apply color
+```
+
+## Testing
+
+- **Unit (vitest):** copy the pattern in `test/parsers/render-link-hook.test.ts`
+  — assert `render-blockquote.html` exists, contains a plain-`>` passthrough
+  branch (`.AlertType ""` → bare `<blockquote>`), and the alert branch
+  (`alert alert-`). No Goldmark render harness exists in-repo, so this is the
+  established way to lock the hook's contract.
+- **CSS presence:** assert the 4 variant selectors exist in the built
+  `sap-fundamental.css` (guards against forgetting `build:css`).
+- **Manual visual:** `npm run dev`, render a fixture tutorial with all 5
+  designators + a plain `>`; confirm plain = blue (unchanged), TIP = green,
+  WARNING = amber, CAUTION = red, NOTE/IMPORTANT = blue.
+
+## Invariants / risks
+
+- **The one hard contract:** plain `>` renders identically to today. Survey
+  confirmed only 2 non-tutorial plain blockquotes exist
+  (`hugo/content/api-docs/_index.md:9,190`), both simple; they render orange via
+  `single.html`'s scoped style and MUST keep matching `.generic-page__content
+  blockquote` — the no-class plain path preserves this.
+- Raw `<blockquote>` HTML already in two tutorials
+  (`application-frontend-cli.md:180`, `application-frontend-mta.md:126`) is
+  passed through untouched by Goldmark — a markdown render hook does not touch
+  raw HTML, so unaffected.
+- No `.alert*` / `.markdown-alert` CSS class collisions (the only `.alert`-ish
+  rules are `#sb-alerts-popover`-scoped shellbar UI).
+- Purely additive: no `[!TYPE]` syntax exists in rendered content today, so
+  nothing is retroactively reinterpreted.
+
+## Out of scope
+
+- Changing the default blockquote look (explicitly rejected — keep blue).
+- A quiet grey "additional note" variant (not requested; authors can use plain
+  `>` or a semantic type).
+- Heading rows / icons (rejected — color-only).
+- Editing generated tutorial content or source-repo migration.

From e77b3c1e57c2ae49fff674d3a9d115a67e295c6c Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:47:56 -0400
Subject: [PATCH 08/46] docs(2595): implementation plan + sync spec hex to
 Horizon canonical

---
 .../2026-10-02-blockquote-alert-variants.md   | 317 ++++++++++++++++++
 ...-10-02-blockquote-alert-variants-design.md |  16 +-
 2 files changed, 327 insertions(+), 6 deletions(-)
 create mode 100644 docs/superpowers/plans/2026-10-02-blockquote-alert-variants.md

diff --git a/docs/superpowers/plans/2026-10-02-blockquote-alert-variants.md b/docs/superpowers/plans/2026-10-02-blockquote-alert-variants.md
new file mode 100644
index 000000000..cb6f7dd00
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-02-blockquote-alert-variants.md
@@ -0,0 +1,317 @@
+# Blockquote Alert Variants Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Let tutorial authors opt into 4 SAP-semantic blockquote looks via GitHub alert syntax (`> [!TYPE]`), while plain `>` keeps today's blue default unchanged.
+
+**Architecture:** Add a Hugo blockquote render hook that emits a bare `<blockquote>` for plain `>` (byte-identical to today) and `<blockquote class="alert alert-<type>">` for alerts. Add 4 color-only CSS variant classes mapped to Horizon semantic colors. Document the syntax for authors. No change to the default; no content migration.
+
+**Tech Stack:** Hugo v0.147.7 (extended) blockquote render hooks (`.AlertType`), PostCSS (`build:css`), vitest.
+
+**Spec:** `docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md`
+
+## Global Constraints
+
+- **Plain `>` must render identically to today** — bare `<blockquote>…</blockquote>`, no class, no attribute changes. This is the one hard contract (keeps the global blue rule AND `single.html`'s `.generic-page__content blockquote` orange rule both matching).
+- **Color-only** — variants set `border-left-color` + `background-color` only. No heading row, no icon, no other property.
+- **5→4 type mapping (verbatim):** `[!NOTE]`→Information(blue), `[!IMPORTANT]`→Information(blue), `[!TIP]`→Success(green), `[!WARNING]`→Warning(amber), `[!CAUTION]`→Error(red).
+- **CSS values** — reference the SAP token with the canonical Horizon-light hex as fallback (several semantic tokens are NOT declared in this project's theme-vars, so the fallback is load-bearing). Verified Horizon-light hex:
+  - Information: border `#0070f2`, bg `#e1f4ff`
+  - Success: border `#30914c`, bg `#f5fae5`
+  - Warning: border `#dd6100`, bg `#fff8d6`
+  - Error: border `#e90b0b`, bg `#ffeaf4`
+- **No test harness renders Goldmark** — hook tests string-assert the `.html` file contents (pattern: `test/parsers/render-link-hook.test.ts`).
+- Edit `sap-fundamental.src.css`, then regenerate `sap-fundamental.css` via `npm run build:css`; commit both (repo commits built CSS).
+- Never edit generated `hugo/content/tutorials/`.
+
+---
+
+### Task 1: Blockquote render hook
+
+**Files:**
+- Create: `hugo/layouts/_default/_markup/render-blockquote.html`
+- Test: `test/parsers/render-blockquote-hook.test.ts`
+
+**Interfaces:**
+- Consumes: Hugo blockquote render-hook context — `.AlertType` (string: `""` for plain `>`, else `note|tip|important|warning|caution`), `.Text` (rendered inner HTML, `template.HTML`).
+- Produces: hook file at the fixed path above. No code symbols consumed by later tasks; Task 2 (CSS) depends only on the class names `alert-note`, `alert-tip`, `alert-important`, `alert-warning`, `alert-caution` emitted here.
+
+- [ ] **Step 1: Write the failing test**
+
+```ts
+// test/parsers/render-blockquote-hook.test.ts
+import { describe, it, expect } from 'vitest'
+import { readFileSync, existsSync } from 'node:fs'
+
+const p = 'hugo/layouts/_default/_markup/render-blockquote.html'
+
+describe('render-blockquote hook', () => {
+  it('exists', () => {
+    expect(existsSync(p)).toBe(true)
+  })
+
+  it('has a plain-`>` passthrough branch (no class) preserving today’s default', () => {
+    const t = readFileSync(p, 'utf8')
+    // branches on an empty AlertType (plain blockquote)
+    expect(t).toContain('.AlertType')
+    expect(t).toMatch(/eq \.AlertType ""/)
+    // plain path emits a bare blockquote with NO class attribute
+    expect(t).toMatch(/<blockquote>\s*\{\{[-\s]*\.Text/)
+  })
+
+  it('emits a semantic alert class for alert blockquotes', () => {
+    const t = readFileSync(p, 'utf8')
+    expect(t).toContain('class="alert alert-{{ .AlertType }}"')
+  })
+})
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/parsers/render-blockquote-hook.test.ts`
+Expected: FAIL — `exists` fails (file not created yet).
+
+- [ ] **Step 3: Write the hook**
+
+```go-html-template
+{{- /* Blockquote render hook (#2595).
+     Plain `>` (AlertType == "") renders byte-identical to Hugo's default so the
+     global blue blockquote style and single.html's scoped style both keep
+     matching. GitHub-style alerts (`> [!TYPE]`) get a semantic class; CSS in
+     sap-fundamental.src.css maps each to a SAP MessageStrip color (color-only).
+     Unknown designators resolve to AlertType "" and take the plain path. */ -}}
+{{- if eq .AlertType "" -}}
+<blockquote>{{ .Text }}</blockquote>
+{{- else -}}
+<blockquote class="alert alert-{{ .AlertType }}">{{ .Text }}</blockquote>
+{{- end -}}
+```
+
+- [ ] **Step 4: Run test to verify it passes**
+
+Run: `npx vitest run test/parsers/render-blockquote-hook.test.ts`
+Expected: PASS (3 passing).
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add hugo/layouts/_default/_markup/render-blockquote.html test/parsers/render-blockquote-hook.test.ts
+git commit -m "feat(2595): blockquote render hook with semantic alert classes"
+```
+
+---
+
+### Task 2: Semantic variant CSS
+
+**Files:**
+- Modify: `hugo/assets/css/sap-fundamental.src.css` (append after the base `blockquote` rule at ~line 873)
+- Regenerate: `hugo/assets/css/sap-fundamental.css` (via `npm run build:css`)
+- Test: `test/parsers/blockquote-alert-css.test.ts`
+
+**Interfaces:**
+- Consumes: class names `alert-note`, `alert-important`, `alert-tip`, `alert-warning`, `alert-caution` emitted by Task 1's hook.
+- Produces: 4 CSS rule-sets in both `.src.css` and the built `.css`. No code symbols.
+
+- [ ] **Step 1: Write the failing test**
+
+```ts
+// test/parsers/blockquote-alert-css.test.ts
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+
+const src = 'hugo/assets/css/sap-fundamental.src.css'
+const built = 'hugo/assets/css/sap-fundamental.css'
+
+describe('blockquote alert variant CSS', () => {
+  it('source defines all four variant selectors', () => {
+    const t = readFileSync(src, 'utf8')
+    expect(t).toContain('blockquote.alert-note')
+    expect(t).toContain('blockquote.alert-important')
+    expect(t).toContain('blockquote.alert-tip')
+    expect(t).toContain('blockquote.alert-warning')
+    expect(t).toContain('blockquote.alert-caution')
+  })
+
+  it('tip maps to Horizon success green, caution to error red, warning to amber', () => {
+    const t = readFileSync(src, 'utf8')
+    expect(t).toContain('#30914c') // success border
+    expect(t).toContain('#f5fae5') // success bg
+    expect(t).toContain('#dd6100') // warning border
+    expect(t).toContain('#fff8d6') // warning bg
+    expect(t).toContain('#e90b0b') // error border
+    expect(t).toContain('#ffeaf4') // error bg
+  })
+
+  it('built css was regenerated with the variant selectors', () => {
+    const t = readFileSync(built, 'utf8')
+    expect(t).toContain('.alert-tip')
+    expect(t).toContain('.alert-warning')
+    expect(t).toContain('.alert-caution')
+  })
+
+  it('does not alter the base blockquote default (blue Information still present)', () => {
+    const t = readFileSync(src, 'utf8')
+    expect(t).toContain('--sapInformationBackground')
+  })
+})
+```
+
+- [ ] **Step 2: Run test to verify it fails**
+
+Run: `npx vitest run test/parsers/blockquote-alert-css.test.ts`
+Expected: FAIL — variant selectors not present in `.src.css`.
+
+- [ ] **Step 3: Append the variant CSS to `sap-fundamental.src.css`**
+
+Insert immediately after the closing `}` of the base `blockquote { … }` rule (around line 880):
+
+```css
+/* Semantic alert callouts (#2595) — author opt-in via `> [!TYPE]`.
+   Base `blockquote` (blue Information) remains the default for plain `>`.
+   Color-only: override border + fill, nothing else. Horizon-light hex are
+   fallbacks because several --sap*Background/BorderColor tokens are not
+   declared in this project's theme-vars. */
+blockquote.alert-note,
+blockquote.alert-important {
+  border-left-color: var(--sapInformationBorderColor, #0070f2);
+  background-color: var(--sapInformationBackground, #e1f4ff);
+}
+blockquote.alert-tip {
+  border-left-color: var(--sapSuccessBorderColor, #30914c);
+  background-color: var(--sapSuccessBackground, #f5fae5);
+}
+blockquote.alert-warning {
+  border-left-color: var(--sapWarningBorderColor, #dd6100);
+  background-color: var(--sapWarningBackground, #fff8d6);
+}
+blockquote.alert-caution {
+  border-left-color: var(--sapErrorBorderColor, #e90b0b);
+  background-color: var(--sapErrorBackground, #ffeaf4);
+}
+```
+
+- [ ] **Step 4: Regenerate the built CSS**
+
+Run: `npm run build:css`
+Expected: exit 0; `hugo/assets/css/sap-fundamental.css` now contains the `.alert-*` selectors.
+
+- [ ] **Step 5: Run test to verify it passes**
+
+Run: `npx vitest run test/parsers/blockquote-alert-css.test.ts`
+Expected: PASS (4 passing).
+
+- [ ] **Step 6: Commit**
+
+```bash
+git add hugo/assets/css/sap-fundamental.src.css hugo/assets/css/sap-fundamental.css test/parsers/blockquote-alert-css.test.ts
+git commit -m "feat(2595): color-only CSS for blockquote alert variants"
+```
+
+---
+
+### Task 3: Author documentation
+
+**Files:**
+- Modify: `docs/authors/writing-tutorials.md` (add an "Alert callouts" subsection)
+
+**Interfaces:**
+- Consumes: nothing (docs only).
+- Produces: nothing consumed by later tasks.
+
+- [ ] **Step 1: Add the "Alert callouts" subsection**
+
+Add after section 3.3 (Steps) — before the code-block section (~line 285). Content:
+
+````markdown
+### Alert callouts
+
+A plain blockquote (`>`) renders as the default blue **Information** callout.
+To signal a different kind of emphasis, start the blockquote with a
+GitHub-style alert designator on its own first line:
+
+```markdown
+> [!TIP]
+> Prefer the frontmatter `video:` field over an inline iframe.
+```
+
+| You write | Rendered emphasis | Color |
+|---|---|---|
+| `> text` (no designator) | Information (default) | blue |
+| `> [!NOTE]` | Information | blue |
+| `> [!IMPORTANT]` | Information | blue |
+| `> [!TIP]` | Success | green |
+| `> [!WARNING]` | Warning | amber |
+| `> [!CAUTION]` | Error | red |
+
+Pick the designator by *intent*, not loudness: use `[!TIP]` for helpful
+asides, `[!WARNING]`/`[!CAUTION]` only for genuine risk. An ordinary
+"additional note" can stay a plain `>` (blue) or use `[!NOTE]`. The callout is
+color-only — there is no icon or heading label.
+````
+
+- [ ] **Step 2: Verify the doc renders (manual, no test)**
+
+Confirm the table and fenced example are well-formed markdown (GitHub preview or `npx markdownlint docs/authors/writing-tutorials.md` if available — do not fail the task on pre-existing lint in untouched lines).
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add docs/authors/writing-tutorials.md
+git commit -m "docs(2595): document blockquote alert callout syntax for authors"
+```
+
+---
+
+### Task 4: Visual verification + full-suite check
+
+**Files:** none (verification task).
+
+**Interfaces:** none.
+
+- [ ] **Step 1: Create a throwaway fixture tutorial**
+
+Create `hugo/content/tutorials/_alert-smoke.md` (leading underscore → Hugo treats as draft/non-list; delete before commit) with frontmatter copied from any existing tutorial plus a body containing a plain `>`, and one of each `[!NOTE]`, `[!TIP]`, `[!IMPORTANT]`, `[!WARNING]`, `[!CAUTION]`.
+
+- [ ] **Step 2: Run the dev server and eyeball**
+
+Run: `npm run dev`
+Expected in browser at the fixture URL:
+- plain `>` = blue (identical to before this change)
+- `[!NOTE]`, `[!IMPORTANT]` = blue
+- `[!TIP]` = green
+- `[!WARNING]` = amber
+- `[!CAUTION]` = red
+
+- [ ] **Step 3: Delete the fixture**
+
+```bash
+rm hugo/content/tutorials/_alert-smoke.md
+```
+
+- [ ] **Step 4: Run the full relevant test subset**
+
+Run: `npx vitest run test/parsers/`
+Expected: PASS, including the two new test files and no regression in existing parser tests.
+
+- [ ] **Step 5: Confirm nothing staged from the fixture**
+
+Run: `git status --porcelain`
+Expected: no `_alert-smoke.md`; only committed work from Tasks 1–3 present.
+
+---
+
+## Self-Review
+
+**1. Spec coverage:**
+- Render hook (spec §Components.1) → Task 1 ✓
+- 4 variant CSS + 5→4 mapping (spec §Components.2, §Decision) → Task 2 ✓
+- Author docs (spec §Components.3) → Task 3 ✓
+- No migration (spec §Components.4) → honored (no content edits) ✓
+- Plain-`>` invariant (spec §Invariants) → Task 1 Step 1 test + Task 4 Step 2 visual ✓
+- Testing approach (spec §Testing) → Tasks 1,2 string-assert hooks/CSS; Task 4 visual ✓
+
+**2. Placeholder scan:** No TBD/TODO; all code blocks concrete; hex values resolved from authoritative Horizon source. ✓
+
+**3. Type consistency:** Class names `alert-note/important/tip/warning/caution` identical across Task 1 (emitter) and Task 2 (CSS). Hex values in Task 2 CSS match the test assertions in Task 2 Step 1 and the Global Constraints table. ✓
+
+**Correction logged vs. spec:** spec's draft fallback hex for success-bg/warning were approximate; this plan uses the verified Horizon-light values (`#f5fae5`, `#dd6100`/`#fff8d6`). The spec will be updated to match.
diff --git a/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md b/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md
index 5ac3ad3aa..28fa0acc5 100644
--- a/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md
+++ b/docs/superpowers/specs/2026-10-02-blockquote-alert-variants-design.md
@@ -99,11 +99,11 @@ blockquote.alert-important {
 }
 blockquote.alert-tip {
   border-left-color: var(--sapSuccessBorderColor, #30914c);
-  background-color: var(--sapSuccessBackground, #f1fdf6);
+  background-color: var(--sapSuccessBackground, #f5fae5);
 }
 blockquote.alert-warning {
-  border-left-color: var(--sapWarningBorderColor, #e76500);
-  background-color: var(--sapWarningBackground, #fef7f1);
+  border-left-color: var(--sapWarningBorderColor, #dd6100);
+  background-color: var(--sapWarningBackground, #fff8d6);
 }
 blockquote.alert-caution {
   border-left-color: var(--sapErrorBorderColor, #e90b0b);
@@ -111,9 +111,13 @@ blockquote.alert-caution {
 }
 ```
 
-(Exact fallback hex values to be read from the active Horizon token set during
-implementation; the `var(--sap…)` token is authoritative, the hex is only a
-fallback.)
+Fallback hex are the **canonical SAP Horizon-light values** (verified against
+`SAP/theming-base-content` `sap_horizon/css_variables.css`). The fallback is
+load-bearing: this project's theme-vars declare only `--sapInformation*` and
+`--sapPositive*`/`--sapNegativeColor` — `--sapSuccess*`, `--sapWarning*`, and
+`--sapError*` are NOT declared here, so `var()` resolves to the fallback. (Using
+the `--sapSuccess/Warning/Error*` names keeps us forward-compatible if the theme
+later adds them.)
 
 Then `npm run build:css` regenerates `sap-fundamental.css`. The generated file is
 committed (repo commits built CSS).

From 95fb71f542bc5abe21f25a9d2fb8ed7fbdc93663 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:55:03 -0400
Subject: [PATCH 09/46] docs(auth): implementation plan for IAS social login
 (#2506)

---
 .../plans/2026-10-02-ias-social-login.md      | 393 ++++++++++++++++++
 1 file changed, 393 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-10-02-ias-social-login.md

diff --git a/docs/superpowers/plans/2026-10-02-ias-social-login.md b/docs/superpowers/plans/2026-10-02-ias-social-login.md
new file mode 100644
index 000000000..868e0d31f
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-02-ias-social-login.md
@@ -0,0 +1,393 @@
+# IAS Social Login Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Add a themed two-button sign-in page that lets a developer log in via SAP ID Service *or* SAP Universal ID (IAS, with social providers) without ever seeing XSUAA's IdP chooser, while the existing default login keeps working unchanged.
+
+**Architecture:** The subaccount already trusts two OIDC IdPs (`sap.default` = SAP ID Service, `sap.custom` = IAS tenant `atxgsg7zi` with social enabled) and XSUAA re-issues its own token for both, so the main srv/approuter bindings and the `(iss,sub)` identity-merge layer (#2552, in PROD) need **no change**. The only work: (1) enable the approuter `dynamicIdentityProvider` gate so the `sap_idp` query param is honored, and (2) add a Hugo-sourced `/signin` page whose two buttons link to `/login?sap_idp=sap.default` and `/login?sap_idp=sap.custom`, pinning the IdP so XSUAA jumps straight through.
+
+**Tech Stack:** `@sap/approuter` v16.9.0 (xs-app.json routes, `sap_idp` / `dynamicIdentityProvider`), Hugo static layouts (Fundamental Styles / Horizon theme), SAP BTP XSUAA + IAS trust.
+
+**Spec:** `docs/superpowers/specs/2026-10-02-ias-social-login-design.md`
+
+## Global Constraints
+
+- `sap_idp` is honored ONLY when `dynamicIdentityProvider` is true for the route (or globally); otherwise silently ignored (`@sap/approuter` `path-rewriter.js:136`). Decision: **per-route** on the `/login` route only.
+- IdP origin keys are the LIVE values: `sap.default` (SAP ID Service), `sap.custom` (IAS `atxgsg7zi`). The origin key `sap.custom` is stable across any IAS tenant swap unless the trust is re-created.
+- The sign-in page is authored as a **Hugo layout** under `hugo/layouts/`; `approuter/static/*.html` are BUILD ARTIFACTS (`mta.yaml:98` `cp -r hugo/public/. approuter/static/`) — never hand-edit them.
+- Button copy: default = "Sign in with SAP"; IAS = "Sign in with SAP Universal ID". Do NOT name a social provider ("Sign in with Google") — social buttons live inside IAS.
+- Theming is inherited free from `hugo/layouts/_default/baseof.html` + `partials/head.html` (CSS link chain, light/dark via localStorage `theme` key + pre-paint script). Use `fd-*` classes + `var(--sap*)` tokens for page-specific style.
+- Switching IdPs requires logout first (`@sap/approuter` README:932) — the signed-in account menu must route IdP-switch through `/logout`.
+- Admin/approuter static changes need a FULL deploy (no `--skip-build`, no `-m` scoping); Step 3.5 bundle check applies. Deploy from fresh `origin/DEV`; `cf target` before any push; PRs target DEV.
+- No raw SQL, no `@sap/` non-public deps, no credential literals (not expected to arise here, but the repo rules stand).
+
+---
+
+## File Structure
+
+- `hugo/layouts/signin.html` (**create**) — the themed two-button sign-in page body (`{{ define "main" }}` block), cloned from `hugo/layouts/403.html`. Produces `hugo/public/signin/index.html` → copied into `approuter/static/signin/index.html` at build.
+- `hugo/content/signin.md` (**create**) — the content stub that makes Hugo render `signin.html` at `/signin/` (front matter sets `layout: signin`, excludes from nav/sitemap).
+- `approuter/xs-app.json` (**modify**) — add a public `/signin` route serving the built page; add `"dynamicIdentityProvider": true` to the existing `/login` route (`:116-121`).
+- `docs/developers/architecture/authentication.md` (**modify**) — document the two-button sign-in + `sap_idp` pinning (currently describes XSUAA-only).
+- `test/e2e/signin.spec.ts` (**create**) — post-deploy Playwright smoke: `/signin` renders both buttons with the correct `sap_idp` hrefs; self-skips without `SMOKE_BASE_URL`.
+
+No backend/CAP/db changes. No MTA resource changes.
+
+---
+
+### Task 1: Enable `dynamicIdentityProvider` on the `/login` route
+
+**Files:**
+- Modify: `approuter/xs-app.json:116-121`
+
+**Interfaces:**
+- Consumes: nothing.
+- Produces: the `/login` route now honors `?sap_idp=<originKey>` → emits XSUAA `login_hint={"origin":"<originKey>"}`. Tasks 2–3 link to `/login?sap_idp=...`.
+
+- [ ] **Step 1: Add the gate flag to the `/login` route**
+
+In `approuter/xs-app.json`, change the `/login` route block (currently):
+```json
+{
+  "source": "^/login(\\?.*)?$",
+  "authenticationType": "xsuaa",
+  "target": "/login-redirect.html",
+  "localDir": "static"
+}
+```
+to:
+```json
+{
+  "source": "^/login(\\?.*)?$",
+  "authenticationType": "xsuaa",
+  "dynamicIdentityProvider": true,
+  "target": "/login-redirect.html",
+  "localDir": "static"
+}
+```
+
+- [ ] **Step 2: Validate the JSON parses**
+
+Run: `node -e "JSON.parse(require('fs').readFileSync('approuter/xs-app.json','utf8')); console.log('ok')"`
+Expected: prints `ok` (no parse error).
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add approuter/xs-app.json
+git commit -m "feat(auth): honor sap_idp on /login route via dynamicIdentityProvider (#2506)"
+```
+
+---
+
+### Task 2: Create the Hugo sign-in layout (two themed buttons)
+
+**Files:**
+- Create: `hugo/layouts/signin.html`
+- Reference: `hugo/layouts/403.html` (clone source)
+
+**Interfaces:**
+- Consumes: Task 1's `sap_idp`-aware `/login` route.
+- Produces: a `main` block rendering two anchors — primary `href="/login?sap_idp=sap.default"`, secondary `href="/login?sap_idp=sap.custom"`. Task 3 wires the content stub that selects this layout; Task 5 asserts these hrefs.
+
+- [ ] **Step 1: Write the layout**
+
+Create `hugo/layouts/signin.html`:
+```html
+{{ define "main" }}
+<section class="signin-hero" aria-labelledby="signin-title">
+  <div class="signin-inner">
+    <ui5-illustrated-message name="tnt/Login" design="Spot" class="signin-illus">
+      <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developers</h1>
+      <p slot="subtitle" class="signin-lede">
+        Choose how you'd like to sign in. Your progress and completions are the
+        same account whichever you pick.
+      </p>
+    </ui5-illustrated-message>
+    <div class="signin-actions">
+      <a class="fd-button fd-button--emphasized signin-btn" href="/login?sap_idp=sap.default">
+        Sign in with SAP
+      </a>
+      <a class="fd-button fd-button--transparent signin-btn" href="/login?sap_idp=sap.custom">
+        Sign in with SAP Universal ID
+      </a>
+    </div>
+  </div>
+</section>
+
+<style>
+  .signin-hero {
+    padding: 4rem 1.5rem;
+    background: var(--sapBackgroundColor, #f5f6f7);
+    min-height: 60vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+  }
+  .signin-inner {
+    max-width: 640px;
+    text-align: center;
+    background: var(--sapTile_Background, #ffffff);
+    padding: 3rem 2rem;
+    border-radius: 0.75rem;
+    box-shadow: 0 0.125rem 0.5rem rgba(0, 0, 0, 0.08);
+  }
+  .signin-illus { display: block; margin: 0 auto 1.25rem; max-width: 100%; }
+  .signin-title { font-size: 1.625rem; margin: 0 0 0.5rem; color: var(--sapTextColor, #32363a); }
+  .signin-lede {
+    font-size: 1rem;
+    color: var(--sapContent_LabelColor, var(--sapTextColor, #32363a));
+    margin: 0 0 1.5rem;
+  }
+  .signin-actions {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+    align-items: center;
+  }
+  .signin-btn { min-width: 16rem; justify-content: center; }
+</style>
+{{- /* ui5Split: illustration assets for <ui5-illustrated-message>, mirrors 403.html (#1777 Task 7) */}}
+{{ if and (not site.Params.previewMode) site.Params.ui5Split }}<script type="module" src="{{ partial "island-src.html" "ui5-illustrations" }}"></script>{{ end }}
+{{ end }}
+```
+
+Note: `tnt/Login` is the login illustration name; if the project's ui5-illustrations bundle doesn't register it, fall back to `tnt/Unlock` or `tnt/Success`. Verify the bundle in Step 2.
+
+- [ ] **Step 2: Verify the illustration name is available**
+
+Run: `grep -rn "tnt/Login\|tnt/Unlock\|tnt/Success\|tnt/Lock" hugo/ --include=*.html --include=*.js | head`
+Expected: at least one existing reference to a `tnt/*` illustration (confirms the bundle pattern). If `tnt/Login` isn't referenced anywhere and the ui5-illustrations loader uses an explicit allowlist, switch the `name=` to one that is already used (e.g. `tnt/Lock` as in 403.html). Edit the layout accordingly.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add hugo/layouts/signin.html
+git commit -m "feat(auth): themed two-button sign-in Hugo layout (#2506)"
+```
+
+---
+
+### Task 3: Add the content stub so Hugo renders `/signin/`
+
+**Files:**
+- Create: `hugo/content/signin.md`
+- Reference: an existing standalone content page's front matter (e.g. look for a `hugo/content/*.md` that sets a custom `layout` and excludes nav)
+
+**Interfaces:**
+- Consumes: Task 2's `signin.html` layout.
+- Produces: a page served at `/signin/` using the `signin` layout, excluded from nav/sitemap/search. Task 4 routes the approuter to it; Task 5 fetches it.
+
+- [ ] **Step 1: Find the project's convention for a layout-pinned, nav-excluded page**
+
+Run: `grep -rln "^layout:" hugo/content | head; echo '---'; grep -rln "sitemap:\|_build:\|robots" hugo/content | head`
+Expected: shows how existing pages pin a layout and opt out of listing. Mirror whichever convention exists (front-matter `layout:`, `_build:` exclusions, `sitemap: { disable: true }`, or a `headless`/`robots` param). If no example exists, use the Hugo-standard `_build` block below.
+
+- [ ] **Step 2: Write the content stub**
+
+Create `hugo/content/signin.md` (adjust keys to match the convention found in Step 1):
+```markdown
+---
+title: "Sign in"
+layout: signin
+_build:
+  list: never
+sitemap:
+  disable: true
+robots: "noindex, nofollow"
+---
+```
+
+- [ ] **Step 3: Build Hugo and confirm the page renders**
+
+Run (from repo root; fetch cache must exist — if not, `npm run fetch-tutorials` first):
+`npm run build:hugo && test -f hugo/public/signin/index.html && echo RENDERED`
+Expected: prints `RENDERED`. (Wrap in `scripts/quiet-run.sh` if the Hugo output is noisy.)
+
+- [ ] **Step 4: Confirm both pinned hrefs are present in the built HTML**
+
+Run: `grep -o 'sap_idp=sap\.[a-z]*' hugo/public/signin/index.html | sort -u`
+Expected: two lines — `sap_idp=sap.custom` and `sap_idp=sap.default`.
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add hugo/content/signin.md
+git commit -m "feat(auth): render /signin page from signin layout (#2506)"
+```
+
+---
+
+### Task 4: Serve `/signin` from the approuter (public route)
+
+**Files:**
+- Modify: `approuter/xs-app.json` (routes array — add BEFORE the catch-all / static fallthrough so it is matched)
+
+**Interfaces:**
+- Consumes: Task 3's built `approuter/static/signin/index.html` (present after the `mta.yaml:98` copy).
+- Produces: `GET /signin` serves the themed page unauthenticated (so a logged-out user can reach it without triggering a chooser). The two buttons then drive the authenticated `/login?sap_idp=...` flow.
+
+- [ ] **Step 1: Add the public `/signin` route**
+
+In `approuter/xs-app.json`, add this route to the `routes` array (place it near the other static/public page routes, before any broad catch-all):
+```json
+{
+  "source": "^/signin/?(\\?.*)?$",
+  "authenticationType": "none",
+  "target": "/signin/index.html",
+  "localDir": "static"
+}
+```
+
+- [ ] **Step 2: Validate JSON + route ordering**
+
+Run: `node -e "const c=JSON.parse(require('fs').readFileSync('approuter/xs-app.json','utf8')); const i=c.routes.findIndex(r=>r.source.includes('signin')); console.log('signin route index',i,'of',c.routes.length); process.exit(i<0?1:0)"`
+Expected: prints a non-negative index. Confirm by eye it precedes any `"^/(.*)$"`-style catch-all.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add approuter/xs-app.json
+git commit -m "feat(auth): serve public /signin page from approuter (#2506)"
+```
+
+---
+
+### Task 5: Post-deploy e2e smoke for the sign-in page
+
+**Files:**
+- Create: `test/e2e/signin.spec.ts`
+- Reference: `test/e2e/README.md` and an existing `test/e2e/*.spec.ts` for the self-skip + base-URL pattern
+
+**Interfaces:**
+- Consumes: the deployed `/signin` page (needs `SMOKE_BASE_URL`).
+- Produces: a self-skipping Playwright spec asserting both buttons + hrefs render.
+
+- [ ] **Step 1: Read the existing e2e self-skip pattern**
+
+Run: `grep -rn "SMOKE_BASE_URL\|test.skip\|baseURL" test/e2e | head`
+Expected: shows how specs read `SMOKE_BASE_URL` and self-skip when absent. Mirror it exactly in Step 2.
+
+- [ ] **Step 2: Write the spec (mirroring the pattern from Step 1)**
+
+Create `test/e2e/signin.spec.ts` (adapt imports/skip to match Step 1's convention):
+```ts
+import { test, expect } from '@playwright/test';
+
+const BASE = process.env.SMOKE_BASE_URL;
+
+test.describe('sign-in page (#2506)', () => {
+  test.skip(!BASE, 'SMOKE_BASE_URL not set — post-deploy only');
+
+  test('renders both IdP-pinned sign-in buttons', async ({ page }) => {
+    await page.goto(`${BASE}/signin`);
+    const sapBtn = page.getByRole('link', { name: 'Sign in with SAP', exact: true });
+    const uidBtn = page.getByRole('link', { name: 'Sign in with SAP Universal ID' });
+    await expect(sapBtn).toBeVisible();
+    await expect(uidBtn).toBeVisible();
+    await expect(sapBtn).toHaveAttribute('href', '/login?sap_idp=sap.default');
+    await expect(uidBtn).toHaveAttribute('href', '/login?sap_idp=sap.custom');
+  });
+});
+```
+
+- [ ] **Step 3: Verify it self-skips locally (no SMOKE_BASE_URL)**
+
+Run: `npx playwright test test/e2e/signin.spec.ts` (or the repo's `npm run test:e2e` script)
+Expected: the test is SKIPPED (not failed) because `SMOKE_BASE_URL` is unset.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add test/e2e/signin.spec.ts
+git commit -m "test(auth): post-deploy e2e smoke for /signin page (#2506)"
+```
+
+---
+
+### Task 6: Document the sign-in flow
+
+**Files:**
+- Modify: `docs/developers/architecture/authentication.md`
+
+**Interfaces:**
+- Consumes: the final behavior from Tasks 1–4.
+- Produces: documentation only.
+
+- [ ] **Step 1: Add a "Two-button sign-in + IdP pinning" section**
+
+Append to `docs/developers/architecture/authentication.md` a section covering:
+- `/signin` is a public themed page; buttons link to `/login?sap_idp=sap.default` (SAP ID Service) and `/login?sap_idp=sap.custom` (IAS `atxgsg7zi`, social providers).
+- `sap_idp` → approuter `login_hint={"origin":...}` → XSUAA jumps straight to that IdP; `dynamicIdentityProvider:true` on `/login` is the gate.
+- Both IdPs federate through XSUAA, which re-issues its own token; the `(iss,sub)` resolver (#2552) merges to one `user_uuid` by email.
+- Caveat: switching IdPs requires `/logout` first.
+- Known boundary: a social login whose SAP-ID row has NULL email gets a separate row until explicit account-merge (#2552 limit).
+
+- [ ] **Step 2: Commit**
+
+```bash
+git add docs/developers/architecture/authentication.md
+git commit -m "docs(auth): document two-button sign-in and sap_idp pinning (#2506)"
+```
+
+---
+
+### Task 7: DEV deploy + live verification
+
+**Files:** none (deploy + manual/automated verification).
+
+**Interfaces:**
+- Consumes: all prior tasks on the branch, merged to DEV.
+- Produces: a verified working `/signin` on DEV.
+
+- [ ] **Step 1: Confirm clean tree + correct branch, open PR to DEV**
+
+```bash
+git status --porcelain   # expect empty
+gh pr create --base DEV --fill
+```
+
+- [ ] **Step 2: After merge, deploy DEV from fresh origin/DEV (full build)**
+
+Follow CLAUDE.md canonical deploy (set `CAP_BASE_URL` to the deployed DEV srv, `npm run build:all` before `mbt build`, FULL deploy — no `--skip-build`, no `-m`). Wrap noisy commands in `scripts/quiet-run.sh`. Confirm `cf target` is DEV first.
+
+- [ ] **Step 3: Verify the chooser is suppressed for each button**
+
+In a logged-out browser:
+- Visit `/signin` → confirm themed page, both buttons, light/dark follows the site toggle.
+- Click **Sign in with SAP** → lands DIRECTLY on SAP ID Service (no "default vs custom" screen).
+- Log out. Click **Sign in with SAP Universal ID** → lands DIRECTLY on the IAS page showing social providers (no chooser).
+- Confirm the authorize URL carries `login_hint={"origin":"sap.default"}` resp. `"sap.custom"` (DevTools network, the redirect to XSUAA). If the chooser still appears, `dynamicIdentityProvider` is not being honored — recheck Task 1.
+
+- [ ] **Step 4: Verify identity continuity**
+
+Log in via SAP ID (note your progress), log out, log in via SAP Universal ID with the same email → confirm the SAME account/progress (same `user_uuid`). If a separate account appears, confirm whether the SAP-ID row had a populated email (known #2552 boundary) before treating it as a defect.
+
+- [ ] **Step 5: Verify default-path regression**
+
+Confirm normal navigation and already-authenticated sessions are unaffected (existing deep links still work; no one is bounced to `/signin` unexpectedly).
+
+---
+
+## Self-Review
+
+**Spec coverage:**
+- Enable `dynamicIdentityProvider` → Task 1. ✓
+- Two-button themed page (Hugo-sourced, cloned from 403, light/dark, logo) → Tasks 2–3. ✓
+- `sap_idp` pinning per button → Tasks 2 (hrefs) + 1 (gate). ✓
+- Public `/signin` served by approuter → Task 4. ✓
+- Identity continuity (no change, verify only) → Task 7 Step 4. ✓
+- IdP-switch-via-logout caveat → documented Task 6; buttons rely on `/login` which handles fresh login. (Signed-in account-menu "switch IdP via logout" wiring is a UI nicety — see Deferred.)
+- Styling recipe → Tasks 2–3. ✓
+- Testing (both buttons, regression, role auth) → Tasks 5 + 7. ✓
+
+**Placeholder scan:** No TBD/TODO; every code step has concrete content; illustration-name and front-matter-convention uncertainties are handled with explicit verify-and-adjust steps rather than left vague.
+
+**Type consistency:** Origin keys `sap.default`/`sap.custom`, hrefs `/login?sap_idp=...`, and button labels are identical across Tasks 1, 2, 5, 6. ✓
+
+## Deferred (not this plan)
+
+- **Force ALL unauthenticated entry to `/signin`** (global redirect so the raw XSUAA chooser is unreachable by any path). The current plan makes `/signin` the sign-in CTA; a global redirect rewrite touches the default path broadly and is a separate hardening step once the page is proven on DEV.
+- **Signed-in "switch IdP" account-menu item** routing through `/logout?returnTo=/signin` — UI nicety, additive later.
+- **IAS login-page branding / custom domain** — separate follow-up per #2506.
+- **Cross-provider explicit account-merge UX** (same human, SAP then social, when email was absent) — #2552 deferred item.

From 88108ac8f754fc0962ccb01d4220f5ded2645e7f Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 13:58:19 -0400
Subject: [PATCH 10/46] feat(2595): blockquote render hook with semantic alert
 classes

---
 .../_default/_markup/render-blockquote.html   | 11 ++++++++++
 test/parsers/render-blockquote-hook.test.ts   | 22 +++++++++++++++++++
 2 files changed, 33 insertions(+)
 create mode 100644 hugo/layouts/_default/_markup/render-blockquote.html
 create mode 100644 test/parsers/render-blockquote-hook.test.ts

diff --git a/hugo/layouts/_default/_markup/render-blockquote.html b/hugo/layouts/_default/_markup/render-blockquote.html
new file mode 100644
index 000000000..72e367786
--- /dev/null
+++ b/hugo/layouts/_default/_markup/render-blockquote.html
@@ -0,0 +1,11 @@
+{{- /* Blockquote render hook (#2595).
+     Plain `>` (AlertType == "") renders byte-identical to Hugo's default so the
+     global blue blockquote style and single.html's scoped style both keep
+     matching. GitHub-style alerts (`> [!TYPE]`) get a semantic class; CSS in
+     sap-fundamental.src.css maps each to a SAP MessageStrip color (color-only).
+     Unknown designators resolve to AlertType "" and take the plain path. */ -}}
+{{- if eq .AlertType "" -}}
+<blockquote>{{ .Text }}</blockquote>
+{{- else -}}
+<blockquote class="alert alert-{{ .AlertType }}">{{ .Text }}</blockquote>
+{{- end -}}
diff --git a/test/parsers/render-blockquote-hook.test.ts b/test/parsers/render-blockquote-hook.test.ts
new file mode 100644
index 000000000..8790d6465
--- /dev/null
+++ b/test/parsers/render-blockquote-hook.test.ts
@@ -0,0 +1,22 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync, existsSync } from 'node:fs'
+
+const p = 'hugo/layouts/_default/_markup/render-blockquote.html'
+
+describe('render-blockquote hook', () => {
+  it('exists', () => {
+    expect(existsSync(p)).toBe(true)
+  })
+
+  it('has a plain-`>` passthrough branch (no class) preserving today\'s default', () => {
+    const t = readFileSync(p, 'utf8')
+    expect(t).toContain('.AlertType')
+    expect(t).toMatch(/eq \.AlertType ""/)
+    expect(t).toMatch(/<blockquote>\s*\{\{[-\s]*\.Text/)
+  })
+
+  it('emits a semantic alert class for alert blockquotes', () => {
+    const t = readFileSync(p, 'utf8')
+    expect(t).toContain('class="alert alert-{{ .AlertType }}"')
+  })
+})

From 83a0c257b197365cba36d50d837cce65a98f039d Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:05:54 -0400
Subject: [PATCH 11/46] feat(2595): color-only CSS for blockquote alert
 variants

---
 hugo/assets/css/sap-fundamental.css       | 23 ++++++++++++++
 hugo/assets/css/sap-fundamental.src.css   | 23 ++++++++++++++
 test/parsers/blockquote-alert-css.test.ts | 38 +++++++++++++++++++++++
 3 files changed, 84 insertions(+)
 create mode 100644 test/parsers/blockquote-alert-css.test.ts

diff --git a/hugo/assets/css/sap-fundamental.css b/hugo/assets/css/sap-fundamental.css
index 1373bc1d0..809bfcfb6 100644
--- a/hugo/assets/css/sap-fundamental.css
+++ b/hugo/assets/css/sap-fundamental.css
@@ -2371,6 +2371,29 @@ blockquote {
   margin: 1rem 0;
 }
 
+/* Semantic alert callouts (#2595) — author opt-in via `> [!TYPE]`.
+   Base `blockquote` (blue Information) remains the default for plain `>`.
+   Color-only: override border + fill, nothing else. Horizon-light hex are
+   fallbacks because several --sap*Background/BorderColor tokens are not
+   declared in this project's theme-vars. */
+blockquote.alert-note,
+blockquote.alert-important {
+  border-left-color: var(--sapInformationBorderColor, #0070f2);
+  background-color: var(--sapInformationBackground, #e1f4ff);
+}
+blockquote.alert-tip {
+  border-left-color: var(--sapSuccessBorderColor, #30914c);
+  background-color: var(--sapSuccessBackground, #f5fae5);
+}
+blockquote.alert-warning {
+  border-left-color: var(--sapWarningBorderColor, #dd6100);
+  background-color: var(--sapWarningBackground, #fff8d6);
+}
+blockquote.alert-caution {
+  border-left-color: var(--sapErrorBorderColor, #e90b0b);
+  background-color: var(--sapErrorBackground, #ffeaf4);
+}
+
 /* Tutorial meta bar (tags + time) */
 .tutorial-meta {
   display: flex;
diff --git a/hugo/assets/css/sap-fundamental.src.css b/hugo/assets/css/sap-fundamental.src.css
index 0d5a75e7d..53103bad9 100644
--- a/hugo/assets/css/sap-fundamental.src.css
+++ b/hugo/assets/css/sap-fundamental.src.css
@@ -879,6 +879,29 @@ blockquote {
   margin: 1rem 0;
 }
 
+/* Semantic alert callouts (#2595) — author opt-in via `> [!TYPE]`.
+   Base `blockquote` (blue Information) remains the default for plain `>`.
+   Color-only: override border + fill, nothing else. Horizon-light hex are
+   fallbacks because several --sap*Background/BorderColor tokens are not
+   declared in this project's theme-vars. */
+blockquote.alert-note,
+blockquote.alert-important {
+  border-left-color: var(--sapInformationBorderColor, #0070f2);
+  background-color: var(--sapInformationBackground, #e1f4ff);
+}
+blockquote.alert-tip {
+  border-left-color: var(--sapSuccessBorderColor, #30914c);
+  background-color: var(--sapSuccessBackground, #f5fae5);
+}
+blockquote.alert-warning {
+  border-left-color: var(--sapWarningBorderColor, #dd6100);
+  background-color: var(--sapWarningBackground, #fff8d6);
+}
+blockquote.alert-caution {
+  border-left-color: var(--sapErrorBorderColor, #e90b0b);
+  background-color: var(--sapErrorBackground, #ffeaf4);
+}
+
 /* Tutorial meta bar (tags + time) */
 .tutorial-meta {
   display: flex;
diff --git a/test/parsers/blockquote-alert-css.test.ts b/test/parsers/blockquote-alert-css.test.ts
new file mode 100644
index 000000000..bd642f501
--- /dev/null
+++ b/test/parsers/blockquote-alert-css.test.ts
@@ -0,0 +1,38 @@
+import { describe, it, expect } from 'vitest'
+import { readFileSync } from 'node:fs'
+
+const src = 'hugo/assets/css/sap-fundamental.src.css'
+const built = 'hugo/assets/css/sap-fundamental.css'
+
+describe('blockquote alert variant CSS', () => {
+  it('source defines all four variant selectors', () => {
+    const t = readFileSync(src, 'utf8')
+    expect(t).toContain('blockquote.alert-note')
+    expect(t).toContain('blockquote.alert-important')
+    expect(t).toContain('blockquote.alert-tip')
+    expect(t).toContain('blockquote.alert-warning')
+    expect(t).toContain('blockquote.alert-caution')
+  })
+
+  it('tip maps to Horizon success green, caution to error red, warning to amber', () => {
+    const t = readFileSync(src, 'utf8')
+    expect(t).toContain('#30914c') // success border
+    expect(t).toContain('#f5fae5') // success bg
+    expect(t).toContain('#dd6100') // warning border
+    expect(t).toContain('#fff8d6') // warning bg
+    expect(t).toContain('#e90b0b') // error border
+    expect(t).toContain('#ffeaf4') // error bg
+  })
+
+  it('built css was regenerated with the variant selectors', () => {
+    const t = readFileSync(built, 'utf8')
+    expect(t).toContain('.alert-tip')
+    expect(t).toContain('.alert-warning')
+    expect(t).toContain('.alert-caution')
+  })
+
+  it('does not alter the base blockquote default (blue Information still present)', () => {
+    const t = readFileSync(src, 'utf8')
+    expect(t).toContain('--sapInformationBackground')
+  })
+})

From a71c777b35ea5f0cf4c0dbed6affd7352a673039 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:06:13 -0400
Subject: [PATCH 12/46] feat(auth): honor sap_idp on /login route via
 dynamicIdentityProvider (#2506)

---
 approuter/xs-app.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/approuter/xs-app.json b/approuter/xs-app.json
index 81a048fd9..2f3bc4308 100644
--- a/approuter/xs-app.json
+++ b/approuter/xs-app.json
@@ -116,6 +116,7 @@
     {
       "source": "^/login(\\?.*)?$",
       "authenticationType": "xsuaa",
+      "dynamicIdentityProvider": true,
       "target": "/login-redirect.html",
       "localDir": "static"
     },

From 28ead936c95596ed09298f55e38d740c9232fe22 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:08:00 -0400
Subject: [PATCH 13/46] docs: sync architecture docs to the split MTA (MCP now
 a separate MTA) (#2589)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The MCP-auth microservice was split out of the main `tutorials-ims` MTA into
its own `tutorials-mcp` MTA (`mta-mcp.yaml`, module `tutorials-srv-mcp`) across
#2569/#2579/#2581 and the IAS OAuth cutover, but the docs still described a
single MTA with the whole MCP surface living in `tutorials-srv`.

Corrects the topology across 11 docs:
- Only the authenticated `/mcp-auth/*` surface moved to `tutorials-srv-mcp`
  (separate MTA, hybrid IAS-PKCE + XSUAA auth, proxied via the approuter's
  `srv-mcp-api` destination). Anonymous `/mcp/*`, PAT `/mcp-pat/*`, and admin
  `/mcp-admin/*` stay on the main `tutorials-srv`.
- `MCP_AUTH_ENABLED` now targets `tutorials-srv-mcp`; `MCP_PAT_MINT_ENABLED` /
  `KG_STEP_SLICER_ENABLED` stay on `tutorials-srv`.
- The MCP MTA adopts the main MTA's services as existing-service; it deploys by
  hand (`mbt build -e mta-mcp.yaml` + `cf deploy ... -e deploy/mcp-<env>.mtaext`)
  and `npm run deploy` does NOT cover it — documented honestly.
- Fixed a pre-existing contradiction: `.well-known` is runtime approuter
  middleware, not static files.
- Refreshed stale `tutorials-ims_1.0.0.mtar` literals to the `*.mtar` glob in
  live runbooks (dated rename-cutover commands left historically accurate).

Docs-only; verified with a clean `npm run docs:build` (no broken links).
---
 CLAUDE.md                                     |  9 +++
 README.md                                     |  9 ++-
 docs/developers/architecture/mcp-server.md    | 80 ++++++++++++-------
 docs/developers/getting-started.md            |  7 +-
 docs/developers/operations/deployment.md      | 45 +++++++----
 docs/developers/operations/mcp-server.md      | 62 ++++++++++----
 docs/developers/operations/mta-deployment.md  | 74 ++++++++++++++---
 .../developers/operations/production-ready.md |  2 +-
 .../operations/qa-channel-bootstrap.md        |  2 +-
 docs/end-users/mcp-quickstart.md              |  2 +-
 docs/pilot-status.md                          |  2 +-
 11 files changed, 216 insertions(+), 78 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index eb3243fe6..c12c46a06 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -101,6 +101,15 @@ Subsystem one-liners:
 
   `mbt build` only `cp`'s `hugo/public/` into the approuter — it does **not** run Hugo or `fetch-tutorials`. Local builds MUST run `npm run build:all` before `mbt build`; skipping ships stale approuter (missing NEW badges, license icons, progress UI). Always confirm deploy scope with maintainer (backend-only / +content / +QA).
 
+- **The MCP server is a SEPARATE MTA (`tutorials-mcp`, `mta-mcp.yaml`)** — the command above deploys only the main `tutorials-ims` MTA (`.deploy/mta.yaml`), which serves the anonymous `/mcp/*`, PAT `/mcp-pat/*`, and admin `/mcp-admin/*` surfaces. The authenticated `/mcp-auth/*` surface runs in the `tutorials-srv-mcp` app of the separate `tutorials-mcp` MTA. `npm run deploy` / `scripts/deploy-mta.cjs` do NOT cover it — deploy it by hand from repo root:
+
+  ```bash
+  mbt build -e mta-mcp.yaml -t mta_archives
+  cf deploy mta_archives/*.mtar -e deploy/mcp-dev.mtaext -f   # or deploy/mcp-prod.mtaext
+  ```
+
+  The MCP MTA adopts the main MTA's services (hana/xsuaa/identity/credstore/destination) as `existing-service`, so deploy the main MTA first on a fresh space. Feature flag `MCP_AUTH_ENABLED` targets `tutorials-srv-mcp`; `MCP_PAT_MINT_ENABLED`/`KG_STEP_SLICER_ENABLED` target `tutorials-srv`. See [mta-deployment.md § MCP MTA](docs/developers/operations/mta-deployment.md#mcp-mta-tutorials-mcp).
+
 - **Local deploy is envsubst-free** — All four secrets (`CONTENT_API_KEY`, `REBUILD_API_KEY`, `APPROUTER_URL`, `GITHUB_DISPATCH_TOKEN`) formerly injected via `envsubst` now live exclusively in the BTP Credential Store (or have been removed entirely, in APPROUTER_URL's case). Run `cf deploy mta_archives/*.mtar -e ../deploy/dev.mtaext -f` directly. Rotation happens through `/admin-ui/#secrets` on the target env's approuter. See [mta-deployment.md](docs/developers/operations/mta-deployment.md) "Local deploy no longer needs envsubst" for the full context.
 
 - **PR over direct merge** — Default to `gh pr create` from a feature branch; subagent code review is not a substitute for PR review. Only fast-merge to `main` if explicitly told to skip the PR.
diff --git a/README.md b/README.md
index f205739e1..c2e1b2199 100644
--- a/README.md
+++ b/README.md
@@ -113,14 +113,17 @@ tutorials-ims/
 │   ├── improvements.md, TODO.md#   Feature backlog and gap tracking (largely historic)
 │   └── superpowers/specs/+plans/ # Feature specs and step-by-step implementation plans
 ├── .deploy/                    # MTA build + deploy artifacts
-│   ├── mta.yaml                #   MTA descriptor (modules: approuter, srv, srv-qa, db, db-qa, destinations)
+│   ├── mta.yaml                #   Main MTA descriptor (modules: approuter, srv, srv-qa, db, db-qa, destinations)
 │   ├── xs-security.json        #   XSUAA scopes + role collections (Admin, MobileApp, Tutorial.Author)
 │   ├── deploy-admin.sh         #   Standalone admin UI deploy helper (bypasses MTA build)
 │   └── DEPLOY.md               #   Deploy procedure documentation
+├── mta-mcp.yaml                # Separate MCP MTA descriptor (tutorials-mcp → module tutorials-srv-mcp, serves /mcp-auth/*; adopts main-MTA services)
 ├── deploy/                     # MTA extension descriptors (environment overrides)
-│   ├── dev.mtaext              #   Development overrides (instance counts, memory)
+│   ├── dev.mtaext              #   Main-MTA development overrides (instance counts, memory, srv-mcp-url)
 │   ├── qa.mtaext               #   QA/staging overrides
-│   └── prod.mtaext             #   Production overrides
+│   ├── prod.mtaext             #   Production overrides
+│   ├── mcp-dev.mtaext          #   MCP-MTA DEV overrides (tutorials-mcp-dev)
+│   └── mcp-prod.mtaext         #   MCP-MTA PROD overrides (tutorials-mcp-prod)
 ├── .github/workflows/          # CI/CD pipelines (GitHub Actions)
 │   ├── deploy.yml              #   Build MTA + deploy to BTP CF + post-deploy smoke tests
 │   ├── rebuild-content.yml     #   Re-fetch tutorials + rebuild Hugo + publish HTML to HANA
diff --git a/docs/developers/architecture/mcp-server.md b/docs/developers/architecture/mcp-server.md
index f0fc3da53..a9b71ffd6 100644
--- a/docs/developers/architecture/mcp-server.md
+++ b/docs/developers/architecture/mcp-server.md
@@ -2,34 +2,54 @@
 
 How the Model Context Protocol surface is structured across CAP services, approuter routes, and the shared step-HTML slicer. For the design rationale, see the spec at `docs/superpowers/specs/2026-07-08-mcp-server-phase2-design.md`.
 
-## Three-route stack
+## Deployment topology — two MTAs
+
+The MCP surface spans **two separately-deployed MTAs** (see
+[operations/mta-deployment.md](../operations/mta-deployment.md)):
+
+- **`tutorials-ims`** (main MTA, `.deploy/mta.yaml`) — the `tutorials-srv` CAP runtime +
+  the approuter. Serves the anonymous `/mcp/*`, PAT `/mcp-pat/*`, and admin `/mcp-admin/*`
+  surfaces, and **owns** the shared services (HANA, XSUAA, destination, credstore, …).
+- **`tutorials-mcp`** (MCP MTA, root `mta-mcp.yaml`) — a single `tutorials-srv-mcp` Node.js
+  app serving only the authenticated `/mcp-auth/*` surface. It **adopts** the main MTA's
+  services as `existing-service` (it creates none of its own) and authenticates inbound
+  requests with a hybrid IAS (public PKCE) + XSUAA scheme.
+
+The approuter (in the main MTA) fronts both: `/mcp-auth/*` is proxied to the external
+`tutorials-srv-mcp` app via the `srv-mcp-api` destination (`${srv-mcp-url}`); every other
+`/mcp*` route goes to the local `srv-api`.
+
+## Four-route stack
 
 ```
 Internet / MCP client
         |
   Approuter (xs-app.json)
         |
-   ┌────┴──────────────────────────────────────────────────────────┐
-   │  Route             Auth              Description               │
-   │  /mcp/*            none              Anonymous read-only tools  │
-   │  /mcp-auth/*       XSUAA OAuth JWT   Authenticated tools        │
-   │  /mcp-pat/*        Bearer PAT        Headless / CI agents       │
-   └───────────────────────────────────────────────────────────────┘
-        |
-  CAP runtime (tutorials-srv)
-        |
-   ┌────┴──────────────────────────────────────────────────────────┐
-   │  @cap-js/mcp adapter                                           │
-   │  Registers each @protocol:['odata','mcp'] service at          │
-   │  /mcp/<serviceRoot> (anonymous) and                           │
-   │  /mcp-auth/<serviceRoot> / /mcp-pat/<serviceRoot>              │
-   │  (via the approuter prefix routing above)                     │
-   └───────────────────────────────────────────────────────────────┘
+   ┌────┴──────────────────────────────────────────────────────────────┐
+   │  Route          Auth                   Backend app                  │
+   │  /mcp/*         none                    tutorials-srv  (srv-api)     │
+   │  /mcp-pat/*     Bearer PAT (in CAP)     tutorials-srv  (srv-api)     │
+   │  /mcp-admin/*   XSUAA (at approuter)    tutorials-srv  (srv-api)     │
+   │  /mcp-auth/*    IAS PKCE / XSUAA        tutorials-srv-mcp (srv-mcp-  │
+   │                 (in the MCP app)         api → separate MTA)         │
+   └─────────────────────────────────────────────────────────────────────┘
+        |                                              |
+  CAP runtime (tutorials-srv)                   MCP app (tutorials-srv-mcp)
+        |                                              |
+   ┌────┴───────────────────────────────┐    ┌────────┴──────────────────────┐
+   │  @cap-js/mcp adapter                │    │  srv-mcp/server.js rewrites    │
+   │  Registers each @protocol:          │    │  /mcp-auth/* → /mcp/* onto its │
+   │  ['odata','mcp'] service at         │    │  own DeveloperService handlers │
+   │  /mcp/<serviceRoot> (anonymous);    │    │  (the 7 authenticated MCP      │
+   │  /mcp-pat/<root> via PAT middleware;│    │  read/write tools). Hybrid     │
+   │  /mcp-admin/* via the compose layer │    │  IAS+XSUAA inbound auth.        │
+   └─────────────────────────────────────┘    └────────────────────────────────┘
 ```
 
-**Anonymous route (`/mcp/*`):** No XSUAA round-trip. The approuter's `authenticationType: none` route forwards directly to `srv-api`. Participating services: `SearchService`, `HomepageService`, `KnowledgeGraphService`.
+**Anonymous route (`/mcp/*`):** No XSUAA round-trip. The approuter's `authenticationType: none` route forwards directly to `srv-api` (the main `tutorials-srv`). Participating services: `SearchService`, `HomepageService`, `KnowledgeGraphService`.
 
-**Authenticated route (`/mcp-auth/*`):** The approuter enforces a valid XSUAA bearer. The CAP runtime receives `req.user` pre-populated by the XSUAA middleware. Participating services: `DeveloperService`, `HomepageService` (authenticated tools).
+**Authenticated route (`/mcp-auth/*`):** Served by the **separate `tutorials-srv-mcp` app** (MCP MTA), proxied through the approuter's `srv-mcp-api` destination with `authenticationType: none` at the approuter — the bearer is validated inside the MCP app, not at the approuter. Inbound auth is **hybrid**: an IAS public-PKCE client (primary, for `mcp-remote` clients) with an XSUAA bearer fallback. `srv-mcp/server.js` rewrites `/mcp-auth/*` → `/mcp/*` onto its own `DeveloperService` handlers (the 7 authenticated read/write tools). `HomepageService` authenticated tools are also reachable here.
 
 **PAT route (`/mcp-pat/*`):** The approuter uses `authenticationType: none` (the PAT is not a XSUAA token — the approuter cannot validate it). The CAP middleware `srv/lib/mcp-pat-middleware.js` intercepts every request before CAP's routing, validates the `Authorization: Bearer pat_...` header against the `PersonalAccessTokens` HANA table (SHA-256 comparison, TTL check), and synthesises a `req.user` object with the matched user's SAP ID and a `tokenSource: 'pat'` marker.
 
@@ -47,32 +67,34 @@ Full adapter reference: <https://cap.cloud.sap/docs/guides/protocols/mcp>.
 
 ## `req.user` resolution
 
-All authenticated tools ultimately call `resolveDbUser(req.user)` to look up the user's database row. Three paths converge on this function:
+All authenticated tools ultimately resolve the caller to a database row. Note the two paths
+run in **different processes**: `/mcp-auth/*` resolves inside the separate `tutorials-srv-mcp`
+app (MCP MTA), while `/mcp-pat/*` resolves inside the main `tutorials-srv` runtime.
 
 ```
-/mcp-auth/*  →  XSUAA middleware  →  req.user.id = SAP universal ID (from JWT sub)
-                                       req.user.tokenSource = undefined (JWT)
-                                       ↓
-                                    resolveDbUser(req.user)
+/mcp-auth/*  →  tutorials-srv-mcp  →  IAS PKCE (primary) or XSUAA (fallback) bearer
+   (MCP MTA)                           ↓
+                                    tiered resolveUser(req.user) + pinResolvedUser (#2552)
+                                       req.user.id = SAP universal ID (from the token sub)
                                        ↓
                                     DB row from Users WHERE sapId = req.user.id
 
-/mcp-pat/*   →  mcp-pat-middleware →  req.user.id = sapId from PersonalAccessTokens
-                                       req.user.tokenSource = 'pat'
+/mcp-pat/*   →  tutorials-srv      →  mcp-pat-middleware → req.user.id = sapId from PAT
+   (main MTA)                          req.user.tokenSource = 'pat'
                                        req.user.roles = ['pat-read'] + ['pat-write'] (if scopes include 'write')
                                        ↓
-                                    resolveDbUser(req.user)  (same function)
+                                    resolveDbUser(req.user)
                                        ↓
                                     DB row from Users WHERE sapId = req.user.id
 ```
 
-If `resolveDbUser` returns null (user not in the DB, stale OAuth clientId, or unmigrated user), the handler emits a WARN log `[mcp-dev] resolveDbUser miss` and rejects with 401. This surfaces stale-token issues without a silent zero-row response — see [[silent-user-resolution-hides-token-bugs]] in MEMORY.md.
+If user resolution returns null (user not in the DB, stale OAuth clientId, or unmigrated user), the handler emits a WARN log `[mcp-dev] resolveDbUser miss` and rejects with 401. This surfaces stale-token issues without a silent zero-row response — see [[silent-user-resolution-hides-token-bugs]] in MEMORY.md.
