@mcp-abap-adt/connection 3.0.0 → 5.0.0

package/dist/connection/RfcAbapConnection.js

@@ -291,13 +291,6 @@ class RfcAbapConnection {
             throw new Error(`RFC call to SADT_REST_RFC_ENDPOINT failed: ${msg}`);
         }
     }
-    /**
-     * Reset the connection — for RFC this closes the session.
-     * Provides interface compatibility with HTTP connections.
-     */
-    reset() {
-        this.close();
-    }
     /**
      * Close the RFC connection and release the ABAP session.
      */

package/dist/connection/SamlAbapConnection.d.ts

@@ -2,7 +2,13 @@ import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import { AbstractAbapConnection } from './AbstractAbapConnection.js';
 /**
- * SAML session cookie authentication for SAP systems
+ * @deprecated The class you take should say which SYSTEM you are dialling,
+ * not which credential you hold — a session mechanism that rides along with
+ * the credential gets one of them wrong. Use `AdtOnPremConnector` with `SamlAuthProvider`:
+ *
+ *   new AdtOnPremConnector(config, new SamlAuthProvider(cookies), logger)
+ *
+ * Kept working, and not removed here: existing consumers are unaffected.
  */
 export declare class SamlAbapConnection extends AbstractAbapConnection {
     private sessionCookies;

package/dist/connection/SamlAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SamlAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/SamlAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;IAC5D,OAAO,CAAC,cAAc,CAAS;gBAG7B,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAUzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAItC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQvD,OAAO,CAAC,MAAM,CAAC,cAAc;CAW9B"}
+{"version":3,"file":"SamlAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/SamlAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;IAC5D,OAAO,CAAC,cAAc,CAAS;gBAG7B,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAUzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAwCjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAItC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAQvD,OAAO,CAAC,MAAM,CAAC,cAAc;CAW9B"}

package/dist/connection/SamlAbapConnection.js

@@ -4,7 +4,13 @@ exports.SamlAbapConnection = void 0;
 const axios_1 = require("axios");
 const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
 /**
- * SAML session cookie authentication for SAP systems
+ * @deprecated The class you take should say which SYSTEM you are dialling,
+ * not which credential you hold — a session mechanism that rides along with
+ * the credential gets one of them wrong. Use `AdtOnPremConnector` with `SamlAuthProvider`:
+ *
+ *   new AdtOnPremConnector(config, new SamlAuthProvider(cookies), logger)
+ *
+ * Kept working, and not removed here: existing consumers are unaffected.
  */
 class SamlAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
     sessionCookies;
@@ -29,7 +35,7 @@ class SamlAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnect
         const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
         this.logger?.debug(`[DEBUG] SamlAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
         try {
-            const token = await this.fetchCsrfToken(discoveryUrl, 3, 1000);
+            const token = await this.fetchCsrfToken(discoveryUrl);
             this.setCsrfToken(token);
             this.logger?.debug('Successfully connected to SAP system', {
                 hasCsrfToken: !!this.getCsrfToken(),

package/dist/connection/connectionFactory.d.ts

@@ -2,8 +2,24 @@ import type { ICertificateMaterialLoader, ITokenRefresher } from '@mcp-abap-adt/
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import type { AbapConnection } from './AbapConnection.js';
+/**
+ * Builds the connection the caller asked for.
+ *
+ * **Say which system it is** with `options.system`, and that is what you get —
+ * `'onprem'` or `'cloud'` — with the credential built from the config and
+ * handed in as an auth provider. Nothing about the system is worked out here:
+ * not from the credential, not from the host name, not by asking the server.
+ *
+ * Without it, the old behaviour: a connection chosen from `authType`, which is
+ * the arrangement where the credential drags the session mechanism along with
+ * it and gets one of them wrong. **Deprecated**, kept so existing callers keep
+ * working, and warned about once per call so it is visible rather than
+ * inherited by accident.
+ */
 export declare function createAbapConnection(config: SapConfig, logger?: ILogger | null, sessionId?: string, tokenRefresher?: ITokenRefresher, options?: {
     skipSessionType?: boolean;
     certLoader?: ICertificateMaterialLoader;
+    /** Which system this is. Said by the caller; never inferred. */
+    system?: 'onprem' | 'cloud';
 }): AbapConnection;
 //# sourceMappingURL=connectionFactory.d.ts.map

