chore: bump version to 4.0.0, update in-range dependencies - #361

…kage.json, CHANGELOG

- README: add breaking-change notice with guidance to use 3.x for old mindsphere.io URLs
- package.json: update description to mention the breaking change
- CHANGELOG: clarify 3.x fallback guidance

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Introduces backward-compatible support for the new Xcelerator
siemens.app/sws.siemens.com URL scheme, gated entirely on the
presence of a configured systemId:

- Add DEFAULT_SYSTEM_ID and systemId threading through auth config,
  credential entries, and MindSphereCredentials
- Rewrite getPiamUrl and addAndStoreConfiguration to build new-scheme
  gateway/PIAM URLs only when systemId is set, otherwise preserve
  legacy behavior unchanged (on-premise and existing tenants unaffected)
- Add GetSystemId() across auth classes (credential, tokenmanager,
  user, frontend, browser, agent auth) and thread it through
  TokenManagerAuth/CredentialAuth construction
- Add SdkClient.GetServiceBaseUrl() helper and convert all ~30 SDK
  client _baseUrl fields to getters using it; special-case
  messagebroker (v4 legacy / v5 new) and notification (api prefix)
- Fix stray hardcoded /api/... URLs in agent-auth, mindconnect-agent,
  mindconnect-setup, mcapi Ingest(), multipart-uploader, and
  tenant.ts logo URL to use the new base-url helpers
- Add --system-id CLI flag to mc-service-credentials and matching
  System Id field in the web credential config UI

Validated with tsc, ts:build, browser:build, and npm run sanity
against the live legacy castidev tenant (28 passing, 9 pending,
2 pre-existing unrelated failures - unchanged baseline).

Still pending: docs/CHANGELOG updates for --system-id, live
verification against an actual new-scheme tenant.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…emId)

Live testing against a real Xcelerator tenant revealed that the OAuth/PIAM
identity zone id (used to build https://<id>.<region>.sws.siemens.com/ auth
urls) can be a genuinely different id than the API systemId (used to build
https://api.<region>.siemens.app/<service>-<id>/v<version> urls) for the
same tenant. The migration docs only document a single, misleading example
id that is not a shared constant.

- AuthBase/CredentialAuth/TokenManagerAuth: accept an optional _oauthSystemId
  constructor param (falls back to _systemId when not set) and use it only
  for getPiamUrl (oauth/token, token_keys). TokenManagerAuth's own
  technicaltokenmanager exchange keeps using _systemId, since that call is
  against the API gateway domain, not the PIAM zone.
- MindSphereCredentials/authJson/credentialEntry: add optional oauthSystemId
  field, threaded through SdkClient's CredentialAuth/TokenManagerAuth
  construction.
- CLI (mc-service-credentials): add --oauth-system-id / -z option.
- Config UI (index.html/scripts.js): add an "OAuth System Id" field to the
  add-credentials dialog and the list item display, with help text
  explaining the distinction and pointing users at their Insights Hub
  administrator if authentication fails.

Also fixes a bug where bindList() mutated the live in-memory credential
objects with display-only placeholder strings ("(none)", "(same as System
Id)"), which saveData() would then persist verbatim into auth.json,
corrupting the real systemId/oauthSystemId values on save. bindList() now
renders from a shallow copy instead.

Bump MC_VERSION to 4.0.0 (src/version.ts) to match package.json; it was
missed during the earlier version bump and still showed 3.24.2 in
`mc --version`, the User-Agent header, and the config UI title.

Add System Id display to the credential list view and pre-fill the add
dialog's System Id field from the server's configured default
(GET /sc/config now also returns defaultSystemId).

