fix(tests): use fake timers for sleep

Closes #1684

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

chore(deps): update minimatch to 10.2.2

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): update all non-major dependencies (#1682)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: make eslint works again

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): update vulnerable dependencies

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): apply updates

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): lock file maintenance (#1681)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1680)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1678)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

[Hyperspace] 🤖 Add PR Bot Configuration (#1677)

Co-authored-by: hyperspace-insights[bot] <209611008+hyperspace-insights[bot]@users.noreply.github.com>

chore: release main (#1676)

* chore: release main

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

fix: guard setInterval delays against 32-bit integer overflow

chore: release main (#1651)

* chore: release main

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

fix(tests): use robust threshold test instead of exact boundary

The exact boundary test was flaky on Windows due to JSON serialization
size differences. Use a clearly-below-threshold payload instead.

refactor(tests): harmonize UI server tests with codebase style

- Add helper functions to reduce duplication (createHttpServerConfig, createLargePayload)
- Add waitForStreamFlush() utility for async stream tests
- Add GZIP_STREAM_FLUSH_DELAY_MS constant with documentation
- Remove low-value constant assertion tests
- Add edge case tests for compression boundary and context cleanup
- Harmonize test names to 'Verify X' style
- Use Reflect.get() instead of unsafe double cast
- Replace eslint-disable with proper guard pattern

fix(tests): use bodyBuffer for binary gzip data in MockServerResponse

Buffer.from(string, 'binary') loses data on Windows due to encoding
differences. Store raw Buffer directly for binary content like gzip.

chore: lock file maintenance

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

feat(ui-server): add transparent response compression

- HTTP: gzip compression for responses > 1KB (Accept-Encoding negotiated)
- WebSocket: perMessageDeflate with memory-optimized settings
- Add DEFAULT_COMPRESSION_THRESHOLD constant (1KB)
- Add tests for compression and security constants

refactor(ui-server): unify HTTP and WebSocket payload size limits

Merge DEFAULT_MAX_BODY_SIZE and DEFAULT_WS_MAX_PAYLOAD into single
DEFAULT_MAX_PAYLOAD_SIZE constant (1MB). Both represent the same
semantic: UI protocol payload limit over different transport layers.

Also increases WebSocket limit from 100KB to 1MB to match HTTP,
allowing ~200-300 charging stations in list responses.

style(ui-server): remove verbose JSDoc comments for codebase consistency

fix(ui-server): prevent rate limiter memory leak

Add maxTrackedIps limit with lazy cleanup to bound memory usage.
Reject new IPs at capacity after cleanup (DoS protection).

feat(ui-server): add HTTP body size and rate limiting

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

feat(ui-server): add numberOfStations upper bound validation

- Add validation check for numberOfStations parameter (max 100)
- Import isValidNumberOfStations and DEFAULT_MAX_STATIONS from UIServerSecurity
- Returns error message when numberOfStations exceeds limit
- Addresses VULN-12: numberOfStations resource exhaustion

feat(ui-server): configure WebSocket max payload limit

fix(ui-server): use timing-safe credential comparison

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

test(ui-server): add UIServerSecurity unit tests

- Add 14 unit tests covering all UIServerSecurity functions
- Test isValidCredential (matching, non-matching, edge cases)
- Test createBodySizeLimiter (under/over/exact boundary)
- Test createRateLimiter (under/over limit, window reset)
- Test isValidNumberOfStations (valid/invalid ranges)
- All tests pass (152ms execution time)

feat(ui-server): add UIServerSecurity utility module

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-opencode)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

chore(deps): update all non-major dependencies (#1675)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): lock file maintenance (#1674)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1673)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1672)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency eslint-plugin-jsdoc to ^62.5.3 (#1670)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency jsdom to v28 (#1668)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1669)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1667)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1666)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update autofix-ci/action digest to 7a166d7 (#1665)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update dependency vue-router to v5 (#1663)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: lock file maintenance

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): lock file maintenance (#1664)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1662)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: update openspec artifacts

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(openspec): add project context to config

chore: update OpenSpec

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): lock file maintenance (#1656)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1661)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1660)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: lock file maintenance

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

fix(deps): update all non-major dependencies (#1657)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

build(deps): bump tar from 7.5.3 to 7.5.4 (#1658)

Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.3 to 7.5.4.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.3...v7.5.4)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Merge pull request #1654 from SAP/renovate/npm-tar-vulnerability

chore(deps): update dependency tar to v7.5.3 [security]

Merge branch 'main' into renovate/npm-tar-vulnerability

Merge pull request #1655 from SAP/renovate/all-minor-patch

chore(deps): update all non-major dependencies

chore(deps): update all non-major dependencies

chore(deps): update dependency tar to v7.5.3 [security]

chore(deps): update all non-major dependencies (#1652)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: update OpenSpec artefacts

