@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/dist/auth/providers.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * The credentials a connector can be handed.
+ *
+ * Each is the authentication half of one of the connection classes that used to
+ * carry both halves, lifted out unchanged — the header a `BasicAuthProvider`
+ * builds is byte for byte what `BaseAbapConnection` built, and the TLS options a
+ * `CertificateAuthProvider` returns are what `CertificateAbapConnection`
+ * returned. Nothing about how a credential works changed; only who owns it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CertificateAuthProvider = exports.SamlAuthProvider = exports.TokenAuthProvider = exports.BasicAuthProvider = void 0;
+/** Username and password, as `Basic base64(user:pass)`. */
+class BasicAuthProvider {
+    username;
+    password;
+    kind = 'basic';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
+    constructor(username, password) {
+        this.username = username;
+        this.password = password;
+    }
+    async authorizationHeader() {
+        return `Basic ${Buffer.from(`${this.username ?? ''}:${this.password ?? ''}`).toString('base64')}`;
+    }
+}
+exports.BasicAuthProvider = BasicAuthProvider;
+/**
+ * A bearer token, kept current by whoever issued it.
+ *
+ * Takes an `ITokenRefresher` — the contract `@mcp-abap-adt/auth-broker` already
+ * produces and `@mcp-abap-adt/auth-providers` already implements twelve ways.
+ * This package depends on neither: it speaks the contract, and the consumer
+ * brings the implementation, exactly as it does for `IAbapConnection`.
+ *
+ * **This carries no session recovery.** What happens to a session when the
+ * credential behind it is renewed mid-flight is the connection's business and
+ * stays there; see `JwtAbapConnection`, which still owns that machinery.
+ */
+class TokenAuthProvider {
+    source;
+    kind = 'token';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
+    /**
+     * A token, or something that can produce one.
+     *
+     * A bare string is a token with no renewal behind it — honest, and fine for a
+     * short task. An `ITokenRefresher` or a function is a provider that checks
+     * expiry and renews on its own, which is where this belongs in a long-lived
+     * process.
+     */
+    constructor(source) {
+        this.source = source;
+    }
+    /**
+     * Asked every time, and nothing kept.
+     *
+     * The provider behind this already caches the token, knows when it expires,
+     * and renews before handing one back. A second cache here would serve the
+     * stale one and hide exactly the renewal the provider exists to do — which
+     * is what the first version of this class did.
+     */
+    async authorizationHeader() {
+        const token = typeof this.source === 'string'
+            ? this.source
+            : typeof this.source === 'function'
+                ? await this.source()
+                : await this.source.getToken();
+        return token ? `Bearer ${token}` : '';
+    }
+    /**
+     * The token was refused, so force a new one.
+     *
+     * Declared through `IRenewableCredential` rather than as an optional member
+     * of every credential, so a consumer narrows to it: a password has nothing
+     * behind it to ask again, and a SAML session was negotiated elsewhere.
+     *
+     * **Nothing in this package calls it.** A token that EXPIRED is replaced
+     * inside `authorizationHeader()` above, which is asked per request — nobody
+     * decides anything. This is the other case, a token the source still believes
+     * in and the server refuses, and whether a refusal meant that is a judgement
+     * made with what the caller knows. So the refusal surfaces, and this is the
+     * seam the caller decides with.
+     *
+     * `getToken()` is documented to return the cached token while it believes it
+     * is still valid — which is exactly the situation after a 401 on a token the
+     * provider has not yet noticed is dead. `refreshToken()` is the contract's
+     * answer for that, and this is the only place it is called.
+     */
+    async renew() {
+        if (typeof this.source === 'string' || typeof this.source === 'function') {
+            // Nothing to force: a fixed token has no source, and a function is asked
+            // afresh every time anyway.
+            return;
+        }
+        await this.source.refreshToken();
+    }
+}
+exports.TokenAuthProvider = TokenAuthProvider;
+/**
+ * A SAML session, already negotiated, presented as cookies.
+ *
+ * No `Authorization` header at all — the cookies are the credential, and they
+ * are added by the connection alongside its own.
