@mcp-abap-adt/connection 4.0.0 → 5.0.0

package/dist/connection/AdtCloudConnector.d.ts

@@ -0,0 +1,29 @@
+/**
+ * An ABAP Cloud system.
+ *
+ * A session there is a **resource**: asked for at
+ * `/sap/bc/adt/core/http/sessions` with `x-sap-security-session: create` and
+ * `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on the address
+ * the server publishes in the answer. Reproduced from Eclipse ADT 3.60 and
+ * measured against a BTP trial: without that request the same connection gets
+ * `sap-usercontext` and `sap-XSRF_*` and no session for a lock to be bound to,
+ * which is how "cloud issues no SAP_SESSIONID" came to be believed.
+ *
+ * **Taking this class is the consumer stating which system it is dialling**, and
+ * it is the only thing that states it: a communication user against ABAP Cloud
+ * gets this mechanism because the caller asked for this connector. Nothing is
+ * inferred — not from the credential, not from the host name, not from what the
+ * server answers.
+ */
+import type { IAuthProvider } from '../auth/IAuthProvider.js';
+import type { SapConfig } from '../config/sapConfig.js';
+import type { ILogger } from '../logger.js';
+import type { SessionStrategy } from '../session/SessionStrategy.js';
+import { CredentialAbapConnection } from './CredentialAbapConnection.js';
+export declare class AdtCloudConnector extends CredentialAbapConnection {
+    constructor(config: SapConfig, credential: IAuthProvider, logger?: ILogger | null, sessionId?: string, options?: {
+        skipSessionType?: boolean;
+    });
+    protected createSessionStrategy(): SessionStrategy;
+}
+//# sourceMappingURL=AdtCloudConnector.d.ts.map

package/dist/connection/AdtCloudConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdtCloudConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtCloudConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,qBAAa,iBAAkB,SAAQ,wBAAwB;gBAE3D,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,aAAa,EACzB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;cAKtB,qBAAqB,IAAI,eAAe;CAG5D"}

package/dist/connection/AdtCloudConnector.js

@@ -0,0 +1,31 @@
+"use strict";
+/**
+ * An ABAP Cloud system.
+ *
+ * A session there is a **resource**: asked for at
+ * `/sap/bc/adt/core/http/sessions` with `x-sap-security-session: create` and
+ * `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on the address
+ * the server publishes in the answer. Reproduced from Eclipse ADT 3.60 and
+ * measured against a BTP trial: without that request the same connection gets
+ * `sap-usercontext` and `sap-XSRF_*` and no session for a lock to be bound to,
+ * which is how "cloud issues no SAP_SESSIONID" came to be believed.
+ *
+ * **Taking this class is the consumer stating which system it is dialling**, and
+ * it is the only thing that states it: a communication user against ABAP Cloud
+ * gets this mechanism because the caller asked for this connector. Nothing is
+ * inferred — not from the credential, not from the host name, not from what the
+ * server answers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdtCloudConnector = void 0;
+const CloudSecuritySessionStrategy_js_1 = require("../session/CloudSecuritySessionStrategy.js");
+const CredentialAbapConnection_js_1 = require("./CredentialAbapConnection.js");
+class AdtCloudConnector extends CredentialAbapConnection_js_1.CredentialAbapConnection {
+    constructor(config, credential, logger = null, sessionId, options) {
+        super(config, credential, logger, sessionId, options);
+    }
+    createSessionStrategy() {
+        return new CloudSecuritySessionStrategy_js_1.CloudSecuritySessionStrategy(this.logger);
+    }
+}
+exports.AdtCloudConnector = AdtCloudConnector;

