@mcp-abap-adt/connection 1.10.1 → 2.0.0

package/dist/connection/AbstractAbapConnection.js

@@ -38,11 +38,24 @@ const node_crypto_1 = require("node:crypto");
 const node_https_1 = require("node:https");
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
 const axios_1 = __importStar(require("axios"));
+const SessionLifecycle_js_1 = require("../session/SessionLifecycle.js");
 const timeouts_js_1 = require("../utils/timeouts.js");
 const csrfConfig_js_1 = require("./csrfConfig.js");
+/**
+ * Declares the capabilities explicitly rather than satisfying them by accident.
+ * `AbapConnection` is the base contract every transport honours; these two are
+ * the HTTP session's own, and naming them means a signature that drifts from
+ * the published contract fails to compile here instead of at the consumer.
+ */
 class AbstractAbapConnection {
     config;
     logger;
+    /**
+     * Owns session state, admission and teardown ordering. Composed rather than
+     * inherited: RfcAbapConnection implements the interface directly, so the two
+     * transports share this unit instead of a base class.
+     */
+    lifecycle = new SessionLifecycle_js_1.SessionLifecycle();
     axiosInstance = null;
     csrfToken = null;
     cookies = null;
@@ -161,7 +174,259 @@ class AbstractAbapConnection {
     getConfig() {
         return this.config;
     }
+    /**
+     * Establishes the session, once, under the lifecycle.
+     *
+     * Idempotent, and concurrent callers share one establishment: the transition
+     * joins the tail of its own kind. A teardown requested while establishment
+     * was in flight means the caller asked to stop, so usability is NOT published
+     * and what was established is released — otherwise a slow connect would hand
+     * back a session someone had already discarded.
+     */
+    async connect() {
+        // Captured HERE, not inside the transition: the callback runs when this
+        // reaches the front of the queue, by which time a teardown the caller
+        // requested afterwards has already bumped the epoch — and comparing it
+        // against itself would let the connect publish a session the caller had
+        // asked to stop. The baseline is "when the caller asked to connect".
+        const baselineEpoch = this.lifecycle.teardownEpoch;
+        await this.lifecycle.transition('connect', async () => {
+            if (this.lifecycle.connected)
+                return;
+            await this.establishAndCommit(baselineEpoch);
+        });
+    }
+    /**
+     * Tears the session down. Never throws: the report says what did not finish
+     * rather than failing. Sends no ADT session-close — see the design's D2.
+     */
+    async disconnect() {
+        this.lifecycle.beginTeardown({ origin: 'caller', sessionLost: false });
+        // The report travels THROUGH the transition, so a joining caller gets the
+        // same one. Building it outside would leave every caller but the first
+        // reporting an empty teardown — the abandoned locks reported to nobody.
+        return this.lifecycle.transition('disconnect', async () => {
+            const drained = await this.lifecycle.drain();
+            this.clearSessionState();
+            this.lifecycle.markDisconnected();
+            return {
+                abandonedWindows: drained.abandonedWindows,
+                releasePending: false,
+            };
+        });
+    }
+    isConnected() {
+        return this.lifecycle.connected;
+    }
+    /**
+     * Fingerprint of the SAP-side session, or null when none is known.
+     *
+     * `null` is NOT a statement about the connection. Two situations produce it:
+     * no session exists, or the connection is live over a server that issued no
+     * session cookie. Use {@link isConnected} for connection state.
+     *
+     * It follows that null → non-null is not a replacement but an identity being
+     * learned; only a CHANGED value means the session was replaced.
+     */
+    getSessionIdentity() {
+        return this.lifecycle.identity;
+    }
+    /** Opens a lock window. See the design: a lock outlives its request. */
+    beginWindow(label) {
+        return this.lifecycle.beginWindow(label);
+    }
+    endWindow(token) {
+        this.lifecycle.endWindow(token);
+    }
+    /**
+     * Discards the session at a caller's request: cancels queued recoveries and
+     * queues the cleanup rather than tearing down under a live request.
+     */
     reset() {
+        this.lifecycle.beginTeardown({ origin: 'caller', sessionLost: true });
+        void this.lifecycle.transition('cleanup', async () => {
+            await this.lifecycle.drain();
+            this.clearSessionState();
+            this.lifecycle.markDisconnected();
+        });
+    }
+    /**
+     * Re-establishes the session for a request that is recovering from a
+     * credential renewal, then lets that request retry.
+     *
+     * Runs as its own `recover` transition, which never joins another: each
+     * recovery carries the baseline of its own request. It yields to a caller's
+     * teardown — if the epoch moved since `baselineEpoch`, someone asked to stop
+     * while this was being prepared, and a retry must not resurrect a session
