@abapify/adt-client 0.4.0 → 0.4.3

package/dist/index.mjs

@@ -0,0 +1,1553 @@
+import { exception } from "@abapify/adt-schemas";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Agent, fetch } from "undici";
+import { adtContract, createAdtClient as createAdtClient$1 } from "@abapify/adt-contracts";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+//#region src/utils/session.ts
+/**
+* Cookie Store - Manages HTTP cookies for stateful sessions
+*/
+var CookieStore = class {
+	cookies = /* @__PURE__ */ new Map();
+	/**
+	* Parse Set-Cookie header and store cookies
+	* Handles complex cookie strings with expires dates
+	*/
+	parseCookies(setCookieHeader) {
+		const cookieStrings = this.splitCookieHeader(setCookieHeader);
+		for (const cookieString of cookieStrings) {
+			const [name, value] = cookieString.split(";")[0].trim().split("=", 2);
+			if (name && value && !name.includes("expires") && !name.includes("path")) this.cookies.set(name.trim(), value.trim());
+		}
+	}
+	/**
+	* Split Set-Cookie header by commas, avoiding splitting on expires dates
+	*/
+	splitCookieHeader(setCookieHeader) {
+		const cookies = [];
+		let current = "";
+		let inExpires = false;
+		for (let i = 0; i < setCookieHeader.length; i++) {
+			const char = setCookieHeader[i];
+			if (char === "," && !inExpires) {
+				if (current.trim()) cookies.push(current.trim());
+				current = "";
+			} else {
+				current += char;
+				if (current.toLowerCase().includes("expires=")) inExpires = true;
+				if (inExpires && (char === ";" || i === setCookieHeader.length - 1)) inExpires = false;
+			}
+		}
+		if (current.trim()) cookies.push(current.trim());
+		return cookies;
+	}
+	/**
+	* Get Cookie header value for requests
+	*/
+	getCookieHeader() {
+		if (this.cookies.size === 0) return;
+		return Array.from(this.cookies.entries()).map(([name, value]) => `${name}=${value}`).join("; ");
+	}
+	/**
+	* Check if we have any cookies
+	*/
+	hasCookies() {
+		return this.cookies.size > 0;
+	}
+	/**
+	* Clear all cookies
+	*/
+	clear() {
+		this.cookies.clear();
+	}
+	/**
+	* Get all cookies as a map (for testing/debugging)
+	*/
+	getAll() {
+		return new Map(this.cookies);
+	}
+	/**
+	* Inject pre-existing cookies (e.g., from SAML authentication)
+	* @param cookieString Cookie string in "name=value; name2=value2" format
+	*/
+	injectCookie(cookieString) {
+		const cookies = cookieString.split("; ");
+		for (const cookie of cookies) {
+			const [name, ...valueParts] = cookie.split("=");
+			const value = valueParts.join("=");
+			if (name && value) this.cookies.set(name.trim(), value.trim());
+		}
+	}
+};
+/**
+* CSRF Token Manager - Handles CSRF token caching and initialization
+*/
+var CsrfTokenManager = class {
+	cachedToken;
+	/**
+	* Extract CSRF token from cookies (SAP stores it there)
+	*/
+	extractFromCookies(cookies) {
+		const xsrfEntry = Array.from(cookies.entries()).find(([key]) => key.toLowerCase().includes("xsrf") || key.toLowerCase().includes("csrf"));
+		if (!xsrfEntry) return;
+		const cookieValue = xsrfEntry[1];
+		const decodedToken = decodeURIComponent(cookieValue);
+		const tokenMatch = decodedToken.match(/^([A-Za-z0-9+/_-]+=*)/);
+		const actualToken = tokenMatch ? tokenMatch[1] : decodedToken;
+		if (actualToken && actualToken !== "Required" && actualToken !== "fetch" && actualToken !== "Fetch") return actualToken;
+	}
+	/**
+	* Extract CSRF token from response header
+	*/
+	extractFromHeader(headerValue) {
+		if (!headerValue || headerValue === "Required" || headerValue === "fetch" || headerValue === "Fetch") return;
+		return headerValue;
+	}
+	/**
+	* Cache a CSRF token
+	*/
+	cache(token) {
+		this.cachedToken = token;
+	}
+	/**
+	* Get cached CSRF token
+	*/
+	getCached() {
+		return this.cachedToken;
+	}
+	/**
+	* Clear cached CSRF token (e.g., on 403 errors)
+	*/
+	clear() {
+		this.cachedToken = void 0;
+	}
+	/**
+	* Check if we have a cached token
+	*/
+	hasCached() {
+		return !!this.cachedToken;
+	}
+	/**
+	* Alias for hasCached() - for consistency with SessionManager API
+	*/
+	hasToken() {
+		return this.hasCached();
+	}
+};
+/**
+* ETag Manager - Tracks ETags for optimistic locking
+*/
+var ETagManager = class {
+	etags = /* @__PURE__ */ new Map();
+	/**
+	* Extract and cache ETag from response header
+	* @param url The request URL (used as key)
+	* @param headerValue The ETag header value
+	*/
+	cacheFromHeader(url, headerValue) {
+		if (headerValue) {
+			const key = this.normalizeUrl(url);
+			this.etags.set(key, headerValue);
+		}
+	}
+	/**
+	* Get cached ETag for a URL
+	*/
+	get(url) {
+		const key = this.normalizeUrl(url);
+		return this.etags.get(key);
+	}
+	/**
+	* Clear cached ETag for a URL
+	*/
+	clear(url) {
+		if (url) {
+			const key = this.normalizeUrl(url);
+			this.etags.delete(key);
+		} else this.etags.clear();
+	}
+	/**
+	* Normalize URL to use as cache key.
+	* Removes query params, trailing slashes, and lowercases the path.
+	* SAP ADT URLs are case-insensitive, so /fmodules/ZAGE_FM and
+	* /fmodules/zage_fm must share the same ETag cache entry.