package/dist/connection/connectionFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectionFactory.d.ts","sourceRoot":"","sources":["../../src/connection/connectionFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAQ1D,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe,EAChC,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,0BAA0B,CAAC;CACzC,GACA,cAAc,CAgChB"}
+{"version":3,"file":"connectionFactory.d.ts","sourceRoot":"","sources":["../../src/connection/connectionFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAmD1D;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe,EAChC,OAAO,CAAC,EAAE;IACR,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,0BAA0B,CAAC;IACxC,gEAAgE;IAChE,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CAC7B,GACA,cAAc,CA2ChB"}

package/dist/connection/connectionFactory.js

@@ -1,12 +1,58 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createAbapConnection = createAbapConnection;
+const providers_js_1 = require("../auth/providers.js");
+const AdtCloudConnector_js_1 = require("./AdtCloudConnector.js");
+const AdtOnPremConnector_js_1 = require("./AdtOnPremConnector.js");
 const BaseAbapConnection_js_1 = require("./BaseAbapConnection.js");
 const CertificateAbapConnection_js_1 = require("./CertificateAbapConnection.js");
 const JwtAbapConnection_js_1 = require("./JwtAbapConnection.js");
 const KerberosAbapConnection_js_1 = require("./KerberosAbapConnection.js");
 const RfcAbapConnection_js_1 = require("./RfcAbapConnection.js");
 const SamlAbapConnection_js_1 = require("./SamlAbapConnection.js");
+/**
+ * The provider for the credential this config carries.
+ *
+ * Reading `authType` here is not the thing the split removed: it says HOW to
+ * authenticate, which is what it always meant. What it no longer does is decide
+ * which system this is — the caller said that.
+ */
+function authProviderFor(config, options, tokenRefresher) {
+    switch (config.authType) {
+        case 'jwt':
+            // No longer refused. It was, while renewal lived only in
+            // JwtAbapConnection and this path would have handed back a connection
+            // that died on the first expiry. The connector now tells the provider
+            // when a token was rejected and rebuilds the session behind it, so a
+            // refresher passed here is used for what it is for.
+            return new providers_js_1.TokenAuthProvider(tokenRefresher ?? config.jwtToken ?? '');
+        case 'saml':
+            return new providers_js_1.SamlAuthProvider(config.sessionCookies ?? '');
+        case 'certificate':
+            if (!options.certLoader) {
+                throw new Error('authType "certificate" needs options.certLoader to load the material.');
+            }
+            return new providers_js_1.CertificateAuthProvider(options.certLoader, config);
+        case 'basic':
+            return new providers_js_1.BasicAuthProvider(config.username ?? '', config.password ?? '');
+        default:
+            throw new Error(`authType "${config.authType}" has no auth provider yet; use the deprecated class for it.`);
+    }
+}
+/**
+ * Builds the connection the caller asked for.
+ *
+ * **Say which system it is** with `options.system`, and that is what you get —
+ * `'onprem'` or `'cloud'` — with the credential built from the config and
+ * handed in as an auth provider. Nothing about the system is worked out here:
+ * not from the credential, not from the host name, not by asking the server.
+ *
+ * Without it, the old behaviour: a connection chosen from `authType`, which is
+ * the arrangement where the credential drags the session mechanism along with
+ * it and gets one of them wrong. **Deprecated**, kept so existing callers keep
+ * working, and warned about once per call so it is visible rather than
+ * inherited by accident.
+ */
 function createAbapConnection(config, logger, sessionId, tokenRefresher, options) {
     // RFC connection type takes priority over auth type
     if (config.connectionType === 'rfc') {
@@ -15,6 +61,12 @@ function createAbapConnection(config, logger, sessionId, tokenRefresher, options
         }
         return new RfcAbapConnection_js_1.RfcAbapConnection(config, logger);
     }
+    if (options?.system) {
+        const provider = authProviderFor(config, options, tokenRefresher);
+        const Connector = options.system === 'cloud' ? AdtCloudConnector_js_1.AdtCloudConnector : AdtOnPremConnector_js_1.AdtOnPremConnector;
+        return new Connector(config, provider, logger ?? null, sessionId, options);
+    }
+    logger?.warn("createAbapConnection(): no options.system given, so the connection is chosen from authType — which lets the credential decide the session mechanism. Pass system: 'onprem' | 'cloud'.");
     switch (config.authType) {
         case 'basic':
             return new BaseAbapConnection_js_1.BaseAbapConnection(config, logger, sessionId, options);