+     * they discarded.
+     *
+     * The transition queues behind the cleanup that the renewal itself raised, so
+     * it never re-establishes on top of stale transport state.
+     */
+    async recoverSession(baselineEpoch) {
+        await this.lifecycle.transition('recover', async () => {
+            await this.establishAndCommit(baselineEpoch);
+        });
+    }
+    /**
+     * Establishes a session and publishes it — but only if nobody asked to stop
+     * meanwhile.
+     *
+     * The epoch is checked BEFORE, so a teardown already requested costs no round
+     * trip, and AFTER, because establishment takes time and a caller can ask to
+     * stop during it. Checking only before is the defect this exists to prevent:
+     * markConnected() would then clear the teardown state and hand back a session
+     * the caller had already discarded.
+     *
+     * Shared by connect() and recoverSession() rather than written twice —
+     * the two drifted apart once already, and a third caller would drift again.
+     */
+    async establishAndCommit(baselineEpoch) {
+        if (this.lifecycle.teardownEpoch !== baselineEpoch) {
+            throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED, 'Establishment abandoned: a teardown was requested for this connection');
+        }
+        try {
+            await this.establishSession();
+        }
+        catch (error) {
+            // A failed establishment leaves debris that poisons the next attempt: the
+            // 401 that rejected us may still have carried a Set-Cookie, and every
+            // subclass treats a cookie as proof that auth is already settled —
+            // buildAuthorizationHeader() returns '' once one exists. So the next
+            // connect() would go out with NO credentials at all, and be rejected for
+            // a reason that has nothing to do with why the first one failed.
+            //
+            // Safe to clear here, unlike the abandonment path below: establishSession()
+            // threw, so no session was published, and admission requires a connected
+            // lifecycle — nothing can be in flight over what this drops.
+            this.invalidateSession();
+            // And the identity with it. The rejecting response was still observed, so
+            // its cookie was recorded as a session that had just been established —
+            // leaving getSessionIdentity() naming a session that never existed while
+            // isConnected() says false. Two answers to one question is worse than
+            // either.
+            this.lifecycle.markDisconnected();
+            throw error;
+        }
+        if (this.lifecycle.teardownEpoch !== baselineEpoch) {
+            // Abandon WITHOUT clearing: the teardown that bumped the epoch is already
+            // queued, and it clears after draining. Clearing here would pull cookies,
+            // the CSRF token and the axios instance out from under a request that is
+            // still in flight — breaking the guarantee this whole change rests on,
+            // from inside the guard meant to protect it.
+            throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED, 'Establishment abandoned: a teardown was requested while it was in flight');
+        }
+        // establishSession() throws on failure, so reaching here means a session
+        // exists. There is no third outcome: no "connected but unusable", no
+        // resolved promise over an empty jar.
+        this.lifecycle.markConnected(this.sessionFingerprint());
+    }
+    /** The teardown epoch, for a recovery to capture before it starts. */
+    get teardownEpoch() {
+        return this.lifecycle.teardownEpoch;
+    }
+    /**
+     * Raises a session-lost teardown from inside request handling.
+     *
+     * There are exactly three things that can cost us the ABAP session, and they
+     * were found one at a time precisely because they were written apart. They go
+     * through here so a fourth joins the list instead of inventing its own
+     * sequence:
+     *
+     *   - the credential was renewed (the injected auth says so);
+     *   - the server says the session is gone (a dead-session response);
+     *   - the tracked cookie changed under us while a lock was held.
+     *
+     * `internal` origin, so it does not cancel the recovery that raised it, and
+     * `sessionLost`, so admission shuts at once and the identity is dropped
+     * immediately — a later comparison must see the change, and on a dead session
+     * the cookie is unchanged, so only the state can tell.
+     *
+     * Does not await: it is called from inside a request, and the queued cleanup
+     * drains that very request.
+     */
+    raiseSessionLost(reason) {
+        this.logger?.warn(`Session lost: ${reason}`);
+        this.lifecycle.beginTeardown({ origin: 'internal', sessionLost: true });
+        void this.lifecycle.transition('cleanup', async () => {
+            await this.lifecycle.drain();
+            this.clearSessionState();
+            this.lifecycle.markDisconnected();
+        });
+    }
+    /** The credential-renewal raiser; see raiseSessionLost(). */
+    discardSession() {
+        this.raiseSessionLost('the credential backing it was renewed');