package/dist/connection/AdtOnPremConnector.d.ts

@@ -0,0 +1,30 @@
+/**
+ * An on-prem ABAP system.
+ *
+ * The session arrives with the establishing call — the logon *is* that call —
+ * and the platform's `/sap/public/bc/icf/logoff` is how it is given back. That
+ * is what on-prem has always used here, and it does not change.
+ *
+ * **Taking this class is the consumer stating which system it is dialling.**
+ * Nothing is probed and nothing is inferred: `/sap/bc/adt/core/http/sessions` answers on on-prem too —
+ * measured on S/4HANA, publishing both the session resource and the ICF logoff
+ * in one document — so asking the server tells you an endpoint exists, not
+ * which kind of system you reached.
+ *
+ * The credential is passed in and decides none of this. A bearer token against
+ * an on-prem system is ordinary, and it gets this mechanism because the caller
+ * asked for this connector — not because of what is in the header, and not
+ * because anything worked out where it was pointing.
+ */
+import type { IAuthProvider } from '../auth/IAuthProvider.js';
+import type { SapConfig } from '../config/sapConfig.js';
+import type { ILogger } from '../logger.js';
+import type { SessionStrategy } from '../session/SessionStrategy.js';
+import { CredentialAbapConnection } from './CredentialAbapConnection.js';
+export declare class AdtOnPremConnector extends CredentialAbapConnection {
+    constructor(config: SapConfig, credential: IAuthProvider, logger?: ILogger | null, sessionId?: string, options?: {
+        skipSessionType?: boolean;
+    });
+    protected createSessionStrategy(): SessionStrategy;
+}
+//# sourceMappingURL=AdtOnPremConnector.d.ts.map

package/dist/connection/AdtOnPremConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdtOnPremConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtOnPremConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,qBAAa,kBAAmB,SAAQ,wBAAwB;gBAE5D,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,aAAa,EACzB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;cAKtB,qBAAqB,IAAI,eAAe;CAG5D"}

package/dist/connection/AdtOnPremConnector.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * An on-prem ABAP system.
+ *
+ * The session arrives with the establishing call — the logon *is* that call —
+ * and the platform's `/sap/public/bc/icf/logoff` is how it is given back. That
+ * is what on-prem has always used here, and it does not change.
+ *
+ * **Taking this class is the consumer stating which system it is dialling.**
+ * Nothing is probed and nothing is inferred: `/sap/bc/adt/core/http/sessions` answers on on-prem too —
+ * measured on S/4HANA, publishing both the session resource and the ICF logoff
+ * in one document — so asking the server tells you an endpoint exists, not
+ * which kind of system you reached.
+ *
+ * The credential is passed in and decides none of this. A bearer token against
+ * an on-prem system is ordinary, and it gets this mechanism because the caller
+ * asked for this connector — not because of what is in the header, and not
+ * because anything worked out where it was pointing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdtOnPremConnector = void 0;
+const IcfSessionStrategy_js_1 = require("../session/IcfSessionStrategy.js");
+const CredentialAbapConnection_js_1 = require("./CredentialAbapConnection.js");
+class AdtOnPremConnector extends CredentialAbapConnection_js_1.CredentialAbapConnection {
+    constructor(config, credential, logger = null, sessionId, options) {
+        super(config, credential, logger, sessionId, options);
+    }
+    createSessionStrategy() {
+        return new IcfSessionStrategy_js_1.IcfSessionStrategy(this.logger);
+    }
+}
+exports.AdtOnPremConnector = AdtOnPremConnector;

package/dist/connection/BaseAbapConnection.d.ts

@@ -2,7 +2,13 @@ import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import { AbstractAbapConnection } from './AbstractAbapConnection.js';
 /**
- * Basic Authentication connection for on-premise SAP systems
+ * @deprecated The class you take should say which SYSTEM you are dialling,
+ * not which credential you hold — a session mechanism that rides along with
+ * the credential gets one of them wrong. Use `AdtOnPremConnector` with `BasicAuthProvider`:
+ *
+ *   new AdtOnPremConnector(config, new BasicAuthProvider(user, pass), logger)
+ *
+ * Kept working, and not removed here: existing consumers are unaffected.
  */
 export declare class BaseAbapConnection extends AbstractAbapConnection {
     constructor(config: SapConfig, logger?: ILogger | null, sessionId?: string, options?: {

package/dist/connection/BaseAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/BaseAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAE1D,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAMzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAU5C,OAAO,CAAC,MAAM,CAAC,cAAc;CAmB9B"}
+{"version":3,"file":"BaseAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/BaseAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAE1D,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAMzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAU5C,OAAO,CAAC,MAAM,CAAC,cAAc;CAmB9B"}

package/dist/connection/BaseAbapConnection.js

@@ -4,7 +4,13 @@ exports.BaseAbapConnection = void 0;
 const axios_1 = require("axios");
 const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
 /**
- * Basic Authentication connection for on-premise SAP systems
+ * @deprecated The class you take should say which SYSTEM you are dialling,
+ * not which credential you hold — a session mechanism that rides along with
+ * the credential gets one of them wrong. Use `AdtOnPremConnector` with `BasicAuthProvider`:
+ *
+ *   new AdtOnPremConnector(config, new BasicAuthProvider(user, pass), logger)
+ *
+ * Kept working, and not removed here: existing consumers are unaffected.
  */
 class BaseAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
     constructor(config, logger, sessionId, options) {