Verified end-to-end: added real Xcelerator technical user credentials with
distinct systemId/oauthSystemId via the CLI, successfully acquired an access
token (mc service-token) and confirmed the full sanity suite is back to the
established baseline (28 passing / 9 pending / 2 pre-existing unrelated
failures) after the corrupted local config was repaired.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…rTenantId

Renames the two Xcelerator ids introduced for the siemens.app URL migration
to clearer, distinct names:
- systemId (API system id, used in service URL paths like
  /assetmanagement-<id>/v3) -> coreTenantId
- oauthSystemId (OAuth/PIAM identity zone id, used in the
  <id>.<region>.sws.siemens.com auth urls) -> customerTenantId

This affects MindSphereCredentials/AppCredentials/ServiceCrendtials fields,
the auth.json/credentialEntry config format, the AuthBase-derived classes'
constructor params and GetCoreTenantId()/GetCustomerTenantId() getters (was
GetSystemId()/GetOAuthSystemId()), the CLI flags (--core-tenant-id/-x,
--customer-tenant-id/-z, was --system-id/--oauth-system-id), and the config
web UI labels/fields.

Not renamed (intentionally): OnboardingConfigurationContent.systemId in
mindconnect-models.ts and AgentAuth's GetSystemId() field access - these
read/represent the actual onboarding file JSON key as issued by the server,
which must not be renamed independently of the server's own wire format.

No functional change; this is unreleased (4.0.0 is still unpublished), so no
migration/back-compat shim is needed for the new field names.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Service credentials are no longer deprecated, so remove the '(deprecated)'
label from the config UI and rename the term to 'technical user
credentials' throughout the config UI, README.md, and CLI help/error text.

No functional change: the underlying credential type value (SERVICE) and
the mc service-credentials command name are left as-is.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Update the Core Tenant Id / Customer Tenant Id descriptions (config UI and
CLI --core-tenant-id/--customer-tenant-id help) to:
- explain both ids are visible in the URL of any Xcelerator app for the
  tenant, e.g. https://<customerTenantId>-settings-<coreTenantId>.<region>.siemens.app/
- clarify the tenant name field is unrelated to and not needed for these
  ids when using technical user credentials against an Xcelerator gateway.

No functional change.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…dentials

Previously the add-credential dialog was a single shared form where
switching the 'Credentials' radio button only hid/showed the app-only
fields (User Tenant, Application Name, Application Version), while all
other inputs (User, Password, Gateway, Core/Customer Tenant Id, Tenant)
were shared and re-labeled generically ('for application credentials'
regardless of the selected type).

Split the dialog into two fully independent field groups
(#appCredentialFields / #serviceCredentialFields), each with its own
inputs, ids, and type-specific descriptions, toggled completely by the
radio selection via showCredentialType(). addNew() now reads from the
active group's fields based on the selected type.

No change to the underlying credential data model or auth logic.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Trim the overly long help text for Core Tenant Id / Customer Tenant Id
in both the Application and Technical User credential forms down to
one or two sentences, keeping the essential info (what it is, where to
find it, when it's needed).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The config UI, CLI help, and JSDoc comments incorrectly implied that
leaving Customer Tenant Id empty and falling back to Core Tenant Id is
a normal/working setup ('the common case where both ids are equal').
In practice the OAuth/PIAM zone id and the API system id are
provisioned independently and are effectively always different for
Xcelerator tenants, so that fallback does not produce a working auth
url. Reworded all of these to state the customer tenant id must
normally be set explicitly, without changing the fallback code itself.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

…enant id

Reuse the same 'Found in the URL of any Xcelerator app, e.g. <url>' phrasing
for Customer Tenant Id as already used for Core Tenant Id, instead of the
vaguer 'Same URL, first number.'

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Reorder the Customer Tenant Id / Core Tenant Id fields (in both the
Application and Technical User forms) and the saved-credentials list
display to match their order in the Xcelerator app URL:
https://<customerTenantId>-settings-<coreTenantId>.<region>.siemens.app/

No functional change.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

- agent-auth.ts: validate the jku header host against our own
  coreTenantId-derived Siemens domain (or MDSP_TRUSTED_JKU_HOSTS
  override) before fetching a signing key from it, closing a
  header-injection signature-bypass vector while staying compatible
  with different Xcelerator stamps/regions.
- Config webserver: add the missing Customer Tenant Id field to the
  Application Credentials form, fix addNew() silently dropping
  customerTenantId for APP credentials, and correct misleading
  fallback text.
- README: document the 4.0.0 Xcelerator gateway migration as
  best-effort compatible (recommend 3.x for on-premise), explain the
  tenant-id distinction and the jku fallback/override, annotate the
  onboarding example with the fds object, and refresh the
  configuration screenshots.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