+	*/
+	normalizeUrl(url) {
+		try {
+			return new URL(url).pathname.replace(/\/$/, "").toLowerCase();
+		} catch {
+			return url.split("?")[0].replace(/\/$/, "").toLowerCase();
+		}
+	}
+};
+/**
+* Session Manager - Orchestrates cookies and CSRF tokens
+*/
+var SessionManager = class SessionManager {
+	logger;
+	fetchFn;
+	static SESSION_PATH_PREFIX = "/sap/bc/adt/core/http/sessions/";
+	cookieStore = new CookieStore();
+	csrfManager = new CsrfTokenManager();
+	etagManager = new ETagManager();
+	securitySessionActive = false;
+	constructor(logger, fetchFn = globalThis.fetch) {
+		this.logger = logger;
+		this.fetchFn = fetchFn;
+	}
+	/**
+	* Process response to update session state
+	* Extracts cookies, CSRF tokens, and ETags
+	* @param response The HTTP response
+	* @param url Optional URL for ETag caching (required for ETag tracking)
+	*/
+	processResponse(response, url) {
+		if (url) {
+			const etag = response.headers.get("etag");
+			if (etag) {
+				this.etagManager.cacheFromHeader(url, etag);
+				this.logger?.debug(`Session: ETag cached for ${url}: ${etag}`);
+			}
+		}
+		const setCookieHeader = response.headers.get("set-cookie");
+		if (setCookieHeader) {
+			this.cookieStore.parseCookies(setCookieHeader);
+			this.logger?.debug("Session: Cookies updated from response");
+		}
+		const csrfHeader = response.headers.get("x-csrf-token");
+		const csrfToken = this.csrfManager.extractFromHeader(csrfHeader);
+		if (csrfToken) {
+			this.csrfManager.cache(csrfToken);
+			this.logger?.debug("Session: CSRF token cached from header");
+		}
+		if (!csrfToken && this.cookieStore.hasCookies()) {
+			const cookieCsrf = this.csrfManager.extractFromCookies(this.cookieStore.getAll());
+			if (cookieCsrf) {
+				this.csrfManager.cache(cookieCsrf);
+				this.logger?.debug("Session: CSRF token cached from cookies");
+			}
+		}
+	}
+	/**
+	* Get headers for next request
+	* @param method HTTP method
+	* @param url Optional URL for ETag lookup (for PUT/PATCH with optimistic locking)
+	*/
+	getRequestHeaders(method, url) {
+		const headers = {};
+		if (this.securitySessionActive) headers["x-sap-security-session"] = "use";
+		const cookieHeader = this.cookieStore.getCookieHeader();
+		if (cookieHeader) headers.Cookie = cookieHeader;
+		if ([
+			"POST",
+			"PUT",
+			"DELETE",
+			"PATCH"
+		].includes(method.toUpperCase())) {
+			const cachedToken = this.csrfManager.getCached();
+			if (cachedToken) headers["x-csrf-token"] = cachedToken;
+			else headers["x-csrf-token"] = "Fetch";
+		}
+		if (["PUT", "PATCH"].includes(method.toUpperCase()) && url) {
+			const etag = this.etagManager.get(url);
+			if (etag) {
+				headers["If-Match"] = etag;
+				this.logger?.debug(`Session: Using cached ETag for If-Match: ${etag}`);
+			}
+		}
+		return headers;
+	}
+	/**
+	* Get cached ETag for a URL
+	*/
+	getETag(url) {
+		return this.etagManager.get(url);
+	}
+	/**
+	* Clear cached ETag for a URL
+	*/
+	clearETag(url) {
+		this.etagManager.clear(url);
+	}
+	/**
+	* Reject session paths that could send cleanup requests off-target.
+	* Only relative paths under the ADT sessions endpoint (or same-origin
+	* absolute URLs with that path) are accepted.
+	*/
+	isTrustedSessionPath({ baseUrl, sessionPath }) {
+		try {
+			const parsed = new URL(sessionPath, baseUrl);
+			const base = new URL(baseUrl);
+			return parsed.origin === base.origin && parsed.pathname.startsWith(SessionManager.SESSION_PATH_PREFIX);
+		} catch {
+			return false;
+		}
+	}
+	extractTrustedSessionPath({ baseUrl, body }) {
+		const sessionPath = body.match(/href="([^"]*\/sessions\/[^"]*)"/)?.[1];
+		if (!sessionPath || !this.isTrustedSessionPath({
+			baseUrl,
+			sessionPath
+		})) {
+			this.logger?.warn("Session: Created security session returned an untrusted path");
+			return;
+		}
+		return sessionPath;
+	}
+	/**
+	* Initialize CSRF token using the Eclipse ADT security session flow:
+	*
+	* 1. GET /sessions + x-sap-security-session: create  → create security session
+	* 2. GET /sessions + x-sap-security-session: use + x-csrf-token: Fetch → get CSRF token
+	* 3. DELETE /sessions/<id> + x-sap-security-session: use + x-csrf-token → destroy session
+	*
+	* The CSRF token survives the session deletion and remains valid for
+	* all subsequent lock/unlock operations. Deleting the session frees
+	* the slot — SAP allows only one security session per user.
+	*/
+	resolveInitializeCsrfArgs(...args) {
+		if (args.length === 1) {
+			const first = args[0];
+			if (first !== null) {
+				if (typeof first === "object") return first;
+			}
+		}
+		return {
+			authHeader: typeof args[0] === "string" ? args[0] : void 0,
+			client: typeof args[1] === "string" ? args[1] : void 0,
+			language: typeof args[2] === "string" ? args[2] : void 0,
+			signal: args[3] instanceof AbortSignal ? args[3] : void 0
+		};
+	}
+	async initializeCsrf(baseUrl, ...args) {
+		const { authHeader, client, language, signal } = this.resolveInitializeCsrfArgs(...args);
+		signal?.throwIfAborted();
+		const sessionsUrl = this.buildSessionsUrl(baseUrl, client, language);
+		let sessionPath;
+		try {
+			sessionPath = await this.createSecuritySession(baseUrl, sessionsUrl, authHeader, signal);
+			if (!sessionPath) return false;
+			if (!await this.acquireCsrfToken(sessionsUrl, authHeader, signal)) {
+				this.deleteSecuritySessionWithFallback({
+					sessionPath,
+					baseUrl,
+					authHeader,
+					client,
+					language
+				}).catch(() => void 0);
+				return false;
+			}
+			const acquiredCsrfToken = this.csrfManager.getCached();
+			if (acquiredCsrfToken) await this.deleteSecuritySession({
+				sessionPath,
+				csrfToken: acquiredCsrfToken,
+				baseUrl,
+				authHeader,
+				client,
+				signal
+			});
+			signal?.throwIfAborted();
+			return true;
+		} catch (error) {
+			return this.handleCsrfInitializationError(error, {
+				baseUrl,
+				authHeader,
+				client,
+				language,
+				sessionPath,
+				signal
+			});
+		}
+	}
+	buildSessionsUrl(baseUrl, client, language) {
+		const url = new URL("/sap/bc/adt/core/http/sessions", baseUrl);
+		if (client) url.searchParams.append("sap-client", client);
+		if (language) url.searchParams.append("sap-language", language);
+		return url;
+	}
+	buildSessionHeaders(authHeader) {
+		const headers = {
+			Accept: "application/vnd.sap.adt.core.http.session.v3+xml",
+			"X-sap-adt-sessiontype": "stateful"
+		};
+		if (authHeader) headers.Authorization = authHeader;
+		const cookie = this.cookieStore.getCookieHeader();
+		if (cookie) headers.Cookie = cookie;
+		return headers;
+	}
+	async createSecuritySession(baseUrl, sessionsUrl, authHeader, signal) {
+		this.logger?.debug("Session: Creating security session");
+		const response = await this.fetchFn(sessionsUrl, {
+			method: "GET",
+			headers: {
+				...this.buildSessionHeaders(authHeader),
+				"x-sap-security-session": "create"
+			},
+			signal
+		});
+		signal?.throwIfAborted();
+		if (!response.ok) {
+			this.logger?.warn(`Session: Security session creation failed with status ${response.status}`);