+    }
+    /**
+     * Whether an error is this connection's own verdict about the session rather
+     * than something the server said about a request.
+     *
+     * A retry path that swallows one of these and rethrows the original error
+     * turns "your lock is dead" back into "your request 403'd", which is the very
+     * information the caller needs and the only one it cannot recover itself.
+     */
+    isSessionVerdict(error) {
+        const code = error?.code;
+        return (code === interfaces_1.ADT_SESSION_ERROR.SESSION_REPLACED ||
+            code === interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED ||
+            code === interfaces_1.ADT_SESSION_ERROR.RELEASE_PENDING);
+    }
+    /**
+     * Folds a response into the session state AND acts on what it means, in one
+     * step.
+     *
+     * Never call updateCookiesFromResponse() directly: it MUTATES the fingerprint,
+     * so discarding its classification absorbs a replacement silently and every
+     * later check reads `unchanged`. That is one call site forgetting, and it
+     * happened — on the error path and on every retry response.
+     */
+    observeResponse(headers) {
+        this.applyIdentityPolicy(this.updateCookiesFromResponse(headers));
+    }
+    /**
+     * Acts on what a response said about the session identity.
+     *
+     * A replacement is fatal only while a lock is held — and "a lock is held"
+     * means an open window, not `sessionMode`: a mode flag cannot represent
+     * windows, another handler can flip it back, and a batch never sets it.
+     * With no lock held the same replacement is not a loss: nothing was being
+     * held, so the new identity simply becomes the current one.
+     */
+    applyIdentityPolicy(classification) {
+        if (classification !== 'replaced')
+            return;
+        if (this.lifecycle.openWindows.length === 0) {
+            this.logger?.debug('Session identity changed with no lock held; continuing on the new one');
+            return;
+        }
+        this.raiseSessionLost('the session cookie changed while a lock was held');
+        throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.SESSION_REPLACED, 'The SAP session was replaced while a lock was held; the lock handle is dead');
+    }
+    /**
+     * Whether the server is telling us the session it was given no longer exists.
+     *
+     * The E19 shape was HTTP 400 with "Session not found", answered in ~60 ms
+     * with the cookie present — which is why identity comparison cannot see this:
+     * the cookie, and therefore the fingerprint, is completely unchanged. The
+     * exact match is landscape-specific and is one of the live probes this design
+     * still owes.
+     */
+    isDeadSessionResponse(error) {
+        if (!(error instanceof axios_1.AxiosError) || !error.response)
+            return false;
+        if (error.response.status !== 400)
+            return false;
+        const text = [
+            error.response.statusText,
+            typeof error.response.data === 'string' ? error.response.data : '',
+        ]
+            .join(' ')
+            .toLowerCase();
+        return text.includes('session not found');
+    }
+    /** Drops everything that described the session. Not a lifecycle transition. */
+    clearSessionState() {
         if (this.axiosInstance) {
             this.axiosInstance.interceptors.request.clear();
             this.axiosInstance.interceptors.response.clear();
@@ -172,6 +437,23 @@ class AbstractAbapConnection {
         this.cookieStore.clear();
         // Note: baseUrl is not reset as it's derived from immutable config
     }
+    /**
+     * The session-bearing cookies, and only those.
+     *
+     * `sap-XSRF_*` is excluded deliberately: it changes on a token refresh WITHIN
+     * the same session, so including it would report an ordinary refresh as a new
+     * session and fail exactly where nothing is wrong. `sap-usercontext` is ours,
+     * overwritten on every response.
+     */
+    sessionFingerprint() {
+        const fingerprint = new Map();
+        for (const [name, value] of this.cookieStore) {
+            if (name.startsWith('SAP_SESSIONID')) {
+                fingerprint.set(name, value);
+            }
+        }
+        return fingerprint;
+    }
     async getBaseUrl() {
         return this.baseUrl;
     }
@@ -187,6 +469,20 @@ class AbstractAbapConnection {
         return headers;
     }
     async makeAdtRequest(options) {
+        // Admission first, synchronously, before any await: the check and the
+        // count must happen in one step, or a request could be admitted and still
+        // be invisible to a teardown draining at that instant. Throws
+        // NOT_CONNECTED when the caller never connected, or when a teardown has
+        // shut the door.
+        const lease = this.lifecycle.admitRequest();
+        try {
+            return await this.performRequest(options);
+        }
+        finally {
+            lease.release();
+        }
+    }
+    async performRequest(options) {
         const { url: endpoint, method, timeout, data, params, headers: customHeaders, } = options;
         const normalizedMethod = method.toUpperCase();