 
 ## Shared step-HTML slicer
 
 `srv/lib/tutorial-step-slicer.js` is the single implementation for extracting a step's HTML from the HANA content BLOB. Four consumers:
 
-1. `DeveloperService.get_tutorial_step` (authenticated MCP, `/mcp-auth/*`)
+1. `DeveloperService.get_tutorial_step` (authenticated MCP, `/mcp-auth/*`) — runs in the separate `tutorials-srv-mcp` app, which consumes the slicer logic via the shared `mcp.bundle.mjs` bundle (`scripts/bundle-shared.cjs`), not a second copy of the source
 2. `SearchService.get_tutorial_step` (anonymous MCP, `/mcp/search`)
 3. `srv/lib/code-check-step-loader.js` (Joule `checkStepCode`)
 4. `srv/lib/chat-context.js` server-side fallback
diff --git a/docs/developers/getting-started.md b/docs/developers/getting-started.md
index 138c4967b..aebf4806b 100644
--- a/docs/developers/getting-started.md
+++ b/docs/developers/getting-started.md
@@ -160,9 +160,14 @@ When CI is broken or you need a quick iterative deploy, build and push from `.de
 cf target -s <dev-space>
 cd .deploy
 mbt build
-cf deploy mta_archives/tutorials-ims_1.0.0.mtar -e ../deploy/dev.mtaext -f
+cf deploy mta_archives/*.mtar -e ../deploy/dev.mtaext -f
 ```
 
+> This deploys the **main** `tutorials-ims` MTA only. The authenticated MCP surface
+> (`/mcp-auth/*`) ships as a **separate** `tutorials-mcp` MTA that deploys by hand:
+> `mbt build -e mta-mcp.yaml -t mta_archives && cf deploy mta_archives/*.mtar -e deploy/mcp-dev.mtaext -f`
+> (from repo root). See [operations/mta-deployment.md § MCP MTA](operations/mta-deployment.md#mcp-mta-tutorials-mcp).
+
 ### Optional env vars
 
 ```bash
diff --git a/docs/developers/operations/deployment.md b/docs/developers/operations/deployment.md
index 308b219ba..c4cbfcca8 100644
--- a/docs/developers/operations/deployment.md
+++ b/docs/developers/operations/deployment.md
@@ -7,40 +7,57 @@ description: SAP BTP Cloud Foundry deployment — MTA modules, BTP service bindi
 
 > Source: extracted from project README, 2026-05-25.
 
-Single MTA deployment to SAP BTP Cloud Foundry:
+Two MTAs deploy to SAP BTP Cloud Foundry: the **main** `tutorials-ims` MTA
+([.deploy/mta.yaml](../../../.deploy/mta.yaml)) and the **MCP** `tutorials-mcp` MTA
+([mta-mcp.yaml](../../../mta-mcp.yaml)). The main MTA owns the service instances; the MCP MTA
+adopts them. Main-MTA deploy:
 
 ```bash
 mbt build
-cf deploy mta_archives/tutorials-ims_1.0.0.mtar
+cf deploy mta_archives/*.mtar
 ```
 
+MCP-MTA deploy is separate and manual (`npm run deploy` does not cover it):
+
+```bash
+mbt build -e mta-mcp.yaml -t mta_archives
+cf deploy mta_archives/*.mtar -e deploy/mcp-dev.mtaext -f
+```
+
+See [operations/mta-deployment.md](mta-deployment.md) for the full runbook.
+
 #### MTA Modules
 
-The deployment in [.deploy/mta.yaml](../../../.deploy/mta.yaml) defines five modules — the prod and QA channels share an AppRouter and XSUAA instance but each gets its own srv app and HDI container.
+The main MTA ([.deploy/mta.yaml](../../../.deploy/mta.yaml)) defines five modules — the prod and QA channels share an AppRouter and XSUAA instance but each gets its own srv app and HDI container. The MCP MTA ([mta-mcp.yaml](../../../mta-mcp.yaml)) adds a sixth deploy unit, `tutorials-srv-mcp`.
 
-| Module | Type | Source | Requires | Purpose |
-| --- | --- | --- | --- | --- |
-| `tutorials-db-deployer` | `hdb` | `gen/db` | `tutorials-hana`, `tutorials-cloud-logging` | Prod HANA schema + indexes (one-shot HDI deploy). Cloud Logging binding forwards deployer stdout for ~30-day forensic retention (#257). |
-| `tutorials-db-qa-deployer` | `hdb` | `gen/db-qa` | `tutorials-hana-qa`, `tutorials-cloud-logging` | QA HANA schema (peer of `db/`, namespace `com.sap.developers.ims.qa`). Cloud Logging binding mirrors prod for QA forensic parity. |
-| `tutorials-srv` | `nodejs` | `gen/srv` | hana, xsuaa, destination, mail, audit-log, cloud-logging, aicore | CAP backend (9 services + jobs + Socket.IO + content store + RAG) |
-| `tutorials-srv-qa` | `nodejs` | `gen/srv-qa` | hana-qa, xsuaa | QA-channel CAP srv (re-renders author drafts via `srv-qa/lib/parsers.bundle.mjs`) |
-| `tutorials-approuter` | `approuter.nodejs` | `approuter/` | xsuaa, `srv-api` (destination), `srv-qa-api` (destination) | XSUAA login + static delivery + reverse proxy to both srv apps |
+| Module | MTA | Type | Source | Requires | Purpose |
+| --- | --- | --- | --- | --- | --- |
+| `tutorials-db-deployer` | main | `hdb` | `gen/db` | `tutorials-hana`, `tutorials-cloud-logging` | Prod HANA schema + indexes (one-shot HDI deploy). Cloud Logging binding forwards deployer stdout for ~30-day forensic retention (#257). |
+| `tutorials-db-qa-deployer` | main | `hdb` | `gen/db-qa` | `tutorials-hana-qa`, `tutorials-cloud-logging` | QA HANA schema (peer of `db/`, namespace `com.sap.developers.ims.qa`). Cloud Logging binding mirrors prod for QA forensic parity. |
+| `tutorials-srv` | main | `nodejs` | `gen/srv` | hana, xsuaa, destination, mail, audit-log, cloud-logging, aicore | CAP backend (9 services + jobs + Socket.IO + content store + RAG); serves `/mcp/*`, `/mcp-pat/*`, `/mcp-admin/*` |
+| `tutorials-srv-qa` | main | `nodejs` | `gen/srv-qa` | hana-qa, xsuaa | QA-channel CAP srv (re-renders author drafts via `srv-qa/lib/parsers.bundle.mjs`) |
+| `tutorials-approuter` | main | `approuter.nodejs` | `approuter/` | xsuaa, `srv-api` (destination), `srv-qa-api` (destination), `srv-mcp-api` (destination) | XSUAA login + static delivery + reverse proxy to both srv apps AND the MCP app |
+| `tutorials-srv-mcp` | **mcp** | `nodejs` | `gen/srv-mcp` | hana, xsuaa, identity (IAS), credstore, destination | Authenticated MCP backend — serves ONLY `/mcp-auth/*`; adopts the main MTA's services as existing-service |
 
-The AppRouter routes `^/tutorials-qa/(.*)`, `^/qa-search/(.*)` to the `srv-qa-api` destination and everything else (`/api/*`, `/admin/*`, `/display/*`, `/content/*`, etc.) to `srv-api`. WebSocket paths (`^/socket\.io/`, `^/ws/`) are `authenticationType: 'none'` because the scope check happens at namespace join.
+The AppRouter routes `^/tutorials-qa/(.*)`, `^/qa-search/(.*)` to the `srv-qa-api` destination, `^/mcp-auth/(.*)` to the `srv-mcp-api` destination (the external MCP app), and everything else (`/api/*`, `/admin/*`, `/display/*`, `/content/*`, `/mcp/*`, `/mcp-pat/*`, `/mcp-admin/*`, etc.) to `srv-api`. WebSocket paths (`^/socket\.io/`, `^/ws/`) are `authenticationType: 'none'` because the scope check happens at namespace join.
 
 #### BTP Service Bindings
 
 | Resource | Service / plan | Required by | Notes |
 | --- | --- | --- | --- |
-| `tutorials-hana` | `hana` / `hdi-shared` | `tutorials-srv`, `tutorials-db-deployer` | Prod HDI container (`com.sap.xs.hdi-container`) |
+| `tutorials-hana` | `hana` / `hdi-shared` | `tutorials-srv`, `tutorials-db-deployer`, `tutorials-srv-mcp` | Prod HDI container (`com.sap.xs.hdi-container`) |
 | `tutorials-hana-qa` | `hana` / `hdi-shared` | `tutorials-srv-qa`, `tutorials-db-qa-deployer` | QA-channel HDI container — separate from prod, no cross-foreign-keys |
-| `tutorials-xsuaa` | `xsuaa` / `application` | all srv apps + approuter | Configured from [.deploy/xs-security.json](../../../.deploy/xs-security.json) (Admin, MobileApp, DisplayApp, Tutorial.Author, ConsolidationScope, DeveloperApp scopes) |
-| `tutorials-destination` | `destination` / `lite` | `tutorials-srv` | NGDS + SCI remote endpoints |
+| `tutorials-xsuaa` | `xsuaa` / `application` | all srv apps + approuter + `tutorials-srv-mcp` | Configured from [.deploy/xs-security.json](../../../.deploy/xs-security.json) (Admin, MobileApp, DisplayApp, Tutorial.Author, ConsolidationScope, DeveloperApp scopes) |
+| `tutorials-identity` | `identity` / IAS | `tutorials-srv-mcp` | IAS public-PKCE client for `/mcp-auth/*` `mcp-remote` clients (primary auth; XSUAA is the fallback) |
+| `tutorials-destination` | `destination` / `lite` | `tutorials-srv`, `tutorials-srv-mcp` | NGDS + SCI remote endpoints; the MCP app uses it for the main-srv write-forward destination |
+| `tutorials-credstore` | `credstore` / `standard` | `tutorials-srv`, `tutorials-srv-mcp` | BTP Credential Store (deploy-time secrets) |
 | `tutorials-mail` | `mail` / `standard` | `tutorials-srv` | SMTP for notification escalation emails |
 | `tutorials-audit-log` | `auditlog` / `standard` (optional) | `tutorials-srv` | `@cap-js/audit-logging` sink for `@PersonalData` events |
 | `tutorials-cloud-logging` | `cloud-logging` / `standard` (optional) | `tutorials-srv`, `tutorials-db-deployer`, `tutorials-db-qa-deployer` | OTLP ingest enabled; backs the `cfLogsUrl` virtual on `PipelineLog` / `JobExecutionLog`. Deployer bindings (#257) capture HDI deploy stdout for ~30-day forensic retention. |
 | `tutorials-aicore` | `aicore` / `extended` (optional) | `tutorials-srv` | Backs `ChatService` + embeddings + RAG (`getRelevantSteps` tool) |
 
+The MCP MTA creates **none** of these — it declares each as `org.cloudfoundry.existing-service` and adopts the instances the main MTA owns.
+
 `optional: true` resources let `mbt build && cf deploy` succeed in a subaccount that hasn't entitled them yet (e.g., a fresh sandbox without AI Core). The srv app degrades gracefully when bindings are missing — chat returns 503, audit logging falls through to the console sink, OTLP export is no-op.
 
 #### Route Architecture
diff --git a/docs/developers/operations/mcp-server.md b/docs/developers/operations/mcp-server.md
index 978ea512f..a34453eb9 100644
--- a/docs/developers/operations/mcp-server.md
+++ b/docs/developers/operations/mcp-server.md
@@ -3,7 +3,7 @@
 Operator runbook for the anonymous Model Context Protocol surface at `/mcp/*`. The CAP adapter (`@cap-js/mcp@1.1.1`) exposes selected read-only services as MCP tools; visitors' MCP clients connect through the approuter with no XSUAA round-trip.
 
 Adapter: [`@cap-js/mcp@1.1.1`](https://www.npmjs.com/package/@cap-js/mcp) — cds10-compatible; registers itself under `cds.protocols.mcp` so no `protocols` block is needed in project `package.json`.
-Approuter route: `/mcp/*` → `srv-api`, `authenticationType: none`, `csrfProtection: false`. The parallel `/mcp-auth/*` prefix is **reserved for Phase 2** — do not repurpose.
+Approuter route: `/mcp/*` → `srv-api`, `authenticationType: none`, `csrfProtection: false`. The parallel `/mcp-auth/*` prefix is the **authenticated** surface, routed to the separate `tutorials-srv-mcp` app (MCP MTA) via the `srv-mcp-api` destination — see [Phase 2 — the authenticated surface](#phase-2-the-authenticated-surface-shipped).
 Services participating: `SearchService`, `HomepageService`, `KnowledgeGraphService` — each declares `@protocol: ['odata', ..., 'mcp']`. **Never** use the `@mcp` single-protocol shortcut alone: it replaces the default OData mount (same trap as [[cap-graphql-shortcut-replaces-odata]]).
 
 ## TL;DR
@@ -14,17 +14,33 @@ Services participating: `SearchService`, `HomepageService`, `KnowledgeGraphServi
 | Retire one tool (temporary) | Comment out the CDS function + its handler, redeploy | ~15 min |
 | Retire one service's whole MCP surface | Remove `'mcp'` from that service's `@protocol` list, redeploy | ~15 min |
 | Full MCP shutdown (ultima ratio) | `npm uninstall @cap-js/mcp`, redeploy | ~15 min |
-| Roll back the last change | `cf rollback tutorials-srv` | ~1 min |
+| Roll back the last change | `cf rollback tutorials-srv` (anonymous/PAT/admin) or `cf rollback tutorials-srv-mcp` (`/mcp-auth/*`) | ~1 min |
 
 ## Deploy
 
-The adapter is a normal CAP protocol plugin — it boots with the CAP process and has no separate lifecycle. There is no MCP-specific deploy step. Use the standard MTA workflow:
+The anonymous `/mcp/*`, PAT `/mcp-pat/*`, and admin `/mcp-admin/*` surfaces run inside the
+main `tutorials-srv` CAP runtime. The adapter is a normal CAP protocol plugin — it boots with
+that process and has no separate lifecycle. There is no MCP-specific deploy step for those
+surfaces; use the standard main-MTA workflow:
 
 ```bash
 npm run build:all
 cd .deploy && mbt build && cf deploy mta_archives/*.mtar -e ../deploy/dev.mtaext -f
 ```
 
+> **The authenticated `/mcp-auth/*` surface is a SEPARATE MTA.** As of the auth-split
+> (#2569/#2579/#2581) the OAuth MCP backend is the `tutorials-srv-mcp` app in its own
+> `tutorials-mcp` MTA (descriptor `mta-mcp.yaml`), not `tutorials-srv`. It deploys by hand:
+>
+> ```bash
+> mbt build -e mta-mcp.yaml -t mta_archives
+> cf deploy mta_archives/*.mtar -e deploy/mcp-dev.mtaext -f   # or deploy/mcp-prod.mtaext
+> ```
+>
+> `npm run deploy` / `scripts/deploy-mta.cjs` deploy ONLY the main MTA — there is no
+> orchestrated MCP-MTA path today, so the main-MTA deploy above does NOT ship `/mcp-auth/*`
+> changes. See [mta-deployment.md § MCP MTA (tutorials-mcp)](mta-deployment.md#mcp-mta-tutorials-mcp).
+
 On boot you'll see the plugin register under `cds.protocols.mcp` and each participating service serve at `/mcp/<serviceRoot>`. Endpoints are `/mcp/search`, `/mcp/homepage`, `/mcp/graph`.
 
 ## Disable one curated tool
@@ -67,10 +83,11 @@ The adapter is gone from `cds.protocols` on next boot; every `/mcp/*` request re
 
 ## Rollback
 
-There is no MCP-specific state — no manifest, no session store, no outbox rows. Standard app rollback recovers the entire surface:
+There is no MCP-specific state — no manifest, no session store, no outbox rows. Standard app rollback recovers the surface — but note the two backends roll back independently:
 
 ```bash
-cf rollback tutorials-srv
+cf rollback tutorials-srv       # anonymous /mcp/*, PAT /mcp-pat/*, admin /mcp-admin/*
+cf rollback tutorials-srv-mcp   # authenticated /mcp-auth/* (separate MCP MTA)
 ```
 
 If the change touched only `.cds` / `.js` files and not `db/`, this is safe to run at any time. If a schema change rode along, use the normal deploy-rollback procedure (see [mta-deployment.md](mta-deployment.md)).
@@ -107,7 +124,7 @@ Boot logs show `serving <Service> { at: '/mcp/<root>' }` for each MCP-enabled se
 
 `/mcp/*` is anonymous. If a client sees 401, the request is not hitting the anonymous route:
 
-- Verify the URL is `/mcp/search`, `/mcp/homepage`, or `/mcp/graph`. Anything else (including `/mcp-auth/*`) is not routed to `srv-api` as anonymous — `/mcp-auth/*` is reserved for Phase 2 and currently returns 404 or 401 depending on approuter config.
+- Verify the URL is `/mcp/search`, `/mcp/homepage`, or `/mcp/graph`. Anything else is not routed to `srv-api` as anonymous — notably `/mcp-auth/*` is the **authenticated** surface (separate `tutorials-srv-mcp` app) and requires an IAS/XSUAA bearer, so an anonymous `initialize` there is expected to 401.
 - Confirm the client isn't hitting an authenticated CAP service at a different path and appending `/mcp` to it. Only the three curated services participate.
 
 ### Connection resets after the first request
@@ -122,9 +139,15 @@ The adapter picks the response encoding from the client's `Accept` header. If a
 
 No MCP-specific counters are exported yet. The general `srv-error-rate` alert on 5xx from `tutorials-srv` covers adapter-level failures — if the plugin throws on `tools/list`, that surfaces as a 500 and rolls into the standard alert. Per-tool call counts / latency histograms are a future enhancement (tracked as a nice-to-have; no issue open).
 
-## Phase 2 preparation
+## Phase 2 — the authenticated surface (shipped)
 
-The approuter reserves `/mcp-auth/*` for the authenticated MCP surface (Phase 2 — MCP calls that require an XSUAA bearer, e.g. tools that read a user's tutorial progress). **Do not squat on this prefix** for anything else. When Phase 2 lands, the plan is to mount an OAuth-protected sibling of the current adapter under `/mcp-auth/*` while keeping the anonymous `/mcp/*` surface unchanged.
+`/mcp-auth/*` is the authenticated MCP surface — MCP calls that require a bearer, e.g. tools
+that read or write a user's tutorial progress. It is **live**, and since the auth-split
+(#2569/#2579/#2581) it is served by the separate `tutorials-srv-mcp` app (the `tutorials-mcp`
+MTA), not the main `tutorials-srv` adapter. Inbound auth is hybrid IAS (public PKCE, for
+`mcp-remote` clients) with an XSUAA bearer fallback. The anonymous `/mcp/*` surface stays on
+`tutorials-srv` unchanged. See [architecture/mcp-server.md](../architecture/mcp-server.md) for
+the full topology.
 
 ## Phase 2 operations
 
@@ -152,18 +175,23 @@ curl -X POST https://<approuter-url>/pats/mintPAT \
 
 Three Phase 2 feature flags control the MCP surface. All default to `true` (enabled).
 
+> **Flag target depends on the surface.** `MCP_AUTH_ENABLED` gates `/mcp-auth/*`, which now
+> runs in the **separate `tutorials-srv-mcp` app** (read in `srv-mcp/server.js`) — set it on
+> that app. `MCP_PAT_MINT_ENABLED` and `KG_STEP_SLICER_ENABLED` gate `/mcp-pat/*` and the
+> anonymous step-slicer on the **main `tutorials-srv`**.
+
 ```bash
-# Disable the authenticated MCP surface entirely
-cf set-env tutorials-srv MCP_AUTH_ENABLED false && cf restart tutorials-srv
+# Disable the authenticated MCP surface entirely (separate MCP MTA app)
+cf set-env tutorials-srv-mcp MCP_AUTH_ENABLED false && cf restart tutorials-srv-mcp
 
-# Disable PAT minting (existing PATs continue to work)
+# Disable PAT minting (existing PATs continue to work) — main srv
 cf set-env tutorials-srv MCP_PAT_MINT_ENABLED false && cf restart tutorials-srv
 
-# Disable the step-HTML slicer (get_tutorial_step returns 404 for all slugs)
+# Disable the step-HTML slicer (get_tutorial_step returns 404 for all slugs) — main srv
 cf set-env tutorials-srv KG_STEP_SLICER_ENABLED false && cf restart tutorials-srv
 ```
 
-To restore a flag to default, `cf unset-env tutorials-srv <NAME> && cf restart tutorials-srv` (unset = default `true`).
+To restore a flag to default, `cf unset-env <app> <NAME> && cf restart <app>` (unset = default `true`) — using the same app the flag was set on above.
 
 ### Granting `Tutorials MCP Users` role collection
 
@@ -234,7 +262,7 @@ The `sap-devs` CLI and its bundled MCP server are a **downstream consumer** of t
 | Consumer shape | URL | Auth |
 | --- | --- | --- |
 | Anonymous curated tools (Phase 1, unchanged) | `<base>/mcp/search`, `/mcp/homepage`, `/mcp/graph` | none |
-| Authenticated / personalized tools (browser agent) | `<base>/mcp-auth/api` | OAuth 2.1 + PKCE via XSUAA; requires the `Tutorial.MCP` scope |
+| Authenticated / personalized tools (browser agent) | `<base>/mcp-auth/api` (separate `tutorials-srv-mcp` app) | OAuth 2.1 + PKCE via **IAS** (primary) with XSUAA fallback; requires the `Tutorial.MCP` scope on the XSUAA path |
 | Authenticated / personalized tools (headless CLI, CI) | `<base>/mcp-pat/api` | `Authorization: Bearer pat_…` |
 
 `<base>` on Dev is `https://tutorial-system-dev-tutorials-approuter.cfapps.eu10-005.hana.ondemand.com`. (Note this is the **actual CF route**, not the vanity `developers-dev.*` host — confirm the current route with `cf routes` before hardcoding.)
@@ -242,7 +270,7 @@ The `sap-devs` CLI and its bundled MCP server are a **downstream consumer** of t
 **What the owner must do**
 
 1. **Prefer PAT for the CLI.** A CLI is a headless agent — route personalized calls through `/mcp-pat/api` with a PAT minted at `/admin-ui/#pats`. Reserve `/mcp-auth/api` (interactive OAuth) for GUI clients like Claude Desktop.
-2. **Auto-discovery.** OAuth clients read `<base>/.well-known/oauth-authorization-server` and `<base>/.well-known/oauth-protected-resource` to self-configure. These are served statically by the approuter — if a client 404s on them, the approuter route order regressed (the specific static routes must precede the broad `^/.well-known/(.*)$` ORD route; guarded by `test/unit/approuter-mcp-route.test.js`).
+2. **Auto-discovery.** OAuth clients read `<base>/.well-known/oauth-authorization-server` and `<base>/.well-known/oauth-protected-resource` to self-configure. These are served by **runtime approuter middleware** (`insertMiddleware.first` in `approuter/server.js`, see [architecture/mcp-server.md § `.well-known` discovery](../architecture/mcp-server.md#well-known-discovery)) — values derive at request time from the bound XSUAA/IAS VCAP credentials and the request host. If a client 404s on them, the approuter middleware order regressed (the discovery middleware must run before the broad `^/.well-known/(.*)$` ORD route; guarded by `test/unit/approuter-mcp-route.test.js`).
 3. **Scope grant.** Interactive OAuth users need the `Tutorials MCP Users` role collection (grants `Tutorial.MCP`) — see [Granting `Tutorials MCP Users` role collection](#granting-tutorials-mcp-users-role-collection) above. PAT callers do **not** need the XSUAA scope; the PAT's own `scopes` array (`read` / `write`) governs access.
 4. **Do not depend on `@sap/`-internal MCP behavior.** The adapter is the public `@cap-js/mcp`; tool names and the `/mcp*` namespaces are stable across Phase 2→3 (Phase 3 only *adds* tools). Client configs will not need to change on the Phase 3 rollout.
 5. **Rate limits & failure modes.** Both authenticated paths converge on the same CAP handlers and rate limits as the anonymous surface — see [Rate limiting](#rate-limiting) and [Common failures](#common-failures). An expired/revoked PAT returns 401.
@@ -299,4 +327,6 @@ The `mcp_compose_fallback_total` counter is the canary for the adapter deep-impo
 
 - Adapter: [`@cap-js/mcp` on npm](https://www.npmjs.com/package/@cap-js/mcp)
 - Related memory: [[cap-graphql-shortcut-replaces-odata]] — why `@protocol:` must be a list, not a shortcut
-- Related runbook: [mta-deployment.md](mta-deployment.md) — standard deploy path
+- Related runbook: [mta-deployment.md](mta-deployment.md) — standard deploy path, incl. [§ MCP MTA (tutorials-mcp)](mta-deployment.md#mcp-mta-tutorials-mcp)
+- MCP MTA descriptors: `mta-mcp.yaml` (root), `deploy/mcp-dev.mtaext`, `deploy/mcp-prod.mtaext`
+- Architecture: [architecture/mcp-server.md](../architecture/mcp-server.md) — two-MTA topology, route-to-backend map
diff --git a/docs/developers/operations/mta-deployment.md b/docs/developers/operations/mta-deployment.md
index ed708fb4e..ff54844c2 100644
--- a/docs/developers/operations/mta-deployment.md
+++ b/docs/developers/operations/mta-deployment.md
@@ -4,21 +4,35 @@ Complete deployment procedure for standing up the tutorials-ims stack in a CF sp
 
 ## Architecture
 
+The stack is **two separately-deployed MTAs** sharing one set of service instances:
+
 ```text
-tutorials-ims MTA
-├── tutorials-db-deployer  (type: hdb — deploys CDS schema to HDI container)
-├── tutorials-srv          (type: nodejs — CAP OData/REST backend)
-└── tutorials-approuter    (type: approuter.nodejs — serves static UI + proxies to srv)
+tutorials-ims MTA  (.deploy/mta.yaml — the main MTA; OWNS the service instances)
+├── tutorials-db-deployer     (type: hdb — deploys CDS schema to HDI container)
+├── tutorials-db-qa-deployer  (type: hdb — QA channel HDI container)
+├── tutorials-srv             (type: nodejs — CAP backend; serves /mcp/*, /mcp-pat/*, /mcp-admin/*)
+├── tutorials-srv-qa          (type: nodejs — QA channel srv)
+└── tutorials-approuter       (type: approuter.nodejs — static UI + proxies to srv AND to the MCP app)
+
+tutorials-mcp MTA  (mta-mcp.yaml at repo root — the MCP microservice; ADOPTS the services above)
+└── tutorials-srv-mcp         (type: nodejs — serves ONLY the authenticated /mcp-auth/* surface)
 
-Resources (created by MTA):
+Resources (created/owned by the MAIN MTA; the MCP MTA references them as existing-service):
 ├── tutorials-hana         (HDI container — com.sap.xs.hdi-container)
 ├── tutorials-xsuaa        (XSUAA application — org.cloudfoundry.managed-service)
+├── tutorials-identity     (IAS — public PKCE client for the MCP app)
 ├── tutorials-destination  (Destination lite — org.cloudfoundry.managed-service)
+├── tutorials-credstore    (Credential Store — holds deploy-time secrets)
 ├── tutorials-mail         (optional — fails gracefully if plan unavailable)
 ├── tutorials-audit-log    (optional)
 └── tutorials-cloud-logging (optional)
 ```
 
+The approuter (main MTA) fronts both backends: `/mcp-auth/*` is proxied to the external
+`tutorials-srv-mcp` app via the `srv-mcp-api` destination (`${srv-mcp-url}`), everything else
+to the local `srv-api`. The MCP MTA creates **no** service instances of its own — it declares
+each resource as `org.cloudfoundry.existing-service` and adopts the main MTA's instances.
+
 ## Prerequisites
 
 - CF CLI logged in to target org/space
@@ -37,10 +51,11 @@ Resources (created by MTA):
 ```bash
 cd .deploy
 mbt build
-cf deploy mta_archives/tutorials-ims_1.0.0.mtar -e ../deploy/dev.mtaext
+cf deploy mta_archives/*.mtar -e ../deploy/dev.mtaext
 ```
 
-The `dev.mtaext` extension adds DEV-specific overrides (debug logging, approuter name suffix, expose CAP UI). For production, omit `-e` or provide a prod extension.
+The mtar filename carries the version from `.deploy/mta.yaml` (e.g.
+`tutorials-ims_1.33.0.mtar`); the `*.mtar` glob avoids pinning a stale version here. The `dev.mtaext` extension adds DEV-specific overrides (debug logging, approuter name suffix, expose CAP UI). For production, omit `-e` or provide a prod extension.
 
 ### Canonical app names per environment
 
@@ -66,6 +81,34 @@ The `cutover-rehearsal.cjs` orchestrator's Step 1 also asserts this invariant 
 
 **First deploy** takes ~10 minutes (HDI container creation + full schema deploy). Subsequent deploys are incremental.
 
+### MCP MTA (`tutorials-mcp`)
+
+The authenticated MCP surface (`/mcp-auth/*`) ships as a **separate MTA** (`mta-mcp.yaml` at
+repo root, module `tutorials-srv-mcp`). It is **not** part of the main MTA archive and the
+main-MTA deploy above does NOT ship `/mcp-auth/*` changes. There is **no orchestrated path** —
+`npm run deploy` / `scripts/deploy-mta.cjs` deploy only the main MTA. Deploy the MCP MTA by
+hand:
+
+```bash
+# From repo root (the descriptor's before-all runs from root, no `cd ..`)
+mbt build -e mta-mcp.yaml -t mta_archives
+cf deploy mta_archives/*.mtar -e deploy/mcp-dev.mtaext -f    # DEV
+# PROD: cf deploy mta_archives/*.mtar -e deploy/mcp-prod.mtaext -f
+```
+
+| Env | MCP MTA ext | MTA ID (ext) | Notes |
+| --- | --- | --- | --- |
+| dev | `deploy/mcp-dev.mtaext` | `tutorials-mcp-dev` | Overrides `dest-main-srv` → `tutorials-main-srv-api-dev` (DEV write-forward destination) |
+| prod | `deploy/mcp-prod.mtaext` | `tutorials-mcp-prod` | Overrides `tutorials-xsuaa` → `service-name: xsuaa-imsprod` (PROD XSUAA, xsappname `tutorials-prod`) |
+
+**Service adoption:** every `resources:` entry in `mta-mcp.yaml` is
+`org.cloudfoundry.existing-service` (`tutorials-identity`, `tutorials-xsuaa`,
+`tutorials-hana`, `tutorials-credstore`, `tutorials-destination`). The MCP MTA creates no
+instances — it binds the ones the **main MTA owns**. Deploy the main MTA first on a fresh
+space so those instances exist before the MCP MTA tries to adopt them. The approuter-side
+discovery/routing env (`srv-mcp-url`, `XSUAA_MCP_URL`, `MCP_ISSUER_KIND`) stays in the
+**main** MTA's `deploy/*.mtaext` (the approuter lives in the main MTA).
+
 ## Step 2: Populate Data (First Deploy Only)
 
 After a fresh HDI deploy, mission/group slugs are empty. The build pipeline needs slugs to generate pages.
@@ -152,10 +195,12 @@ curl -s -o /dev/null -w "%{http_code}" "$APPROUTER/tutorials/abap-dev-get-starte
 
 | File | Purpose |
 |------|---------|
-| `.deploy/mta.yaml` | Main MTA deployment descriptor |
-| `deploy/dev.mtaext` | DEV-specific extension (debug logging, app name suffix) |
+| `.deploy/mta.yaml` | Main MTA (`tutorials-ims`) deployment descriptor |
+| `mta-mcp.yaml` | MCP MTA (`tutorials-mcp`) descriptor — the separate `/mcp-auth/*` app |
+| `deploy/dev.mtaext` | Main-MTA DEV extension (debug logging, app name suffix, `srv-mcp-url`) |
+| `deploy/mcp-dev.mtaext` / `deploy/mcp-prod.mtaext` | MCP-MTA env extensions |
 | `xs-security.json` | XSUAA scopes, role templates, role collections |
-| `approuter/xs-app.json` | AppRouter route definitions |
+| `approuter/xs-app.json` | AppRouter route definitions (incl. the `/mcp-auth/*` → `srv-mcp-api` route) |
 | `.cdsrc-private.json` | Local hybrid bindings (gitignored) |
 
 ## Parallel Operation with Legacy IMS
@@ -208,6 +253,13 @@ The rename touches **two** identity domains that Cloud Foundry tracks independen
 | MTA `ID:` | `tutorials-poc` → `tutorials-ims` in `mta.yaml` and `.deploy/mta.yaml` | CF creates a NEW MTA registration. Service instances are NOT recreated because every `resources:` entry declares an explicit `service-name:` — the deployer adopts the existing `tutorials-hana`, `tutorials-xsuaa`, `tutorials-credstore`, etc. |
 | `xsappname` | `tutorials-poc` → `tutorials-ims` in `xs-security.json` and `.deploy/xs-security.json` | XSUAA service instance is **updated** (not recreated) — `cf update-service tutorials-xsuaa -c xs-security.json` flips the scope namespace. Every issued JWT scope literal changes from `tutorials-poc!t<n>.*` to `tutorials-ims!t<n>.*`. Existing role-collection bindings become empty (they reference scopes that no longer exist) and must be re-bound. |
 
+> **MCP-MTA note (post-split).** The `tutorials-poc` → `tutorials-ims` cutover below predates
+> the MCP split and touched only the main MTA. For any **future** rename of a shared service
+> (xsuaa/hana/credstore), remember the separately-deployed `tutorials-mcp` MTA adopts those
+> same instances by `service-name:` — after the main-MTA rename lands, redeploy the MCP MTA
+> (`cf deploy … -e deploy/mcp-<env>.mtaext`) so `tutorials-srv-mcp` re-binds the renamed
+> instances.
+
 ### What is and isn't safe
 
 **Safe (data preserved):**
@@ -356,7 +408,7 @@ Same procedure, scheduled into the end-of-July 2026 AEM→IMS PROD window. Diffe
 
 ### Why not `cf undeploy --delete-services` first (as the issue originally specified)?
 
-The issue's original runbook assumed renaming the MTA `ID:` forced full service-instance recreation. That's only true when `resources:` entries lack explicit `service-name:` declarations. **This codebase already declares `service-name:` on every resource** (see `.deploy/mta.yaml:211-289`), which decouples instance identity from MTA identity. The `--delete-services` flag would actively destroy HANA schemas, force a fresh HDI deploy, and require restoring data from snapshot — the destructive path is exactly what `service-name:` is designed to avoid.
+The issue's original runbook assumed renaming the MTA `ID:` forced full service-instance recreation. That's only true when `resources:` entries lack explicit `service-name:` declarations. **This codebase already declares `service-name:` on every resource** (see the `resources:` block in `.deploy/mta.yaml`), which decouples instance identity from MTA identity. The `--delete-services` flag would actively destroy HANA schemas, force a fresh HDI deploy, and require restoring data from snapshot — the destructive path is exactly what `service-name:` is designed to avoid.
 
 ### Post-cutover lessons (2026-07-03 DEV cutover incident)
 
diff --git a/docs/developers/operations/production-ready.md b/docs/developers/operations/production-ready.md
index 2715d28c2..3a4c04894 100644
--- a/docs/developers/operations/production-ready.md
+++ b/docs/developers/operations/production-ready.md
@@ -80,7 +80,7 @@ resources:
 
 Then deploy with:
 ```bash
-cf deploy mta_archives/tutorials-ims_1.0.0.mtar -e deploy/prod.mtaext
+cf deploy mta_archives/*.mtar -e deploy/prod.mtaext
 ```
 
 ---
diff --git a/docs/developers/operations/qa-channel-bootstrap.md b/docs/developers/operations/qa-channel-bootstrap.md
index 3e9e49c8f..be3d5bcb2 100644
--- a/docs/developers/operations/qa-channel-bootstrap.md
+++ b/docs/developers/operations/qa-channel-bootstrap.md
@@ -74,7 +74,7 @@ Without the QA build, `static/qa/` will be empty after `mbt build` and `/tutoria
 ```bash
 cd .deploy
 mbt build
-cf deploy mta_archives/tutorials-ims_1.0.0.mtar -e ../deploy/dev.mtaext
+cf deploy mta_archives/*.mtar -e ../deploy/dev.mtaext
 ```
 
 Both `tutorials-srv` and `tutorials-srv-qa` apps should be healthy; HDI containers `tutorials-hana` and `tutorials-hana-qa` deployed.
diff --git a/docs/end-users/mcp-quickstart.md b/docs/end-users/mcp-quickstart.md
index 41277e2d7..16c55129d 100644
--- a/docs/end-users/mcp-quickstart.md
+++ b/docs/end-users/mcp-quickstart.md
@@ -161,7 +161,7 @@ The server speaks Streamable HTTP. Clients may send `Accept: application/json` o
 
 ## Troubleshooting
 
-- **`initialize` returns 401.** You hit `/mcp-auth/*` by mistake. That namespace is reserved for Phase 2 authenticated tools; use `/mcp/*` in Phase 1.
+- **`initialize` returns 401.** You hit `/mcp-auth/*`, the **authenticated** surface — it needs an OAuth bearer (IAS/XSUAA). For the anonymous tools use `/mcp/*` (`/mcp/search`, `/mcp/homepage`, `/mcp/graph`).
 - **`tools/list` returns an empty array.** Wrong service path. Each service is mounted separately — `/mcp/search`, `/mcp/homepage`, `/mcp/graph`. There is no aggregate `/mcp` root.
 - **First response is slow (5–15s).** Cold start. The CAP backend spins down when idle. Subsequent requests are fast.
 - **Nothing returns and no error.** Anonymous IP throttle. Back off and retry.
diff --git a/docs/pilot-status.md b/docs/pilot-status.md
index c5476a02d..810335a93 100644
--- a/docs/pilot-status.md
+++ b/docs/pilot-status.md
@@ -63,7 +63,7 @@ This is the locked scope. Anything not listed is post-launch.
 
 ### Deployment
 
-- Single MTA deployment via [../.deploy/mta.yaml](../.deploy/mta.yaml) → SAP BTP Cloud Foundry (eu10-005, DevRel and Community Tools subaccount); see [mta-deployment.md](mta-deployment.md)
+- Two MTAs → SAP BTP Cloud Foundry (eu10-005, DevRel and Community Tools subaccount): the main [../.deploy/mta.yaml](../.deploy/mta.yaml) plus the separate MCP MTA [../mta-mcp.yaml](../mta-mcp.yaml) (`/mcp-auth/*`); see [mta-deployment.md](mta-deployment.md)
 - AppRouter + XSUAA + 2 HDI containers (prod + QA)
 - 3-tier testing: unit (in-memory SQLite), hybrid (real HANA via `cds bind --exec`), smoke (HTTP against deployed)
 - CI: [../.github/workflows/deploy.yml](../.github/workflows/deploy.yml), [../.github/workflows/rebuild-content.yml](../.github/workflows/rebuild-content.yml)

From b040ee0b96291522beaa090b23a889e886126aeb Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:10:22 -0400
Subject: [PATCH 14/46] feat(auth): themed two-button sign-in Hugo layout
 (#2506)

---
 hugo/layouts/signin.html | 56 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)
 create mode 100644 hugo/layouts/signin.html

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
new file mode 100644
index 000000000..484df46d2
--- /dev/null
+++ b/hugo/layouts/signin.html
@@ -0,0 +1,56 @@
+{{ define "main" }}
+<section class="signin-hero" aria-labelledby="signin-title">
+  <div class="signin-inner">
+    <ui5-illustrated-message name="tnt/Lock" design="Spot" class="signin-illus">
+      <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developers</h1>
+      <p slot="subtitle" class="signin-lede">
+        Choose how you'd like to sign in. Your progress and completions are the
+        same account whichever you pick.
+      </p>
+    </ui5-illustrated-message>
+    <div class="signin-actions">
+      <a class="fd-button fd-button--emphasized signin-btn" href="/login?sap_idp=sap.default">
+        Sign in with SAP
+      </a>
+      <a class="fd-button fd-button--transparent signin-btn" href="/login?sap_idp=sap.custom">
+        Sign in with SAP Universal ID
+      </a>
+    </div>
+  </div>
+</section>
+
+<style>
+  .signin-hero {
+    padding: 4rem 1.5rem;
+    background: var(--sapBackgroundColor, #f5f6f7);
+    min-height: 60vh;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+  }
+  .signin-inner {
+    max-width: 640px;
+    text-align: center;
+    background: var(--sapTile_Background, #ffffff);
+    padding: 3rem 2rem;
+    border-radius: 0.75rem;
+    box-shadow: 0 0.125rem 0.5rem rgba(0, 0, 0, 0.08);
+  }
+  .signin-illus { display: block; margin: 0 auto 1.25rem; max-width: 100%; }
+  .signin-title { font-size: 1.625rem; margin: 0 0 0.5rem; color: var(--sapTextColor, #32363a); }
+  .signin-lede {
+    font-size: 1rem;
+    color: var(--sapContent_LabelColor, var(--sapTextColor, #32363a));
+    margin: 0 0 1.5rem;
+  }
+  .signin-actions {
+    display: flex;
+    flex-direction: column;
+    gap: 0.75rem;
+    align-items: center;
+  }
+  .signin-btn { min-width: 16rem; justify-content: center; }
+</style>
+{{- /* ui5Split: illustration assets for <ui5-illustrated-message>, mirrors 403.html (#1777 Task 7) */}}
+{{ if and (not site.Params.previewMode) site.Params.ui5Split }}<script type="module" src="{{ partial "island-src.html" "ui5-illustrations" }}"></script>{{ end }}
+{{ end }}

From 503a96ff428ce245ed6e611a1a5688a7425841fc Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:11:52 -0400
Subject: [PATCH 15/46] docs(2595): document blockquote alert callout syntax
 for authors

---
 docs/authors/writing-tutorials.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/docs/authors/writing-tutorials.md b/docs/authors/writing-tutorials.md
index 9dd4c3b9d..72a6f80cf 100644
--- a/docs/authors/writing-tutorials.md
+++ b/docs/authors/writing-tutorials.md
@@ -280,6 +280,31 @@ for one OS, then ask the extension to "generate OS variants" — it returns tran
 macOS / Linux / BAS blocks you can review and accept inline. See the
 [VS Code extension docs](TODO: link added when plugin ships) for the workflow.
 
+### Alert callouts
+
+A plain blockquote (`>`) renders as the default blue **Information** callout.
+To signal a different kind of emphasis, start the blockquote with a
+GitHub-style alert designator on its own first line:
+
+```markdown
+> [!TIP]
+> Prefer the frontmatter `video:` field over an inline iframe.
+```
+
+| You write | Rendered emphasis | Color |
+|---|---|---|
+| `> text` (no designator) | Information (default) | blue |
+| `> [!NOTE]` | Information | blue |
+| `> [!IMPORTANT]` | Information | blue |
+| `> [!TIP]` | Success | green |
+| `> [!WARNING]` | Warning | amber |
+| `> [!CAUTION]` | Error | red |
+
+Pick the designator by *intent*, not loudness: use `[!TIP]` for helpful
+asides, `[!WARNING]`/`[!CAUTION]` only for genuine risk. An ordinary
+"additional note" can stay a plain `>` (blue) or use `[!NOTE]`. The callout is
+color-only — there is no icon or heading label.
+
 ### 3.6 Code blocks
 
 Use fenced code blocks with a language tag. Supported languages include `abap`, `js`, `ts`, `java`, `cds`, `sql`, `bash`, `yaml`, `json`, `xml`, `html`, `css`. CDS code uses dedicated highlighting (see `npm run build:highlight`).

From 5030da4c97f81e1bcc4bb61fdf74672d8fcdc3ea Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:14:33 -0400
Subject: [PATCH 16/46] =?UTF-8?q?content:=20rename=20SAP=20BTP=20=E2=86=92?=
 =?UTF-8?q?=20SAP=20Business=20AI=20Platform=20in=20user-facing=20strings?=
 =?UTF-8?q?=20(#2588)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'SAP Business Technology Platform' / 'SAP BTP' / 'BTP' name is retired
in favour of 'SAP Business AI Platform' (never abbreviated 'BAIP').

Renames user-facing prose in this repo's own authored content only:
Hugo site/layout strings, Joule starter prompts, admin-UI help/labels,
event-stream ticker labels, api-docs.yaml service titles/descriptions,
and the KTT acronym-quiz content. The BTP quiz entry now teaches the
retired name; the existing BAIP entry is kept (abbreviation permitted
only inside the three-letter-acronym quiz).

Technical identifiers are intentionally left untouched: the btp CLI,
AICore-btp binding, BTP_ROLES_* env vars, cockpit.btp.cloud.sap URLs,
sourceId/category identifiers, CSS --btp-* tokens, tag slugs, package
names.

Out of scope (per issue triage): generated/overwritten content
(hugo/content/tutorials/, public/, caches), generated hugo/data/*.json,
internal docs/, and reader-facing tutorial body prose (sourced from the
external sap-tutorials/* repos — needs separate upstream PRs).
---
 app/admin-shell/webapp/model/navigation.json  |  2 +-
 app/admin/joule/webapp/i18n/i18n.properties   |  4 +-
 app/admin/joule/webapp/view/Settings.view.xml |  2 +-
 .../puzzles/webapp/view/Builder.view.xml      |  2 +-
 app/admin/secrets/webapp/i18n/i18n.properties |  2 +-
 .../webapp/view/SecretDialog.fragment.xml     |  2 +-
 app/display-app/src/event-stream.ts           |  2 +-
 db/data/api-docs.yaml                         | 60 ++++++++--------
 hugo-apps/src/event-display/useEventStream.ts |  2 +-
 hugo/content/api-docs/_index.md               |  2 +-
 hugo/content/api-docs/graphql/_index.md       |  4 +-
 hugo/content/cookies.md                       |  2 +-
 hugo/content/operate/_index.md                |  2 +-
 hugo/content/u9-glossary-demo.md              | 12 ++--
 hugo/hugo.toml                                |  2 +-
 hugo/layouts/_default/llms.txt                |  2 +-
 hugo/layouts/_default/sitemapmd.md            |  2 +-
 hugo/layouts/_default/terms.html              |  2 +-
 hugo/layouts/explore/about.html               |  4 +-
 hugo/layouts/partials/joule-starters.html     | 20 +++---
 .../verb-extras/btp-service-catalog.html      |  4 +-
 hugo/static/AGENTS.md                         |  4 +-
 scripts/generate-ktt-lessons.ts               | 68 +++++++++----------
 23 files changed, 105 insertions(+), 103 deletions(-)

diff --git a/app/admin-shell/webapp/model/navigation.json b/app/admin-shell/webapp/model/navigation.json
index 2612410f8..5dce31908 100644
--- a/app/admin-shell/webapp/model/navigation.json
+++ b/app/admin-shell/webapp/model/navigation.json
@@ -154,7 +154,7 @@
       "requiredScope": "Admin",
       "items": [
         { "key": "baipAiLaunchpad", "title": "AI Launchpad", "href": "https://tutorial-system.ai-launchpad.prod.eu-central-1.aws.ai-prod.cloud.sap/aic/index.html", "target": "_blank", "requiredScope": "Admin" },
-        { "key": "baipBtpSubaccount", "title": "BTP Subaccount", "href": "https://emea.cockpit.btp.cloud.sap/cockpit/#/globalaccount/a0ec0d63-f690-42ab-8113-9f6567cd897e/subaccount/3c6fa3f1-db8c-4e47-9048-fa8c84b867cb/subaccountoverview", "target": "_blank", "requiredScope": "Admin" },
+        { "key": "baipBtpSubaccount", "title": "SAP Business AI Platform Subaccount", "href": "https://emea.cockpit.btp.cloud.sap/cockpit/#/globalaccount/a0ec0d63-f690-42ab-8113-9f6567cd897e/subaccount/3c6fa3f1-db8c-4e47-9048-fa8c84b867cb/subaccountoverview", "target": "_blank", "requiredScope": "Admin" },
         { "key": "baipHanaCloud", "title": "HANA Cloud", "href": "https://devrel.hana-tooling.ingress.orchestration.prod-eu10.hanacloud.ondemand.com/hcs/sap/hana/cloud/index.html", "target": "_blank", "requiredScope": "Admin" },
         { "key": "baipIasAdminConsole", "title": "IAS Admin Console", "href": "https://atxgsg7zi.accounts.ondemand.com/admin/#/applications/17b636dd-fa87-4cd8-b0f2-0abd5f9a3042", "target": "_blank", "requiredScope": "Admin" }
       ]
diff --git a/app/admin/joule/webapp/i18n/i18n.properties b/app/admin/joule/webapp/i18n/i18n.properties
index ad2610c07..9cc21f8f7 100644
--- a/app/admin/joule/webapp/i18n/i18n.properties
+++ b/app/admin/joule/webapp/i18n/i18n.properties
@@ -72,6 +72,6 @@ a2aTokenUrlPlaceholder=XSUAA token endpoint advertised in the Agent Card
 
 alertsSection=Operational Alerting (SAP Alert Notification)
 alertsEnabled=Enable ANS push alerts
-alertsEnabledHelp=Master switch for SAP Alert Notification push alerts (publish-reject, scheduled-job failures, rebuild-dispatch failures). Off (default) = no alerts sent. Requires the ANS email action to be configured in the BTP cockpit first. DB-backed — takes effect live, no redeploy needed.
+alertsEnabledHelp=Master switch for SAP Alert Notification push alerts (publish-reject, scheduled-job failures, rebuild-dispatch failures). Off (default) = no alerts sent. Requires the ANS email action to be configured in the SAP Business AI Platform cockpit first. DB-backed — takes effect live, no redeploy needed.
 sendTestAlertButton=Send test alert
-sendTestAlertHelp=Fires a TEST alert (eventType AlertingTest) through the real ANS code path so you can confirm end-to-end delivery on demand. Enable ANS push alerts above and click Save FIRST — the toggle only takes effect after saving (a ~5s server cache). A delivered result means the code path fired; the email also needs an AlertingTest condition wired in the BTP cockpit for the target environment.
+sendTestAlertHelp=Fires a TEST alert (eventType AlertingTest) through the real ANS code path so you can confirm end-to-end delivery on demand. Enable ANS push alerts above and click Save FIRST — the toggle only takes effect after saving (a ~5s server cache). A delivered result means the code path fired; the email also needs an AlertingTest condition wired in the SAP Business AI Platform cockpit for the target environment.
diff --git a/app/admin/joule/webapp/view/Settings.view.xml b/app/admin/joule/webapp/view/Settings.view.xml
index 39b617e1e..944ab7f88 100644
--- a/app/admin/joule/webapp/view/Settings.view.xml
+++ b/app/admin/joule/webapp/view/Settings.view.xml
@@ -191,7 +191,7 @@
            scheduled-job failures, and rebuild-dispatch failures
            (srv/lib/alerting.js, resolved via srv/lib/runtime-config/alert-settings.js).
            DB-backed (no env var) so ops can toggle live without a restart. The ANS
-           email action must be configured in the BTP cockpit first, else alerts
+           email action must be configured in the SAP Business AI Platform cockpit first, else alerts
            have nowhere to go. Rollback by flipping this back off — no redeploy. -->
       <Panel headerText="{i18n>alertsSection}" expandable="true" expanded="true" class="sapUiSmallMarginBottom">
         <f:SimpleForm editable="true" layout="ResponsiveGridLayout">
diff --git a/app/admin/puzzles/webapp/view/Builder.view.xml b/app/admin/puzzles/webapp/view/Builder.view.xml
index 4b10b48c5..01355a355 100644
--- a/app/admin/puzzles/webapp/view/Builder.view.xml
+++ b/app/admin/puzzles/webapp/view/Builder.view.xml
@@ -53,7 +53,7 @@
         <FlexBox wrap="Wrap" class="sapUiSmallMarginBottom" alignItems="End">
           <VBox width="16rem" class="sapUiSmallMarginEnd sapUiSmallMarginBottom">
             <Label text="Title" required="true"/>
-            <Input id="titleInput" value="{b>/title}" placeholder="e.g. SAP BTP Basics"/>
+            <Input id="titleInput" value="{b>/title}" placeholder="e.g. SAP Business AI Platform Basics"/>
           </VBox>
           <VBox width="16rem" class="sapUiSmallMarginEnd sapUiSmallMarginBottom">
             <Label text="Slug" required="true"/>
diff --git a/app/admin/secrets/webapp/i18n/i18n.properties b/app/admin/secrets/webapp/i18n/i18n.properties
index 89e94c863..d7695cda1 100644
--- a/app/admin/secrets/webapp/i18n/i18n.properties
+++ b/app/admin/secrets/webapp/i18n/i18n.properties
@@ -1,7 +1,7 @@
 appTitle=Secrets Inventory
 pageTitle=Secrets Inventory
 tableTitle=Tracked Secrets
-infoStrip=Encrypted values are stored in the BTP Credential Store and read at runtime by tutorials-srv. Use "Set value" / "Rotate" / "Clear" to manage. The cached read-token TTL is 5 min, but changes here flush the cache immediately. Daily expiry-check cron at 04:11 UTC surfaces warnings via the notifications popover (bell icon).
+infoStrip=Encrypted values are stored in the SAP Business AI Platform Credential Store and read at runtime by tutorials-srv. Use "Set value" / "Rotate" / "Clear" to manage. The cached read-token TTL is 5 min, but changes here flush the cache immediately. Daily expiry-check cron at 04:11 UTC surfaces warnings via the notifications popover (bell icon).
 colKey=Key
 colValue=Value
 colKind=Kind
diff --git a/app/admin/secrets/webapp/view/SecretDialog.fragment.xml b/app/admin/secrets/webapp/view/SecretDialog.fragment.xml
index d777cc0c6..6cc200360 100644
--- a/app/admin/secrets/webapp/view/SecretDialog.fragment.xml
+++ b/app/admin/secrets/webapp/view/SecretDialog.fragment.xml
@@ -18,7 +18,7 @@
         <core:Item key="content-api-key" text="Content API Key" />
         <core:Item key="salt" text="Salt / hash secret" />
         <core:Item key="smtp-credential" text="SMTP credential" />
-        <core:Item key="service-key" text="BTP service key" />
+        <core:Item key="service-key" text="SAP Business AI Platform service key" />
         <core:Item key="other" text="Other" />
       </ComboBox>
       <Label text="{i18n>fieldRotationOwner}" />
diff --git a/app/display-app/src/event-stream.ts b/app/display-app/src/event-stream.ts
index e1115e2f0..19019ba5d 100644
--- a/app/display-app/src/event-stream.ts
+++ b/app/display-app/src/event-stream.ts
@@ -15,7 +15,7 @@ export interface RecentEvent {
 export type ConnectionState = 'idle' | 'connecting' | 'connected' | 'reconnecting' | 'error'
 
 const DEMO_TAGS = [
-  'SAP BTP', 'SAP HANA Cloud', 'SAP Fiori', 'SAP Build',
+  'SAP Business AI Platform', 'SAP HANA Cloud', 'SAP Fiori', 'SAP Build',
   'SAP Integration Suite', 'SAP Analytics Cloud', 'ABAP Cloud',
   'SAP AI Core', 'SAP CAP', 'SAP Mobile',
 ]
diff --git a/db/data/api-docs.yaml b/db/data/api-docs.yaml
index b152414ed..c0b027da4 100644
--- a/db/data/api-docs.yaml
+++ b/db/data/api-docs.yaml
@@ -6,7 +6,7 @@
 # Coverage matrix (per spec §7.1):
 #   - CAP (8) — framework reference + cloud-sdk + cds
 #   - S/4HANA Cloud (15) — public OData v2 APIs (Business Partner, Sales Order, etc.)
-#   - BTP services (15) — Connectivity, Destination, Identity Authentication, Audit Log, etc.
+#   - SAP Business AI Platform services (15) — Connectivity, Destination, Identity Authentication, Audit Log, etc.
 #   - SAP Build / Workflow / Process Automation (4)
 #   - Integration Suite (5) — Cloud Integration, Open Connectors, API Management
 #   - Cloud SDK (4) — Java + JavaScript
@@ -242,32 +242,32 @@
   apiType: odata-v2
 
 # ============================================================================
-# BTP Services
+# SAP Business AI Platform Services
 # ============================================================================
 
 - sourceId: SAP_Cloud_Connector_Connectivity
-  title: SAP BTP — Connectivity Service API
+  title: SAP Business AI Platform — Connectivity Service API
   url: https://api.sap.com/package/SAPBTPConnectivityService
   description: |
-    REST API and SDK for the SAP BTP Connectivity Service. Manage Cloud
+    REST API and SDK for the SAP Business AI Platform Connectivity Service. Manage Cloud
     Connector tunnels, on-premise system mappings, and principal propagation
     configuration. Used to reach S/4HANA or other on-premise systems from
-    BTP-hosted applications.
+    SAP Business AI Platform-hosted applications.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_Destination_Service
-  title: SAP BTP — Destination Service API
+  title: SAP Business AI Platform — Destination Service API
   url: https://api.sap.com/package/SAPBTPDestinationService
   description: |
-    REST API for the SAP BTP Destination Service. Configure HTTP, RFC, or
+    REST API for the SAP Business AI Platform Destination Service. Configure HTTP, RFC, or
     MAIL destinations with authentication tokens, certificates, and
     location-based routing. Consumed by approuter and CAP applications.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_XSUAA_Authorization
-  title: SAP BTP — XSUAA Authentication & Authorization
+  title: SAP Business AI Platform — XSUAA Authentication & Authorization
   url: https://api.sap.com/package/SAPXSUAA
   description: |
     Reference for the XSUAA service (Cloud Foundry UAA fork). Covers JWT
@@ -282,62 +282,62 @@
   description: |
     REST API for the SAP Cloud Identity Services — Identity Authentication
     (IAS). Manage users, groups, SAML/OIDC trust configurations, and
-    branding. Used as the primary IdP for SAP BTP applications.
+    branding. Used as the primary IdP for SAP Business AI Platform applications.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_AuditLog
-  title: SAP BTP — Audit Log Service
+  title: SAP Business AI Platform — Audit Log Service
   url: https://api.sap.com/package/SAPAuditLogService
   description: |
-    REST API for the SAP BTP Audit Log Service. Write security events,
+    REST API for the SAP Business AI Platform Audit Log Service. Write security events,
     personal-data accesses, and configuration changes. Reads via the Audit
     Log Retrieval API.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_Credstore
-  title: SAP BTP — Credential Store Service
+  title: SAP Business AI Platform — Credential Store Service
   url: https://api.sap.com/package/SAPCredstore
   description: |
-    REST API for the SAP BTP Credential Store. Securely store, rotate,
+    REST API for the SAP Business AI Platform Credential Store. Securely store, rotate,
     and retrieve secrets (passwords, keys, OAuth tokens) for applications
     bound to a credstore service instance. Supports JWE-encrypted payloads.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_AlertNotification
-  title: SAP BTP — Alert Notification Service
+  title: SAP Business AI Platform — Alert Notification Service
   url: https://api.sap.com/package/SAPAlertNotificationService
   description: |
-    REST API for the SAP BTP Alert Notification Service. Send operational
+    REST API for the SAP Business AI Platform Alert Notification Service. Send operational
     events to channels (email, Slack, webhook, ServiceNow) with subscription
     + filter management.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_FeatureFlags
-  title: SAP BTP — Feature Flags Service
+  title: SAP Business AI Platform — Feature Flags Service
   url: https://api.sap.com/package/SAPFeatureFlagsService
   description: |
-    REST API for the SAP BTP Feature Flags service. Define boolean and
+    REST API for the SAP Business AI Platform Feature Flags service. Define boolean and
     string-typed flags with rollout rules; consume via the SAP Cloud SDK
     or direct REST.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_BusinessRules
-  title: SAP BTP — Business Rules Service
+  title: SAP Business AI Platform — Business Rules Service
   url: https://api.sap.com/package/SAPBusinessRulesService
   description: |
-    REST API for the SAP BTP Business Rules service. Author decision
+    REST API for the SAP Business AI Platform Business Rules service. Author decision
     tables and rule sets in the rules editor; execute via runtime API
     from CAP or other applications.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_DocumentInformation
-  title: SAP BTP — Document Information Extraction
+  title: SAP Business AI Platform — Document Information Extraction
   url: https://api.sap.com/package/SAPDocumentInformationExtraction
   description: |
     REST API for the Document Information Extraction service. Submit PDFs
@@ -347,19 +347,19 @@
   apiType: rest
 
 - sourceId: SAP_BTP_DocumentClassification
-  title: SAP BTP — Document Classification
+  title: SAP Business AI Platform — Document Classification
   url: https://api.sap.com/package/SAPDocumentClassification
   description: |
-    REST API for the SAP BTP Document Classification service. Submit
+    REST API for the SAP Business AI Platform Document Classification service. Submit
     documents for ML-driven classification into custom-trained categories.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_PrintService
-  title: SAP BTP — Print Service
+  title: SAP Business AI Platform — Print Service
   url: https://api.sap.com/package/SAPPrintService
   description: |
-    REST API for the SAP BTP Print Service. Submit print jobs to network
+    REST API for the SAP Business AI Platform Print Service. Submit print jobs to network
     printers via SAP-managed queue infrastructure.
   category: BTP
   apiType: rest
@@ -374,17 +374,17 @@
   apiType: rest
 
 - sourceId: SAP_BTP_Mobile_Services
-  title: SAP BTP — Mobile Services API
+  title: SAP Business AI Platform — Mobile Services API
   url: https://api.sap.com/package/SAPMobileServices
   description: |
-    REST API and SDK for SAP BTP Mobile Services. Manage mobile app
+    REST API and SDK for SAP Business AI Platform Mobile Services. Manage mobile app
     registrations, push-notification dispatch, offline OData sync, and
     feature flags scoped per-app.
   category: BTP
   apiType: rest
 
 - sourceId: SAP_BTP_HtmlSrv
-  title: SAP BTP — HTML5 Application Repository Service
+  title: SAP Business AI Platform — HTML5 Application Repository Service
   url: https://api.sap.com/package/SAPHTMLApplicationRepositoryService
   description: |
     REST API for managing static HTML5 application bundles deployed via
@@ -422,7 +422,7 @@
   description: |
     Reference for the SAP Build Apps (formerly AppGyver) runtime. Covers
     Composer Pro logic, data resources, REST integration patterns, and
-    deployment via SAP BTP.
+    deployment via SAP Business AI Platform.
   category: SAP Build
   apiType: reference
 
@@ -474,7 +474,7 @@
   description: |
     REST and AMQP 1.0 API for SAP Event Mesh. Publish events on topics,
     create durable queues, manage subscriptions, and consume via push or
-    pull. Foundation for event-driven architecture on BTP.