+ */
+class SamlAuthProvider {
+    sessionCookies;
+    kind = 'saml';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
+    constructor(sessionCookies) {
+        this.sessionCookies = sessionCookies;
+    }
+    /** Not a header: this credential authenticates with the cookies below. */
+    async authorizationHeader() {
+        return null;
+    }
+    /** The cookies to present. */
+    cookies() {
+        return this.sessionCookies;
+    }
+}
+exports.SamlAuthProvider = SamlAuthProvider;
+/**
+ * Client certificate: the credential lives in the TLS handshake.
+ *
+ * `prepare()` is where the material is read, which is why it exists at all —
+ * building an agent before it is loaded is what used to reject a connect
+ * before a single request went out.
+ */
+class CertificateAuthProvider {
+    loader;
+    config;
+    kind = 'certificate';
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    material = null;
+    constructor(loader, config) {
+        this.loader = loader;
+        this.config = config;
+    }
+    async prepare() {
+        if (!this.material) {
+            this.material = await this.loader.load(this.config);
+        }
+    }
+    /** Not a header: this credential authenticates through TLS. */
+    async authorizationHeader() {
+        return null;
+    }
+    transportMaterial() {
+        if (!this.material) {
+            throw new Error('CertificateAuthProvider: certificate material not loaded. connect() prepares it; a request before that has nothing to present.');
+        }
+        const { cert, key, pfx, passphrase } = this.material;
+        return { cert, key, pfx, passphrase };
+    }
+}
+exports.CertificateAuthProvider = CertificateAuthProvider;

package/dist/connection/AbstractAbapConnection.d.ts

@@ -3,14 +3,41 @@ import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import { SessionLifecycle } from '../session/SessionLifecycle.js';
 import type { AbapConnection, AbapRequestOptions } from './AbapConnection.js';
+import { type IAdtSessionContext, type IAdtTransport } from './IAdtTransport.js';
 /**
  * Declares the capabilities explicitly rather than satisfying them by accident.
  * `AbapConnection` is the base contract every transport honours; these two are
  * the HTTP session's own, and naming them means a signature that drifts from
  * the published contract fails to compile here instead of at the consumer.
+ *
+ * **This gives the consumer instruments; it does not decide for it.** `connect()`
+ * opens one session and `disconnect()` closes it. How many connections to hold,
+ * how long to hold them and when to let go stays with the caller — there are no
+ * thresholds here, no pooling and no eviction, because none of that is knowable
+ * from inside a single connection. A session this one did not open is not its
+ * business: the session limit is per user and the pool is shared, so a SAP GUI
+ * logon of the same user sits in the same list.
+ *
+ * **Nothing the server decides is treated as something to count on.** Whether it
+ * issues a session cookie, whether it still holds a session it issued, how many
+ * it will tolerate, how fast it answers a logoff — all of that is its own and
+ * may differ by system and release. So each is observed and reported, never
+ * relied upon: the logoff is best effort under a bound the caller sets, a
+ * missing session cookie is a warning rather than a rule, and no code here
+ * counts sessions or predicts the next answer from the last one.
  */
 declare abstract class AbstractAbapConnection implements AbapConnection, ISessionLifecycleAware {
     private readonly config;
+    /**
+     * Required, and constructed by the caller.
+     *
+     * There is no default to fall back to and nothing is worked out from the
+     * config: the wire is a fact about the deployment, and a library that
+     * picked one would be guessing at the thing this design exists to stop
+     * guessing at. It also carries what the caller alone can wire — the
+     * credential's TLS material, the client — which is why it arrives built.
+     */
+    readonly transport: IAdtTransport;
     protected readonly logger: ILogger | null;
     /**
      * Owns session state, admission and teardown ordering. Composed rather than
@@ -18,40 +45,86 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * transports share this unit instead of a base class.
      */
     protected readonly lifecycle: SessionLifecycle;
-    private axiosInstance;
-    private csrfToken;
-    private cookies;
-    private cookieStore;
     private baseUrl;
     private sessionId;
     private sessionMode;
-    private skipSessionType;
     /**
      * When true, requests are treated as part of an uninterruptible critical
      * section (e.g. a lock → modify → unlock chain). In this state a short
-     * per-request timeout must NOT abort the request mid-flight, because
-     * aborting the socket drops the stateful ADT session and orphans the lock
-     * handle (leaving the object locked and inactive). While set, makeAdtRequest
+     * per-request timeout must NOT abort the request mid-flight: the abort ends
+     * nothing server-side — only the server ends an ABAP session, on an idle
+     * timeout this side cannot see — it ends what this side KNOWS. Whether the
+     * change was applied becomes unknowable, and the handle `unlock` needs is
+     * lost while the lock lives on in that session. While set, makeAdtRequest
      * raises the effective timeout to CRITICAL_SECTION_TIMEOUT (a large ceiling)
      * so the request runs to completion instead of being interrupted.