         // Build full URL: baseUrl + endpoint
@@ -282,7 +578,7 @@ class AbstractAbapConnection {
         });
         try {
             const response = await this.getAxiosInstance()(requestConfig);
-            this.updateCookiesFromResponse(response.headers);
+            this.observeResponse(response.headers);
             this.logger?.debug(`Request succeeded with status ${response.status}`, {
                 type: 'REQUEST_SUCCESS',
                 status: response.status,
@@ -305,7 +601,17 @@ class AbstractAbapConnection {
                     typeof error.response.data === 'string'
                         ? error.response.data.slice(0, 200)
                         : JSON.stringify(error.response.data).slice(0, 200);
-                this.updateCookiesFromResponse(error.response.headers);
+                this.observeResponse(error.response.headers);
+            }
+            // The server telling us the session is gone is invisible to the identity
+            // comparison: the cookie, and therefore the fingerprint, is unchanged.
+            // Only the state can see it, and it must say so at once — otherwise a
+            // later unlockAll() finds a match and unlocks over a dead session.
+            if (this.isDeadSessionResponse(error)) {
+                this.raiseSessionLost('the server reports the session no longer exists');
+                // No internal retry: a blind retry here is what produced further locks
+                // in the field. The caller decides.
+                throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.SESSION_REPLACED, 'The SAP session no longer exists; any lock handle from it is dead');
             }
             // Check if this is a network error (connection refused, timeout, DNS, etc.)
             // Don't retry for network errors - these indicate infrastructure/VPN issues
@@ -357,10 +663,16 @@ class AbstractAbapConnection {
                         requestHeaders.Cookie = refreshedCookies;
                     }
                     const retryResponse = await this.getAxiosInstance()(requestConfig);
-                    this.updateCookiesFromResponse(retryResponse.headers);
+                    this.observeResponse(retryResponse.headers);
                     return retryResponse;
                 }
                 catch (retryError) {
+                    // A session verdict outranks the error that started the retry: the
+                    // caller can retry a 403 itself, but it cannot discover that its lock
+                    // handle is dead from a 403.
+                    if (this.isSessionVerdict(retryError)) {
+                        throw retryError;
+                    }
                     this.logger?.debug(`CSRF retry failed; rethrowing original error: ${retryError instanceof Error
                         ? retryError.message
                         : String(retryError)}`);
@@ -379,7 +691,7 @@ class AbstractAbapConnection {
                     this.logger?.debug(`[DEBUG] BaseAbapConnection - 401 on GET request, retrying with cookies from error response`);
                     requestHeaders.Cookie = this.cookies;
                     const retryResponse = await this.getAxiosInstance()(requestConfig);
-                    this.updateCookiesFromResponse(retryResponse.headers);
+                    this.observeResponse(retryResponse.headers);
                     return retryResponse;
                 }
                 // If no cookies, try to get them via CSRF token fetch
@@ -391,11 +703,14 @@ class AbstractAbapConnection {
                         requestHeaders.Cookie = this.cookies;
                         this.logger?.debug(`[DEBUG] BaseAbapConnection - Retrying GET request with cookies from CSRF fetch`);
                         const retryResponse = await this.getAxiosInstance()(requestConfig);
-                        this.updateCookiesFromResponse(retryResponse.headers);
+                        this.observeResponse(retryResponse.headers);
                         return retryResponse;
                     }
                 }
                 catch (csrfError) {
+                    if (this.isSessionVerdict(csrfError)) {
+                        throw csrfError;
+                    }
                     this.logger?.debug(`[DEBUG] BaseAbapConnection - Failed to get CSRF token for 401 retry: ${csrfError instanceof Error ? csrfError.message : String(csrfError)}`);
                     // Fall through to throw original error
                 }
@@ -434,6 +749,13 @@ class AbstractAbapConnection {
                 return await this.fetchCsrfTokenFromEndpoint(csrfUrl, retryCount, retryDelay);
             }
             catch (error) {
+                // Third layer with a catch on this path, and the last one that could
+                // bury a verdict: falling through to the fallback endpoint would open
+                // ANOTHER session, and by then the teardown has cleared the fingerprint
+                // so the new one reads as `established` and the loss disappears.
+                if (this.isSessionVerdict(error)) {
+                    throw error;
+                }
                 lastError = error instanceof Error ? error : new Error(String(error));