+    pull. Foundation for event-driven architecture on SAP Business AI Platform.
   category: Integration Suite
   apiType: rest
 
@@ -584,7 +584,7 @@
   url: https://api.sap.com/package/SAPJouleAgent
   description: |
     Reference for the SAP Joule agent framework. Build composite agents
-    that orchestrate skills, retrieve context from BTP services, and
+    that orchestrate skills, retrieve context from SAP Business AI Platform services, and
     converse with users via the Joule shell or embedded experiences.
   category: AI
   apiType: reference
diff --git a/hugo-apps/src/event-display/useEventStream.ts b/hugo-apps/src/event-display/useEventStream.ts
index 098c5bb17..cc839b23e 100644
--- a/hugo-apps/src/event-display/useEventStream.ts
+++ b/hugo-apps/src/event-display/useEventStream.ts
@@ -10,7 +10,7 @@ export interface Bucket {
 export type ConnectionState = 'idle' | 'connecting' | 'connected' | 'reconnecting' | 'error'
 
 const DEMO_TAGS = [
-  'SAP BTP', 'SAP HANA Cloud', 'SAP Fiori', 'SAP Build',
+  'SAP Business AI Platform', 'SAP HANA Cloud', 'SAP Fiori', 'SAP Build',
   'SAP Integration Suite', 'SAP Analytics Cloud', 'ABAP Cloud',
   'SAP AI Core', 'SAP CAP', 'SAP Mobile',
 ]
diff --git a/hugo/content/api-docs/_index.md b/hugo/content/api-docs/_index.md
index f6d375437..f42df1299 100644
--- a/hugo/content/api-docs/_index.md
+++ b/hugo/content/api-docs/_index.md
@@ -32,7 +32,7 @@ These exist and are documented, but require elevated XSUAA scopes (`Tutorial.Aut
 
 ## sap-devs CLI
 
-`sap-devs` is a companion CLI that bundles the same SAP developer content and context this site consumes — CAP / BTP / ABAP tips, canonical code samples, error lookups, tutorial search, event listings, and more — so you can get to it without leaving your terminal.
+`sap-devs` is a companion CLI that bundles the same SAP developer content and context this site consumes — CAP / SAP Business AI Platform / ABAP tips, canonical code samples, error lookups, tutorial search, event listings, and more — so you can get to it without leaving your terminal.
 
 **Install** — the CLI ships as a self-contained binary (it's no longer published to npm). Pick your platform:
 
diff --git a/hugo/content/api-docs/graphql/_index.md b/hugo/content/api-docs/graphql/_index.md
index 255a936c3..ac013ef7e 100644
--- a/hugo/content/api-docs/graphql/_index.md
+++ b/hugo/content/api-docs/graphql/_index.md
@@ -56,9 +56,9 @@ Requires a service key on the tutorials XSUAA instance. Request one through the
 
 ## Prerequisite: Role Collection Assignment
 
-The `Tutorial.API` scope is only granted to identities assigned the **Tutorials API Consumer** role collection in your BTP subaccount. Ask a subaccount administrator to:
+The `Tutorial.API` scope is only granted to identities assigned the **Tutorials API Consumer** role collection in your SAP Business AI Platform subaccount. Ask a subaccount administrator to:
 
-1. Open the [BTP cockpit](https://cockpit.btp.cloud.sap) → your subaccount → **Security** → **Role Collections**.
+1. Open the [SAP Business AI Platform cockpit](https://cockpit.btp.cloud.sap) → your subaccount → **Security** → **Role Collections**.
 2. Locate the `Tutorials API Consumer` role collection (auto-created by the tutorials MTA deploy).
 3. Assign your identity (via **User** or **Identity Provider** tab).
 
diff --git a/hugo/content/cookies.md b/hugo/content/cookies.md
index 59c48063b..43ac938af 100644
--- a/hugo/content/cookies.md
+++ b/hugo/content/cookies.md
@@ -33,7 +33,7 @@ required cookies.
 | Name | Purpose | Set by | Duration |
 | --- | --- | --- | --- |
 | Session cookie (XSUAA) | Keeps you signed in after you log in with your SAP account | SAP Application Router (XSUAA) | Session |
-| Routing cookie (`__VCAP_ID__`) | Routes your requests to the same backend instance for stable sessions | SAP BTP Cloud Foundry router | Session |
+| Routing cookie (`__VCAP_ID__`) | Routes your requests to the same backend instance for stable sessions | SAP Business AI Platform Cloud Foundry router | Session |
 | SAP Identity Provider cookies | Set during the login flow when you authenticate with your SAP account | `accounts.sap.com` | Session / persistent — see the [SAP Trust Center privacy statement](https://www.sap.com/about/legal/privacy.html) |
 
 ### Functional {#functional}
diff --git a/hugo/content/operate/_index.md b/hugo/content/operate/_index.md
index d6673a715..647b1b04e 100644
--- a/hugo/content/operate/_index.md
+++ b/hugo/content/operate/_index.md
@@ -1,6 +1,6 @@
 ---
 title: "Operate"
-description: "Run, deploy, secure, and govern what you build on BTP."
+description: "Run, deploy, secure, and govern what you build on SAP Business AI Platform."
 type: "verb"
 layout: "list"
 verbKey: "OPERATE"
diff --git a/hugo/content/u9-glossary-demo.md b/hugo/content/u9-glossary-demo.md
index adc07e03a..b301e1995 100644
--- a/hugo/content/u9-glossary-demo.md
+++ b/hugo/content/u9-glossary-demo.md
@@ -18,9 +18,10 @@ body copy stays readable.
 ## What's covered
 
 This site teaches developers how to build cloud-native business apps on SAP
-BTP. The default stack is CAP — the SAP Cloud Application Programming Model —
-which leans on CDS for data and service modeling. ABAP developers building
-on S/4HANA Cloud will instead reach for RAP, the ABAP-side equivalent.
+Business AI Platform. The default stack is CAP — the SAP Cloud Application
+Programming Model — which leans on CDS for data and service modeling. ABAP
+developers building on S/4HANA Cloud will instead reach for RAP, the ABAP-side
+equivalent.
 
 ## Deployment story
 
@@ -28,11 +29,12 @@ Production apps ship as an MTA (multitarget application) bundle pushed to
 Cloud Foundry. The deployment binds an XSUAA instance for authentication, an
 HDI container for HANA schema isolation, and optionally an IAS tenant when
 the customer has a corporate IDP they want to federate against. The HANA
-database itself runs as a managed BTP service — no infrastructure to babysit.
+database itself runs as a managed SAP Business AI Platform service — no
+infrastructure to babysit.
 
 ## What you don't pay for
 
-Note how each acronym in this paragraph (BTP, CAP, CDS, RAP, MTA, XSUAA, HDI,
+Note how each acronym in this paragraph (CAP, CDS, RAP, MTA, XSUAA, HDI,
 IAS, IDP, HANA) appears underlined only on its *first* mention above. The
 second mention here renders as plain text — that's the "tag only the first
 occurrence per page" policy.
diff --git a/hugo/hugo.toml b/hugo/hugo.toml
index 6a9e35408..b66c9eca7 100644
--- a/hugo/hugo.toml
+++ b/hugo/hugo.toml
@@ -11,7 +11,7 @@ enableRobotsTXT = false  # we ship our own via the robots output format
   # instead of the monolithic ui5-bootstrap.ts bundle. Flag OFF by default; flip to
   # true once the split entries are validated. (#1777 Task 7)
   ui5Split = false
-  defaultDescription = 'Hands-on tutorials for SAP technologies — SAP BTP, ABAP Cloud, CAP, Fiori, HANA Cloud, and integration. Build, learn, and ship on SAP.'
+  defaultDescription = 'Hands-on tutorials for SAP technologies — SAP Business AI Platform, ABAP Cloud, CAP, Fiori, HANA Cloud, and integration. Build, learn, and ship on SAP.'
   heroDescription = 'Step-by-step tutorials, multi-tutorial missions, and reference content for every SAP developer technology. Tested, maintained, and free to use.'
   twitterHandle = '@sapdevs'
   defaultOgImage = '/img/og-default.png'
diff --git a/hugo/layouts/_default/llms.txt b/hugo/layouts/_default/llms.txt
index 7f73eb912..50f253bc7 100644
--- a/hugo/layouts/_default/llms.txt
+++ b/hugo/layouts/_default/llms.txt
@@ -1,6 +1,6 @@
 # SAP Developers Tutorials
 
-> Official tutorial platform for SAP technologies. Step-by-step tutorials, missions (multi-tutorial learning paths), and reference content for SAP BTP, ABAP Cloud, CAP, Fiori, HANA Cloud, and integration.
+> Official tutorial platform for SAP technologies. Step-by-step tutorials, missions (multi-tutorial learning paths), and reference content for SAP Business AI Platform, ABAP Cloud, CAP, Fiori, HANA Cloud, and integration.
 
 Content policy: Citation in AI search and answer use cases is welcome. Use for model training is not.
 See https://developers.sap.com/AGENTS.md.
diff --git a/hugo/layouts/_default/sitemapmd.md b/hugo/layouts/_default/sitemapmd.md
index 25138fd72..b45c3b28d 100644
--- a/hugo/layouts/_default/sitemapmd.md
+++ b/hugo/layouts/_default/sitemapmd.md
@@ -5,7 +5,7 @@
      falls back to linking the /missions/ index, like llms.txt. */ -}}
 # SAP Developers Tutorials — Site Map
 
-> Official tutorial platform for SAP technologies. Step-by-step tutorials, missions (multi-tutorial learning paths), and reference content for SAP BTP, ABAP Cloud, CAP, Fiori, HANA Cloud, and integration.
+> Official tutorial platform for SAP technologies. Step-by-step tutorials, missions (multi-tutorial learning paths), and reference content for SAP Business AI Platform, ABAP Cloud, CAP, Fiori, HANA Cloud, and integration.
 
 Semantic site map mirroring the site's navigation, with missions expanded to their ordered tutorials.
 
diff --git a/hugo/layouts/_default/terms.html b/hugo/layouts/_default/terms.html
index eb6e39025..644886e1a 100644
--- a/hugo/layouts/_default/terms.html
+++ b/hugo/layouts/_default/terms.html
@@ -2,7 +2,7 @@
 <article class="taxonomy-terms">
   <header class="taxonomy-terms__header">
     <h1>{{ .Title }}</h1>
-    <p class="lede">Browse SAP developer tutorials by topic. {{ len .Data.Terms }} topics cover everything from ABAP to BTP, CAP, Fiori, HANA Cloud, and integration.</p>
+    <p class="lede">Browse SAP developer tutorials by topic. {{ len .Data.Terms }} topics cover everything from ABAP to SAP Business AI Platform, CAP, Fiori, HANA Cloud, and integration.</p>
   </header>
 
   <ul class="taxonomy-terms__list">
diff --git a/hugo/layouts/explore/about.html b/hugo/layouts/explore/about.html
index a9fac9312..312476407 100644
--- a/hugo/layouts/explore/about.html
+++ b/hugo/layouts/explore/about.html
@@ -51,7 +51,7 @@ <h2 id="kg-arch">How it's built</h2>
           <a href="https://learning.sap.com" target="_blank" rel="noopener">learning.sap.com</a>,
           <strong>blog posts</strong> from the
           <a href="https://community.sap.com" target="_blank" rel="noopener">SAP Community</a>,
-          <strong>Discovery Center missions and BTP services</strong> from
+          <strong>Discovery Center missions and SAP Business AI Platform services</strong> from
           <a href="https://discovery-center.cloud.sap" target="_blank" rel="noopener">discovery-center.cloud.sap</a>,
           <strong>videos</strong> from the
           <a href="https://youtube.com/@sapdevs" target="_blank" rel="noopener">SAP Developers YouTube channel</a>
@@ -152,7 +152,7 @@ <h3>SAP Cloud Application Programming Model (CAP)</h3>
         <p>Service layer, scheduler, and the cron jobs that build the graph.</p>
       </a>
       <a class="kg-overview__tech-badge" href="https://help.sap.com/docs/btp/sap-business-technology-platform/cloud-foundry-environment" target="_blank" rel="noopener">
-        <h3>SAP BTP Cloud Foundry</h3>
+        <h3>SAP Business AI Platform Cloud Foundry</h3>
         <p>The runtime.</p>
       </a>
       <p class="kg-overview__tech-callout">
diff --git a/hugo/layouts/partials/joule-starters.html b/hugo/layouts/partials/joule-starters.html
index 519ec8dfd..146542d62 100644
--- a/hugo/layouts/partials/joule-starters.html
+++ b/hugo/layouts/partials/joule-starters.html
@@ -18,14 +18,14 @@
   ],
   "homepage": [
     "I'm a long-time ABAP developer catching up on cloud — where do I start?",
-    "Where can I find SAP BTP AI best practices?",
+    "Where can I find SAP Business AI Platform best practices?",
     "Which SAP developer destination covers the Business Accelerator Hub APIs?",
     "What's the difference between SAP Build, Build Code, and Build Apps?"
   ],
   "tutorial-navigator": [
     "Find me a CAP getting-started tutorial.",
     "Show me ABAP Cloud tutorials for beginners.",
-    "What missions cover SAP BTP?"
+    "What missions cover SAP Business AI Platform?"
   ],
   "verb-learn": [
     "I'm new to SAP cloud development — which learning journey should I start with?",
@@ -39,16 +39,16 @@
   ],
   "verb-integrate": [
     "Where can I browse SAP business APIs?",
-    "Which BTP service handles eventing between SAP and non-SAP systems?",
-    "How do I set up an API destination on BTP?"
+    "Which SAP Business AI Platform service handles eventing between SAP and non-SAP systems?",
+    "How do I set up an API destination on SAP Business AI Platform?"
   ],
   "verb-operate": [
-    "How do I log into the BTP Cockpit?",
-    "Where is the BTP Discovery Center service catalog?",
-    "Which CLI manages BTP subaccounts and entitlements?"
+    "How do I log into the SAP Business AI Platform cockpit?",
+    "Where is the SAP Business AI Platform Discovery Center service catalog?",
+    "Which CLI manages SAP Business AI Platform subaccounts and entitlements?"
   ],
   "verb-ai": [
-    "Where are the SAP BTP AI best practices?",
+    "Where are the SAP Business AI Platform best practices?",
     "How do I build a Joule extension?",
     "Show me the SAP AI Core documentation."
   ],
@@ -60,7 +60,7 @@
   "search": [
     "Find me a CAP getting-started tutorial.",
     "Show me ABAP Cloud tutorials for beginners.",
-    "What missions cover SAP BTP?"
+    "What missions cover SAP Business AI Platform?"
   ],
   "mission": [
     "Explain this mission's path.",
@@ -78,7 +78,7 @@
     "Where is Thomas Jung based and what does he focus on?"
   ],
   "generic": [
-    "What's new in SAP BTP?",
+    "What's new in SAP Business AI Platform?",
     "Help me find a tutorial.",
     "Explain CAP in 30 seconds."
   ]
diff --git a/hugo/layouts/partials/verb-extras/btp-service-catalog.html b/hugo/layouts/partials/verb-extras/btp-service-catalog.html
index ccf14b06d..a8d7a52d1 100644
--- a/hugo/layouts/partials/verb-extras/btp-service-catalog.html
+++ b/hugo/layouts/partials/verb-extras/btp-service-catalog.html
@@ -3,8 +3,8 @@
        Single hero link card to the SAP Discovery Center service catalog.
 */ -}}
 <section class="verb-extra verb-extra--btp-catalog">
-  <h2>BTP service catalog</h2>
-  <p>Browse every service available on SAP Business Technology Platform with pricing, regions, and guided missions.</p>
+  <h2>SAP Business AI Platform service catalog</h2>
+  <p>Browse every service available on SAP Business AI Platform with pricing, regions, and guided missions.</p>
   <a class="verb-extra__cta" href="https://discovery-center.cloud.sap" target="_blank" rel="noopener">
     Open Discovery Center →
   </a>
diff --git a/hugo/static/AGENTS.md b/hugo/static/AGENTS.md
index 624684f73..cda473978 100644
--- a/hugo/static/AGENTS.md
+++ b/hugo/static/AGENTS.md
@@ -4,7 +4,7 @@ You are reading this because you're an AI assistant or scraper visiting **SAP De
 
 ## Who we are
 
-SAP Developers Tutorials is the official tutorial platform for SAP technologies, run by SAP SE. The catalog covers SAP BTP, ABAP Cloud, CAP, Fiori, HANA Cloud, integration, and related technologies. All content is authored by SAP and SAP-community contributors.
+SAP Developers Tutorials is the official tutorial platform for SAP technologies, run by SAP SE. The catalog covers SAP Business AI Platform, ABAP Cloud, CAP, Fiori, HANA Cloud, integration, and related technologies. All content is authored by SAP and SAP-community contributors.
 
 ## What we'd like you to do
 
@@ -23,7 +23,7 @@ SAP Developers Tutorials is the official tutorial platform for SAP technologies,
 ## Authoritative sources we recommend
 
 - For SAP product docs: https://help.sap.com/
-- For BTP services: https://discovery-center.cloud.sap/
+- For SAP Business AI Platform services: https://discovery-center.cloud.sap/
 - For SAP APIs: https://api.sap.com/
 - For community Q&A: https://community.sap.com/
 - For learning paths: https://learning.sap.com/
diff --git a/scripts/generate-ktt-lessons.ts b/scripts/generate-ktt-lessons.ts
index 411ac0d71..62fe13a2b 100644
--- a/scripts/generate-ktt-lessons.ts
+++ b/scripts/generate-ktt-lessons.ts
@@ -34,7 +34,7 @@ const SEED: SeedEntry[] = [
   // ─── Unit 1: Core Platform ───────────────────────────────────────────────────
   {
     tla: 'SAP', expansion: 'Systems, Applications, Products in Data Processing',
-    blurb: 'The full name of the company behind your daily BTP adventures. Founded in Walldorf, 1972.',
+    blurb: 'The full name of the company behind your daily SAP Business AI Platform adventures. Founded in Walldorf, 1972.',
     category: 'company',
     unitId: 'unit-1-platform', lessonIdx: 0,
     distractors: ['Software Architecture Platform', 'Service Automation Protocol'],
@@ -42,26 +42,26 @@ const SEED: SeedEntry[] = [
     kasimirWrong: 'SAP = Systems, Applications, Products in Data Processing. It\'s literally on the letterhead!',
   },
   {
-    tla: 'BTP', expansion: 'SAP Business Technology Platform',
-    blurb: 'SAP\'s unified cloud platform for building, extending, and integrating business applications. The successor to SAP Cloud Platform (SCP).',
+    tla: 'BTP', expansion: 'SAP Business Technology Platform (retired — now SAP Business AI Platform)',
+    blurb: 'The former name of SAP\'s unified cloud platform. "SAP Business Technology Platform" and its BTP acronym are now retired — the platform is called SAP Business AI Platform (see BAIP).',
     category: 'platform',
     unitId: 'unit-1-platform', lessonIdx: 0,
     distractors: ['SAP Big-data Transaction Platform', 'SAP Business Transaction Processing'],
-    kasimirRight: 'BTP — the cloud with a view from Walldorf! Nicely done. ☁️',
-    kasimirWrong: 'BTP = SAP Business Technology Platform. The "T" is Technology, not Transaction.',
+    kasimirRight: 'Correct — and these days that platform is called SAP Business AI Platform. ☁️',
+    kasimirWrong: 'BTP stood for SAP Business Technology Platform, now retired in favour of SAP Business AI Platform.',
   },
   {
     tla: 'SCP', expansion: 'SAP Cloud Platform',
-    blurb: 'The former name of SAP BTP (deprecated 2021). You\'ll still see SCP in older tutorials and Stack Overflow answers.',
+    blurb: 'An early former name of SAP Business AI Platform (deprecated 2021, when it became SAP BTP). You\'ll still see SCP in older tutorials and Stack Overflow answers.',
     category: 'platform',
     unitId: 'unit-1-platform', lessonIdx: 0,
     distractors: ['SAP Continuous Provisioning', 'SAP Core Protocol'],
-    kasimirRight: 'SCP — the old BTP. Nostalgia is allowed. 📜',
-    kasimirWrong: 'SCP = SAP Cloud Platform, the predecessor to BTP. History matters in enterprise software!',
+    kasimirRight: 'SCP — one of the platform\'s old names. Nostalgia is allowed. 📜',
+    kasimirWrong: 'SCP = SAP Cloud Platform, an early name for what is now SAP Business AI Platform. History matters in enterprise software!',
   },
   {
     tla: 'IAS', expansion: 'SAP Identity Authentication Service',
-    blurb: 'SAP\'s cloud-based Identity Provider (IdP) on BTP. Handles authentication for SAP apps and custom services via SAML 2.0 and OIDC.',
+    blurb: 'SAP\'s cloud-based Identity Provider (IdP) on SAP Business AI Platform. Handles authentication for SAP apps and custom services via SAML 2.0 and OIDC.',
     category: 'security',
     unitId: 'unit-1-platform', lessonIdx: 0,
     distractors: ['Integrated Authorization Service', 'Internal Application Server'],
@@ -80,16 +80,16 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'BAS', expansion: 'SAP Business Application Studio',
-    blurb: 'SAP\'s browser-based IDE on BTP, built on VS Code Open Source. The recommended tool for CAP, Fiori, and ABAP Cloud development.',
+    blurb: 'SAP\'s browser-based IDE on SAP Business AI Platform, built on VS Code Open Source. The recommended tool for CAP, Fiori, and ABAP Cloud development.',
     category: 'tooling',
     unitId: 'unit-1-platform', lessonIdx: 1,
     distractors: ['Backend Automation System', 'Business API Services'],
     kasimirRight: 'BAS — where humans write the code that Kasimir reviews. Well played! 💻',
-    kasimirWrong: 'BAS = SAP Business Application Studio — the cloud IDE on BTP, not a backend system.',
+    kasimirWrong: 'BAS = SAP Business Application Studio — the cloud IDE on SAP Business AI Platform, not a backend system.',
   },
   {
     tla: 'SDK', expansion: 'Software Development Kit',
-    blurb: 'A bundle of tools, libraries, and documentation for building on a platform. SAP Cloud SDK adds BTP destinations, resilience, and type-safe OData clients.',
+    blurb: 'A bundle of tools, libraries, and documentation for building on a platform. SAP Cloud SDK adds SAP Business AI Platform destinations, resilience, and type-safe OData clients.',
     category: 'tooling',
     unitId: 'unit-1-platform', lessonIdx: 1,
     distractors: ['Service Deployment Kit', 'Standard Data Keyring'],
@@ -108,25 +108,25 @@ const SEED: SeedEntry[] = [
   // Lesson 1-3
   {
     tla: 'MTA', expansion: 'Multi-Target Application',
-    blurb: 'SAP\'s deployment artefact format for BTP. A single `.mtar` archive bundles multiple modules (backend, UI, DB) and wires up service bindings automatically.',
+    blurb: 'SAP\'s deployment artefact format for SAP Business AI Platform. A single `.mtar` archive bundles multiple modules (backend, UI, DB) and wires up service bindings automatically.',
     category: 'deployment',
     unitId: 'unit-1-platform', lessonIdx: 2,
     distractors: ['Managed Tenant Architecture', 'Module Transfer Archive'],
     kasimirRight: 'MTA — one package to rule them all! Purrfectly correct. 📦',
-    kasimirWrong: 'MTA = Multi-Target Application. It bundles all your BTP modules into one deployable archive.',
+    kasimirWrong: 'MTA = Multi-Target Application. It bundles all your SAP Business AI Platform modules into one deployable archive.',
   },
   {
     tla: 'ANS', expansion: 'SAP Alert Notification Service',
-    blurb: 'A BTP service that sends real-time alerts about application events to email, Slack, or custom webhooks. Used in tutorials-ims for operational monitoring.',
+    blurb: 'A SAP Business AI Platform service that sends real-time alerts about application events to email, Slack, or custom webhooks. Used in tutorials-ims for operational monitoring.',
     category: 'operations',
     unitId: 'unit-1-platform', lessonIdx: 2,
     distractors: ['Automated Notification System', 'Application Node Service'],
-    kasimirRight: 'ANS — the smoke alarm of your BTP app. Alert! You\'re correct! 🚨',
+    kasimirRight: 'ANS — the smoke alarm of your SAP Business AI Platform app. Alert! You\'re correct! 🚨',
     kasimirWrong: 'ANS = SAP Alert Notification Service. It notifies, alerts, and generally keeps you from sleeping.',
   },
   {
     tla: 'SAC', expansion: 'SAP Analytics Cloud',
-    blurb: 'SAP\'s SaaS business intelligence platform for dashboards, planning, and predictive analytics. Lives on BTP.',
+    blurb: 'SAP\'s SaaS business intelligence platform for dashboards, planning, and predictive analytics. Lives on SAP Business AI Platform.',
     category: 'analytics',
     unitId: 'unit-1-platform', lessonIdx: 2,
     distractors: ['SAP Application Console', 'SAP Automation Center'],
@@ -201,7 +201,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'ABAP', expansion: 'Advanced Business Application Programming',
-    blurb: 'SAP\'s original high-level programming language, born in the 1980s and still the heart of S/4HANA. ABAP Cloud is its clean-core, BTP-ready modern incarnation — and the foundation RAP is built on.',
+    blurb: 'SAP\'s original high-level programming language, born in the 1980s and still the heart of S/4HANA. ABAP Cloud is its clean-core, cloud-ready modern incarnation — and the foundation RAP is built on.',
     category: 'framework',
     unitId: 'unit-2-cds', lessonIdx: 1,
     distractors: ['Automated Batch Application Processing', 'ABAP Business Application Platform'],
@@ -256,7 +256,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'CLI', expansion: 'Command-Line Interface',
-    blurb: 'A text-based tool for interacting with software. CAP provides `cds` CLI; BTP has `btp`; CF has `cf`. Together they\'re the developer\'s Swiss army knife.',
+    blurb: 'A text-based tool for interacting with software. CAP provides `cds` CLI; SAP Business AI Platform has `btp`; CF has `cf`. Together they\'re the developer\'s Swiss army knife.',
     category: 'tooling',
     unitId: 'unit-2-cds', lessonIdx: 2,
     distractors: ['Cloud Layer Interface', 'Component Library Index'],
@@ -267,7 +267,7 @@ const SEED: SeedEntry[] = [
   // ─── Unit 3: HANA & Data ──────────────────────────────────────────────────────
   {
     tla: 'HANA', expansion: 'High-performance ANalytic Appliance',
-    blurb: 'SAP\'s in-memory relational database. Processes analytical and transactional workloads simultaneously ("HTAP"). The default production database for CAP apps on BTP.',
+    blurb: 'SAP\'s in-memory relational database. Processes analytical and transactional workloads simultaneously ("HTAP"). The default production database for CAP apps on SAP Business AI Platform.',
     category: 'database',
     unitId: 'unit-3-hana', lessonIdx: 0,
     distractors: ['Hybrid Application and Network Architecture', 'Hosted Analytical Node Application'],
@@ -388,7 +388,7 @@ const SEED: SeedEntry[] = [
   // ─── Unit 4: Security & Ops ───────────────────────────────────────────────────
   {
     tla: 'XSUAA', expansion: 'Extended Services for User Account and Authorization',
-    blurb: 'SAP BTP\'s OAuth 2.0 authorization service (also called "Authorization and Trust Management Service"). Manages roles, scopes, and JWT tokens for CAP apps.',
+    blurb: 'SAP Business AI Platform\'s OAuth 2.0 authorization service (also called "Authorization and Trust Management Service"). Manages roles, scopes, and JWT tokens for CAP apps.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 0,
     distractors: ['External Single-Use Authentication API', 'eXtended Security User Application API'],
@@ -397,7 +397,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'UAA', expansion: 'User Account and Authentication',
-    blurb: 'Cloud Foundry\'s open-source OAuth 2.0 / OpenID Connect server. SAP\'s XSUAA is a proprietary extension of UAA, adding BTP-specific scopes and role collections.',
+    blurb: 'Cloud Foundry\'s open-source OAuth 2.0 / OpenID Connect server. SAP\'s XSUAA is a proprietary extension of UAA, adding SAP Business AI Platform-specific scopes and role collections.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 0,
     distractors: ['Universal Access Authority', 'Unified App Authenticator'],
@@ -406,7 +406,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'SSO', expansion: 'Single Sign-On',
-    blurb: 'Log in once, access everything. SAP IAS federates identity to BTP, SAP S/4HANA, and third-party apps so users don\'t need separate passwords per system.',
+    blurb: 'Log in once, access everything. SAP IAS federates identity to SAP Business AI Platform, SAP S/4HANA, and third-party apps so users don\'t need separate passwords per system.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 0,
     distractors: ['Secure Session Object', 'Synchronised Sign-Out'],
@@ -415,7 +415,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'JWT', expansion: 'JSON Web Token',
-    blurb: 'A compact, URL-safe token format (RFC 7519) for conveying claims between parties. BTP uses JWTs to carry XSUAA scopes and user info between services.',
+    blurb: 'A compact, URL-safe token format (RFC 7519) for conveying claims between parties. SAP Business AI Platform uses JWTs to carry XSUAA scopes and user info between services.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 0,
     distractors: ['JavaScript Web Transfer', 'JSON Workflow Trigger'],
@@ -425,7 +425,7 @@ const SEED: SeedEntry[] = [
   // Lesson 4-2
   {
     tla: 'IDP', expansion: 'Identity Provider',
-    blurb: 'A system that authenticates users and issues identity tokens. SAP IAS is a BTP Identity Provider. Corporate IdPs (Azure AD, Okta) can be federated into IAS.',
+    blurb: 'A system that authenticates users and issues identity tokens. SAP IAS is a SAP Business AI Platform Identity Provider. Corporate IdPs (Azure AD, Okta) can be federated into IAS.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 1,
     distractors: ['Internal Data Processor', 'Interface Definition Protocol'],
@@ -434,7 +434,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'MFA', expansion: 'Multi-Factor Authentication',
-    blurb: 'Requiring ≥2 verification methods (password + OTP, biometric, hardware key). SAP IAS supports MFA for BTP admin and application users.',
+    blurb: 'Requiring ≥2 verification methods (password + OTP, biometric, hardware key). SAP IAS supports MFA for SAP Business AI Platform admin and application users.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 1,
     distractors: ['Managed Federation Access', 'Modular Flow Authentication'],
@@ -443,7 +443,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'TLS', expansion: 'Transport Layer Security',
-    blurb: 'The cryptographic protocol that secures HTTPS connections (successor to SSL). All BTP endpoints use TLS; CAP enforces it in production profiles automatically.',
+    blurb: 'The cryptographic protocol that secures HTTPS connections (successor to SSL). All SAP Business AI Platform endpoints use TLS; CAP enforces it in production profiles automatically.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 1,
     distractors: ['Token Lifecycle Service', 'Trusted Link System'],
@@ -462,7 +462,7 @@ const SEED: SeedEntry[] = [
   // Lesson 4-3
   {
     tla: 'ERP', expansion: 'Enterprise Resource Planning',
-    blurb: 'Software that integrates core business processes (finance, HR, supply chain). SAP S/4HANA is the flagship ERP; it\'s why CAP and BTP exist — to extend and integrate ERP.',
+    blurb: 'Software that integrates core business processes (finance, HR, supply chain). SAP S/4HANA is the flagship ERP; it\'s why CAP and SAP Business AI Platform exist — to extend and integrate ERP.',
     category: 'business',
     unitId: 'unit-4-security', lessonIdx: 2,
     distractors: ['Enterprise Reporting Platform', 'Event-Routing Protocol'],
@@ -480,7 +480,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'AMS', expansion: 'SAP Authorization Management Service',
-    blurb: 'A BTP service (`@cap-js/ams`) providing policy-based authorization for CAP applications via the `@ams` CDS annotation. An alternative to pure XSUAA role checks.',
+    blurb: 'A SAP Business AI Platform service (`@cap-js/ams`) providing policy-based authorization for CAP applications via the `@ams` CDS annotation. An alternative to pure XSUAA role checks.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 2,
     distractors: ['Application Monitoring Service', 'API Management Suite'],
@@ -489,12 +489,12 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'RBAC', expansion: 'Role-Based Access Control',
-    blurb: 'Assigning permissions to roles, then roles to users — rather than granting permissions directly. XSUAA role collections implement RBAC for BTP apps.',
+    blurb: 'Assigning permissions to roles, then roles to users — rather than granting permissions directly. XSUAA role collections implement RBAC for SAP Business AI Platform apps.',
     category: 'security',
     unitId: 'unit-4-security', lessonIdx: 2,
     distractors: ['Resource-Bound API Control', 'Runtime Backend Access Cache'],
     kasimirRight: 'RBAC — roles for the role, access for the few. Permission granted! 🎖️',
-    kasimirWrong: 'RBAC = Role-Based Access Control. XSUAA role collections ARE the RBAC mechanism in BTP.',
+    kasimirWrong: 'RBAC = Role-Based Access Control. XSUAA role collections ARE the RBAC mechanism in SAP Business AI Platform.',
   },
 
   // ─── Unit 5: SAP & AI ─────────────────────────────────────────────────────────
@@ -537,7 +537,7 @@ const SEED: SeedEntry[] = [
   // Lesson 5-2
   {
     tla: 'BAIP', expansion: 'SAP Business AI Platform',
-    blurb: 'SAP\'s platform for building, deploying, and governing AI across business processes — bringing generative and predictive AI to BTP apps with enterprise data grounding.',
+    blurb: 'SAP\'s platform for building, deploying, and governing AI across business processes — bringing generative and predictive AI to SAP Business AI Platform apps with enterprise data grounding.',
     category: 'ai',
     unitId: 'unit-5-ai', lessonIdx: 1,
     distractors: ['Business Application Integration Platform', 'BTP Analytics & Insights Portal'],
@@ -555,7 +555,7 @@ const SEED: SeedEntry[] = [
   },
   {
     tla: 'ISLM', expansion: 'Intelligent Scenario Lifecycle Management',
-    blurb: 'SAP\'s framework for managing embedded machine-learning scenarios end to end — training, deploying, and monitoring predictive models inside S/4HANA and BTP apps.',
+    blurb: 'SAP\'s framework for managing embedded machine-learning scenarios end to end — training, deploying, and monitoring predictive models inside S/4HANA and SAP Business AI Platform apps.',
     category: 'ai',
     unitId: 'unit-5-ai', lessonIdx: 1,
     distractors: ['Integrated Service Layer Model', 'Intelligent System Learning Module'],
@@ -582,7 +582,7 @@ const UNITS: UnitMeta[] = [
     title: 'SAP Core Platform',
     icon: '🏗️',
     order: 1,
-    lessonTitles: ['Who\'s SAP, and what\'s BTP?', 'The CAP Stack', 'Deploying & Operating'],
+    lessonTitles: ['Who\'s SAP, and what\'s SAP Business AI Platform?', 'The CAP Stack', 'Deploying & Operating'],
     lessonIntros: [
       'Ah, a fresh student! Before we write a single line of CDS, let\'s settle the most fundamental questions: who runs this show, and what platform are we on?',
       'Now we\'re cooking! CAP is where the magic happens. Let me introduce you to my favourite framework — and no, I\'m not biased just because it\'s named after something a professor wears.',

From ae688062c529e6cec1c268fa7b5dec7b99c90431 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:17:46 -0400
Subject: [PATCH 17/46] feat(auth): render /signin page from signin layout
 (#2506)

---
 hugo/content/signin.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 hugo/content/signin.md

diff --git a/hugo/content/signin.md b/hugo/content/signin.md
new file mode 100644
index 000000000..ee8d4213e
--- /dev/null
+++ b/hugo/content/signin.md
@@ -0,0 +1,9 @@
+---
+title: "Sign in"
+layout: signin
+_build:
+  list: never
+sitemap:
+  disable: true
+robotsNoIndex: true
+---

From 6c91a26f923bd374298af0f440603ffc843a3b90 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:22:25 -0400
Subject: [PATCH 18/46] feat(auth): serve public /signin page from approuter
 (#2506)

---
 approuter/xs-app.json | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/approuter/xs-app.json b/approuter/xs-app.json
index 2f3bc4308..2dc63a8a3 100644
--- a/approuter/xs-app.json
+++ b/approuter/xs-app.json
@@ -719,6 +719,12 @@
     { "source": "^/puzzles/?(\\?.*)?$",              "target": "/content/puzzles-index",                "destination": "srv-api", "authenticationType": "none" },
     { "source": "^/puzzles/([^/?]+)/?(\\?.*)?$",      "target": "/content/puzzles/$1",                   "destination": "srv-api", "authenticationType": "none" },
     { "source": "^/channels/(?!health(?:/|$)|media-diet(?:/|$)|crosswalk(?:/|$)|atlas(?:/|$))([^/?]+)/?(\\?.*)?$", "target": "/content/channel-detail/$1", "destination": "srv-api", "authenticationType": "none" },
+    {
+      "source": "^/signin/?(\\?.*)?$",
+      "authenticationType": "none",
+      "target": "/signin/index.html",
+      "localDir": "static"
+    },
     { "source": "^/(\\?.*)?$",                       "target": "/content/pages/$1",                     "destination": "srv-api", "authenticationType": "none" },
     {
       "source": "^(.*)$",

From 8bb4b3baa06a6d5787c36865a73dd768a2837a54 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:32:05 -0400
Subject: [PATCH 19/46] test(auth): post-deploy e2e smoke for /signin page
 (#2506)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds test/e2e/signin.spec.ts: verifies both IdP-pinned sign-in buttons
render at /signin with the correct href attributes after deploy.

Also widens the e2e vitest project include to *.{test,spec}.{js,ts} so
all existing *.spec.ts files (ktt, topics, topic-clusters-band, ui5-split,
explore-3d) are correctly wired into `npm run test:e2e` alongside the new spec.

Self-skips (no browser, no output) when SMOKE_BASE_URL/PLAYWRIGHT_BASE_URL
is absent — `npm test` (unit tier) is unaffected.
---
 test/e2e/signin.spec.ts | 47 +++++++++++++++++++++++++++++++++++++++++
 vitest.config.ts        |  2 +-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 test/e2e/signin.spec.ts

diff --git a/test/e2e/signin.spec.ts b/test/e2e/signin.spec.ts
new file mode 100644
index 000000000..8013c47db
--- /dev/null
+++ b/test/e2e/signin.spec.ts
@@ -0,0 +1,47 @@
+// test/e2e/signin.spec.ts
+//
+// e2e: IAS social-login sign-in page at /signin (#2506).
+//
+// Post-deploy smoke: verifies both IdP-pinned sign-in buttons render with the
+// correct href attributes so the approuter's dynamicIdentityProvider routing
+// fires correctly for each provider.
+//
+// Self-skips when PLAYWRIGHT_BASE_URL / SMOKE_BASE_URL is absent (repo e2e
+// convention, #1338) — `npm test` (unit suite) is unaffected.
+//
+// Run post-deploy only:
+//   SMOKE_BASE_URL=https://… npx vitest run --project e2e test/e2e/signin.spec.ts
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { hasBaseUrl } from './e2e.config.js';
+import { launchBrowser, newPage } from './_browser.js';
+
+describe.skipIf(!hasBaseUrl())('e2e: /signin page (IAS social login, #2506)', () => {
+  let browser: Awaited<ReturnType<typeof launchBrowser>>;
+
+  beforeAll(async () => {
+    browser = await launchBrowser();
+  });
+
+  afterAll(async () => {
+    await browser?.close();
+  });
+
+  it('renders both IdP-pinned sign-in buttons with correct hrefs', async () => {
+    const { context, page } = await newPage(browser, { authenticated: false });
+    try {
+      const response = await page.goto('/signin', { waitUntil: 'domcontentloaded' });
+      expect(response, 'no response received').not.toBeNull();
+      expect(response!.status(), 'unexpected status for /signin').toBe(200);
+
+      const sapBtn = page.getByRole('link', { name: 'Sign in with SAP', exact: true });
+      const uidBtn = page.getByRole('link', { name: 'Sign in with SAP Universal ID' });
+
+      await expect(sapBtn).toBeVisible();
+      await expect(uidBtn).toBeVisible();
+      await expect(sapBtn).toHaveAttribute('href', '/login?sap_idp=sap.default');
+      await expect(uidBtn).toHaveAttribute('href', '/login?sap_idp=sap.custom');
+    } finally {
+      await context.close();
+    }
+  });
+});
diff --git a/vitest.config.ts b/vitest.config.ts
index ce88b9f8e..47fee5c96 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -183,7 +183,7 @@ export default defineConfig({
         // avoid a second test-runner dependency.
         test: {
           name: 'e2e',
-          include: ['test/e2e/**/*.test.{js,ts}'],
+          include: ['test/e2e/**/*.{test,spec}.{js,ts}'],
           pool: 'forks',
           testTimeout: 120000,
           hookTimeout: 60000,

From 6fa24674d23e2da8cadb5b15489a6a99a5c07b50 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:36:46 -0400
Subject: [PATCH 20/46] docs(auth): document two-button sign-in and sap_idp
 pinning (#2506)

---
 .../developers/architecture/authentication.md | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/docs/developers/architecture/authentication.md b/docs/developers/architecture/authentication.md
index 3fac0f66d..087b5ac93 100644
--- a/docs/developers/architecture/authentication.md
+++ b/docs/developers/architecture/authentication.md
@@ -418,6 +418,64 @@ Switch to a custom IAS tenant if you later need:
 
 ---
 
+### Two-Button Sign-In and IdP Pinning
+
+The platform provides a themed public sign-in page (`/signin`) that allows users to choose between two authentication flows, each routed to a different Identity Provider.
+
+#### Sign-In Page (`/signin`)
+
+The `/signin` page is a public, unauthenticated Hugo page (served by AppRouter with `authenticationType: "none"`). It presents two buttons:
+
+1. **"Sign in with SAP"** — Routes to `/login?sap_idp=sap.default` (SAP ID Service, the default universal IDP)
+2. **"Sign in with SAP Universal ID"** — Routes to `/login?sap_idp=sap.custom` (IAS tenant `atxgsg7zi`, which federates social providers like GitHub, Google, Microsoft)
+
+Both flows eventually reach the same app via XSUAA, which re-issues its own OAuth token. The user sees XSUAA's token in the session, not the upstream IdP's token.
+
+#### IdP Pinning via `sap_idp` Query Parameter
+
+The `/login` route in `xs-app.json` is configured with `dynamicIdentityProvider: true`. This enables the `sap_idp` query parameter:
+
+```
+/login?sap_idp=sap.default    → AppRouter sets login_hint={"origin":"sap.default"}
+/login?sap_idp=sap.custom     → AppRouter sets login_hint={"origin":"sap.custom"}
+```
+
+The AppRouter translates the `sap_idp` parameter into an XSUAA `login_hint` claim. XSUAA receives this hint and bypasses the IdP chooser screen, jumping directly to the specified IdP's authentication flow. This provides a seamless two-button experience — the user never sees an "Account Chooser" or "Which IdP?" dialog.
+
+#### Identity Resolution Across IdPs
+
+Both IdPs federate through a single XSUAA instance. When a user authenticates via either flow:
+
+1. **Authentication** happens at the upstream IdP (SAP ID Service or IAS)
+2. **Token re-issuance** happens at XSUAA — a new JWT is issued to the app with:
+   - `user_uuid` claim = stable unique identifier (either from SAP ID or IAS)
+   - `email` claim = user's email address (if provided by the IdP)
+   - `given_name`, `family_name` = user profile fields
+3. **Identity merge** (via the `(iss,sub)` resolver, #2552): If a user logs in via one IdP and later logs in via the other with the same email address, the system detects the email match and merges both logins to the same `user_uuid` in the database. This allows a user to seamlessly switch between "Sign in with SAP" and "Sign in with SAP Universal ID" without creating duplicate accounts.
+
+#### Session and IdP Switching
+
+**Caveat: Switching IdPs requires logout first.** This is an AppRouter/XSUAA constraint:
+
+- If a user logs in via `sap.default` (SAP ID Service) and gets a session cookie
+- And then tries to log in via `sap.custom` (IAS) **without logging out first**
+- The AppRouter sees the existing session and skips the authentication flow — the user remains logged in as the previous identity
+
+**Workaround:** The app's logout flow clears the session cookie. After logout, a user can click either sign-in button and be routed to the corresponding IdP.
+
+#### Known Boundary: Social Login Without SAP ID Account
+
+When a user logs in via a social provider (GitHub, Google, etc. via IAS) **and the email address does not exist in any prior SAP ID login**:
+
+- A new `Users` database row is created with the social IdP's `user_uuid` and email
+- Later, if the same user logs in via SAP ID Service with the same email but a different SAP `user_uuid`
+- The system detects the email collision but cannot automatically merge because they have different `user_uuid` values (issue #2552)
+- **Workaround:** The user can manually merge accounts via the `/admin-ui/#account-merge` endpoint if they have `Admin` scope, or the DeveloperService can expose a user-facing merge endpoint in a future update
+
+This edge case only occurs for users who first log in socially without a pre-existing SAP ID. Most SAP developers have an existing SAP ID, so the happy path (same email, automatic merge) covers the common case.
+
+---
+
 ### XSUAA Configuration
 
 The XSUAA instance (`tutorials-xsuaa`) is configured via `xs-security.json`.

From 425f50394bed172b1d226ee63ef9abaf12896bb7 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:42:27 -0400
Subject: [PATCH 21/46] fix(auth): correct schema accuracy in social login
 boundary (#2506)

Fixed inaccurate description of UserIdentities storage. Previously stated
new Users row created with social IdP's user_uuid; corrected to state
sapId=null with identity linked via UserIdentities (issuer, subject) row.
Aligns with #2552 schema.
---
 docs/developers/architecture/authentication.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/developers/architecture/authentication.md b/docs/developers/architecture/authentication.md
index 087b5ac93..d00570456 100644
--- a/docs/developers/architecture/authentication.md
+++ b/docs/developers/architecture/authentication.md
@@ -467,9 +467,9 @@ Both IdPs federate through a single XSUAA instance. When a user authenticates vi
 
 When a user logs in via a social provider (GitHub, Google, etc. via IAS) **and the email address does not exist in any prior SAP ID login**:
 
-- A new `Users` database row is created with the social IdP's `user_uuid` and email
-- Later, if the same user logs in via SAP ID Service with the same email but a different SAP `user_uuid`
-- The system detects the email collision but cannot automatically merge because they have different `user_uuid` values (issue #2552)
+- A new `Users` database row is created with `sapId = null`, linked to the social identity via a `UserIdentities` (issuer, subject) row
+- Later, if the same user logs in via SAP ID Service with the same email but a different identity key
+- The system detects the email collision but cannot automatically merge because they have different identity keys stored in `UserIdentities` (issue #2552)
 - **Workaround:** The user can manually merge accounts via the `/admin-ui/#account-merge` endpoint if they have `Admin` scope, or the DeveloperService can expose a user-facing merge endpoint in a future update
 
 This edge case only occurs for users who first log in socially without a pre-existing SAP ID. Most SAP developers have an existing SAP ID, so the happy path (same email, automatic merge) covers the common case.

From 901a147d9bf97dc79d4ee97dd7437683aae0402e Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:47:40 -0400
Subject: [PATCH 22/46] fix(app-space): resolve tutorials FK-first in
 event/app-space progress (#1866)

getEventProgress and getAppSpaceProgress resolved each CompletionPathItem's
task via taskLegacyId only. Manually-authored event content (DSAG-Jahreskongress
2026, SAP Connect 2026) populates the item's tutorial_ID FK but leaves
taskLegacyId NULL, so those items missed the task map and the App-Space page
rendered empty tutorial cards (title/url blank, badge still showing).

The mission catalog builder (build-catalog.js) already resolved tutorial_ID
first; this gives the two progress handlers the same FK-first behavior via a
shared helper (srv/lib/path-item-task-resolver.js):
- fetch tutorials by both taskLegacyId and tutorial_ID
- resolve each item FK-first, falling back to taskType:taskLegacyId
- derive an effective legacyId (own taskLegacyId, else resolved tutorial's)
  for the output imsId and user TaskRecord lookups

Closes the permanent-fix half of the empty-card defect behind the prod data
patch already applied to events 10000009 / 10000006.
---
 srv/developer-service.js             |  83 +++++++------------
 srv/lib/path-item-task-resolver.js   | 116 +++++++++++++++++++++++++++
 test/app-space-fk-resolution.test.js | 105 ++++++++++++++++++++++++
 3 files changed, 251 insertions(+), 53 deletions(-)
 create mode 100644 srv/lib/path-item-task-resolver.js
 create mode 100644 test/app-space-fk-resolution.test.js

diff --git a/srv/developer-service.js b/srv/developer-service.js
index 0a30c381a..822d1b2c8 100644
--- a/srv/developer-service.js
+++ b/srv/developer-service.js
@@ -14,6 +14,7 @@ import { maybeAutoSendCompletion } from './lib/ngds-autosend.js';
 import { stampSubmissionId } from './lib/task-record-submission-id.js';
 import { rollUpParentsForCompletion } from './lib/completion-rollup.js';
 import { renderMarkdown } from './lib/markdown.js';
+import { buildTaskMap, resolveTask, effectiveLegacyId } from './lib/path-item-task-resolver.js';
 
 // Per-user rate limit for resetTutorialProgress — same window as the
 // IP-based feedback limiter below (5/hr) but keyed by sapId via a shared
@@ -567,43 +568,25 @@ export default class DeveloperService extends cds.ApplicationService {
         ? await SELECT.from(dbPathItems).where({ path_ID: { in: pathIds } }).orderBy('itemOrder')
         : [];
 
-      const taskLegacyIds = allItems.map(i => i.taskLegacyId);
-
-      const tutorials = taskLegacyIds.length > 0
-        ? await SELECT.from(dbTutorials).where({ legacyId: { in: taskLegacyIds } })
-        : [];
-      const checkpoints = taskLegacyIds.length > 0
-        ? await SELECT.from(dbCheckpoints).where({ legacyId: { in: taskLegacyIds } })
-        : [];
-      const petoberfests = taskLegacyIds.length > 0
-        ? await SELECT.from(dbPetoberfests).where({ legacyId: { in: taskLegacyIds } })
-        : [];
+      // #1866: resolve tasks FK-first (tutorial_ID) with taskLegacyId fallback,
+      // so manually-authored items (taskLegacyId null, tutorial_ID set) resolve.
+      const taskMap = await buildTaskMap({
+        items: allItems,
+        entities: { Tutorials: dbTutorials, Checkpoints: dbCheckpoints, Petoberfests: dbPetoberfests },
+      });
 
-      const taskMap = new Map();
-      for (const t of tutorials) taskMap.set(`TUTORIAL:${t.legacyId}`, t);
-      for (const c of checkpoints) taskMap.set(`CHECKPOINT:${c.legacyId}`, c);
-      for (const p of petoberfests) taskMap.set(`PETOBERFEST:${p.legacyId}`, p);
-
-      const missingSlugIds = allItems
-        .filter(i => i.taskType === 'TUTORIAL' && taskMap.has(`TUTORIAL:${i.taskLegacyId}`))
-        .filter(i => !taskMap.get(`TUTORIAL:${i.taskLegacyId}`).slug)
-        .map(i => i.taskLegacyId);
-
-      if (missingSlugIds.length > 0) {
-        const freshTutorials = await SELECT.from(dbTutorials)
-          .where({ legacyId: { in: missingSlugIds }, slug: { '!=': null } });
-        for (const t of freshTutorials) {
-          taskMap.set(`TUTORIAL:${t.legacyId}`, t);
-        }
-      }
+      // Effective legacyId per item (own taskLegacyId, else resolved tutorial's)
+      // drives both TaskRecord lookups and the output imsId.
+      const effLegacyByItem = new Map(allItems.map(i => [i, effectiveLegacyId(taskMap, i)]));
+      const recordLegacyIds = [...new Set([...effLegacyByItem.values()].filter(v => v != null))];
 
       let userRecords = [];
       const sapId = resolveUserSapId(user);
       const dbUser = sapId ? await SELECT.one.from(dbUsers).where({ sapId }) : null;
-      if (dbUser) {
+      if (dbUser && recordLegacyIds.length > 0) {
         userRecords = await SELECT.from(dbTaskRecords).where({
           user_ID: dbUser.ID,
-          taskLegacyId: { in: taskLegacyIds }
+          taskLegacyId: { in: recordLegacyIds }
         });
       }
       const recordMap = new Map();
@@ -628,10 +611,11 @@ export default class DeveloperService extends cds.ApplicationService {
           const items = allItems
             .filter(i => i.path_ID === p.ID)
             .map(i => {
-              const task = taskMap.get(`${i.taskType}:${i.taskLegacyId}`);
-              const record = recordMap.get(`${i.taskType}:${i.taskLegacyId}`);
+              const task = resolveTask(taskMap, i);
+              const effLegacyId = effLegacyByItem.get(i);
+              const record = recordMap.get(`${i.taskType}:${effLegacyId}`);
               return {
-                imsId: i.taskLegacyId,
+                imsId: effLegacyId,
                 title: task?.title || record?.titleSnapshot || '',
                 type: i.taskType,
                 status: record?.status || '',
@@ -700,30 +684,22 @@ export default class DeveloperService extends cds.ApplicationService {
         ? await SELECT.from(dbPathItems).where({ path_ID: { in: pathIds } }).orderBy('itemOrder')
         : [];
 
-      const taskLegacyIds = allItems.map(i => i.taskLegacyId);
-
-      const tutorials = taskLegacyIds.length > 0
-        ? await SELECT.from(dbTutorials).where({ legacyId: { in: taskLegacyIds } })
-        : [];
-      const checkpoints = taskLegacyIds.length > 0
-        ? await SELECT.from(dbCheckpoints).where({ legacyId: { in: taskLegacyIds } })
-        : [];
-      const petoberfests = taskLegacyIds.length > 0
-        ? await SELECT.from(dbPetoberfests).where({ legacyId: { in: taskLegacyIds } })
-        : [];
+      // #1866: FK-first resolution (see getEventProgress / build-catalog.js).
+      const taskMap = await buildTaskMap({
+        items: allItems,
+        entities: { Tutorials: dbTutorials, Checkpoints: dbCheckpoints, Petoberfests: dbPetoberfests },
+      });
 
-      const taskMap = new Map();
-      for (const t of tutorials) taskMap.set(`TUTORIAL:${t.legacyId}`, t);
-      for (const c of checkpoints) taskMap.set(`CHECKPOINT:${c.legacyId}`, c);
-      for (const p of petoberfests) taskMap.set(`PETOBERFEST:${p.legacyId}`, p);
+      const effLegacyByItem = new Map(allItems.map(i => [i, effectiveLegacyId(taskMap, i)]));
+      const recordLegacyIds = [...new Set([...effLegacyByItem.values()].filter(v => v != null))];
 
       let userRecords = [];
       const sapId = resolveUserSapId(user);
       const dbUser = sapId ? await SELECT.one.from(dbUsers).where({ sapId }) : null;
-      if (dbUser) {
+      if (dbUser && recordLegacyIds.length > 0) {
         userRecords = await SELECT.from(dbTaskRecords).where({
           user_ID: dbUser.ID,
-          taskLegacyId: { in: taskLegacyIds }
+          taskLegacyId: { in: recordLegacyIds }
         });
       }
       const recordMap = new Map();
@@ -741,10 +717,11 @@ export default class DeveloperService extends cds.ApplicationService {
           const items = allItems
             .filter(i => i.path_ID === p.ID)
             .map(i => {
-              const task = taskMap.get(`${i.taskType}:${i.taskLegacyId}`);
-              const record = recordMap.get(`${i.taskType}:${i.taskLegacyId}`);
+              const task = resolveTask(taskMap, i);
+              const effLegacyId = effLegacyByItem.get(i);
+              const record = recordMap.get(`${i.taskType}:${effLegacyId}`);
               return {
-                imsId: i.taskLegacyId,
+                imsId: effLegacyId,
                 title: task?.title || record?.titleSnapshot || '',
                 type: i.taskType,
                 status: record?.status || '',
diff --git a/srv/lib/path-item-task-resolver.js b/srv/lib/path-item-task-resolver.js
new file mode 100644
index 000000000..1a9182ec7
--- /dev/null
+++ b/srv/lib/path-item-task-resolver.js
@@ -0,0 +1,116 @@
+import cds from '@sap/cds';
+
+// Shared task resolution for CompletionPathItems in the event / app-space
+// progress handlers (srv/developer-service.js: getEventProgress,
+// getAppSpaceProgress).
+//
+// #1866: manually-authored content (the high-ID prod batch, e.g. the
+// DSAG-Jahreskongress 2026 / SAP Connect 2026 event missions) populates the
+// item's tutorial_ID FK (UUID) but leaves taskLegacyId null. The original
+// legacyId-only lookup fetched tutorials by taskLegacyId and keyed the task
+// map by legacyId, so those items missed the map entirely → App-Space rendered
+// empty tutorial cards. The mission catalog builder (srv/lib/build-catalog.js)
+// already resolves tutorial_ID first; this helper gives the two progress
+// handlers the same FK-first behavior.
+//
+// CHECKPOINT / PETOBERFEST items carry no FK column, so they resolve by
+// taskLegacyId only (unchanged behavior).
+
+/**
+ * Fetch tutorials/checkpoints/petoberfests for the given path items and build a
+ * lookup map keyed by BOTH `TUTORIAL:uuid:<ID>` and `TUTORIAL:<legacyId>` for
+ * tutorials, and `CHECKPOINT:<legacyId>` / `PETOBERFEST:<legacyId>` for the
+ * others.
+ *
+ * @param {object} opts
+ * @param {Array}  opts.items   CompletionPathItems rows (must include taskType,
+ *                              taskLegacyId, tutorial_ID).
+ * @param {object} opts.entities { Tutorials, Checkpoints, Petoberfests } CDS entities.
+ * @returns {Promise<Map>} task map
+ */
+export async function buildTaskMap({ items, entities }) {
+  const { Tutorials, Checkpoints, Petoberfests } = entities;
+
+  const legacyIds = [...new Set(items.map(i => i.taskLegacyId).filter(v => v != null))];
+  const tutorialUuids = [...new Set(
+    items
+      .filter(i => i.taskType === 'TUTORIAL' && i.tutorial_ID)
+      .map(i => i.tutorial_ID)
+  )];
+
+  // Tutorials: resolve by legacyId OR tutorial_ID so items carrying only one of
+  // the two still resolve. Two separate queries merged in JS — avoids a
+  // combined OR across two columns (CQN OR shorthand is error-prone and HANA/
+  // SQLite differ) and de-dupes on ID.
+  const tutorialById = new Map();
+  if (legacyIds.length > 0) {
+    for (const t of await SELECT.from(Tutorials).where({ legacyId: { in: legacyIds } })) {
+      tutorialById.set(t.ID, t);
+    }
+  }
+  if (tutorialUuids.length > 0) {
+    for (const t of await SELECT.from(Tutorials).where({ ID: { in: tutorialUuids } })) {
+      tutorialById.set(t.ID, t);
+    }
+  }
+  const tutorials = [...tutorialById.values()];
+
+  const checkpoints = legacyIds.length > 0
+    ? await SELECT.from(Checkpoints).where({ legacyId: { in: legacyIds } })
+    : [];
+  const petoberfests = legacyIds.length > 0
+    ? await SELECT.from(Petoberfests).where({ legacyId: { in: legacyIds } })
+    : [];
+
+  const taskMap = new Map();
+  for (const t of tutorials) {
+    if (t.ID != null) taskMap.set(`TUTORIAL:uuid:${t.ID}`, t);
+    // Only index by legacyId when the tutorial actually has one AND no better
+    // (slug-bearing) entry is already present — mirrors the original
+    // last-write-wins semantics; the missing-slug re-query below still applies.
+    if (t.legacyId != null) taskMap.set(`TUTORIAL:${t.legacyId}`, t);
+  }
+  for (const c of checkpoints) taskMap.set(`CHECKPOINT:${c.legacyId}`, c);
+  for (const p of petoberfests) taskMap.set(`PETOBERFEST:${p.legacyId}`, p);
+
+  // Slug-freshness safety net (ported from getEventProgress): if a resolved
+  // TUTORIAL has no slug, re-query by legacyId filtering to slug-bearing rows.
+  const missingSlugIds = tutorials
+    .filter(t => t.legacyId != null && !t.slug)
+    .map(t => t.legacyId);
+  if (missingSlugIds.length > 0) {
+    const fresh = await SELECT.from(Tutorials)
+      .where({ legacyId: { in: missingSlugIds }, slug: { '!=': null } });
+    for (const t of fresh) {
+      if (t.ID != null) taskMap.set(`TUTORIAL:uuid:${t.ID}`, t);
+      if (t.legacyId != null) taskMap.set(`TUTORIAL:${t.legacyId}`, t);
+    }
+  }
+
+  return taskMap;
+}
+
+/**
+ * Resolve the task record for an item, FK (tutorial_ID) first, then
+ * `${taskType}:${taskLegacyId}`.
+ * @returns {object|undefined}
+ */
+export function resolveTask(taskMap, item) {
+  if (item.taskType === 'TUTORIAL' && item.tutorial_ID) {
+    const byUuid = taskMap.get(`TUTORIAL:uuid:${item.tutorial_ID}`);
+    if (byUuid) return byUuid;
+  }
+  return taskMap.get(`${item.taskType}:${item.taskLegacyId}`);
+}
+
+/**
+ * The legacyId to use for this item's output `imsId` and for user TaskRecord
+ * lookups: the item's own taskLegacyId when present, else the resolved
+ * tutorial's legacyId (manually-authored FK-only items).
+ * @returns {number|null}
+ */
+export function effectiveLegacyId(taskMap, item) {
+  if (item.taskLegacyId != null) return item.taskLegacyId;
+  const task = resolveTask(taskMap, item);
+  return task?.legacyId ?? null;
+}
diff --git a/test/app-space-fk-resolution.test.js b/test/app-space-fk-resolution.test.js
new file mode 100644
index 000000000..85e091500
--- /dev/null
+++ b/test/app-space-fk-resolution.test.js
@@ -0,0 +1,105 @@
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import cds from '@sap/cds';
+
+const project = cds.test('serve', '--project', '.', '--in-memory');
+
+// Issue #1866 (App-Space arm): getAppSpaceProgress / getEventProgress resolved
+// each CompletionPathItem's task via `taskLegacyId` only. Manually-authored
+// content (e.g. the DSAG-Jahreskongress 2026 / SAP Connect 2026 event missions)
+// populates the item's `tutorial_ID` FK (UUID) but leaves `taskLegacyId` NULL,
+// so those items missed the task map entirely and the App-Space page rendered
+// empty tutorial cards (title/url/description blank) even though the badge
+// showed. The mission catalog builder (build-catalog.js) already resolved
+// tutorial_ID first; srv/lib/path-item-task-resolver.js now gives the two
+// progress handlers the same FK-first behavior.
+const EVENT_ID   = 10009009;
+const MISSION_ID = '11111111-1866-aaaa-0000-000000000001';
+const PATH_ID    = '22222222-1866-aaaa-0000-000000000001';
+
+// Three tutorials exercising the three item shapes.
+const TUT_FK_ONLY   = { ID: 'cccccccc-1866-aaaa-0000-000000000011', legacyId: 10009075, slug: 'fk-only-agent',     title: 'FK Only Agent' };
+const TUT_LEGACY    = { ID: 'cccccccc-1866-aaaa-0000-000000000012', legacyId: 10009076, slug: 'legacy-only-agent', title: 'Legacy Only Agent' };
+const TUT_BOTH      = { ID: 'cccccccc-1866-aaaa-0000-000000000013', legacyId: 10009077, slug: 'both-set-agent',    title: 'Both Set Agent' };
+
+describe('App-Space / event progress: FK-first tutorial resolution (#1866)', () => {
+  beforeAll(async () => {
+    const { Events, Missions, CompletionPaths, CompletionPathItems, Tutorials } =
+      cds.entities('com.sap.developers.ims');
+
+    await INSERT.into(Tutorials).entries([TUT_FK_ONLY, TUT_LEGACY, TUT_BOTH]);
+
+    await INSERT.into(Missions).entries({
+      ID: MISSION_ID, legacyId: 10009001, title: 'Event Mission', slug: 'event-mission',
+      description: 'Mission for the app-space event', published: true, event_ID: null,
+    });
+
+    await INSERT.into(Events).entries({
+      ID: 'eeeeeeee-1866-aaaa-0000-000000000001', legacyId: EVENT_ID,
+      name: 'FK Resolution Test Event', eventType: 'OTHER', mission_ID: MISSION_ID,
+    });
+
+    await INSERT.into(CompletionPaths).entries({
+      ID: PATH_ID, legacyId: 10009050, name: 'Event Mission', mission_ID: MISSION_ID,
+    });
+
+    await INSERT.into(CompletionPathItems).entries([
+      // FK-only: tutorial_ID set, taskLegacyId NULL (the broken shape).