package/dist/index.d.ts

@@ -1,8 +1,12 @@
 export type { IWebSocketCloseInfo, IWebSocketConnectOptions, IWebSocketMessageEnvelope, IWebSocketMessageHandler, IWebSocketTransport, } from '@mcp-abap-adt/interfaces';
 export { FileCertificateMaterialLoader } from './auth/FileCertificateMaterialLoader.js';
+export type { IAuthProvider } from './auth/IAuthProvider.js';
+export { BasicAuthProvider, CertificateAuthProvider, SamlAuthProvider, TokenAuthProvider, } from './auth/providers.js';
 export type { SapAuthType, SapConfig, SapConnectionType, } from './config/sapConfig.js';
 export { sapConfigSignature } from './config/sapConfig.js';
 export type { AbapConnection, AbapRequestOptions, } from './connection/AbapConnection.js';
+export { AdtCloudConnector } from './connection/AdtCloudConnector.js';
+export { AdtOnPremConnector } from './connection/AdtOnPremConnector.js';
 export { BaseAbapConnection, BaseAbapConnection as OnPremAbapConnection, } from './connection/BaseAbapConnection.js';
 export { CertificateAbapConnection } from './connection/CertificateAbapConnection.js';
 export { createAbapConnection } from './connection/connectionFactory.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,YAAY,EACV,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,IAAI,oBAAoB,GAC3C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,IAAI,mBAAmB,GACzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAOxE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,IAAI,oBAAoB,GAC3C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,IAAI,mBAAmB,GACzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,12 +1,21 @@
 "use strict";
 // Types - re-exported from interfaces package with backward compatibility aliases
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getTimeoutConfig = exports.getTimeout = exports.SamlAbapConnection = exports.RfcAbapConnection = exports.KerberosAbapConnection = exports.CloudAbapConnection = exports.JwtAbapConnection = exports.GenericWebSocketTransport = exports.CSRF_ERROR_MESSAGES = exports.CSRF_CONFIG = exports.createAbapConnection = exports.CertificateAbapConnection = exports.OnPremAbapConnection = exports.BaseAbapConnection = exports.sapConfigSignature = exports.FileCertificateMaterialLoader = void 0;
+exports.getTimeoutConfig = exports.getTimeout = exports.SamlAbapConnection = exports.RfcAbapConnection = exports.KerberosAbapConnection = exports.CloudAbapConnection = exports.JwtAbapConnection = exports.GenericWebSocketTransport = exports.CSRF_ERROR_MESSAGES = exports.CSRF_CONFIG = exports.createAbapConnection = exports.CertificateAbapConnection = exports.OnPremAbapConnection = exports.BaseAbapConnection = exports.AdtOnPremConnector = exports.AdtCloudConnector = exports.sapConfigSignature = exports.TokenAuthProvider = exports.SamlAuthProvider = exports.CertificateAuthProvider = exports.BasicAuthProvider = exports.FileCertificateMaterialLoader = void 0;
 var FileCertificateMaterialLoader_js_1 = require("./auth/FileCertificateMaterialLoader.js");
 Object.defineProperty(exports, "FileCertificateMaterialLoader", { enumerable: true, get: function () { return FileCertificateMaterialLoader_js_1.FileCertificateMaterialLoader; } });
+var providers_js_1 = require("./auth/providers.js");
+Object.defineProperty(exports, "BasicAuthProvider", { enumerable: true, get: function () { return providers_js_1.BasicAuthProvider; } });
+Object.defineProperty(exports, "CertificateAuthProvider", { enumerable: true, get: function () { return providers_js_1.CertificateAuthProvider; } });
+Object.defineProperty(exports, "SamlAuthProvider", { enumerable: true, get: function () { return providers_js_1.SamlAuthProvider; } });
+Object.defineProperty(exports, "TokenAuthProvider", { enumerable: true, get: function () { return providers_js_1.TokenAuthProvider; } });
 // Config utilities
 var sapConfig_js_1 = require("./config/sapConfig.js");
 Object.defineProperty(exports, "sapConfigSignature", { enumerable: true, get: function () { return sapConfig_js_1.sapConfigSignature; } });
+var AdtCloudConnector_js_1 = require("./connection/AdtCloudConnector.js");
+Object.defineProperty(exports, "AdtCloudConnector", { enumerable: true, get: function () { return AdtCloudConnector_js_1.AdtCloudConnector; } });
+var AdtOnPremConnector_js_1 = require("./connection/AdtOnPremConnector.js");
+Object.defineProperty(exports, "AdtOnPremConnector", { enumerable: true, get: function () { return AdtOnPremConnector_js_1.AdtOnPremConnector; } });
 // The session lifecycle vocabulary — ISessionLifecycleAware, ADT_SESSION_ERROR —
 // is deliberately NOT exported here. It lives in @mcp-abap-adt/interfaces, and a
 // consumer imports it from there: re-exporting a contract type gives it two