package/dist/connection/CertificateAbapConnection.d.ts

@@ -3,7 +3,15 @@ import type { ICertificateMaterialLoader } from '@mcp-abap-adt/interfaces';
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import { AbstractAbapConnection } from './AbstractAbapConnection.js';
-/** Client-certificate (mTLS) authentication. Credential lives on the TLS agent. */
+/**
+ * @deprecated The class you take should say which SYSTEM you are dialling,
+ * not which credential you hold — a session mechanism that rides along with
+ * the credential gets one of them wrong. Use `AdtOnPremConnector` with `CertificateAuthProvider`:
+ *
+ *   new AdtOnPremConnector(config, new CertificateAuthProvider(loader, config), logger)
+ *
+ * Kept working, and not removed here: existing consumers are unaffected.
+ */
 export declare class CertificateAbapConnection extends AbstractAbapConnection {
     private loader;
     private material;
@@ -18,6 +26,8 @@ export declare class CertificateAbapConnection extends AbstractAbapConnection {
      * Establishes the session for this auth type. Called by
      * AbstractAbapConnection.connect(), which owns the lifecycle around it.
      */
+    /** The material has to be loaded before anything is sent, preflight included. */
+    protected prepareCredential(): Promise<void>;
     protected establishSession(): Promise<void>;
     protected getHttpsAgentOptions(): AgentOptions;
     protected buildAuthorizationHeader(): string;

package/dist/connection/CertificateAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CertificateAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CertificateAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,mFAAmF;AACnF,qBAAa,yBAA0B,SAAQ,sBAAsB;IACnE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAqC;gBAGnD,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,0BAA0B;IAOrC,OAAO,CAAC,MAAM,CAAC,cAAc;cAyBb,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/C;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjD,SAAS,CAAC,oBAAoB,IAAI,YAAY;IAU9C,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAG7C"}
+{"version":3,"file":"CertificateAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CertificateAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,sBAAsB;IACnE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAqC;gBAGnD,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,0BAA0B;IAOrC,OAAO,CAAC,MAAM,CAAC,cAAc;cAyBb,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/C;;;OAGG;IACH;;;OAGG;IACH,iFAAiF;cACxD,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;cAI3C,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjD,SAAS,CAAC,oBAAoB,IAAI,YAAY;IAU9C,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAG7C"}

package/dist/connection/CertificateAbapConnection.js

@@ -4,7 +4,15 @@ exports.CertificateAbapConnection = void 0;
 const axios_1 = require("axios");
 const FileCertificateMaterialLoader_js_1 = require("../auth/FileCertificateMaterialLoader.js");
 const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-/** Client-certificate (mTLS) authentication. Credential lives on the TLS agent. */
+/**
+ * @deprecated The class you take should say which SYSTEM you are dialling,
+ * not which credential you hold — a session mechanism that rides along with
+ * the credential gets one of them wrong. Use `AdtOnPremConnector` with `CertificateAuthProvider`:
+ *
+ *   new AdtOnPremConnector(config, new CertificateAuthProvider(loader, config), logger)
+ *
+ * Kept working, and not removed here: existing consumers are unaffected.
+ */
 class CertificateAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
     loader;
     material = null;
@@ -42,6 +50,10 @@ class CertificateAbapConnection extends AbstractAbapConnection_js_1.AbstractAbap
      * Establishes the session for this auth type. Called by
      * AbstractAbapConnection.connect(), which owns the lifecycle around it.
      */
+    /** The material has to be loaded before anything is sent, preflight included. */
+    async prepareCredential() {
+        await this.ensureMaterial();
+    }
     async establishSession() {
         await this.ensureMaterial();
         const baseUrl = await this.getBaseUrl();