+			return;
+		}
+		this.processResponse(response);
+		const body = await response.text();
+		signal?.throwIfAborted();
+		return this.extractTrustedSessionPath({
+			baseUrl,
+			body
+		});
+	}
+	async acquireCsrfToken(sessionsUrl, authHeader, signal) {
+		this.logger?.debug("Session: Fetching CSRF token");
+		const response = await this.fetchFn(sessionsUrl, {
+			method: "GET",
+			headers: {
+				...this.buildSessionHeaders(authHeader),
+				"x-sap-security-session": "use",
+				"x-csrf-token": "Fetch"
+			},
+			signal
+		});
+		signal?.throwIfAborted();
+		if (!response.ok) {
+			this.logger?.warn(`Session: CSRF fetch failed with status ${response.status}`);
+			return false;
+		}
+		this.processResponse(response);
+		if (!this.csrfManager.hasCached()) {
+			this.logger?.warn("Session: CSRF fetch succeeded but no token found in response");
+			return false;
+		}
+		this.securitySessionActive = true;
+		this.logger?.debug("Session: CSRF token acquired");
+		return true;
+	}
+	async deleteSecuritySession({ sessionPath, csrfToken, baseUrl, authHeader, client, signal }) {
+		if (!this.isTrustedSessionPath({
+			baseUrl,
+			sessionPath
+		})) {
+			this.logger?.warn("Session: Refusing to delete security session with untrusted path");
+			return;
+		}
+		const deleteUrl = new URL(sessionPath, baseUrl);
+		if (client) deleteUrl.searchParams.append("sap-client", client);
+		try {
+			this.logger?.debug(`Session: Deleting security session ${sessionPath}`);
+			await this.fetchFn(deleteUrl, {
+				method: "DELETE",
+				headers: {
+					...this.buildSessionHeaders(authHeader),
+					"x-sap-security-session": "use",
+					"x-csrf-token": csrfToken
+				},
+				signal: signal ?? AbortSignal.timeout(5e3)
+			});
+			this.logger?.debug("Session: Security session deleted");
+		} catch {
+			this.logger?.debug("Session: Failed to delete security session (will expire)");
+		}
+	}
+	async fetchSecuritySessionCsrfToken({ baseUrl, authHeader, client, language, signal }) {
+		const sessionsUrl = this.buildSessionsUrl(baseUrl, client, language);
+		try {
+			this.logger?.debug("Session: Fetching CSRF token for security session cleanup");
+			const response = await this.fetchFn(sessionsUrl, {
+				method: "GET",
+				headers: {
+					...this.buildSessionHeaders(authHeader),
+					"x-sap-security-session": "use",
+					"x-csrf-token": "Fetch"
+				},
+				signal: signal ?? AbortSignal.timeout(5e3)
+			});
+			if (!response.ok) {
+				this.logger?.debug(`Session: Cleanup CSRF fetch failed with status ${response.status}`);
+				return;
+			}
+			const setCookieHeader = response.headers.get("set-cookie");
+			if (setCookieHeader) this.cookieStore.parseCookies(setCookieHeader);
+			return this.csrfManager.extractFromHeader(response.headers.get("x-csrf-token"));
+		} catch {
+			this.logger?.debug("Session: Failed to fetch cleanup CSRF token");
+			return;
+		}
+	}
+	async deleteSecuritySessionWithFallback({ sessionPath, baseUrl, authHeader, client, language, signal }) {
+		const token = await this.fetchSecuritySessionCsrfToken({
+			baseUrl,
+			authHeader,
+			client,
+			language,
+			signal
+		});
+		if (token) await this.deleteSecuritySession({
+			sessionPath,
+			csrfToken: token,
+			baseUrl,
+			authHeader,
+			client,
+			signal
+		});
+	}
+	handleCsrfInitializationError(error, { baseUrl, authHeader, client, language, sessionPath, signal }) {
+		if (sessionPath) this.deleteSecuritySessionWithFallback({
+			sessionPath,
+			baseUrl,
+			authHeader,
+			client,
+			language
+		}).catch(() => void 0);
+		if (signal?.aborted) throw error;
+		this.logger?.error(`Session: CSRF initialization error: ${error instanceof Error ? error.message : String(error)}`);
+		return false;
+	}
+	/**
+	* Clear all session state (cookies and CSRF)
+	*/
+	clear() {
+		this.cookieStore.clear();
+		this.csrfManager.clear();
+		this.securitySessionActive = false;
+		this.logger?.debug("Session: Cleared all session state (cookies and CSRF)");
+	}
+	/**
+	* Check if we have a cached CSRF token
+	*/
+	hasCsrfToken() {
+		return this.csrfManager.hasCached();
+	}
+	/**
+	* Get Cookie header value for requests
+	*/
+	getCookieHeader() {
+		return this.cookieStore.getCookieHeader();
+	}
+	/**
+	* Get session type header value
+	* SAP ADT requires 'stateful' for operations that need session persistence
+	*/
+	getSessionTypeHeader() {
+		return "stateful";
+	}
+	/**
+	* Inject a pre-existing cookie (e.g., from SAML authentication)
+	* @param cookieString Cookie string in "name=value" format
+	*/
+	injectCookie(cookieString) {
+		this.cookieStore.injectCookie(cookieString);
+		this.logger?.debug(`Session: Injected cookie from external source`);
+	}
+};
+
+//#endregion
+//#region src/errors.ts
+/**
+* ADT Error Handling
+*
+* SAP ADT returns errors in a standard XML format defined by exception.xsd:
+* <exc:exception xmlns:exc="http://www.sap.com/abapxml/types/communicationframework">
+*   <namespace id="..."/>
+*   <type id="..."/>
+*   <message lang="EN">Human readable error message</message>
+*   <localizedMessage lang="EN">Localized message</localizedMessage>
+*   <properties>
+*     <entry key="key1">value1</entry>
+*   </properties>
+* </exc:exception>
+*
+* Uses the generated exception schema from @abapify/adt-schemas for type-safe parsing.
+*/
+/**
+* Custom error class for ADT exceptions
+*
+* Provides structured access to SAP ADT error details.
+*/
+var AdtError = class AdtError extends Error {
+	/** HTTP status code */
+	status;
+	/** HTTP status text */
+	statusText;
+	/** Parsed ADT exception data (if available) */
+	exception;
+	/** Raw response body */
+	rawBody;
+	/** Request URL */
+	url;
+	/** HTTP method */
+	method;
+	constructor(options) {
+		const baseMsg = `HTTP ${options.status}: ${options.statusText}`;
+		const detailMsg = options.exception?.message || options.exception?.localizedMessage;
+		const fullMsg = detailMsg ? `${baseMsg} - ${detailMsg}` : baseMsg;
+		super(fullMsg);
+		this.name = "AdtError";
+		this.status = options.status;
+		this.statusText = options.statusText;
+		this.url = options.url;
+		this.method = options.method;
+		this.rawBody = options.rawBody;
+		this.exception = options.exception;
+		if (Error.captureStackTrace) Error.captureStackTrace(this, AdtError);
+	}
+	/**
+	* Get the most relevant error message
+	*/
+	get detailMessage() {
+		return this.exception?.localizedMessage || this.exception?.message || this.statusText;
+	}
+	/**
+	* Check if this is a specific error type
+	*/
+	isType(type) {
+		return this.exception?.type === type;
+	}
+	/**
+	* Check if this is from a specific namespace
+	*/
+	isNamespace(namespace) {
+		return this.exception?.namespace === namespace;
+	}
+	/**
+	* Get a property value from the exception
+	*/
+	getProperty(key) {
+		return this.exception?.properties?.[key];
+	}
+};
+/**
+* Parse ADT exception XML into structured data
+*
+* Uses the generated exception schema from @abapify/adt-schemas for type-safe parsing.