package/dist/session/CloudSecuritySessionStrategy.d.ts

@@ -0,0 +1,32 @@
+/**
+ * ABAP Cloud: a session is a resource, asked for and given back by address.
+ *
+ * Captured from Eclipse ADT 3.60 against a BTP trial and reproduced here with a
+ * bearer token, which is what made the difference visible: **the server issues
+ * `SAP_SESSIONID` to whoever asks for a session, and we never asked.** The
+ * request that asks carries `x-sap-security-session: create` — `use` does not
+ * do it — and `sap-adt-purpose: preflight_logon`. The response sets the cookie
+ * and publishes the session's own address in a `securitysession` link, which is
+ * the address a close goes to.
+ *
+ * Without that request the same connection gets `sap-usercontext` and
+ * `sap-XSRF_*` and nothing else, no `securitysession` link, and no session for
+ * a lock to be bound to — which is how "cloud does not issue SAP_SESSIONID"
+ * came to be believed.
+ */
+import { type ISessionTransport, SessionStrategy } from './SessionStrategy.js';
+export declare class CloudSecuritySessionStrategy extends SessionStrategy {
+    readonly kind: "cloud-security-session";
+    /** The address this server published for our session — the only close target. */
+    private resource;
+    openSession(transport: ISessionTransport): Promise<boolean>;
+    closeSession(transport: ISessionTransport): Promise<void>;
+    /**
+     * The `securitysession` link's href, by its `rel` rather than by position.
+     *
+     * The document carries three links — the session, the logoff resource and
+     * system information — and their order is not a contract.
+     */
+    private securitySessionHref;
+}
+//# sourceMappingURL=CloudSecuritySessionStrategy.d.ts.map

package/dist/session/CloudSecuritySessionStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudSecuritySessionStrategy.d.ts","sourceRoot":"","sources":["../../src/session/CloudSecuritySessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAa/E,qBAAa,4BAA6B,SAAQ,eAAe;IAC/D,QAAQ,CAAC,IAAI,EAAG,wBAAwB,CAAU;IAElD,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAuB;IAEjC,WAAW,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA6D3D,YAAY,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC/D;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}