package/dist/connection/CredentialAbapConnection.d.ts

@@ -0,0 +1,88 @@
+/**
+ * A connection whose authentication is passed in.
+ *
+ * The shared half of the two platform connectors, and the reason the split is
+ * possible at all: `establishSession()` was measured to be the same work in
+ * every one of the five auth classes — fetch a CSRF token from
+ * `/sap/bc/adt/discovery`, keep it, tolerate a failure — with the only
+ * per-credential part being a step before it. That step is `prepare()`.
+ *
+ * So this owns the establishing call, and the credential contributes three
+ * things at most: what to prepare, what header to send, and what TLS material
+ * to present. Which system this is talking to was stated by the caller when it
+ * chose the subclass, and is never worked out here.
+ */
+import type { AgentOptions } from 'node:https';
+import type { IAbapRequestOptions, IAdtResponse } from '@mcp-abap-adt/interfaces';
+import type { IAuthProvider } from '../auth/IAuthProvider.js';
+import type { SapConfig } from '../config/sapConfig.js';
+import type { ILogger } from '../logger.js';
+import { AbstractAbapConnection } from './AbstractAbapConnection.js';
+export declare abstract class CredentialAbapConnection extends AbstractAbapConnection {
+    protected readonly credential: IAuthProvider;
+    constructor(config: SapConfig, credential: IAuthProvider, logger?: ILogger | null, sessionId?: string, options?: {
+        skipSessionType?: boolean;
+    });
+    /**
+     * Whatever the credential needs before the first request goes out.
+     *
+     * Runs before the preflight, not inside the establishing call: building the
+     * transport reads the TLS options, and a certificate whose material had not
+     * been loaded yet rejected the connect while the argument was still being
+     * evaluated — outside every catch, with no request sent.
+     */
+    /** The header last put on the wire, so a change can be seen. */
+    private lastAuthorization;
+    private credentialRenewal?;
+    protected prepareCredential(): Promise<void>;
+    /**
+     * Nothing here: the header is asked for asynchronously in `getAuthHeaders()`,
+     * because a provider can renew behind the call and a synchronous read would
+     * have to hold what it returned. The base's abstract member is satisfied and
+     * unused.
+     */
+    protected buildAuthorizationHeader(): string;
+    /**
+     * The credential's cookies travel with its header.
+     *
+     * On every path, not only on ordinary requests: a SAML session that is not
+     * presented to the session preflight and the establishing call is a session
+     * the server never sees us in.
+     */
+    getAuthHeaders(): Promise<Record<string, string>>;
+    protected getHttpsAgentOptions(): AgentOptions;
+    /**
+     * One retry, and only when the credential actually changed.
+     *
+     * A provider renews on its own — `BaseTokenProvider` checks expiry and
+     * refreshes before answering — so a 401 has two very different causes, and
+     * asking again tells them apart. A different answer means the token was
+     * stale: the ABAP session built on the old one is dead, so it is rebuilt and
+     * the request goes once more. The same answer means the server refused these
+     * credentials, and repeating them would only ask a second time.
+     *
+     * This is why no renewal strategy is injected. The provider owns "get me a
+     * valid credential"; what is left is "the credential changed, so the session
+     * is gone", which belongs to whoever owns the session and cannot be done from
+     * outside it.
+     */
+    makeAdtRequest<T = any, D = any>(options: IAbapRequestOptions): Promise<IAdtResponse<T, D>>;
+    /**
+     * Ask the provider again; if it answers differently, rebuild the session.
+     *
+     * Single-flight, because concurrent operations meet the same 401 at the same
+     * moment and the session must be rebuilt once, not once per request in
+     * flight. Everyone joins the first one and gets its verdict.
+     */
+    private rebuiltAfterCredentialChange;
+    /**
+     * The establishing call, shared because it always was.
+     *
+     * Failure is a warning rather than a throw, as it has been: the first request
+     * retries it, and a system that answers the discovery call badly may still
+     * answer everything else. What decides whether the connection is usable is
+     * the session check that follows, not this.
+     */
+    protected establishSession(): Promise<void>;
+}
+//# sourceMappingURL=CredentialAbapConnection.d.ts.map

package/dist/connection/CredentialAbapConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CredentialAbapConnection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AASrE,8BAAsB,wBAAyB,SAAQ,sBAAsB;IAGzE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa;gBAD5C,MAAM,EAAE,SAAS,EACE,UAAU,EAAE,aAAa,EAC5C,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAKzC;;;;;;;OAOG;IACH,gEAAgE;IAChE,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAmB;cAEpB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAI5C;;;;;;OAMG;IACY,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;cAkB7C,oBAAoB,IAAI,YAAY;IAMvD;;;;;;;;;;;;;;OAcG;IAEY,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EAC5C,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAwB9B;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IAqCpC;;;;;;;OAOG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlD"}