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

fix(deps): update all non-major dependencies (#1650)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: release main (#1645)

* chore: release main

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

fix: Change connector boot status to be available at boot (#1641)

* fix: connector boot status available by default

* fix: connector boot status available by default

* chore: add unit tests to getBootConnectorStatus

* fix: refine connector boot status logic based on reviewer feedback

- Restore charging station and connector availability checks
- Only restore previous status when transaction is in progress (transactionStarted === true)
- Add isChargingStationAvailable() method to test factory
- Add comprehensive tests for all scenarios including:
  - Charging station/connector unavailable
  - Transaction in progress (restore previous status)
  - Boot status from template
  - Default to Available

Addresses review feedback from PR #1641 about properly handling:
- Station/connector availability
- Conditional previous status restoration
- Transaction state considerations

* refactor: remove redundant comments from getBootConnectorStatus

---------

Co-authored-by: Jérôme Benoit <jerome.benoit@sap.com>
Co-authored-by: Jérôme Benoit <jerome.benoit@piment-noir.org>

Merge pull request #1648 from SAP/renovate/lock-file-maintenance

chore(deps): lock file maintenance

chore(deps): lock file maintenance

Merge pull request #1649 from SAP/renovate/all-minor-patch

chore(deps): update all non-major dependencies

chore(deps): update all non-major dependencies

Merge branch 'fix/config-read-hardening'

fix: improve configuration file validation and error handling

- Add validation for null/empty configurations after parsing
- Add validation for missing configurationHash before caching
- Add fallback to cached config on file read errors with warning
- Remove non-null assertion on configurationHash assignment

fix: harden ChargingStation null-safety

test: adjust tolerance for delay checks

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): update dependency @types/node to ^24.10.7 (#1646)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: refine renovate config

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): update dependency eslint-plugin-jsdoc to v62 (#1640)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: ensure proper cleanup of BroadcastChannel resources in AbstractUIService tests

Add service.stop() calls to all AbstractUIService tests to properly close
BroadcastChannel instances. On Windows, unclosed BroadcastChannel handles
can cause test freezes due to unfreed system resources. This ensures proper
cleanup after each test completes.

chore(deps): update all non-major dependencies (#1644)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: lock file maintenance

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore: release main (#1478)

* chore: release main

* [autofix.ci] apply automated fixes

---------

Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1639)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: ui websocket server stops responding to broadcast procedures (#1643)

* fix: ui websocket server stops responding to broadcast procedures (#1642)

remove premature response handler deletion in .finally() block that was
causing broadcast procedures (AUTHORIZE, DELETE_CHARGING_STATIONS) to
fail. response handlers are now only deleted on error or when sendResponse()
is called with the actual response.

root cause: broadcast procedures return undefined from requestHandler() and
wait for worker responses. the .finally() block was deleting handlers before
the response arrived, making the server unable to send the response back
to the client.

includes comprehensive test coverage:
- UIWebSocketServer.test.ts: 11 tests for WebSocket-specific behavior
- UIHttpServer.test.ts: 11 tests for HTTP-specific behavior
- AbstractUIService.test.ts: 9 tests for base service functionality
- test utilities and constants for consistent test data

all tests follow repository conventions and verify the fix prevents
regression of this bug.

* fix: correct UIHttpServer test expectations for response format

The UIHttpServer.sendResponse() method sends only the payload part of the
protocol response, not the full [uuid, payload] tuple. Fixed two tests that
were incorrectly expecting the full tuple format.

Tests affected:
- Verify response payload serialization
- Verify response with error details

All 31 UI server tests now pass correctly.

chore(deps): update all non-major dependencies (#1638)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): lock file maintenance (#1637)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Merge pull request #1636 from SAP/renovate/all-minor-patch

fix(deps): update all non-major dependencies

fix(deps): update all non-major dependencies

chore(deps): lock file maintenance (#1635)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1634)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1633)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore: update openspec artifacts

Signed-off-by: Jérôme Benoit <jerome.benoit@piment-noir.org>

chore(deps): lock file maintenance (#1632)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency @tsconfig/node24 to v24.0.3 (#1631)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix: update tsconfig.json to use @tsconfig/node24

Signed-off-by: Jérôme Benoit <jerome.benoit@sap.com>

chore(deps): replace dependency @tsconfig/node22 with @tsconfig/node24 (#1628)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1629)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency eslint-plugin-perfectionist to v5 (#1630)

* chore(deps): update dependency eslint-plugin-perfectionist to v5

* [autofix.ci] apply automated fixes

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1627)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1626)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update sonarsource/sonarqube-scan-action action to v7 (#1625)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update all non-major dependencies (#1624)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1622)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): lock file maintenance (#1623)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

fix(deps): update all non-major dependencies (#1621)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): lock file maintenance (#1619)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

chore(deps): update dependency @cspell/eslint-plugin to ^9.4.0 (#1620)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>