package/dist/session/CloudSecuritySessionStrategy.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * ABAP Cloud: a session is a resource, asked for and given back by address.
+ *
+ * Captured from Eclipse ADT 3.60 against a BTP trial and reproduced here with a
+ * bearer token, which is what made the difference visible: **the server issues
+ * `SAP_SESSIONID` to whoever asks for a session, and we never asked.** The
+ * request that asks carries `x-sap-security-session: create` — `use` does not
+ * do it — and `sap-adt-purpose: preflight_logon`. The response sets the cookie
+ * and publishes the session's own address in a `securitysession` link, which is
+ * the address a close goes to.
+ *
+ * Without that request the same connection gets `sap-usercontext` and
+ * `sap-XSRF_*` and nothing else, no `securitysession` link, and no session for
+ * a lock to be bound to — which is how "cloud does not issue SAP_SESSIONID"
+ * came to be believed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudSecuritySessionStrategy = void 0;
+const cookies_js_1 = require("../utils/cookies.js");
+const timeouts_js_1 = require("../utils/timeouts.js");
+const SessionStrategy_js_1 = require("./SessionStrategy.js");
+const SESSIONS_PATH = '/sap/bc/adt/core/http/sessions';
+/** The versioned media types Eclipse asks this resource for, newest first. */
+const SESSION_ACCEPT = 'application/vnd.sap.adt.core.http.session.v3+xml, ' +
+    'application/vnd.sap.adt.core.http.session.v2+xml, ' +
+    'application/vnd.sap.adt.core.http.session.v1+xml';
+const SECURITY_SESSION_REL = 'http://www.sap.com/adt/categories/core/http/sessions/securitysession';
+class CloudSecuritySessionStrategy extends SessionStrategy_js_1.SessionStrategy {
+    kind = 'cloud-security-session';
+    /** The address this server published for our session — the only close target. */
+    resource = null;
+    async openSession(transport) {
+        try {
+            // Read ONCE. The contract lets a provider answer differently each time —
+            // a token provider renews behind the call — so two reads can build one
+            // request out of two different credentials, and for a token provider they
+            // also double the work.
+            const auth = await transport.authHeaders();
+            const response = await transport.send({
+                method: 'GET',
+                // The cache-buster is Eclipse's; kept because this must not be served
+                // from anything's cache — a cached session document would hand back an
+                // address that belongs to a session somebody else already ended.
+                url: `${transport.baseUrl}${SESSIONS_PATH}?_=${Date.now()}`,
+                // Bounded: connect() waits for this one.
+                timeoutMs: (0, timeouts_js_1.getTimeout)('csrf'),
+                // Its SAP_SESSIONID is the session.
+                adoptCookies: true,
+                headers: {
+                    ...auth,
+                    Accept: SESSION_ACCEPT,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, transport.cookies() ?? undefined),
+                    'sap-adt-purpose': 'preflight_logon',
+                    'x-sap-security-session': 'create',
+                },
+            });
+            // 404 is the answer "this system has no session resource", which is what
+            // on-prem says. Not an error, and not something to retry.
+            if (response.status === 404) {
+                return false;
+            }
+            const resource = this.securitySessionHref(response.data);
+            if (!resource) {
+                // Answered, but published no session of its own — so there is no
+                // address to give one back by, and claiming this mechanism would leave
+                // the close with nothing to send. Falls back to the platform's logoff,
+                // which needs no address.
+                this.logger?.debug(`Session resource answered ${response.status} but published no securitysession link`);
+                return false;
+            }
+            this.resource = resource;
+            this.logger?.debug(`Security session opened: ${resource}`);
+            return true;
+        }
+        catch (error) {
+            // Never fatal here. If no session was opened, the establishment that
+            // follows says so with the whole picture; a transport error raised from
+            // a preflight would replace that with something less useful.
+            this.logger?.debug(`Could not open a security session: ${error instanceof Error ? error.message : String(error)}`);
+            return false;
+        }
+    }
+    async closeSession(transport) {
+        const resource = this.resource;
+        if (!resource || !transport.cookies()) {
+            // No address to send it to, or no cookie to prove the session is ours —
+            // holding the cookie is the whole permission.
+            return;
+        }
+        const csrf = transport.csrfToken();
+        try {
+            const auth = await transport.authHeaders();
+            await transport.send({
+                method: 'DELETE',
+                url: new URL(resource, transport.baseUrl).toString(),
+                headers: {
+                    ...auth,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, transport.cookies() ?? undefined),
+                    'x-sap-security-session': 'use',
+                    // A state change, so the server wants the token. Without one the
+                    // request is refused with 403 — which is still just a message the
+                    // server did not accept, and still not something to raise from a
+                    // teardown.
+                    ...(csrf ? { 'x-csrf-token': csrf } : {}),
+                },
+            });
+            this.logger?.debug('Told the server the security session is finished');
+        }
+        catch (error) {
+            this.logger?.debug(`Could not tell the server the session is finished: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * The `securitysession` link's href, by its `rel` rather than by position.
+     *
+     * The document carries three links — the session, the logoff resource and
+     * system information — and their order is not a contract.
+     */
+    securitySessionHref(body) {
+        if (typeof body !== 'string')
+            return undefined;
+        for (const link of body.matchAll(/<[^>]*link\b([^>]*)>/g)) {
+            const attrs = link[1];
+            const rel = attrs.match(/\brel="([^"]*)"/)?.[1];
+            if (rel !== SECURITY_SESSION_REL)
+                continue;
+            const href = attrs.match(/\bhref="([^"]*)"/)?.[1];
+            if (href)
+                return href;
+        }
+        return undefined;
+    }
+}
+exports.CloudSecuritySessionStrategy = CloudSecuritySessionStrategy;