+*/
+function parseAdtException(xml) {
+	if (!xml.includes("exception") || !/xmlns(?::[\w-]+)?="http:\/\/www\.sap\.com\/abapxml\/types\/communicationframework"/.test(xml)) return;
+	try {
+		const exc = exception.parse(xml).exception;
+		if (!exc) return;
+		const result = {};
+		if (exc.namespace?.id) result.namespace = exc.namespace.id;
+		if (exc.type?.id) result.type = exc.type.id;
+		if (exc.message?.$value) result.message = exc.message.$value;
+		if (exc.localizedMessage?.$value) result.localizedMessage = exc.localizedMessage.$value;
+		if (exc.properties?.entry) {
+			result.properties = {};
+			const entries = Array.isArray(exc.properties.entry) ? exc.properties.entry : [exc.properties.entry];
+			for (const entry of entries) if (entry.key && entry.$value) result.properties[entry.key] = entry.$value;
+		}
+		if (!result.namespace && !result.type && !result.message && !result.localizedMessage) return;
+		return result;
+	} catch {
+		return;
+	}
+}
+/**
+* Create an AdtError from HTTP response details
+*/
+function createAdtError(status, statusText, url, method, rawBody) {
+	const exception = parseAdtException(rawBody);
+	return new AdtError({
+		status,
+		statusText,
+		url,
+		method,
+		rawBody,
+		exception
+	});
+}
+
+//#endregion
+//#region src/cancellation.ts
+const adtAbortSignal = new AsyncLocalStorage();
+/**
+* Runs an ADT operation with an execution-scoped abort signal. Async local
+* storage keeps concurrent clients and invocations isolated without mutating
+* shared client state.
+*/
+async function runWithAdtAbortSignal(signal, operation) {
+	signal.throwIfAborted();
+	return await adtAbortSignal.run(signal, operation);
+}
+function activeAdtAbortSignal() {
+	return adtAbortSignal.getStore();
+}
+
+//#endregion
+//#region src/adapter.ts
+/**
+* A response exceeded an explicit byte cap before its body was retained.
+* Deliberately carries size metadata only, never response text.
+*/
+var AdtResponseTooLargeError = class extends Error {
+	maxBytes;
+	receivedBytes;
+	code = "ADT_RESPONSE_TOO_LARGE";
+	constructor(maxBytes, receivedBytes) {
+		super(`ADT response exceeds the ${maxBytes}-byte limit.`);
+		this.maxBytes = maxBytes;
+		this.receivedBytes = receivedBytes;
+		this.name = "AdtResponseTooLargeError";
+	}
+};
+function contentLengthExceedsLimit(contentLength, maxBytes) {
+	if (!contentLength || !/^\d+$/.test(contentLength)) return void 0;
+	const parsed = Number(contentLength);
+	return Number.isSafeInteger(parsed) && parsed > maxBytes ? parsed : void 0;
+}
+async function abortResponse(response, abortController) {
+	abortController.abort();
+	try {
+		await response.body?.cancel();
+	} catch {}
+}
+async function readResponseTextBounded(response, maxBytes, abortController) {
+	const declaredBytes = contentLengthExceedsLimit(response.headers.get("content-length"), maxBytes);
+	if (declaredBytes !== void 0) {
+		await abortResponse(response, abortController);
+		throw new AdtResponseTooLargeError(maxBytes, declaredBytes);
+	}
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const chunks = [];
+	let receivedBytes = 0;
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			if (!value) continue;
+			const nextReceivedBytes = receivedBytes + value.byteLength;
+			if (nextReceivedBytes > maxBytes) {
+				abortController.abort();
+				try {
+					await reader.cancel();
+				} catch {}
+				throw new AdtResponseTooLargeError(maxBytes, nextReceivedBytes);
+			}
+			chunks.push(value);
+			receivedBytes = nextReceivedBytes;
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const combined = new Uint8Array(receivedBytes);
+	let offset = 0;
+	for (const chunk of chunks) {
+		combined.set(chunk, offset);
+		offset += chunk.byteLength;
+	}
+	return new TextDecoder().decode(combined);
+}
+function executionAbortController() {
+	const abortController = new AbortController();
+	const executionSignal = activeAdtAbortSignal();
+	if (!executionSignal) return {
+		abortController,
+		dispose: () => void 0
+	};
+	const abortFromExecution = () => abortController.abort(executionSignal.reason);
+	if (executionSignal.aborted) abortFromExecution();
+	else executionSignal.addEventListener("abort", abortFromExecution, { once: true });
+	return {
+		abortController,
+		dispose: () => executionSignal.removeEventListener("abort", abortFromExecution)
+	};
+}
+function createAdtAdapter(config) {
+	const { baseUrl, username, password, cookieHeader, authorizationHeader, client, language, logger, plugins = [], onSessionExpired, headersTimeoutMs } = config;
+	const dispatcher = headersTimeoutMs === void 0 ? void 0 : new Agent({ headersTimeout: headersTimeoutMs });
+	/** Merge the optional Undici dispatcher into a fetch RequestInit. */
+	function withDispatcher(init) {
+		return dispatcher ? {
+			...init,
+			dispatcher
+		} : init;
+	}
+	/** Keep a configured Agent paired with the Undici fetch ABI that created it. */
+	async function requestFetch(input, init) {
+		if (!dispatcher) return globalThis.fetch(input, init);
+		return await fetch(input, init);
+	}
+	/**
+	* Route a session-manager request through the same paired Undici
+	* fetch/dispatcher used for the final adapter request, so the
+	* configured headersTimeout applies to the entire write flow
+	* (CSRF handshake included), not just the last hop.
+	*/
+	async function sessionFetch(input, init) {
+		return requestFetch(input.toString(), withDispatcher(init ?? {}));
+	}
+	/**
+	* Resolve `options.url` against the configured `baseUrl` and reject
+	* absolute URLs that would send credentials to a different origin.
+	*/
+	function resolveAdtUrl(requestUrl) {
+		const resolved = new URL(requestUrl, baseUrl);
+		const baseOrigin = new URL(baseUrl).origin;
+		if (resolved.origin !== baseOrigin) throw new RangeError(`Refusing to fetch ${resolved.origin} — ADT requests must target the configured base origin ${baseOrigin}`);
+		return resolved;
+	}
+	const isSamlAuth = !!cookieHeader;
+	const basicCredentials = `${username}:${password}`;
+	const authHeader = authorizationHeader ?? (isSamlAuth ? void 0 : `Basic ${Buffer.from(basicCredentials).toString("base64")}`);
+	const sessionManager = new SessionManager(logger, sessionFetch);
+	if (cookieHeader) sessionManager.injectCookie(cookieHeader);
+	return {
+		async request(options) {
+			const executionSignal = activeAdtAbortSignal();
+			executionSignal?.throwIfAborted();
+			logger?.debug("=== ADAPTER REQUEST START ===");
+			logger?.debug("options.url:", options.url);
+			logger?.debug("options.method:", options.method);
+			logger?.debug("options.body:", options.body ? "present" : "undefined");
+			logger?.debug("options.bodySchema:", options.bodySchema ? "present" : "undefined");
+			const url = resolveAdtUrl(options.url);
+			if (options.query) Object.entries(options.query).forEach(([key, value]) => {
+				(Array.isArray(value) ? value : [value]).forEach((entry) => {
+					if (entry !== void 0) url.searchParams.append(key, String(entry));
+				});
+			});
+			if (client) url.searchParams.append("sap-client", client);
+			if (language) url.searchParams.append("sap-language", language);
+			if ([
+				"POST",
+				"PUT",
+				"DELETE",
+				"PATCH"
+			].includes(options.method.toUpperCase()) && !sessionManager.hasCsrfToken()) {
+				logger?.debug("Adapter: Initializing CSRF token before write operation");
+				await sessionManager.initializeCsrf(baseUrl, {
+					authHeader,
+					client,
+					language,
+					signal: executionSignal
+				});
+			}
+			const headers = {
+				"X-sap-adt-sessiontype": sessionManager.getSessionTypeHeader(),
+				...sessionManager.getRequestHeaders(options.method, url.pathname),
+				...options.headers
+			};
+			if (authHeader) headers.Authorization = authHeader;
+			let bodySerializableSchema;
+			if (options.bodySchema && typeof options.bodySchema === "object") {
+				if ("build" in options.bodySchema && typeof options.bodySchema.build === "function") bodySerializableSchema = options.bodySchema;
+			}
+			let serializableSchema;
+			if (options.responses) {