      */
     private inCriticalSection;
     /** Reference count for nested beginCriticalSection()/endCriticalSection() pairs. */
     private criticalSectionDepth;
-    protected constructor(config: SapConfig, logger: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
+    /** The default release deadline, validated once at construction. */
+    /**
+     * The logoff for the session this connection last held, while it is on its
+     * way. One, because a connection holds one session: `connect()` opens it and
+     * `disconnect()` closes it, and how many connections to run is the caller's
+     * business, not something to be tracked here.
+     *
+     * Carries the session id, not just the promise, so a release still in flight
+     * for an EARLIER session is recognised as not being this one's — reusing it
+     * was what left the second session of a reconnect never released at all.
+     *
+     * The id is the `SAP_SESSIONID` value — the ABAP session, the one locks are
+     * bound to — never the cookie header: that header also carries `sap-XSRF_*`,
+     * which rotates within one and the same session, so comparing headers made a
+     * session stop recognising itself after a token refresh.
+     */
+    /**
+     * How this server opens and gives back a session, decided by asking it rather
+     * than by guessing which system it is. Set at establishment; until then the
+     * on-prem mechanism, which is the one that needs no resource.
+     */
+    /**
+     * The application server this session lives on, as the server named it.
+     *
+     * A session belongs to ONE application server. On a multi-node system a
+     * request that lands on another gets another session — and a lock held on the
+     * first is then dead through nobody's fault and no inactivity. Eclipse pins
+     * itself with these headers; without them every request is a fresh throw of
+     * the dice.
+     *
+     * Learned from `sap-adt-saplb` on a response, sent back as `saplb`. Cleared
+     * with the rest of the session state: it names a server for a session that no
+     * longer exists.
+     */
+    /**
+     * Whether the preflight opened a session of its own.
+     *
+     * Distinct from "there are cookies": a failed establishment often leaves a
+     * cookie from the 401 that rejected it, and that is debris, not a session.
+     * Only a preflight answered with a session address opened one, and only that
+     * is worth saying goodbye to when establishment then fails.
+     */
+    protected constructor(config: SapConfig, 
+    /**
+     * Required, and constructed by the caller.
+     *
+     * There is no default to fall back to and nothing is worked out from the
+     * config: the wire is a fact about the deployment, and a library that
+     * picked one would be guessing at the thing this design exists to stop
+     * guessing at. It also carries what the caller alone can wire — the
+     * credential's TLS material, the client — which is why it arrives built.
+     */
+    transport: IAdtTransport, logger: ILogger | null, sessionId?: string);
     /**
      * Set session type (stateful or stateless)
      * Controls whether x-sap-adt-sessiontype: stateful header is added to requests
      * - stateful: SAP maintains session state between requests (locks, transactions)
      * - stateless: Each request is independent
      *
-     * When skipSessionType is enabled (via constructor options), this is a no-op:
-     * the x-sap-adt-sessiontype header will never be sent. This is needed for
-     * older BASIS versions (e.g. 7.40) where the stateful header causes locks
-     * to be stored in ABAP session memory instead of the global enqueue table,
-     * resulting in HTTP 423 on subsequent PUT requests.
+     * Whether the header actually goes out is the WIRE's: a system where the
+     * stateful header makes the server store locks in session memory instead of
+     * the enqueue table — BASIS 7.40 — is a different deployment, and a
+     * deployment is a transport, not a flag on the connection.
      */
     setSessionType(type: 'stateful' | 'stateless'): void;
     /**
@@ -65,9 +138,11 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * in a finally, AFTER unlocking). While in a critical section, a short
      * per-request timeout is not applied — makeAdtRequest uses a large ceiling
      * (CRITICAL_SECTION_TIMEOUT, env SAP_TIMEOUT_CRITICAL) instead — so a slow
-     * PUT/activate/unlock is not aborted mid-flight. Aborting mid-flight tears
-     * down the socket, which drops the stateful ADT session and orphans the
-     * lock handle, leaving the object locked and inactive.