package/dist/session/IcfSessionStrategy.d.ts

@@ -0,0 +1,27 @@
+/**
+ * On-prem: the logon is the establishing request, and the platform takes the
+ * session back through `/sap/public/bc/icf/logoff`.
+ *
+ * There is nothing to open. The session arrives as a `SAP_SESSIONID` cookie on
+ * the establishing call, which is why on-prem SM04 shows those sessions opened
+ * by `P=/sap/bc/adt/discovery` — one per `connect()`, and one left behind per
+ * `connect()` that never said it was finished.
+ *
+ * ADT publishes no session resource here — `/sap/bc/adt/core/http/sessions`
+ * does not exist — so this is the only mechanism, and it is the platform's
+ * rather than ADT's.
+ */
+import { type ISessionTransport, SessionStrategy } from './SessionStrategy.js';
+export declare class IcfSessionStrategy extends SessionStrategy {
+    readonly kind: "icf";
+    /**
+     * Nothing to ask for: the session comes with the establishing request.
+     *
+     * `false` is about the session RESOURCE, not about sessions — this system has
+     * no address to open or close one by, which is exactly why the close below is
+     * the platform's logoff.
+     */
+    openSession(_transport: ISessionTransport): Promise<boolean>;
+    closeSession(transport: ISessionTransport): Promise<void>;
+}
+//# sourceMappingURL=IcfSessionStrategy.d.ts.map

package/dist/session/IcfSessionStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IcfSessionStrategy.d.ts","sourceRoot":"","sources":["../../src/session/IcfSessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,KAAK,iBAAiB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI/E,qBAAa,kBAAmB,SAAQ,eAAe;IACrD,QAAQ,CAAC,IAAI,EAAG,KAAK,CAAU;IAE/B;;;;;;OAMG;IACG,WAAW,CAAC,UAAU,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAI5D,YAAY,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CA+BhE"}

package/dist/session/IcfSessionStrategy.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * On-prem: the logon is the establishing request, and the platform takes the
+ * session back through `/sap/public/bc/icf/logoff`.
+ *
+ * There is nothing to open. The session arrives as a `SAP_SESSIONID` cookie on
+ * the establishing call, which is why on-prem SM04 shows those sessions opened
+ * by `P=/sap/bc/adt/discovery` — one per `connect()`, and one left behind per
+ * `connect()` that never said it was finished.
+ *
+ * ADT publishes no session resource here — `/sap/bc/adt/core/http/sessions`
+ * does not exist — so this is the only mechanism, and it is the platform's
+ * rather than ADT's.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IcfSessionStrategy = void 0;
+const cookies_js_1 = require("../utils/cookies.js");
+const SessionStrategy_js_1 = require("./SessionStrategy.js");
+const ICF_LOGOFF_PATH = '/sap/public/bc/icf/logoff';
+class IcfSessionStrategy extends SessionStrategy_js_1.SessionStrategy {
+    kind = 'icf';
+    /**
+     * Nothing to ask for: the session comes with the establishing request.
+     *
+     * `false` is about the session RESOURCE, not about sessions — this system has
+     * no address to open or close one by, which is exactly why the close below is
+     * the platform's logoff.
+     */
+    async openSession(_transport) {
+        return false;
+    }
+    async closeSession(transport) {
+        const cookies = transport.cookies();
+        if (!cookies) {
+            // Holding the cookie is the whole permission to end a session, and it is
+            // why nothing is sent without one. The session limit is per user and the
+            // pool is shared — a SAP GUI logon of the same user sits in the same SM04
+            // list — so a connector that tidied up sessions it did not open would
+            // eventually close somebody's GUI.
+            return;
+        }
+        try {
+            // Read once: see CloudSecuritySessionStrategy — a provider may answer
+            // differently on a second call, and one request must be built from one
+            // credential.
+            const auth = await transport.authHeaders();
+            await transport.send({
+                method: 'GET',
+                url: `${transport.baseUrl}${ICF_LOGOFF_PATH}`,
+                headers: {
+                    ...auth,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, cookies),
+                },
+            });
+            this.logger?.debug('Told the server the session is finished');
+        }
+        catch (error) {
+            this.logger?.debug(`Could not tell the server the session is finished: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+exports.IcfSessionStrategy = IcfSessionStrategy;