+      { ID: 'dddddddd-1866-aaaa-0000-000000000001', path_ID: PATH_ID, itemOrder: 1,
+        taskType: 'TUTORIAL', taskLegacyId: null, tutorial_ID: TUT_FK_ONLY.ID },
+      // Legacy-only: taskLegacyId set, tutorial_ID NULL (legacy shape).
+      { ID: 'dddddddd-1866-aaaa-0000-000000000002', path_ID: PATH_ID, itemOrder: 2,
+        taskType: 'TUTORIAL', taskLegacyId: TUT_LEGACY.legacyId, tutorial_ID: null },
+      // Both set: FK wins, must still resolve correctly.
+      { ID: 'dddddddd-1866-aaaa-0000-000000000003', path_ID: PATH_ID, itemOrder: 3,
+        taskType: 'TUTORIAL', taskLegacyId: TUT_BOTH.legacyId, tutorial_ID: TUT_BOTH.ID },
+    ]);
+  });
+
+  afterAll(async () => {
+    const { Events, Missions, CompletionPaths, CompletionPathItems, Tutorials } =
+      cds.entities('com.sap.developers.ims');
+    await DELETE.from(CompletionPathItems).where({ path_ID: PATH_ID });
+    await DELETE.from(CompletionPaths).where({ ID: PATH_ID });
+    await DELETE.from(Events).where({ legacyId: EVENT_ID });
+    await DELETE.from(Missions).where({ ID: MISSION_ID });
+    await DELETE.from(Tutorials).where({ ID: { in: [TUT_FK_ONLY.ID, TUT_LEGACY.ID, TUT_BOTH.ID] } });
+  });
+
+  it('getAppSpaceProgress populates title/url for all three item shapes', async () => {
+    const { data } = await project.get(`/api/getAppSpaceProgress(eventLegacyId=${EVENT_ID})`);
+
+    const items = data.paths.flatMap(p => p.items);
+    expect(items).toHaveLength(3);
+
+    const byTitle = Object.fromEntries(items.map(i => [i.title, i]));
+
+    // FK-only item: previously blank; now resolved via tutorial_ID.
+    expect(byTitle[TUT_FK_ONLY.title]).toBeDefined();
+    expect(byTitle[TUT_FK_ONLY.title].url).toBe(`/tutorials/${TUT_FK_ONLY.slug}.html`);
+    expect(byTitle[TUT_FK_ONLY.title].imsId).toBe(TUT_FK_ONLY.legacyId); // effective legacyId
+
+    // Legacy-only item: unchanged fallback path still works.
+    expect(byTitle[TUT_LEGACY.title].url).toBe(`/tutorials/${TUT_LEGACY.slug}.html`);
+    expect(byTitle[TUT_LEGACY.title].imsId).toBe(TUT_LEGACY.legacyId);
+
+    // Both set: FK wins, resolves to the same tutorial.
+    expect(byTitle[TUT_BOTH.title].url).toBe(`/tutorials/${TUT_BOTH.slug}.html`);
+    expect(byTitle[TUT_BOTH.title].imsId).toBe(TUT_BOTH.legacyId);
+
+    // No empty cards.
+    for (const i of items) {
+      expect(i.title).not.toBe('');
+      expect(i.url).not.toBe('');
+    }
+  });
+
+  it('getEventProgress resolves the FK-only item too', async () => {
+    const { data } = await project.get(`/api/getEventProgress(missionLegacyId=10009001)`,
+      { auth: { username: 'developer', password: 'developer' } });
+    const items = data.paths.flatMap(p => p.items);
+    const fkItem = items.find(i => i.title === TUT_FK_ONLY.title);
+    expect(fkItem).toBeDefined();
+    expect(fkItem.url).toBe(`/tutorials/${TUT_FK_ONLY.slug}.html`);
+    expect(fkItem.imsId).toBe(TUT_FK_ONLY.legacyId);
+  });
+});

From 6a0b1a040fa5f798d07643f9c6f208a03261a85c Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 14:57:30 -0400
Subject: [PATCH 23/46] fix(admin-shell): rename BTP Subaccount nav item to SAP
 Business AI Platform Subaccount (#2588)

Completes the SAP BTP -> SAP Business AI Platform user-facing rename
for the admin-shell BAIP external-links group. The nav title in
webapp/model/navigation.json and the TITLES expectation in
admin-shell-baip-links.test.js were out of sync (source renamed, test
not), failing the unit suite on PR #2600. Both now say
'SAP Business AI Platform Subaccount'.
---
 app/admin-shell/webapp/model/navigation.json | 2 +-
 test/unit/admin-shell-baip-links.test.js     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/admin-shell/webapp/model/navigation.json b/app/admin-shell/webapp/model/navigation.json
index 2612410f8..5dce31908 100644
--- a/app/admin-shell/webapp/model/navigation.json
+++ b/app/admin-shell/webapp/model/navigation.json
@@ -154,7 +154,7 @@
       "requiredScope": "Admin",
       "items": [
         { "key": "baipAiLaunchpad", "title": "AI Launchpad", "href": "https://tutorial-system.ai-launchpad.prod.eu-central-1.aws.ai-prod.cloud.sap/aic/index.html", "target": "_blank", "requiredScope": "Admin" },
-        { "key": "baipBtpSubaccount", "title": "BTP Subaccount", "href": "https://emea.cockpit.btp.cloud.sap/cockpit/#/globalaccount/a0ec0d63-f690-42ab-8113-9f6567cd897e/subaccount/3c6fa3f1-db8c-4e47-9048-fa8c84b867cb/subaccountoverview", "target": "_blank", "requiredScope": "Admin" },
+        { "key": "baipBtpSubaccount", "title": "SAP Business AI Platform Subaccount", "href": "https://emea.cockpit.btp.cloud.sap/cockpit/#/globalaccount/a0ec0d63-f690-42ab-8113-9f6567cd897e/subaccount/3c6fa3f1-db8c-4e47-9048-fa8c84b867cb/subaccountoverview", "target": "_blank", "requiredScope": "Admin" },
         { "key": "baipHanaCloud", "title": "HANA Cloud", "href": "https://devrel.hana-tooling.ingress.orchestration.prod-eu10.hanacloud.ondemand.com/hcs/sap/hana/cloud/index.html", "target": "_blank", "requiredScope": "Admin" },
         { "key": "baipIasAdminConsole", "title": "IAS Admin Console", "href": "https://atxgsg7zi.accounts.ondemand.com/admin/#/applications/17b636dd-fa87-4cd8-b0f2-0abd5f9a3042", "target": "_blank", "requiredScope": "Admin" }
       ]
diff --git a/test/unit/admin-shell-baip-links.test.js b/test/unit/admin-shell-baip-links.test.js
index 1564a5c43..2621ce8de 100644
--- a/test/unit/admin-shell-baip-links.test.js
+++ b/test/unit/admin-shell-baip-links.test.js
@@ -19,7 +19,7 @@ const EXPECTED = {
 
 const TITLES = {
   baipAiLaunchpad:   'AI Launchpad',
-  baipBtpSubaccount: 'BTP Subaccount',
+  baipBtpSubaccount: 'SAP Business AI Platform Subaccount',
   baipHanaCloud:     'HANA Cloud',
   baipIasAdminConsole: 'IAS Admin Console'
 };

From c711fbaabe720da15d279d4cf26c77213936e07f Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 16:22:43 -0400
Subject: [PATCH 24/46] fix(petoberfest-admin): uploader email fallback + photo
 on detail page
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses the Petoberfest admin moderation UI follow-ups to #2597:

- Uploader never blank: PetSubmissions projection now exposes
  coalesce(uploaderName, user.email) as uploaderName, so moderators
  always see the submitter's name or email (uploaderEmail still
  surfaced separately). Scalar path expression — no LOB, no redirect.
- Thumbnail is a plain preview; clicking the row navigates to the
  ObjectPage (dropped the separate enlarge dialog + PhotoThumb.js).
- ObjectPage shows the full-size photo via a new PhotoView custom
  section, fetched from the auth-gated /admin/petoberfest/photo/:id
  express route (LOB stays out of the OData projection).
- Added explicit ID to the Details facet so the manifest section
  anchor is stable.
- 2 new unit tests for the uploaderName fallback (11 passing).

Admin-UI is bundle-gated: needs a full deploy to appear on DEV.
---
 app/admin-annotations.cds                     |  2 +-
 .../webapp/ext/PhotoThumb.fragment.xml        | 13 ++--
 .../petoberfest/webapp/ext/PhotoThumb.js      | 68 -------------------
 .../webapp/ext/PhotoView.fragment.xml         | 18 +++++
 app/admin/petoberfest/webapp/manifest.json    | 16 ++++-
 srv/admin-service.cds                         | 13 ++--
 test/unit/petoberfest-admin.test.js           | 23 +++++++
 7 files changed, 70 insertions(+), 83 deletions(-)
 delete mode 100644 app/admin/petoberfest/webapp/ext/PhotoThumb.js
 create mode 100644 app/admin/petoberfest/webapp/ext/PhotoView.fragment.xml

diff --git a/app/admin-annotations.cds b/app/admin-annotations.cds
index 20f1137c7..5a283a3ce 100644
--- a/app/admin-annotations.cds
+++ b/app/admin-annotations.cds
@@ -4255,7 +4255,7 @@ annotate AdminService.PetSubmissions with @(
     { Value: uploadedAt,   Label: 'Uploaded At' }
   ]},
   UI.Facets: [
-    { $Type: 'UI.ReferenceFacet', Label: 'Details', Target: '@UI.FieldGroup#Details' }
+    { $Type: 'UI.ReferenceFacet', ID: 'Details', Label: 'Details', Target: '@UI.FieldGroup#Details' }
   ],
   UI.Identification: [
     { $Type: 'UI.DataFieldForAction', Action: 'AdminService.approve', Label: 'Approve' },
diff --git a/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml b/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml
index 52beae5cd..58d0988dc 100644
--- a/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml
+++ b/app/admin/petoberfest/webapp/ext/PhotoThumb.fragment.xml
@@ -1,17 +1,14 @@
 <core:FragmentDefinition
   xmlns:core="sap.ui.core"
-  xmlns:m="sap.m"
-  core:require="{ handler: 'sap/tutorials/admin/petoberfest/ext/PhotoThumb' }">
-  <!-- Issue #2597: press the thumbnail to open a centered, full-size preview
-       (replaces the non-functional "Open in New Tab"). sap.m.Image has no
-       hover event, so press is used — also keyboard/touch accessible. -->
+  xmlns:m="sap.m">
+  <!-- Issue #2597 / follow-up: the thumbnail is a plain preview. Clicking the
+       row (including this cell) navigates to the submission ObjectPage, which
+       shows the full-size photo — there is no separate enlarge dialog. -->
   <m:Image
     src="{= '/admin/petoberfest/photo/' + ${ID} + '?size=thumb' }"
     width="60px"
     height="60px"
     densityAware="false"
-    press="handler.onEnlarge"
-    alt="{= 'Photo of ' + (${petName} || 'submission') + ' — click to enlarge' }"
-    tooltip="Click to enlarge"
+    alt="{= 'Photo of ' + (${petName} || 'submission') }"
     class="sapUiTinyMargin" />
 </core:FragmentDefinition>
diff --git a/app/admin/petoberfest/webapp/ext/PhotoThumb.js b/app/admin/petoberfest/webapp/ext/PhotoThumb.js
deleted file mode 100644
index 041ebc8e5..000000000
--- a/app/admin/petoberfest/webapp/ext/PhotoThumb.js
+++ /dev/null
@@ -1,68 +0,0 @@
-sap.ui.define([
-	"sap/m/Dialog",
-	"sap/m/Image",
-	"sap/m/Button"
-], function (Dialog, Image, Button) {
-	"use strict";
-
-	// Issue #2597: moderators asked to "see the pictures larger before
-	// approving" and for a centered large version — the old "Open in New Tab"
-	// did nothing. sap.m.Image exposes no hover event, so we enlarge on press
-	// (click / Enter / Space), which is also keyboard- and touch-accessible.
-	// The full-size (1280px) image is the same auth-gated express route as the
-	// thumbnail, just without ?size=thumb.
-	return {
-		/**
-		 * Open a centered modal dialog showing the full-size submission photo.
-		 * Bound from PhotoThumb.fragment.xml via core:require.
-		 * @param {sap.ui.base.Event} oEvent press event from the thumbnail Image
-		 */
-		onEnlarge: function (oEvent) {
-			var oImageCtrl = oEvent.getSource();
-			var oContext = oImageCtrl.getBindingContext();
-			if (!oContext) {
-				return;
-			}
-			var sId = oContext.getProperty("ID");
-			var sPetName = oContext.getProperty("petName") || "Submission";
-			if (!sId) {
-				return;
-			}
-
-			var oDialog = new Dialog({
-				title: sPetName,
-				// Cap the dialog to the viewport so very large photos stay
-				// centered and fully visible; the image scales within.
-				contentWidth: "90vw",
-				contentHeight: "90vh",
-				horizontalScrolling: true,
-				verticalScrolling: true,
-				resizable: true,
-				draggable: true,
-				content: [
-					new Image({
-						// Omit ?size=thumb to fetch the 1280px display render.
-						src: "/admin/petoberfest/photo/" + encodeURIComponent(sId),
-						densityAware: false,
-						alt: "Full-size photo of " + sPetName,
-						// Fit the width of the dialog content; height follows
-						// the image aspect ratio.
-						width: "100%"
-					})
-				],
-				endButton: new Button({
-					text: "Close",
-					press: function () {
-						oDialog.close();
-					}
-				}),
-				afterClose: function () {
-					oDialog.destroy();
-				}
-			});
-
-			oDialog.addStyleClass("sapUiContentPadding");
-			oDialog.open();
-		}
-	};
-});
diff --git a/app/admin/petoberfest/webapp/ext/PhotoView.fragment.xml b/app/admin/petoberfest/webapp/ext/PhotoView.fragment.xml
new file mode 100644
index 000000000..d2a1e6228
--- /dev/null
+++ b/app/admin/petoberfest/webapp/ext/PhotoView.fragment.xml
@@ -0,0 +1,18 @@
+<core:FragmentDefinition
+  xmlns:core="sap.ui.core"
+  xmlns:m="sap.m">
+  <!-- Issue #2597 follow-up: show the full-size submission photo on the
+       ObjectPage. The photo LOB is intentionally excluded from the
+       PetSubmissions OData projection (LOB locators expire when mixed with
+       non-BLOB columns on HANA — see srv/admin-service.cds), so the image is
+       fetched from the dedicated auth-gated express route. Omitting
+       ?size=thumb returns the 1280px display render. -->
+  <m:VBox class="sapUiMediumMargin">
+    <m:Image
+      src="{= '/admin/petoberfest/photo/' + ${ID} }"
+      densityAware="false"
+      alt="{= 'Photo of ' + (${petName} || 'submission') }"
+      width="100%"
+      class="sapUiResponsiveMargin" />
+  </m:VBox>
+</core:FragmentDefinition>
diff --git a/app/admin/petoberfest/webapp/manifest.json b/app/admin/petoberfest/webapp/manifest.json
index 5534ad4ce..18de0a9f3 100644
--- a/app/admin/petoberfest/webapp/manifest.json
+++ b/app/admin/petoberfest/webapp/manifest.json
@@ -125,7 +125,21 @@
           "options": {
             "settings": {
               "contextPath": "/PetSubmissions",
-              "editableHeaderContent": false
+              "editableHeaderContent": false,
+              "content": {
+                "body": {
+                  "sections": {
+                    "PhotoSection": {
+                      "title": "Photo",
+                      "position": {
+                        "placement": "Before",
+                        "anchor": "Details"
+                      },
+                      "template": "sap.tutorials.admin.petoberfest.ext.PhotoView"
+                    }
+                  }
+                }
+              }
             }
           }
         },
diff --git a/srv/admin-service.cds b/srv/admin-service.cds
index a4b55e911..550f47855 100644
--- a/srv/admin-service.cds
+++ b/srv/admin-service.cds
@@ -172,12 +172,15 @@ service AdminService {
   // admin user is provisioned (Admin + Tutorial.Author roles together).
   // A Tutorial.Author-only user (without Admin) cannot reach this service.
   entity PetSubmissions as projection on ims.PetSubmissions {
-    ID, petName, uploaderName, moderation, sizeBytes, uploadedAt,
+    ID, petName, moderation, sizeBytes, uploadedAt,
     // uploaderName is NULL when the uploader's token lacked given_name/
-    // family_name claims (#2597). Flatten the uploader's email from the
-    // user association so moderators can always identify/contact the
-    // submitter. Scalar path expression (like contestSlug below) — no LOB,
-    // no redirect (Users is not projected into AdminService).
+    // family_name claims (#2597). Fall back to the uploader's email so the
+    // Uploader column/field is never blank — moderators can always identify
+    // the submitter. The raw email is still surfaced separately as
+    // uploaderEmail below. coalesce over the user association is a scalar
+    // path expression (no LOB, no redirect; Users is not projected into
+    // AdminService).
+    coalesce(uploaderName, user.email) as uploaderName : String,
     user.email as uploaderEmail,
     petoberfest.slug as contestSlug, petoberfest.title as contestTitle
   } actions {
diff --git a/test/unit/petoberfest-admin.test.js b/test/unit/petoberfest-admin.test.js
index e7c40ddf0..d9b108cf6 100644
--- a/test/unit/petoberfest-admin.test.js
+++ b/test/unit/petoberfest-admin.test.js
@@ -27,6 +27,29 @@ test('PetSubmissions projection exposes uploaderEmail flattened from the user as
   expect(row.uploaderEmail).toBe('tom@example.com');
 });
 
+test('uploaderName falls back to the uploader email when the name is NULL', async () => {
+  // s1 was seeded with no uploaderName (token lacked given_name/family_name).
+  // The projection coalesce(uploaderName, user.email) must surface the email
+  // so the Uploader column/field is never blank.
+  const srv = await cds.connect.to('AdminService');
+  const row = await srv.tx({ user: ADMIN_USER }, (tx) =>
+    tx.run(SELECT.one.from('AdminService.PetSubmissions').columns('ID', 'uploaderName').where({ ID: 's1' })));
+  expect(row.uploaderName).toBe('tom@example.com');
+});
+
+test('uploaderName keeps the real name when present (no fallback)', async () => {
+  const { PetSubmissions } = cds.entities('com.sap.developers.ims');
+  await db.run(INSERT.into(PetSubmissions).entries({
+    ID: 'named', petoberfest_ID: 'p1', user_ID: 'u1', petName: 'Bella',
+    uploaderName: 'Tom Jung', moderation: 'PENDING', mimeType: 'image/webp',
+    uploadedAt: '2026-08-01T00:00:00Z',
+  }));
+  const srv = await cds.connect.to('AdminService');
+  const row = await srv.tx({ user: ADMIN_USER }, (tx) =>
+    tx.run(SELECT.one.from('AdminService.PetSubmissions').columns('ID', 'uploaderName').where({ ID: 'named' })));
+  expect(row.uploaderName).toBe('Tom Jung');
+});
+
 test('approve sets moderation APPROVED', async () => {
   const srv = await cds.connect.to('AdminService');
   await srv.tx({ user: ADMIN_USER }, async (tx) => {

From 746f0df3773141d6568f677992398abea30a6c2f Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 16:40:24 -0400
Subject: [PATCH 25/46] feat(signin): wire /signin chooser into login flow +
 relabel buttons
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Relabel the two IdP-chooser buttons and route the deliberate sign-in
action through the /signin chooser instead of straight to one IdP.

- signin.html: buttons → "Sign in with SAP Account" and "Sign In if you
  don't already have an SAP Account" (hrefs/sap_idp keys unchanged);
  forward a safe relative returnTo onto the chosen /login?sap_idp URL.
- header.html: shellbar profile-click (anonymous) → /signin?returnTo=…
  so the user picks an IdP. maybeAutoLogin (silent returning-visitor
  SSO, #1689) still targets /login directly — must not surface a chooser.
- AppSpace.vue: step-1 "Log in with your SAP ID" is now a live sign-in
  link while anonymous (same /signin flow); passive label once logged in.
- authentication.md: document the chooser-in-flow + returnTo forwarding.
- e2e/signin.spec.ts: update button-label assertions to new labels.
---
 .../developers/architecture/authentication.md |  6 ++--
 hugo-apps/src/app-space/AppSpace.vue          | 33 ++++++++++++++++++-
 hugo/layouts/partials/header.html             |  5 ++-
 hugo/layouts/signin.html                      | 21 +++++++++---
 test/e2e/signin.spec.ts                       |  4 +--
 5 files changed, 59 insertions(+), 10 deletions(-)

diff --git a/docs/developers/architecture/authentication.md b/docs/developers/architecture/authentication.md
index d00570456..4adb06f1f 100644
--- a/docs/developers/architecture/authentication.md
+++ b/docs/developers/architecture/authentication.md
@@ -426,8 +426,10 @@ The platform provides a themed public sign-in page (`/signin`) that allows users
 
 The `/signin` page is a public, unauthenticated Hugo page (served by AppRouter with `authenticationType: "none"`). It presents two buttons:
 
-1. **"Sign in with SAP"** — Routes to `/login?sap_idp=sap.default` (SAP ID Service, the default universal IDP)
-2. **"Sign in with SAP Universal ID"** — Routes to `/login?sap_idp=sap.custom` (IAS tenant `atxgsg7zi`, which federates social providers like GitHub, Google, Microsoft)
+1. **"Sign in with SAP Account"** — Routes to `/login?sap_idp=sap.default` (SAP ID Service, the default universal IDP)
+2. **"Sign In if you don't already have an SAP Account"** — Routes to `/login?sap_idp=sap.custom` (IAS tenant `atxgsg7zi`, which federates social providers like GitHub, Google, Microsoft)
+
+The `/signin` chooser is reached when an anonymous visitor deliberately signs in (the shellbar profile action redirects to `/signin?returnTo=<path>`); the chooser forwards that `returnTo` onto the chosen `/login?sap_idp=…` URL so the user lands back where they started. The silent returning-visitor auto-login (`maybeAutoLogin`, issue #1689) still targets `/login` directly — it resolves transparently against an existing IdP SSO session and must not surface the chooser.
 
 Both flows eventually reach the same app via XSUAA, which re-issues its own OAuth token. The user sees XSUAA's token in the session, not the upstream IdP's token.
 
diff --git a/hugo-apps/src/app-space/AppSpace.vue b/hugo-apps/src/app-space/AppSpace.vue
index d4faf7f00..37486b138 100644
--- a/hugo-apps/src/app-space/AppSpace.vue
+++ b/hugo-apps/src/app-space/AppSpace.vue
@@ -251,6 +251,14 @@ function goBack() {
   selectedTrack.value = null
 }
 
+// Start the deliberate sign-in flow — same destination as the shellbar profile
+// click in hugo/layouts/partials/header.html: the /signin IdP chooser, carrying
+// a safe relative returnTo so the user lands back on this page after auth.
+function startLogin() {
+  const returnTo = window.location.pathname + window.location.search
+  window.location.href = '/signin?returnTo=' + encodeURIComponent(returnTo)
+}
+
 function handleItemClick(track: AppSpaceTrack, index: number, item: AppSpaceItem) {
   if (item.type === 'TUTORIAL' && isItemUnlocked(track, index) && item.url) {
     window.open(item.url, '_blank')
@@ -347,7 +355,16 @@ const emptyStateMessage = computed(() => {
           { icon: '4', text: 'Earn your prize!' }
         ]" :key="i">
           <span class="instruction-icon">{{ step.icon }}</span>
-          <span class="instruction-text">{{ step.text }}</span>
+          <!-- Step 1 is a live sign-in affordance while anonymous: starts the
+               same flow as the shellbar profile click (→ /signin chooser). Once
+               logged in it reverts to a passive label. -->
+          <a
+            v-if="i === 0 && !isLoggedIn"
+            class="instruction-text instruction-text--login"
+            href="#"
+            @click.prevent="startLogin()"
+          >{{ step.text }}</a>
+          <span v-else class="instruction-text">{{ step.text }}</span>
         </div>
       </div>
     </section>
@@ -685,6 +702,20 @@ const emptyStateMessage = computed(() => {
   opacity: 0.9;
 }
 
+/* Step 1 as a sign-in link while anonymous — inherits the hero's light text on
+   its dark background rather than a clashing default link color. */
+.instruction-text--login {
+  color: inherit;
+  text-decoration: underline;
+  text-underline-offset: 2px;
+  cursor: pointer;
+}
+.instruction-text--login:hover,
+.instruction-text--login:focus-visible {
+  opacity: 1;
+  text-decoration-thickness: 2px;
+}
+
 
 /* ── Content Area ──────────────────────────────────────── */
 .content-area {
diff --git a/hugo/layouts/partials/header.html b/hugo/layouts/partials/header.html
index d90f63674..b1f32cc6d 100644
--- a/hugo/layouts/partials/header.html
+++ b/hugo/layouts/partials/header.html
@@ -213,7 +213,10 @@
     if (!isAuthenticated) {
       try { localStorage.removeItem('autologin.optout'); } catch {}
       try { sessionStorage.setItem('autologin.tried', '1'); } catch {}
-      window.location.href = '/login?returnTo=' + encodeURIComponent(window.location.pathname + window.location.search);
+      // Deliberate sign-in: send to the /signin IdP chooser (not straight to
+      // /login) so the user picks an identity provider. maybeAutoLogin (silent
+      // returning-visitor SSO) still uses /login directly — see below.
+      window.location.href = '/signin?returnTo=' + encodeURIComponent(window.location.pathname + window.location.search);
       return;
     }
     closeAllExcept(userPopover);
diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index 484df46d2..55df13a8e 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -9,16 +9,29 @@ <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developer
       </p>
     </ui5-illustrated-message>
     <div class="signin-actions">
-      <a class="fd-button fd-button--emphasized signin-btn" href="/login?sap_idp=sap.default">
-        Sign in with SAP
+      <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
+        Sign in with SAP Account
       </a>
-      <a class="fd-button fd-button--transparent signin-btn" href="/login?sap_idp=sap.custom">
-        Sign in with SAP Universal ID
+      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom">
+        Sign In if you don't already have an SAP Account
       </a>
     </div>
   </div>
 </section>
 
+<script>
+  // Carry a safe relative returnTo through the IdP choice so the user lands
+  // back where they started after auth. Mirrors login-redirect.html's
+  // open-redirect guard: only same-origin relative paths, never //host.
+  (function () {
+    var rt = new URLSearchParams(window.location.search).get('returnTo');
+    if (!rt || rt.charAt(0) !== '/' || rt.startsWith('//')) return;
+    document.querySelectorAll('a[data-signin-idp]').forEach(function (a) {
+      a.href += '&returnTo=' + encodeURIComponent(rt);
+    });
+  })();
+</script>
+
 <style>
   .signin-hero {
     padding: 4rem 1.5rem;
diff --git a/test/e2e/signin.spec.ts b/test/e2e/signin.spec.ts
index 8013c47db..d19d11732 100644
--- a/test/e2e/signin.spec.ts
+++ b/test/e2e/signin.spec.ts
@@ -33,8 +33,8 @@ describe.skipIf(!hasBaseUrl())('e2e: /signin page (IAS social login, #2506)', ()
       expect(response, 'no response received').not.toBeNull();
       expect(response!.status(), 'unexpected status for /signin').toBe(200);
 
-      const sapBtn = page.getByRole('link', { name: 'Sign in with SAP', exact: true });
-      const uidBtn = page.getByRole('link', { name: 'Sign in with SAP Universal ID' });
+      const sapBtn = page.getByRole('link', { name: 'Sign in with SAP Account', exact: true });
+      const uidBtn = page.getByRole('link', { name: "Sign In if you don't already have an SAP Account", exact: true });
 
       await expect(sapBtn).toBeVisible();
       await expect(uidBtn).toBeVisible();

From 74b123a5440faa9be027fc1a4e19aa7e77da7225 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Fri, 2 Oct 2026 17:37:17 -0400
Subject: [PATCH 26/46] fix(signin): exempt /signin chooser from silent
 auto-login

The /signin IdP chooser (shipped in 746f0df37) is where a deliberate
profile-click lands so the user can pick an identity provider. But
maybeAutoLogin() runs on every page via the header partial and only
exempts the homepage (/). For any returning visitor
(localStorage['auth.returning']==='1', durable across sessions), landing
on /signin triggers an immediate location.replace('/login?...') before
the chooser renders, silently SSO-ing them in and skipping the choice
entirely. The chooser was effectively unreachable for its intended
audience.

Exempt /signin (trailing-slash tolerant) from maybeAutoLogin the same
way / is exempt, so the chooser always renders when the user asked for
it.
---
 hugo/layouts/partials/header.html | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hugo/layouts/partials/header.html b/hugo/layouts/partials/header.html
index b1f32cc6d..f9839711b 100644
--- a/hugo/layouts/partials/header.html
+++ b/hugo/layouts/partials/header.html
@@ -455,8 +455,11 @@
   // transparently; if not, the IDP bounces straight back and the 'tried' flag
   // (set before the redirect) prevents a loop.
   function maybeAutoLogin() {
-    // Homepage (/) is exempt — never auto-redirect there.
-    if (window.location.pathname === '/') return;
+    // Homepage (/) and the deliberate IdP chooser (/signin) are exempt — never
+    // auto-redirect there. The chooser is where a returning visitor goes to pick
+    // an IdP (profile-click → /signin); auto-bouncing it to /login would skip the
+    // choice and silently SSO them in — the exact bug this guards against.
+    if (window.location.pathname === '/' || window.location.pathname.replace(/\/$/, '') === '/signin') return;
     // Returning-visitor gate: only auto-login browsers that have authenticated
     // here before. Fail closed (unreadable storage → don't bounce).
     try { if (localStorage.getItem('auth.returning') !== '1') return; } catch { return; }

From bf2e5016e9c4759698d554ed1bb90ec780175f79 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 01:53:58 -0400
Subject: [PATCH 27/46] fix(signin): relabel chooser options for clarity

Option 1: 'Sign in with SAP Account' -> 'Sign in SAP Universal Account'
Option 2: 'Sign In if you don't already have an SAP Account' -> 'Other Options including Social Login'

Copy-only change; no flow/behavior change.
---
 hugo/layouts/signin.html | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index 55df13a8e..f6bf2d301 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -10,10 +10,10 @@ <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developer
     </ui5-illustrated-message>
     <div class="signin-actions">
       <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
-        Sign in with SAP Account
+        Sign in SAP Universal Account
       </a>
       <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom">
-        Sign In if you don't already have an SAP Account
+        Other Options including Social Login
       </a>
     </div>
   </div>

From 437dc78255efca6ad1f3a3d6fab9f4fd7400f70f Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 02:03:49 -0400
Subject: [PATCH 28/46] chore(approuter): upgrade @sap/approuter 16.9.0 ->
 23.3.0 (security)

Approuter was scaffolded at ^16.0.0 (2026-04-22) and the caret cap froze it
on the 16.x maintenance line, missing 7 majors of security hardening
(PKCE+state default-on, AES-256-GCM cookie crypto, path-traversal rejection,
cookie partitioning). Default branch currently shows 6 critical / 157 high
Dependabot advisories; the stale approuter is a material contributor.

- Bump @sap/approuter ^16.0.0 -> ^23.3.0
- Pin engines node ^22||^24 (root already requires >=22.12; 23.x drops Node 20)

Verified locally against installed 23.3.0 source:
- Boots as 'Application router version 23.3.0' with the custom server.js
  extensions/insertMiddleware API intact (config schema accepted; only
  env-specific static/destination resources missing in a raw worktree).
- sap_idp query param STILL supported (url-utils SAP_IDP_QUERY_PARAM;
  path-rewriter honors it with dynamicIdentityProvider routes) -> the
  /signin chooser + login flow are unaffected.

Does NOT change logout topology: approuter remains XSUAA-bound (no IAS
binding), so native IAS end_session still does not fire. Clean-logout /
event-floor requirement tracked separately (needs IAS-fronted auth).

Full auth regression to be validated on DEV deploy (PKCE/state default-on,
cookie-model session reset at cutover, websockets, admin-ui).
---
 approuter/package-lock.json | 1336 +++++++++++++++--------------------
 approuter/package.json      |    5 +-
 2 files changed, 581 insertions(+), 760 deletions(-)

diff --git a/approuter/package-lock.json b/approuter/package-lock.json
index fcac2e2f8..7d8e6f12b 100644
--- a/approuter/package-lock.json
+++ b/approuter/package-lock.json
@@ -6,11 +6,14 @@
     "": {
       "name": "tutorials-approuter",
       "dependencies": {
-        "@sap/approuter": "^16.0.0",
+        "@sap/approuter": "^23.3.0",
         "jose": "^5.10.0",
         "sharp": "0.35.0",
         "tar": "^7.5.21",
         "undici": "^6.28.0"
+      },
+      "engines": {
+        "node": "^22.0.0 || ^24.0.0"
       }
     },
     "node_modules/@colors/colors": {
@@ -580,6 +583,12 @@
         "url": "https://opencollective.com/libvips"
       }
     },
+    "node_modules/@ioredis/commands": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/@ioredis/commands/-/commands-2.0.0.tgz",
+      "integrity": "sha512-vrx0AE/T0h7cRZwfo1M39Cr+ZhZrkf0V8mQN75wucKCxCLD9l/VX6no3gFvrLqD1IlG/1LtzWovqEw3t0Vr9zg==",
+      "license": "MIT"
+    },
     "node_modules/@isaacs/fs-minipass": {
       "version": "4.0.1",
       "resolved": "https://registry.npmjs.org/@isaacs/fs-minipass/-/fs-minipass-4.0.1.tgz",
@@ -593,273 +602,180 @@
       }
     },
     "node_modules/@sap/approuter": {
-      "version": "16.9.0",
-      "resolved": "https://registry.npmjs.org/@sap/approuter/-/approuter-16.9.0.tgz",
-      "integrity": "sha512-KCxYGdXG0vLHZHG0kOEIzxaid1+xZRxj6GSCIOUNd1Hp8EYR6IVOWI5Ntbp+IqVGGGAS9EzMcaRPpCRYJya+1A==",
+      "version": "23.3.0",
+      "resolved": "https://registry.npmjs.org/@sap/approuter/-/approuter-23.3.0.tgz",
+      "integrity": "sha512-q+ypAKKkXLSPzoXDwN+gyRow7ePb0VCEaWdsco/a4oadQemsQs5xQRnUOHvzDwi7OZBeIr4G/9GwPEhegcQXtg==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
-        "@sap/audit-logging": "6.1.0",
-        "@sap/e2e-trace": "4.1.0",
-        "@sap/logging": "^7.1.0",
-        "@sap/xsenv": "^4.0.0",
-        "@sap/xssec": "3.6.1",
-        "agentkeepalive": "2.0.5",
-        "axios": "1.7.4",
-        "axios-cookiejar-support": "2.0.3",
+        "@sap/audit-logging": "7.0.0",
+        "@sap/e2e-trace": "6.0.0",
+        "@sap/logging": "9.2.3",
+        "@sap/xsenv": "6.0.0",
+        "@sap/xssec": "4.12.2",
+        "agentkeepalive": "4.6.0",
+        "axios": "1.20.0",
+        "axios-cookiejar-support": "5.0.5",
+        "axios-retry": "4.5.0",
         "base64-url": "2.3.3",
-        "basic-auth": "1.0.3",
-        "body-parser": "1.20.3",
-        "cf-nodejs-logging-support": "^7.2.0",
-        "commander": "2.9.0",
+        "basic-auth": "1.1.0",
+        "body-parser": "2.3.0",
+        "cf-nodejs-logging-support": "8.0.0",
+        "commander": "2.20.3",
         "compressible": "2.0.18",
-        "compression": "1.7.4",
-        "connect": "3.6.5",
-        "cookie": "0.2.2",
-        "cookie-parser": "1.4.6",
-        "cookie-signature": "1.1.0",
-        "debug": "4.3.2",
-        "deepmerge": "2.1.1",
+        "compression": "1.8.2",
+        "connect": "3.7.0",
+        "cookie": "1.1.1",
+        "cookie-parser": "1.4.7",
+        "cookie-signature": "1.2.2",
+        "debug": "4.4.3",
+        "deepmerge": "2.2.1",
         "encodeurl": "1.0.2",
-        "express-session": "1.17.0",
-        "http-proxy-agent": "4.0.1",
-        "https-proxy-agent": "5.0.0",
-        "ioredis": "4.28.5",
-        "jwt-decode": "2.0.1",
-        "lodash": "4.17.21",
-        "lru-cache": "4.0.0",
-        "mime": "1.4.1",
-        "ms": "2.1.1",
-        "mustache": "2.2.1",
-        "node-cache": "4.1.1",
-        "node-forge": "^1.3.0",
-        "passport": "^0.6.0",
-        "query-string": "7.1.2",
+        "express-session": "1.19.0",
+        "http-proxy-agent": "7.0.2",
+        "https-proxy-agent": "7.0.6",
+        "ioredis": "6.0.0",
+        "jwt-decode": "2.2.0",
+        "lodash": "4.18.1",
+        "lru-cache": "4.1.5",
+        "mime": "4.1.0",
+        "ms": "2.1.3",
+        "mustache": "4.2.0",
+        "node-cache": "5.1.2",
+        "passport": "0.7.0",
         "request-stats": "2.0.1",
         "safe-regex": "1.1.0",
-        "send": "0.19.0",
-        "serve-static": "1.16.2",
-        "tough-cookie": "4.1.3",
-        "tv4": "1.2.7",
+        "send": "0.19.2",
+        "serve-static": "1.16.3",
+        "tough-cookie": "4.1.4",
+        "tv4": "1.3.0",
         "uid-safe": "2.1.5",
-        "urijs": "^1.19.11",
-        "uuid": "8.3.2",
-        "validator": "13.7.0",
-        "verror": "1.10.0",
-        "ws": "7.5.10",
-        "wtfnode": "0.9.1"
+        "urijs": "1.19.11",
+        "validator": "13.15.26",
+        "verror": "1.10.1",
+        "ws": "8.21.3",
+        "wtfnode": "0.10.1"
       },
       "engines": {
-        "node": "^18.0.0 || ^20.0.0"
+        "node": "^22.0.0 || ^24.0.0"
       }
     },
     "node_modules/@sap/audit-logging": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@sap/audit-logging/-/audit-logging-6.1.0.tgz",
-      "integrity": "sha512-NmKBjWTawJW0GjUnt0SNnQ9h+yj15fYrZ66SI1lE5lwR0ard8AgzbMwTnoq6jHrTSKvTHeOEhPYeUHAdb8llYA==",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/@sap/audit-logging/-/audit-logging-7.0.0.tgz",
+      "integrity": "sha512-0wbXJlAOenEal6nMspDKJev8fWDYA+MuRbi6iTHNdusRT2fisM9v+IWllT4fzeut6+Sd3l+5qKtA/AlbM5zGfA==",
       "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
-        "@sap/xssec": "^3.6.1",
-        "debug": "4.3.4",
-        "fetch-retry": "4.1.0",
-        "lodash": "4.17.21",
-        "node-cache": "5.1.2",
-        "node-fetch": "2.7.0"
+        "@sap/xssec": "4.9.0",
+        "debug": "4.4.3"
       },
       "engines": {
-        "node": "^18.0.0 || ^20.0.0"
+        "node": "^20.20.0 || ^22.x || ^24.x"
       }
     },
-    "node_modules/@sap/audit-logging/node_modules/debug": {
-      "version": "4.3.4",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
-      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
-      "license": "MIT",
+    "node_modules/@sap/audit-logging/node_modules/@sap/xssec": {
+      "version": "4.9.0",
+      "resolved": "https://registry.npmjs.org/@sap/xssec/-/xssec-4.9.0.tgz",
+      "integrity": "sha512-x2f1AvS9KDs3djtDsRgH4Md3Ze5vc2NZHAlpCf+oRokWaQCmMNmS57DE6Zm80IVCCzo1mr8VtSrjWMPTshfUpw==",
+      "license": "SAP DEVELOPER LICENSE AGREEMENT",
       "dependencies": {
-        "ms": "2.1.2"
+        "debug": "^4.3.4",
+        "jwt-decode": "^4"
       },
       "engines": {
-        "node": ">=6.0"
-      },
-      "peerDependenciesMeta": {
-        "supports-color": {
-          "optional": true
-        }
+        "node": ">=18"
       }
     },
-    "node_modules/@sap/audit-logging/node_modules/ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "license": "MIT"
-    },
-    "node_modules/@sap/audit-logging/node_modules/node-cache": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/node-cache/-/node-cache-5.1.2.tgz",
-      "integrity": "sha512-t1QzWwnk4sjLWaQAS8CHgOJ+RAfmHpxFWmc36IWTiWHQfs0w5JDMBS1b1ZxQteo0vVVuWJvIUKHDkkeK7vIGCg==",
+    "node_modules/@sap/audit-logging/node_modules/jwt-decode": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-4.0.0.tgz",
+      "integrity": "sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==",
       "license": "MIT",
-      "dependencies": {
-        "clone": "2.x"
-      },
       "engines": {
-        "node": ">= 8.0.0"
+        "node": ">=18"
       }
     },
     "node_modules/@sap/e2e-trace": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/@sap/e2e-trace/-/e2e-trace-4.1.0.tgz",
-      "integrity": "sha512-HSOIPHQjdC2coWFVxB04DztApRUgYiMIV781FfyYpmvnJy7/BUCv5fdLyJjisoIUqBpDE3KbkJ/Ko1GdoryHlw==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@sap/e2e-trace/-/e2e-trace-6.0.0.tgz",
+      "integrity": "sha512-SveaAgYUpZ6h05sCjBK+wEySHE5gyWQhehWABPDVlCAWJmESqmivfQp7DitBXNwnyIhgyI5yrNHUBD7eOt29zw==",
       "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
         "request-stats": "3.0.0"
       },
       "engines": {
-        "node": "^12.0.0 || ^14.0.0 || ^16.0.0 || ^18.0.0 || ^20.0.0"
-      }
-    },
-    "node_modules/@sap/e2e-trace/node_modules/http-headers": {
-      "version": "3.0.2",
-      "dependencies": {
-        "next-line": "^1.1.0"
-      }
-    },
-    "node_modules/@sap/e2e-trace/node_modules/next-line": {
-      "version": "1.1.0"
-    },
-    "node_modules/@sap/e2e-trace/node_modules/once": {
-      "version": "1.4.0",
-      "dependencies": {
-        "wrappy": "1"
+        "node": "^20.0.0 || ^22.0.0 || ^24.0.0"
       }
     },
     "node_modules/@sap/e2e-trace/node_modules/request-stats": {
       "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/request-stats/-/request-stats-3.0.0.tgz",
+      "integrity": "sha512-yhnHqXbmgjQs0q/3ZRUzaWTpmaRX78w1Su6UJaWy4h/EGicimIUDkMce7TZdJaXjOWy7bjqC7RXP9ZBXeBJzIw==",
+      "license": "MIT",
       "dependencies": {
         "http-headers": "^3.0.1",
         "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">=0.12"
       }
     },
-    "node_modules/@sap/e2e-trace/node_modules/wrappy": {
-      "version": "1.0.2"
-    },
     "node_modules/@sap/logging": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/@sap/logging/-/logging-7.1.0.tgz",
-      "integrity": "sha512-pMYHJg23099j/nW90md0X8Ach0mfkdFy8235LOWXBlcH7eNPuIb5ES6slisqinQ6PHsj1Cip5C2emyGlkd/liw==",
+      "version": "9.2.3",
+      "resolved": "https://registry.npmjs.org/@sap/logging/-/logging-9.2.3.tgz",
+      "integrity": "sha512-rFhLQk09QHKZKu3njNlSeuHSJI8QiK3Rs/HVAnFqgqjDvqYA7zURgoCa45s8GrzWvVaqfoo/vqXIaGLDfM0t6Q==",
       "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
-        "@sap/e2e-trace": "^4.1.0",
-        "lodash": "4.17.21",
-        "moment": "2.29.4"
+        "@sap/e2e-trace": "6.2.2",
+        "lodash": "4.18.1",
+        "moment": "2.31.0"
       },
       "engines": {
-        "node": "^12.0.0 || ^14.0.0 || ^16.0.0 || ^18.0.0 || ^20.0.0"
+        "node": "^20.0.0 || ^22.0.0 || ^24.0.0"
       }
     },
     "node_modules/@sap/logging/node_modules/@sap/e2e-trace": {
-      "version": "4.1.0",
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/@sap/e2e-trace/-/e2e-trace-6.2.2.tgz",
+      "integrity": "sha512-R3ALhBJIgV5wKqUDNDIojre+zcpIp7kd0PbO9zPcWX47CnIcM3kJKHpFGswOEBPhcjVvLPsEIZZpvTMyfwGIsw==",
+      "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
         "request-stats": "3.0.0"
+      },
+      "engines": {
+        "node": "^20.0.0 || ^22.0.0 || ^24.0.0"
       }
     },
-    "node_modules/@sap/logging/node_modules/@sap/e2e-trace/node_modules/http-headers": {
-      "version": "3.0.2",
-      "dependencies": {
-        "next-line": "^1.1.0"
-      }
-    },
-    "node_modules/@sap/logging/node_modules/@sap/e2e-trace/node_modules/next-line": {
-      "version": "1.1.0"
-    },
-    "node_modules/@sap/logging/node_modules/@sap/e2e-trace/node_modules/once": {
-      "version": "1.4.0",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/@sap/logging/node_modules/@sap/e2e-trace/node_modules/request-stats": {
+    "node_modules/@sap/logging/node_modules/request-stats": {
       "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/request-stats/-/request-stats-3.0.0.tgz",
+      "integrity": "sha512-yhnHqXbmgjQs0q/3ZRUzaWTpmaRX78w1Su6UJaWy4h/EGicimIUDkMce7TZdJaXjOWy7bjqC7RXP9ZBXeBJzIw==",
+      "license": "MIT",
       "dependencies": {
         "http-headers": "^3.0.1",
         "once": "^1.4.0"
+      },
+      "engines": {
+        "node": ">=0.12"
       }
     },
-    "node_modules/@sap/logging/node_modules/@sap/e2e-trace/node_modules/wrappy": {
-      "version": "1.0.2"
-    },
-    "node_modules/@sap/logging/node_modules/lodash": {
-      "version": "4.17.21"
-    },
-    "node_modules/@sap/logging/node_modules/moment": {
-      "version": "2.29.4"
-    },
     "node_modules/@sap/xsenv": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/@sap/xsenv/-/xsenv-4.2.0.tgz",
-      "integrity": "sha512-Hu74ezPEKVgzz1XLi4/Ttlv+n2w9CTuLBlR6Vw4y9FK7btLm1wnCViDPufTG7yxniEADw8EQbqRv+krmcFmGLA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@sap/xsenv/-/xsenv-6.0.0.tgz",
+      "integrity": "sha512-9bNpJXmxndWn5JbRCPPtbeMqldXOn2Od17ybS92PHd1rNkZ80IMmOURHNct5YSVQ1MKBIDAyC+ck6VL7cVAfUA==",
       "license": "SEE LICENSE IN LICENSE file",
       "dependencies": {
-        "debug": "4.3.3",
-        "node-cache": "^5.1.0",
-        "verror": "1.10.0"
+        "debug": "4.4.1",
+        "node-cache": "^5.1.2",
+        "verror": "1.10.1"
       },
       "engines": {
-        "node": "^12.0.0 || ^14.0.0 || ^16.0.0 || ^18.0.0 || ^20.0.0"
+        "node": "^20.0.0  || ^22.0.0 || ^24.0.0"
       }
     },
-    "node_modules/@sap/xsenv/node_modules/assert-plus": {
-      "version": "1.0.0"
-    },
-    "node_modules/@sap/xsenv/node_modules/clone": {
-      "version": "2.1.2"
-    },
-    "node_modules/@sap/xsenv/node_modules/core-util-is": {
-      "version": "1.0.2"
-    },
     "node_modules/@sap/xsenv/node_modules/debug": {
-      "version": "4.3.3",
-      "dependencies": {
-        "ms": "2.1.2"
-      }
-    },
-    "node_modules/@sap/xsenv/node_modules/extsprintf": {
-      "version": "1.4.1"
-    },
-    "node_modules/@sap/xsenv/node_modules/ms": {
-      "version": "2.1.2"
-    },
-    "node_modules/@sap/xsenv/node_modules/node-cache": {
-      "version": "5.1.2",
-      "dependencies": {
-        "clone": "2.x"
-      }
-    },
-    "node_modules/@sap/xsenv/node_modules/verror": {
-      "version": "1.10.0",
-      "dependencies": {
-        "assert-plus": "^1.0.0",
-        "core-util-is": "1.0.2",
-        "extsprintf": "^1.2.0"
-      }
-    },
-    "node_modules/@sap/xssec": {
-      "version": "3.6.1",
-      "resolved": "https://registry.npmjs.org/@sap/xssec/-/xssec-3.6.1.tgz",
-      "integrity": "sha512-OJouwIWClefpsJ8rVCziEydeDHDNOMA4hjsjw9OqolbbObaiYMMDRU0YJbPe7XL5JkLgrtt+CLCBCsNERxcCZg==",
-      "license": "SAP DEVELOPER LICENSE AGREEMENT",
-      "dependencies": {
-        "axios": "^1.6",
-        "debug": "^4.3.4",
-        "jsonwebtoken": "^9.0.2",
-        "node-rsa": "^1.1.1"
-      },
-      "engines": {
-        "node": ">=14"
-      }
-    },
-    "node_modules/@sap/xssec/node_modules/debug": {
-      "version": "4.4.3",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
-      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.1.tgz",
+      "integrity": "sha512-KcKCqiftBJcZr++7ykoDIEwSa3XWowTfNPo92BYxjXiyYEVrUQh2aLyhxBCwww+heortUFxEJYcRzosstTEBYQ==",
       "license": "MIT",
       "dependencies": {
         "ms": "^2.1.3"
@@ -873,19 +789,26 @@
         }
       }
     },
-    "node_modules/@sap/xssec/node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
+    "node_modules/@sap/xssec": {
+      "version": "4.12.2",
+      "resolved": "https://registry.npmjs.org/@sap/xssec/-/xssec-4.12.2.tgz",
+      "integrity": "sha512-T4yy/lXZerAREJnb2Yte3oL4iDJOKlmWrMwMLXY5/U33tuKDVzIVO3VQqfLTGTIJABk4msE+km0YWpds+fSv3w==",
+      "license": "SAP DEVELOPER LICENSE AGREEMENT",
+      "dependencies": {
+        "debug": "^4.4.3",
+        "jwt-decode": "^4"
+      },
+      "engines": {
+        "node": ">=18"
+      }
     },
-    "node_modules/@tootallnate/once": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@tootallnate/once/-/once-1.1.2.tgz",
-      "integrity": "sha512-RbzJvlNzmRq5c3O09UipeuXno4tA1FE6ikOjxZK0tuxVv3412l64l5t1W5pj4+rJq9vpkm/kwiR07aZXnsKPxw==",
+    "node_modules/@sap/xssec/node_modules/jwt-decode": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-4.0.0.tgz",
+      "integrity": "sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==",
       "license": "MIT",
       "engines": {
-        "node": ">= 6"
+        "node": ">=18"
       }
     },
     "node_modules/@types/triple-beam": {
@@ -894,38 +817,25 @@
       "integrity": "sha512-6WaYesThRMCl19iryMYP7/x2OVgCtbIVflDGFpWnb9irXI3UjYE4AzmYuiUKY1AJstGijoY+MgUszMgRxIYTYw==",
       "license": "MIT"
     },
-    "node_modules/accepts": {
-      "version": "1.3.8",
-      "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
-      "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
-      "license": "MIT",
-      "dependencies": {
-        "mime-types": "~2.1.34",
-        "negotiator": "0.6.3"
-      },
-      "engines": {
-        "node": ">= 0.6"
-      }
-    },
     "node_modules/agent-base": {
-      "version": "6.0.2",
-      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
-      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "version": "7.1.4",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+      "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
       "license": "MIT",
-      "dependencies": {
-        "debug": "4"
-      },
       "engines": {
-        "node": ">= 6.0.0"
+        "node": ">= 14"
       }
     },
     "node_modules/agentkeepalive": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-2.0.5.tgz",
-      "integrity": "sha512-dlXxjfkCrcEPmvJju6ypP6/eq1q0l+cu0u10IhKfiwMoy4yH73n0TQ2jMO2H39xbcC3Q4cWUFPkNk1b3GLEklg==",
+      "version": "4.6.0",
+      "resolved": "https://registry.npmjs.org/agentkeepalive/-/agentkeepalive-4.6.0.tgz",
+      "integrity": "sha512-kja8j7PjmncONqaTsB8fQ+wE2mSU2DJ9D4XKoJ5PFWIdRMa6SLSN1ff4mOr4jCbfRSsxR4keIiySJU0N9T5hIQ==",
       "license": "MIT",
+      "dependencies": {
+        "humanize-ms": "^1.2.1"
+      },
       "engines": {
-        "node": ">= 0.10.0"
+        "node": ">= 8.0.0"
       }
     },
     "node_modules/ajv": {
@@ -944,15 +854,6 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
-    "node_modules/asn1": {
-      "version": "0.2.6",
-      "resolved": "https://registry.npmjs.org/asn1/-/asn1-0.2.6.tgz",
-      "integrity": "sha512-ix/FxPn0MDjeyJ7i/yoHGFt/EX6LyNbxSEhPPXODPL+KB0VPk86UYfL0lMdy+KCnv+fmvIzySwaK5COwqVbWTQ==",
-      "license": "MIT",
-      "dependencies": {
-        "safer-buffer": "~2.1.0"
-      }
-    },
     "node_modules/assert-plus": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/assert-plus/-/assert-plus-1.0.0.tgz",
@@ -969,32 +870,73 @@
       "license": "MIT"
     },
     "node_modules/axios": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.7.4.tgz",
-      "integrity": "sha512-DukmaFRnY6AzAALSH4J2M3k6PkaC+MfaAGdEERRWcC9q3/TWQwLpHR8ZRLKTdQ3aBDL64EdluRDjJqKw+BPZEw==",
+      "version": "1.20.0",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.20.0.tgz",
+      "integrity": "sha512-r8aOh8j9cGKpgQAqpzrUHnSIc6a59Y3Xf/cv8sy1DrHCkZHzQGEuoq1tARk6qSyDdtQGSDgpb9kFlruzPvrgwg==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.6",
-        "form-data": "^4.0.0",
-        "proxy-from-env": "^1.1.0"
+        "follow-redirects": "^1.16.0",
+        "form-data": "^4.0.6",
+        "https-proxy-agent": "^5.0.1",
+        "proxy-from-env": "^2.1.0"
       }
     },
     "node_modules/axios-cookiejar-support": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/axios-cookiejar-support/-/axios-cookiejar-support-2.0.3.tgz",
-      "integrity": "sha512-tvMB+0JhxXLjjvePsXzqXhBI4DMlW4ImR4pKKNl+xclwF0IviNV+CkuhubQCCFjPzOXv7PIzOq3z7WFiF9pMpw==",
+      "version": "5.0.5",
+      "resolved": "https://registry.npmjs.org/axios-cookiejar-support/-/axios-cookiejar-support-5.0.5.tgz",
+      "integrity": "sha512-jJG+p7JnOYxkVrYkCDKBrLqUmcpwHZTNQrEcIEKr5qe7YVTyPAD9nCsi1cO5LDmQpQApfS430czO+oceI3g/3g==",
       "license": "MIT",
       "dependencies": {
-        "http-cookie-agent": "^1.0.2"
+        "http-cookie-agent": "^6.0.8"
       },
       "engines": {
-        "node": ">=12.19.0 <13.0.0 || >=14.5.0"
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/3846masa"
       },
       "peerDependencies": {
         "axios": ">=0.20.0",
         "tough-cookie": ">=4.0.0"
       }
     },
+    "node_modules/axios-retry": {
+      "version": "4.5.0",
+      "resolved": "https://registry.npmjs.org/axios-retry/-/axios-retry-4.5.0.tgz",
+      "integrity": "sha512-aR99oXhpEDGo0UuAlYcn2iGRds30k366Zfa05XWScR9QaQD4JYiP3/1Qt1u7YlefUOK+cn0CcwoL1oefavQUlQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "is-retry-allowed": "^2.2.0"
+      },
+      "peerDependencies": {
+        "axios": "0.x || 1.x"
+      }
+    },
+    "node_modules/axios/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/axios/node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/base64-url": {
       "version": "2.3.3",
       "resolved": "https://registry.npmjs.org/base64-url/-/base64-url-2.3.3.tgz",
@@ -1005,53 +947,38 @@
       }
     },
     "node_modules/basic-auth": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-1.0.3.tgz",
-      "integrity": "sha512-fkXSqXkCTgBy5HVNQ2wP1Fnc/JZjnREwM3hfU8h5RyUN8X9WMQBJem6ZmlsSs7Y4f3fQ7z09vcARgOa0iaPaZA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/basic-auth/-/basic-auth-1.1.0.tgz",
+      "integrity": "sha512-CtGuTyWf3ig+sgRyC7uP6DM3N+5ur/p8L+FPfsd+BbIfIs74TFfCajZTHnCw6K5dqM0bZEbRIqRy1fAdiUJhTA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
     "node_modules/body-parser": {
-      "version": "1.20.3",
-      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
-      "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-2.3.0.tgz",
+      "integrity": "sha512-2cGmJupaNgg+QUwVLAucDuWuoMZ6EX9iHDRswZ5lsNYEmwPaRknMPCLZz07yTzVq/83p4o/wzbDZbBrTvGGTIw==",
       "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
-        "content-type": "~1.0.5",
-        "debug": "2.6.9",
-        "depd": "2.0.0",
-        "destroy": "1.2.0",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "on-finished": "2.4.1",
-        "qs": "6.13.0",
-        "raw-body": "2.5.2",
-        "type-is": "~1.6.18",
-        "unpipe": "1.0.0"
+        "bytes": "^3.1.2",
+        "content-type": "^2.0.0",
+        "debug": "^4.4.3",
+        "http-errors": "^2.0.1",
+        "iconv-lite": "^0.7.2",
+        "on-finished": "^2.4.1",
+        "qs": "^6.15.2",
+        "raw-body": "^3.0.2",
+        "type-is": "^2.1.0"
       },
       "engines": {
-        "node": ">= 0.8",
-        "npm": "1.2.8000 || >= 1.4.16"
-      }
-    },
-    "node_modules/body-parser/node_modules/debug": {
-      "version": "2.6.9",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
-      "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
-      "license": "MIT",
-      "dependencies": {
-        "ms": "2.0.0"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
-    "node_modules/body-parser/node_modules/ms": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-      "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
-      "license": "MIT"
-    },
     "node_modules/buffer-equal-constant-time": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/buffer-equal-constant-time/-/buffer-equal-constant-time-1.0.1.tgz",
@@ -1097,19 +1024,19 @@
       }
     },
     "node_modules/cf-nodejs-logging-support": {
-      "version": "7.4.6",
-      "resolved": "https://registry.npmjs.org/cf-nodejs-logging-support/-/cf-nodejs-logging-support-7.4.6.tgz",
-      "integrity": "sha512-k1+i5HtO+mobS1rZVcWlt7Wr0U0uafhnGlIr/9vva4mbkGlcLtktkSTLh+RC1X6fyecGJLceLCMH+8+2h2rEVg==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/cf-nodejs-logging-support/-/cf-nodejs-logging-support-8.0.0.tgz",
+      "integrity": "sha512-OJeJ9oyaTDYgOW8n2Js2s6QYX+II3fm+ms1fR54XmBwLip11CVlapWByoyCeHrJ2sdJhdcfOeu91rYvGwdwxlw==",
       "license": "Apache-2.0",
       "dependencies": {
         "ajv": "^8.18.0",
         "json-stringify-safe": "^5.0.1",
         "jsonwebtoken": "^9.0.3",
-        "triple-beam": "^1.3.0",
-        "winston-transport": "^4.5.0"
+        "triple-beam": "^1.4.1",
+        "winston-transport": "^4.9.0"
       },
       "engines": {
-        "node": ">=14.14"
+        "node": ">=22"
       }
     },
     "node_modules/chownr": {
@@ -1131,9 +1058,9 @@
       }
     },
     "node_modules/cluster-key-slot": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/cluster-key-slot/-/cluster-key-slot-1.1.2.tgz",
-      "integrity": "sha512-RMr0FhtfXemyinomL4hrWcYJxmX6deFdCxpJzhDttxgO1+bcCnkk+9drydLVDmAMG7NE6aN/fl4F7ucU/90gAA==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cluster-key-slot/-/cluster-key-slot-1.1.1.tgz",
+      "integrity": "sha512-rwHwUfXL40Chm1r08yrhU3qpUvdVlgkKNeyeGPOxnW8/SyVDvgRaed/Uz54AqWNaTCAThlj6QAs3TZcKI0xDEw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.10.0"
@@ -1152,16 +1079,10 @@
       }
     },
     "node_modules/commander": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-2.9.0.tgz",
-      "integrity": "sha512-bmkUukX8wAOjHdN26xj5c4ctEV22TQ7dQYhSmuckKhToXrkUn0iIaolHdIxYYqD55nhpSPA9zPQ1yP57GdXP2A==",
-      "license": "MIT",
-      "dependencies": {
-        "graceful-readlink": ">= 1.0.0"
-      },
-      "engines": {
-        "node": ">= 0.6.x"
-      }
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "license": "MIT"
     },
     "node_modules/compressible": {
       "version": "2.0.18",
@@ -1176,30 +1097,26 @@
       }
     },
     "node_modules/compression": {
-      "version": "1.7.4",
-      "resolved": "https://registry.npmjs.org/compression/-/compression-1.7.4.tgz",
-      "integrity": "sha512-jaSIDzP9pZVS4ZfQ+TzvtiWhdpFhE2RDHz8QJkpX9SIpLq88VueF5jJw6t+6CUQcAoA6t+x89MLrWAqpfDE8iQ==",
+      "version": "1.8.2",
+      "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.2.tgz",
+      "integrity": "sha512-o8vI5RE5A6EVVOd9o41jKp41aJom+QTEO/Bx8MYNjexMo/Bv2WOjUfZr+aL0WnYSgymUy6zeguqLTsIhV0gMvQ==",
       "license": "MIT",
       "dependencies": {
-        "accepts": "~1.3.5",
-        "bytes": "3.0.0",
-        "compressible": "~2.0.16",
+        "bytes": "3.1.2",
+        "compressible": "~2.0.18",
         "debug": "2.6.9",
-        "on-headers": "~1.0.2",
-        "safe-buffer": "5.1.2",
+        "destroy": "1.2.0",
+        "negotiator": "~0.6.4",
+        "on-headers": "~1.1.0",
+        "safe-buffer": "5.2.1",
         "vary": "~1.1.2"
       },
       "engines": {
         "node": ">= 0.8.0"
-      }
-    },
-    "node_modules/compression/node_modules/bytes": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.0.0.tgz",
-      "integrity": "sha512-pMhOfFDPiv9t5jjIXkHosWmkSyQbvsgEVNkz0ERHbuLh2T/7j4Mqqpz523Fe8MVY89KC6Sh/QfS2sM+SjgFDcw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/compression/node_modules/debug": {
@@ -1218,14 +1135,14 @@
       "license": "MIT"
     },
     "node_modules/connect": {
-      "version": "3.6.5",
-      "resolved": "https://registry.npmjs.org/connect/-/connect-3.6.5.tgz",
-      "integrity": "sha512-B+WTJ0bDgjQugnbNF7fWGvwEgTj9Isdk3Y7yTZlgCuVe+hpl/do8frEMeimx7sRMPW3oZA+EsC9uDZL8MaaAwQ==",
+      "version": "3.7.0",
+      "resolved": "https://registry.npmjs.org/connect/-/connect-3.7.0.tgz",
+      "integrity": "sha512-ZqRXc+tZukToSNmh5C2iWMSoV3X1YUcPbqEM4DkEG5tNQXrQUZCNVGGv3IuicnkMtPfGf3Xtp8WCXs295iQ1pQ==",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
-        "finalhandler": "1.0.6",
-        "parseurl": "~1.3.2",
+        "finalhandler": "1.1.2",
+        "parseurl": "~1.3.3",
         "utils-merge": "1.0.1"
       },
       "engines": {
@@ -1248,30 +1165,38 @@
       "license": "MIT"
     },
     "node_modules/content-type": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
-      "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.1.0.tgz",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.2.2.tgz",
-      "integrity": "sha512-QT1/SH6oF6jrC9K4rlWpa/5FgqUZuh/Ohl4NvGAgSm67DsieBdTz/XsiVQwBKEJMnw7Tui5uBuC7k1yUAmPO2g==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-1.1.1.tgz",