+				const schema200 = options.responses[200];
+				logger?.debug("Schema detection:", {
+					hasSchema: !!schema200,
+					type: typeof schema200,
+					keys: schema200 && typeof schema200 === "object" ? Object.keys(schema200) : []
+				});
+				if (schema200 && typeof schema200 === "object" && "parse" in schema200 && typeof schema200.parse === "function") serializableSchema = schema200;
+			}
+			let requestBody;
+			const body = options.body;
+			logger?.debug("Request URL: " + options.url);
+			logger?.debug("Request method: " + options.method);
+			logger?.debug("options.body: " + (options.body ? JSON.stringify(options.body).substring(0, 500) : "UNDEFINED"));
+			logger?.debug("options.bodySchema: " + (options.bodySchema ? "present" : "undefined"));
+			logger?.debug("bodySerializableSchema: " + (bodySerializableSchema ? "present" : "undefined"));
+			logger?.debug("Body type: " + typeof body);
+			logger?.debug("Body value: " + (body ? JSON.stringify(body).substring(0, 500) : "UNDEFINED/NULL"));
+			if (body !== void 0 && body !== null) {
+				if (typeof body === "string") {
+					requestBody = body;
+					logger?.debug("Body: using raw string");
+					logger?.debug("Body content (first 200 chars):", requestBody.substring(0, 200));
+				} else if (bodySerializableSchema) try {
+					logger?.debug("Calling bodySerializableSchema.build with body: " + JSON.stringify(body).substring(0, 300));
+					requestBody = bodySerializableSchema.build(body);
+					logger?.debug("Body: serialized using Serializable.build()");
+					logger?.debug("Body output type: " + typeof requestBody);
+					logger?.debug("Body output length: " + requestBody?.length);
+					logger?.debug("Body content (first 500 chars): " + requestBody?.substring(0, 500));
+				} catch (buildError) {
+					logger?.error("Schema build() threw error: " + (buildError instanceof Error ? buildError.message : String(buildError)));
+					logger?.error("Stack: " + (buildError instanceof Error ? buildError.stack : "N/A"));
+					throw buildError;
+				}
+				else {
+					requestBody = JSON.stringify(body);
+					logger?.debug("Body: serialized as JSON");
+				}
+			}
+			logger?.debug(`HTTP ${options.method} ${url.toString()}`);
+			{
+				const headerNames = Object.keys(headers).sort();
+				logger?.debug("Request headers (names only): " + JSON.stringify(headerNames));
+			}
+			const response = await requestFetch(url.toString(), withDispatcher({
+				method: options.method,
+				headers,
+				body: requestBody,
+				signal: executionSignal
+			}));
+			sessionManager.processResponse(response, url.pathname);
+			logger?.debug(`Response: ${response.status} ${response.statusText}`);
+			logger?.debug("Response headers: " + JSON.stringify(Object.fromEntries(response.headers.entries()), null, 2));
+			if (!response.ok) {
+				const errorBody = await response.text();
+				const adtError = createAdtError(response.status, response.statusText, url.toString(), options.method, errorBody);
+				if (response.status === 412) {
+					const sentETag = headers["If-Match"] ?? "(none)";
+					const diag = `[If-Match: ${sentETag}, URL: ${url.pathname}]`;
+					logger?.error(`ETag mismatch: ${options.method} ${url.pathname} sent If-Match: ${sentETag}`);
+					Object.defineProperty(adtError, "message", {
+						value: `${adtError.message} ${diag}`,
+						writable: true,
+						configurable: true
+					});
+				}
+				logger?.error(`Request failed - ${adtError.message} (${options.method} ${url.toString()})`);
+				if (adtError.exception) logger?.error(`ADT Exception: namespace=${adtError.exception.namespace}, type=${adtError.exception.type}`);
+				if (errorBody && !adtError.exception) logger?.error(`Response body: ${errorBody}`);
+				if (response.status === 403) {
+					if (!(adtError.exception?.type === "ExceptionResourceNoAccess" && (adtError.message.includes("currently editing") || adtError.message.includes("is being edited")))) {
+						sessionManager.clear();
+						logger?.warn("Session cleared due to 403 Forbidden response");
+					} else logger?.warn("Lock conflict (403) — session preserved (object locked by another session)");
+				}
+				throw adtError;
+			}
+			const contentType = response.headers.get("content-type") || "";
+			const rawText = await response.text();
+			if (contentType.includes("text/html") && rawText.includes("SAMLRequest")) {
+				sessionManager.clear();
+				logger?.warn("SAML redirect detected - session expired");
+				if (onSessionExpired) {
+					logger?.info("Attempting automatic re-authentication...");
+					try {
+						const newCookie = await onSessionExpired();
+						sessionManager.injectCookie(newCookie);
+						logger?.info("Re-authentication successful, retrying request...");
+						return this.request(options);
+					} catch (refreshError) {
+						logger?.error("Re-authentication failed");
+						throw new Error("Session expired - re-authentication failed", { cause: refreshError });
+					}
+				}
+				throw new Error("Session expired - SAML re-authentication required");
+			}
+			let data;
+			if (contentType.includes("application/json") || contentType.includes("+json")) data = JSON.parse(rawText);
+			else if (contentType.includes("text/") || contentType.includes("xml")) {
+				if (serializableSchema && contentType.includes("xml")) data = serializableSchema.parse(rawText);
+				else data = rawText;
+			} else data = rawText;
+			if (plugins.length > 0) {
+				const context = {
+					rawText,
+					parsedData: data,
+					url: url.toString(),
+					method: options.method,
+					contentType
+				};
+				for (const plugin of plugins) {
+					const result = await plugin.process(context);
+					if (result !== void 0) {
+						data = result;
+						context.parsedData = result;
+					}
+				}
+			}
+			return data;
+		},
+		clearETag(url) {
+			sessionManager.clearETag(url);
+		},
+		async readTextBounded(options, maxBytes) {
+			if (!Number.isSafeInteger(maxBytes) || maxBytes < 0) throw new RangeError("maxBytes must be a non-negative safe integer.");
+			const url = resolveAdtUrl(options.url);
+			if (client) url.searchParams.append("sap-client", client);
+			if (language) url.searchParams.append("sap-language", language);
+			const headers = {
+				"X-sap-adt-sessiontype": sessionManager.getSessionTypeHeader(),
+				...sessionManager.getRequestHeaders("GET", url.pathname),
+				...options.headers
+			};
+			if (authHeader) headers.Authorization = authHeader;
+			const { abortController, dispose } = executionAbortController();
+			try {
+				const response = await requestFetch(url.toString(), withDispatcher({
+					method: "GET",
+					headers,
+					signal: abortController.signal
+				}));
+				sessionManager.processResponse(response, url.pathname);
+				const text = await readResponseTextBounded(response, maxBytes, abortController);
+				if (!response.ok) throw createAdtError(response.status, response.statusText, url.toString(), "GET", text);
+				return text;
+			} finally {
+				dispose();
+			}
+		}
+	};
+}
+
+//#endregion
+//#region src/services/transports.ts
+/**
+* Transport Service - orchestrates CTS operations
+*/
+var TransportService = class {
+	adt;
+	constructor(adt) {
+		this.adt = adt;
+	}
+	/**
+	* List transport requests
+	*/
+	async list(options) {
+		const response = await this.adt.cts.transportrequests.list(options);
+		return this.extractRequests(response).map((req) => this.mapToTransport(req));
+	}
+	/**
+	* Get a single transport by number
+	*/
+	async get(trkorr) {
+		const data = await this.adt.cts.transportrequests.get(trkorr);
+		const unwrapped = data?.root && typeof data.root === "object" ? data.root : data;
+		const wanted = trkorr.trim().toUpperCase();
+		const request = this.findUnit(unwrapped?.task, wanted) ?? this.findUnit(unwrapped?.request, wanted) ?? unwrapped?.request ?? unwrapped?.task ?? unwrapped;
+		return this.mapToTransport(request);
+	}
+	/**
+	* Create a new transport request
+	*
+	* Note: Full create implementation requires XML body building.