package/dist/session/SessionLifecycle.d.ts

@@ -7,8 +7,23 @@
  * this unit testable without a server, and it is where the hard part lives:
  * ordering, admission, and telling one session from the next.
  *
- * Design: docs/superpowers/specs/2026-07-31-teardown-policy-design.md in
- * @mcp-abap-adt/adt-clients.
+ * What it guarantees, since the design note it used to point at lived in another
+ * package and has been deleted with the work it described:
+ *
+ *   - **One transition at a time**, on a serializing tail. Connects join
+ *     connects and disconnects join disconnects, so concurrent callers share one
+ *     establishment or one teardown rather than racing to build and demolish the
+ *     same session.
+ *   - **Admission is synchronous.** A request is admitted, or refused, in the
+ *     same step that counts it — so nothing can be admitted and still be
+ *     invisible to a teardown draining at that instant.
+ *   - **A teardown waits for nothing.** In-flight requests run to completion
+ *     untouched; their results are fenced by session generation so a late answer
+ *     cannot write over a session established since.
+ *   - **Identity is observed, never assumed.** A changed fingerprint means the
+ *     session we had is gone and this is a different one, which is fatal to
+ *     anything held against the old one;
+ *     an unchanged one says nothing about whether the server still has it.
  */
 import { type AdtSessionErrorCode } from '@mcp-abap-adt/interfaces';
 export type TransitionKind = 'connect' | 'disconnect' | 'recover' | 'cleanup';

package/dist/session/SessionLifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionLifecycle.d.ts","sourceRoot":"","sources":["../../src/session/SessionLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC9B,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,GAAG;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAMvC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAK;IAErB,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,WAAW,CAAiC;IAIpD,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAM5B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;;;;OAKG;IACH,aAAa,CAAC,WAAW,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GAAG,IAAI;IAOzE;;;;;;OAMG;IACH,cAAc,IAAI,IAAI;IAItB,gBAAgB,IAAI,IAAI;IAKxB;;;;;;OAMG;IACH,OAAO,CACL,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACvC,WAAW,GAAG,aAAa,GAAG,UAAU;IAiB3C,YAAY,IAAI,IAAI;IAMpB,4EAA4E;IAC5E,YAAY,IAAI,YAAY;IAiB5B,2FAA2F;IAC3F,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO;IAM3D,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,oBAAoB,GAAG,IAAI;IAelE,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAID;;;;;;;;;OASG;IACH,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAuBvE"}
+{"version":3,"file":"SessionLifecycle.d.ts","sourceRoot":"","sources":["../../src/session/SessionLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC9B,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,GAAG;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAMvC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAK;IAErB,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,WAAW,CAAiC;IAIpD,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAM5B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;;;;OAKG;IACH,aAAa,CAAC,WAAW,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GAAG,IAAI;IAOzE;;;;;;OAMG;IACH,cAAc,IAAI,IAAI;IAItB,gBAAgB,IAAI,IAAI;IAKxB;;;;;;OAMG;IACH,OAAO,CACL,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACvC,WAAW,GAAG,aAAa,GAAG,UAAU;IAiB3C,YAAY,IAAI,IAAI;IAMpB,4EAA4E;IAC5E,YAAY,IAAI,YAAY;IAiB5B,2FAA2F;IAC3F,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO;IAM3D,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,oBAAoB,GAAG,IAAI;IAelE,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAID;;;;;;;;;OASG;IACH,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAuBvE"}

package/dist/session/SessionLifecycle.js

@@ -8,8 +8,23 @@
  * this unit testable without a server, and it is where the hard part lives:
  * ordering, admission, and telling one session from the next.
  *
- * Design: docs/superpowers/specs/2026-07-31-teardown-policy-design.md in
- * @mcp-abap-adt/adt-clients.
+ * What it guarantees, since the design note it used to point at lived in another
+ * package and has been deleted with the work it described:
+ *
+ *   - **One transition at a time**, on a serializing tail. Connects join
+ *     connects and disconnects join disconnects, so concurrent callers share one
+ *     establishment or one teardown rather than racing to build and demolish the
+ *     same session.
+ *   - **Admission is synchronous.** A request is admitted, or refused, in the
+ *     same step that counts it — so nothing can be admitted and still be
+ *     invisible to a teardown draining at that instant.
+ *   - **A teardown waits for nothing.** In-flight requests run to completion
+ *     untouched; their results are fenced by session generation so a late answer
+ *     cannot write over a session established since.
+ *   - **Identity is observed, never assumed.** A changed fingerprint means the
+ *     session we had is gone and this is a different one, which is fatal to
+ *     anything held against the old one;
+ *     an unchanged one says nothing about whether the server still has it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionLifecycle = void 0;