MultipartUploader.GetGateway() read content.baseUrl directly instead of
agent.GetGateway(), bypassing the Xcelerator fds.baseUrl preference that
agent.GetGateway() already implements. Since IotFileBaseUrl() builds the
/iotfile-{coreTenantId}/v3 path that only exists on the Xcelerator
gateway, this made UploadFile()/multipart uploads fail with
"Requested Endpoint Not Found" for any Xcelerator-onboarded agent.

Verified by onboarding a real Xcelerator agent (tppnd11) and uploading a
15MB file via chunked multipart upload - previously failed with a 404,
now succeeds. Sanity suite unaffected (28/9/2, same as baseline).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Two bugs found while auditing cookie-based auth (BrowserAuth/FrontendAuth)
for the same class of issue as the multipart-uploader gateway bug:

1. BrowserAuth.GetCoreTenantId() always returned "" instead of parsing the
   real core tenant id embedded in the app hostname
   (<customerTenantId>-<appName>-<coreTenantId>.<region>.siemens.app).
   Without it, embedded/cookie-authenticated apps on Xcelerator tenants
   built legacy (now-broken) paths.

   Added extractCoreTenantIdFromHostname() in utils.ts and used it in both
   BrowserAuth.GetCoreTenantId() and command-utils.ts (FrontendAuth, used
   for MDSP_HOST/MDSP_SESSION/MDSP_XSRF_TOKEN-based mc commands).

2. GetServiceBaseUrl() only prepended "/api/" for messagebroker/notification
   via an opt-in apiPrefix option, but real Xcelerator app subdomains
   require the "/api/" prefix for every service, even once the coreTenantId
   is embedded in the path. Made "/api/" prefixing unconditional for the
   new coreTenantId scheme and dropped the now-obsolete apiPrefix option
   from its two former callers.

Verified live against a real Xcelerator tenant (tppnd11): replicated the
exact BrowserAuth logic inside the live embedded Asset Manager app page
(hostname parsing + XSRF cookie header + computed path) and confirmed a
200 response with real asset data, where the previous logic would have
produced a 403. Full sanity suite rerun against the castidev baseline
credential: 28 passing / 9 pending / 2 failing, unchanged from baseline.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Live testing against a real Xcelerator tenant revealed that its actual
session cookie is now named gw_session, not SESSION. The SDK's
"borrowed cookie" auth flow (FrontendAuth, used by
MDSP_HOST/MDSP_SESSION/MDSP_XSRF_TOKEN and mc dev-proxy --mode session)
hardcoded a Cookie: SESSION=... header, which a gateway/Xcelerator
tenant does not recognize (confirmed 401), while gw_session=... alone
succeeds (confirmed 200).

Since legacy tenants still expect SESSION and Xcelerator tenants expect
gw_session, and a tenant type is not otherwise known at this layer, both
cookie names are now sent together (confirmed harmless/still 200) so a
borrowed session works regardless of which scheme the target tenant uses.

Verified live: the real FrontendAuth class, using a borrowed gw_session +
XSRF-TOKEN value from a live Xcelerator tenant, successfully authenticated
and returned real asset data via GetAssetManagementClient().GetAssets().
Sanity suite rerun against the castidev baseline credential: 28 passing /
9 pending / 2 failing, unchanged from baseline.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Update the --session/--host option help text and README dev-proxy docs
to note that Xcelerator (.siemens.app) tenants name their session
cookie gw_session instead of the legacy SESSION, and that the CLI now
sends both cookie names so a borrowed session works on either scheme.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The full-documentation link printed by mc --version/--help, the demo
notification message, and the tenant list all pointed at
industrial-iot-open-source/index.html, which does not resolve. The
correct page is industrial-iot-open-source/overview.html.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Replaced user-facing "MindSphere"/"mindsphere" mentions with "Insights
Hub" across command descriptions, option help text, --help example
blocks, generated markdown docs, and console/log messages shown during
command execution (e.g. "Edit the file before submitting it to ...",
demo notification content, verbose logs).