+     * PUT/activate/unlock is not aborted mid-flight. An abort does not end the
+     * ABAP session — that session is the server's, and only the server ends it,
+     * on an idle timeout this side cannot influence — it strands the caller:
+     * the outcome is unknown and the handle `unlock` needs is gone, while the
+     * lock survives inside the ABAP session that owns it.
      *
      * Nesting is reference-counted so nested begin/end pairs are safe.
      */
@@ -97,6 +172,27 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * preparation and fetch the CSRF token; connect() owns everything around it.
      */
     protected abstract establishSession(): Promise<void>;
+    /**
+     * Gets the credential ready before anything is sent.
+     *
+     * A no-op for the auth types whose credential is already in hand — basic
+     * builds a header from the configuration, JWT carries a token it was given.
+     * It exists for the ones that have to fetch or load theirs, because the
+     * preflight now runs BEFORE `establishSession()` and needs a credential to
+     * go out with: a certificate connection reads its material there, and
+     * without this the preflight throws `certificate material not loaded` while
+     * assembling the transport — before a single request is made, on every
+     * system, cloud or on-prem.
+     *
+     * Must be idempotent: `establishSession()` may prepare the same credential
+     * again, and does.
+     *
+     * Kerberos deliberately does NOT implement it. Minting the SPNEGO token this
+     * early changes when the exchange happens, and that connection is not
+     * production-tested — its preflight fails the way it already did, is caught
+     * inside the strategy, and the connection falls back to ICF as before.
+     */
+    protected prepareCredential(): Promise<void>;
     /**
      * Establishes the session, once, under the lifecycle.
      *
@@ -110,16 +206,37 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     /**
      * Tears the session down. Never throws, and always settles.
      *
-     * It waits for NOTHING. Deciding when to disconnect is the caller's, and so is
-     * preparing for it — finishing chains, releasing locks. Waiting here on a
-     * request whose caller chose no timeout is what made a teardown unbounded, and
-     * an unbounded teardown blocks every later transition on the serialized tail.
+     * Tells the server the session is no longer needed, then clears the local
+     * state. **When the server actually reclaims it is the server's business** —
+     * possibly not until the next connect asks it for one — and nothing here
+     * waits for that or depends on it. What matters is that the session stops
+     * being counted against the user, which dropping the cookie alone does not
+     * achieve: the server keeps it until its own timeout, so a process that
+     * connects repeatedly leaves one behind every time. Measured on S/4HANA on-prem, 25 connects in a row: with the logoff,
+     * 24-25 of them were given a session; without it, 2. A connection that gets
+     * no session still answers `200` to a LOCK and hands back a handle the next
+     * request cannot use, so the leak surfaces as a half-written object rather
+     * than as anything about sessions.
+     *
+     * **Nothing is waited for.** The logoff is dispatched, not awaited: this
+     * method notifies, and whether the server has acted on the notice is not
+     * something it reports. Finishing chains and releasing locks stay the
+     * caller's to do BEFORE calling — waiting here on a request that carries no
+     * timeout by design is what made a teardown unbounded, which blocks every
+     * later transition on the serialized tail.
      *
-     * Requests already in flight run to completion untouched. Generation fencing
-     * (see `SessionLifecycle.isCurrent`) keeps their results from reaching this
-     * connection afterwards.
+     * **Requests already in flight are not waited for, and the logoff ends the
+     * session they are running on** — so they will start failing against a
+     * session that no longer exists. That is the caller having asked to
+     * disconnect, not a race, and it is a change from the version that only
+     * dropped the cookie. Generation fencing (see `SessionLifecycle.isCurrent`)
+     * keeps their results from reaching this connection either way.
      *
-     * Sends no ADT session-close — see the design's D2.
+     * **Nothing to wait for.** This TELLS the server the session is finished and
+     * does not act on the answer — whether and when the session is freed is the
+     * server's affair. Waiting for a reply nobody reads was also the one thing
+     * that could make a teardown unbounded, since the goodbye carries no request
+     * timeout by design.
      */
     disconnect(): Promise<void>;
     isConnected(): boolean;
@@ -131,14 +248,9 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * session cookie. Use {@link isConnected} for connection state.