+	* For now, this is a placeholder that throws a helpful error.
+	* Use ADK's AdkTransportRequest.create() for full functionality.
+	*/
+	async create(_options) {
+		throw new Error("Transport creation via service layer not yet implemented. Use ADK's AdkTransportRequest.create() for now.");
+	}
+	/**
+	* Delete a transport request
+	*/
+	async delete(trkorr) {
+		await this.adt.cts.transportrequests.delete(trkorr);
+	}
+	/**
+	* Release a transport request
+	*
+	* Note: Release requires POST with specific action parameter.
+	* This is a placeholder for the full implementation.
+	*/
+	async release(_trkorr) {
+		throw new Error("Transport release via service layer not yet implemented.");
+	}
+	/**
+	* Find a request/task unit whose number matches the wanted transport id.
+	* Handles both single-object and array shapes from ts-xsd.
+	*/
+	findUnit(node, wanted) {
+		if (!node) return void 0;
+		return (Array.isArray(node) ? node : [node]).find((item) => {
+			const u = item;
+			return String(u?.trkorr ?? u?.number ?? "").toUpperCase() === wanted;
+		});
+	}
+	/**
+	* Extract requests array from various response formats
+	*/
+	extractRequests(response) {
+		if (!response) return [];
+		const data = response;
+		if (Array.isArray(data.request)) return data.request;
+		if (data.request && typeof data.request === "object") return [data.request];
+		if (Array.isArray(response)) return response;
+		if (data.root && typeof data.root === "object") return this.extractRequests(data.root);
+		return [];
+	}
+	/**
+	* Map raw request data to Transport interface
+	*/
+	mapToTransport(req) {
+		const data = req;
+		return {
+			number: String(data.trkorr ?? data.number ?? ""),
+			desc: data.as4text ?? data.desc,
+			owner: data.as4user ?? data.owner,
+			status: data.trstatus ?? data.status,
+			type: data.trfunction ?? data.type,
+			target: data.tarsystem ?? data.target,
+			parent: data.parent,
+			lastChangedTimestamp: data.lastchanged_timestamp ?? data.lastChangedTimestamp,
+			tasks: this.extractTasks(data)
+		};
+	}
+	/**
+	* Extract tasks from transport data
+	*/
+	extractTasks(data) {
+		const tasks = data.task ?? data.tasks;
+		if (!tasks) return [];
+		return (Array.isArray(tasks) ? tasks : [tasks]).map((task) => {
+			const t = task;
+			return {
+				number: String(t.trkorr ?? t.number ?? ""),
+				owner: t.as4user ?? t.owner,
+				status: t.trstatus ?? t.status,
+				desc: t.as4text ?? t.desc,
+				type: t.trfunction ?? t.type,
+				parent: t.parent,
+				lastChangedTimestamp: t.lastchanged_timestamp ?? t.lastChangedTimestamp
+			};
+		});
+	}
+};
+/**
+* Create transport service instance
+*/
+function createTransportService(adt) {
+	return new TransportService(adt);
+}
+
+//#endregion
+//#region src/services/users.ts
+/** Extract entry array from atomFeed parsed response */
+function extractEntries(data) {
+	const feedData = data.feed;
+	if (!feedData) return [];
+	const rawEntries = feedData.entry;
+	if (!rawEntries) return [];
+	return Array.isArray(rawEntries) ? rawEntries : [rawEntries];
+}
+/** Map raw Atom entries to normalized UserInfo */
+function toUserInfoList(entries) {
+	return entries.map((e) => ({
+		username: e.id ?? "",
+		fullName: e.title,
+		uri: e.link?.[0]?.href
+	}));
+}
+/**
+* User Service - orchestrates user lookup operations
+*/
+var UserService = class {
+	adt;
+	constructor(adt) {
+		this.adt = adt;
+	}
+	/** Get the currently authenticated user via systeminformation */
+	async getCurrentUser() {
+		const sysInfo = await this.adt.core.http.systeminformation.getSystemInfo();
+		return {
+			userName: sysInfo.userName ?? "",
+			userFullName: sysInfo.userFullName,
+			systemID: sysInfo.systemID ?? "",
+			client: sysInfo.client ?? ""
+		};
+	}
+	/** Look up a specific user by exact username */
+	async getUserByName(username) {
+		const normalized = username.trim().toUpperCase();
+		if (!normalized) throw new Error("username is required");
+		return toUserInfoList(extractEntries(await this.adt.system.users.get(normalized)));
+	}
+	/** Search users by wildcard query */
+	async searchUsers(query, maxcount = 50) {
+		const normalizedQuery = query.trim();
+		if (!normalizedQuery) throw new Error("query is required");
+		if (!Number.isInteger(maxcount) || maxcount <= 0) throw new Error("maxcount must be a positive integer");
+		return toUserInfoList(extractEntries(await this.adt.system.users.search({
+			querystring: normalizedQuery,
+			maxcount
+		})));
+	}
+};
+function createUserService(adt) {
+	return new UserService(adt);
+}
+
+//#endregion
+//#region src/services/source-history.ts
+var SourceHistoryProtocolError = class extends Error {
+	code;
+	ordinal;
+	constructor(code, message, ordinal) {
+		super(message);
+		this.code = code;
+		this.ordinal = ordinal;
+		this.name = "SourceHistoryProtocolError";
+	}
+};
+/**
+* An immutable source body crossed its configured byte limit.
+* This error intentionally does not retain the source URI or any source text.
+*/
+var SourceVersionTooLargeError = class extends Error {
+	maxBytes;
+	receivedBytes;
+	code = "SOURCE_VERSION_TOO_LARGE";
+	constructor(maxBytes, receivedBytes) {
+		super(`Source version exceeds the ${maxBytes}-byte limit.`);
+		this.maxBytes = maxBytes;
+		this.receivedBytes = receivedBytes;
+		this.name = "SourceVersionTooLargeError";
+	}
+};
+const ADT_PATH_PREFIX = "/sap/bc/adt/";
+const TRAVERSAL_SEGMENT = /(?:^|\/)(?:\.{1,2}|%2e(?:%2e)?)(?:\/|$)/i;
+const TRANSPORT_NUMBER = /^[A-Z0-9]{10}$/;
+function asOptionalString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function asArray(value) {
+	if (value === void 0) return [];
+	return Array.isArray(value) ? value : [value];
+}
+/**
+* Validate a server-relative ADT URI before it reaches the authenticated
+* adapter. This deliberately rejects absolute and protocol-relative URLs so a
+* source-history link cannot redirect credentials to another origin.