+      "integrity": "sha512-ei8Aos7ja0weRpFzJnEA9UHJ/7XQmqglbRwnf2ATjcB9Wq874VKH9kfjjirM6UhU2/E5fFYadylyhFldcqSidQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/cookie-parser": {
-      "version": "1.4.6",
-      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.6.tgz",
-      "integrity": "sha512-z3IzaNjdwUC2olLIB5/ITd0/setiaFMLYiZJle7xg5Fe9KWAceil7xszYfHHBtDFYLSgJduS2Ty0P1uJdPDJeA==",
+      "version": "1.4.7",
+      "resolved": "https://registry.npmjs.org/cookie-parser/-/cookie-parser-1.4.7.tgz",
+      "integrity": "sha512-nGUvgXnotP3BsjiLX2ypbQnWoGUPIIfHQNZkkC668ntrzGWEZVW70HDEB1qnNGMicPje6EttlIgzo51YSwNQGw==",
       "license": "MIT",
       "dependencies": {
-        "cookie": "0.4.1",
+        "cookie": "0.7.2",
         "cookie-signature": "1.0.6"
       },
       "engines": {
@@ -1279,9 +1204,9 @@
       }
     },
     "node_modules/cookie-parser/node_modules/cookie": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz",
-      "integrity": "sha512-ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==",
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -1294,9 +1219,9 @@
       "license": "MIT"
     },
     "node_modules/cookie-signature": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.1.0.tgz",
-      "integrity": "sha512-Alvs19Vgq07eunykd3Xy2jF0/qSNv2u7KDbAek9H5liV1UMijbqFs5cycZvv5dVsvseT/U4H8/7/w8Koh35C4A==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.2.2.tgz",
+      "integrity": "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg==",
       "license": "MIT",
       "engines": {
         "node": ">=6.6.0"
@@ -1309,12 +1234,12 @@
       "license": "MIT"
     },
     "node_modules/debug": {
-      "version": "4.3.2",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.2.tgz",
-      "integrity": "sha512-mOp8wKcvj7XxC78zLgw/ZA+6TSgkoE2C/ienthhRD298T7UNwAg9diBpLRxC0mOezLl4B0xV7M0cCO6P/O0Xhw==",
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
       "license": "MIT",
       "dependencies": {
-        "ms": "2.1.2"
+        "ms": "^2.1.3"
       },
       "engines": {
         "node": ">=6.0"
@@ -1325,25 +1250,10 @@
         }
       }
     },
-    "node_modules/debug/node_modules/ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "license": "MIT"
-    },
-    "node_modules/decode-uri-component": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.2.tgz",
-      "integrity": "sha512-FqUYQ+8o158GyGTrMFJms9qh3CqTKvAqgqsTnkLI8sKu0028orqBhxNMFkFen0zGyg6epACD32pjVk58ngIErQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10"
-      }
-    },
     "node_modules/deepmerge": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-2.1.1.tgz",
-      "integrity": "sha512-urQxA1smbLZ2cBbXbaYObM1dJ82aJ2H57A1C/Kklfh/ZN1bgH4G/n5KWhdNfOK11W98gqZfyYj7W4frJJRwA2w==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-2.2.1.tgz",
+      "integrity": "sha512-R9hc1Xa/NOBi9WRVUWg19rl1UB7Tt4kuPd+thNJgFZoxXsTz7ncaPaeIm+40oSGuP33DfMb4sZt1QIGiJzC4EA==",
       "license": "MIT",
       "engines": {
         "node": ">=0.10.0"
@@ -1359,9 +1269,9 @@
       }
     },
     "node_modules/denque": {
-      "version": "1.5.1",
-      "resolved": "https://registry.npmjs.org/denque/-/denque-1.5.1.tgz",
-      "integrity": "sha512-XwE+iZ4D6ZUB7mfYRMb5wByE8L74HCn30FBN7sWnXksWc1LO1bPDl67pBR9o/kC4z/xSNAwkMYcGgqDV3BE3Hw==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/denque/-/denque-2.1.0.tgz",
+      "integrity": "sha512-HVQE3AAb/pxF8fQAoiqpvg9i3evqug3hoiwakOyZAwJm+6vZehbkYXZ0l4JxS+I3QxM97v5aaRNhj8v5oBhekw==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=0.10"
@@ -1494,37 +1404,41 @@
       }
     },
     "node_modules/express-session": {
-      "version": "1.17.0",
-      "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.17.0.tgz",
-      "integrity": "sha512-t4oX2z7uoSqATbMfsxWMbNjAL0T5zpvcJCk3Z9wnPPN7ibddhnmDZXHfEcoBMG2ojKXZoCyPMc5FbtK+G7SoDg==",
+      "version": "1.19.0",
+      "resolved": "https://registry.npmjs.org/express-session/-/express-session-1.19.0.tgz",
+      "integrity": "sha512-0csaMkGq+vaiZTmSMMGkfdCOabYv192VbytFypcvI0MANrp+4i/7yEkJ0sbAEhycQjntaKGzYfjfXQyVb7BHMA==",
       "license": "MIT",
       "dependencies": {
-        "cookie": "0.4.0",
-        "cookie-signature": "1.0.6",
-        "debug": "2.6.9",
+        "cookie": "~0.7.2",
+        "cookie-signature": "~1.0.7",
+        "debug": "~2.6.9",
         "depd": "~2.0.0",
-        "on-headers": "~1.0.2",
+        "on-headers": "~1.1.0",
         "parseurl": "~1.3.3",
-        "safe-buffer": "5.2.0",
+        "safe-buffer": "~5.2.1",
         "uid-safe": "~2.1.5"
       },
       "engines": {
         "node": ">= 0.8.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/express-session/node_modules/cookie": {
-      "version": "0.4.0",
-      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.4.0.tgz",
-      "integrity": "sha512-+Hp8fLp57wnUSt0tY0tHEXh4voZRDnoIrZPqlo3DPiI4y9lwg/jqx+1Om94/W6ZaPDOUbnjOt/99w66zk+l1Xg==",
+      "version": "0.7.2",
+      "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.2.tgz",
+      "integrity": "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
     "node_modules/express-session/node_modules/cookie-signature": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
-      "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ==",
+      "version": "1.0.7",
+      "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.7.tgz",
+      "integrity": "sha512-NXdYc3dLr47pBkpUCHtKSwIOQXLVn8dZEuywboCOJY/osA0wFSLlSawr3KN8qXJEyX66FcONTH8EIlVuK0yyFA==",
       "license": "MIT"
     },
     "node_modules/express-session/node_modules/debug": {
@@ -1542,12 +1456,6 @@
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "license": "MIT"
     },
-    "node_modules/express-session/node_modules/safe-buffer": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.0.tgz",
-      "integrity": "sha512-fZEwUGbVl7kouZs1jCdMLdt95hdIv0ZeHg6L7qPeciMZhZ+/gdesW4wgTARkrFWEpspjEATAzUGPG8N2jJiwbg==",
-      "license": "MIT"
-    },
     "node_modules/extsprintf": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/extsprintf/-/extsprintf-1.4.1.tgz",
@@ -1564,9 +1472,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
-      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
+      "version": "3.1.8",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.8.tgz",
+      "integrity": "sha512-GZMtZUTNRpOVIECoXwLNZS5xUGE+mVNbTB8h/7Rwh2TFWcBQiPzTgyZi05BF9UMZKkLJv8XBRJTlU7zg8+ZfMg==",
       "funding": [
         {
           "type": "github",
@@ -1585,33 +1493,18 @@
       "integrity": "sha512-OP2IUU6HeYKJi3i0z4A19kHMQoLVs4Hc+DPqqxI2h/DPZHTm/vjsfC6P0b4jCMy14XizLBqvndQ+UilD7707Jw==",
       "license": "MIT"
     },
-    "node_modules/fetch-retry": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/fetch-retry/-/fetch-retry-4.1.0.tgz",
-      "integrity": "sha512-FUc9XZuhyE3ka3m53lec29PXVhdRf59QG01nE+OZdfl0M/R0E7Pk6k6qeWzHhX1pHl/f2JPA97sjjbHRgSg/9A==",
-      "license": "MIT"
-    },
-    "node_modules/filter-obj": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/filter-obj/-/filter-obj-1.1.0.tgz",
-      "integrity": "sha512-8rXg1ZnX7xzy2NGDVkBVaAy+lSlPNwad13BtgSlLuxfIslyt5Vg64U7tFcCt4WS1R0hvtnQybT/IyCkGZ3DpXQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/finalhandler": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.0.6.tgz",
-      "integrity": "sha512-immlyyYCPWG2tajlYBhZ6cjLAv1QAclU8tKS0d27ZtPqm/+iddy16GT3xLExg+V4lIETLpPwaYQAlZHNE//dPA==",
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.1.2.tgz",
+      "integrity": "sha512-aAWcW57uxVNrQZqFXjITpW3sIUQmHGG3qSb9mUah9MgMC4NeWhNOlNjXEYq3HjRAvL6arUviZGGJsBg6z0zsWA==",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
-        "encodeurl": "~1.0.1",
+        "encodeurl": "~1.0.2",
         "escape-html": "~1.0.3",
         "on-finished": "~2.3.0",
-        "parseurl": "~1.3.2",
-        "statuses": "~1.3.1",
+        "parseurl": "~1.3.3",
+        "statuses": "~1.5.0",
         "unpipe": "~1.0.0"
       },
       "engines": {
@@ -1646,9 +1539,9 @@
       }
     },
     "node_modules/follow-redirects": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "version": "1.16.1",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
+      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
       "funding": [
         {
           "type": "individual",
@@ -1748,12 +1641,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/graceful-readlink": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/graceful-readlink/-/graceful-readlink-1.0.1.tgz",
-      "integrity": "sha512-8tLu60LgxF6XpdbK8OW3FA+IfTNBn1ZHGHKF4KQbEeSkajYw5PlYJcKluntgegDPTg8UkHjpet1T82vk6TQ68w==",
-      "license": "MIT"
-    },
     "node_modules/has-symbols": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
@@ -1794,40 +1681,53 @@
       }
     },
     "node_modules/http-cookie-agent": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/http-cookie-agent/-/http-cookie-agent-1.0.6.tgz",
-      "integrity": "sha512-Ei0BDjMfy6MSXATmCZ5nWr935NLYl6eD/BTxVGOIrKAlg4xDtMdk+8a+caq6Qwa4FACn+vACj89pFKlXmHOnkQ==",
+      "version": "6.0.8",
+      "resolved": "https://registry.npmjs.org/http-cookie-agent/-/http-cookie-agent-6.0.8.tgz",
+      "integrity": "sha512-qnYh3yLSr2jBsTYkw11elq+T361uKAJaZ2dR4cfYZChw1dt9uL5t3zSUwehoqqVb4oldk1BpkXKm2oat8zV+oA==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "^6.0.2"
+        "agent-base": "^7.1.3"
       },
       "engines": {
-        "node": ">=12.19.0 <13.0.0 || >=14.5.0"
+        "node": ">=18.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/3846masa"
       },
       "peerDependencies": {
-        "tough-cookie": "^4.0.0"
+        "tough-cookie": "^4.0.0 || ^5.0.0",
+        "undici": "^5.11.0 || ^6.0.0"
+      },
+      "peerDependenciesMeta": {
+        "undici": {
+          "optional": true
+        }
       }
     },
     "node_modules/http-errors": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
-      "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.1.tgz",
+      "integrity": "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ==",
       "license": "MIT",
       "dependencies": {
-        "depd": "2.0.0",
-        "inherits": "2.0.4",
-        "setprototypeof": "1.2.0",
-        "statuses": "2.0.1",
-        "toidentifier": "1.0.1"
+        "depd": "~2.0.0",
+        "inherits": "~2.0.4",
+        "setprototypeof": "~1.2.0",
+        "statuses": "~2.0.2",
+        "toidentifier": "~1.0.1"
       },
       "engines": {
         "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/http-errors/node_modules/statuses": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
-      "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -1843,42 +1743,54 @@
       }
     },
     "node_modules/http-proxy-agent": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-4.0.1.tgz",
-      "integrity": "sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+      "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
       "license": "MIT",
       "dependencies": {
-        "@tootallnate/once": "1",
-        "agent-base": "6",
-        "debug": "4"
+        "agent-base": "^7.1.0",
+        "debug": "^4.3.4"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
     "node_modules/https-proxy-agent": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.0.tgz",
-      "integrity": "sha512-EkYm5BcKUGiduxzSt3Eppko+PiNWNEpa4ySk9vTC6wDsQJW9rHSa+UhGNJoRYp7bz6Ht1eaRIa6QaJqO5rCFbA==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+      "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
       "license": "MIT",
       "dependencies": {
-        "agent-base": "6",
+        "agent-base": "^7.1.2",
         "debug": "4"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
+      }
+    },
+    "node_modules/humanize-ms": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/humanize-ms/-/humanize-ms-1.2.1.tgz",
+      "integrity": "sha512-Fl70vYtsAFb/C06PTS9dZBo7ihau+Tu/DNCk/OyHhea07S+aeMWpFFkUaXRa8fI+ScZbEI8dfSxwY7gxZ9SAVQ==",
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.0.0"
       }
     },
     "node_modules/iconv-lite": {
-      "version": "0.4.24",
-      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
-      "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.7.3.tgz",
+      "integrity": "sha512-IKXpvIzjnC9XTAUbVBcMfGS0EPaIXtW6v+zr+RRp+hqULEpo0owZax6wyRwPOJbWbzjYspQwusTsfVr0ifh4uQ==",
       "license": "MIT",
       "dependencies": {
-        "safer-buffer": ">= 2.1.2 < 3"
+        "safer-buffer": ">= 2.1.2 < 3.0.0"
       },
       "engines": {
         "node": ">=0.10.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/inherits": {
@@ -1888,31 +1800,38 @@
       "license": "ISC"
     },
     "node_modules/ioredis": {
-      "version": "4.28.5",
-      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-4.28.5.tgz",
-      "integrity": "sha512-3GYo0GJtLqgNXj4YhrisLaNNvWSNwSS2wS4OELGfGxH8I69+XfNdnmV1AyN+ZqMh0i7eX+SWjrwFKDBDgfBC1A==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-6.0.0.tgz",
+      "integrity": "sha512-f+Dtubxfpf6KYFq7WVXJoOLn0bk4TJrMrN9SzeE+jrWrCWj7XX3fA6vkryafhADX+GMymRxgDJDOI33COkJc0w==",
       "license": "MIT",
       "dependencies": {
-        "cluster-key-slot": "^1.1.0",
-        "debug": "^4.3.1",
-        "denque": "^1.1.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.flatten": "^4.4.0",
-        "lodash.isarguments": "^3.1.0",
-        "p-map": "^2.1.0",
-        "redis-commands": "1.7.0",
-        "redis-errors": "^1.2.0",
-        "redis-parser": "^3.0.0",
-        "standard-as-callback": "^2.1.0"
+        "@ioredis/commands": "2.0.0",
+        "cluster-key-slot": "1.1.1",
+        "debug": "4.4.3",
+        "denque": "2.1.0",
+        "redis-errors": "1.2.0",
+        "standard-as-callback": "2.1.0"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=20.0.0"
       },
       "funding": {
         "type": "opencollective",
         "url": "https://opencollective.com/ioredis"
       }
     },
+    "node_modules/is-retry-allowed": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/is-retry-allowed/-/is-retry-allowed-2.2.0.tgz",
+      "integrity": "sha512-XVm7LOeLpTW4jV19QSH38vkswxoLud8sQ57YwJVTPWdiaI9I8keEhGFpBlslyVsgdQy4Opg8QOLb8YRgsyZiQg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/jose": {
       "version": "5.10.0",
       "resolved": "https://registry.npmjs.org/jose/-/jose-5.10.0.tgz",
@@ -1978,27 +1897,15 @@
       }
     },
     "node_modules/jwt-decode": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-2.0.1.tgz",
-      "integrity": "sha512-/KEXk2wGfWoSM2SHQk8mq9n/Rd6ahB0XIZt0jEcNy4tQXeDHU4oNOGK1shSVstIQm97qowy6dFgUAHB3zbOD8g==",
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-2.2.0.tgz",
+      "integrity": "sha512-86GgN2vzfUu7m9Wcj63iUkuDzFNYFVmjeDm2GzWpUk+opB0pEpMsw6ePCMrhYkumz2C1ihqtZzOMAg7FiXcNoQ==",
       "license": "MIT"
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
-      "license": "MIT"
-    },
-    "node_modules/lodash.defaults": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
-      "integrity": "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ==",
-      "license": "MIT"
-    },
-    "node_modules/lodash.flatten": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.flatten/-/lodash.flatten-4.4.0.tgz",
-      "integrity": "sha512-C5N2Z3DgnnKr0LOpv/hKCgKdb7ZZwafIrsesve6lmzvZIRZRGaZ/l6Q8+2W7NaT+ZwO3fFlSCzCzrDCFdJfZ4g==",
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.18.1.tgz",
+      "integrity": "sha512-dMInicTPVE8d1e5otfwmmjlxkZoUpiVLwyeTdUsi/Caj/gfzzblBcCE5sRHV/AsjuCmxWrte2TNGSYuCeCq+0Q==",
       "license": "MIT"
     },
     "node_modules/lodash.includes": {
@@ -2007,12 +1914,6 @@
       "integrity": "sha512-W3Bx6mdkRTGtlJISOvVD/lbqjTlPPUDTMnlXZFnVwi9NKJ6tiAk6LVdlhZMm17VZisqhKcgzpO5Wz91PCt5b0w==",
       "license": "MIT"
     },
-    "node_modules/lodash.isarguments": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/lodash.isarguments/-/lodash.isarguments-3.1.0.tgz",
-      "integrity": "sha512-chi4NHZlZqZD18a0imDHnZPrDeBbTtVN7GXMwuGdRH9qotxAjYs3aVLKc7zNOG9eddR5Ksd8rvFEBc9SsggPpg==",
-      "license": "MIT"
-    },
     "node_modules/lodash.isboolean": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/lodash.isboolean/-/lodash.isboolean-3.0.3.tgz",
@@ -2067,13 +1968,13 @@
       }
     },
     "node_modules/lru-cache": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.0.0.tgz",
-      "integrity": "sha512-WKhDkjlLwzE8jAQdQlsxLUQTPXLCKX/4cJk6s5AlRtJkDBk0IKH5O51bVDH61K9N4bhbbyvLM6EiOuE8ovApPA==",
+      "version": "4.1.5",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-4.1.5.tgz",
+      "integrity": "sha512-sWZlbEP2OsHNkXrMl5GYk/jKk70MBng6UU4YI/qGDYbgf6YbP4EvmqISbXCoJiRKs+1bSpFHVgQxvJ17F2li5g==",
       "license": "ISC",
       "dependencies": {
-        "pseudomap": "^1.0.1",
-        "yallist": "^2.0.0"
+        "pseudomap": "^1.0.2",
+        "yallist": "^2.1.2"
       }
     },
     "node_modules/math-intrinsics": {
@@ -2086,21 +1987,31 @@
       }
     },
     "node_modules/media-typer": {
-      "version": "0.3.0",
-      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
-      "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-1.1.1.tgz",
+      "integrity": "sha512-yz3xRaG20c6/BOzvYoDaGtPmGscs7YivItZEEqe6GbwNfHuxu9YNmvnEkMzKldAGY4/80pRcQRZSEnhquk9XuQ==",
       "license": "MIT",
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 0.8"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/mime": {
-      "version": "1.4.1",
-      "resolved": "https://registry.npmjs.org/mime/-/mime-1.4.1.tgz",
-      "integrity": "sha512-KI1+qOZu5DcW6wayYHSzR/tXKCDC5Om4s1z2QJjDULzLcmf3DvzS7oluY4HCTrc+9FiKmWUgeNLg7W3uIQvxtQ==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/mime/-/mime-4.1.0.tgz",
+      "integrity": "sha512-X5ju04+cAzsojXKes0B/S4tcYtFAJ6tTMuSPBEn9CPGlrWr8Fiw7qYeLT0XyH80HSoAoqWCaz+MWKh22P7G1cw==",
+      "funding": [
+        "https://github.com/sponsors/broofa"
+      ],
       "license": "MIT",
       "bin": {
-        "mime": "cli.js"
+        "mime": "bin/cli.js"
+      },
+      "engines": {
+        "node": ">=16"
       }
     },
     "node_modules/mime-db": {
@@ -2154,28 +2065,34 @@
         "node": ">= 18"
       }
     },
+    "node_modules/moment": {
+      "version": "2.31.0",
+      "resolved": "https://registry.npmjs.org/moment/-/moment-2.31.0.tgz",
+      "integrity": "sha512-0acOTfMiWOheYS4eoWb80yYMb/JLvVv9SHbs2PehaDzfUG0Bw855SKyk0IKTnPGa5+U2bmi3W68l1+sGLX/pvw==",
+      "license": "MIT",
+      "engines": {
+        "node": "*"
+      }
+    },
     "node_modules/ms": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.1.tgz",
-      "integrity": "sha512-tgp+dl5cGk28utYktBsrFqA7HKgrhgPsg6Z/EfhWI4gl1Hwq8B/GmY/0oXZ6nF8hDVesS/FpnYaD/kOWhYQvyg==",
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
       "license": "MIT"
     },
     "node_modules/mustache": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/mustache/-/mustache-2.2.1.tgz",
-      "integrity": "sha512-azYRexmi9y6h2lk2JqfBLh1htlDMjKYyEYOkxoGKa0FRdr5aY4f5q8bH4JIecM181DtUEYLSz8PcRO46mgzMNQ==",
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/mustache/-/mustache-4.2.0.tgz",
+      "integrity": "sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==",
       "license": "MIT",
       "bin": {
         "mustache": "bin/mustache"
-      },
-      "engines": {
-        "npm": ">=1.4.0"
       }
     },
     "node_modules/negotiator": {
-      "version": "0.6.3",
-      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
-      "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+      "version": "0.6.4",
+      "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
+      "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
@@ -2188,54 +2105,15 @@
       "license": "MIT"
     },
     "node_modules/node-cache": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/node-cache/-/node-cache-4.1.1.tgz",
-      "integrity": "sha512-1IdglJ3+6RO7j2jGVSbWG7CD/H7axG770BbuopZNDqKpQu1ol89xC4Qc+hd6uBEewjsoCZ6xRIY8BRa5PkHgTQ==",
-      "license": "MIT",
-      "dependencies": {
-        "clone": "2.x",
-        "lodash": "4.x"
-      },
-      "engines": {
-        "node": ">= 0.4.6"
-      }
-    },
-    "node_modules/node-fetch": {
-      "version": "2.7.0",
-      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.7.0.tgz",
-      "integrity": "sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==",
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/node-cache/-/node-cache-5.1.2.tgz",
+      "integrity": "sha512-t1QzWwnk4sjLWaQAS8CHgOJ+RAfmHpxFWmc36IWTiWHQfs0w5JDMBS1b1ZxQteo0vVVuWJvIUKHDkkeK7vIGCg==",
       "license": "MIT",
       "dependencies": {
-        "whatwg-url": "^5.0.0"
-      },
-      "engines": {
-        "node": "4.x || >=6.0.0"
-      },
-      "peerDependencies": {
-        "encoding": "^0.1.0"
+        "clone": "2.x"
       },
-      "peerDependenciesMeta": {
-        "encoding": {
-          "optional": true
-        }
-      }
-    },
-    "node_modules/node-forge": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/node-forge/-/node-forge-1.4.0.tgz",
-      "integrity": "sha512-LarFH0+6VfriEhqMMcLX2F7SwSXeWwnEAJEsYm5QKWchiVYVvJyV9v7UDvUv+w5HO23ZpQTXDv/GxdDdMyOuoQ==",
-      "license": "(BSD-3-Clause OR GPL-2.0)",
       "engines": {
-        "node": ">= 6.13.0"
-      }
-    },
-    "node_modules/node-rsa": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/node-rsa/-/node-rsa-1.1.1.tgz",
-      "integrity": "sha512-Jd4cvbJMryN21r5HgxQOpMEqv+ooke/korixNNK3mGqfGJmy0M77WDDzo/05969+OkMy3XW1UuZsSmW9KQm7Fw==",
-      "license": "MIT",
-      "dependencies": {
-        "asn1": "^0.2.4"
+        "node": ">= 8.0.0"
       }
     },
     "node_modules/object-inspect": {
@@ -2263,9 +2141,9 @@
       }
     },
     "node_modules/on-headers": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.0.2.tgz",
-      "integrity": "sha512-pZAE+FJLoyITytdqK0U5s+FIpjN0JP3OzFi/u8Rx+EV5/W+JTWGXG8xFzevE7AjBfDqHv/8vL8qQsIhHnqRkrA==",
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
+      "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
@@ -2280,15 +2158,6 @@
         "wrappy": "1"
       }
     },
-    "node_modules/p-map": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/p-map/-/p-map-2.1.0.tgz",
-      "integrity": "sha512-y3b8Kpd8OAN444hxfBbFfj1FY/RjtTd8tzYwhUqNYXx0fXx2iX4maP4Qr6qhIKbQXI02wTLAda4fYUbDagTUFw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/parseurl": {
       "version": "1.3.3",
       "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
@@ -2299,9 +2168,9 @@
       }
     },
     "node_modules/passport": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/passport/-/passport-0.6.0.tgz",
-      "integrity": "sha512-0fe+p3ZnrWRW74fe8+SvCyf4a3Pb2/h7gFkQ8yTJpAO50gDzlfjZUZTO1k5Eg9kUct22OxHLqDZoKUWRHOh9ug==",
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/passport/-/passport-0.7.0.tgz",
+      "integrity": "sha512-cPLl+qZpSc+ireUvt+IzqbED1cHHkDoVYMo30jbJIdOOjQ1MQYZBPiNvmi8UM6lJuOpTPXJGZQk0DtC4y61MYQ==",
       "license": "MIT",
       "dependencies": {
         "passport-strategy": "1.x.x",
@@ -2330,10 +2199,13 @@
       "integrity": "sha512-KG8UEiEVkR3wGEb4m5yZkVCzigAD+cVEJck2CzYZO37ZGJfctvVptVO192MwrtPhzONn6go8ylnOdMhKqi4nfg=="
     },
     "node_modules/proxy-from-env": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-      "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-      "license": "MIT"
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+      "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
     },
     "node_modules/pseudomap": {
       "version": "1.0.2",
@@ -2363,12 +2235,13 @@
       }
     },
     "node_modules/qs": {
-      "version": "6.13.0",
-      "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
-      "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
+      "version": "6.16.0",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.0.6"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
@@ -2377,24 +2250,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/query-string": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/query-string/-/query-string-7.1.2.tgz",
-      "integrity": "sha512-KPbFzz/8pmtYOMH6zlYZgqTYJKQ18FxwfW3RLHIBwHWQ0iQG18X16XtIOk68ddfaM6j3grjYSnMPMrqQEjwR4w==",
-      "license": "MIT",
-      "dependencies": {
-        "decode-uri-component": "^0.2.1",
-        "filter-obj": "^1.1.0",
-        "split-on-first": "^1.0.0",
-        "strict-uri-encode": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
     "node_modules/querystringify": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/querystringify/-/querystringify-2.2.0.tgz",
@@ -2420,18 +2275,18 @@
       }
     },
     "node_modules/raw-body": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
-      "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-3.0.2.tgz",
+      "integrity": "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA==",
       "license": "MIT",
       "dependencies": {
-        "bytes": "3.1.2",
-        "http-errors": "2.0.0",
-        "iconv-lite": "0.4.24",
-        "unpipe": "1.0.0"
+        "bytes": "~3.1.2",
+        "http-errors": "~2.0.1",
+        "iconv-lite": "~0.7.0",
+        "unpipe": "~1.0.0"
       },
       "engines": {
-        "node": ">= 0.8"
+        "node": ">= 0.10"
       }
     },
     "node_modules/readable-stream": {
@@ -2448,12 +2303,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/redis-commands": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/redis-commands/-/redis-commands-1.7.0.tgz",
-      "integrity": "sha512-nJWqw3bTFy21hX/CPKHth6sfhZbdiHP6bTawSgQBlKOVRG7EZkfHbbHwQJnrE4vsQf0CMNE+3gJ4Fmm16vdVlQ==",
-      "license": "MIT"
-    },
     "node_modules/redis-errors": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/redis-errors/-/redis-errors-1.2.0.tgz",
@@ -2463,18 +2312,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/redis-parser": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/redis-parser/-/redis-parser-3.0.0.tgz",
-      "integrity": "sha512-DJnGAeenTdpMEH6uAJRK/uiyEIH9WVsUmoLwzudwGJUwZPp80PDBWPHXSAGNPwNvIXAbe7MSUB1zQFugFml66A==",
-      "license": "MIT",
-      "dependencies": {
-        "redis-errors": "^1.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/request-stats": {
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/request-stats/-/request-stats-2.0.1.tgz",
@@ -2510,9 +2347,23 @@
       }
     },
     "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
       "license": "MIT"
     },
     "node_modules/safe-regex": {
@@ -2552,24 +2403,24 @@
       }
     },
     "node_modules/send": {
-      "version": "0.19.0",
-      "resolved": "https://registry.npmjs.org/send/-/send-0.19.0.tgz",
-      "integrity": "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/send/-/send-0.19.2.tgz",
+      "integrity": "sha512-VMbMxbDeehAxpOtWJXlcUS5E8iXh6QmN+BkRX1GARS3wRaXEEgzCcB10gTQazO42tpNIya8xIyNx8fll1OFPrg==",
       "license": "MIT",
       "dependencies": {
         "debug": "2.6.9",
         "depd": "2.0.0",
         "destroy": "1.2.0",
-        "encodeurl": "~1.0.2",
+        "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "etag": "~1.8.1",
-        "fresh": "0.5.2",
-        "http-errors": "2.0.0",
+        "fresh": "~0.5.2",
+        "http-errors": "~2.0.1",
         "mime": "1.6.0",
         "ms": "2.1.3",
-        "on-finished": "2.4.1",
+        "on-finished": "~2.4.1",
         "range-parser": "~1.2.1",
-        "statuses": "2.0.1"
+        "statuses": "~2.0.2"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2590,6 +2441,15 @@
       "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
       "license": "MIT"
     },
+    "node_modules/send/node_modules/encodeurl": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+      "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
     "node_modules/send/node_modules/mime": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
@@ -2602,31 +2462,25 @@
         "node": ">=4"
       }
     },
-    "node_modules/send/node_modules/ms": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
-      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
-      "license": "MIT"
-    },
     "node_modules/send/node_modules/statuses": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
-      "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.2.tgz",
+      "integrity": "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.8"
       }
     },
     "node_modules/serve-static": {
-      "version": "1.16.2",
-      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.2.tgz",
-      "integrity": "sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==",
+      "version": "1.16.3",
+      "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.3.tgz",
+      "integrity": "sha512-x0RTqQel6g5SY7Lg6ZreMmsOzncHFU7nhnRWkKgWuMTu5NN0DR5oruckMqRvacAN9d5w6ARnRBXl9xhDCgfMeA==",
       "license": "MIT",
       "dependencies": {
         "encodeurl": "~2.0.0",
         "escape-html": "~1.0.3",
         "parseurl": "~1.3.3",
-        "send": "0.19.0"
+        "send": "~0.19.1"
       },
       "engines": {
         "node": ">= 0.8.0"
@@ -2763,15 +2617,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/split-on-first": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/split-on-first/-/split-on-first-1.1.0.tgz",
-      "integrity": "sha512-43ZssAJaMusuKWL8sKUBQXHWOpq8d6CfN/u1p4gUzfJkM05C8rxTmYrkIPTXapZpORA6LkkzcUulJ8FqA7Uudw==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      }
-    },
     "node_modules/standard-as-callback": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/standard-as-callback/-/standard-as-callback-2.1.0.tgz",
@@ -2779,23 +2624,14 @@
       "license": "MIT"
     },
     "node_modules/statuses": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.3.1.tgz",
-      "integrity": "sha512-wuTCPGlJONk/a1kqZ4fQM2+908lC7fa7nPYpTC1EhnvqLX/IICbeP1OZGDtA374trpSq68YubKUMo8oRhN46yg==",
+      "version": "1.5.0",
+      "resolved": "https://registry.npmjs.org/statuses/-/statuses-1.5.0.tgz",
+      "integrity": "sha512-OpZ3zP+jT1PI7I8nemJX4AKmAX070ZkYPVWV/AaKTJl+tXCTGyVdC1a4SL8RUQYEwk/f34ZX8UTykN68FwrqAA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.6"
       }
     },
-    "node_modules/strict-uri-encode": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/strict-uri-encode/-/strict-uri-encode-2.0.0.tgz",
-      "integrity": "sha512-QwiXZgpRcKkhTj2Scnn++4PKtWsH0kpzZ62L2R6c/LUVYv7hVnZqcg2+sMuT6R7Jusu1vviK/MFsu6kNJfWlEQ==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=4"
-      }
-    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -2805,26 +2641,6 @@
         "safe-buffer": "~5.2.0"
       }
     },
-    "node_modules/string_decoder/node_modules/safe-buffer": {
-      "version": "5.2.1",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
-      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/tar": {
       "version": "7.5.22",
       "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.22.tgz",
@@ -2860,9 +2676,9 @@
       }
     },
     "node_modules/tough-cookie": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.3.tgz",
-      "integrity": "sha512-aX/y5pVRkfRnfmuX+OdbSdXvPe6ieKX/G2s7e98f4poJHnqH3281gDPm/metm6E/WRamfx7WC4HUqkWHfQHprw==",
+      "version": "4.1.4",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz",
+      "integrity": "sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==",
       "license": "BSD-3-Clause",
       "dependencies": {
         "psl": "^1.1.33",
@@ -2874,12 +2690,6 @@
         "node": ">=6"
       }
     },
-    "node_modules/tr46": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
-      "integrity": "sha512-N3WMsuqV66lT30CrXNbEjx4GEwlow3v6rr4mCcv6prnfwhS01rkgyFdjPNBYd9br7LpXV1+Emh01fHnq2Gdgrw==",
-      "license": "MIT"
-    },
     "node_modules/triple-beam": {
       "version": "1.4.1",
       "resolved": "https://registry.npmjs.org/triple-beam/-/triple-beam-1.4.1.tgz",
@@ -2897,24 +2707,55 @@
       "optional": true
     },
     "node_modules/tv4": {
-      "version": "1.2.7",
-      "resolved": "https://registry.npmjs.org/tv4/-/tv4-1.2.7.tgz",
-      "integrity": "sha512-7W00xKKK9ccSXbN8E1FUKe+PJKlQc3HcPRM1y9WnplFVucoWFBpTNCGJNMHG04+yf5lQKUKx71yt0mluqnbCzw==",
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/tv4/-/tv4-1.3.0.tgz",
+      "integrity": "sha512-afizzfpJgvPr+eDkREK4MxJ/+r8nEEHcmitwgnPUqpaP+FpwQyadnxNoSACbgc/b1LsZYtODGoPiFxQrgJgjvw==",
+      "license": [
+        {
+          "type": "Public Domain",
+          "url": "http://geraintluff.github.io/tv4/LICENSE.txt"
+        },
+        {
+          "type": "MIT",
+          "url": "http://jsonary.com/LICENSE.txt"
+        }
+      ],
       "engines": {
         "node": ">= 0.8.0"
       }
     },
     "node_modules/type-is": {
-      "version": "1.6.18",
-      "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
-      "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/type-is/-/type-is-2.1.0.tgz",
+      "integrity": "sha512-faYHw0anBbc/kWF3zFTEnxSFOAGUX9GFbOBthvDdLsIlEoWOFOtS0zgCiQYwIskL9iGXZL3kAXD8OoZ4GmMATA==",
       "license": "MIT",
       "dependencies": {
-        "media-typer": "0.3.0",
-        "mime-types": "~2.1.24"
+        "content-type": "^2.0.0",
+        "media-typer": "^1.1.0",
+        "mime-types": "^3.0.0"
       },
       "engines": {
-        "node": ">= 0.6"
+        "node": ">= 18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
+    "node_modules/type-is/node_modules/mime-types": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-3.0.2.tgz",
+      "integrity": "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A==",
+      "license": "MIT",
+      "dependencies": {
+        "mime-db": "^1.54.0"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/uid-safe": {
@@ -2987,20 +2828,10 @@
         "node": ">= 0.4.0"
       }
     },
-    "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
-      "license": "MIT",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
-    },
     "node_modules/validator": {
-      "version": "13.7.0",
-      "resolved": "https://registry.npmjs.org/validator/-/validator-13.7.0.tgz",
-      "integrity": "sha512-nYXQLCBkpJ8X6ltALua9dRrZDHVYxjJ1wgskNt1lH9fzGjs3tgojGSCBjmEPwkWS1y29+DrizMTW19Pr9uB2nw==",
+      "version": "13.15.26",
+      "resolved": "https://registry.npmjs.org/validator/-/validator-13.15.26.tgz",
+      "integrity": "sha512-spH26xU080ydGggxRyR1Yhcbgx+j3y5jbNXk/8L+iRvdIEQ4uTRH2Sgf2dokud6Q4oAtsbNvJ1Ft+9xmm6IZcA==",
       "license": "MIT",
       "engines": {
         "node": ">= 0.10"
@@ -3016,33 +2847,17 @@
       }
     },
     "node_modules/verror": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.0.tgz",
-      "integrity": "sha512-ZZKSmDAEFOijERBLkmYfJ+vmk3w+7hOLYDNkRCuRuMJGEmqYNCNLyBBFwWKVMhfwaEF3WOd0Zlw86U/WC/+nYw==",
-      "engines": [
-        "node >=0.6.0"
-      ],
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/verror/-/verror-1.10.1.tgz",
+      "integrity": "sha512-veufcmxri4e3XSrT0xwfUR7kguIkaxBeosDg00yDWhk49wdwkSUrvvsm7nc75e1PUyvIeZj6nS8VQRYz2/S4Xg==",
       "license": "MIT",
       "dependencies": {
         "assert-plus": "^1.0.0",
         "core-util-is": "1.0.2",
         "extsprintf": "^1.2.0"
-      }
-    },
-    "node_modules/webidl-conversions": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
-      "integrity": "sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==",
-      "license": "BSD-2-Clause"
-    },
-    "node_modules/whatwg-url": {
-      "version": "5.0.0",
-      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
-      "integrity": "sha512-saE57nupxk6v3HY35+jzBwYa0rKSy0XR8JSxZPwgLr7ys0IBzhGviA1/TUGJLmSVqs8pb9AnvICXEuOHLprYTw==",
-      "license": "MIT",
-      "dependencies": {
-        "tr46": "~0.0.3",
-        "webidl-conversions": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=0.6.0"
       }
     },
     "node_modules/winston-transport": {
@@ -3066,16 +2881,16 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "7.5.10",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.10.tgz",
-      "integrity": "sha512-+dbF1tHwZpXcbOJdVOkzLDxZP1ailvSxM6ZweXTegylPny803bFhA+vqBYw4s31NSAk4S2Qz+AKXK9a4wkdjcQ==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "license": "MIT",
       "engines": {
-        "node": ">=8.3.0"
+        "node": ">=10.0.0"
       },
       "peerDependencies": {
         "bufferutil": "^4.0.1",
-        "utf-8-validate": "^5.0.2"
+        "utf-8-validate": ">=5.0.2"
       },
       "peerDependenciesMeta": {
         "bufferutil": {
@@ -3087,12 +2902,15 @@
       }
     },
     "node_modules/wtfnode": {
-      "version": "0.9.1",
-      "resolved": "https://registry.npmjs.org/wtfnode/-/wtfnode-0.9.1.tgz",
-      "integrity": "sha512-Ip6C2KeQPl/F3aP1EfOnPoQk14Udd9lffpoqWDNH3Xt78svxPbv53ngtmtfI0q2Te3oTq79XKTnRNXVIn/GsPA==",
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/wtfnode/-/wtfnode-0.10.1.tgz",
+      "integrity": "sha512-4mcHdlvcdSytsbFueN6QYZxmh5K7REawBk//ZOrJrtVOe548Qsq4GNEm/OUfZATqDnsX4g8uBbzmN7NdEZx09Q==",
       "license": "ISC",
       "bin": {
         "wtfnode": "proxy.js"
+      },
+      "engines": {
+        "node": ">=0.10.0"
       }
     },
     "node_modules/yallist": {
diff --git a/approuter/package.json b/approuter/package.json
index f3401d133..9117a1876 100644
--- a/approuter/package.json
+++ b/approuter/package.json
@@ -1,7 +1,7 @@
 {
   "name": "tutorials-approuter",
   "dependencies": {
-    "@sap/approuter": "^16.0.0",
+    "@sap/approuter": "^23.3.0",
     "jose": "^5.10.0",
     "sharp": "0.35.0",
     "tar": "^7.5.21",
@@ -9,5 +9,8 @@
   },
   "scripts": {
     "start": "node server.js"
+  },
+  "engines": {
+    "node": "^22.0.0 || ^24.0.0"
   }
 }

From 805e907e1bb71533acb1b5a52a4ee030a558806e Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 03:56:48 -0400
Subject: [PATCH 29/46] docs(auth): design for clean logout via IAS-fronted
 approuter (#2610)

---
 ...-10-03-clean-logout-ias-fronting-design.md | 250 ++++++++++++++++++
 1 file changed, 250 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md

diff --git a/docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md b/docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md
new file mode 100644
index 000000000..9897e9f3a
--- /dev/null
+++ b/docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md
@@ -0,0 +1,250 @@
+# Clean Logout via IAS-fronted Approuter — Design
+
+**Issue:** [#2610](https://github.com/sap-tutorials/tutorials-ims/issues/2610) — Clean logout on shared/event machines
+**Date:** 2026-10-03
+**Status:** Design — pending review
+**Author:** Thomas Jung (with Claude)
+
+## Problem
+
+On shared event-floor machines, logging out does not fully clear the user. The approuter
+`/logout` terminates the approuter + XSUAA session, but the **IAS session (tenant
+`atxgsg7zi`) survives**, so the next person is silently re-SSO'd as the previous user.
+
+**Verified root cause:** the approuter is bound to **XSUAA only**. On `/logout` it clears
+its own session and redirects to `/`, hitting XSUAA `logout.do` — it **never reaches IAS**
+(`atxgsg7zi.accounts.ondemand.com`). The IAS Remember-Me token is tenant-wide and
+default-on, so the surviving IAS session re-authenticates the next visitor. XSUAA does not
+perform federated single-logout to IAS.
+
+## Goal
+
+Make approuter 23.x's native OIDC RP-initiated logout (`end_session`) fire against IAS on
+`/logout`, so the IAS session is terminated and the next person on a shared machine is not
+silently re-SSO'd — **without** changing which identities users log in with and **without**
+breaking the public-PKCE MCP flow.
+
+Verified during design: the IAS logout endpoint the approuter will call is
+`https://atxgsg7zi.accounts.ondemand.com/oauth2/logout` (from the live
+`tutorials-identity` binding's `end_session_endpoint`).
+
+## Non-goals
+
+- **No change to the login UX.** The dual-IdP picker (`sap.default` = SAP Universal ID,
+  `sap.custom` = social/other) stays exactly as today, including the `/signin` chooser page.
+- **No change to which IAS tenant is used.** `atxgsg7zi` is the only tenant.
+  (`alzmza7li` was a failed/abandoned setup attempt — ignore it. No Corporate-IdP
+  federation to `accounts.sap.com`.)
+- **No making IAS the single/forced login** (that was #2551 follow-up #1 — a separate
+  concern). Force-authentication is explicitly unacceptable (users would revolt).
+- **No change to the public-PKCE MCP flow** (`mcp-remote`). Hard constraint.
+
+## Prerequisites (already satisfied on DEV)
+
+- `@sap/approuter ^23.3.0` on `origin/DEV` (≥21 required for native `end_session`).
+  **Gap:** `main` and the working tree still declare `^16.0.0`; the bump must reach `main`
+  as part of this work (see Rollout step 6).
+- `xs-app.json` already defines `login.callbackEndpoint: /login/callback` and
+  `logout: { logoutEndpoint: "/logout", logoutPage: "/" }`.
+- An `identity` service instance already exists in the DEV space (`tutorials-identity`),
+  proving entitlement + broker work on this tenant.
+
+## Architecture
+
+The change is scoped to the **single `tutorials-approuter` module** in the main MTA
+(`.deploy/mta.yaml`, module block ~230–446). There is **one** application router, always —
+this design adds no second approuter app.
+
+```
+Browser ──/login?sap_idp=…──> approuter (bound XSUAA + IAS)
+                                  │  authenticationType: ias  (explicit per route)
+                                  ▼
+                        IAS atxgsg7zi (interactive OIDC login)
+                                  │  xsuaa-cross-consumption → XSUAA scopes/authz preserved
+                                  ▼
+                               CAP srv (XSUAA token, unchanged authz)
+
+Browser ──/logout──> approuter → OIDC end_session →
+                     https://atxgsg7zi.accounts.ondemand.com/oauth2/logout
+                     → IAS session terminated → post-logout redirect
+```
+
+### The core mechanism
+
+Bind the `identity` service to the approuter alongside `tutorials-xsuaa`, keeping XSUAA for
+authorization/scopes. With both bound and routes resolving to `ias`, the existing `/logout`
+endpoint performs OIDC RP-initiated logout → IAS `end_session` → IAS session ends.
+
+### Central design risk and its resolution
+
+`.deploy/mta.yaml:362–371` documents a deliberate constraint: the approuter is bound to
+**only** `tutorials-xsuaa` because, under the **16.x** approuter, binding a second auth
+service made the login handshake pick a binding non-deterministically → 500s.
+
+Under **23.3.0** this is resolved and dual-binding is supported. The `@sap/approuter`
+23.3.0 README (`authenticationType` reference) states: when bound to both XSUAA and IAS,
+the approuter *"prefers ias if both authentication services can be used … determined via
+BTP security endpoint (may impact response time)."* Therefore:
+
+- We set `authenticationType: ias` **explicitly** on each protected route rather than
+  relying on auto-detection — this avoids the per-request BTP-security-endpoint probe
+  latency.
+- The stale "one binding only" comment at `mta.yaml:362–371` is replaced with the 23.x
+  rationale.
+- XSUAA `scope` arrays on routes still apply under `ias` auth when the approuter is bound
+  to both (README `authenticationType` note).
+
+## Identity instance strategy
+
+**Decision (confirmed with Tom): two service instances.** The extra IAS service instance is
+acceptable; it is strictly safer than sharing one client between two auth postures.
+
+- The **existing `tutorials-identity`** instance stays **untouched**. It remains the
+  public-PKCE client for `mcp-remote` (`public-client: true`, `credential-type: NONE`,
+  `clientid 0b1e8b56-…`). The MCP flow is fully protected — **no client_id rotation, no doc
+  churn**.
+- A **new dedicated IAS instance** is created for the approuter's interactive login
+  (confidential, X.509).
+
+Why not share one instance: a single `identity` instance maps to one IAS OIDC app with one
+`client_id`; a binding only selects credential posture (NONE vs X509) against that same
+client. Whether one client can simultaneously allow public PKCE (secretless, for
+mcp-remote) **and** X509 confidential auth (for the approuter) is uncertain, and probing it
+would risk the live MCP client. Two instances sidesteps the question entirely.
+
+### New instance: `tutorials-approuter-identity`
+
+Created **out-of-band** (mirroring how `tutorials-identity` was created out-of-band for a
+stable client_id), then **adopted** via `org.cloudfoundry.existing-service` in the main
+MTA. Out-of-band creation means **no provisioning time is added to the main MTA deploy** —
+adoption is just a bind. This matches the established pattern already used for
+`tutorials-xsuaa`/`tutorials-hana` adoption in `mta-mcp.yaml`.
+
+Instance `oauth2-configuration` (per approuter 23.3.0 README "Authentication with IAS"):
+
+```jsonc
+{
+  "oauth2-configuration": {
+    "redirect-uris":            ["https://*.cfapps.eu10-005.hana.ondemand.com/login/callback?authType=ias"],
+    "post-logout-redirect-uris":["https://*.cfapps.eu10-005.hana.ondemand.com/**"]
+    // prod cutover: add the real prod host (developers.sap.com/**) to both arrays
+  },
+  "xsuaa-cross-consumption": true   // keep XSUAA trust/authz while IAS fronts login
+}
+```
+
+Binding to the approuter uses `credential-type: X509_GENERATED` (README: approuter→IAS auth
+must use X.509 certificates).
+
+> **Note on `redirect-uris` / `post-logout-redirect-uris`:** the exact production host
+> (`developers.sap.com` vs the `*.cfapps…` route) must be enumerated to match the real
+> login/logout callback origins. The main `xs-security.json` already lists both
+> `developers.sap.com/login/callback` and the `*.cfapps.*.hana.ondemand.com/**` wildcard as
+> XSUAA redirect-uris; the IAS instance must mirror the equivalents.
+
+## Route authentication & the dual-IdP picker
+
+### Routes
+
+Set `authenticationType: ias` explicitly on the routes currently marked `xsuaa` in
+`approuter/xs-app.json` (~40 routes). `authenticationType: none` routes (public content,
+MCP `/mcp-auth/*`, build feeds, etc.) are **unchanged** — in particular the MCP public-PKCE
+routes stay `none` and are untouched.
+
+### Picker preserved via `sap_idp` + `dynamicIdentityProvider`
+
+The picker (`hugo/layouts/signin.html`, rendered to `approuter/static/signin/index.html`)
+today links:
+
+- Button 1 "Sign in SAP Universal Account" → `/login?sap_idp=sap.default`
+- Button 2 "Other Options including Social Login" → `/login?sap_idp=sap.custom`
+
+The 23.3.0 README documents exactly this case: with XSUAA + IAS, a chain such as
+`sap_idp=sap.custom,local` routes through the XSUAA trust configuration `sap.custom` and
+then to IAS. We:
+
+- Enable `dynamicIdentityProvider: true` on the `/login` route so the `sap_idp` query param
+  is honored under IAS fronting.
+- Keep both picker buttons; the `sap_idp` values are mapped to the IAS-aware equivalents so
+  users still choose SAP Universal ID vs. social.
+
+**Note (README):** after logging in with one IdP, switching to the other requires a logout
++ new login — which is exactly the behavior clean logout now provides correctly.
+
+## Logout wiring
+
+`xs-app.json` already has `logout: { logoutEndpoint: "/logout", logoutPage: "/" }`. Once
+routes resolve to `ias`, `/logout` triggers approuter 23.x RP-initiated logout →
+`end_session_endpoint` (`atxgsg7zi.../oauth2/logout`) → IAS session ends → redirect to the
+instance's `post-logout-redirect-uris`.
+
+- Add `backChannelLogoutEndpoint` to the `logout` object so IAS-initiated back-channel
+  logout is also honored.
+- The site chrome logout button (`hugo/layouts/partials/header.html:313`) already navigates
+  to `/logout` — **no client-side change required**.
+
+## Identity-continuity gate (hard PROD blocker)
+
+Today users are keyed by XSUAA's `user_uuid`. `Users.sapId` (~798k rows) and the NGDS badge
+gate (`^[PSIps]\d{6,}$`) depend on that key. #2551 follow-up #1 explicitly left this
+unvalidated: **does an IAS-fronted interactive login resolve to the same user key the
+current XSUAA path produces?**
+
+- If **yes**, cutover is safe.
+- If **no**, user progress/completions **fork** for the entire population. The spec then
+  requires a UUID→user reconciliation step before any PROD cutover.
+
+This MUST be validated empirically on DEV (one real user: compare the resolved user key
+before vs. after IAS fronting) and is a **gate before PROD**, not an afterthought.
+
+## Testing & verification
+
+1. **DEV deploy** of the IAS-fronted approuter (new instance bound, routes `ias`,
+   `dynamicIdentityProvider` on `/login`).
+2. **Login works** via both picker buttons (SAP Universal ID and social).
+3. **Logout clears the IAS session** — the core assertion. Simulate the shared-machine
+   case: log in as user A, log out, confirm a fresh login prompt appears (not a silent
+   re-SSO as A). Verify the network trace reaches `atxgsg7zi.../oauth2/logout`.
+4. **MCP public-PKCE flow intact** — `mcp-remote` still obtains a token against the
+   untouched `tutorials-identity` client.
+5. **Identity-continuity check** (gate above).
+6. **e2e:** extend `test/e2e/signin.spec.ts` with the logout-clears-session assertion
+   (post-deploy, self-skips without `SMOKE_BASE_URL`).
+
+## Rollout sequence
+
+1. Create `tutorials-approuter-identity` out-of-band on DEV (`atxgsg7zi`), confidential/X509
+   posture, with the `oauth2-configuration` above.
+2. Adopt it as `existing-service` in `.deploy/mta.yaml`; add the `requires` entry to the
+   `tutorials-approuter` module; replace the stale "one binding" comment.
+3. Flip the ~40 `xsuaa` routes to `ias` in `approuter/xs-app.json`; add
+   `dynamicIdentityProvider: true` on `/login`; add `backChannelLogoutEndpoint`.
+4. Deploy to DEV; run the full test matrix incl. the identity-continuity gate.
+5. **Shared DEV+PROD subaccount caveat:** DEV and PROD share the subaccount. Anything that
+   surfaces on PROD must be done in a planned window (per #2551). Plan the PROD cutover
+   accordingly.
+6. Land the approuter `^16.0.0` → `^23.3.0` bump on `main` (currently DEV-only) so a
+   from-`main` deploy carries the version that supports native `end_session`.
+7. PROD cutover only after the identity-continuity gate passes on DEV.
+
+## Files touched (implementation)
+
+- `.deploy/mta.yaml` — new `identity` resource (existing-service) + `requires` on the
+  approuter module; replace stale comment at ~362–371.
+- `approuter/xs-app.json` — route `authenticationType` flips; `/login`
+  `dynamicIdentityProvider`; `logout.backChannelLogoutEndpoint`.
+- `approuter/package.json` — `@sap/approuter` `^16.0.0` → `^23.3.0` (align with DEV).
+- `hugo/layouts/signin.html` — map `sap_idp` values to IAS-aware equivalents (picker
+  preserved).
+- `test/e2e/signin.spec.ts` — logout-clears-session assertion.
+- Out-of-band: create `tutorials-approuter-identity` IAS instance (not an MTA-managed
+  resource — created once, adopted).
+
+## Open items for the implementation plan
+
+- Enumerate the exact prod/dev callback + post-logout origins for the IAS instance's
+  `redirect-uris` / `post-logout-redirect-uris`.
+- Confirm the `sap_idp` value mapping that preserves both picker buttons under IAS fronting
+  (DEV probe).
+- Confirm route-scoped CSP behavior under 23.x (a `server.js:124` comment references 16.9.0
+  behavior that may be stale).

From 6095629dbce0a946f38d92206e2ffd362a5f7952 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 04:01:01 -0400
Subject: [PATCH 30/46] docs(auth): implementation plan for clean logout via
 IAS-fronted approuter (#2610)

---
 .../2026-10-03-clean-logout-ias-fronting.md   | 415 ++++++++++++++++++
 1 file changed, 415 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-10-03-clean-logout-ias-fronting.md

diff --git a/docs/superpowers/plans/2026-10-03-clean-logout-ias-fronting.md b/docs/superpowers/plans/2026-10-03-clean-logout-ias-fronting.md
new file mode 100644
index 000000000..8fe473d8a
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-03-clean-logout-ias-fronting.md
@@ -0,0 +1,415 @@
+# Clean Logout via IAS-fronted Approuter — Implementation Plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.
+
+**Goal:** Make approuter 23.x native OIDC `end_session` fire against IAS (`atxgsg7zi`) on `/logout`, so the IAS session is terminated and the next person on a shared machine is not silently re-SSO'd.
+
+**Architecture:** Bind a new dedicated IAS `identity` instance to the single `tutorials-approuter` module alongside the existing XSUAA binding; flip protected routes to `authenticationType: ias` (XSUAA kept for authz via `xsuaa-cross-consumption`); the pre-existing `logout` endpoint then performs RP-initiated logout. The dual-IdP picker is preserved via `sap_idp` + `dynamicIdentityProvider`.
+
+**Tech Stack:** SAP BTP Cloud Foundry, `@sap/approuter` 23.3.0, MTA (`mbt`), SAP IAS (identity service, `application` plan), XSUAA, Hugo (signin page), Playwright (e2e).
+
+**Spec:** `docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md`
+
+## Global Constraints
+
+- IAS tenant is **`atxgsg7zi`** only. Never reference `alzmza7li` (abandoned attempt).
+- The existing `tutorials-identity` instance is **NOT touched** — it is the public-PKCE client for `mcp-remote` (`client_id 0b1e8b56-…`). Breaking it is a hard failure.
+- No change to login UX: both picker buttons (`sap.default`, `sap.custom`) keep working.
+- No forced authentication (Force Authentication must stay OFF).
+- IAS logout endpoint (verified): `https://atxgsg7zi.accounts.ondemand.com/oauth2/logout`.
+- All DEV work only; PROD cutover is gated and out of scope for this plan's code tasks.
+- DEV and PROD **share the subaccount** — anything surfacing on PROD needs a planned window.
+- PRs target **DEV**; `main` is protected. Deploy from fresh `origin/DEV`, never a feature branch. Run `cf target` before any push.
+- Approuter deploy is bundle-gated: admin-UI/static changes need a FULL `mbt build` (no `--skip-build`, no `-m` scoping).
+- Wrap any command with >~50 lines output (`mbt build`, `cf deploy`, `npm run build:all`) in `scripts/quiet-run.sh`.
+
+---
+
+## Risk-first sequencing
+
+Tasks 1–3 prove the three assumptions that can only be settled empirically on DEV, **before** the irreversible-feeling full route flip. If Task 1 (identity continuity) fails, STOP — the plan needs a reconciliation layer added before proceeding. Tasks 4–7 are the implementation. Task 8 is PROD-readiness docs. Each task is independently testable.
+
+---
+
+### Task 1: Provision the IAS instance + prove identity continuity (DEV probe)
+
+This is the hard gate. It creates the new IAS instance and answers "does an IAS-fronted login resolve to the same user key XSUAA produces today?" using a single bound test, without touching the main approuter yet.
+
+**Files:**
+- Create: `scripts/spikes/ias-identity-continuity.cjs` (throwaway probe harness; delete after)
+- Reference: `.deploy/xs-security.json` (redirect-uri origins to mirror)
+
+**Interfaces:**
+- Produces: a DEV IAS instance named `tutorials-approuter-identity` (confidential/X509 posture) that later tasks adopt as `existing-service`.
+- Produces: a documented finding — IAS `sub`/`user_uuid` of a real test user vs. that user's existing XSUAA-resolved key in `Users.sapId`.
+
+- [ ] **Step 1: Write the instance config file**
+
+Create `scripts/spikes/approuter-identity-params.json`:
+
+```json
+{
+  "oauth2-configuration": {
+    "redirect-uris": ["https://*.cfapps.eu10-005.hana.ondemand.com/login/callback?authType=ias"],
+    "post-logout-redirect-uris": ["https://*.cfapps.eu10-005.hana.ondemand.com/**"]
+  },
+  "xsuaa-cross-consumption": true
+}
+```
+
+- [ ] **Step 2: Create the IAS instance out-of-band on DEV**
+
+Run (confirm `cf target` = `tutorial-system/dev` first):
+
+```bash
+cf target | grep -i space   # MUST show: space: dev
+cf create-service identity application tutorials-approuter-identity -c scripts/spikes/approuter-identity-params.json
+cf service tutorials-approuter-identity   # wait for: create succeeded
+```
+
+Expected: instance `create succeeded`. (Entitlement is proven — `tutorials-identity` already exists.)
+
+- [ ] **Step 3: Create an X509 service key and inspect the client posture**
+
+```bash
+cf create-service-key tutorials-approuter-identity ar-key -c '{"credential-type":"X509_GENERATED"}'
+cf service-key tutorials-approuter-identity ar-key
+```
+
+Expected: credentials include `clientid` (a NEW client_id, distinct from `0b1e8b56-…`), `certificate`/`key`, `authorization_endpoint` and `end_session_endpoint` on `atxgsg7zi.accounts.ondemand.com`. Confirms a confidential X509 client minted on the correct tenant.
+
+- [ ] **Step 4: Document the identity-continuity finding**
+
+Capture one real test user's current XSUAA-resolved key (from the live DEV `/auth/user` while logged in today, or a `Users` row) and compare to the IAS `sub` that an IAS login for the same user would carry. If an interactive IAS login through the approuter isn't wired yet, record the IAS `sub` from a direct IAS token for that user (the MCP flow already proves IAS token issuance on this tenant) and compare UUIDs.
+
+Write the finding into the spec's "Identity-continuity gate" section as GATE PASS or GATE FAIL with the two UUIDs (redact to first 8 chars).
+
+- [ ] **Step 5: Decision checkpoint — STOP if gate fails**
+
+If the IAS `sub` ≠ the XSUAA-resolved user key, STOP and report: the plan needs a UUID→user reconciliation task inserted before Task 4. Do not proceed to route flips. If PASS, continue.
+
+- [ ] **Step 6: Commit the probe + finding**
+
+```bash
+git add scripts/spikes/ docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md
+git commit -m "spike(auth): provision IAS approuter instance + identity-continuity finding (#2610)"
+```
+
+---
+
+### Task 2: Confirm the `sap_idp` IAS mapping that preserves both picker buttons (DEV probe)
+
+Resolves the spec open item: which `sap_idp` values route correctly to each IdP once IAS fronts the approuter. Probe-only; no committed route flip yet.