Left unchanged (not user-facing branding text):
- Code identifiers (MindSphereSdk, MindSphereModels, toMindSphereDataType, etc.)
- The MindSphereStandardEvent API type constant and its
  com.siemens.mindsphere.eventmgmt... value (actual API contract data)
- Documentation URLs (developer.mindsphere.io, documentation.mindsphere.io,
  github.com/mindsphere/...)
- The "MindSphere GitHub" link label in tenant.ts, since it accurately
  names the linked github.com/mindsphere/ organization

Verified with a full source typecheck/build (in-place and dist/), a
sanity suite rerun against the castidev baseline credential (28 passing/
9 pending/2 failing, unchanged), and manual inspection of mc --help and
several subcommands' --help output to confirm text and doc links are
correct.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

… Xcelerator tenants

The CLI built app-subdomain links (Asset Manager, Operations Insight,
Settings, agent onboarding) by taking the gateway URL and doing a
literal string .replace("gateway", "<tenant>-<appName>"). This only
worked for legacy gateway hostnames like
gateway.<tenant>.<region>.mindsphere.io, which literally contain the
substring "gateway".

Xcelerator gateways (https://api.<region>.siemens.app) don't contain
that substring, so the replace was a silent no-op, producing broken
links such as https://api.eu1.siemens.app/entity/<id> instead of
https://<customerTenantId>-<appName>-<coreTenantId>.<region>.siemens.app/entity/<id>.

Added SdkClient.GetAppUrl(appName, path) as a shared helper: it keeps
the old legacy replace() behavior when no coreTenantId is configured,
and builds the correct Xcelerator app-subdomain URL (using both
coreTenantId and a new no-fallback customerTenantId accessor) when it
is. Returns "" if the Xcelerator info needed to build the link isn't
available, rather than guessing a wrong URL.

Updated all affected call sites (asset-info.ts, assets.ts,
subtenant.ts, tenant.ts, and the shared agentConfigLog used by
mc-create-agent/mc-offboard-agent/mc-renew-agent/mc-automap) to use
the new helper, preserving mc-automap's special "southgate" legacy
replace token for its non-passkey auth mode.

Verified generated Xcelerator URLs against a real tenant, matching
the known-working pattern
(1263225466-assetmanager-1000001700.eu1.siemens.app). Sanity suite
baseline (28 passing / 9 pending / 2 failing) unchanged with castidev
credentials.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

The OS Bar JS (used by the service-credentials config webserver) was
still loaded from the legacy static.eu1.mindsphere.io host. Per the
official OS Bar migration notes, static resource hosting moved to
static.ih.eu1.siemens.app; the legacy host may be retired eventually.

The mdsp-css design system stylesheet is intentionally left on the
legacy host: it returns 403 Access Denied on the new host since it was
never migrated there (mdsp-css/UXT has reached end of service and is
being superseded by the open-source Siemens iX design system, which
would require a full component-level rewrite of this page rather than
a URL swap).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

.npmignore had unanchored src/, test/, and templates/ patterns meant
to exclude the repo's top-level TypeScript source, test, and template
directories from the published package. Because npmignore (like
gitignore) matches unanchored patterns at any depth, these same rules
also matched the compiled dist/src/, dist/test/, and dist/templates/
directories, silently excluding the entire built output (main,
browser, and types entry points, plus the bin script's dependencies
from every npm publish.

Verified with npm pack --dry-run: before this fix the tarball
contained only 10 root-level files; after the fix it contains 632,
matching the last known-good published release (3.24.2) and including
dist/src/index.js, index.bundle.js, index.d.ts.

Also added url-migration-review.md (a local-only working notes file,
already gitignored) to .npmignore, since it was untracked and leaking
into the tarball.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
EOF
)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>