package/dist/session/SessionStrategy.d.ts

@@ -0,0 +1,86 @@
+/**
+ * How a session is opened on the server, and how the server is told we are
+ * done with it.
+ *
+ * Two systems, two mechanisms, one meaning. On ABAP Cloud a session is a
+ * resource: it is asked for at `/sap/bc/adt/core/http/sessions` and the
+ * response publishes its own address, which is what a `DELETE` is sent to. On
+ * on-prem there is no such resource — the logon call is the establishing
+ * request itself, and the platform's `/sap/public/bc/icf/logoff` is how it is
+ * given back.
+ *
+ * **Both are notifications, not commands.** They say "we have finished with
+ * this session". Whether the system frees it now, later, or keeps it to reuse
+ * is the system's business, and nothing here checks afterwards or depends on
+ * the answer. Measured on a trial: the `DELETE` is answered `200` and the
+ * session is still listed a moment later; the logoff is answered `200` and it
+ * is not. Neither is a failure — they are two systems deciding differently
+ * about a message they both accepted.
+ *
+ * Split by what the server publishes rather than by which system we think we
+ * are talking to: `openSession()` asks, and a system that has no such resource
+ * says so. Guessing the platform would be a guess; asking is not.
+ */
+import type { ILogger } from '../logger.js';
+/** What a strategy needs from the connection to talk to the server. */
+export interface ISessionTransport {
+    /** Absolute base URL of the system. */
+    baseUrl: string;
+    /** Auth headers for a request made outside the normal request path. */
+    authHeaders(): Promise<Record<string, string>>;
+    /** Cookies held for this connection, or null before any have arrived. */
+    cookies(): string | null;
+    /** The CSRF token held, if one has been fetched. */
+    csrfToken(): string | null;
+    /** Issue a raw request and hand back status, headers and body. */
+    send(request: {
+        method: 'GET' | 'DELETE';
+        url: string;
+        headers: Record<string, string>;
+        /**
+         * A deadline for the REQUEST, and only where one belongs.
+         *
+         * The open is a preflight that `connect()` waits for, so it is bounded.
+         * The close must not be: a request timeout aborts the socket, which would
+         * cancel the very message it was waiting for and leave the session open —
+         * the caller's own deadline bounds the WAIT instead, elsewhere.
+         */
+        timeoutMs?: number;
+        /**
+         * Whether the cookies this answers with become the connection's.
+         *
+         * True for the open — its `SAP_SESSIONID` **is** the session. False for a
+         * close: a teardown's response must not feed the session identity, or the
+         * cookies it sets read as the session having been replaced under a
+         * connection that is on its way out.
+         */
+        adoptCookies?: boolean;
+    }): Promise<{
+        status: number;
+        headers: unknown;
+        data: unknown;
+    }>;
+}
+export declare abstract class SessionStrategy {
+    protected readonly logger: ILogger | null;
+    constructor(logger: ILogger | null);
+    /** A name for logs, so which one ran is never a guess. */
+    abstract readonly kind: 'cloud-security-session' | 'icf';
+    /**
+     * Ask the server to open a session, before anything needs one.
+     *
+     * Returns whether a session resource was actually opened and its address
+     * captured — `false` is not a failure, it is a system saying it has none, and
+     * the close then falls to the mechanism that needs no address. Never throws: a system that
+     * will not open one is a fact for the establishment that follows to report,
+     * with the whole picture, not a transport error raised from a preflight.
+     */
+    abstract openSession(transport: ISessionTransport): Promise<boolean>;
+    /**
+     * Tell the server we are done with the session.
+     *
+     * Never throws, and says nothing about what the server then did with it.
+     */
+    abstract closeSession(transport: ISessionTransport): Promise<void>;
+}
+//# sourceMappingURL=SessionStrategy.d.ts.map

package/dist/session/SessionStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionStrategy.d.ts","sourceRoot":"","sources":["../../src/session/SessionStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,uEAAuE;AACvE,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/C,yEAAyE;IACzE,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IACzB,oDAAoD;IACpD,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAC3B,kEAAkE;IAClE,IAAI,CAAC,OAAO,EAAE;QACZ,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAC;QACzB,GAAG,EAAE,MAAM,CAAC;QACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC;;;;;;;WAOG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB;;;;;;;WAOG;QACH,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClE;AAED,8BAAsB,eAAe;IACvB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;gBAAtB,MAAM,EAAE,OAAO,GAAG,IAAI;IAErD,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,GAAG,KAAK,CAAC;IAEzD;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IAEpE;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CACnE"}