+
+**Files:**
+- Reference: `hugo/layouts/signin.html:12` (`/login?sap_idp=sap.default`), `:15` (`/login?sap_idp=sap.custom`)
+
+**Interfaces:**
+- Produces: the confirmed `sap_idp` string for each button under IAS fronting (e.g. plain `sap.default` / `sap.custom`, or an IAS chain like `sap.custom,<ias-idp-key>`), consumed by Task 6.
+
+- [ ] **Step 1: Enumerate the IAS trust/IdP keys available on the subaccount**
+
+```bash
+cf curl "/v3/service_instances?names=tutorials-approuter-identity" >/dev/null  # sanity
+# Inspect subaccount trust configs (IdP origin keys) via BTP:
+btp list security/trust --subaccount <tutorial-system-dev-guid>
+```
+
+Expected: the origin keys backing `sap.default` and `sap.custom`. Record them.
+
+- [ ] **Step 2: Document the mapping**
+
+Record in the spec's "Open items" → resolved: the exact `sap_idp` value each button must send so SAP Universal ID and social both resolve under IAS fronting. No code change in this task.
+
+- [ ] **Step 3: Commit the finding**
+
+```bash
+git add docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md
+git commit -m "spike(auth): confirm sap_idp mapping for dual-IdP picker under IAS (#2610)"
+```
+
+---
+
+### Task 3: Align approuter version on the branch
+
+Ensures the branch declares the 23.x approuter that supports native `end_session`, matching DEV runtime.
+
+**Files:**
+- Modify: `approuter/package.json` (`@sap/approuter` dependency)
+
+- [ ] **Step 1: Update the dependency**
+
+In `approuter/package.json`, change `"@sap/approuter": "^16.0.0"` to `"@sap/approuter": "^23.3.0"`.
+
+- [ ] **Step 2: Verify it matches DEV**
+
+```bash
+jq -r '.dependencies["@sap/approuter"]' approuter/package.json   # expect ^23.3.0
+MSYS_NO_PATHCONV=1 git show origin/DEV:approuter/package.json | jq -r '.dependencies["@sap/approuter"]'  # expect ^23.3.0
+```
+
+Expected: both print `^23.3.0`.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add approuter/package.json
+git commit -m "chore(approuter): declare @sap/approuter ^23.3.0 (#2610)"
+```
+
+---
+
+### Task 4: Bind the IAS instance to the approuter module
+
+Adds the second auth binding and replaces the stale 16.x "one binding only" comment. This is the structural MTA change.
+
+**Files:**
+- Modify: `.deploy/mta.yaml:361-371` (approuter `requires` + stale comment)
+- Add: an `identity` resource (existing-service) in the `resources:` section (~line 447+)
+
+**Interfaces:**
+- Consumes: the `tutorials-approuter-identity` instance from Task 1.
+- Produces: approuter module bound to XSUAA + IAS.
+
+- [ ] **Step 1: Replace the stale comment and add the IAS require**
+
+In `.deploy/mta.yaml`, the approuter `requires:` currently reads (line 361 + comment 362-371):
+
+```yaml
+    requires:
+      - name: tutorials-xsuaa
+      # NOTE: the approuter is deliberately bound to ONLY the confidential
+      # tutorials-xsuaa (its login client). ...
+      # ... Keeping one binding avoids that.
+      # approuter resolves runtime secrets from the credstore via
+      # approuter/lib/credstore-secret.js (same binding the srv uses). The retired
+      # /admin/rebuild handler (#1659 C.4) no longer reads from it.
+      - name: tutorials-credstore
+```
+
+Replace the `tutorials-xsuaa` line + the stale NOTE (362-368) with:
+
+```yaml
+    requires:
+      - name: tutorials-xsuaa
+      # Dual auth binding (approuter 23.x). XSUAA is kept for authorization/scopes;
+      # tutorials-approuter-identity (IAS) fronts interactive login so native
+      # OIDC end_session fires on /logout (#2610, clean logout on shared machines).
+      # The 16.x "one binding only / non-deterministic 500s" constraint no longer
+      # applies: 23.x supports XSUAA+IAS together. Routes set authenticationType:ias
+      # EXPLICITLY (xs-app.json) to avoid the per-request BTP-security-endpoint probe.
+      # NOTE: tutorials-identity (the PUBLIC mcp-remote PKCE client) is a SEPARATE
+      # instance and is intentionally NOT bound here.
+      - name: tutorials-approuter-identity
+      # approuter resolves runtime secrets from the credstore via
+      # approuter/lib/credstore-secret.js.
+      - name: tutorials-credstore
+```
+
+- [ ] **Step 2: Add the existing-service resource**
+
+In the `resources:` section (near the `tutorials-xsuaa` resource), add:
+
+```yaml
+  # IAS instance fronting approuter interactive login so native end_session fires
+  # on /logout (#2610). Created out-of-band (like tutorials-identity) for a stable
+  # client_id; adopted here. NOT the mcp-remote public client (that is tutorials-identity).
+  - name: tutorials-approuter-identity
+    type: org.cloudfoundry.existing-service
+    parameters:
+      service-name: tutorials-approuter-identity
+```
+
+- [ ] **Step 3: Validate MTA descriptor parses**
+
+```bash
+scripts/quiet-run.sh mbt build -p=. -t=./.mta-check --mtar=/dev/null 2>&1 | tail -5 || true
+# Lighter check if mbt is heavy: yq validates YAML structure
+yq '.resources[] | select(.name == "tutorials-approuter-identity")' .deploy/mta.yaml
+yq '.modules[] | select(.type=="approuter.nodejs") | .requires[].name' .deploy/mta.yaml | grep tutorials-approuter-identity
+```
+
+Expected: the resource prints; the require name prints — confirming wiring.
+
+- [ ] **Step 4: Commit**
+
+```bash
+git add .deploy/mta.yaml
+git commit -m "feat(approuter): bind IAS identity instance for clean logout (#2610)"
+```
+
+---
+
+### Task 5: Flip protected routes to `authenticationType: ias`
+
+Changes the ~40 `xsuaa` routes to `ias`. `none` routes (public + MCP) stay untouched.
+
+**Files:**
+- Modify: `approuter/xs-app.json` (routes with `"authenticationType": "xsuaa"`)
+
+- [ ] **Step 1: Flip xsuaa → ias on all protected routes**
+
+Replace every route-level `"authenticationType": "xsuaa"` with `"authenticationType": "ias"`. Do NOT touch any `"authenticationType": "none"` route (public content, `/mcp-auth/*`, `/content/*`, build feeds, `/signin`, `/version`, etc.).
+
+```bash
+# Count before (expect ~40):
+grep -c '"authenticationType": "xsuaa"' approuter/xs-app.json
+sd -F '"authenticationType": "xsuaa"' '"authenticationType": "ias"' approuter/xs-app.json
+# Count after (expect 0 xsuaa, same count now ias):
+grep -c '"authenticationType": "xsuaa"' approuter/xs-app.json   # expect 0
+```
+
+- [ ] **Step 2: Verify no `none` route was altered + JSON is valid**
+
+```bash
+jq '.routes | map(select(.authenticationType=="none")) | length' approuter/xs-app.json  # unchanged vs origin/DEV
+jq -e . approuter/xs-app.json >/dev/null && echo "valid JSON"
+MSYS_NO_PATHCONV=1 git show origin/DEV:approuter/xs-app.json | jq '.routes | map(select(.authenticationType=="none")) | length'  # compare equal
+```
+
+Expected: `none` count equal to DEV baseline; JSON valid.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add approuter/xs-app.json
+git commit -m "feat(approuter): route authenticationType xsuaa -> ias (#2610)"
+```
+
+---
+
+### Task 6: Preserve the dual-IdP picker + wire back-channel logout
+
+Applies the Task 2 `sap_idp` mapping, enables `dynamicIdentityProvider` on `/login`, and adds `backChannelLogoutEndpoint`.
+
+**Files:**
+- Modify: `approuter/xs-app.json` (the `^/login(\?.*)?$` route; the `logout` object)
+- Modify: `hugo/layouts/signin.html:12,15` (only if Task 2 found the button values must change)
+
+**Interfaces:**
+- Consumes: the confirmed `sap_idp` values from Task 2.
+
+- [ ] **Step 1: Enable dynamicIdentityProvider on the /login route**
+
+In `approuter/xs-app.json`, on the route `"source": "^/login(\\?.*)?$"`, add `"dynamicIdentityProvider": true` (keep its existing `authenticationType` — it should now be `ias` from Task 5). This makes the approuter honor the `sap_idp` query param under IAS.
+
+- [ ] **Step 2: Add backChannelLogoutEndpoint to the logout object**
+
+Change the `logout` object from:
+
+```json
+"logout": { "logoutEndpoint": "/logout", "logoutPage": "/" }
+```
+
+to:
+
+```json
+"logout": { "logoutEndpoint": "/logout", "logoutPage": "/", "backChannelLogoutEndpoint": "/backchannel-logout" }
+```
+
+- [ ] **Step 3: Apply the Task 2 sap_idp mapping to the picker (only if required)**
+
+If Task 2 found the button `sap_idp` values must change for IAS, update `hugo/layouts/signin.html:12` and `:15` accordingly. If Task 2 confirmed plain `sap.default`/`sap.custom` still resolve, make NO change and note that here.
+
+- [ ] **Step 4: Validate**
+
+```bash
+jq -e '.routes[] | select(.source=="^/login(\\?.*)?$") | .dynamicIdentityProvider' approuter/xs-app.json  # expect true
+jq -e '.logout.backChannelLogoutEndpoint' approuter/xs-app.json  # expect "/backchannel-logout"
+```
+
+- [ ] **Step 5: Commit**
+
+```bash
+git add approuter/xs-app.json hugo/layouts/signin.html
+git commit -m "feat(approuter): preserve dual-IdP picker + back-channel logout under IAS (#2610)"
+```
+
+---
+
+### Task 7: Deploy to DEV and verify clean logout end-to-end
+
+The real-thing test: deploy, confirm login both ways, confirm logout clears the IAS session, confirm MCP intact.
+
+**Files:**
+- Modify: `test/e2e/signin.spec.ts` (add logout-clears-session assertion)
+
+- [ ] **Step 1: Deploy to DEV from this branch's build**
+
+Per the repo deploy convention (full build, no `--skip-build`, no `-m`):
+
+```bash
+cf target   # MUST be tutorial-system/dev
+export CAP_BASE_URL="https://tutorial-system-dev-tutorials-srv.cfapps.eu10-005.hana.ondemand.com"
+scripts/quiet-run.sh npm run build:all
+cd .deploy && scripts/quiet-run.sh mbt build && scripts/quiet-run.sh cf deploy mta_archives/*.mtar -e ../deploy/dev.mtaext -f
+```
+
+Expected: deploy succeeds; approuter now bound to XSUAA + IAS (`cf env tutorials-approuter | grep -o '"identity"'`).
+
+- [ ] **Step 2: Verify login via BOTH picker buttons**
+
+Browser: open DEV `/signin`, click "SAP Universal Account" → authenticates → lands authenticated. Repeat with "Other Options" (social). Both must succeed.
+
+- [ ] **Step 3: Verify logout clears the IAS session (the core assertion)**
+
+Log in as user A. Click logout (`/logout`). With a network trace open, confirm the chain reaches `https://atxgsg7zi.accounts.ondemand.com/oauth2/logout`. Then navigate back to a protected route — confirm a **fresh login prompt** appears (NOT a silent re-SSO as A). This is the bug being fixed.
+
+- [ ] **Step 4: Verify MCP public-PKCE flow intact**
+
+Run the `mcp-remote` DEV connection (per `docs/end-users/mcp-quickstart.md`, DEV `client_id 0b1e8b56-…`). Confirm it still obtains a token against the untouched `tutorials-identity`.
+
+- [ ] **Step 5: Add the e2e assertion**
+
+In `test/e2e/signin.spec.ts`, add a test that logs in, hits `/logout`, and asserts the next protected-route visit renders the login/signin page (not authenticated content). Follow the file's existing pattern (self-skips without `SMOKE_BASE_URL`).
+
+- [ ] **Step 6: Run e2e against DEV**
+
+```bash
+export SMOKE_BASE_URL="https://<dev-approuter-route>"
+scripts/quiet-run.sh npm run test:e2e
+```
+
+Expected: the new logout-clears-session test passes.
+
+- [ ] **Step 7: Commit**
+
+```bash
+git add test/e2e/signin.spec.ts
+git commit -m "test(e2e): assert logout clears IAS session (#2610)"
+```
+
+---
+
+### Task 8: PROD-readiness documentation
+
+Captures the gated PROD cutover steps so the handoff is actionable. No PROD change executed here.
+
+**Files:**
+- Modify: `docs/developers/architecture/authentication.md` (document the IAS-fronted logout flow)
+- Modify: the spec's Rollout section (mark DEV steps done; leave PROD steps as the gated checklist)
+
+- [ ] **Step 1: Document the new auth/logout flow**
+
+Add a section to `docs/developers/architecture/authentication.md` describing: approuter bound to XSUAA + IAS, routes `authenticationType: ias`, `/logout` → IAS `end_session`, dual-IdP picker via `sap_idp`, and the two separate IAS instances (approuter vs mcp-remote).
+
+- [ ] **Step 2: Record the PROD cutover checklist**
+
+In the spec, mark the DEV rollout steps complete and leave the PROD steps as a checklist: add prod host (`developers.sap.com/**`) to the IAS instance `redirect-uris`/`post-logout-redirect-uris`; create the prod `tutorials-approuter-identity`; land the approuter 23.x bump on `main`; plan the shared-subaccount window; cutover only after identity-continuity PASS.
+
+- [ ] **Step 3: Commit**
+
+```bash
+git add docs/developers/architecture/authentication.md docs/superpowers/specs/2026-10-03-clean-logout-ias-fronting-design.md
+git commit -m "docs(auth): document IAS-fronted clean logout + PROD cutover checklist (#2610)"
+```
+
+---
+
+## Self-review
+
+**Spec coverage:** core mechanism (T4-5), identity instance strategy/two instances (T1,T4), route flip + explicit ias (T5), dual-IdP picker (T2,T6), logout wiring + back-channel (T6), identity-continuity gate (T1), approuter version (T3), testing incl. MCP-intact + e2e (T7), rollout + PROD caveat (T8). All spec sections map to a task.
+
+**Placeholder scan:** no TBD/TODO; the only conditional step (T6 Step 3) is explicitly gated on a documented Task 2 output, with the "make no change and note it" branch spelled out.
+
+**Type/name consistency:** instance name `tutorials-approuter-identity` used identically in T1/T4; `logoutEndpoint: /logout` and `backChannelLogoutEndpoint: /backchannel-logout` consistent; `sap_idp` values flow T2→T6.

From 0b37fc836563c840c4fe6b71070eef0e09f26a46 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 04:06:49 -0400
Subject: [PATCH 31/46] feat(approuter): route auth xsuaa->ias + dynamicIdP +
 back-channel logout (#2610)

---
 approuter/xs-app.json | 101 +++++++++++++++++++++---------------------
 1 file changed, 51 insertions(+), 50 deletions(-)

diff --git a/approuter/xs-app.json b/approuter/xs-app.json
index 2dc63a8a3..c38b6fa18 100644
--- a/approuter/xs-app.json
+++ b/approuter/xs-app.json
@@ -38,7 +38,8 @@
   },
   "logout": {
     "logoutEndpoint": "/logout",
-    "logoutPage": "/"
+    "logoutPage": "/",
+    "backChannelLogoutEndpoint": "/backchannel-logout"
   },
   "errorPage": [
     { "status": 404, "file": "static/404.html" },
@@ -51,35 +52,35 @@
       "source": "^/scanner-ui/(.*)$",
       "target": "/scanner-ui/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.MobileApp"
     },
     {
       "source": "^/scanner-vue/(.*)$",
       "target": "/scanner-vue/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.MobileApp"
     },
     {
       "source": "^/scanner/(.*)$",
       "target": "/scanner/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.MobileApp"
     },
     {
       "source": "^/display-app/(.*)$",
       "target": "/display-app/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.DisplayApp"
     },
     {
       "source": "^/analytics-ui/(.*)$",
       "target": "/analytics-ui/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/explore-ui/(.*)$",
@@ -97,32 +98,32 @@
       "source": "^/admin-ui/(.*)$",
       "target": "/admin-ui/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/data-inspector-ui/(.*)$",
       "target": "/data-inspector-ui/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/odata/v4/data-inspector/(.*)$",
       "target": "/odata/v4/data-inspector/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/login(\\?.*)?$",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "dynamicIdentityProvider": true,
       "target": "/login-redirect.html",
       "localDir": "static"
     },
     {
       "source": "^/auth/user$",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "target": "/auth/user",
       "destination": "srv-api"
     },
@@ -178,13 +179,13 @@
       "source": "^/api/devtoberfest/join(\\?.*)?$",
       "target": "/api/devtoberfest/join$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/api/devtoberfest/cat-game/award(\\?.*)?$",
       "target": "/api/devtoberfest/cat-game/award$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     { "source": "^/devtoberfest/?(\\?.*)?$", "target": "/content/pages/devtoberfest/$1", "destination": "srv-api", "authenticationType": "none" },
     {
@@ -197,14 +198,14 @@
       "source": "^/gameboard/getMyGameboard(.*)$",
       "target": "/gameboard/getMyGameboard$1",
       "destination": "gameboard-auth-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "httpMethods": ["GET", "HEAD"]
     },
     {
       "source": "^/gameboard/refreshGameboardCache(.*)$",
       "target": "/gameboard/refreshGameboardCache$1",
       "destination": "gameboard-auth-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "httpMethods": ["POST"]
     },
     {
@@ -218,7 +219,7 @@
       "source": "^/community/khoros/eventRegs/(.*)$",
       "target": "/community/khoros/eventRegs/$1",
       "destination": "gameboard-auth-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
@@ -243,69 +244,69 @@
       "source": "^/hcql/admin(.*)$",
       "target": "/hcql/admin$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/hcql/author(.*)$",
       "target": "/hcql/author$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/hcql/analytics(.*)$",
       "target": "/hcql/analytics$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/hcql/exports(.*)$",
       "target": "/hcql/exports$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/hcql/consolidation(.*)$",
       "target": "/hcql/consolidation$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.ConsolidationScope"
     },
     {
       "source": "^/admin/exports/(.*)$",
       "target": "/admin/exports/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/admin/analytics/(.*)$",
       "target": "/admin/analytics/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/pats/(.*)$",
       "target": "/pats/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/admin/(.*)$",
       "target": "/admin/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/author/(.*)$",
       "target": "/author/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
@@ -330,7 +331,7 @@
       "source": "^/graphql(\\?.*)?$",
       "target": "/graphql",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/graph/(neighborhood(?:Full)?|Concepts|ConceptEdges|TutorialConceptLinks|pathBetween|conceptsForUser|explore-data|clusters-data|path|searchKG|PublishedConcepts)(\\(.*\\))?(/.*)?(\\?.*)?$",
@@ -342,21 +343,21 @@
       "source": "^/graph/(.*)$",
       "target": "/graph/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/display/(.*)$",
       "target": "/display/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.DisplayApp"
     },
     {
       "source": "^/api/v1/(.*)$",
       "target": "/api/v1/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.ConsolidationScope"
     },
     {
@@ -369,7 +370,7 @@
       "source": "^/chat/(.*)$",
       "target": "/chat/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/api/advocates(/.*)?$",
@@ -405,7 +406,7 @@
       "source": "^/puzzle-api/(.*)$",
       "target": "/puzzle-api/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/petoberfest-api/photo/(.*)$",
@@ -429,25 +430,25 @@
       "source": "^/petoberfest-api/(.*)/upload$",
       "target": "/petoberfest-api/$1/upload",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/petoberfest-api/(.*)$",
       "target": "/petoberfest-api/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/channel-submissions/(.*)$",
       "target": "/channel-submissions/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/api/media-diet/my-picks(\\?.*)?$",
       "target": "/api/media-diet/my-picks$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/api/media-diet/export(\\?.*)?$",
@@ -459,7 +460,7 @@
       "source": "^/api/(.*)$",
       "target": "/api/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/search/(.*)$",
@@ -495,7 +496,7 @@
       "source": "^/homepage/personalized$",
       "target": "/homepage/personalized",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/homepage/(.*)$",
@@ -543,7 +544,7 @@
       "source": "^/ktt/(.*)$",
       "target": "/ktt/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa"
+      "authenticationType": "ias"
     },
     {
       "source": "^/content/(.*)$",
@@ -576,7 +577,7 @@
       "source": "^/mcp-admin/(.*)$",
       "target": "/mcp-admin/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "csrfProtection": false,
       "scope": "$XSAPPNAME.Tutorial.MCP"
     },
@@ -584,7 +585,7 @@
       "source": "^/a2a/?$",
       "target": "/a2a",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "csrfProtection": false,
       "scope": "$XSAPPNAME.Tutorial.MCP"
     },
@@ -592,49 +593,49 @@
       "source": "^/tutorial-navigator-qa/?(\\?.*)?$",
       "target": "/content/pages/tutorial-navigator/$1",
       "destination": "srv-qa-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/_nav\\.json$",
       "target": "/content/nav",
       "destination": "srv-qa-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/qa-search/(.*)$",
       "target": "/search/$1",
       "destination": "srv-qa-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/search/?(.*)$",
       "target": "/qa/search/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/?$",
       "target": "/qa/index.html",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/((?:css|js|img|fonts|vendor)/.*)$",
       "target": "/$1",
       "localDir": "static",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/(.*)$",
       "target": "/content/tutorials/$1",
       "destination": "srv-qa-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
@@ -671,14 +672,14 @@
       "source": "^/_dev/?(.*)$",
       "target": "/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/(\\$api-docs/.*)$",
       "target": "/$1",
       "destination": "srv-api",
-      "authenticationType": "xsuaa",
+      "authenticationType": "ias",
       "scope": "$XSAPPNAME.Admin"
     },
     {

From 498078bf37f88b8bac45d778eed6ce7f2a3d6087 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 04:09:12 -0400
Subject: [PATCH 32/46] feat(approuter): bind IAS identity instance for clean
 logout (#2610)

---
 .deploy/mta.yaml | 33 ++++++++++++++++++++++++---------
 1 file changed, 24 insertions(+), 9 deletions(-)

diff --git a/.deploy/mta.yaml b/.deploy/mta.yaml
index 439025737..778979a4e 100644
--- a/.deploy/mta.yaml
+++ b/.deploy/mta.yaml
@@ -359,16 +359,20 @@ modules:
           srv-mcp-url: ${srv-mcp-url}
     requires:
       - name: tutorials-xsuaa
-      # NOTE: the approuter is deliberately bound to ONLY the confidential
-      # tutorials-xsuaa (its login client). The PUBLIC tutorials-mcp issuer that
-      # .well-known OAuth discovery advertises is supplied as NON-SECRET config
-      # env (XSUAA_MCP_URL + XSUAA_MCP_XSAPPNAME, see properties below) — NOT a
-      # 2nd xsuaa binding. Binding a 2nd xsuaa would make @sap/approuter's own
-      # login handshake pick a binding non-deterministically (no route selector),
-      # risking 500s on every xsuaa-authed route. Keeping one binding avoids that.
+      # Dual auth binding (approuter 23.x). XSUAA is kept for authorization/scopes;
+      # tutorials-approuter-identity (IAS) fronts interactive login so native OIDC
+      # end_session fires on /logout (#2610 — clean logout on shared event machines).
+      # The former 16.x "one binding only / non-deterministic 500s" constraint no
+      # longer applies: 23.x supports XSUAA+IAS bound together. Routes set
+      # authenticationType:ias EXPLICITLY (approuter/xs-app.json) to avoid the
+      # per-request BTP-security-endpoint probe when both services are bound.
+      # NOTE: tutorials-identity (the PUBLIC mcp-remote PKCE client, client
+      # 0b1e8b56-…) is a SEPARATE instance and is intentionally NOT bound here.
+      # The .well-known MCP issuer stays NON-SECRET config env (XSUAA_MCP_URL +
+      # XSUAA_MCP_XSAPPNAME, see properties above), NOT a binding.
+      - name: tutorials-approuter-identity
       # approuter resolves runtime secrets from the credstore via
-      # approuter/lib/credstore-secret.js (same binding the srv uses). The retired
-      # /admin/rebuild handler (#1659 C.4) no longer reads from it.
+      # approuter/lib/credstore-secret.js (same binding the srv uses).
       - name: tutorials-credstore
       - name: srv-api
         group: destinations
@@ -473,6 +477,17 @@ resources:
       service-name: tutorials-xsuaa
       config-path: xs-security.json
 
+  # IAS instance fronting approuter interactive login so native OIDC end_session
+  # fires on /logout (#2610 — clean logout on shared event machines, tenant
+  # atxgsg7zi). Created out-of-band (like tutorials-identity) for a stable
+  # client_id and adopted here, so no provisioning time is added to the main MTA
+  # deploy. This is NOT the mcp-remote PUBLIC PKCE client — that is the separate
+  # tutorials-identity instance, which stays untouched.
+  - name: tutorials-approuter-identity
+    type: org.cloudfoundry.existing-service
+    parameters:
+      service-name: tutorials-approuter-identity
+
   - name: tutorials-destination
     type: org.cloudfoundry.managed-service
     parameters:

From 626f2ccec995d52c3583fda769ff0ef108dc8b78 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 04:17:59 -0400
Subject: [PATCH 33/46] chore(auth): checked-in IAS instance params for
 tutorials-approuter-identity (#2610)

---
 scripts/ias/approuter-identity-params.json | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 scripts/ias/approuter-identity-params.json

diff --git a/scripts/ias/approuter-identity-params.json b/scripts/ias/approuter-identity-params.json
new file mode 100644
index 000000000..e1b0a8bf8
--- /dev/null
+++ b/scripts/ias/approuter-identity-params.json
@@ -0,0 +1,13 @@
+{
+  "oauth2-configuration": {
+    "redirect-uris": [
+      "https://*.cfapps.eu10-005.hana.ondemand.com/login/callback?authType=ias",
+      "https://developers.sap.com/login/callback?authType=ias"
+    ],
+    "post-logout-redirect-uris": [
+      "https://*.cfapps.eu10-005.hana.ondemand.com/**",
+      "https://developers.sap.com/**"
+    ]
+  },
+  "xsuaa-cross-consumption": true
+}

From 9053c1e382aa4e2ee9816963e5b9e310da92d7d7 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 05:08:25 -0400
Subject: [PATCH 34/46] test(smoke): accept IAS /oauth2/authorize redirect in
 anon-auth assertions (#2610)

---
 test/smoke/admin-exports.smoke.test.js         | 8 ++++----
 test/smoke/admin-homepage-config.smoke.test.js | 7 ++++---
 test/smoke/analytics.test.js                   | 5 +++--
 3 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/test/smoke/admin-exports.smoke.test.js b/test/smoke/admin-exports.smoke.test.js
index 822b94f4d..71806a86f 100644
--- a/test/smoke/admin-exports.smoke.test.js
+++ b/test/smoke/admin-exports.smoke.test.js
@@ -9,13 +9,13 @@ describe.runIf(APPROUTER && SRV)('admin exports smoke', () => {
     const res = await fetchWithRetry(`${APPROUTER}/admin/exports/exportLegacyData?format=csv`, { redirect: 'manual' });
     // Approuter may respond with:
     //   - 401 (HEAD-style direct rejection)
-    //   - 302 (server-side redirect to /oauth/authorize)
-    //   - 200 with a tiny HTML body that JS-redirects to /oauth/authorize and
+    //   - 302 (server-side redirect to /oauth2/authorize [IAS] or /oauth/authorize [XSUAA])
+    //   - 200 with a tiny HTML body that JS-redirects to /oauth2?/authorize and
     //     stashes the URL fragment in a cookie (the browser-friendly path).
-    // All three prove the route is XSUAA-protected.
+    // All three prove the route is auth-protected.
     if (res.status === 200) {
       const body = await res.text();
-      expect(body).toMatch(/\/oauth\/authorize/);
+      expect(body).toMatch(/\/oauth2?\/authorize/);
     } else {
       expect([401, 302]).toContain(res.status);
     }
diff --git a/test/smoke/admin-homepage-config.smoke.test.js b/test/smoke/admin-homepage-config.smoke.test.js
index 6d4167366..441ba0c7b 100644
--- a/test/smoke/admin-homepage-config.smoke.test.js
+++ b/test/smoke/admin-homepage-config.smoke.test.js
@@ -10,7 +10,8 @@
 //
 // Pattern: matches admin-exports.smoke.test.js (the established admin smoke
 // test shape). XSUAA gates /admin/* and /admin-ui/* — anonymous requests
-// resolve to 401 / 302 / HTML-redirect to /oauth/authorize. With a
+// resolve to 401 / 302 / HTML-redirect to /oauth2?/authorize (IAS /oauth2 or
+// XSUAA /oauth). With a
 // SMOKE_ADMIN_TOKEN env var (tech user), we can hit the OData collection
 // directly and assert the four-field shape.
 
@@ -26,7 +27,7 @@ describe.runIf(APPROUTER && SRV)('admin homepage config smoke (#734)', () => {
     const res = await fetchWithRetry(`${APPROUTER}/admin-ui/`, { redirect: 'manual' });
     if (res.status === 200) {
       const body = await res.text();
-      expect(body).toMatch(/\/oauth\/authorize/);
+      expect(body).toMatch(/\/oauth2?\/authorize/);
     } else {
       expect([401, 302]).toContain(res.status);
     }
@@ -39,7 +40,7 @@ describe.runIf(APPROUTER && SRV)('admin homepage config smoke (#734)', () => {
     const res = await fetchWithRetry(`${SRV}/admin/HomepageConfig`, { redirect: 'manual' });
     if (res.status === 200) {
       const body = await res.text();
-      expect(body).toMatch(/\/oauth\/authorize/);
+      expect(body).toMatch(/\/oauth2?\/authorize/);
     } else {
       expect([401, 302]).toContain(res.status);
     }
diff --git a/test/smoke/analytics.test.js b/test/smoke/analytics.test.js
index ecc7440e8..b40325bc0 100644
--- a/test/smoke/analytics.test.js
+++ b/test/smoke/analytics.test.js
@@ -7,11 +7,12 @@ const hasUrls = !!process.env.SMOKE_BASE_URL && !!process.env.SMOKE_SRV_URL;
 describe.skipIf(!hasUrls)('analytics smoke', () => {
   it('GET /analytics-ui/ unauthenticated -> 302/401 or 200+JS-redirect', async () => {
     const res = await fetchWithRetry(`${BASE_URL}/analytics-ui/`);
-    // Approuter may JS-redirect (200 with /oauth/authorize body) instead of
+    // Approuter may JS-redirect (200 with /oauth2/authorize body under IAS, or
+    // /oauth/authorize under XSUAA) instead of
     // returning 302 for browser-friendly fragment preservation.
     if (res.status === 200) {
       const body = await res.text();
-      expect(body).toMatch(/\/oauth\/authorize/);
+      expect(body).toMatch(/\/oauth2?\/authorize/);
     } else {
       expect([302, 401]).toContain(res.status);
     }

From 1ebea02ab6635c9942351190a0e1809e97d27a69 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 08:22:56 -0400
Subject: [PATCH 35/46] fix(approuter): revert routes ias->xsuaa, keep IAS
 binding for logout (#2610)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The IAS-fronting deploy flipped ~49 routes to authenticationType:ias, which
routed interactive login through IAS atxgsg7zi — whose SP-initiated login hits
the known broken corporate-IdP federation 400, breaking sap.default login.

Restore the working XSUAA login + sap.default/sap.custom picker (routes back to
xsuaa, byte-identical to pre-#2610). KEEP the tutorials-approuter-identity IAS
binding in mta.yaml and backChannelLogoutEndpoint so logout can still reach IAS
end_session. Fixes the xs-app-graph-routes unit test (catch-all expects xsuaa).
---
 approuter/xs-app.json | 98 +++++++++++++++++++++----------------------
 1 file changed, 49 insertions(+), 49 deletions(-)

diff --git a/approuter/xs-app.json b/approuter/xs-app.json
index c38b6fa18..0a429436c 100644
--- a/approuter/xs-app.json
+++ b/approuter/xs-app.json
@@ -52,35 +52,35 @@
       "source": "^/scanner-ui/(.*)$",
       "target": "/scanner-ui/$1",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.MobileApp"
     },
     {
       "source": "^/scanner-vue/(.*)$",
       "target": "/scanner-vue/$1",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.MobileApp"
     },
     {
       "source": "^/scanner/(.*)$",
       "target": "/scanner/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.MobileApp"
     },
     {
       "source": "^/display-app/(.*)$",
       "target": "/display-app/$1",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.DisplayApp"
     },
     {
       "source": "^/analytics-ui/(.*)$",
       "target": "/analytics-ui/$1",
       "localDir": "static",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/explore-ui/(.*)$",
@@ -98,32 +98,32 @@
       "source": "^/admin-ui/(.*)$",
       "target": "/admin-ui/$1",
       "localDir": "static",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/data-inspector-ui/(.*)$",
       "target": "/data-inspector-ui/$1",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/odata/v4/data-inspector/(.*)$",
       "target": "/odata/v4/data-inspector/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/login(\\?.*)?$",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "dynamicIdentityProvider": true,
       "target": "/login-redirect.html",
       "localDir": "static"
     },
     {
       "source": "^/auth/user$",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "target": "/auth/user",
       "destination": "srv-api"
     },
@@ -179,13 +179,13 @@
       "source": "^/api/devtoberfest/join(\\?.*)?$",
       "target": "/api/devtoberfest/join$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/api/devtoberfest/cat-game/award(\\?.*)?$",
       "target": "/api/devtoberfest/cat-game/award$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     { "source": "^/devtoberfest/?(\\?.*)?$", "target": "/content/pages/devtoberfest/$1", "destination": "srv-api", "authenticationType": "none" },
     {
@@ -198,14 +198,14 @@
       "source": "^/gameboard/getMyGameboard(.*)$",
       "target": "/gameboard/getMyGameboard$1",
       "destination": "gameboard-auth-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "httpMethods": ["GET", "HEAD"]
     },
     {
       "source": "^/gameboard/refreshGameboardCache(.*)$",
       "target": "/gameboard/refreshGameboardCache$1",
       "destination": "gameboard-auth-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "httpMethods": ["POST"]
     },
     {
@@ -219,7 +219,7 @@
       "source": "^/community/khoros/eventRegs/(.*)$",
       "target": "/community/khoros/eventRegs/$1",
       "destination": "gameboard-auth-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
@@ -244,69 +244,69 @@
       "source": "^/hcql/admin(.*)$",
       "target": "/hcql/admin$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/hcql/author(.*)$",
       "target": "/hcql/author$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/hcql/analytics(.*)$",
       "target": "/hcql/analytics$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/hcql/exports(.*)$",
       "target": "/hcql/exports$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/hcql/consolidation(.*)$",
       "target": "/hcql/consolidation$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.ConsolidationScope"
     },
     {
       "source": "^/admin/exports/(.*)$",
       "target": "/admin/exports/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/admin/analytics/(.*)$",
       "target": "/admin/analytics/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/pats/(.*)$",
       "target": "/pats/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/admin/(.*)$",
       "target": "/admin/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/author/(.*)$",
       "target": "/author/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
@@ -331,7 +331,7 @@
       "source": "^/graphql(\\?.*)?$",
       "target": "/graphql",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/graph/(neighborhood(?:Full)?|Concepts|ConceptEdges|TutorialConceptLinks|pathBetween|conceptsForUser|explore-data|clusters-data|path|searchKG|PublishedConcepts)(\\(.*\\))?(/.*)?(\\?.*)?$",
@@ -343,21 +343,21 @@
       "source": "^/graph/(.*)$",
       "target": "/graph/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/display/(.*)$",
       "target": "/display/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.DisplayApp"
     },
     {
       "source": "^/api/v1/(.*)$",
       "target": "/api/v1/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.ConsolidationScope"
     },
     {
@@ -370,7 +370,7 @@
       "source": "^/chat/(.*)$",
       "target": "/chat/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/api/advocates(/.*)?$",
@@ -406,7 +406,7 @@
       "source": "^/puzzle-api/(.*)$",
       "target": "/puzzle-api/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/petoberfest-api/photo/(.*)$",
@@ -430,25 +430,25 @@
       "source": "^/petoberfest-api/(.*)/upload$",
       "target": "/petoberfest-api/$1/upload",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/petoberfest-api/(.*)$",
       "target": "/petoberfest-api/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/channel-submissions/(.*)$",
       "target": "/channel-submissions/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/api/media-diet/my-picks(\\?.*)?$",
       "target": "/api/media-diet/my-picks$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/api/media-diet/export(\\?.*)?$",
@@ -460,7 +460,7 @@
       "source": "^/api/(.*)$",
       "target": "/api/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/search/(.*)$",
@@ -496,7 +496,7 @@
       "source": "^/homepage/personalized$",
       "target": "/homepage/personalized",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/homepage/(.*)$",
@@ -544,7 +544,7 @@
       "source": "^/ktt/(.*)$",
       "target": "/ktt/$1",
       "destination": "srv-api",
-      "authenticationType": "ias"
+      "authenticationType": "xsuaa"
     },
     {
       "source": "^/content/(.*)$",
@@ -577,7 +577,7 @@
       "source": "^/mcp-admin/(.*)$",
       "target": "/mcp-admin/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "csrfProtection": false,
       "scope": "$XSAPPNAME.Tutorial.MCP"
     },
@@ -585,7 +585,7 @@
       "source": "^/a2a/?$",
       "target": "/a2a",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "csrfProtection": false,
       "scope": "$XSAPPNAME.Tutorial.MCP"
     },
@@ -593,49 +593,49 @@
       "source": "^/tutorial-navigator-qa/?(\\?.*)?$",
       "target": "/content/pages/tutorial-navigator/$1",
       "destination": "srv-qa-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/_nav\\.json$",
       "target": "/content/nav",
       "destination": "srv-qa-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/qa-search/(.*)$",
       "target": "/search/$1",
       "destination": "srv-qa-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/search/?(.*)$",
       "target": "/qa/search/$1",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/?$",
       "target": "/qa/index.html",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/((?:css|js|img|fonts|vendor)/.*)$",
       "target": "/$1",
       "localDir": "static",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
       "source": "^/tutorials-qa/(.*)$",
       "target": "/content/tutorials/$1",
       "destination": "srv-qa-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Tutorial.Author"
     },
     {
@@ -672,14 +672,14 @@
       "source": "^/_dev/?(.*)$",
       "target": "/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {
       "source": "^/(\\$api-docs/.*)$",
       "target": "/$1",
       "destination": "srv-api",
-      "authenticationType": "ias",
+      "authenticationType": "xsuaa",
       "scope": "$XSAPPNAME.Admin"
     },
     {

From 5d96a6cbeee85dfa4fd473b3661141b5073a11ef Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 09:16:15 -0400
Subject: [PATCH 36/46] chore(auth): add developers-qa.sap.com + prod hosts to
 IAS instance params (#2610)

The prod approuter serves 3 routes: the CF route (covered by the *.cfapps
wildcard), developers.sap.com, and developers-qa.sap.com. Add the -qa host to
redirect-uris + post-logout-redirect-uris so the IAS instance covers every prod
route. The PROD tutorials-approuter-identity instance was pre-created from this
config so it is in place before the prod deploy.
---
 scripts/ias/approuter-identity-params.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/scripts/ias/approuter-identity-params.json b/scripts/ias/approuter-identity-params.json
index e1b0a8bf8..048fe3136 100644
--- a/scripts/ias/approuter-identity-params.json
+++ b/scripts/ias/approuter-identity-params.json
@@ -2,11 +2,13 @@
   "oauth2-configuration": {
     "redirect-uris": [
       "https://*.cfapps.eu10-005.hana.ondemand.com/login/callback?authType=ias",
-      "https://developers.sap.com/login/callback?authType=ias"
+      "https://developers.sap.com/login/callback?authType=ias",
+      "https://developers-qa.sap.com/login/callback?authType=ias"
     ],
     "post-logout-redirect-uris": [
       "https://*.cfapps.eu10-005.hana.ondemand.com/**",
-      "https://developers.sap.com/**"
+      "https://developers.sap.com/**",
+      "https://developers-qa.sap.com/**"
     ]
   },
   "xsuaa-cross-consumption": true

From 5c86cff722265b23f26877c93b81938082dda028 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 10:22:50 -0400
Subject: [PATCH 37/46] feat(header): make "Manage my Account" link IdP-aware
 (#2615)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The user-menu "Manage my Account" link was hardcoded to account.sap.com
regardless of which IdP the user logged in with. With the two-IdP /signin
chooser (sap_idp=sap.default | sap.custom) now in the flow, point the link
at the right place per IdP.

- srv/server.js: /auth/user now returns `identityProvider`, resolved by
  resolveIdentityProvider(user). Primary source is the XSUAA SAML `origin`
  attribute (user.attr.origin); falls back to classifying the token issuer
  host (*.accounts.ondemand.com -> sap.custom) for IAS-issued tokens that
  may omit `origin`. Returns null when undeterminable.
- hugo/layouts/partials/header.html: the link gets an id; on authenticated
  render the href is set from identityProvider — sap.custom -> the IAS
  tenant profile page, sap.default/null -> account.sap.com (safe default,
  prior behavior). Threaded through the sessionStorage user cache too.
- .cdsrc.json: idpcustom/idpdefault mock users (attr.origin) for tests.
- test/unit/auth-user-endpoint.test.js: cover sap.custom, sap.default, null.

Default-safe: an undeterminable IdP falls back to account.sap.com, so the
link is never worse than the previous hardcode.
---
 .cdsrc.json                          |  8 +++++++
 hugo/layouts/partials/header.html    | 14 ++++++++++--
 srv/server.js                        | 34 +++++++++++++++++++++++++++-
 test/unit/auth-user-endpoint.test.js | 31 +++++++++++++++++++++++++
 4 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/.cdsrc.json b/.cdsrc.json
index fbe934751..f85aeadcd 100644
--- a/.cdsrc.json
+++ b/.cdsrc.json
@@ -62,6 +62,14 @@
         "author": {
           "roles": ["Tutorial.Author", "authenticated-user"]
         },
+        "idpcustom": {
+          "roles": ["authenticated-user"],
+          "attr": { "origin": "sap.custom" }
+        },
+        "idpdefault": {
+          "roles": ["authenticated-user"],
+          "attr": { "origin": "sap.default" }
+        },
         "apiuser": {
           "password": "apikey",
           "roles": ["Tutorial.API", "authenticated-user"]
diff --git a/hugo/layouts/partials/header.html b/hugo/layouts/partials/header.html
index f9839711b..8cb961c0a 100644
--- a/hugo/layouts/partials/header.html
+++ b/hugo/layouts/partials/header.html
@@ -100,7 +100,7 @@
       <div id="user-email" class="user-popover__email"></div>
     </div>
     <hr class="user-popover__separator">
-    <a href="https://account.sap.com" class="user-popover__link" target="_blank" rel="noopener">Manage my Account</a>
+    <a id="manage-account-link" href="https://account.sap.com" class="user-popover__link" target="_blank" rel="noopener">Manage my Account</a>
     <a href="https://www.youtube.com/@sapdevs" class="user-popover__link" target="_blank" rel="noopener">SAP Devs YouTube &#x2197;</a>
     <a href="https://learning.sap.com" class="user-popover__link" target="_blank" rel="noopener">Learnings &#x2197;</a>
     <a href="https://community.sap.com" class="user-popover__link" target="_blank" rel="noopener">Community &#x2197;</a>
@@ -126,6 +126,7 @@
   const shareCopyBtn = document.getElementById('share-copy-btn');
   const logoutBtn = document.getElementById('logout-btn');
   const khorosLink = document.getElementById('khoros-community-link');
+  const manageAccountLink = document.getElementById('manage-account-link');
   const themeItem = document.getElementById('sb-theme');
   let isAuthenticated = false;
 
@@ -436,6 +437,15 @@
         khorosLink.setAttribute('hidden', '');
       }
     }
+    // Issue #2615: point "Manage my Account" at the IdP the user actually
+    // logged in with. sap.custom (the IAS tenant) → the IAS profile page;
+    // sap.default and anything else (incl. missing) → the SAP account page,
+    // which is the safe default and the pre-existing behavior.
+    if (manageAccountLink) {
+      manageAccountLink.href = u.identityProvider === 'sap.custom'
+        ? 'https://atxgsg7zi.accounts.ondemand.com/ui/protected/profilemanagement'
+        : 'https://account.sap.com';
+    }
     // Issue #548: signal alerts island (and any other auth-gated UI) that
     // authentication has resolved. Fires from applyAuthenticatedUser so the
     // authenticated path dispatches with detail.authenticated = true. The
@@ -496,7 +506,7 @@
         if (cached) applyAuthenticatedUser(cached);
         return;
       }
-      const toCache = { firstName: user.givenName, givenName: user.givenName, familyName: user.familyName, email: user.email, id: user.id, isAdmin: user.isAdmin === true, khorosId: user.khorosId ?? null, khorosLogin: user.khorosLogin ?? null, khorosAvatarUrl: user.khorosAvatarUrl ?? null };
+      const toCache = { firstName: user.givenName, givenName: user.givenName, familyName: user.familyName, email: user.email, id: user.id, isAdmin: user.isAdmin === true, identityProvider: user.identityProvider ?? null, khorosId: user.khorosId ?? null, khorosLogin: user.khorosLogin ?? null, khorosAvatarUrl: user.khorosAvatarUrl ?? null };
       try { sessionStorage.setItem(USER_KEY, JSON.stringify({ ts: Date.now(), value: toCache })); } catch {}
       applyAuthenticatedUser(user);
       // Live auth success: supersedes any prior intentional logout — re-enable
diff --git a/srv/server.js b/srv/server.js
index 30cfbb7f9..6cf626a8e 100644
--- a/srv/server.js
+++ b/srv/server.js
@@ -95,7 +95,7 @@ import { defaultLoadChallengeAnswer } from './lib/challenge-grade-question-loade
 import { scheduleRebuild, checkFeatureFlag as checkRebuildTriggerFeatureFlag } from './lib/rebuild-trigger.js';
 import { classifyRebuildMode, resolveSlugForEntity, resolveSlugsForTagRename, TAG_REVERSE_LOOKUP_CAP } from './lib/_classify-rebuild-mode.js';
 import { handleUIEvent, checkFeatureFlag as checkUIEventFeatureFlag } from './lib/ui-event-handler.js';
-import { provisionDbUser, resolveDbUser, resolveUserSapId, emailFromUser, pinResolvedUser } from './lib/resolve-db-user.js';
+import { provisionDbUser, resolveDbUser, resolveUserSapId, emailFromUser, pinResolvedUser, issuerSubjectFromUser } from './lib/resolve-db-user.js';
 import { registerMigrationModeHandler } from './lib/migration-mode.js';
 import { decodeBase64Upload } from './lib/decode-base64-upload.js';
 import { uploadAndUpsertAdvocatePhoto } from './lib/advocate-photo-upsert.js';
@@ -1932,6 +1932,29 @@ cds.on('served', async () => {
     }
   }
 
+  // #2615: classify which IdP the current user authenticated with, so the
+  // client can target "Manage my Account" correctly. Two IdPs are reachable via
+  // the /signin chooser: sap.default (SAP Universal ID / SAP ID Service →
+  // account.sap.com) and sap.custom (the IAS tenant). Primary source is the
+  // XSUAA SAML `origin` attribute (CAP copies non-standard token claims onto
+  // user.attr); IAS-issued tokens may omit `origin`, so fall back to the token
+  // issuer host — an *.accounts.ondemand.com issuer is the IAS tenant → treat as
+  // sap.custom. Returns null when neither is determinable (client defaults to
+  // the SAP account), so the link is never worse than the prior hardcode.
+  function resolveIdentityProvider(user) {
+    const origin = user?.attr?.origin;
+    if (origin === 'sap.default' || origin === 'sap.custom') return origin;
+    try {
+      const isu = issuerSubjectFromUser(user);
+      if (isu?.issuer) {
+        const host = new URL(isu.issuer).hostname;
+        if (host.endsWith('.accounts.ondemand.com')) return 'sap.custom';
+        if (host.endsWith('.hana.ondemand.com')) return 'sap.default';
+      }
+    } catch { /* malformed issuer URL → fall through to null */ }
+    return typeof origin === 'string' && origin ? origin : null;
+  }
+
   app.get('/auth/user', contextMw, authMw, async (req, res) => {
     // #1268: coarse deploy environment (DEV/PROD/QA/LOCAL) for the admin
     // header. Derived from the CF space name — safe to expose to anonymous
@@ -1989,6 +2012,15 @@ cds.on('served', async () => {
       isAdmin: user.is?.('Admin') === true,
       isAuthor: user.is?.('Tutorial.Author') === true,
       environment,
+      // #2615: expose the originating IdP so the client can point "Manage my
+      // Account" at the right place (SAP Universal ID vs the IAS tenant). The
+      // /signin chooser issues sap_idp=sap.default | sap.custom; XSUAA surfaces
+      // that as the SAML `origin` attribute on user.attr. IAS-issued tokens may
+      // omit `origin`, so fall back to classifying the token issuer: an IAS
+      // issuer host (*.accounts.ondemand.com) → 'sap.custom'. Null when neither
+      // is determinable — the client treats null as the SAP-account default, so
+      // the link is never worse than the previous hardcoded behavior.
+      identityProvider: resolveIdentityProvider(user),
       khorosId,
       khorosLogin,
       khorosAvatarUrl,
diff --git a/test/unit/auth-user-endpoint.test.js b/test/unit/auth-user-endpoint.test.js
index 2481bfcf2..8c9886e16 100644
--- a/test/unit/auth-user-endpoint.test.js
+++ b/test/unit/auth-user-endpoint.test.js
@@ -59,4 +59,35 @@ describe('/auth/user', () => {
     expect(body.authenticated).toBe(false);
     expect(body.environment).toMatchObject({ id: 'local', label: 'LOCAL' });
   });
+
+  // Issue #2615 — expose the originating IdP so the client can target "Manage
+  // my Account" (sap.default → account.sap.com, sap.custom → the IAS tenant).
+  it('reflects attr.origin=sap.custom as identityProvider', async () => {
+    const credentials = Buffer.from('idpcustom:').toString('base64');
+    const res = await fetch(`${baseUrl}/auth/user`, {
+      headers: { Authorization: `Basic ${credentials}` }
+    });
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.identityProvider).toBe('sap.custom');
+  });
+
+  it('reflects attr.origin=sap.default as identityProvider', async () => {
+    const credentials = Buffer.from('idpdefault:').toString('base64');
+    const res = await fetch(`${baseUrl}/auth/user`, {
+      headers: { Authorization: `Basic ${credentials}` }
+    });
+    const body = await res.json();
+    expect(body.identityProvider).toBe('sap.default');
+  });
+
+  it('includes identityProvider:null when the caller carries no origin/issuer', async () => {
+    const credentials = Buffer.from('author:').toString('base64');
+    const res = await fetch(`${baseUrl}/auth/user`, {
+      headers: { Authorization: `Basic ${credentials}` }
+    });
+    const body = await res.json();
+    expect(body).toHaveProperty('identityProvider');
+    expect(body.identityProvider).toBeNull();
+  });
 });

From 75778103a5b7c54be258feba8f268cc2fa41b687 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 11:53:49 -0400
Subject: [PATCH 38/46] feat(auth): GitHub-OIDC shim for IAS federation (Phase
 1, flag-gated)

Add a minimal OpenID Connect IdP that wraps GitHub's OAuth2 so SAP IAS can
federate GitHub as a corporate OIDC IdP (GitHub is OAuth2-only: no discovery,
no id_token, no JWKS, so it cannot be registered in IAS directly). This bridges
GitHub into a real XSUAA/IAS session rather than a parallel app session.

- approuter/lib/github-oidc-shim.js: discovery, authorize, callback, token, jwks
  endpoints under /github-oidc/. Stateless authorize->token correlation sealed
  into an encrypted short-TTL JWT (A256GCM); PKCE S256 enforced; RS256 id_token
  carries sub=GitHub numeric id, preferred_username=login, email/name/nonce.
- approuter/lib/github-oidc-keys.js: loads the RS256 signing key from credstore
  (GITHUB_OIDC_SIGNING_KEY) and derives the public JWK for the jwks endpoint.
- Registered in approuter/server.js insertMiddleware.first (before static/proxy),
  gated by GITHUB_OIDC_ENABLED (read at call time) -> inert no-op until enabled.
- test/unit/github-oidc-shim.test.js: 15 tests (discovery, JWKS<->id_token verify,
  PKCE accept/reject, sealed-state round-trip + tamper/wrong-secret, authorize
  redirect, callback error paths, flag no-op).

Phase 1 of the plan; CAP-side claim handling + IAS registration follow.
Secrets via credstore (no envsubst), per Tom's standing preference.
---
 approuter/lib/github-oidc-keys.js  |  94 +++++++
 approuter/lib/github-oidc-shim.js  | 417 +++++++++++++++++++++++++++++
 approuter/server.js                |   2 +
 test/unit/github-oidc-shim.test.js | 235 ++++++++++++++++
 4 files changed, 748 insertions(+)
 create mode 100644 approuter/lib/github-oidc-keys.js
 create mode 100644 approuter/lib/github-oidc-shim.js
 create mode 100644 test/unit/github-oidc-shim.test.js

diff --git a/approuter/lib/github-oidc-keys.js b/approuter/lib/github-oidc-keys.js
new file mode 100644
index 000000000..8a3b3c97d
--- /dev/null
+++ b/approuter/lib/github-oidc-keys.js
@@ -0,0 +1,94 @@
+// approuter/lib/github-oidc-keys.js
+//
+// RSA keypair management for the GitHub-OIDC shim (the custom OpenID Connect
+// IdP that wraps GitHub so SAP IAS can federate it — see github-oidc-shim.js).
+//
+// The shim mints RS256 `id_token`s that IAS verifies against the shim's JWKS.
+// The signing key is a credstore secret (alias GITHUB_OIDC_SIGNING_KEY), an
+// RSA private key in PKCS#8 PEM. We derive the public JWK from it on demand for
+// the /github-oidc/jwks endpoint so there is a single source of truth (the
+// private key) and no second secret to rotate in lockstep.
+//
+// CJS to match the rest of approuter/ (server.js, well-known-oauth.js,
+// credstore-secret.js). `jose` is already an approuter dependency (used by
+// credstore-secret.js for JWE decrypt).
+//
+// Related:
+//   [[feedback_credstore_only_no_envsubst_for_new_secrets]]
+//   approuter/lib/credstore-secret.js — the resolveSecret() this builds on
+
+'use strict'
+
+const { importPKCS8, exportJWK, calculateJwkThumbprint } = require('jose')
+const { resolveSecret } = require('./credstore-secret')
+
+const SIGNING_KEY_ALIAS = 'GITHUB_OIDC_SIGNING_KEY'
+const ALG = 'RS256'
+
+// Module-singleton cache (same globalThis-Symbol defense as credstore-secret.js:
+// vitest workers in one process could otherwise hold divergent key material).
+const STATE_KEY = Symbol.for('com.sap.developers.ims:github-oidc-keys')
+const _state = (globalThis[STATE_KEY] ??= {
+  // { privateKey: KeyLike, publicJwk: object, kid: string } | null
+  material: null,
+})
+
+function _resetForTests() {
+  _state.material = null
+}
+
+// Normalize a stored key into PEM. Credstore round-trips values as plain
+// strings; a key pasted without the armor (or with escaped newlines) still
+// needs to parse. Mirrors credstore-secret.js ensurePem().
+function ensurePem(raw) {
+  if (typeof raw !== 'string') return raw
+  const s = raw.includes('\\n') ? raw.replace(/\\n/g, '\n') : raw
+  if (s.includes('-----BEGIN ')) return s
+  const wrapped = s.match(/.{1,64}/g).join('\n')
+  return `-----BEGIN PRIVATE KEY-----\n${wrapped}\n-----END PRIVATE KEY-----`
+}
+
+// Load (once) the shim signing key from credstore and derive its public JWK +
+// stable `kid` (RFC 7638 JWK thumbprint). Throws if the secret is absent —
+// callers (the shim endpoints) translate that into a 503, never a crash.
+async function getSigningMaterial() {
+  if (_state.material) return _state.material
+
+  const pem = await resolveSecret(SIGNING_KEY_ALIAS, { logTag: '[github-oidc]' })
+  if (!pem) {
+    throw new Error(`${SIGNING_KEY_ALIAS} not configured (credstore + env both empty)`)
+  }
+
+  // extractable: true is required so exportJWK can derive the public JWK for
+  // the /github-oidc/jwks endpoint. The private key never leaves this process
+  // (loaded from credstore); only the public members are ever exported.
+  const privateKey = await importPKCS8(ensurePem(pem), ALG, { extractable: true })
+  // exportJWK on a private key yields the private JWK; strip to the public
+  // members only for the JWKS document.
+  const fullJwk = await exportJWK(privateKey)
+  const publicJwk = { kty: fullJwk.kty, n: fullJwk.n, e: fullJwk.e }
+  const kid = await calculateJwkThumbprint(publicJwk)
+
+  _state.material = {
+    privateKey,
+    kid,
+    publicJwk: { ...publicJwk, kid, use: 'sig', alg: ALG },
+  }
+  return _state.material
+}
+
+// The JWKS document body served at /github-oidc/jwks.
+async function getJwks() {
+  const { publicJwk } = await getSigningMaterial()
+  return { keys: [publicJwk] }
+}
+
+module.exports = {
+  getSigningMaterial,
+  getJwks,
+  SIGNING_KEY_ALIAS,
+  ALG,
+  // exported for unit tests
+  ensurePem,
+  _resetForTests,
+}
diff --git a/approuter/lib/github-oidc-shim.js b/approuter/lib/github-oidc-shim.js
new file mode 100644
index 000000000..c7ac933ac
--- /dev/null
+++ b/approuter/lib/github-oidc-shim.js
@@ -0,0 +1,417 @@
+// approuter/lib/github-oidc-shim.js
+//
+// A minimal OpenID Connect IdP that wraps GitHub's OAuth 2.0 so SAP IAS can
+// federate GitHub as a "Corporate Identity Provider → OpenID Connect Compliant"
+// (the same mechanism LinkedIn / Hugging Face use). GitHub itself is OAuth2-only
+// (no discovery doc, no id_token, no JWKS) and therefore cannot be registered in
+// IAS directly; this shim supplies the missing OIDC surface and bridges GitHub
+// into a REAL XSUAA/IAS session. See the plan + design notes in the PR.
+//
+// Flow (one browser login):
+//   IAS /authorize  → shim /github-oidc/authorize   (validate IAS req, 302 → GitHub)
+//   GitHub          → shim /github-oidc/callback     (exchange code, fetch profile,
+//                                                      302 → IAS redirect_uri w/ our code)
+//   IAS (back-chan) → shim /github-oidc/token        (verify PKCE, mint RS256 id_token)
+//   IAS             → shim /github-oidc/jwks         (verify the id_token signature)
+//
+// Statelessness: the approuter runs multiple instances, so the authorize→token
+// correlation (GitHub profile, nonce, PKCE challenge, original IAS redirect) is
+// NOT held in memory. It is sealed into an encrypted+authenticated short-TTL JWT
+// (A256GCM via GITHUB_OIDC_STATE_SECRET) that travels as the opaque `code`. The
+// GitHub access token is used transiently inside /callback and never persisted.
+//
+// Mounts in the approuter's insertMiddleware.first chain (server.js), BEFORE the
+// static/proxy handlers, like well-known-oauth.js — short-circuits its own paths
+// (writeHead/end, no next()) and runs before XSUAA (the unauthenticated seam IAS
+// needs for the back-channel token/jwks calls).
+//
+// Feature flag: GITHUB_OIDC_ENABLED (read at CALL time, not module load, so it
+// tracks runtime config and is unit-testable). Off ⇒ immediate next(), zero
+// behavior change — the default state until the IAS registration lands.
+//
+// CJS to match approuter/. `jose` + `undici` are already approuter deps.
+
+'use strict'
+
+const crypto = require('node:crypto')
+const { SignJWT, EncryptJWT, jwtDecrypt } = require('jose')
+const { resolveSecret } = require('./credstore-secret')
+const { getSigningMaterial, getJwks, ALG } = require('./github-oidc-keys')
+
+const BASE = '/github-oidc'
+const DISCOVERY_PATH = `${BASE}/.well-known/openid-configuration`
+const AUTHORIZE_PATH = `${BASE}/authorize`
+const CALLBACK_PATH = `${BASE}/callback`
+const TOKEN_PATH = `${BASE}/token`
+const JWKS_PATH = `${BASE}/jwks`
+const USERINFO_PATH = `${BASE}/userinfo`
+
+const GITHUB_AUTHORIZE = 'https://github.com/login/oauth/authorize'
+const GITHUB_TOKEN = 'https://github.com/login/oauth/access_token'
+const GITHUB_API = 'https://api.github.com'
+const GITHUB_SCOPES = 'read:user user:email'
+
+// The logical issuer we stamp into UserIdentities on the CAP side keys GitHub
+// logins on (issuer='https://github.com', subject=<github numeric id>). The
+// shim's OWN OIDC issuer (the `iss` of the id_token IAS verifies) is the shim
+// base URL, derived per-request — not this constant.
+const CODE_TTL_S = 300 // 5 min: authorize→token window
+const ID_TOKEN_TTL_S = 300
+
+const STATE_SECRET_ALIAS = 'GITHUB_OIDC_STATE_SECRET'
+const CLIENT_ID_ALIAS = 'GITHUB_CLIENT_ID'
+const CLIENT_SECRET_ALIAS = 'GITHUB_CLIENT_SECRET'
+// The client_id/secret IAS uses to call our /token back-channel (IAS is OUR
+// OAuth client). Separate from the GitHub app credentials above.
+const IAS_CLIENT_ID_ALIAS = 'GITHUB_OIDC_IAS_CLIENT_ID'
+const IAS_CLIENT_SECRET_ALIAS = 'GITHUB_OIDC_IAS_CLIENT_SECRET'
+
+// Read at call time so runtime config / tests take effect without reload.
+function isEnabled() {
+  return String(process.env.GITHUB_OIDC_ENABLED || '').toLowerCase() === 'true'
+}
+
+// Externally-visible base URL of this approuter, from the inbound request —
+// honors CF's x-forwarded-proto/host. Same derivation as well-known-oauth.js.
+function resolveBaseUrl(req) {
+  const proto = (req.headers['x-forwarded-proto'] || 'https').split(',')[0].trim()
+  const host = (req.headers['x-forwarded-host'] || req.headers.host || '').split(',')[0].trim()
+  if (!host) return null
+  return `${proto}://${host}`
+}
+
+function sendJson(res, status, body) {
+  res.writeHead(status, { 'Content-Type': 'application/json', 'Cache-Control': 'no-store' })
+  res.end(JSON.stringify(body))
+}
+
+function redirect(res, location) {
+  res.writeHead(302, { Location: location, 'Cache-Control': 'no-store' })
+  res.end()
+}
+
+// Append query params to a URL (preserves any already present).