package/dist/connection/CredentialAbapConnection.js

@@ -0,0 +1,195 @@
+"use strict";
+/**
+ * A connection whose authentication is passed in.
+ *
+ * The shared half of the two platform connectors, and the reason the split is
+ * possible at all: `establishSession()` was measured to be the same work in
+ * every one of the five auth classes — fetch a CSRF token from
+ * `/sap/bc/adt/discovery`, keep it, tolerate a failure — with the only
+ * per-credential part being a step before it. That step is `prepare()`.
+ *
+ * So this owns the establishing call, and the credential contributes three
+ * things at most: what to prepare, what header to send, and what TLS material
+ * to present. Which system this is talking to was stated by the caller when it
+ * chose the subclass, and is never worked out here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialAbapConnection = void 0;
+const axios_1 = require("axios");
+const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
+/** A 401 from the server, whatever transport shape it arrives in. */
+function isUnauthorized(error) {
+    const status = error?.response
+        ?.status;
+    return status === 401;
+}
+class CredentialAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
+    credential;
+    constructor(config, credential, logger = null, sessionId, options) {
+        super(config, logger, sessionId, options);
+        this.credential = credential;
+    }
+    /**
+     * Whatever the credential needs before the first request goes out.
+     *
+     * Runs before the preflight, not inside the establishing call: building the
+     * transport reads the TLS options, and a certificate whose material had not
+     * been loaded yet rejected the connect while the argument was still being
+     * evaluated — outside every catch, with no request sent.
+     */
+    /** The header last put on the wire, so a change can be seen. */
+    lastAuthorization = '';
+    credentialRenewal;
+    async prepareCredential() {
+        await this.credential.prepare?.();
+    }
+    /**
+     * Nothing here: the header is asked for asynchronously in `getAuthHeaders()`,
+     * because a provider can renew behind the call and a synchronous read would
+     * have to hold what it returned. The base's abstract member is satisfied and
+     * unused.
+     */
+    buildAuthorizationHeader() {
+        return '';
+    }
+    /**
+     * The credential's cookies travel with its header.
+     *
+     * On every path, not only on ordinary requests: a SAML session that is not
+     * presented to the session preflight and the establishing call is a session
+     * the server never sees us in.
+     */
+    async getAuthHeaders() {
+        const headers = await super.getAuthHeaders();
+        // Asked now, not kept: a token provider renews behind this call, and a
+        // value held from establishment would be the stale one.
+        const authorization = await this.credential.authorizationHeader();
+        if (authorization) {
+            headers.Authorization = authorization;
+            this.lastAuthorization = authorization;
+        }
+        const cookies = this.credential.cookies?.();
+        if (cookies) {
+            headers.Cookie = cookies;
+        }
+        return headers;
+    }
+    getHttpsAgentOptions() {
+        return (this.credential.httpsAgentOptions?.() ?? super.getHttpsAgentOptions());
+    }
+    /**
+     * One retry, and only when the credential actually changed.
+     *
+     * A provider renews on its own — `BaseTokenProvider` checks expiry and
+     * refreshes before answering — so a 401 has two very different causes, and
+     * asking again tells them apart. A different answer means the token was
+     * stale: the ABAP session built on the old one is dead, so it is rebuilt and
+     * the request goes once more. The same answer means the server refused these
+     * credentials, and repeating them would only ask a second time.
+     *
+     * This is why no renewal strategy is injected. The provider owns "get me a
+     * valid credential"; what is left is "the credential changed, so the session
+     * is gone", which belongs to whoever owns the session and cannot be done from
+     * outside it.
+     */
+    // biome-ignore lint/suspicious/noExplicitAny: matches the base signature exactly
+    async makeAdtRequest(options) {
+        // Which session this request is going out on. A 401 that comes back after
+        // the session has already been replaced says nothing about the credential:
+        // it was answered by a server we are no longer talking to.
+        const sentOn = this.sessionGeneration;
+        try {
+            return await super.makeAdtRequest(options);
+        }