                 this.logger?.debug(`CSRF token not available from ${csrfUrl}, trying next endpoint...`);
             }
@@ -482,7 +804,7 @@ class AbstractAbapConnection {
                     headers,
                     timeout: (0, timeouts_js_1.getTimeout)('csrf'),
                 });
-                this.updateCookiesFromResponse(response.headers);
+                this.observeResponse(response.headers);
                 const token = response.headers['x-csrf-token'];
                 if (!token) {
                     this.logger?.error('No CSRF token in response headers', {
@@ -496,7 +818,7 @@ class AbstractAbapConnection {
                     throw new Error(csrfConfig_js_1.CSRF_ERROR_MESSAGES.NOT_IN_HEADERS);
                 }
                 if (response.headers['set-cookie']) {
-                    this.updateCookiesFromResponse(response.headers);
+                    this.observeResponse(response.headers);
                     if (this.cookies) {
                         this.logger?.debug(`[DEBUG] BaseAbapConnection - Cookies received from CSRF response (first 100 chars): ${this.cookies.substring(0, 100)}...`);
                         this.logger?.debug('Cookies extracted from response', {
@@ -508,11 +830,19 @@ class AbstractAbapConnection {
                 return token;
             }
             catch (error) {
+                // A session verdict is not a failed token fetch and must not be
+                // retried into silence: the retry would observe the SAME new session,
+                // read it as `unchanged`, and the replacement this raised would be gone
+                // for good. It leaves immediately, past the loop and past the caller's
+                // recovery.
+                if (this.isSessionVerdict(error)) {
+                    throw error;
+                }
                 if (error instanceof axios_1.AxiosError) {
                     // Always try to extract cookies from error response, even on 401
                     // This ensures cookies are available for subsequent requests
                     if (error.response?.headers) {
-                        this.updateCookiesFromResponse(error.response.headers);
+                        this.observeResponse(error.response.headers);
                         if (this.cookies) {
                             this.logger?.debug('Cookies extracted from error response', {
                                 status: error.response.status,
@@ -531,14 +861,14 @@ class AbstractAbapConnection {
                         this.logger?.debug('CSRF: SAP returned 405 (Method Not Allowed) — not critical, token found in header');
                         const token = error.response.headers['x-csrf-token'];
                         if (token) {
-                            this.updateCookiesFromResponse(error.response.headers);
+                            this.observeResponse(error.response.headers);
                             return token;
                         }
                     }
                     if (error.response?.headers['x-csrf-token']) {
                         this.logger?.debug(`Got CSRF token despite error (status: ${error.response?.status})`);
                         const token = error.response.headers['x-csrf-token'];
-                        this.updateCookiesFromResponse(error.response.headers);
+                        this.observeResponse(error.response.headers);
                         return token;
                     }
                     if (error.response) {
@@ -597,13 +927,19 @@ class AbstractAbapConnection {
     setInitialCookies(cookies) {
         this.cookies = cookies;
     }
+    /**
+     * Folds a response's cookies into the jar and classifies what that means for
+     * the session identity. Returns the classification rather than acting on it:
+     * cookie parsing stays free of policy, and no exception fires in the middle
+     * of a state update. The caller decides.
+     */
     updateCookiesFromResponse(headers) {
         if (!headers) {
-            return;
+            return 'unchanged';
         }
         const setCookie = headers['set-cookie'];
         if (!setCookie) {
-            return;
+            return 'unchanged';
         }
         const cookiesArray = Array.isArray(setCookie) ? setCookie : [setCookie];
         for (const entry of cookiesArray) {
@@ -633,16 +969,17 @@ class AbstractAbapConnection {
             this.cookieStore.set('sap-usercontext', `sap-client=${this.config.client}`);
         }
         if (this.cookieStore.size === 0) {
-            return;
+            return 'unchanged';
         }
         const combined = Array.from(this.cookieStore.entries())
             .map(([name, value]) => (value ? `${name}=${value}` : name))
             .join('; ');
         if (!combined) {
-            return;
+            return 'unchanged';
         }
         this.cookies = combined;
         this.logger?.debug(`[DEBUG] BaseAbapConnection - Updated cookies from response (first 100 chars): ${this.cookies.substring(0, 100)}...`);
+        return this.lifecycle.observe(this.sessionFingerprint());
     }
     /**
      * Subclasses override to inject extra https.Agent options (e.g. mTLS cert/key/pfx).