      *
      * It follows that null → non-null is not a replacement but an identity being
-     * learned; only a CHANGED value means the session was replaced.
+     * learned; only a CHANGED value means the session we had is gone.
      */
     getSessionIdentity(): string | null;
-    /**
-     * Discards the session at a caller's request: cancels queued recoveries and
-     * queues the cleanup rather than tearing down under a live request.
-     */
-    reset(): void;
     /**
      * Re-establishes the session for a request that is recovering from a
      * credential renewal, then lets that request retry.
@@ -166,9 +278,40 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * Shared by connect() and recoverSession() rather than written twice —
      * the two drifted apart once already, and a third caller would drift again.
      */
+    /**
+     * What a session strategy is given: enough to make one request and to prove
+     * the session is ours, and nothing else. It cannot reach session state, so a
+     * strategy can neither mark this connection connected nor tear it down.
+     */
+    /**
+     * Ask the server to open a session before the establishing call needs one.
+     *
+     * The strategy is chosen by what the server publishes, not by which system we
+     * believe it to be: ABAP Cloud offers a session resource and issues
+     * `SAP_SESSIONID` to whoever asks for one — with `x-sap-security-session:
+     * create` — while on-prem has no such resource and its session arrives with
+     * the establishing request. Believing cloud simply "issues no SAP_SESSIONID"
+     * is what happens when nobody asks.
+     */
+    /**
+     * What a wire needs from this connection to get a session, or give one back.
+     *
+     * A snapshot in the sense that matters: a close is dispatched without being
+     * awaited, so nothing here may read the connection again once the teardown
+     * has cleared it.
+     */
+    protected sessionContext(): IAdtSessionContext;
     private establishAndCommit;
     /** The teardown epoch, for a recovery to capture before it starts. */
     protected get teardownEpoch(): number;
+    /**
+     * Which session the connection is on now.
+     *
+     * Moves whenever the session does. A response that comes back carrying an
+     * older one belongs to a session that has already been replaced, and must not
+     * be acted on as if it said something about the current one.
+     */
+    protected get sessionGeneration(): number;
     /**
      * Raises a session-lost teardown from inside request handling.
      *
@@ -200,7 +343,7 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * turns "your lock is dead" back into "your request 403'd", which is the very
      * information the caller needs and the only one it cannot recover itself.
      */
-    private isSessionVerdict;
+    protected isSessionVerdict(error: unknown): boolean;
     /**
      * Folds a response into the session state AND acts on what it means, in one
      * step.
@@ -210,7 +353,7 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * later check reads `unchanged`. That is one call site forgetting, and it
      * happened — on the error path and on every retry response.
      */
-    private observeResponse;
+    protected observeResponse(headers?: Record<string, unknown>, generation?: number): void;
     /**
      * Acts on what a response said about the session identity.
      *
@@ -231,7 +374,7 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     /**
      * Whether the server is telling us the session it was given no longer exists.
      *
-     * The E19 shape was HTTP 400 with "Session not found", answered in ~60 ms
+     * One on-prem system answered HTTP 400 with "Session not found", answered in ~60 ms
      * with the cookie present — which is why identity comparison cannot see this:
      * the cookie, and therefore the fingerprint, is completely unchanged. The
      * exact match is landscape-specific and is one of the live probes this design
@@ -255,19 +398,17 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     private performRequest;
     protected abstract buildAuthorizationHeader(): string;
     /**
-     * Fetch CSRF token from SAP system
-     * Protected method for use by concrete implementations in their connect() method
+     * Ask the wire to establish itself, and hand back what it earned.
+     *
+     * The exchange itself is the transport's — it is the HTTP wire that has a
+     * token to earn and an endpoint to earn it from, and the RFC wire that has
+     * neither. What stays here is the part that is about the SESSION rather than
+     * the wire: fencing the answer by generation, and letting the identity policy
+     * read what it means.