+*/
+function isUnsafeAdtUri(uri) {
+	if (uri !== uri.trim()) return true;
+	if (!uri.startsWith(ADT_PATH_PREFIX)) return true;
+	if (uri.startsWith("//")) return true;
+	if (uri.includes("#")) return true;
+	if (uri.includes("\\")) return true;
+	return TRAVERSAL_SEGMENT.test(uri);
+}
+function assertAdtUri(uri) {
+	if (isUnsafeAdtUri(uri)) throw new SourceHistoryProtocolError("SOURCE_HISTORY_URI_UNSAFE", "Source-history URI must be a server-relative SAP ADT path.");
+	return uri;
+}
+function isUnsafeRelativeHref(href) {
+	if (href.startsWith("//")) return true;
+	if (href.includes("\\")) return true;
+	if (href.includes(":")) return true;
+	return TRAVERSAL_SEGMENT.test(href);
+}
+function resolveRelativeAdtUri(href, versionsUri) {
+	const validatedBase = assertAdtUri(versionsUri);
+	const collectionBase = validatedBase.endsWith("/") ? validatedBase : `${validatedBase}/`;
+	const resolved = new URL(href, `https://adt.invalid${collectionBase}`);
+	return assertAdtUri(`${resolved.pathname}${resolved.search}${resolved.hash}`);
+}
+function resolveAdtUri(href, versionsUri) {
+	if (href.startsWith("/")) return assertAdtUri(href);
+	if (isUnsafeRelativeHref(href)) throw new SourceHistoryProtocolError("SOURCE_HISTORY_URI_UNSAFE", "Source-history link must stay within the SAP ADT origin.");
+	return resolveRelativeAdtUri(href, versionsUri);
+}
+function normalizeLinks(value) {
+	return asArray(value).filter((link) => Boolean(link) && typeof link === "object");
+}
+function isContentLink(link) {
+	const rel = asOptionalString(link.rel)?.toLowerCase();
+	return Boolean(rel?.endsWith("/content") || rel === "content");
+}
+function isPlainTextContentLink(link) {
+	const contentType = asOptionalString(link.type)?.toLowerCase();
+	return Boolean(contentType?.startsWith("text/plain"));
+}
+/**
+* Some SAP source-version feeds represent the immutable source body with the
+* standard Atom `content` element rather than an Atom link. Treat it exactly
+* like a content link, but only when it is explicitly plain text.
+*/
+function contentElementAsLink(entry) {
+	const content = entry.content;
+	if (!content) return void 0;
+	if (typeof content !== "object") return void 0;
+	if (Array.isArray(content)) return void 0;
+	const src = asOptionalString(content.src);
+	if (!src) return void 0;
+	const type = asOptionalString(content.type);
+	if (!type) return void 0;
+	if (!type.toLowerCase().startsWith("text/plain")) return void 0;
+	return {
+		href: src,
+		type
+	};
+}
+function isTransportRel(rel) {
+	return rel.endsWith("/transport") || rel.endsWith("/transport/request");
+}
+function transportFromTitle(link) {
+	const title = asOptionalString(link.title)?.toUpperCase();
+	if (!title) return void 0;
+	if (TRANSPORT_NUMBER.test(title)) return title;
+}
+function transportFromHref(link) {
+	const href = asOptionalString(link.href);
+	if (!href) return void 0;
+	const lastSegment = (href.split(/[?#]/, 1)[0]?.split("/").filter((segment) => segment !== ""))?.pop();
+	if (!lastSegment) return void 0;
+	try {
+		const candidate = decodeURIComponent(lastSegment).toUpperCase();
+		return TRANSPORT_NUMBER.test(candidate) ? candidate : void 0;
+	} catch {
+		return;
+	}
+}
+function transportFromLink(link) {
+	const rel = asOptionalString(link.rel)?.toLowerCase();
+	if (!rel || !isTransportRel(rel)) return void 0;
+	return transportFromTitle(link) ?? transportFromHref(link);
+}
+function authorName(value) {
+	return asOptionalString(asArray(value).find((candidate) => Boolean(candidate) && typeof candidate === "object")?.name);
+}
+/**
+* Normalize the parsed Atom versions feed while preserving SAP's feed order.
+* The result contains references and provenance only; source bodies are fetched
+* separately and are never retained by this function.
+*/
+function assertSourceVersionPayload(payload) {
+	if (!payload || typeof payload !== "object") throw new SourceHistoryProtocolError("SOURCE_VERSION_FEED_INVALID", "SAP ADT source-history response is not an Atom feed.");
+	if (!("feed" in payload)) throw new SourceHistoryProtocolError("SOURCE_VERSION_FEED_INVALID", "SAP ADT source-history response is not an Atom feed.");
+	return payload;
+}
+function assertSourceVersionFeed(feed) {
+	if (!feed) throw invalidFeedError();
+	if (typeof feed !== "object") throw invalidFeedError();
+	if (Array.isArray(feed)) throw invalidFeedError();
+	return feed;
+}
+function invalidFeedError() {
+	return new SourceHistoryProtocolError("SOURCE_VERSION_FEED_INVALID", "SAP ADT source-history feed has an invalid root.");
+}
+function readSourceVersionEntries(feed) {
+	if (feed.entry === void 0) return [];
+	const entries = asArray(feed.entry);
+	if (entries.some((entry) => !entry || typeof entry !== "object")) throw new SourceHistoryProtocolError("SOURCE_VERSION_FEED_INVALID", "SAP ADT source-history feed contains an invalid entry.");
+	return entries;
+}
+function extractContentLink(entry, ordinal) {
+	const links = normalizeLinks(entry.link);
+	const contentLink = links.find(isContentLink) ?? links.find(isPlainTextContentLink) ?? contentElementAsLink(entry);
+	const href = contentLink && asOptionalString(contentLink.href);
+	if (!contentLink || !href) throw new SourceHistoryProtocolError("SOURCE_VERSION_CONTENT_LINK_MISSING", `Source-history entry ${ordinal} has no immutable content link.`, ordinal);
+	return {
+		...contentLink,
+		href
+	};
+}
+function extractEntryTransports(links) {
+	return [...new Set(links.map(transportFromLink).filter((transport) => Boolean(transport)))];
+}
+function sourceVersionRefFromEntry(entry, ordinal, versionsUri) {
+	const id = asOptionalString(entry.id);
+	if (!id) throw new SourceHistoryProtocolError("SOURCE_VERSION_ID_MISSING", `Source-history entry ${ordinal} has no stable version id.`, ordinal);
+	const contentLink = extractContentLink(entry, ordinal);
+	return {
+		id,
+		ordinal,
+		title: asOptionalString(entry.title),
+		sourceUri: resolveAdtUri(contentLink.href, versionsUri),
+		contentType: asOptionalString(contentLink.type),
+		etag: asOptionalString(contentLink.etag),
+		updatedAt: asOptionalString(entry.updated),
+		author: authorName(entry.author),
+		transports: extractEntryTransports(normalizeLinks(entry.link))
+	};
+}
+function normalizeSourceVersionFeed(payload, versionsUri) {
+	assertAdtUri(versionsUri);
+	return readSourceVersionEntries(assertSourceVersionFeed(assertSourceVersionPayload(payload).feed)).map((entry, ordinal) => sourceVersionRefFromEntry(entry, ordinal, versionsUri));
+}
+var SourceHistoryService = class {
+	adt;
+	boundedSourceReader;
+	constructor(adt, boundedSourceReader) {
+		this.adt = adt;
+		this.boundedSourceReader = boundedSourceReader;
+	}
+	async listVersions(versionsUri) {
+		assertAdtUri(versionsUri);
+		return normalizeSourceVersionFeed(await this.adt.repository.sourceversions.list({ versionsUri }), versionsUri);
+	}
+	async readVersionSource(sourceUri) {
+		assertAdtUri(sourceUri);
+		return this.adt.repository.sourceversions.get({ sourceUri });
+	}
+	async readVersionSourceBounded(sourceUri, maxBytes) {
+		assertAdtUri(sourceUri);
+		if (!this.boundedSourceReader) throw new Error("Bounded source reads are not configured.");
+		try {
+			return await this.boundedSourceReader(sourceUri, maxBytes);
+		} catch (error) {
+			if (error instanceof AdtResponseTooLargeError) throw new SourceVersionTooLargeError(error.maxBytes, error.receivedBytes);
+			throw error;
+		}
+	}
+};
+function createSourceHistoryService(adt, boundedSourceReader) {
+	return new SourceHistoryService(adt, boundedSourceReader);
+}
+
+//#endregion
+//#region src/client.ts
+/**
+* ADT Client V2 - Contract-Based Architecture
+*
+* Provides typed access to SAP ADT REST APIs:
+* - client.adt.*   - Typed ADT REST contracts (speci-generated)
+* - client.fetch() - Generic HTTP utility for raw requests
+*
+* Note: Business logic (transport management, etc.) has moved to @abapify/adk
+* Use AdkTransportRequest for transport operations.