package/dist/connection/BaseAbapConnection.d.ts

@@ -12,7 +12,11 @@ export declare class BaseAbapConnection extends AbstractAbapConnection {
      * Connect to SAP system with Basic Auth
      * Fetches CSRF token which also establishes session cookies
      */
-    connect(): Promise<void>;
+    /**
+     * Establishes the session for this auth type. Called by
+     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
+     */
+    protected establishSession(): Promise<void>;
     protected buildAuthorizationHeader(): string;
     private static validateConfig;
 }

package/dist/connection/BaseAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/BaseAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAE1D,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAMzC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsC9B,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAU5C,OAAO,CAAC,MAAM,CAAC,cAAc;CAmB9B"}
+{"version":3,"file":"BaseAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/BaseAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAE1D,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAMzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAU5C,OAAO,CAAC,MAAM,CAAC,cAAc;CAmB9B"}

package/dist/connection/BaseAbapConnection.js

@@ -15,7 +15,11 @@ class BaseAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnect
      * Connect to SAP system with Basic Auth
      * Fetches CSRF token which also establishes session cookies
      */
-    async connect() {
+    /**
+     * Establishes the session for this auth type. Called by
+     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
+     */
+    async establishSession() {
         const baseUrl = await this.getBaseUrl();
         const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
         this.logger?.debug(`[DEBUG] BaseAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
@@ -41,6 +45,12 @@ class BaseAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnect
                     this.logger?.debug(`[DEBUG] BaseAbapConnection - Cookies extracted from error response during connect (first 100 chars): ${this.getCookies()?.substring(0, 100)}...`);
                 }
             }
+            // Rethrow: a resolved connect() must mean a usable session exists. This
+            // used to swallow and resolve anyway, deferring establishment to the
+            // first request — coherent only while that lazy path existed. Without it,
+            // swallowing would leave a connection that reports success, holds
+            // nothing, and refuses every request.
+            throw error;
         }
     }
     buildAuthorizationHeader() {