      */
-    protected fetchCsrfToken(url: string, retryCount?: number, retryDelay?: number, 
+    protected fetchCsrfToken(_url: string, retryCount?: number, retryDelay?: number, 
     /** Fences the response effects; omitted during connect(), which has no lease. */
     generation?: number): Promise<string>;
-    /**
-     * Fetch CSRF token from a specific endpoint with retries
-     */
-    private fetchCsrfTokenFromEndpoint;
-    /**
-     * Get CSRF token (protected for use by subclasses)
-     */
     protected getCsrfToken(): string | null;
     /**
      * Set CSRF token (protected for use by subclasses)
@@ -277,27 +418,38 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * Get cookies (protected for use by subclasses)
      */
     protected getCookies(): string | null;
-    protected setInitialCookies(cookies: string): void;
     /**
-     * Folds a response's cookies into the jar and classifies what that means for
-     * the session identity. Returns the classification rather than acting on it:
-     * cookie parsing stays free of policy, and no exception fires in the middle
-     * of a state update. The caller decides.
+     * Seed the wire with cookies the caller already holds — a SAML session, which
+     * IS the credential rather than something a logon call earns.
+     *
+     * Handed over as a response would deliver them, because the wire owns the jar
+     * and how it stores them is its business, not this class's.
      */
-    private updateCookiesFromResponse;
+    protected setInitialCookies(cookies: string): void;
     /**
-     * Subclasses override to inject extra https.Agent options (e.g. mTLS cert/key/pfx).
-     * The returned options are merged with the base options (rejectUnauthorized).
+     * Subclasses override to inject extra https.Agent options (e.g. mTLS
+     * cert/key/pfx). The returned options are merged with the base options
+     * (rejectUnauthorized).
      */
     protected getHttpsAgentOptions(): import('node:https').AgentOptions;
-    private getAxiosInstance;
-    private ensureFreshCsrfToken;
+    /**
+     * Make sure the wire is ready to carry a mutation.
+     *
+     * What ready MEANS is the wire's: HTTP holds a CSRF token and returns at once
+     * when it already has one; an RFC conversation has nothing to earn and does
+     * nothing. Demanding a token back was an HTTP assumption, and over RFC it
+     * raised `No CSRF token in response headers` before every write — swallowed
+     * by the caller, but logged as an error and repeated on the next one.
+     */
+    private ensureWireReady;
     /**
      * Clear SAP-side session state when SAP rejects the cached CSRF token + session
      * cookies (HTTP 401 on a mutation while a cached token exists). This forces the
      * next request path to fetch a fresh token and a fresh SAP_SESSIONID cookie.
      *
-     * Distinct from reset(): this leaves the axios instance and interceptors in place.
+     * Distinct from disconnect(): this leaves the axios instance and interceptors
+     * in place, and tells the server nothing — it is a request-level repair, not a
+     * teardown.
      */
     private invalidateSession;
     private shouldRetryCsrf;

package/dist/connection/AbstractAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E;;;;;GAKG;AACH,uBAAe,sBACb,YAAW,cAAc,EAAE,sBAAsB;IA+B/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IA9B3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D,OAAO,CAAC,eAAe,CAAU;IACjC;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IAEjC,SAAS,aACU,MAAM,EAAE,SAAS,EACf,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAqBzC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAUpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;;;;;;;;;OAYG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAc9B;;;;;;;;;;;;;OAaG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAWjC,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;OAGG;IACH,KAAK,IAAI,IAAI;IAQb;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;YACW,kBAAkB;IAuDhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IAyBvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAa7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAU7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAchB,cAAc;IA4V5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;OAGG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAmDlB;;OAEG;YACW,0BAA0B;IA0LxC;;OAEG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIlD;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;IAqEjC;;;OAGG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE,OAAO,CAAC,gBAAgB;YAsBV,oBAAoB;IAiClC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAazB,OAAO,CAAC,eAAe;CA+BxB;AAGD,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,uBAAe,sBACb,YAAW,cAAc,EAAE,sBAAsB;IAsE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IA/E3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH;;;;;;;OAOG;IAEH,SAAS,aACU,MAAM,EAAE,SAAS;IAClC;;;;;;;;OAQG;IACM,SAAS,EAAE,aAAa,EACd,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM;IAoBpB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAOpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkCjC,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IAEH;;;;;;;;;OASG;IAEH;;;;;;OAMG;IACH,SAAS,CAAC,cAAc,IAAI,kBAAkB;YAUhC,kBAAkB;IAqJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASnD;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI;IA2BP;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAc7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAchB,cAAc;IA8W5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;;;;;;OAQG;cACa,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAqBlB,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAMlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMlD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,eAAe;CA6BxB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}