+*/
+function createAdtClient(config) {
+	const adapter = createAdtAdapter(config);
+	const adtClient = createAdtClient$1({
+		baseUrl: config.baseUrl,
+		adapter
+	});
+	const fetchFn = async (url, options) => {
+		const requestOptions = {
+			method: options?.method || "GET",
+			url,
+			headers: options?.headers || {},
+			body: options?.body
+		};
+		return adapter.request(requestOptions);
+	};
+	const readTextBounded = async (url, maxBytes, options) => adapter.readTextBounded({
+		url,
+		headers: options?.headers
+	}, maxBytes);
+	return {
+		/**
+		* Typed ADT REST contracts
+		* Direct access to speci-generated client methods
+		*/
+		adt: adtClient,
+		/**
+		* Services layer - business logic orchestration
+		* Higher-level operations that combine multiple contract calls
+		*/
+		services: {
+			transports: createTransportService(adtClient),
+			sourceHistory: createSourceHistoryService(adtClient, (sourceUri, maxBytes) => readTextBounded(sourceUri, maxBytes, { headers: { Accept: "text/plain" } }))
+		},
+		/**
+		* Generic fetch utility for arbitrary ADT endpoints
+		* Useful for debugging, testing, or accessing undocumented APIs
+		*
+		* @param url - The ADT endpoint path (e.g., '/sap/bc/adt/core/http/sessions')
+		* @param options - Request options (method, headers, body)
+		* @returns Raw response
+		*/
+		fetch: fetchFn,
+		/**
+		* Read an authenticated plain-text endpoint while enforcing a byte limit.
+		*/
+		readTextBounded,
+		/**
+		* Clear cached ETag for a specific URL, or all ETags if no URL given.
+		* Use after operations that may invalidate server-side ETags.
+		*/
+		clearETag: (url) => adapter.clearETag(url)
+	};
+}
+
+//#endregion
+//#region src/plugins/logging.ts
+/**
+* Logging plugin - logs requests and responses
+*/
+var LoggingPlugin = class {
+	logger;
+	name = "logging";
+	constructor(logger = console.log) {
+		this.logger = logger;
+	}
+	process(context) {
+		this.logger(`[${context.method}] ${context.url}`, {
+			contentType: context.contentType,
+			hasParsedData: !!context.parsedData,
+			rawSize: context.rawText.length
+		});
+		return context.parsedData;
+	}
+};
+
+//#endregion
+//#region src/plugins/file-logging.ts
+/**
+* File Logging Plugin - Saves HTTP responses to files
+*/
+/**
+* Plugin that logs HTTP responses to files
+* Similar to v1's FileLogger functionality
+*/
+var FileLoggingPlugin = class {
+	config;
+	name = "file-logging";
+	constructor(config) {
+		this.config = config;
+	}
+	process(context) {
+		try {
+			const filePath = this.generateFilePath(context.url, context.method);
+			const fullPath = join(this.config.outputDir, filePath);
+			mkdirSync(dirname(fullPath), { recursive: true });
+			writeFileSync(fullPath, context.rawText, "utf8");
+			this.config.logger?.trace(`Wrote response to: ${fullPath}`);
+			if (this.config.writeMetadata) {
+				const metadataPath = this.getMetadataPath(fullPath);
+				const metadata = {
+					url: context.url,
+					method: context.method,
+					contentType: context.contentType,
+					timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+					size: context.rawText.length
+				};
+				writeFileSync(metadataPath, JSON.stringify(metadata, null, 2), "utf8");
+				this.config.logger?.trace(`Wrote metadata to: ${metadataPath}`);
+			}
+		} catch (error) {
+			this.config.logger?.error(`Failed to write response file: ${error instanceof Error ? error.message : String(error)}`);
+		}
+		return context.parsedData;
+	}
+	/**
+	* Generate file path for HTTP response
+	* Converts URL to fixture-style path structure
+	*/
+	generateFilePath(url, method) {
+		const urlObj = new URL(url);
+		let path = urlObj.pathname;
+		path = path.replace(/^\/sap\/bc\/adt\/?/, "");
+		if (!path || path === "discovery") return "./adt/core/discovery.xml";
+		const [basePath] = path.split("?");
+		const segments = basePath.split("/").filter((s) => s);
+		const sourceTypes = [
+			"main",
+			"definitions",
+			"implementations",
+			"macros",
+			"testclasses"
+		];
+		const lastSegment = segments[segments.length - 1];
+		if (sourceTypes.includes(lastSegment)) return `./adt/${segments.join("/")}`;
+		const requestId = Date.now().toString() + Math.random().toString(36).slice(2, 7);
+		let dirPath = `./adt/${segments.join("/")}`;
+		if (urlObj.search) {
+			const sanitizedQuery = urlObj.search.slice(1).replaceAll(/[^a-zA-Z0-9_-]/g, "_");
+			dirPath += `/${sanitizedQuery}`;
+		}
+		const methodPrefix = method !== "GET" ? `${method.toLowerCase()}-` : "";
+		return `${dirPath}/${methodPrefix}${requestId}-response.xml`;
+	}
+	/**
+	* Get metadata file path for a response file
+	*/
+	getMetadataPath(responsePath) {
+		if (/-response\.xml$/.test(responsePath)) return responsePath.replace(/-response\.xml$/, "-metadata.json");
+		if (/\.xml$/.test(responsePath)) return responsePath.replace(/\.xml$/, ".metadata.json");
+		return `${responsePath}.metadata.json`;
+	}
+};
+
+//#endregion
+export { AdtResponseTooLargeError, CookieStore, CsrfTokenManager, FileLoggingPlugin, LoggingPlugin, SessionManager, SourceHistoryProtocolError, SourceHistoryService, SourceVersionTooLargeError, TransportService, UserService, adtContract, assertAdtUri, createAdtAdapter, createAdtClient, createSourceHistoryService, createTransportService, createUserService, normalizeSourceVersionFeed, runWithAdtAbortSignal };
+//# sourceMappingURL=index.mjs.map