+        catch (error) {
+            if (!isUnauthorized(error))
+                throw error;
+            if (!(await this.rebuiltAfterCredentialChange(sentOn)))
+                throw error;
+            // Exactly once, and to `super` deliberately: reaching for `this` would
+            // re-enter this method, and a provider that answers differently every
+            // time — a broken refresher, or a server refusing whatever it is given —
+            // would look like "the credential changed" forever.
+            //
+            // A test pins the request count at two, but it does NOT distinguish the
+            // two forms: swapping `super` for `this` leaves the suite green, and why
+            // it does not then recurse is unexplained. Treat this line as guarded by
+            // review, not by the suite.
+            return await super.makeAdtRequest(options);
+        }
+    }
+    /**
+     * Ask the provider again; if it answers differently, rebuild the session.
+     *
+     * Single-flight, because concurrent operations meet the same 401 at the same
+     * moment and the session must be rebuilt once, not once per request in
+     * flight. Everyone joins the first one and gets its verdict.
+     */
+    rebuiltAfterCredentialChange(sentOn) {
+        if (this.credentialRenewal)
+            return this.credentialRenewal;
+        const inFlight = (async () => {
+            // Somebody else already rebuilt while this request was in flight, so this
+            // refusal was answered by a session that no longer exists and says
+            // nothing about the credential in use now. Retry on the new one; renewing
+            // again would force a second refresh and tear down a healthy session —
+            // which is what comparing against a connection-wide "last header" did,
+            // since by then that header was the NEW one.
+            if (this.sessionGeneration !== sentOn)
+                return true;
+            const before = this.lastAuthorization;
+            // Tell the credential its last answer was refused BEFORE asking again.
+            // Asking alone is not enough: a token provider returns the cached token
+            // while it believes it is valid, which after a 401 is precisely what it
+            // wrongly believes.
+            await this.credential.renew?.();
+            const now = await this.credential.authorizationHeader();
+            if (!now || now === before)
+                return false;
+            this.logger?.debug('The credential changed after a 401; the session built on the old one is gone. Rebuilding.');
+            const baseline = this.teardownEpoch;
+            this.discardSession();
+            await this.recoverSession(baseline);
+            return true;
+        })().finally(() => {
+            if (this.credentialRenewal === inFlight) {
+                this.credentialRenewal = undefined;
+            }
+        });
+        this.credentialRenewal = inFlight;
+        return inFlight;
+    }
+    /**
+     * The establishing call, shared because it always was.
+     *
+     * Failure is a warning rather than a throw, as it has been: the first request
+     * retries it, and a system that answers the discovery call badly may still
+     * answer everything else. What decides whether the connection is usable is
+     * the session check that follows, not this.
+     */
+    async establishSession() {
+        const baseUrl = await this.getBaseUrl();
+        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
+        try {
+            const token = this.credential.fetchCsrfToken
+                ? await this.credential.fetchCsrfToken(discoveryUrl)
+                : await this.fetchCsrfToken(discoveryUrl);
+            this.setCsrfToken(token);
+            this.logger?.debug('Connected', {
+                credential: this.credential.kind,
+                hasCsrfToken: !!this.getCsrfToken(),
+                hasCookies: !!this.getCookies(),
+            });
+        }
+        catch (error) {
+            this.logger?.warn(`Could not establish upfront (${this.credential.kind}): ${error instanceof Error ? error.message : String(error)}. The first request will retry.`);
+            // A rejecting response can still carry the cookies that matter; they are
+            // taken by fetchCsrfToken itself, so nothing is read out of the error
+            // here beyond saying whether any arrived.
+            if (error instanceof axios_1.AxiosError && error.response?.headers) {
+                this.logger?.debug(`Cookies after a failed establishment: ${this.getCookies() ? 'present' : 'none'}`);
+            }
+        }
+    }
+}
+exports.CredentialAbapConnection = CredentialAbapConnection;