+function withQuery(url, params) {
+  const u = new URL(url)
+  for (const [k, v] of Object.entries(params)) {
+    if (v !== undefined && v !== null) u.searchParams.set(k, String(v))
+  }
+  return u.toString()
+}
+
+// Build an error redirect back to IAS per OAuth 2.0 §4.1.2.1.
+function errorRedirect(res, redirectUri, state, error, description) {
+  if (!redirectUri) return sendJson(res, 400, { error, error_description: description })
+  return redirect(res, withQuery(redirectUri, { error, error_description: description, state }))
+}
+
+// ── stateless code/state sealing ─────────────────────────────────────────────
+// The 32-byte A256GCM key is derived from the configured secret via SHA-256 so
+// an operator can supply any sufficiently-random string as the alias value.
+async function stateKey() {
+  const secret = await resolveSecret(STATE_SECRET_ALIAS, { logTag: '[github-oidc]' })
+  if (!secret) throw new Error(`${STATE_SECRET_ALIAS} not configured`)
+  return crypto.createHash('sha256').update(secret).digest()
+}
+
+// Seal the IAS authorize context (used as the `state` we hand GitHub, so it
+// survives the GitHub round-trip without server-side storage).
+async function sealState(payload) {
+  const key = await stateKey()
+  return await new EncryptJWT(payload)
+    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
+    .setIssuedAt()
+    .setExpirationTime(`${CODE_TTL_S}s`)
+    .encrypt(key)
+}
+
+async function openState(token) {
+  const key = await stateKey()
+  const { payload } = await jwtDecrypt(token, key) // throws on tamper/expiry
+  return payload
+}
+
+// ── GitHub calls ─────────────────────────────────────────────────────────────
+async function exchangeGithubCode(code, clientId, clientSecret, redirectUri) {
+  const res = await fetch(GITHUB_TOKEN, {
+    method: 'POST',
+    headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+    body: JSON.stringify({ client_id: clientId, client_secret: clientSecret, code, redirect_uri: redirectUri }),
+    signal: AbortSignal.timeout(15_000),
+  })
+  if (!res.ok) throw new Error(`github token exchange: ${res.status}`)
+  const json = await res.json()
+  if (json.error || !json.access_token) throw new Error(`github token exchange: ${json.error || 'no access_token'}`)
+  return json.access_token
+}
+
+async function fetchGithubProfile(accessToken) {
+  const headers = {
+    Authorization: `Bearer ${accessToken}`,
+    Accept: 'application/vnd.github+json',
+    'X-GitHub-Api-Version': '2022-11-28',
+    'User-Agent': 'tutorials-github-oidc-shim',
+  }
+  const userRes = await fetch(`${GITHUB_API}/user`, { headers, signal: AbortSignal.timeout(15_000) })
+  if (!userRes.ok) throw new Error(`github /user: ${userRes.status}`)
+  const user = await userRes.json()
+
+  // Email: /user.email is often null (privacy). Pull the verified primary from
+  // /user/emails. NEVER key identity on email downstream (noreply synthetics) —
+  // the subject is the numeric id; email is advisory.
+  let email = null
+  let emailVerified = false
+  try {
+    const emailsRes = await fetch(`${GITHUB_API}/user/emails`, { headers, signal: AbortSignal.timeout(15_000) })
+    if (emailsRes.ok) {
+      const emails = await emailsRes.json()
+      const primary = Array.isArray(emails) ? emails.find(e => e.primary && e.verified) : null
+      if (primary) { email = primary.email; emailVerified = true }
+    }
+  } catch { /* email is best-effort */ }
+
+  return {
+    id: String(user.id), // GitHub numeric user id — the stable OIDC subject
+    login: user.login, // handle → Users.githubLogin
+    name: user.name || user.login || null,
+    email,
+    emailVerified,
+  }
+}
+
+// ── OIDC documents ───────────────────────────────────────────────────────────
+function discoveryDocument(baseUrl) {
+  return {
+    issuer: baseUrl,
+    authorization_endpoint: `${baseUrl}${AUTHORIZE_PATH}`,
+    token_endpoint: `${baseUrl}${TOKEN_PATH}`,
+    userinfo_endpoint: `${baseUrl}${USERINFO_PATH}`,
+    jwks_uri: `${baseUrl}${JWKS_PATH}`,
+    response_types_supported: ['code'],
+    grant_types_supported: ['authorization_code'],
+    subject_types_supported: ['public'],
+    id_token_signing_alg_values_supported: [ALG],
+    scopes_supported: ['openid', 'profile', 'email'],
+    token_endpoint_auth_methods_supported: ['client_secret_post', 'client_secret_basic'],
+    code_challenge_methods_supported: ['S256'],
+    claims_supported: ['sub', 'iss', 'aud', 'exp', 'iat', 'nonce', 'preferred_username', 'email', 'email_verified', 'name'],
+  }
+}
+
+// RFC 7636 S256 verification: base64url(sha256(verifier)) === challenge.
+function verifyPkce(verifier, challenge) {
+  if (!verifier || !challenge) return false
+  const hash = crypto.createHash('sha256').update(verifier).digest('base64url')
+  return crypto.timingSafeEqual(Buffer.from(hash), Buffer.from(challenge))
+}
+
+async function mintIdToken(baseUrl, aud, profile, nonce) {
+  const { privateKey, kid } = await getSigningMaterial()
+  return await new SignJWT({
+    preferred_username: profile.login,
+    email: profile.email ?? undefined,
+    email_verified: profile.email ? profile.emailVerified : undefined,
+    name: profile.name ?? undefined,
+    nonce: nonce ?? undefined,
+  })
+    .setProtectedHeader({ alg: ALG, kid })
+    .setIssuer(baseUrl)
+    .setSubject(profile.id)
+    .setAudience(aud)
+    .setIssuedAt()
+    .setExpirationTime(`${ID_TOKEN_TTL_S}s`)
+    .sign(privateKey)
+}
+
+// ── endpoint handlers ────────────────────────────────────────────────────────
+async function handleAuthorize(req, res, baseUrl) {
+  const url = new URL(req.url, baseUrl)
+  const q = url.searchParams
+  const redirectUri = q.get('redirect_uri')
+  const state = q.get('state')
+  // Validate the IAS request. We only support code + S256 PKCE.
+  if (q.get('response_type') !== 'code') {
+    return errorRedirect(res, redirectUri, state, 'unsupported_response_type', 'only code is supported')
+  }
+  const iasClientId = await resolveSecret(IAS_CLIENT_ID_ALIAS, { logTag: '[github-oidc]' })
+  if (iasClientId && q.get('client_id') !== iasClientId) {
+    return errorRedirect(res, redirectUri, state, 'unauthorized_client', 'unknown client_id')
+  }
+  if (!redirectUri) return sendJson(res, 400, { error: 'invalid_request', error_description: 'redirect_uri required' })
+
+  const githubClientId = await resolveSecret(CLIENT_ID_ALIAS, { logTag: '[github-oidc]' })
+  if (!githubClientId) return sendJson(res, 503, { error: 'server_error', error_description: 'github client not configured' })
+
+  // Seal the IAS context so /callback can continue statelessly.
+  const sealed = await sealState({
+    ias_redirect_uri: redirectUri,
+    ias_state: state ?? null,
+    ias_nonce: q.get('nonce') ?? null,
+    ias_code_challenge: q.get('code_challenge') ?? null,
+    ias_code_challenge_method: q.get('code_challenge_method') ?? null,
+    aud: q.get('client_id') ?? null,
+  })
+
+  // Hand `sealed` to GitHub as its `state`; GitHub returns it to /callback.
+  return redirect(res, withQuery(GITHUB_AUTHORIZE, {
+    client_id: githubClientId,
+    redirect_uri: `${baseUrl}${CALLBACK_PATH}`,
+    scope: GITHUB_SCOPES,
+    state: sealed,
+    allow_signup: 'true',
+  }))
+}
+
+async function handleCallback(req, res, baseUrl) {
+  const url = new URL(req.url, baseUrl)
+  const q = url.searchParams
+  const sealed = q.get('state')
+  const ghError = q.get('error')
+
+  let ctx
+  try { ctx = await openState(sealed) } catch {
+    return sendJson(res, 400, { error: 'invalid_request', error_description: 'invalid or expired state' })
+  }
+  if (ghError) {
+    return errorRedirect(res, ctx.ias_redirect_uri, ctx.ias_state, 'access_denied', q.get('error_description') || ghError)
+  }
+  const ghCode = q.get('code')
+  if (!ghCode) return errorRedirect(res, ctx.ias_redirect_uri, ctx.ias_state, 'invalid_request', 'missing code')
+
+  const githubClientId = await resolveSecret(CLIENT_ID_ALIAS, { logTag: '[github-oidc]' })
+  const githubClientSecret = await resolveSecret(CLIENT_SECRET_ALIAS, { logTag: '[github-oidc]' })
+  if (!githubClientId || !githubClientSecret) {
+    return errorRedirect(res, ctx.ias_redirect_uri, ctx.ias_state, 'server_error', 'github client not configured')
+  }
+
+  let profile
+  try {
+    const accessToken = await exchangeGithubCode(ghCode, githubClientId, githubClientSecret, `${baseUrl}${CALLBACK_PATH}`)
+    profile = await fetchGithubProfile(accessToken)
+  } catch (err) {
+    return errorRedirect(res, ctx.ias_redirect_uri, ctx.ias_state, 'server_error', String(err.message || err))
+  }
+
+  // Re-seal with the fetched profile; this becomes the authorization `code` IAS
+  // presents to /token. PKCE challenge travels along for verification there.
+  const code = await sealState({
+    profile,
+    ias_nonce: ctx.ias_nonce,
+    ias_code_challenge: ctx.ias_code_challenge,
+    aud: ctx.aud,
+    purpose: 'code',
+  })
+
+  return redirect(res, withQuery(ctx.ias_redirect_uri, { code, state: ctx.ias_state }))
+}
+
+async function readBody(req) {
+  const chunks = []
+  for await (const c of req) chunks.push(c)
+  return Buffer.concat(chunks).toString('utf8')
+}
+
+function parseTokenParams(req, rawBody) {
+  const ct = (req.headers['content-type'] || '').split(';')[0].trim()
+  if (ct === 'application/x-www-form-urlencoded') return Object.fromEntries(new URLSearchParams(rawBody))
+  if (ct === 'application/json') { try { return JSON.parse(rawBody) } catch { return {} } }
+  return Object.fromEntries(new URLSearchParams(rawBody))
+}
+
+async function handleToken(req, res, baseUrl) {
+  const rawBody = await readBody(req)
+  const params = parseTokenParams(req, rawBody)
+
+  if (params.grant_type !== 'authorization_code') {
+    return sendJson(res, 400, { error: 'unsupported_grant_type' })
+  }
+
+  // Authenticate IAS as our client (secret in body or Basic header).
+  const expectSecret = await resolveSecret(IAS_CLIENT_SECRET_ALIAS, { logTag: '[github-oidc]' })
+  if (expectSecret) {
+    let presented = params.client_secret
+    const authz = req.headers.authorization || ''
+    if (!presented && authz.startsWith('Basic ')) {
+      const decoded = Buffer.from(authz.slice(6), 'base64').toString('utf8')
+      presented = decoded.slice(decoded.indexOf(':') + 1)
+    }
+    if (!presented || presented.length !== expectSecret.length ||
+        !crypto.timingSafeEqual(Buffer.from(presented), Buffer.from(expectSecret))) {
+      return sendJson(res, 401, { error: 'invalid_client' })
+    }
+  }
+
+  let ctx
+  try { ctx = await openState(params.code) } catch {
+    return sendJson(res, 400, { error: 'invalid_grant', error_description: 'invalid or expired code' })
+  }
+  if (ctx.purpose !== 'code' || !ctx.profile) {
+    return sendJson(res, 400, { error: 'invalid_grant' })
+  }
+
+  // Verify PKCE if IAS supplied a challenge at /authorize.
+  if (ctx.ias_code_challenge) {
+    if (!verifyPkce(params.code_verifier, ctx.ias_code_challenge)) {
+      return sendJson(res, 400, { error: 'invalid_grant', error_description: 'PKCE verification failed' })
+    }
+  }
+
+  let idToken
+  try {
+    idToken = await mintIdToken(baseUrl, ctx.aud, ctx.profile, ctx.ias_nonce)
+  } catch (err) {
+    return sendJson(res, 503, { error: 'server_error', error_description: String(err.message || err) })
+  }
+
+  return sendJson(res, 200, {
+    access_token: crypto.randomUUID(), // opaque; userinfo is driven by the id_token
+    token_type: 'Bearer',
+    expires_in: ID_TOKEN_TTL_S,
+    id_token: idToken,
+  })
+}
+
+// ── middleware entrypoint ────────────────────────────────────────────────────
+function gitHubOidcShimHandler(req, res, next) {
+  if (!isEnabled()) return next()
+  const pathOnly = (req.url || '').split('?')[0]
+  if (!pathOnly.startsWith(`${BASE}/`) && pathOnly !== BASE) return next()
+
+  const baseUrl = resolveBaseUrl(req)
+  if (!baseUrl) return sendJson(res, 503, { error: 'server_error', error_description: 'cannot resolve base url' })
+
+  const run = (p) => p.catch((err) => {
+    console.error('[github-oidc] handler error:', err && err.message)
+    if (!res.headersSent) sendJson(res, 500, { error: 'server_error' })
+  })
+
+  if ((req.method === 'GET' || req.method === 'HEAD')) {
+    if (pathOnly === DISCOVERY_PATH) return sendJson(res, 200, discoveryDocument(baseUrl))
+    if (pathOnly === JWKS_PATH) return run(getJwks().then(j => sendJson(res, 200, j)))
+    if (pathOnly === AUTHORIZE_PATH) return run(handleAuthorize(req, res, baseUrl))
+    if (pathOnly === CALLBACK_PATH) return run(handleCallback(req, res, baseUrl))
+    if (pathOnly === USERINFO_PATH) return sendJson(res, 400, { error: 'use_id_token', error_description: 'userinfo not served; claims are in the id_token' })
+  }
+  if (req.method === 'POST' && pathOnly === TOKEN_PATH) return run(handleToken(req, res, baseUrl))
+
+  // A /github-oidc/* path we don't serve — do not leak to the SPA proxy.
+  return sendJson(res, 404, { error: 'not_found' })
+}
+
+module.exports = {
+  gitHubOidcShimHandler,
+  // exported for unit tests
+  resolveBaseUrl,
+  discoveryDocument,
+  verifyPkce,
+  sealState,
+  openState,
+  mintIdToken,
+  isEnabled,
+  BASE,
+  DISCOVERY_PATH,
+  AUTHORIZE_PATH,
+  CALLBACK_PATH,
+  TOKEN_PATH,
+  JWKS_PATH,
+}
diff --git a/approuter/server.js b/approuter/server.js
index a16fb91cf..b186eccd8 100644
--- a/approuter/server.js
+++ b/approuter/server.js
@@ -21,6 +21,7 @@ const { normalizeLegacyCatalogUrl } = require('./lib/catalog-legacy-redirects')
 const { bump, startAutoFlush } = require('./lib/hit-counter')
 const { safeFetch } = require('./lib/safe-fetch')
 const { wellKnownOAuthHandler } = require('./lib/well-known-oauth')
+const { gitHubOidcShimHandler } = require('./lib/github-oidc-shim')
 const { mcpManifestHandler } = require('./lib/well-known-mcp-manifest')
 const { mcpAuthChallengeHandler } = require('./lib/mcp-auth-challenge')
 const { securityTxtHandler } = require('./lib/security-txt')
@@ -595,6 +596,7 @@ ar.start({
       insertMiddleware: {
         first: [
           { path: '/', handler: wellKnownOAuthHandler },
+          { path: '/', handler: gitHubOidcShimHandler },
           { path: '/', handler: mcpManifestHandler },
           { path: '/', handler: securityTxtHandler },
           { path: '/', handler: sitemapIndexRedirectHandler },
diff --git a/test/unit/github-oidc-shim.test.js b/test/unit/github-oidc-shim.test.js
new file mode 100644
index 000000000..50da7ee31
--- /dev/null
+++ b/test/unit/github-oidc-shim.test.js
@@ -0,0 +1,235 @@
+// test/unit/github-oidc-shim.test.js
+//
+// Unit coverage for the GitHub-OIDC shim (approuter/lib/github-oidc-shim.js +
+// github-oidc-keys.js) — the custom OpenID Connect IdP that wraps GitHub so SAP
+// IAS can federate it. Mirrors the well-known-oauth.test.js harness: ESM test
+// loads the CJS middleware via createRequire; a mockRes() captures writeHead/end.
+//
+// GitHub network calls (code exchange, /user, /user/emails) are only hit on the
+// /callback path; those paths are exercised via the pure helpers + fetch stubs.
+// The crypto surface (seal/open state, id_token mint + JWKS verify, PKCE) is
+// tested directly — that is the load-bearing security logic.
+
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+import { createRequire } from 'node:module'
+import crypto from 'node:crypto'
+import { generateKeyPair, exportPKCS8, SignJWT, jwtVerify, createLocalJWKSet } from 'jose'
+
+const require = createRequire(import.meta.url)
+const shim = require('../../approuter/lib/github-oidc-shim.js')
+const keys = require('../../approuter/lib/github-oidc-keys.js')
+const credstore = require('../../approuter/lib/credstore-secret.js')
+
+function mockRes() {
+  return {
+    statusCode: null,
+    headers: null,
+    body: null,
+    headersSent: false,
+    writeHead(status, headers) { this.statusCode = status; this.headers = headers; this.headersSent = true; return this },
+    end(payload) { this.body = payload; return this },
+    json() { return JSON.parse(this.body) },
+  }
+}
+
+function getReq(url) {
+  return { method: 'GET', url, headers: { 'x-forwarded-proto': 'https', 'x-forwarded-host': 'developers.sap.com' } }
+}
+
+const BASE_URL = 'https://developers.sap.com'
+let TEST_PKCS8 // a throwaway RSA private key, PKCS#8 PEM
+
+const SAVED = {}
+function saveEnv(...names) { for (const n of names) SAVED[n] = process.env[n] }
+function restoreEnv() { for (const [n, v] of Object.entries(SAVED)) { if (v === undefined) delete process.env[n]; else process.env[n] = v } }
+
+beforeEach(async () => {
+  saveEnv('GITHUB_OIDC_ENABLED', 'GITHUB_OIDC_SIGNING_KEY', 'GITHUB_OIDC_STATE_SECRET',
+    'GITHUB_CLIENT_ID', 'GITHUB_CLIENT_SECRET', 'GITHUB_OIDC_IAS_CLIENT_ID', 'GITHUB_OIDC_IAS_CLIENT_SECRET')
+  credstore._resetForTests()
+  keys._resetForTests()
+  vi.spyOn(console, 'warn').mockImplementation(() => {})
+  vi.spyOn(console, 'error').mockImplementation(() => {})
+
+  if (!TEST_PKCS8) {
+    const { privateKey } = await generateKeyPair('RS256', { modulusLength: 2048, extractable: true })
+    TEST_PKCS8 = await exportPKCS8(privateKey)
+  }
+  // Secrets come from env fallback (credstore binding absent in unit env).
+  process.env.GITHUB_OIDC_ENABLED = 'true'
+  process.env.GITHUB_OIDC_SIGNING_KEY = TEST_PKCS8
+  process.env.GITHUB_OIDC_STATE_SECRET = 'unit-test-state-secret-value'
+  process.env.GITHUB_CLIENT_ID = 'gh-client-id'
+  process.env.GITHUB_CLIENT_SECRET = 'gh-client-secret'
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+  credstore._resetForTests()
+  keys._resetForTests()
+  restoreEnv()
+})
+
+describe('feature flag', () => {
+  it('is a no-op (calls next) when GITHUB_OIDC_ENABLED is not true', () => {
+    process.env.GITHUB_OIDC_ENABLED = 'false'
+    const res = mockRes()
+    const next = vi.fn()
+    shim.gitHubOidcShimHandler(getReq(shim.DISCOVERY_PATH), res, next)
+    expect(next).toHaveBeenCalledOnce()
+    expect(res.statusCode).toBeNull()
+  })
+
+  it('passes through non-/github-oidc paths to next even when enabled', () => {
+    const res = mockRes()
+    const next = vi.fn()
+    shim.gitHubOidcShimHandler(getReq('/tutorials/foo'), res, next)
+    expect(next).toHaveBeenCalledOnce()
+  })
+})
+
+describe('discovery document', () => {
+  it('serves a valid OIDC discovery doc with RS256 + code + S256', () => {
+    const res = mockRes()
+    shim.gitHubOidcShimHandler(getReq(shim.DISCOVERY_PATH), res, vi.fn())
+    expect(res.statusCode).toBe(200)
+    const doc = res.json()
+    expect(doc.issuer).toBe(BASE_URL)
+    expect(doc.authorization_endpoint).toBe(`${BASE_URL}${shim.AUTHORIZE_PATH}`)
+    expect(doc.token_endpoint).toBe(`${BASE_URL}${shim.TOKEN_PATH}`)
+    expect(doc.jwks_uri).toBe(`${BASE_URL}${shim.JWKS_PATH}`)
+    expect(doc.response_types_supported).toEqual(['code'])
+    expect(doc.id_token_signing_alg_values_supported).toContain('RS256')
+    expect(doc.code_challenge_methods_supported).toEqual(['S256'])
+    expect(doc.scopes_supported).toEqual(['openid', 'profile', 'email'])
+  })
+})
+
+describe('JWKS endpoint', () => {
+  it('serves a public JWK that verifies a shim-minted id_token', async () => {
+    // Mint an id_token via the shim, then verify it against the JWKS the shim serves.
+    const profile = { id: '42', login: 'octocat', name: 'The Octocat', email: 'octo@example.com', emailVerified: true }
+    const idToken = await shim.mintIdToken(BASE_URL, 'ias-client', profile, 'nonce-123')
+
+    const res = mockRes()
+    shim.gitHubOidcShimHandler(getReq(shim.JWKS_PATH), res, vi.fn())
+    await vi.waitFor(() => expect(res.statusCode).toBe(200))
+    const jwks = res.json()
+    expect(jwks.keys).toHaveLength(1)
+    expect(jwks.keys[0].kty).toBe('RSA')
+    expect(jwks.keys[0].kid).toBeTruthy()
+
+    const JWKS = createLocalJWKSet(jwks)
+    const { payload } = await jwtVerify(idToken, JWKS, { issuer: BASE_URL, audience: 'ias-client' })
+    expect(payload.sub).toBe('42')
+    expect(payload.preferred_username).toBe('octocat')
+    expect(payload.email).toBe('octo@example.com')
+    expect(payload.email_verified).toBe(true)
+    expect(payload.nonce).toBe('nonce-123')
+  })
+})
+
+describe('id_token minting', () => {
+  it('omits email/email_verified when GitHub gives no verified email', async () => {
+    const profile = { id: '7', login: 'ghost', name: null, email: null, emailVerified: false }
+    const idToken = await shim.mintIdToken(BASE_URL, 'aud', profile, null)
+    const jwks = await keys.getJwks()
+    const { payload } = await jwtVerify(idToken, createLocalJWKSet(jwks), { issuer: BASE_URL, audience: 'aud' })
+    expect(payload.sub).toBe('7')
+    expect(payload.preferred_username).toBe('ghost')
+    expect(payload.email).toBeUndefined()
+    expect(payload.email_verified).toBeUndefined()
+  })
+})
+
+describe('PKCE S256 verification', () => {
+  it('accepts a matching verifier/challenge pair', () => {
+    const verifier = 'a'.repeat(64)
+    const challenge = crypto.createHash('sha256').update(verifier).digest('base64url')
+    expect(shim.verifyPkce(verifier, challenge)).toBe(true)
+  })
+  it('rejects a mismatched verifier', () => {
+    const challenge = crypto.createHash('sha256').update('a'.repeat(64)).digest('base64url')
+    expect(shim.verifyPkce('b'.repeat(64), challenge)).toBe(false)
+  })
+  it('rejects when either side is missing', () => {
+    expect(shim.verifyPkce('', 'x')).toBe(false)
+    expect(shim.verifyPkce('x', '')).toBe(false)
+  })
+})
+
+describe('stateless code/state sealing', () => {
+  it('round-trips a sealed payload', async () => {
+    const sealed = await shim.sealState({ ias_redirect_uri: 'https://ias/cb', ias_state: 's1', purpose: 'code' })
+    const opened = await shim.openState(sealed)
+    expect(opened.ias_redirect_uri).toBe('https://ias/cb')
+    expect(opened.ias_state).toBe('s1')
+    expect(opened.purpose).toBe('code')
+  })
+  it('rejects a tampered token', async () => {
+    const sealed = await shim.sealState({ foo: 'bar' })
+    const tampered = sealed.slice(0, -4) + (sealed.slice(-4) === 'AAAA' ? 'BBBB' : 'AAAA')
+    await expect(shim.openState(tampered)).rejects.toThrow()
+  })
+  it('rejects a token sealed with a different secret', async () => {
+    const sealed = await shim.sealState({ foo: 'bar' })
+    credstore._resetForTests()
+    process.env.GITHUB_OIDC_STATE_SECRET = 'a-totally-different-secret'
+    await expect(shim.openState(sealed)).rejects.toThrow()
+  })
+})
+
+describe('authorize endpoint', () => {
+  it('302-redirects to GitHub with our client_id + scopes + sealed state', async () => {
+    const q = new URLSearchParams({
+      response_type: 'code', client_id: 'ias-client', redirect_uri: 'https://ias.example/cb',
+      state: 'ias-state', nonce: 'n1', code_challenge: 'chal', code_challenge_method: 'S256',
+    })
+    const res = mockRes()
+    shim.gitHubOidcShimHandler(getReq(`${shim.AUTHORIZE_PATH}?${q}`), res, vi.fn())
+    await vi.waitFor(() => expect(res.statusCode).toBe(302))
+    const loc = new URL(res.headers.Location)
+    expect(loc.origin + loc.pathname).toBe('https://github.com/login/oauth/authorize')
+    expect(loc.searchParams.get('client_id')).toBe('gh-client-id')
+    expect(loc.searchParams.get('scope')).toBe('read:user user:email')
+    expect(loc.searchParams.get('redirect_uri')).toBe(`${BASE_URL}${shim.CALLBACK_PATH}`)
+    // state handed to GitHub is our sealed context, reopenable
+    const opened = await shim.openState(loc.searchParams.get('state'))
+    expect(opened.ias_redirect_uri).toBe('https://ias.example/cb')
+    expect(opened.ias_nonce).toBe('n1')
+    expect(opened.ias_code_challenge).toBe('chal')
+  })
+
+  it('rejects a non-code response_type via error redirect', async () => {
+    const q = new URLSearchParams({ response_type: 'token', redirect_uri: 'https://ias.example/cb', state: 'st' })
+    const res = mockRes()
+    shim.gitHubOidcShimHandler(getReq(`${shim.AUTHORIZE_PATH}?${q}`), res, vi.fn())
+    await vi.waitFor(() => expect(res.statusCode).toBe(302))
+    const loc = new URL(res.headers.Location)
+    expect(loc.origin + loc.pathname).toBe('https://ias.example/cb')
+    expect(loc.searchParams.get('error')).toBe('unsupported_response_type')
+    expect(loc.searchParams.get('state')).toBe('st')
+  })
+})
+
+describe('callback endpoint', () => {
+  it('redirects back to IAS with access_denied when GitHub returns an error', async () => {
+    const state = await shim.sealState({ ias_redirect_uri: 'https://ias.example/cb', ias_state: 'st' })
+    const q = new URLSearchParams({ error: 'access_denied', error_description: 'user cancelled', state })
+    const res = mockRes()
+    shim.gitHubOidcShimHandler(getReq(`${shim.CALLBACK_PATH}?${q}`), res, vi.fn())
+    await vi.waitFor(() => expect(res.statusCode).toBe(302))
+    const loc = new URL(res.headers.Location)
+    expect(loc.origin + loc.pathname).toBe('https://ias.example/cb')
+    expect(loc.searchParams.get('error')).toBe('access_denied')
+    expect(loc.searchParams.get('state')).toBe('st')
+  })
+
+  it('400s on an invalid/expired state', async () => {
+    const q = new URLSearchParams({ code: 'gh-code', state: 'not-a-valid-sealed-token' })
+    const res = mockRes()
+    shim.gitHubOidcShimHandler(getReq(`${shim.CALLBACK_PATH}?${q}`), res, vi.fn())
+    await vi.waitFor(() => expect(res.statusCode).toBe(400))
+    expect(res.json().error).toBe('invalid_request')
+  })
+})

From fafbd710bfd9e088592b539af89c522f84ee38df Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 12:29:08 -0400
Subject: [PATCH 39/46] chore(deploy): enable GITHUB_OIDC_ENABLED on DEV
 approuter (dev.mtaext)

---
 deploy/dev.mtaext | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/deploy/dev.mtaext b/deploy/dev.mtaext
index 5e8b97dba..7338dba47 100644
--- a/deploy/dev.mtaext
+++ b/deploy/dev.mtaext
@@ -71,6 +71,16 @@ modules:
       # is NOT server config — mcp-remote supplies it via --static-oauth-client-info
       # (see docs/end-users/mcp-quickstart.md); RFC 8414 discovery carries no client_id.
       MCP_ISSUER_KIND: ias
+      # GitHub-OIDC shim (approuter/lib/github-oidc-shim.js) toggle. The shim is
+      # a custom OpenID Connect IdP wrapping GitHub so IAS can federate GitHub as
+      # a corporate OIDC IdP (GitHub is OAuth2-only — no discovery/id_token/JWKS).
+      # Read via process.env.GITHUB_OIDC_ENABLED at call time; off ⇒ the handler
+      # is an inert no-op. MUST be a `properties:` entry, NOT `env:` (MTA silently
+      # drops module-level env — see the note at the top of this module). Secrets
+      # (GITHUB_CLIENT_ID/SECRET, GITHUB_OIDC_SIGNING_KEY, GITHUB_OIDC_STATE_SECRET,
+      # GITHUB_OIDC_IAS_CLIENT_ID/SECRET) live in the BTP Credential Store, read
+      # via approuter/lib/credstore-secret.js — never here.
+      GITHUB_OIDC_ENABLED: "true"
       # REBUILD_API_KEY was formerly injected here via envsubst against
       # deploy.yml's $REBUILD_API_KEY. Removed as the third and final rollout
       # step of PR #871 (issue #903): the approuter now reads REBUILD_API_KEY

From 7f2ff7617b1089d0acf6e1fa4e28e10516b32c15 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 12:31:48 -0400
Subject: [PATCH 40/46] chore(ci): allowlist gitleaks false-positive on
 github-oidc-keys PEM literal

---
 .gitleaks.toml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.gitleaks.toml b/.gitleaks.toml
index 4de773bdc..5664506c0 100644
--- a/.gitleaks.toml
+++ b/.gitleaks.toml
@@ -43,9 +43,21 @@ description = "Project-specific false positives"
 # NOTE: the finding is anchored to the commit that introduced line 40; if that
 # comment is ever reworded, re-add the new introducing commit here (or drop the
 # literal PEM markers from the doc). Confirmed a placeholder (2026-07-23).
+# Suppress approuter/lib/github-oidc-keys.js (line 48, RuleID private-key) in
+# commit 75778103a: the `ensurePem()` helper contains the literal PEM armor
+# ("-----BEGIN PRIVATE KEY-----\n${wrapped}\n-----END PRIVATE KEY-----") it
+# uses to WRAP a credstore-sourced key string into PEM form. The literal is a
+# template, not a key body — no real secret (the actual signing key lives only
+# in the BTP Credential Store, alias GITHUB_OIDC_SIGNING_KEY). gitleaks'
+# private-key rule matches the header/footer literal in the code. Because
+# history is scanned (fetch-depth 0), this fails every PR after #2618 merged to
+# DEV. Same class as the srv/lib/github-app-token.js entry above. NOTE: anchored
+# to the introducing commit; if the helper is reworded, re-add the new commit
+# (or drop the literal PEM markers). Confirmed a placeholder (2026-10-03).
 commits = [
   "5153670f57cb30d9322af3603642fdaf980add74",
   "5a6dedf4345733040e9148dd503b6a62ed5a2b4c",
+  "75778103a5b7c54be258feba8f268cc2fa41b687",
 ]
 # Env-var references are the CORRECT, secret-free pattern — never flag them.
 regexes = [

From ee4e9a0d21c653d62b53378124c4cc58e282f5a3 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 14:02:44 -0400
Subject: [PATCH 41/46] feat(auth): link GitHub-federated logins to the
 identity model (Phase 2)

GitHub is federated into IAS via the custom OIDC shim (Phase 1, #2618). After
federation the app token's `iss` is the IAS tenant (not github.com) and `sub`
is the GitHub NUMERIC id (shim sets it; IAS Subject Name Identifier=None passes
it through); the login handle rides `preferred_username`. Confirmed live via the
IAS IdP validation (sub=12159356, preferred_username=jung-thomas, email,
email_verified, name).

This teaches the identity resolver to recognise a GitHub-federated login and
link it on the durable provider-canonical key:

- packages/core/resolve-db-user.js:
  - githubIdentityFromUser(user): detects a GitHub-origin login (numeric sub +
    a login-handle claim, or an explicit github IdP marker) and returns
    {issuer:'https://github.com', subject:<id>, login, email, emailVerified}.
    Defensive about the exact IAS-reissued claim name (preferred_username /
    login / user_name) since the live app-token names weren't captured (sticky
    IAS SSO blocked the browser capture).
  - linkGithubIdentity(): writes the provider-canonical UserIdentities link
    (provider='github') AND sets Users.githubLogin (idempotent; swallows the
    @assert.unique collision so a shared handle never breaks login).
  - resolveUser: new Tier 0 resolves on the GitHub (https://github.com,<id>)
    key (durable across IAS tenants); Tiers 1/2/3 and the create path also call
    linkGithubIdentity on a github login, so the link + githubLogin are written
    however the row is first matched.

srv/lib/resolve-db-user.js is a thin re-export of @tutorials/core (not a copy),
so no duplicate to sync; the CF _shared bundle is regenerated at build time.

Tests: test/unit/resolve-db-user-resolve.test.js +6 (githubIdentityFromUser
mapping + negatives, Tier-0 github-link resolve with githubLogin backfill,
sapId-hit github-link write). 26/26 in-file; adjacent resolver/schema suites
green (31/31). Inert until a real GitHub token arrives (gh=null for all other
logins).
---
 packages/core/resolve-db-user.js          | 132 +++++++++++++++++++++-
 test/unit/resolve-db-user-resolve.test.js |  81 ++++++++++++-
 2 files changed, 210 insertions(+), 3 deletions(-)

diff --git a/packages/core/resolve-db-user.js b/packages/core/resolve-db-user.js
index 64735e990..317006b88 100644
--- a/packages/core/resolve-db-user.js
+++ b/packages/core/resolve-db-user.js
@@ -124,6 +124,101 @@ function providerFromIssuer(issuer) {
 // fbf099e2-f1b5-4cda-b590-866fed970a2a — never a real SAP ID.
 const SCIM_UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+// The durable, provider-canonical issuer we store for a GitHub login, so the
+// link key is stable regardless of which IAS tenant fronts it. providerFromIssuer
+// already classifies this as 'github'. See githubIdentityFromUser().
+const GITHUB_ISSUER = 'https://github.com';
+
+// Claim names that may carry the GitHub login handle, in preference order. The
+// shim stamps `preferred_username`; IAS re-issues it, but a tenant may remap it.
+// Defensive: accept the common OIDC + IAS variants (confirmed shim claim is
+// `preferred_username`; see github-oidc-shim.js mintIdToken).
+const GITHUB_LOGIN_CLAIMS = ['preferred_username', 'login', 'user_name', 'preferredUsername'];
+
+/**
+ * Detect a GitHub-federated login and return its PROVIDER-CANONICAL identity,
+ * independent of the IAS tenant that fronts it.
+ *
+ * GitHub is federated into IAS via a custom OIDC shim (approuter/lib/
+ * github-oidc-shim.js) registered as a corporate OIDC IdP. After federation the
+ * app token's `iss` is the IAS tenant (NOT github.com) and `sub` is the GitHub
+ * NUMERIC id (the shim sets it as `sub`; IAS Subject Name Identifier = None
+ * passes it through). So the IAS (iss,sub) alone can't be classified as GitHub
+ * by issuer — we recognise a GitHub login by the shim-origin claims instead and
+ * remap it to the stable (issuer=https://github.com, subject=<numeric id>) key.
+ *
+ * Recognition is deliberately permissive (the exact IAS-reissued claim names
+ * were not captured live — sticky-SSO blocked the browser capture — so this
+ * tolerates renames): a login is GitHub-origin when the token carries a GitHub
+ * login-handle claim AND a numeric subject, OR an explicit IdP/amr marker that
+ * names the GitHub corporate IdP.
+ *
+ * @param {object} user — CAP cds.context.user / req.user.
+ * @returns {{issuer:string, subject:string, login:string|null, email:string|null, emailVerified:boolean}|null}
+ */
+export function githubIdentityFromUser(user) {
+  const p = user?.authInfo?.token?.payload;
+  if (!p) return null;
+
+  const login = GITHUB_LOGIN_CLAIMS.map((c) => p[c]).find((v) => typeof v === 'string' && v);
+  const sub = typeof p.sub === 'string' ? p.sub : null;
+  // The GitHub subject the shim stamps is the numeric user id (digits only).
+  const numericSub = sub && /^\d+$/.test(sub) ? sub : null;
+
+  // Explicit IdP marker, if present (IAS may surface the corporate-IdP name or
+  // id in a claim; amr sometimes carries it). Best-effort, not required.
+  const idpMarker = [p.identity_provider, p.identityProvider, p.idp, p.amr]
+    .flat()
+    .filter((v) => typeof v === 'string')
+    .join(' ');
+  const idpSaysGithub = /github/i.test(idpMarker);
+
+  // GitHub-origin when: a login handle + numeric subject are present, or an
+  // explicit GitHub IdP marker is present with a numeric subject.
+  if (numericSub && (login || idpSaysGithub)) {
+    return {
+      issuer: GITHUB_ISSUER,
+      subject: numericSub,
+      login: login || null,
+      email: tokenEmail(user),
+      emailVerified: typeof p.email_verified === 'boolean' ? p.email_verified : true,
+    };
+  }
+  return null;
+}
+
+/**
+ * Write the provider-canonical GitHub link (issuer=https://github.com) and set
+ * Users.githubLogin from the login handle. Idempotent and non-throwing — a
+ * duplicate (iss,sub) link or a githubLogin unique-collision is swallowed so
+ * this never breaks a read/resolve path. Called wherever a Users row is
+ * resolved or created for a GitHub-origin login, IN ADDITION to the IAS
+ * (iss,sub) self-heal link, so Tier 1 resolves on both keys.
+ *
+ * @param {string} user_ID
+ * @param {ReturnType<typeof githubIdentityFromUser>} gh — non-null GitHub identity.
+ * @param {object} [db] — optional tx/service runner threaded through.
+ */
+async function linkGithubIdentity(user_ID, gh, db) {
+  if (!user_ID || !gh) return;
+  await writeIdentityLink(user_ID, { issuer: gh.issuer, subject: gh.subject }, {
+    provider: 'github',
+    email: gh.email,
+    emailVerified: gh.emailVerified,
+  }, db);
+  if (gh.login) {
+    try {
+      const { Users } = cds.entities('com.sap.developers.ims');
+      const stmt = UPDATE(Users).set({ githubLogin: gh.login }).where({ ID: user_ID });
+      await (db ? db.run(stmt) : stmt);
+    } catch (err) {
+      // githubLogin is @assert.unique — a collision (same handle already on
+      // another row) must not break login. Swallow unique/duplicate only.
+      if (!/unique|duplicate/i.test(String(err?.message ?? ''))) throw err;
+    }
+  }
+}
+
 /**
  * Resolve the authenticated request to its Users row via the tiered identity
  * layer (#2552). Tiers, in order:
@@ -144,15 +239,41 @@ export async function resolveUser(user, db) {
   const { Users, UserIdentities } = cds.entities('com.sap.developers.ims');
   const run = (stmt) => (db ? db.run(stmt) : stmt);
 
-  // ── Tier 1: (issuer, subject) link ──────────────────────────────────────
+  // The IAS (tenant-local) (iss,sub) key, and — if this is a GitHub-federated
+  // login — the provider-canonical GitHub identity. GitHub's app-token iss is
+  // the IAS tenant, so the durable key is (https://github.com, <numeric id>).
   const isu = issuerSubjectFromUser(user);
+  const gh = githubIdentityFromUser(user);
+
+  // ── Tier 0: GitHub provider-canonical link (durable across IAS tenants) ──
+  if (gh) {
+    const ghLink = await run(SELECT.one.from(UserIdentities)
+      .columns('user_ID')
+      .where({ issuer: gh.issuer, subject: gh.subject }));
+    if (ghLink?.user_ID) {
+      const row = await run(SELECT.one.from(Users).where({ ID: ghLink.user_ID }));
+      if (row) {
+        // Self-heal the IAS (iss,sub) link + githubLogin on repeat logins.
+        if (isu) await writeIdentityLink(row.ID, isu, {
+          provider: providerFromIssuer(isu.issuer), email: gh.email, emailVerified: gh.emailVerified,
+        }, db);
+        await linkGithubIdentity(row.ID, gh, db);
+        return row;
+      }
+    }
+  }
+
+  // ── Tier 1: (issuer, subject) link ──────────────────────────────────────
   if (isu) {
     const link = await run(SELECT.one.from(UserIdentities)
       .columns('user_ID')
       .where({ issuer: isu.issuer, subject: isu.subject }));
     if (link?.user_ID) {
       const row = await run(SELECT.one.from(Users).where({ ID: link.user_ID }));
-      if (row) return row;
+      if (row) {
+        if (gh) await linkGithubIdentity(row.ID, gh, db);
+        return row;
+      }
     }
   }
 
@@ -172,6 +293,7 @@ export async function resolveUser(user, db) {
           emailVerified: true,
         }, db);
       }
+      if (gh) await linkGithubIdentity(row.ID, gh, db);
       return row;
     }
   }
@@ -195,6 +317,7 @@ export async function resolveUser(user, db) {
           emailVerified: true,
         }, db);
       }
+      if (gh) await linkGithubIdentity(row.ID, gh, db);
       return row;
     }
   }
@@ -480,6 +603,11 @@ export async function provisionDbUser(user, columns) {
       emailVerified: true,
     });
   }
+  // For a GitHub-federated login also write the provider-canonical link
+  // (issuer=https://github.com) + githubLogin, so future logins resolve on the
+  // durable GitHub key regardless of the fronting IAS tenant.
+  const ghNew = githubIdentityFromUser(user);
+  if (ghNew) await linkGithubIdentity(newId, ghNew);
   const q = SELECT.one.from(Users).where({ ID: newId });
   return (columns && columns.length) ? await q.columns(...columns) : await q;
 }
diff --git a/test/unit/resolve-db-user-resolve.test.js b/test/unit/resolve-db-user-resolve.test.js
index 6abc9433b..984450ba4 100644
--- a/test/unit/resolve-db-user-resolve.test.js
+++ b/test/unit/resolve-db-user-resolve.test.js
@@ -27,6 +27,14 @@ function installInsert() {
   } }) };
 }
 
+// UPDATE stub — records the last githubLogin set so tests can assert it.
+function installUpdate() {
+  globalThis.UPDATE = (e) => ({ set: (vals) => ({ where: (w) => {
+    captured = { ...captured, updateEntity: e?.name || e, updateVals: vals, updateWhere: w };
+    return Promise.resolve({});
+  } }) });
+}
+
 // Chainable SELECT stub. Supports:
 //   SELECT.one.from(E).columns(...).where({...})
 //   SELECT.one.from(E).columns(...).where`lower(email) = ${v}`
@@ -54,7 +62,7 @@ function installSelect() {
   });
 }
 
-const { resolveUser, issuerSubjectFromUser } = await import('../../packages/core/resolve-db-user.js');
+const { resolveUser, issuerSubjectFromUser, githubIdentityFromUser } = await import('../../packages/core/resolve-db-user.js');
 
 const iasUser = (over = {}) => ({
   id: 'thomas.jung@sap.com',
@@ -277,3 +285,74 @@ describe('provisionDbUser — (iss,sub) get-or-create', () => {
     expect(await provisionDbUser(bare)).toBeNull();
   });
 });
+
+// ── GitHub-federated login (via the OIDC shim behind IAS) ────────────────────
+// After federation the app token's iss is the IAS tenant and sub is the GitHub
+// NUMERIC id; the login handle rides preferred_username. The resolver must remap
+// to the provider-canonical (issuer=https://github.com, subject=<id>) key and
+// set Users.githubLogin.
+const githubViaIasUser = (over = {}) => ({
+  id: 'thomas.jung@sap.com',
+  authInfo: { token: { payload: {
+    iss: 'https://atxgsg7zi.accounts.ondemand.com',   // IAS tenant, NOT github.com
+    sub: '12159356',                                   // GitHub numeric id (SNI=None)
+    preferred_username: 'jung-thomas',                 // GitHub login handle
+    email: 'thomas.jung@sap.com',
+    email_verified: true,
+    name: 'Thomas Jung',
+    ...over,
+  } } },
+});
+
+describe('githubIdentityFromUser', () => {
+  it('maps a GitHub-via-IAS token to the provider-canonical identity', () => {
+    expect(githubIdentityFromUser(githubViaIasUser())).toEqual({
+      issuer: 'https://github.com',
+      subject: '12159356',
+      login: 'jung-thomas',
+      email: 'thomas.jung@sap.com',
+      emailVerified: true,
+    });
+  });
+  it('returns null for a plain SAP-ID login (no github claims)', () => {
+    expect(githubIdentityFromUser(iasUser())).toBeNull();
+  });
+  it('returns null when the subject is not numeric (not a github id)', () => {
+    expect(githubIdentityFromUser(githubViaIasUser({ sub: 'thomas.jung@sap.com' }))).toBeNull();
+  });
+  it('recognises an explicit github IdP marker claim with a numeric subject', () => {
+    const u = githubViaIasUser({ preferred_username: undefined, identity_provider: 'GitHub' });
+    expect(githubIdentityFromUser(u)).toMatchObject({ issuer: 'https://github.com', subject: '12159356', login: null });
+  });
+});
+
+describe('resolveUser — GitHub provider-canonical link (Tier 0)', () => {
+  beforeEach(() => { captured = undefined; stub = {}; installSelect(); installInsert(); installUpdate(); });
+  afterEach(() => { delete globalThis.SELECT; delete globalThis.INSERT; delete globalThis.UPDATE; });
+
+  it('resolves on the GitHub (https://github.com, <id>) link and backfills githubLogin', async () => {
+    stub.identityRow = { user_ID: 'u-gh' };   // the first UserIdentities query (GitHub key) hits
+    stub.usersRows = [{ ID: 'u-gh', sapId: null, email: 'thomas.jung@sap.com', githubLogin: null }];
+    const row = await resolveUser(githubViaIasUser());
+    expect(row.ID).toBe('u-gh');
+    // githubLogin backfilled via UPDATE
+    expect(captured.updateEntity).toMatch(/\.Users$/);
+    expect(captured.updateVals.githubLogin).toBe('jung-thomas');
+  });
+
+  it('on a sapId (Tier-2) hit for a github login, writes the durable github link', async () => {
+    // Tier-0 miss (no github link yet), Tier-1 miss, Tier-2 sapId hit.
+    stub.identityRow = null;
+    stub.usersRows = [{ ID: 'u-1', sapId: 'I809764', email: 'thomas.jung@sap.com' }];
+    const u = githubViaIasUser({ /* IAS token also carries userId */ });
+    u.authInfo.token.userId = 'I809764';
+    const row = await resolveUser(u);
+    expect(row.ID).toBe('u-1');
+    // A github provider-canonical link was inserted (issuer=https://github.com).
+    expect(captured.insertVals?.issuer).toBe('https://github.com');
+    expect(captured.insertVals?.subject).toBe('12159356');
+    expect(captured.insertVals?.provider).toBe('github');
+    expect(captured.updateVals?.githubLogin).toBe('jung-thomas');
+  });
+});
+

From 08cab14cff998d4cc8a43814390c19ef4073c03a Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 17:57:39 -0400
Subject: [PATCH 42/46] feat(auth): per-provider buttons on /signin (RPT-style
 IdP picker)

Replace the two-button /signin (#2506) with a per-provider button row, matching the RPT Playground sign-in UX: one button per IAS corporate IdP that deep-links straight to that provider.

Each button links to /login?sap_idp=<IAS trust Name>; the approuter (dynamicIdentityProvider, already on the /login route) injects &idp=<Name> into the XSUAA authorize URL, which IAS routes to that specific corporate IdP (verified at the URL layer on DEV for GitHub + Hugging Face incl. space-encoding).

Buttons: SAP Universal ID (sap.default), GitHub, LinkedIn, Hugging Face (the four idp-addressable corporate OIDC IdPs), plus a 'More options' pass-through to the IAS page (sap.custom) for the social tiles (Google/X) that are NOT idp-addressable. Existing returnTo carry-through (data-signin-idp) applies to all buttons unchanged.

Updates test/e2e/signin.spec.ts to assert the new buttons/hrefs (the prior assertions had drifted from the live layout). Hugo-rendered output verified: all five hrefs + labels correct.

Note: reliable click-through still depends on prompt=login defeating IAS SSO stickiness; end-user validation pending on a non-SSO-contaminated browser.
---
 hugo/layouts/signin.html | 30 ++++++++++++++++++++++++++----
 test/e2e/signin.spec.ts  | 25 +++++++++++++++++--------
 2 files changed, 43 insertions(+), 12 deletions(-)

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index f6bf2d301..fbf49f4d0 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -4,18 +4,35 @@
     <ui5-illustrated-message name="tnt/Lock" design="Spot" class="signin-illus">
       <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developers</h1>
       <p slot="subtitle" class="signin-lede">
-        Choose how you'd like to sign in. Your progress and completions are the
-        same account whichever you pick.
+        Choose a provider to continue.
       </p>
     </ui5-illustrated-message>
     <div class="signin-actions">
+      <!-- Per-provider deep-links. Each sap_idp value is the EXACT IAS corporate-IdP
+           trust Name (confirmed injecting `&idp=<Name>` into the XSUAA authorize URL,
+           which IAS routes straight to that provider). SAP uses the stable BTP origin
+           key sap.default. Google/X are IAS *social* tiles (not idp-addressable), so
+           they live behind the "More options" pass-through to the IAS page (sap.custom). -->
       <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
-        Sign in SAP Universal Account
+        Sign in with SAP Universal ID
+      </a>
+      <a class="fd-button signin-btn" data-signin-idp href="/login?sap_idp=GitHub">
+        Sign in with GitHub
+      </a>
+      <a class="fd-button signin-btn" data-signin-idp href="/login?sap_idp=LinkedIn">
+        Sign in with LinkedIn
+      </a>
+      <a class="fd-button signin-btn" data-signin-idp href="/login?sap_idp=Hugging%20Face">
+        Sign in with Hugging Face
       </a>
       <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom">
-        Other Options including Social Login
+        More options (Google, X, &amp; more)
       </a>
     </div>
+    <p class="signin-note">
+      Whichever you choose, it's the same account &mdash; your progress and
+      completions carry across providers.
+    </p>
   </div>
 </section>
 
@@ -63,6 +80,11 @@ <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developer
     align-items: center;
   }
   .signin-btn { min-width: 16rem; justify-content: center; }
+  .signin-note {
+    font-size: 0.8125rem;
+    color: var(--sapContent_LabelColor, #6a6d70);
+    margin: 1.25rem 0 0;
+  }
 </style>
 {{- /* ui5Split: illustration assets for <ui5-illustrated-message>, mirrors 403.html (#1777 Task 7) */}}
 {{ if and (not site.Params.previewMode) site.Params.ui5Split }}<script type="module" src="{{ partial "island-src.html" "ui5-illustrations" }}"></script>{{ end }}
diff --git a/test/e2e/signin.spec.ts b/test/e2e/signin.spec.ts
index d19d11732..f4ed3b0ff 100644
--- a/test/e2e/signin.spec.ts
+++ b/test/e2e/signin.spec.ts
@@ -26,20 +26,29 @@ describe.skipIf(!hasBaseUrl())('e2e: /signin page (IAS social login, #2506)', ()
     await browser?.close();
   });
 
-  it('renders both IdP-pinned sign-in buttons with correct hrefs', async () => {
+  it('renders the per-provider sign-in buttons with correct sap_idp hrefs', async () => {
     const { context, page } = await newPage(browser, { authenticated: false });
     try {
       const response = await page.goto('/signin', { waitUntil: 'domcontentloaded' });
       expect(response, 'no response received').not.toBeNull();
       expect(response!.status(), 'unexpected status for /signin').toBe(200);
 
-      const sapBtn = page.getByRole('link', { name: 'Sign in with SAP Account', exact: true });
-      const uidBtn = page.getByRole('link', { name: "Sign In if you don't already have an SAP Account", exact: true });
-
-      await expect(sapBtn).toBeVisible();
-      await expect(uidBtn).toBeVisible();
-      await expect(sapBtn).toHaveAttribute('href', '/login?sap_idp=sap.default');
-      await expect(uidBtn).toHaveAttribute('href', '/login?sap_idp=sap.custom');
+      // Each button deep-links to one IAS corporate IdP via the approuter's
+      // dynamicIdentityProvider (sap_idp → &idp=<Name> on the XSUAA authorize
+      // URL → IAS routes straight to that provider). Google/X are IAS social
+      // tiles (not idp-addressable) and live behind the "More options" pass-through.
+      const buttons: Array<[string, string]> = [
+        ['Sign in with SAP Universal ID', '/login?sap_idp=sap.default'],
+        ['Sign in with GitHub', '/login?sap_idp=GitHub'],
+        ['Sign in with LinkedIn', '/login?sap_idp=LinkedIn'],
+        ['Sign in with Hugging Face', '/login?sap_idp=Hugging%20Face'],
+        ['More options (Google, X, & more)', '/login?sap_idp=sap.custom'],
+      ];
+      for (const [name, href] of buttons) {
+        const link = page.getByRole('link', { name, exact: true });
+        await expect(link, `button "${name}" not visible`).toBeVisible();
+        await expect(link, `button "${name}" href`).toHaveAttribute('href', href);
+      }
     } finally {
       await context.close();
     }

From 3b90d49f457185b9e1199010d1b600dc43c05082 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 18:59:18 -0400
Subject: [PATCH 43/46] =?UTF-8?q?feat(auth):=20RPT-style=20/signin=20?=
 =?UTF-8?q?=E2=80=94=20provider=20logos=20+=20chain-form=20IdP=20routing?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Redesign /signin to mirror the RPT Playground login (rpt.cloud.sap/login) within our Horizon theme: a centered card with eyebrow + 'Sign In' + subtitle, a short description, and a stacked column of logo buttons (logo left of 'Continue with <Provider>').

Providers: GitHub, Google, Hugging Face, LinkedIn, SAP ID. Apple omitted (requires a paid Apple Developer account). Logos sourced from the RPT login page into hugo/static/img/providers/ (self-hosted → same-origin, no CSP img-src change).

CRITICAL ROUTING FIX: corporate OIDC IdPs are NESTED inside IAS, so they need the approuter CHAIN form sap_idp=sap.custom,<IAS trust Name> (XSUAA routes via the sap.custom IAS trust, then IAS applies idp=<Name>). The prior bare sap_idp=<Name> did nothing — XSUAA has no such origin, so every button silently fell through to the default IdP (the 'logs me in with default' bug). GitHub/LinkedIn/Hugging Face now use the chain form; SAP ID uses sap.default; Google routes to sap.custom (IAS page) until converted from a social tile to corporate OIDC.

Updates test/e2e/signin.spec.ts to the 5 Continue-with buttons + chain-form hrefs.

KNOWN FOLLOW-UP: an existing IAS SSO session can still be reused instead of honoring the chosen IdP (IAS prompt=login would force it, but the approuter does not forward prompt). Validate click-through on a clean browser.
---
 hugo/layouts/signin.html                  | 159 ++++++++++++++++------
 hugo/static/img/providers/Github.svg      |   1 +
 hugo/static/img/providers/Google.svg      |   1 +
 hugo/static/img/providers/SAP.svg         |  11 ++
 hugo/static/img/providers/huggingface.svg |  37 +++++
 hugo/static/img/providers/linkedin.webp   | Bin 0 -> 12560 bytes
 test/e2e/signin.spec.ts                   |  10 +-
 7 files changed, 170 insertions(+), 49 deletions(-)
 create mode 100644 hugo/static/img/providers/Github.svg
 create mode 100644 hugo/static/img/providers/Google.svg
 create mode 100644 hugo/static/img/providers/SAP.svg
 create mode 100644 hugo/static/img/providers/huggingface.svg
 create mode 100644 hugo/static/img/providers/linkedin.webp

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index fbf49f4d0..b996bf640 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -1,37 +1,64 @@
 {{ define "main" }}
 <section class="signin-hero" aria-labelledby="signin-title">
-  <div class="signin-inner">
-    <ui5-illustrated-message name="tnt/Lock" design="Spot" class="signin-illus">
-      <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developers</h1>
-      <p slot="subtitle" class="signin-lede">
-        Choose a provider to continue.
-      </p>
-    </ui5-illustrated-message>
+  <div class="signin-card">
+    <p class="signin-eyebrow">SAP&reg; ID</p>
+    <h1 id="signin-title" class="signin-title">Sign In</h1>
+    <p class="signin-subtitle">SAP Developers</p>
+
+    <p class="signin-desc">
+      Sign in to track your tutorial progress, earn completions, and personalize
+      your experience across SAP Developers.
+    </p>
+
+    <hr class="signin-sep" />
+
+    <p class="signin-choose">Choose your authentication service:</p>
+
     <div class="signin-actions">
-      <!-- Per-provider deep-links. Each sap_idp value is the EXACT IAS corporate-IdP
-           trust Name (confirmed injecting `&idp=<Name>` into the XSUAA authorize URL,
-           which IAS routes straight to that provider). SAP uses the stable BTP origin
-           key sap.default. Google/X are IAS *social* tiles (not idp-addressable), so
-           they live behind the "More options" pass-through to the IAS page (sap.custom). -->
-      <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
-        Sign in with SAP Universal ID
+      {{/*
+        Provider sign-in buttons, RPT-style (logo + label, full-width stacked).
+
+        Routing (approuter dynamicIdentityProvider → sap_idp):
+          - CORPORATE OIDC IdPs nested in IAS use the CHAIN form
+            sap_idp=sap.custom,<IAS trust Name>: XSUAA routes via the sap.custom
+            IAS trust, then IAS applies idp=<Name> to pick that provider. A bare
+            sap_idp=<Name> does NOT work (XSUAA has no such origin → falls through
+            to default). Deep-linkable today: GitHub, LinkedIn, Hugging Face.
+          - SAP ID = direct XSUAA trust origin sap.default.
+          - Google is NOT yet a corporate OIDC IdP in IAS (it's a social tile, not
+            idp-addressable), so its button routes to sap.custom (the IAS page) where
+            Google appears. Convert it to corporate OIDC to make it a true deep-link.
+            Apple is intentionally omitted (requires a paid Apple Developer account).
+        NOTE: an existing IAS SSO session can be reused instead of honoring the
+        chosen IdP (IAS prompt=login would force it, but the approuter does not
+        forward prompt) — tracked as a follow-up.
+      */}}
+      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom,GitHub">
+        <img class="signin-logo" src="/img/providers/Github.svg" alt="" aria-hidden="true" width="20" height="20" />
+        <span>Continue with GitHub</span>
       </a>
-      <a class="fd-button signin-btn" data-signin-idp href="/login?sap_idp=GitHub">
-        Sign in with GitHub
+      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom">
+        <img class="signin-logo" src="/img/providers/Google.svg" alt="" aria-hidden="true" width="20" height="20" />
+        <span>Continue with Google</span>
       </a>
-      <a class="fd-button signin-btn" data-signin-idp href="/login?sap_idp=LinkedIn">
-        Sign in with LinkedIn
+      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom,Hugging%20Face">
+        <img class="signin-logo" src="/img/providers/huggingface.svg" alt="" aria-hidden="true" width="20" height="20" />
+        <span>Continue with Hugging Face</span>
       </a>
-      <a class="fd-button signin-btn" data-signin-idp href="/login?sap_idp=Hugging%20Face">
-        Sign in with Hugging Face
+      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom,LinkedIn">
+        <img class="signin-logo" src="/img/providers/linkedin.webp" alt="" aria-hidden="true" width="20" height="20" />
+        <span>Continue with LinkedIn</span>
       </a>
-      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom">
-        More options (Google, X, &amp; more)
+      <a class="fd-button fd-button--emphasized signin-btn" data-signin-idp href="/login?sap_idp=sap.default">
+        <img class="signin-logo signin-logo--sap" src="/img/providers/SAP.svg" alt="" aria-hidden="true" width="20" height="20" />
+        <span>Continue with SAP ID</span>
       </a>
     </div>
-    <p class="signin-note">
-      Whichever you choose, it's the same account &mdash; your progress and
-      completions carry across providers.
+
+    <p class="signin-legal">
+      By signing in, you accept our
+      <a href="/privacy">Privacy Policy</a> and
+      <a href="/cookies">Cookie Statement</a>.