package/dist/connection/CertificateAbapConnection.d.ts

@@ -14,7 +14,11 @@ export declare class CertificateAbapConnection extends AbstractAbapConnection {
      * Loads certificate material and primes the session. MUST be called before the first
      * request — the TLS agent is built lazily and needs the client cert present.
      */
-    connect(): Promise<void>;
+    /**
+     * Establishes the session for this auth type. Called by
+     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
+     */
+    protected establishSession(): Promise<void>;
     protected getHttpsAgentOptions(): AgentOptions;
     protected buildAuthorizationHeader(): string;
 }

package/dist/connection/CertificateAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CertificateAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CertificateAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,mFAAmF;AACnF,qBAAa,yBAA0B,SAAQ,sBAAsB;IACnE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAqC;gBAGnD,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,0BAA0B;IAOrC,OAAO,CAAC,MAAM,CAAC,cAAc;cAyBb,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/C;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB9B,SAAS,CAAC,oBAAoB,IAAI,YAAY;IAU9C,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAG7C"}
+{"version":3,"file":"CertificateAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CertificateAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,mFAAmF;AACnF,qBAAa,yBAA0B,SAAQ,sBAAsB;IACnE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAqC;gBAGnD,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,0BAA0B;IAOrC,OAAO,CAAC,MAAM,CAAC,cAAc;cAyBb,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/C;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjD,SAAS,CAAC,oBAAoB,IAAI,YAAY;IAU9C,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAG7C"}

package/dist/connection/CertificateAbapConnection.js

@@ -38,7 +38,11 @@ class CertificateAbapConnection extends AbstractAbapConnection_js_1.AbstractAbap
      * Loads certificate material and primes the session. MUST be called before the first
      * request — the TLS agent is built lazily and needs the client cert present.
      */
-    async connect() {
+    /**
+     * Establishes the session for this auth type. Called by
+     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
+     */
+    async establishSession() {
         await this.ensureMaterial();
         const baseUrl = await this.getBaseUrl();
         const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
@@ -53,6 +57,12 @@ class CertificateAbapConnection extends AbstractAbapConnection_js_1.AbstractAbap
                     this.logger?.debug(`[DEBUG] CertificateAbapConnection - Cookies extracted from error response during connect (first 100 chars): ${this.getCookies()?.substring(0, 100)}...`);
                 }
             }
+            // Rethrow: a resolved connect() must mean a usable session exists. This
+            // used to swallow and resolve anyway, deferring establishment to the
+            // first request — coherent only while that lazy path existed. Without it,
+            // swallowing would leave a connection that reports success, holds
+            // nothing, and refuses every request.
+            throw error;
         }
     }
     getHttpsAgentOptions() {

package/dist/connection/JwtAbapConnection.d.ts

@@ -21,9 +21,10 @@ export declare class JwtAbapConnection extends AbstractAbapConnection {
      */
     private tryRefreshToken;
     /**
-     * Override connect to handle JWT token refresh on errors
+     * Establishes the session for this auth type. Called by
+     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
      */
-    connect(): Promise<void>;
+    protected establishSession(): Promise<void>;
     /**
      * Override makeAdtRequest to handle JWT auth errors with automatic token refresh
      */

package/dist/connection/JwtAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/JwtAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;GAMG;AACH,qBAAa,iBAAkB,SAAQ,sBAAsB;IAC3D,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAS;gBAG3B,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe;IAWlC,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAW5C;;;OAGG;YACW,eAAe;IA0B7B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAyD9B;;OAEG;IACG,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAyD9B;;OAEG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,SAAI,EACd,UAAU,SAAO,GAChB,OAAO,CAAC,MAAM,CAAC;IA2ClB,OAAO,CAAC,MAAM,CAAC,cAAc;CAa9B"}
+{"version":3,"file":"JwtAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/JwtAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;GAMG;AACH,qBAAa,iBAAkB,SAAQ,sBAAsB;IAC3D,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAS;gBAG3B,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe;IAWlC,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAW5C;;;OAGG;YACW,eAAe;IA0B7B;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA2DjD;;OAEG;IACG,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAiE9B;;OAEG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,SAAI,EACd,UAAU,SAAO,GAChB,OAAO,CAAC,MAAM,CAAC;IA2ClB,OAAO,CAAC,MAAM,CAAC,cAAc;CAa9B"}