package/dist/connection/JwtAbapConnection.d.ts

@@ -1,17 +1,26 @@
 import { type IAdtResponse, type ITokenRefresher } from '@mcp-abap-adt/interfaces';
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
+import type { SessionStrategy } from '../session/SessionStrategy.js';
 import type { AbapRequestOptions } from './AbapConnection.js';
 import { AbstractAbapConnection } from './AbstractAbapConnection.js';
 /**
- * JWT Authentication connection for SAP BTP Cloud systems
+ * The class you take should say which SYSTEM you are dialling, not which
+ * credential you hold — a session mechanism that rides along with the
+ * credential gets one of them wrong. `AdtCloudConnector` and
+ * `AdtOnPremConnector` are how that is said.
  *
- * Supports automatic token refresh via ITokenRefresher injection:
- * - a **401** triggers a token refresh when a tokenRefresher is available;
- * - without one, or when the refresh does not help, the server's own error is
- *   thrown unchanged — status and body intact;
- * - a **403** is never a token problem. It propagates as it arrived, because a
- *   new token is the same caller and cannot change a permissions answer.
+ * **This class is NOT deprecated yet, and must not be replaced by
+ * `AdtCloudConnector` + `TokenAuthProvider`.** What it does beyond
+ * authenticating has not moved: a 401 caught mid-operation, one refresh shared
+ * by every operation in flight, the session rebuilt behind it, generation
+ * fencing so a dead session's response cannot land, and the request retried
+ * once. A `TokenAuthProvider` fetches a token at establishment and nothing
+ * after it, so swapping today trades all of that for a connection that dies on
+ * the first expiry.
+ *
+ * Use this class for JWT until that machinery moves; the split is the
+ * platform-connectors spec's next step.
  */
 export declare class JwtAbapConnection extends AbstractAbapConnection {
     private tokenRefresher?;
@@ -97,6 +106,13 @@ export declare class JwtAbapConnection extends AbstractAbapConnection {
      * Establishes the session for this auth type. Called by
      * AbstractAbapConnection.connect(), which owns the lifecycle around it.
      */
+    /**
+     * Cloud manages sessions through ADT: a session resource is opened at
+     * `/sap/bc/adt/core/http/sessions` and given back by `DELETE` on the address
+     * the server publishes. This is the one connection that does it — on-prem
+     * keeps the platform's ICF logoff, which is what it has always used.
+     */
+    protected createSessionStrategy(): SessionStrategy;
     protected establishSession(): Promise<void>;
     /**
      * Override makeAdtRequest to handle JWT auth errors with automatic token refresh

package/dist/connection/JwtAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/JwtAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAuBrE;;;;;;;;;GASG;AACH,qBAAa,iBAAkB,SAAQ,sBAAsB;IAC3D,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAS;IAE7B,6DAA6D;IAC7D,OAAO,CAAC,eAAe,CAAK;IAE5B,0EAA0E;IAC1E,OAAO,CAAC,oBAAoB,CAAC,CAAmB;IAEhD;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB,CAAK;IAEhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAAC,CAAmB;IAE3C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2C;gBAGvE,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe;IAWlC,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAW5C;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAc1B,0EAA0E;IAC1E,OAAO,CAAC,eAAe;IASvB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;YAsBV,mBAAmB;IAoBjC;;OAEG;IACH,OAAO,CAAC,eAAe;YAiBT,cAAc;IAwB5B;;;;OAIG;YACW,eAAe;IAyB7B;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjD;;OAEG;IACG,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAKhB,cAAc;IA8D5B;;OAEG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;YASJ,gBAAgB;IAkD9B,OAAO,CAAC,MAAM,CAAC,cAAc;CAa9B"}
+{"version":3,"file":"JwtAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/JwtAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAuBrE;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iBAAkB,SAAQ,sBAAsB;IAC3D,OAAO,CAAC,cAAc,CAAC,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAS;IAE7B,6DAA6D;IAC7D,OAAO,CAAC,eAAe,CAAK;IAE5B,0EAA0E;IAC1E,OAAO,CAAC,oBAAoB,CAAC,CAAmB;IAEhD;;;;;;;;OAQG;IACH,OAAO,CAAC,mBAAmB,CAAK;IAEhC;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe,CAAC,CAAmB;IAE3C;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA2C;gBAGvE,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,eAAe;IAWlC,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAW5C;;;;;;;;OAQG;IACH,OAAO,CAAC,kBAAkB;IAc1B,0EAA0E;IAC1E,OAAO,CAAC,eAAe;IASvB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAQvB;;;;;;;;;OASG;IACH,OAAO,CAAC,gBAAgB;YAsBV,mBAAmB;IAoBjC;;OAEG;IACH,OAAO,CAAC,eAAe;YAiBT,cAAc;IAwB5B;;;;OAIG;YACW,eAAe;IAyB7B;;;OAGG;IACH;;;;;OAKG;cACgB,qBAAqB,IAAI,eAAe;cAI3C,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA4BjD;;OAEG;IACG,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAKhB,cAAc;IA8D5B;;OAEG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;YASJ,gBAAgB;IAkD9B,OAAO,CAAC,MAAM,CAAC,cAAc;CAa9B"}