     </p>
   </div>
 </section>
@@ -51,41 +78,85 @@ <h1 slot="title" id="signin-title" class="signin-title">Sign in to SAP Developer
 
 <style>
   .signin-hero {
-    padding: 4rem 1.5rem;
+    padding: 3rem 1.5rem;
     background: var(--sapBackgroundColor, #f5f6f7);
-    min-height: 60vh;
+    min-height: 70vh;
     display: flex;
     align-items: center;
     justify-content: center;
   }
-  .signin-inner {
-    max-width: 640px;
+  .signin-card {
+    max-width: 26rem;
+    width: 100%;
     text-align: center;
-    background: var(--sapTile_Background, #ffffff);
-    padding: 3rem 2rem;
+    background: var(--sapGroup_ContentBackground, var(--sapTile_Background, #ffffff));
+    padding: 2.5rem 2rem;
     border-radius: 0.75rem;
-    box-shadow: 0 0.125rem 0.5rem rgba(0, 0, 0, 0.08);
+    box-shadow: 0 0.125rem 0.75rem rgba(0, 0, 0, 0.1);
   }
-  .signin-illus { display: block; margin: 0 auto 1.25rem; max-width: 100%; }
-  .signin-title { font-size: 1.625rem; margin: 0 0 0.5rem; color: var(--sapTextColor, #32363a); }
-  .signin-lede {
+  .signin-eyebrow {
+    font-size: 0.75rem;
+    letter-spacing: 0.04em;
+    text-transform: uppercase;
+    color: var(--sapContent_LabelColor, #6a6d70);
+    margin: 0 0 0.25rem;
+  }
+  .signin-title {
+    font-size: 1.75rem;
+    margin: 0 0 0.125rem;
+    color: var(--sapTextColor, #32363a);
+  }
+  .signin-subtitle {
     font-size: 1rem;
-    color: var(--sapContent_LabelColor, var(--sapTextColor, #32363a));
-    margin: 0 0 1.5rem;
+    color: var(--sapContent_LabelColor, #6a6d70);
+    margin: 0 0 1.25rem;
+  }
+  .signin-desc {
+    font-size: 0.875rem;
+    line-height: 1.4;
+    color: var(--sapTextColor, #32363a);
+    margin: 0 0 1.25rem;
+  }
+  .signin-sep {
+    border: 0;
+    border-top: 1px solid var(--sapGroup_ContentBorderColor, #d9d9d9);
+    margin: 0 0 1.25rem;
+  }
+  .signin-choose {
+    font-size: 0.875rem;
+    font-weight: 600;
+    color: var(--sapTextColor, #32363a);
+    margin: 0 0 1rem;
   }
   .signin-actions {
     display: flex;
     flex-direction: column;
-    gap: 0.75rem;
+    gap: 0.625rem;
+  }
+  .signin-btn {
+    width: 100%;
+    display: flex;
     align-items: center;
+    gap: 0.625rem;
+    justify-content: flex-start;
+    height: 2.75rem;
+    padding: 0 1rem;
+  }
+  .signin-logo {
+    flex: 0 0 auto;
+    width: 1.25rem;
+    height: 1.25rem;
+    object-fit: contain;
   }
-  .signin-btn { min-width: 16rem; justify-content: center; }
-  .signin-note {
-    font-size: 0.8125rem;
+  /* The SAP mark is wide; let it keep aspect without forcing a square. */
+  .signin-logo--sap { width: 2rem; }
+  .signin-btn > span { flex: 1 1 auto; text-align: center; }
+  .signin-legal {
+    font-size: 0.75rem;
     color: var(--sapContent_LabelColor, #6a6d70);
-    margin: 1.25rem 0 0;
+    margin: 1.5rem 0 0;
+    line-height: 1.4;
   }
+  .signin-legal a { color: var(--sapLinkColor, #0070f2); }
 </style>
-{{- /* ui5Split: illustration assets for <ui5-illustrated-message>, mirrors 403.html (#1777 Task 7) */}}
-{{ if and (not site.Params.previewMode) site.Params.ui5Split }}<script type="module" src="{{ partial "island-src.html" "ui5-illustrations" }}"></script>{{ end }}
 {{ end }}
diff --git a/hugo/static/img/providers/Github.svg b/hugo/static/img/providers/Github.svg
new file mode 100644
index 000000000..37fa923df
--- /dev/null
+++ b/hugo/static/img/providers/Github.svg
@@ -0,0 +1 @@
+<svg width="98" height="96" xmlns="http://www.w3.org/2000/svg"><path fill-rule="evenodd" clip-rule="evenodd" d="M48.854 0C21.839 0 0 22 0 49.217c0 21.756 13.993 40.172 33.405 46.69 2.427.49 3.316-1.059 3.316-2.362 0-1.141-.08-5.052-.08-9.127-13.59 2.934-16.42-5.867-16.42-5.867-2.184-5.704-5.42-7.17-5.42-7.17-4.448-3.015.324-3.015.324-3.015 4.934.326 7.523 5.052 7.523 5.052 4.367 7.496 11.404 5.378 14.235 4.074.404-3.178 1.699-5.378 3.074-6.6-10.839-1.141-22.243-5.378-22.243-24.283 0-5.378 1.94-9.778 5.014-13.2-.485-1.222-2.184-6.275.486-13.038 0 0 4.125-1.304 13.426 5.052a46.97 46.97 0 0 1 12.214-1.63c4.125 0 8.33.571 12.213 1.63 9.302-6.356 13.427-5.052 13.427-5.052 2.67 6.763.97 11.816.485 13.038 3.155 3.422 5.015 7.822 5.015 13.2 0 18.905-11.404 23.06-22.324 24.283 1.78 1.548 3.316 4.481 3.316 9.126 0 6.6-.08 11.897-.08 13.526 0 1.304.89 2.853 3.316 2.364 19.412-6.52 33.405-24.935 33.405-46.691C97.707 22 75.788 0 48.854 0z" fill="#24292f"/></svg>
\ No newline at end of file
diff --git a/hugo/static/img/providers/Google.svg b/hugo/static/img/providers/Google.svg
new file mode 100644
index 000000000..a3337bfde
--- /dev/null
+++ b/hugo/static/img/providers/Google.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" fill="none"><path fill="#4285F4" d="M17.64 9.2c0-.63-.06-1.25-.16-1.84H9v3.48h4.84a4.14 4.14 0 0 1-1.8 2.72v2.26h2.92a8.78 8.78 0 0 0 2.68-6.62Z"/><path fill="#34A853" d="M9 18a8.6 8.6 0 0 0 5.96-2.18l-2.91-2.26a5.41 5.41 0 0 1-8.09-2.85h-3v2.33A9 9 0 0 0 9 18Z"/><path fill="#FBBC05" d="M3.96 10.71A5.41 5.41 0 0 1 3.68 9c0-.6.1-1.17.28-1.71V4.96h-3A9 9 0 0 0 0 9a9 9 0 0 0 .96 4.04l3-2.33Z"/><path fill="#EA4335" d="M9 3.58c1.32 0 2.5.45 3.44 1.34l2.58-2.58A8.64 8.64 0 0 0 9 0 9 9 0 0 0 .96 4.96l3 2.33A5.36 5.36 0 0 1 9 3.58Z"/></svg>
diff --git a/hugo/static/img/providers/SAP.svg b/hugo/static/img/providers/SAP.svg
new file mode 100644
index 000000000..368f65410
--- /dev/null
+++ b/hugo/static/img/providers/SAP.svg
@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 412.38 204" width="412.38" height="204">
+<defs><style>.cls-1{fill:url(#linear-gradient);}.cls-1,.cls-2{fill-rule:evenodd;}.cls-2{fill:#fff;}</style>
+<linearGradient id="linear-gradient" x1="206.19" y1="0" x2="206.19" y2="204" gradientUnits="userSpaceOnUse">
+<stop offset="0" stop-color="#00b1eb"></stop>
+<stop offset=".212" stop-color="#009ad9"></stop>
+<stop offset=".519" stop-color="#007fc4"></stop>
+<stop offset=".792" stop-color="#006eb8"></stop>
+<stop offset="1" stop-color="#0069b4"></stop></linearGradient></defs>
+<polyline class="cls-1" points="0 204 208.413 204 412.38 0 0 0 0 204"/>
+<path class="cls-2" d="m244.727,38.359l-40.593-.025v96.518l-35.46-96.518h-35.16l-30.277,80.716c-3.224-20.352-24.277-27.38-40.84-32.649-10.937-3.512-22.541-8.678-22.434-14.387.091-4.687,6.225-9.04,18.377-8.385,8.17.433,15.373,1.092,29.71,8.006l14.102-24.557c-13.088-6.658-31.169-10.867-45.985-10.883h-.086c-17.277,0-31.677,5.598-40.602,14.824-6.221,6.443-9.572,14.626-9.712,23.679-.227,12.454,4.341,21.292,13.938,28.338,8.104,5.944,18.468,9.794,27.603,12.626,11.27,3.492,20.467,6.526,20.36,13.002-.083,2.355-.977,4.552-2.671,6.337-2.807,2.897-7.124,3.986-13.084,4.098-11.497.243-20.026-1.559-33.61-9.585l-12.536,24.903c13.546,7.705,29.586,12.223,45.952,12.223l2.106-.024c14.247-.256,25.745-4.316,34.929-11.712.527-.416,1.001-.845,1.488-1.277l-4.073,10.874h36.875l6.189-18.822c6.477,2.214,13.847,3.437,21.676,3.437,7.618,0,14.795-1.17,21.156-3.252l5.965,18.637h60.137v-38.969h13.113c31.706,0,50.456-16.147,50.456-43.202,0-30.139-18.219-43.969-57.011-43.969Zm-93.816,82.587c-4.737,0-9.177-.828-13.006-2.275l12.866-40.593h.244l12.643,40.708c-3.801,1.349-8.138,2.16-12.746,2.16Zm96.199-23.324h-8.941v-32.711h8.941c11.927,0,21.437,3.961,21.437,16.139,0,12.602-9.51,16.572-21.437,16.572"/>
+</svg>
\ No newline at end of file
diff --git a/hugo/static/img/providers/huggingface.svg b/hugo/static/img/providers/huggingface.svg
new file mode 100644
index 000000000..43c5d3c0c
--- /dev/null
+++ b/hugo/static/img/providers/huggingface.svg
@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="95" height="88" fill="none">
+	<path fill="#FFD21E" d="M47.21 76.5a34.75 34.75 0 1 0 0-69.5 34.75 34.75 0 0 0 0 69.5Z" />
+	<path
+		fill="#FF9D0B"
+		d="M81.96 41.75a34.75 34.75 0 1 0-69.5 0 34.75 34.75 0 0 0 69.5 0Zm-73.5 0a38.75 38.75 0 1 1 77.5 0 38.75 38.75 0 0 1-77.5 0Z"
+	/>
+	<path
+		fill="#3A3B45"
+		d="M58.5 32.3c1.28.44 1.78 3.06 3.07 2.38a5 5 0 1 0-6.76-2.07c.61 1.15 2.55-.72 3.7-.32ZM34.95 32.3c-1.28.44-1.79 3.06-3.07 2.38a5 5 0 1 1 6.76-2.07c-.61 1.15-2.56-.72-3.7-.32Z"
+	/>
+	<path
+		fill="#FF323D"
+		d="M46.96 56.29c9.83 0 13-8.76 13-13.26 0-2.34-1.57-1.6-4.09-.36-2.33 1.15-5.46 2.74-8.9 2.74-7.19 0-13-6.88-13-2.38s3.16 13.26 13 13.26Z"
+	/>
+	<path
+		fill="#3A3B45"
+		fill-rule="evenodd"
+		d="M39.43 54a8.7 8.7 0 0 1 5.3-4.49c.4-.12.81.57 1.24 1.28.4.68.82 1.37 1.24 1.37.45 0 .9-.68 1.33-1.35.45-.7.89-1.38 1.32-1.25a8.61 8.61 0 0 1 5 4.17c3.73-2.94 5.1-7.74 5.1-10.7 0-2.34-1.57-1.6-4.09-.36l-.14.07c-2.31 1.15-5.39 2.67-8.77 2.67s-6.45-1.52-8.77-2.67c-2.6-1.29-4.23-2.1-4.23.29 0 3.05 1.46 8.06 5.47 10.97Z"
+		clip-rule="evenodd"
+	/>
+	<path
+		fill="#FF9D0B"
+		d="M70.71 37a3.25 3.25 0 1 0 0-6.5 3.25 3.25 0 0 0 0 6.5ZM24.21 37a3.25 3.25 0 1 0 0-6.5 3.25 3.25 0 0 0 0 6.5ZM17.52 48c-1.62 0-3.06.66-4.07 1.87a5.97 5.97 0 0 0-1.33 3.76 7.1 7.1 0 0 0-1.94-.3c-1.55 0-2.95.59-3.94 1.66a5.8 5.8 0 0 0-.8 7 5.3 5.3 0 0 0-1.79 2.82c-.24.9-.48 2.8.8 4.74a5.22 5.22 0 0 0-.37 5.02c1.02 2.32 3.57 4.14 8.52 6.1 3.07 1.22 5.89 2 5.91 2.01a44.33 44.33 0 0 0 10.93 1.6c5.86 0 10.05-1.8 12.46-5.34 3.88-5.69 3.33-10.9-1.7-15.92-2.77-2.78-4.62-6.87-5-7.77-.78-2.66-2.84-5.62-6.25-5.62a5.7 5.7 0 0 0-4.6 2.46c-1-1.26-1.98-2.25-2.86-2.82A7.4 7.4 0 0 0 17.52 48Zm0 4c.51 0 1.14.22 1.82.65 2.14 1.36 6.25 8.43 7.76 11.18.5.92 1.37 1.31 2.14 1.31 1.55 0 2.75-1.53.15-3.48-3.92-2.93-2.55-7.72-.68-8.01.08-.02.17-.02.24-.02 1.7 0 2.45 2.93 2.45 2.93s2.2 5.52 5.98 9.3c3.77 3.77 3.97 6.8 1.22 10.83-1.88 2.75-5.47 3.58-9.16 3.58-3.81 0-7.73-.9-9.92-1.46-.11-.03-13.45-3.8-11.76-7 .28-.54.75-.76 1.34-.76 2.38 0 6.7 3.54 8.57 3.54.41 0 .7-.17.83-.6.79-2.85-12.06-4.05-10.98-8.17.2-.73.71-1.02 1.44-1.02 3.14 0 10.2 5.53 11.68 5.53.11 0 .2-.03.24-.1.74-1.2.33-2.04-4.9-5.2-5.21-3.16-8.88-5.06-6.8-7.33.24-.26.58-.38 1-.38 3.17 0 10.66 6.82 10.66 6.82s2.02 2.1 3.25 2.1c.28 0 .52-.1.68-.38.86-1.46-8.06-8.22-8.56-11.01-.34-1.9.24-2.85 1.31-2.85Z"
+	/>
+	<path
+		fill="#FFD21E"
+		d="M38.6 76.69c2.75-4.04 2.55-7.07-1.22-10.84-3.78-3.77-5.98-9.3-5.98-9.3s-.82-3.2-2.69-2.9c-1.87.3-3.24 5.08.68 8.01 3.91 2.93-.78 4.92-2.29 2.17-1.5-2.75-5.62-9.82-7.76-11.18-2.13-1.35-3.63-.6-3.13 2.2.5 2.79 9.43 9.55 8.56 11-.87 1.47-3.93-1.71-3.93-1.71s-9.57-8.71-11.66-6.44c-2.08 2.27 1.59 4.17 6.8 7.33 5.23 3.16 5.64 4 4.9 5.2-.75 1.2-12.28-8.53-13.36-4.4-1.08 4.11 11.77 5.3 10.98 8.15-.8 2.85-9.06-5.38-10.74-2.18-1.7 3.21 11.65 6.98 11.76 7.01 4.3 1.12 15.25 3.49 19.08-2.12Z"
+	/>
+	<path
+		fill="#FF9D0B"
+		d="M77.4 48c1.62 0 3.07.66 4.07 1.87a5.97 5.97 0 0 1 1.33 3.76 7.1 7.1 0 0 1 1.95-.3c1.55 0 2.95.59 3.94 1.66a5.8 5.8 0 0 1 .8 7 5.3 5.3 0 0 1 1.78 2.82c.24.9.48 2.8-.8 4.74a5.22 5.22 0 0 1 .37 5.02c-1.02 2.32-3.57 4.14-8.51 6.1-3.08 1.22-5.9 2-5.92 2.01a44.33 44.33 0 0 1-10.93 1.6c-5.86 0-10.05-1.8-12.46-5.34-3.88-5.69-3.33-10.9 1.7-15.92 2.78-2.78 4.63-6.87 5.01-7.77.78-2.66 2.83-5.62 6.24-5.62a5.7 5.7 0 0 1 4.6 2.46c1-1.26 1.98-2.25 2.87-2.82A7.4 7.4 0 0 1 77.4 48Zm0 4c-.51 0-1.13.22-1.82.65-2.13 1.36-6.25 8.43-7.76 11.18a2.43 2.43 0 0 1-2.14 1.31c-1.54 0-2.75-1.53-.14-3.48 3.91-2.93 2.54-7.72.67-8.01a1.54 1.54 0 0 0-.24-.02c-1.7 0-2.45 2.93-2.45 2.93s-2.2 5.52-5.97 9.3c-3.78 3.77-3.98 6.8-1.22 10.83 1.87 2.75 5.47 3.58 9.15 3.58 3.82 0 7.73-.9 9.93-1.46.1-.03 13.45-3.8 11.76-7-.29-.54-.75-.76-1.34-.76-2.38 0-6.71 3.54-8.57 3.54-.42 0-.71-.17-.83-.6-.8-2.85 12.05-4.05 10.97-8.17-.19-.73-.7-1.02-1.44-1.02-3.14 0-10.2 5.53-11.68 5.53-.1 0-.19-.03-.23-.1-.74-1.2-.34-2.04 4.88-5.2 5.23-3.16 8.9-5.06 6.8-7.33-.23-.26-.57-.38-.98-.38-3.18 0-10.67 6.82-10.67 6.82s-2.02 2.1-3.24 2.1a.74.74 0 0 1-.68-.38c-.87-1.46 8.05-8.22 8.55-11.01.34-1.9-.24-2.85-1.31-2.85Z"
+	/>
+	<path
+		fill="#FFD21E"
+		d="M56.33 76.69c-2.75-4.04-2.56-7.07 1.22-10.84 3.77-3.77 5.97-9.3 5.97-9.3s.82-3.2 2.7-2.9c1.86.3 3.23 5.08-.68 8.01-3.92 2.93.78 4.92 2.28 2.17 1.51-2.75 5.63-9.82 7.76-11.18 2.13-1.35 3.64-.6 3.13 2.2-.5 2.79-9.42 9.55-8.55 11 .86 1.47 3.92-1.71 3.92-1.71s9.58-8.71 11.66-6.44c2.08 2.27-1.58 4.17-6.8 7.33-5.23 3.16-5.63 4-4.9 5.2.75 1.2 12.28-8.53 13.36-4.4 1.08 4.11-11.76 5.3-10.97 8.15.8 2.85 9.05-5.38 10.74-2.18 1.69 3.21-11.65 6.98-11.76 7.01-4.31 1.12-15.26 3.49-19.08-2.12Z"
+	/>
+</svg>
diff --git a/hugo/static/img/providers/linkedin.webp b/hugo/static/img/providers/linkedin.webp
new file mode 100644
index 0000000000000000000000000000000000000000..2fb9f0ddc2ace9b4017a4f59a6b92458a7a0b19f
GIT binary patch
literal 12560
zcmeHtMNl0;vo0aHy9akCXmEE8?(Q7i5AN<7+=E-N;O_2+;O-Dy&f(_2t5<h%7jN-a
zuj;Fwo?c8>b=6e&eDi&mla@x{fP&JN5?9qy<x_lThk|1J82!N1Ox<e*kW9Wg<sJCG
zNDsj@bX2fZM<@7-0$2RJ5^SWaeL?$gGMez*(9|XCn~S2euOHV(YwHqiLNniv9SZzr
z_>Xh<$NRq>`{g!|ep6Wexa)m?bLQ4=Icqgm-KG9DooS0lt+SiENOkjgmWvm^AA%uH
z!m7h3#|LQZZkDIp&DGj*KwqqJ{@w=mL_;nyGeM$jL}qFy;+SUmG9(P;fd+l-fZX^Q
z4Voo)>GV^sKg_=Xb?~5E9t>kHoDh^pRh>NF1~jUoOE4PBUfLo;g$zdcV#Z{6-#Q&a
zE=$(YS?dNoc`hJW*(JCc7E759p?r;w{fAR;UZ^vXste0tADSY^a7fJMJyaNJ&^39v
z3x@2UaWVGrqZv~ZpvPG`(Usq}IKq`5+aN6Cbpv}iX@4HxW|1H}GjJd%bSUpypB!PM
z^^1M}c8_lpK;O6(@N}p*?f3{MmSVBkS}3wQGS~tDZe4%CtR=Tzc5IB~+~X~M+nD$O
z_H=*d<2x1!boGY2ZW#V4h-!~Es``|Hq%p${hqRe(>Xn<uQ^*L9#;EB$b7~z<DD&Im
zIM=W`-0Bz1aRYpKGt!LMsh&Z^XQDDa;-p;v+&*Yndk0Y(0U6dHbJidlUZ}^cPmFPH
z(}YrWL3shweDGQc2Mu2QpIL$iWAa8Czn^LxsaA)}TYJt#*W`+}eLGgIbY*ta6MK~j
zooF10!|R{;cC7JR$#Mo4j(&K{Qu=&NEP+}s*}Yf>$oggRT7!><MyB;r5A~M);c090
zZKt-BkRd4$E+hyFs^6*&u+jP-5U>CDvatfwH}dh(E#4DmHbEVFXAkksqsyuLytZz^
z{^{$<H<E8*m;-8K6cLp;gCj9zozCJ}ZHIH3vfrrFWW6{JFy#4w&WgpK7gGDpPFyK2
zsxfey;-OH%q=oAIIN=UdeT^jjrX)j57_viKWYvf!o!>UWgq9<d*x^XL-&{ciDeXyN
z@CgnJ{D8|ka#~sIsBdO%@q9Gh3fS92BF=GTi@??vrMfF^wZ_wGnM>!JwAS74;eJ?T
z&aSWejS<N<$-bDn)P_U+E>iDEefO<Z^D8rbaz}bOm1q@q?C5+AZ51D)RT$O9vhA3*
z)PNzPTh^phZ(wL^E1dH8L~(jQkk^Gq+YM--xb`*J4T~v?_*3DKI=7nSUSZ6MyO#~x
z2FfZO308|52&71YKp-T(Os}b-NxXrnZU|)$EVX5()q>5yvM$wpVDrqY0rz$f{6u4m
zmceylx=Hh<m6oMauM%@FeuR8{UZ8M>Nmd+zDIbY)p;Xo9GmxolZOY=qZzsB}225S=
zpbQ%u@UCGm{m=#pFK@GD4K^oks~{|Apy#HQ!*-Q_mT{?CZj4r8pe2PFz<SE5(8%0D
zQ}mOc*MhcK%&Bnwf}1I6p{lXN?4pz+#(2O_6Yc?kwv$Ux(1hRq<g)QL0<-3en_l(F
zgXc=s3nsXYmj(RGJo)Wt+Z)<N2mqkdaLtRVG=}sqV@E=}1L?~BVa9Fg71I#bx(((#
z^I(>({^UMm^_^?Rdm+3(G6r{ts`r3nd3(eP*%}qA_CW%@P0~Bp#6<f%b^cAFCMoIi
z+vP3Ti_oFb!}0><{9UD?(BWPR>$SH-Nqwe(OKpIb0C&+Ewy5I!gMXVLX!aOgWAhLO
z2b&FXSrk-^(@58s#b<X9NJP2|hb3`(Rsk+5rtBjM(gwuXU&d||;6@qzW!x_J`z>zr
zH~hGP3id$+ztA9mtmO*`ZIBf@Lk>T{oXtuu4bdP0_n`@M5?cT|JDOz~^A~b$S$@!w
zg<3U>YWR;V{2f07&6C=K55_&sLbo>G?Y&Ao-}F9fz$No9_pl))SW)cEsxiH`87aBo
zxpA{)++R}aEE9sk^Fs@9nJKzW8qrXvla&cg4>5Ft!3*OH?ZZFriGvp<w>O#7TfYkF
zKt1pQ2Ca%@?<Zitdr@&W%GVA<SFcXBNmc<Z%tV8@$A8+XvdmT3!{}jeDCp*+U1K?a
z$uo2D%|PzDlCCnfJrnx0HXh~?om!4CMyg?=rtw*yhCS!x#9WS66M63Hi3Ry9_!80F
zB^cy`%{<y!KyQ+>rixlOth$NWiugx3<Sc*b`-N04!p>E#-Y>j8Mt#HsVK6e>vQ<3N
ziE=%B2oJOnjOVPy1APDUB;rkgH)>GyEanN=$J7^yfe+oY>dD(d$d*VAM0z)RTr7Wl
zghz(@*!_1Qps_pk<3(@icyhEREk5m%b%o0*f&ZdA;s@`7eY3wC=o7<6+1uL(6Mj)I
z^ln77CHDHX4?45qcY2)5T3xh|#;S)Nos7($h{Kn>#uDwB!B;%Mv&NA%x?@?i$&(X(
ziFmQ%kTrSvLE9J%<u)*eqmk1{lI;O(MEtYY4?UfDBQ)qXiojPNMQm8v=aym;s{b{5
zHbn>(kl2eL+WW@{ZY5m@H>#)Ijy#^pIfa!xkE_37OqNDXFC~eCep$T0*yOcSi<`Q@
z2D5N$oVVCF_$(~_lVK}Kwa20s|Df#`aua`V>k`D=A!Gx(Vif6?uvG79;E$rIuc}aQ
z*w!2=eR97<ANw$^$U8GkTh}yEN`kU*=K{{5OXjpxf-gZM>*N`Xqky6FUeta%Uzm2U
z+xQ@M>=R`>6R2sLHI~=zF{-~XUA&TiGzIThxHuMAnQyuk!fNTE@+BFHttd8SoB?@M
z(Mu}iehM&~yT=4|GNuQAR7Br1Fc&GJ_qvjkzozy*vto)f(u(G5(0}!ma1Eu}n}j}8
zA^9ZC5q?<Z4}QR5FIdPEfSUH7Th3{n$Kexco7r>fa~t(|Sf&p$(r@uNJf`@)+mqkJ
zoMeP6Cj^K(Wpuwc`}Ckaud<Wts?pZrxMdV^HnCNUPpNDI?si`|W@}II&OLg86(gg9
zSxa1&y5h6&$}kY>(k%q1KNQyHt<|NX3GbK+IJrMV(@{WQVVg4P;BDs7kk%c-Y*n|q
zw^!Y4mYe>T!0w4vLYR$)*=Y+K{t|No`s2*ZhVfy$>&-pV=}UmrI^eC38+O$O{WlYR
zGlSkqb<DLO^lx!T(Q8xRJ9ea<TW*_Wl-@_ko%~;k=29r|U|0mbm~T!bHH4(}Dc74`
zBT~CCAW{{hNQVtG2Df3$fWk)EOh~0=u9>$v2u#zIDGq#^)Dnz&TybgURNR4#T^OKW
z+wK?Sb=;70WW*bBbZM_}w;#gZh_JMCQVI{ywQrO6D2sIjiuutvvUegKe5kR5Mu_f`
z^<dmor`mkjW%~R8Vu~1Z##x#)XE_4ZYCo@4bT^3~Jf`eO&WL}6+hL^sWLr<kw!1~X
zSdF0L1hfqMgLJI4;@(!K9C-i8pjhu2qdkF#XK$Q7K}tCNa9)zBGEHIr66frmjU~!X
z%#polTK*IZ7|dR$GfLi`&F;`G3}m@uzu-;r;k>A*J(~h~oA>e`iLKQKzZkF8i@2da
zPMRl}iR`6p(q7=-(IGxNWq$_y@9v&By}O=Vvu8>M#><EWnk&q2w;07kdYTwssq6wm
zAtMe^kf<V&lHN1B`%GREFe(kt+;(R~aqqp-{I*2#$@Q_&9NDdyUvaMv7MO-+^y3?3
z_BJr#!|lCb|AXY?_*vwChVDc@{wD$(pDdm0m{RJrYsnHXY!a_3dC4cv5v+$-Gvyu0
zvA0clevii-KfO88<1ZTp^0Tt`;00oOSy%(PUvFb9HY{E16bj$fJ136{789h>cyo~x
zH=7+TA-^}V4`-ZSIs;2eK0dCnA*6iQyYW4D0=tjOY5KZd2^+jl)MQphwWjSP{g|e%
znbQLG;~>L8#-8w2|8pj=)b(ZL9Q^JR1lh}Fc6&sxbGXhBNDTybgoJh*V&T?H_E@|+
zdEEZ)#Fr-1*j}X5Oz{$mzPCf!FJmX2@r2!D;k;I^4}W|9Tq^;$lKTP*@u92oj7~Fl
zxV?=Wkt6$7yT5fu=aWNxDUICEt@BDx^!*o8nxhoD8{2m2O5?uMxel<4Nv-D3MT+e#
z!AIUElHO=<r#3C^)j}38!?~x>?ZL{bZ`TTqy`z0~z|vu?C%-4*1rz6!FhuOU&dZa^
zo6WcjyHUY<GrQvnB4e}pjK)@4EWx0Iv&Z4TTxVKq{}!;P7dlL{nC$=XAX2h&cz0K4
zz>QsRV&K6Q#2@ky%k)hfG|iI>^s87ho$3uw@VA@@ck&S7c)6`K*KNAON(fM7YPxz<
z#`O@rK9FZtw$N3J%C=t;%e$O5)ybUjb1cQ!8WgBSbATvmyen95UsP$TiFi0)AI9Dr
z6P;UWWrp?cb^4nweR4cyG0_aq_VU<S61!5*8TctUdZXp_&{z4{e^uq81uh05kH||v
zK<dkd!0)8rZk55j8}9yR&N82=4fCCk)xxDxmneEyod$Abi|f``>eM2^N(pC<1RBcu
z{P%6Y{o>12TxNfwK}w4eJcxjk&24&p8=Fjd-l-LQ#w@$tkfbf~g<pFN%U@R#%M@Ln
z?!_v@<JkVrm4#r(p|oV7yXkhNG8?8lPH0W~Jk{TGZwQpTM=uquR^V}Ek%r5rdiH?T
zby?277|LtYugfkh6GjHu>0ZCY@>f+C$qt*gG|WRm5QM4(F<&%ef%XbQktBw}7QLzV
zYAn}=TW;D_IzQDyf$xP&(AHlD)iFzogY@<aS0!Tp@UFTqeI;`;!TVl3#A8?F<W`-I
zSsYAbSJ?}34Tt~o<2}}{vG-(RnUnCx%6Aqo2)7<Tqq|2rg#wHBbb{nhu`WH=Z8%5@
zTy1BYu{g``>jUbOtgR*u7U0bj!(2<`-ypr`9RcjZ^B7C9mPccyz(<6t<=$X-$$*5T
zI)A&D&{e|mpR+>^(Cpr>du|U$6h;&$u_Z#BO*moPU*u-f88b7G21&sTvxm_M0Z2m~
zc?c@~2;qA<26#`U0^x0q^SE(d&a7=_0t&bZbQB_(b#4;tvY&jgEep<uU@?k-*m>0}
z@wZ6hH{4mkABzW$`MR){lPlD8?i&J{raq&YW=NwQr$4Iurb_r^T)4$7PR0?H^?JlP
zA&g6$-IXLYJAYakI&DjC{!9-7cr=5IyqL>)YVR<ydNbA}J=LND{3+{SNMKKuwEXo_
ziKOLBgeyC6UfuA$x(3|ERFvH=>dHigc83bN3`1n+OZbSzvBRH>k(N9CttOtQ-k5ZH
zvuA2hOK8}`rX<Vh4SEA`GCQ^;i-W*+jEg+T9Jt!d`q@(~(_2XEkrZFGoz8H7$+-UF
zqWw<B9cYIW%b>Le(Zq7Aj05sG9`PKq=i#>VuDa4Io+BMRXK-W{A#LjGcOy)p%|ort
zS92%4(`fg<Vc*kmN0AD}bzfB7uu!l`;PjcdPi9itAbFhDVf4`Ij~c+4oIK82?4?wZ
zU(M<(^FfMFGLD@<3oLQPCUh&V>f9=(?<u8+l;<u>B@EUbTNcHl!XlO~)>I5s$&Dn_
z>P%@*Cd{#oT;UDB&`jjaUnb(yp<(Z)mkfXJ8O4`Js6{zgCJej`I2=L=vd}WUh2P?!
zHiT5a*Fe9nc1+}LMMe2yqpP2mCiNgqPib^zolR-LnV;2>>7uLXRu}fjUk<4|)({k)
z_4~+kYScb9q#+`m6EYvZID4pTCYE*a)=4L&<qI2}+9Wi|2Kxhwa!YdIbmee{@1(}`
z$js;k=zmpkq-m~!eiU7V)Cve@BFM|5wnAIJm-dFd5!DKbbo48R)e*D6y&vq)YbvP-
z&PLVMU<k;mdncOH(T!@ud%EW4hu4#t(1qT%uzZud-Bo~hO|4#1M7m-9bFhlB5}Y$7
zsYA;9f*3ZvM@xt>`IkKvjI(!_H4bm?5NP$6f#A)~%JmKaZ*FZx8_LcTl#Md7CWp?<
zDc7fC8<okWmc)BRqg|G#+KR~5!9KxrNRt@V6gaAoQOq2X>5$MAxl7a5tgWV1kclF_
z9(kLBl4d!Nr9xmy6h0;&!7w%2l!D8rKPjKFbHT2)fN6c*CvOCAozs-kynn$@NyzlV
zoonbNXi2k5IPLtXR#S>#U9B^YygM~1Ka<$}WKE;Le^Gu;%5=Mbaiq_~w2o!%Q*!`z
zd7P*jifv}m9oOE!AlLfq&3D(7vOT&!+mzDn;^{x0m7Yst{Y7Woh_Ca}c}AXRXuSmn
zN$V?|HMZ_JU#^ll4Zvk3I{nwEuC^BCv>F~NMllVtDv!3!X+Qm&de;G+Do<=Cb&&(F
z(N}EC(JS4q19jEM<t_`siG)KYpYilcyfoBZ8cTZONd*g`kv*!RgI;roc#Or~=tion
z@sIws?^b`$2n6ssvm+Wgrb?L+8fm8_Tcvc!ipo0>-dr7B_btgxc^92K<fy{(a&v|#
zYrgOzYVI)2<>!nkKNB$@+yigYN0s+(9%?Qun0siOv0vETEfIu-`qxBPw-4x6ah2vD
z)ZQ)le&hYcev)+<mZA8I{o?JQi7d8>q)#@is%LIbD3L59v$84JNE(xpP*WtXMoexm
zk&v=LqTQ2EB1H<Pt-?Uvf}mZkBi{y9!{3O*AhzsUR4MiIRX5+&21+B<Cq|H_{0vzQ
z?60`|H684iq}Q)ufiIb-_46!|{OqYi{!ms>lk1T2D~<{fNjERJ;>AJg>RDcLF-P)5
z9`lD5qTwZBV%fsvE}5TH0F(k5Ti8Q*<5E!L7?8?VDXfW0e4!rE5|w73o+`O{Okn>c
z;;txZC00>f?XJ8=3W6Dvfdsh38&T!zyXunCGCOfXauI645$kt7qO1^8O;KINHGPMn
zb;e)E7ZD*p@Hi&AfA+LybB+B%EW{yhETe5QnmJ;8@L_W764r-y9-5o{#zAlzo|}k;
zbWR$ab3reOMs?@nMr+#G@sp68%hMIs3c6BI8iH>1H*Czvg4^ts%kt|26i0m6WPaHD
zj-@t5^V_tPLZXj@bN~!X0j2xO9k$N5+MHS0ZST^wEAqI<+oYxzRnVBqPH6x|MRFyJ
zTFRWZ&ZR(MY5ompKM^I4gnX#=Vh|%`K5TuAi%huq6A?n&!=AYUMO(7i$=c7PO<83g
z9;-y$0R64cgu9RdXI^r7i}xPqKY|9i&SnVX@#23FaoKz^GpI_c+2?OWcRK_uD2lDH
zO@E{Mc}KzVbvkeM#zgXBw7yN-JhP*3x{w8h8x~`PUu&_-h&Pj%b{XdEnmo)5_*C>D
zB7I#5d#L+4(D%AK09<^fAn(m%-`;hrHNG1Rdt+5>@ZH552sozG>5PdU2;6A-<tiks
zLvVxUU!y<Zx7*jLt=sZ|91dFnFrU_I#U|~#GZenja(L7;9Z>Jx^sUXNGiY~BTK=)1
zx#nzB*}^}5pGq0lPEXV)UM3TUH9D+Mv#m7{b6npht^2Qa48+nUHi!q>WwY<6?V~E4
zbJ}Dj?e8_TAih$GCmOdGq>q!ap>%9~$sJ#@oW2@J#x7vCQA-eDX9}kcym4Sk>CI$6
zoIEfJtr@NH8AunB!d)p|I>-A>A}}EDuwh8xR-OH+8bi=?mJwq?u%wN9jFhUYqoH-+
zmPx4|=Zr*Pa-O(Ra?P!jZ!#JAO$ISIp9tH1t;!1@tJ@;OytO>|=0w&?WYpgOlD=pm
zeG6%n5yP#0?(~=bkDgGpr9#)DCHvG6wD04l;?>p%5py*j;<Yk=Rf;$%XQ(cIH}P9|
zg664EI@`{^Duyhdhgo^eBu2<6Db}c7mTz}9jHz7Hx_7cUegA^?wp5KXBh>u|7y89#
zKg_%SUeJlQ{dM><-2b}wovx18=R;?AXL=AAZ6oIEm56bBw0k+Uz;2bNzvgYRTVKGV
zn)&P*h~Jj<x7@|2`P?0`W4I(drxPFYs;;$EInexWh!kEN`8_t}b;-6#{{4I+tO{7C
z(}VZX7CPt=vCt26<nCw56~ZAto}NY%rvIUzV)UmweeNkZC-;3-J3~Wg?2Pvu9_=+*
z;s-*e%Egk)^{kw6$GL6Wv~QujtPzA=<Ys!dZ8@0);1JXBMnBYeXQr->PPj<P%F60E
zlf|K5%9_K=t!4o6df7e<%=|F?zj9s*KK?iK3O?oM`s|Z>D8{y1vjiN2o}S*oK2L8`
za&$lZ?yjymU%|)q;OgOry}cO@5$;-jw8&}$4hysHyNdcL{|U_My9Y5pap}j$f?HRK
z+2^S1o?VK4Y4~hC(+%7BEuW+Da%$dH{<Bj2%?s*-<Mizv8QO9l3M=)u>&A!t<{tV&
zkJp%s>GHRat)airlo_0*TNz{`d`9QL{U2W%W@~wS8*_X;gh~e$&`v5mUScpMoVpI2
zMAI&jPP9s|&q=s`%6}QJD)7$P3&-EpNscdg7`LMNX-<Ti<liR(%-h_Yvb*4Sa#Zl}
z9t<^)`M&8lA@qLTQu!U8f0w~}=5(?|yi!W;AE!54|5!&XT_BD;`$33%HkP^aaTLg%
z&O6PdtXH4GE>P}m-IM0FyLhjz@Dls4w*lj6<nLmt2JNJp@Ag>5lduvGY$CNP!{d$L
z)vyJpY}Sna&9J(5{?=p_PVr8&(Iby~BwE!Zy_?mERuYj<zI8!*7l-;z{h_X3-3IN(
zQx`jd2&xmkL^xW=y}njY2oKRDo=1Ky@0#_3Lxa8xUF%2#%cp~gDrN>As>yt78(HV2
ztkc?juXz7T!N6Qmv+4?a_?r1AWVf`;n&E5CvgaXBIR2K@u5L2dh=e^F*vq(-z)+nl
zZXxY>m`Qm*6;D_vQUdG^u!rS;r2sjo39<x;&+}U<<Lrgn(rb6kG(hL!7B}mrq<ICZ
zNnKpr@zQYMGgN(F(i$4V%BtJyi1}j^bml>NweU)_kK6O%pPbXiHN&Kd&?~1#X>FUU
zUB!N-y%AIYpBVkq?U8eOWv^kCv(d*lSi!O;&r<Q<Wo<zvaf~ynI!~2=VHHXsHPf%&
zlWQr8lvIun!`<%RYf6e4ei7nbPst=KOsDs}xJNQ+oGFi6M6kYGqTlU#_M-J`O`NWJ
z5pWp-<ze4L6wy%$Gp^L9uJ3-545ellHJ}fXD2rxXl+G2ronii+_t*|9{^*WWPiz;q
z`<zj39OfA(BnlX)Qk=m&W&eIT*vt3BS&_7`)hrQ&u#T`iQoZ?{2LC<&?_w3|de@2)
zCswy<3mxy7<X4c;Z&1ecM^&UryS@F=%==%*d$VK1rK8+mpVU%f+dJ$6X&<QZESZ+^
zl(xdO;&cmnY<IvCX_QFwWU6oO1uJ2co?)OW)YbXuZ-{oy(w|Eci?O0l?FLs06sghP
zuk9w4f5=ij8rSmx=B~>zC<0Y4Hw=MTQS-!=wK;zhgh^70c%0tHJ3^1QVV5C!gp_FM
zbn5!vx9lKxUtmjgAV)lx`>g6l`=Q^2Dv1_x$FI-E1nCt#cZ$5a1bm`^<KDFxMwD$W
zz=^I>^uWvC<&2pt1#D$ft(@Px7zsPKRsMO-)H0J8#TZW-0&joG1Cs6t?VRwTnj1q$
zrk5U#5{T2-REfL5!e(>iVu0JkS{t#F2GD_<e{x9oXS<wLB`HL^P`i>R>%GtUGj{b)
z)@GltwzWFD`LXc{mZdMBmaG*Em+S0CD}?tyrFZ@m+TQGk1_efd9@^BRND9GjmHxdx
zQJ>P3)C2;3hu*b$6fVJSH(8L0E&WSKc0_OPVih<rpk%w@^$bO4c4yU&(*x=L(&mEL
zBa9!B=i2dvX-c!AKcbWP<qui8a@a;3&y5eMb{-NsE9W(s%Hyj6$=A#7Uj8qv+!uf{
z<tQoXZs||fVSSRJTkl97@>7hwM`Z~bbi-AZ5nbbiXTRE2iZScYORBNW;}EYYH>%am
z;qUU^_Ln<2{tSCRO`Kh<IsMwLlg%T`tRT4Lf6XQ58nNINRLG;;-Zbz!vGYi%S?kwW
zwF7!&ysN`n@y|w9-dUt%JErrid$P~x4IXP?8rkG4=-1Drj|(ZeS=ukHyZ$s~{VJQs
z#>+hks8!BF^jC5<_nRT`1&O;EYzUv_cC>J?dh2;Cpty4k3nlOa>Sj0w^9=L&K5{Ux
z`jTfz__v@kpSPDQ?_zy_Y?I35304qq^JrAeenE8t=<^2(nroNnpL8!Hx~r6I^r~0P
zaT5NCc+QpRvB_$z1+!J9o@@|o%+$;j2UA3}f|q^VC5w^)YtVF9{*qK1?jE#&o`Jp<
z@jL~1?>PHGJihD`%6(Aw^18ccu<2!z4O9iTe_*qoSQCH2N-5!TzG9x57k6dZYwmaV
zKsUXE?&WXX9qAmknf%oO2@JL41{LW?C8)L)YRAi*IrIGRxjN7S1oMnb*)5=`qXSS7
zgd4e0grz*NnQ6TszW}0iHV(N5pBfJYT&OIb8Y|g9R=h3rF7#Zen4c6}i~je{+5EAB
zP40uSyh$Wa?qd(#GVrV-@Wt{%Wmf8=mBAwLH$GTkZ4ly)0u~5?z|u8{Y-U2Z$;Ke}
z;U~sTIp9;s{q^K&L0wtkzeAdk)(WnaK6>&Xr)c+13}9m2afrM6D{nZ&_8T}y?jyf3
z34BWOx*7o)MmG=CQ~bzJfxv1vi1-V?K2@9)IEsDD$bM)6*9v9|13w}m0BqAhP#(me
z6Z}?;@V01se;s#!tuikXUlv$>vMqeiwiXYzWqW;MzppP30-t)nK5g7P5u?8?THasZ
zo@_(C;<K6u^5;XqJm8HC$SKmRw&KT(+{dfrT7hz5V1f9DXGtIx@_GSUQJ{#z2i$zG
zoa18!_Q|%^{q^9<HuP&n{OR`k>Gu9yZ+%5zF!W<Z<b1E*>yzuhB(D|fr`!J$LIjJf
z90xBhE-uek$y5!y+kgKq4FGSguOlC=tO<*Vq55*^lcZj;_^w2QGd=9t&=1l9le|8W
zzHA2~p0l9ZCs}>kZ3zUwV{r7x<N5WL86ZJ$jEu+BFp@L>u3HAg$e)cA*6aq(uB<%}
z`&i?U@}UvBNI}&VT|P4IHrJCq`&pz+Ec`5u%QJS26%>|oKc!Qt{-62lt3!fVL~knT
zTHA9nqGRR$lmChkF^E7Dt~cxqq)}-v{oP(6geRPb<1XFtAP+C)_hk{C2;$3l8_kUA
zj)D!gHm%1g{m?BNzLUt(kH;U!R$B6g-OQYAOICclL+odV*FNPqE>IOccdq)T@!w|K
zHl8J22r?Dx8_@k2BD!E9BYQfeMx7wmxm{X8V-Eva5|yXlb~z?&cZQyq0ee5odknaO
zzBnhHUiDf>3?&=lVfSqtb8V#8+(ngiGBZT=+!0+scU%rp7-irL85MR{vI=)M@=aZq
zi>jzky9bx9?8yT6Qj-61u!bHTe4xv2-1a--6Z!IJs(>BGhDq+3hkW`3-`M3see<lG
zrGAzK;CeO(J{sYnt4yr<hx-P(vNplN%$xh(P39rR)oGlIX<)HVKb)rb8?e0n?DH@s
zDdf-@Xvt~dmn_3vvOx^BfhpaNX+QkE)h4>d;j;m|f11uz>zn8_@5FP)AE_E^95em}
zuIYQ8ZbjzPtuoOZbI;g7t;Q-hEa%6kIL8fU%yUp3*;Ff62Vh0A#^D@aYF#x{->67u
zBR?nj;@3#)5iv%Y&Q{vLhkZnOD_}Gl7A+6k%omeW|Ju<kdXtHwb!zO<z|t&vlL^z4
zTE^aNLr{vj8A#K|Pq4N{NsR~U#xh2CGy;BZTq&aVM&+)3Ig4H<eK<V%VWxweYgpse
z9|*7Aq{~87s8jR2X5kP{MccBoWj4*5kIW+Urx5RgMyp!^_SZ=EV#t@F-@Hha_6grE
z>toWND67}99-GZhsX~Jut`%+n&2eV8ZcQ%SOG&MUV`p+c=sEyv>5ZQ6H6P^-ubxz(
z5XX={L5*piqC*u71Zj#Z7)IkEKP^sU(KTP{a`(cQi&dD22ho<!+lw~XD7MH-*7D|$
z{E)CZFnLSSu7jg}@E#=T%#sJ$9fy5{e8QdwC@f~K`?WBC%BIy22JLTuko?zdnkO95
z*8W8|!YSw+1j>qpFm<QUbrCGZd}L+Kqb4hcLIkiE*8_V-dMmbuax5HFsx-xqi7ip*
z7d#s~Gx};{gt%b;zBDV^*hE|lykOgi><a_v>75*t)6+N$Dx^jVVhoxLyzDV(37FjE
zLsef7>~$w(K>=~w^xzs(b-ytc^2+Amiv#F6&v__OJ-dID5xJx?T<PgZ;{qb|{2F-z
z4{w5hV$eMliDu3SEvn==7Ksu^Jh-OM9V$+mV5CZK_rUKTy%h(Jg7TolvCJA?2}^3C
zit)`Fo}rd~xQA1l17PLs1;;obQL?Z{Kj7EUK7N|l30*T2v$w`*;fVr3XXg16oLQg&
zo%+woQPOh;S3Z@)Mr05S!pT5k`(PtH@J4`{#2i?{MzRK)B$8~25)1Ll8_fDI<Y6vt
z5UOLuVW#1!Y?3J)(t~)KphRcw;Hqsyh+br%7<od$L4BTlK>^z+JTSapp+%0rhWK|v
zwc&}7S;D+w9w<KaABQWNoNrLc1V9Um*hA+q%x!)aHU>b&!pRQKG_d<_^+7!nLT|Cj
zB(6evy575s&aNEQKYzVfL=8DE$nF(Z+yUy{kXS(Mf(q*4RIK;4r6~f;`tNo|>a(GD
zjE81Kz6O+0{^azqrA4?>Hq;WMPn$J(6_<rjx}35QT!|V$2%{FF6a+BF{}G1(-5s%c
z{ke=bOdQ@~mg7*hMJU^BE+pxu++P<Ad{>HkdqG^u&CjkuOI)(LR){HNc}?&9X)}tt
zMg;N?1PbCflxaLx%%Lz7`59q{>J8MLm>HHPdc)dQz&>{Z<7iBFZMc((@p<Y*W$lHX
zrHI<8hrUzH^$GIeyKid~FSqV|`q_zem3xdm(4we&jN7b15Nm@&8q5bY0~%~KruGR7
zNhx3U^aoPO@ixwMLzsnQ3&!m@1~&B<ZbcR|Mtu`I61CehlPb-i3KTq5y1O(o(dEIL
zG(C;7yR-@kO}6~6c$&v03~sQ?{<ags4f1htCJc+FG|jpb$2)d-3c6v{*vcpwO|W(E
z%$5XoMtP+c2z3G}X;>xz#qXr}I<>MBj3(opu4$`cD{XFRGEysp&S{lnuTD5+OYt=`
zI5fIR{;V-gn7<y2=>dfv2vX}<dW|@T>V?Z`#SRE8DyS0KpICJJRHe<Ug~brV8Z?zu
ziI7@T5hhAP&)X0uq<78~RfS0nsu3o#`yb9=4*UCCq6!5m+w&6&mp-qegnT76$U~41
zbmpd@Cl0m85nD$$_&%rtDzV2BLiC+`kh-T<n9EaAdF?+xKOOhkZNV1$Mqo56rNR@k
z>UnR$(Pfm7|E}b%R6)ma^9t~7!ZG4J9nZMokIH}N^acy~?uD=3&8PAPt-hR&&kmep
zo{sPLpWmL0ckFnu`u=^pVJxQ8@2~zW<m2Vt%`a35UvK8y1m6`9pFb76N_uaB*>yCR
zDt!Z*JQT_NFo3wd%>J(qWMAa}<Nrkkm^cqiJ5E|^aZgSnZN7Cyyv>6K<ih_~I_Cc%
zYr+MhAt?eyB72?iuWt@GU`#e%sX+99%8tNNFKfxbp+orj?K!)9nHntf6DNGYrA#0v
z7!DjizoK_vq4Yq0zsimT21gIUf^Dn!`{%de817g730~DrwZlok;5WPzrys}oFl~r$
z=`V@~=Djc3_6^3QcfAe9fk$Q+ULHp+4F#<()>|lVw$=RqlmZoiwJgohXmHQy#Wv~-
zI5)ck?gev_P!^O#W~&}iP1S2}O%VJ(Vx@!i;{R>1B6+)$^BKM0pC$lK80RV{niJ6H
zKRR_W-=4Tc*-X*yq+@k0U)*C+F!hY^vp&ALM%*8ySFqfox;>-YP5AIIWe0u6G!+wR
z))P!}0A?qX6JrPInDyMjG*caI2obcw+?H*cwErs&FMMrnPn1*bPEYuA1k7qR%5}O2
zYC^P27jIT`b{}wiQW?Ih0#vi^(k2en?^ri2M!5vctUF2qohFTHBOe5p#b-&i&4tWD
zB%bMNG7*M}8@HZShYCXPSE3_Bt|RZa1}Ky$y2&DGKfdv?<&hDgk-YF-FO%$%?F)Wy
zR8@L-LdKKwIsXaArSZ;@w%SLb4RA?&s-45d$RtSQON>nD4Y`G;8z&iYGVP++y@~!3
z=H)6v;-?VC8!`woh`2Tj-`!1kcEm)x%e>um8pQpe_)UzDj(;6@_3QSyVb+<&2)p%e
z>x(dH=;g1LbPqn>R&^;gbXXBdPZ|2T&(}d0{LQQt0Wa_}f;+z>@8{tIkyc@qDRnBm
z))1G|yA9d=L^PfVRxXFAe{N`s_?auN7I?h>vvqW&K__@m9xX7%`pF)b0T{EWUJt|R
z-d80xZUtE~ZbLQoyhd2l9@gMgMYE2A7t9-T=GB>GZ&PX+6gSDb;DcY7Q7Bg-`;cKw
zUtIKIAGQRX0F)S}qbS1%3W5Z0y95#=<iX26%-j!27_Yx8vU~XmSCb^`9|KOjM+mEr
zve*(%jbu_p_$6)jZbPfW@SOmU*fH|~gwF2x_#5M~S`p$s_<)3ss8to>&t$M|%gtgV
z)oL3CE+sqBmRT(2pg4!zvMhi#&)f>pkhDV;+=8r*2aHhH5vr*<O?<!own-?Un_Ewx
zV%x@hWKwk#wR%&jg?`;z&Y=P1vlaw)qiVTaPqGK@bM0wx{~Q?#lf){c37nGl2c&tj
z@?7W&N6pi=5#d)~$thsyy)HT&7(d=*KbiA9itKU%9xOw>T3T@PG&`h67llLIT^)ED
z!s7$?Hj{K;G}llvMXflSzx~sNx~vnfQQz@OTJp|tBVTcnq#m|3_ym{)NUi`Q&apq`
zoH_+0j82R;cLa1G#`}<2Hh+m7K@i~Cwl{C=`_||%aP=r#!{{jer<x2+Ktr47*f!r7
zLrc{3bI-7qVNPT}q?a-0=?e&BZJe$lyY~&@`J9>42&1usZJF4=_Dke+z@A%!wr~3M
z$4jP!Q75q+6W@VryFITqD`5m%LUG-6j0OEwfcn&Odn(H4x0#Ukk;{H9*L%?}?)z;A
zmYm3v+8+W9%Ni{A`sTIcEe=Ax%jmXWs={k+>J#|v-|8Hc_NC~n$1ErHt|@BDo14<X
z^tUnf0d=6i4gi^%#5&)Ph+4-j;)Z1xndS$u7QThYK3?kpY*~91UjfTsEU!V0O|+R6
zpH&`7Zf8pUQ{j#MN?>4YZHw`-X{ANwWJV{DNKVK?u655?heSqc#@v3ZV`)%zyjZLC
z;u1*t^QE&nz5X()pj8`{QU86Uz`WwGZz}{?8<bmhY$A}AbEB%>L|*{dTZANL+eI|^
zU*xVKvi;MLHrM`fVg1GR((S;zsr?`-?^PY!j5@uzqMW-F$hEOF;lcj>Rnx(^cXci-
z(QLK{b_3MSUql61?4;V*S{hHD?~`vG?07&IlM=$Jbx7^iUJ8rqn%1@?2Jf+YpBQVK
z<_MJ`<MA&MISg(b4~TV^t(CWFn-`*My*g}wmuhckU6}k^AFeipqx|7&PMW|4-_yf{
zLe+%@La}2zDe{|osMf_CluPGlBx0^6(Dnn*5`)|mR96SkEW~D&Nk?p7kJFLYDsxqN
zakiQDUq5+rZ9eu`j+IvyHwER*9{mpfc@!Pp*(7l$a(OmHlb`*OCE@4!eUm}zjw<`u
zA)nFYm|M8ah6zQz$%ipB59B9qbw}^3d(5)ww!ZFRY@m%P!D8fL3uF}-NM($D8e%%X
z_t&Hl7{40hgmj=(q@k{8882ITtOsB5m-RT|6d2S|&I=<8tQR=`(=Vqs9F+T?8(%bG
z8}U7XzC;VLr}+K*aI46lzNk_8r|P^Kj+esKr$~y_a5CDiBhv7^5J@5eURLdIp}M`l
zw`;DFz8%i{^@%Nu2SQ>zP|g1yB~rw#z59TPrTz9^TKxLPGs^f$%9EY--k9otl1Eh8
igNjex`J=z2{Ieh}b^qNMZLS*svynk}ovQFl+W!KaBc?C_

literal 0
HcmV?d00001

diff --git a/test/e2e/signin.spec.ts b/test/e2e/signin.spec.ts
index f4ed3b0ff..53e7874d6 100644
--- a/test/e2e/signin.spec.ts
+++ b/test/e2e/signin.spec.ts
@@ -38,11 +38,11 @@ describe.skipIf(!hasBaseUrl())('e2e: /signin page (IAS social login, #2506)', ()
       // URL → IAS routes straight to that provider). Google/X are IAS social
       // tiles (not idp-addressable) and live behind the "More options" pass-through.
       const buttons: Array<[string, string]> = [
-        ['Sign in with SAP Universal ID', '/login?sap_idp=sap.default'],
-        ['Sign in with GitHub', '/login?sap_idp=GitHub'],
-        ['Sign in with LinkedIn', '/login?sap_idp=LinkedIn'],
-        ['Sign in with Hugging Face', '/login?sap_idp=Hugging%20Face'],
-        ['More options (Google, X, & more)', '/login?sap_idp=sap.custom'],
+        ['Continue with GitHub', '/login?sap_idp=sap.custom,GitHub'],
+        ['Continue with Google', '/login?sap_idp=sap.custom'],
+        ['Continue with Hugging Face', '/login?sap_idp=sap.custom,Hugging%20Face'],
+        ['Continue with LinkedIn', '/login?sap_idp=sap.custom,LinkedIn'],
+        ['Continue with SAP ID', '/login?sap_idp=sap.default'],
       ];
       for (const [name, href] of buttons) {
         const link = page.getByRole('link', { name, exact: true });

From 508a8679727dc76d51e56524a3281b925121080a Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 19:12:56 -0400
Subject: [PATCH 44/46] feat(auth): Google deep-link on /signin (now corporate
 OIDC)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Google was converted from an IAS social tile to a corporate 'OpenID Connect Compliant' IdP (discovery accounts.google.com, Client ID reused from the social tile, scopes openid profile email, callback registered in the Google OAuth app). Validated 3/3 on IAS; claims confirmed: real verified email + given_name/family_name/name + numeric sub (no preferred_username, so the GitHub-only resolver path is not triggered — Google resolves via the existing email tier, no Phase-2 change needed).

Flips the /signin Google button to the chain form sap_idp=sap.custom,Google so it deep-links to Google instead of the IAS page. Updates the e2e assertion + layout comment.
---
 hugo/layouts/signin.html | 6 ++----
 test/e2e/signin.spec.ts  | 2 +-
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/hugo/layouts/signin.html b/hugo/layouts/signin.html
index b996bf640..e202c709d 100644
--- a/hugo/layouts/signin.html
+++ b/hugo/layouts/signin.html
@@ -25,9 +25,7 @@ <h1 id="signin-title" class="signin-title">Sign In</h1>
             sap_idp=<Name> does NOT work (XSUAA has no such origin → falls through
             to default). Deep-linkable today: GitHub, LinkedIn, Hugging Face.
           - SAP ID = direct XSUAA trust origin sap.default.
-          - Google is NOT yet a corporate OIDC IdP in IAS (it's a social tile, not
-            idp-addressable), so its button routes to sap.custom (the IAS page) where
-            Google appears. Convert it to corporate OIDC to make it a true deep-link.
+          - Deep-linkable corporate OIDC IdPs: GitHub, Google, Hugging Face, LinkedIn.
             Apple is intentionally omitted (requires a paid Apple Developer account).
         NOTE: an existing IAS SSO session can be reused instead of honoring the
         chosen IdP (IAS prompt=login would force it, but the approuter does not
@@ -37,7 +35,7 @@ <h1 id="signin-title" class="signin-title">Sign In</h1>
         <img class="signin-logo" src="/img/providers/Github.svg" alt="" aria-hidden="true" width="20" height="20" />
         <span>Continue with GitHub</span>
       </a>
-      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom">
+      <a class="fd-button fd-button--transparent signin-btn" data-signin-idp href="/login?sap_idp=sap.custom,Google">
         <img class="signin-logo" src="/img/providers/Google.svg" alt="" aria-hidden="true" width="20" height="20" />
         <span>Continue with Google</span>
       </a>
diff --git a/test/e2e/signin.spec.ts b/test/e2e/signin.spec.ts
index 53e7874d6..8730e115d 100644
--- a/test/e2e/signin.spec.ts
+++ b/test/e2e/signin.spec.ts
@@ -39,7 +39,7 @@ describe.skipIf(!hasBaseUrl())('e2e: /signin page (IAS social login, #2506)', ()
       // tiles (not idp-addressable) and live behind the "More options" pass-through.
       const buttons: Array<[string, string]> = [
         ['Continue with GitHub', '/login?sap_idp=sap.custom,GitHub'],
-        ['Continue with Google', '/login?sap_idp=sap.custom'],
+        ['Continue with Google', '/login?sap_idp=sap.custom,Google'],
         ['Continue with Hugging Face', '/login?sap_idp=sap.custom,Hugging%20Face'],
         ['Continue with LinkedIn', '/login?sap_idp=sap.custom,LinkedIn'],
         ['Continue with SAP ID', '/login?sap_idp=sap.default'],

From 9abb1df57bf80e867f14552e2547732f334ba815 Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 19:54:48 -0400
Subject: [PATCH 45/46] chore(deploy): enable GITHUB_OIDC_ENABLED on the PROD
 approuter

Adds GITHUB_OIDC_ENABLED: "true" to the tutorials-approuter properties: block in deploy/prod.mtaext (mirrors dev.mtaext). Without it the GitHub-OIDC shim is an inert no-op in PROD. properties: not env: (MTA drops module-level env). Final code change needed before the PROD GitHub-login rollout; shim secrets live in the PROD credstore. The /signin entry-point wiring is already in place (header.html routes deliberate sign-in to /signin).
---
 deploy/prod.mtaext | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/deploy/prod.mtaext b/deploy/prod.mtaext
index f486d085c..b5999b025 100644
--- a/deploy/prod.mtaext
+++ b/deploy/prod.mtaext
@@ -65,6 +65,15 @@ modules:
       # `openid` (IAS JWTs carry no scopes), vs the XSUAA `<xsappname>.Everyone`
       # form. MUST be 'ias' because XSUAA_MCP_URL points at an IAS tenant.
       MCP_ISSUER_KIND: ias
+      # GitHub-OIDC shim toggle (approuter/lib/github-oidc-shim.js) — mirrors
+      # dev.mtaext. Read via process.env at call time; off ⇒ inert no-op. MUST be
+      # a `properties:` entry, NOT `env:` (MTA silently drops module-level env).
+      # The shim is host-relative, so the PROD approuter serves a valid shim at
+      # the prod host; the shared-tenant IAS GitHub IdP's Discovery URL is pointed
+      # at this prod host (see the PROD topology decision). Secrets (GITHUB_CLIENT_ID
+      # /SECRET, GITHUB_OIDC_SIGNING_KEY, GITHUB_OIDC_STATE_SECRET, GITHUB_OIDC_IAS_
+      # CLIENT_ID/SECRET) live in the PROD BTP Credential Store, never here.
+      GITHUB_OIDC_ENABLED: "true"
     parameters:
       app-name: tutorials-prod-approuter
       instances: 2

From 9a512ff51c27f0fa1774421300b9564a8261d39e Mon Sep 17 00:00:00 2001
From: Thomas Jung <thomas.jung@sap.com>
Date: Sat, 3 Oct 2026 20:07:39 -0400
Subject: [PATCH 46/46] chore(release): bump deploy version to 1.34.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Minor bump for the GitHub-login + RPT-style /signin feature release (new sign-in page, GitHub/Google/Hugging Face/LinkedIn corporate-OIDC deep-link buttons, GitHub-OIDC shim, CAP identity linking). Precedes the DEV->main release promotion + PROD blue-green deploy. The user-facing changelog (hugo/data/whats_new.json) is generated from merged PRs by build:whats-new-snapshot — no hand edit.
---
 .deploy/mta.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.deploy/mta.yaml b/.deploy/mta.yaml
index 778979a4e..704a2d421 100644
--- a/.deploy/mta.yaml
+++ b/.deploy/mta.yaml
@@ -10,7 +10,7 @@ ID: tutorials-ims
 # Bump this on each release you deploy — it's the version shown by `cf mtas`
 # and in the mtar filename (tutorials-ims_<version>.mtar). Deploy is manual:
 # `cd .deploy && mbt build && cf deploy mta_archives/tutorials-ims_<version>.mtar -e ../deploy/<env>.mtaext -f`.
-version: 1.33.0
+version: 1.34.0
 
 # Top-level parameters (overridable per-env via deploy/<env>.mtaext).
 parameters: