@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/dist/connection/AbstractAbapConnection.js

@@ -1,54 +1,37 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AbstractAbapConnection = void 0;
 const node_crypto_1 = require("node:crypto");
-const node_https_1 = require("node:https");
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
-const axios_1 = __importStar(require("axios"));
 const SessionLifecycle_js_1 = require("../session/SessionLifecycle.js");
 const timeouts_js_1 = require("../utils/timeouts.js");
 const csrfConfig_js_1 = require("./csrfConfig.js");
+const IAdtTransport_js_1 = require("./IAdtTransport.js");
 /**
  * Declares the capabilities explicitly rather than satisfying them by accident.
  * `AbapConnection` is the base contract every transport honours; these two are
  * the HTTP session's own, and naming them means a signature that drifts from
  * the published contract fails to compile here instead of at the consumer.
+ *
+ * **This gives the consumer instruments; it does not decide for it.** `connect()`
+ * opens one session and `disconnect()` closes it. How many connections to hold,
+ * how long to hold them and when to let go stays with the caller — there are no
+ * thresholds here, no pooling and no eviction, because none of that is knowable
+ * from inside a single connection. A session this one did not open is not its
+ * business: the session limit is per user and the pool is shared, so a SAP GUI
+ * logon of the same user sits in the same list.
+ *
+ * **Nothing the server decides is treated as something to count on.** Whether it
+ * issues a session cookie, whether it still holds a session it issued, how many
+ * it will tolerate, how fast it answers a logoff — all of that is its own and
+ * may differ by system and release. So each is observed and reported, never
+ * relied upon: the logoff is best effort under a bound the caller sets, a
+ * missing session cookie is a warning rather than a rule, and no code here
+ * counts sessions or predicts the next answer from the last one.
  */
 class AbstractAbapConnection {
     config;
+    transport;
     logger;
     /**
      * Owns session state, admission and teardown ordering. Composed rather than
@@ -56,30 +39,79 @@ class AbstractAbapConnection {
      * transports share this unit instead of a base class.
      */
     lifecycle = new SessionLifecycle_js_1.SessionLifecycle();
-    axiosInstance = null;
-    csrfToken = null;
-    cookies = null;
-    cookieStore = new Map();
     baseUrl;
     sessionId = null;
     sessionMode = 'stateless';
-    skipSessionType;
     /**
      * When true, requests are treated as part of an uninterruptible critical
      * section (e.g. a lock → modify → unlock chain). In this state a short
-     * per-request timeout must NOT abort the request mid-flight, because
-     * aborting the socket drops the stateful ADT session and orphans the lock
-     * handle (leaving the object locked and inactive). While set, makeAdtRequest
+     * per-request timeout must NOT abort the request mid-flight: the abort ends
+     * nothing server-side — only the server ends an ABAP session, on an idle
+     * timeout this side cannot see — it ends what this side KNOWS. Whether the
+     * change was applied becomes unknowable, and the handle `unlock` needs is
+     * lost while the lock lives on in that session. While set, makeAdtRequest
      * raises the effective timeout to CRITICAL_SECTION_TIMEOUT (a large ceiling)
      * so the request runs to completion instead of being interrupted.
      */
     inCriticalSection = false;
     /** Reference count for nested beginCriticalSection()/endCriticalSection() pairs. */
     criticalSectionDepth = 0;
-    constructor(config, logger, sessionId, options) {
+    /** The default release deadline, validated once at construction. */
+    /**
+     * The logoff for the session this connection last held, while it is on its
+     * way. One, because a connection holds one session: `connect()` opens it and
+     * `disconnect()` closes it, and how many connections to run is the caller's
+     * business, not something to be tracked here.
+     *
+     * Carries the session id, not just the promise, so a release still in flight
+     * for an EARLIER session is recognised as not being this one's — reusing it
+     * was what left the second session of a reconnect never released at all.
+     *
+     * The id is the `SAP_SESSIONID` value — the ABAP session, the one locks are
+     * bound to — never the cookie header: that header also carries `sap-XSRF_*`,
+     * which rotates within one and the same session, so comparing headers made a
+     * session stop recognising itself after a token refresh.
+     */
+    /**
+     * How this server opens and gives back a session, decided by asking it rather
+     * than by guessing which system it is. Set at establishment; until then the
+     * on-prem mechanism, which is the one that needs no resource.
+     */
+    /**
+     * The application server this session lives on, as the server named it.
+     *
+     * A session belongs to ONE application server. On a multi-node system a
+     * request that lands on another gets another session — and a lock held on the
+     * first is then dead through nobody's fault and no inactivity. Eclipse pins
+     * itself with these headers; without them every request is a fresh throw of
+     * the dice.
+     *
+     * Learned from `sap-adt-saplb` on a response, sent back as `saplb`. Cleared
+     * with the rest of the session state: it names a server for a session that no
+     * longer exists.
+     */
+    /**
+     * Whether the preflight opened a session of its own.
+     *
+     * Distinct from "there are cookies": a failed establishment often leaves a
+     * cookie from the 401 that rejected it, and that is debris, not a session.
+     * Only a preflight answered with a session address opened one, and only that
+     * is worth saying goodbye to when establishment then fails.
+     */
+    constructor(config, 
+    /**
+     * Required, and constructed by the caller.
+     *
+     * There is no default to fall back to and nothing is worked out from the
+     * config: the wire is a fact about the deployment, and a library that
+     * picked one would be guessing at the thing this design exists to stop
+     * guessing at. It also carries what the caller alone can wire — the
+     * credential's TLS material, the client — which is why it arrives built.
+     */
+    transport, logger, sessionId) {
         this.config = config;
+        this.transport = transport;
         this.logger = logger;
-        this.skipSessionType = options?.skipSessionType ?? false;
         // Generate sessionId (used for sap-adt-connection-id header)
         this.sessionId = sessionId || (0, node_crypto_1.randomUUID)();
         // Initialize baseUrl from config (required, will throw if invalid)
@@ -98,16 +130,12 @@ class AbstractAbapConnection {
      * - stateful: SAP maintains session state between requests (locks, transactions)
      * - stateless: Each request is independent
      *
-     * When skipSessionType is enabled (via constructor options), this is a no-op:
-     * the x-sap-adt-sessiontype header will never be sent. This is needed for
-     * older BASIS versions (e.g. 7.40) where the stateful header causes locks
-     * to be stored in ABAP session memory instead of the global enqueue table,
-     * resulting in HTTP 423 on subsequent PUT requests.
+     * Whether the header actually goes out is the WIRE's: a system where the
+     * stateful header makes the server store locks in session memory instead of
+     * the enqueue table — BASIS 7.40 — is a different deployment, and a
+     * deployment is a transport, not a flag on the connection.
      */
     setSessionType(type) {
-        if (this.skipSessionType) {
-            return;
-        }
         this.sessionMode = type;
         this.logger?.debug(`Session type set to: ${type}`, {
             sessionId: this.sessionId?.substring(0, 8),
@@ -126,9 +154,11 @@ class AbstractAbapConnection {
      * in a finally, AFTER unlocking). While in a critical section, a short
      * per-request timeout is not applied — makeAdtRequest uses a large ceiling
      * (CRITICAL_SECTION_TIMEOUT, env SAP_TIMEOUT_CRITICAL) instead — so a slow
-     * PUT/activate/unlock is not aborted mid-flight. Aborting mid-flight tears
-     * down the socket, which drops the stateful ADT session and orphans the
-     * lock handle, leaving the object locked and inactive.
+     * PUT/activate/unlock is not aborted mid-flight. An abort does not end the
+     * ABAP session — that session is the server's, and only the server ends it,
+     * on an idle timeout this side cannot influence — it strands the caller:
+     * the outcome is unknown and the handle `unlock` needs is gone, while the
+     * lock survives inside the ABAP session that owns it.
      *
      * Nesting is reference-counted so nested begin/end pairs are safe.
      */
@@ -174,6 +204,27 @@ class AbstractAbapConnection {
     getConfig() {
         return this.config;
     }
+    /**
+     * Gets the credential ready before anything is sent.
+     *
+     * A no-op for the auth types whose credential is already in hand — basic
+     * builds a header from the configuration, JWT carries a token it was given.
+     * It exists for the ones that have to fetch or load theirs, because the
+     * preflight now runs BEFORE `establishSession()` and needs a credential to
+     * go out with: a certificate connection reads its material there, and
+     * without this the preflight throws `certificate material not loaded` while
+     * assembling the transport — before a single request is made, on every
+     * system, cloud or on-prem.
+     *
+     * Must be idempotent: `establishSession()` may prepare the same credential
+     * again, and does.
+     *
+     * Kerberos deliberately does NOT implement it. Minting the SPNEGO token this
+     * early changes when the exchange happens, and that connection is not
+     * production-tested — its preflight fails the way it already did, is caught
+     * inside the strategy, and the connection falls back to ICF as before.
+     */
+    async prepareCredential() { }
     /**
      * Establishes the session, once, under the lifecycle.
      *
@@ -193,29 +244,73 @@ class AbstractAbapConnection {
         await this.lifecycle.transition('connect', async () => {
             if (this.lifecycle.connected)
                 return;
+            // The wire gets a session in whatever way it has one: an RFC
+            // conversation opened, a cloud session resource asked for, nothing at
+            // all on a wire whose session arrives with the establishing call. Which
+            // of those it is belongs to the transport the caller handed in.
+            await this.transport.open(this.sessionContext());
             await this.establishAndCommit(baselineEpoch);
         });
     }
     /**
      * Tears the session down. Never throws, and always settles.
      *
-     * It waits for NOTHING. Deciding when to disconnect is the caller's, and so is
-     * preparing for it — finishing chains, releasing locks. Waiting here on a
-     * request whose caller chose no timeout is what made a teardown unbounded, and
-     * an unbounded teardown blocks every later transition on the serialized tail.
+     * Tells the server the session is no longer needed, then clears the local
+     * state. **When the server actually reclaims it is the server's business** —
+     * possibly not until the next connect asks it for one — and nothing here
+     * waits for that or depends on it. What matters is that the session stops
+     * being counted against the user, which dropping the cookie alone does not
+     * achieve: the server keeps it until its own timeout, so a process that
+     * connects repeatedly leaves one behind every time. Measured on S/4HANA on-prem, 25 connects in a row: with the logoff,
+     * 24-25 of them were given a session; without it, 2. A connection that gets
+     * no session still answers `200` to a LOCK and hands back a handle the next
+     * request cannot use, so the leak surfaces as a half-written object rather
+     * than as anything about sessions.
+     *
+     * **Nothing is waited for.** The logoff is dispatched, not awaited: this
+     * method notifies, and whether the server has acted on the notice is not
+     * something it reports. Finishing chains and releasing locks stay the
+     * caller's to do BEFORE calling — waiting here on a request that carries no
+     * timeout by design is what made a teardown unbounded, which blocks every
+     * later transition on the serialized tail.
      *
-     * Requests already in flight run to completion untouched. Generation fencing
-     * (see `SessionLifecycle.isCurrent`) keeps their results from reaching this
-     * connection afterwards.
+     * **Requests already in flight are not waited for, and the logoff ends the
+     * session they are running on** — so they will start failing against a
+     * session that no longer exists. That is the caller having asked to
+     * disconnect, not a race, and it is a change from the version that only
+     * dropped the cookie. Generation fencing (see `SessionLifecycle.isCurrent`)
+     * keeps their results from reaching this connection either way.
      *
-     * Sends no ADT session-close — see the design's D2.
+     * **Nothing to wait for.** This TELLS the server the session is finished and
+     * does not act on the answer — whether and when the session is freed is the
+     * server's affair. Waiting for a reply nobody reads was also the one thing
+     * that could make a teardown unbounded, since the goodbye carries no request
+     * timeout by design.
      */
     async disconnect() {
+        // Nothing here throws. This method's place is a `finally` — a connection
+        // that was connected must be disconnected — and an exception raised there
+        // replaces the error that sent the caller into it.
         // Synchronous, at the call: admission shuts and the generation moves before
         // anything is queued, so a caller who has asked to disconnect cannot have
         // requests still going through while this waits its turn.
         this.lifecycle.beginTeardown({ origin: 'caller', sessionLost: false });
+        // Captured before the transition and before anything is cleared: a
+        // concurrent disconnect JOINS the transition and its callback is never run
+        // for the joiner, so a joiner would otherwise learn nothing about what it
+        // asked to release.
+        const session = this.getSessionIdentity();
         await this.lifecycle.transition('disconnect', async () => {
+            // DISPATCHED, not awaited. The goodbye carries no request timeout by
+            // design — a server that never answers must not hold a teardown open —
+            // and nothing bounds it here either, because there is nothing to bound:
+            // awaiting an unbounded request is precisely what would make every
+            // teardown unbounded.
+            //
+            // The context is taken now, while the session is still true: the clear
+            // below runs while the close is suspended on its first await.
+            const context = this.sessionContext();
+            const inFlight = Promise.resolve(this.transport.close(context)).then(() => undefined);
             this.clearSessionState();
             this.lifecycle.markDisconnected();
         });
@@ -231,22 +326,11 @@ class AbstractAbapConnection {
      * session cookie. Use {@link isConnected} for connection state.
      *
      * It follows that null → non-null is not a replacement but an identity being
-     * learned; only a CHANGED value means the session was replaced.
+     * learned; only a CHANGED value means the session we had is gone.
      */
     getSessionIdentity() {
         return this.lifecycle.identity;
     }
-    /**
-     * Discards the session at a caller's request: cancels queued recoveries and
-     * queues the cleanup rather than tearing down under a live request.
-     */
-    reset() {
-        this.lifecycle.beginTeardown({ origin: 'caller', sessionLost: true });
-        void this.lifecycle.transition('cleanup', async () => {
-            this.clearSessionState();
-            this.lifecycle.markDisconnected();
-        });
-    }
     /**
      * Re-establishes the session for a request that is recovering from a
      * credential renewal, then lets that request retry.
@@ -278,6 +362,36 @@ class AbstractAbapConnection {
      * Shared by connect() and recoverSession() rather than written twice —
      * the two drifted apart once already, and a third caller would drift again.
      */
+    /**
+     * What a session strategy is given: enough to make one request and to prove
+     * the session is ours, and nothing else. It cannot reach session state, so a
+     * strategy can neither mark this connection connected nor tear it down.
+     */
+    /**
+     * Ask the server to open a session before the establishing call needs one.
+     *
+     * The strategy is chosen by what the server publishes, not by which system we
+     * believe it to be: ABAP Cloud offers a session resource and issues
+     * `SAP_SESSIONID` to whoever asks for one — with `x-sap-security-session:
+     * create` — while on-prem has no such resource and its session arrives with
+     * the establishing request. Believing cloud simply "issues no SAP_SESSIONID"
+     * is what happens when nobody asks.
+     */
+    /**
+     * What a wire needs from this connection to get a session, or give one back.
+     *
+     * A snapshot in the sense that matters: a close is dispatched without being
+     * awaited, so nothing here may read the connection again once the teardown
+     * has cleared it.
+     */
+    sessionContext() {
+        return {
+            baseUrl: this.baseUrl,
+            authHeaders: () => this.getAuthHeaders(),
+            extraHeaders: { 'sap-adt-connection-id': this.getSessionId() ?? '' },
+            observe: (headers) => this.observeResponse(headers),
+        };
+    }
     async establishAndCommit(baselineEpoch) {
         if (this.lifecycle.teardownEpoch !== baselineEpoch) {
             throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED, 'Establishment abandoned: a teardown was requested for this connection');
@@ -289,6 +403,20 @@ class AbstractAbapConnection {
         // makes the new fingerprint `established`, which is what it is.
         this.lifecycle.forgetIdentity();
         try {
+            // First, because the preflight below has to be able to authenticate: the
+            // credential of a certificate or Kerberos connection is not in hand until
+            // it is loaded or minted, and assembling a request without it throws.
+            await this.prepareCredential();
+            // Before the establishing call, because on a system that has one this is
+            // what creates the session the rest of the connection runs in — and the
+            // cookies it sets are the ones the establishing call must carry.
+            // Forgotten again, because the open was OURS. Establishment is now two
+            // requests where it used to be one, and the identity policy answers "did
+            // the server move us to a different session while we were working" — a
+            // question that has no meaning between two calls we make ourselves to set
+            // this session up. The identity that counts is taken at the end, from the
+            // cookies we finish with.
+            this.lifecycle.forgetIdentity();
             await this.establishSession();
         }
         catch (error) {
@@ -302,6 +430,26 @@ class AbstractAbapConnection {
             // Safe to clear here, unlike the abandonment path below: establishSession()
             // threw, so no session was published, and admission requires a connected
             // lifecycle — nothing can be in flight over what this drops.
+            //
+            // But say goodbye FIRST. The preflight may already have opened a session
+            // — on cloud it does, and the SAP_SESSIONID is in the cookies about to be
+            // dropped — and establishing can still fail after it, on a credential the
+            // preflight never used. Clearing without telling the server would leak
+            // exactly the session this release exists to stop leaking, and leave it
+            // unreachable: the connection is not connected, so disconnect() sends
+            // nothing, and the cookie that was the only permission to close it is
+            // gone. The transport is a snapshot, so this survives the clearing that
+            // follows it.
+            // Only when the preflight opened one. A cookie left by the 401 that
+            // rejected us is debris, not a session, and telling the server we are
+            // finished with something we never had sends a request nobody asked for
+            // — into the middle of an authentication exchange, in the case that found
+            // this.
+            // Whether there is anything to say is the wire's to know: a cloud
+            // session has an address or it does not, and an on-prem one was
+            // established or the cookie is debris from the refusal. The connection
+            // asks, and each wire answers by doing nothing when it has nothing.
+            const goodbye = this.transport.close(this.sessionContext());
             this.invalidateSession();
             // And the identity with it. The rejecting response was still observed, so
             // its cookie was recorded as a session that had just been established —
@@ -309,6 +457,10 @@ class AbstractAbapConnection {
             // isConnected() says false. Two answers to one question is worse than
             // either.
             this.lifecycle.markDisconnected();
+            // Not awaited, for the same reason a teardown does not wait: the caller
+            // is owed the establishment error now, not after a round trip nobody is
+            // waiting on. closeSession never throws, so nothing here can go unhandled.
+            void goodbye;
             throw error;
         }
         if (this.lifecycle.teardownEpoch !== baselineEpoch) {
@@ -319,15 +471,76 @@ class AbstractAbapConnection {
             // from inside the guard meant to protect it.
             throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED, 'Establishment abandoned: a teardown was requested while it was in flight');
         }
-        // establishSession() throws on failure, so reaching here means a session
-        // exists. There is no third outcome: no "connected but unusable", no
-        // resolved promise over an empty jar.
+        // The session IS the SAP_SESSIONID the server issued; our own session id is
+        // a conversation label we generate and says nothing about what exists on
+        // the other side. An empty fingerprint therefore means the server opened no
+        // session — on-prem it answers with `sap-XSRF_*` instead once enough
+        // sessions are already open for the user — and such a connection still gets
+        // `200` for a LOCK and hands back a handle the next request cannot use.
+        //
+        // SAP_SESSIONID names the ABAP session — the one locks are bound to. Its
+        // absence is therefore not a transport problem: the HTTP side is fine, the
+        // cookies are here, and stateless requests will work. What is missing is any
+        // ABAP session known to this connection, so there is nothing a lock could be
+        // bound to and every lock taken over it is dead the moment it is issued.
+        //
+        // Checked rather than assumed: a connection that got no cookie was held open
+        // against an on-prem system and the session list showed nothing for it,
+        // while one that got a cookie appeared there.
+        //
+        // Which is why this refuses to connect rather than warning. There is no
+        // count to plan around — the same system allowed 21 sessions one day and
+        // refused an eleventh the next — so a caller cannot avoid the condition by
+        // being frugal, and the only reliable signal is whether THIS connect got a
+        // session. Reported with its cause; recovering is the caller's call, and
+        // nothing here retries on anyone's behalf.
+        //
+        // Reported, not decided on. A session that was not opened is a condition on
+        // the server, and what to do about it — wait, retry, release sessions this
+        // user still holds, carry on read-only over a fresh connection — depends on
+        // things only the caller knows. So it is raised where the caller can catch
+        // it, with enough in the message to act on, and nothing is retried here.
+        //
+        // Every transport, not only basic: splitting by authentication type would
+        // encode a guess about cloud ABAP, whose ADT endpoint would not answer the
+        // bearer obtainable here, so the question stayed open. If a cloud system
+        // turns out to hold sessions without issuing this cookie, this is the rule
+        // to revisit — and it will say so loudly rather than fail quietly.
+        if (!this.transport.sessionEstablished()) {
+            // Goodbye first, for the same reason the catch above does it: the
+            // preflight may have opened a session — on cloud it does — and this path
+            // is about to drop the cookies that are the only permission to close it.
+            // Refusing to connect must not leak the session the refusal is about.
+            try {
+                void this.transport.close(this.sessionContext());
+            }
+            catch (error) {
+                this.logger?.debug(`Could not tell the server the session is finished: ${error instanceof Error ? error.message : String(error)}`);
+            }
+            this.invalidateSession();
+            this.lifecycle.forgetIdentity();
+            this.lifecycle.markDisconnected();
+            throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED, `The server authenticated the request but opened no ABAP session: the ${this.transport.kind} wire reports it is on none, so there is nothing for a lock to be bound to. The wire itself is fine — the request was carried and answered — which is why this is not a transport failure and does not look like one. ` +
+                'Stateless reads would still work over it, but a lock, and any write under that lock, is dead the moment it is issued. ' +
+                'The usual cause is the system declining to open another session for this user: they are limited per user, shared with every other tool logged on as them, and released either by disconnecting or by their own idle timeout. ' +
+                'Whether to wait, retry, or release sessions this user still holds is yours to decide — this library does not retry on your behalf.');
+        }
         this.lifecycle.markConnected(this.sessionFingerprint());
     }
     /** The teardown epoch, for a recovery to capture before it starts. */
     get teardownEpoch() {
         return this.lifecycle.teardownEpoch;
     }
+    /**
+     * Which session the connection is on now.
+     *
+     * Moves whenever the session does. A response that comes back carrying an
+     * older one belongs to a session that has already been replaced, and must not
+     * be acted on as if it said something about the current one.
+     */
+    get sessionGeneration() {
+        return this.lifecycle.sessionGeneration;
+    }
     /**
      * Raises a session-lost teardown from inside request handling.
      *
@@ -398,7 +611,10 @@ class AbstractAbapConnection {
             this.logger?.debug('Ignoring a response from a previous session: its effects are fenced');
             return;
         }
-        this.applyIdentityPolicy(this.updateCookiesFromResponse(headers));
+        // The wire folds the response into its own state; what the change MEANS
+        // is decided here, because it is a question about the session's lifetime.
+        this.transport.ingest(headers);
+        this.applyIdentityPolicy(this.lifecycle.observe(this.transport.sessionFingerprint()));
     }
     /**
      * Acts on what a response said about the session identity.
@@ -420,25 +636,28 @@ class AbstractAbapConnection {
         if (classification !== 'replaced')
             return;
         this.raiseSessionLost('the session cookie changed under us');
-        throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.SESSION_REPLACED, 'The SAP session was replaced; anything held against the previous one is dead');
+        throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.SESSION_REPLACED, 'The SAP session this connection was using is gone and the requests are now on a different one; anything held against the old session — a lock and any write under it — is dead. ' +
+            'The server does not swap sessions on a whim: the usual causes are the session idling out (the timeout is idle-based, so a quiet connection loses it while a busy one does not) or a request landing on a different application server. ' +
+            'What to do about it is yours: re-establish and redo the work, or fail the operation. Nothing is retried here.');
     }
     /**
      * Whether the server is telling us the session it was given no longer exists.
      *
-     * The E19 shape was HTTP 400 with "Session not found", answered in ~60 ms
+     * One on-prem system answered HTTP 400 with "Session not found", answered in ~60 ms
      * with the cookie present — which is why identity comparison cannot see this:
      * the cookie, and therefore the fingerprint, is completely unchanged. The
      * exact match is landscape-specific and is one of the live probes this design
      * still owes.
      */
     isDeadSessionResponse(error) {
-        if (!(error instanceof axios_1.AxiosError) || !error.response)
+        const refusal = (0, IAdtTransport_js_1.refusalOf)(error);
+        if (!refusal)
             return false;
-        if (error.response.status !== 400)
+        if (refusal.status !== 400)
             return false;
         const text = [
-            error.response.statusText,
-            typeof error.response.data === 'string' ? error.response.data : '',
+            refusal.statusText,
+            typeof refusal.data === 'string' ? refusal.data : '',
         ]
             .join(' ')
             .toLowerCase();
@@ -446,14 +665,11 @@ class AbstractAbapConnection {
     }
     /** Drops everything that described the session. Not a lifecycle transition. */
     clearSessionState() {
-        if (this.axiosInstance) {
-            this.axiosInstance.interceptors.request.clear();
-            this.axiosInstance.interceptors.response.clear();
-            this.axiosInstance = null;
-        }
-        this.csrfToken = null;
-        this.cookies = null;
-        this.cookieStore.clear();
+        this.setCsrfToken(null);
+        // Cookies, the fingerprint and the application server are the wire's, and
+        // it gives them back together — a server named for a session that no
+        // longer exists is as stale as the cookie that addressed it.
+        this.transport.forgetSession();
         // Note: baseUrl is not reset as it's derived from immutable config
     }
     /**
@@ -465,13 +681,7 @@ class AbstractAbapConnection {
      * overwritten on every response.
      */
     sessionFingerprint() {
-        const fingerprint = new Map();
-        for (const [name, value] of this.cookieStore) {
-            if (name.startsWith('SAP_SESSIONID')) {
-                fingerprint.set(name, value);
-            }
-        }
-        return fingerprint;
+        return this.transport.sessionFingerprint();
     }
     async getBaseUrl() {
         return this.baseUrl;
@@ -504,21 +714,22 @@ class AbstractAbapConnection {
     async performRequest(options, lease) {
         const { url: endpoint, method, timeout, data, params, headers: customHeaders, } = options;
         const normalizedMethod = method.toUpperCase();
-        // Build full URL: baseUrl + endpoint
-        const requestUrl = `${this.baseUrl}${endpoint}`;
+        // The PATH, not an address. Which server it belongs in front of — or
+        // whether it belongs in front of one at all — is the wire's to say.
+        const requestUrl = endpoint;
         // Try to ensure CSRF token is available for POST/PUT/DELETE, but don't fail if it can't be fetched
         // The retry logic will handle CSRF token errors automatically
         if (normalizedMethod === 'POST' ||
             normalizedMethod === 'PUT' ||
             normalizedMethod === 'DELETE') {
-            if (!this.csrfToken) {
+            if (!this.transport.csrfToken()) {
                 try {
-                    await this.ensureFreshCsrfToken(requestUrl);
+                    await this.ensureWireReady();
                 }
                 catch (error) {
                     // If CSRF token can't be fetched upfront, continue anyway
                     // The retry logic will handle CSRF token errors automatically
-                    this.logger?.debug(`[DEBUG] BaseAbapConnection - Could not fetch CSRF token upfront, will retry on error: ${error instanceof Error ? error.message : String(error)}`);
+                    this.logger?.debug(`Could not fetch CSRF token upfront, will retry on error: ${error instanceof Error ? error.message : String(error)}`);
                 }
             }
         }
@@ -544,20 +755,19 @@ class AbstractAbapConnection {
         }
         // Add auth headers (these MUST NOT be overridden)
         Object.assign(requestHeaders, await this.getAuthHeaders());
+        // Read once: the wire is asked what it holds, and the same value is what
+        // goes on the header.
+        const presented = this.transport.csrfToken();
         if ((normalizedMethod === 'POST' ||
             normalizedMethod === 'PUT' ||
             normalizedMethod === 'DELETE') &&
-            this.csrfToken) {
-            requestHeaders['x-csrf-token'] = this.csrfToken;
-        }
-        // Add cookies LAST (MUST NOT be overridden by custom headers)
-        if (this.cookies) {
-            requestHeaders.Cookie = this.cookies;
-            this.logger?.debug(`[DEBUG] BaseAbapConnection - Adding cookies to request (first 100 chars): ${this.cookies.substring(0, 100)}...`);
-        }
-        else {
-            this.logger?.debug(`[DEBUG] BaseAbapConnection - NO COOKIES available for this request to ${requestUrl}`);
+            presented) {
+            requestHeaders['x-csrf-token'] = presented;
         }
+        // No cookies and no affinity headers here. Both are the wire's own state,
+        // and the wire puts them on the requests it sends — a connection that
+        // threaded them would be threading them for every transport, including one
+        // that has neither.
         if ((normalizedMethod === 'POST' || normalizedMethod === 'PUT') && data) {
             if (typeof data === 'string' && !requestHeaders['Content-Type']) {
                 if (requestUrl.includes('/usageReferences') &&
@@ -573,8 +783,10 @@ class AbstractAbapConnection {
             }
         }
         // Inside an uninterruptible critical section (lock → modify → unlock), a
-        // short per-request timeout must not abort the request mid-flight — that
-        // would drop the stateful session and orphan the lock. Raise the effective
+        // short per-request timeout must not abort the request mid-flight — not
+        // because the abort ends the ABAP session (only the server does that), but
+        // because it leaves the outcome unknown and the unlock handle lost while
+        // the lock stays held in that session. Raise the effective
         // timeout to the large critical-section ceiling for the whole request
         // (also honoured on the retry paths below, which reuse requestConfig).
         const effectiveTimeout = this.inCriticalSection
@@ -585,7 +797,9 @@ class AbstractAbapConnection {
             url: requestUrl,
             headers: requestHeaders,
             timeout: effectiveTimeout,
-            params,
+            // `unknown` on the caller's options, a record on the seam: the two
+            // transports serialise a query differently and both need the pairs.
+            params: params,
         };
         if (data !== undefined) {
             requestConfig.data = data;
@@ -596,7 +810,7 @@ class AbstractAbapConnection {
             method: normalizedMethod,
         });
         try {
-            const response = await this.getAxiosInstance()(requestConfig);
+            const response = await this.transport.send(requestConfig);
             this.observeResponse(response.headers, lease.generation);
             this.logger?.debug(`Request succeeded with status ${response.status}`, {
                 type: 'REQUEST_SUCCESS',
@@ -626,15 +840,18 @@ class AbstractAbapConnection {
                 message: error instanceof Error ? error.message : String(error),
                 url: requestUrl,
                 method: normalizedMethod,
-                status: error instanceof axios_1.AxiosError ? error.response?.status : undefined,
+                status: (0, IAdtTransport_js_1.refusalOf)(error)?.status,
                 data: undefined,
             };
-            if (error instanceof axios_1.AxiosError && error.response) {
+            const refusal = (0, IAdtTransport_js_1.refusalOf)(error);
+            if (refusal) {
                 errorDetails.data =
-                    typeof error.response.data === 'string'
-                        ? error.response.data.slice(0, 200)
-                        : JSON.stringify(error.response.data).slice(0, 200);
-                this.observeResponse(error.response.headers, lease.generation);
+                    typeof refusal.data === 'string'
+                        ? refusal.data.slice(0, 200)
+                        : JSON.stringify(refusal.data).slice(0, 200);
+                // Every wire's refusal, not only axios's. A response the connection
+                // never observed is a session replacement it never noticed.
+                this.observeResponse(refusal.headers, lease.generation);
             }
             // The server telling us the session is gone is invisible to the identity
             // comparison: the cookie, and therefore the fingerprint, is unchanged.
@@ -660,20 +877,24 @@ class AbstractAbapConnection {
             else {
                 this.logger?.error(errorDetails.message, errorDetails);
             }
-            // Detect the "login-form 401" pattern: SAP returned 401 for a mutation while
-            // we have a cached CSRF token. The token and its bound SAP session must be
-            // discarded before the retry. Basic auth only — JWT/SAML lifecycles are
-            // managed elsewhere.
-            const isCachedTokenStale = error instanceof axios_1.AxiosError &&
-                this.config.authType === 'basic' &&
-                (normalizedMethod === 'POST' ||
-                    normalizedMethod === 'PUT' ||
-                    normalizedMethod === 'DELETE') &&
-                error.response?.status === 401 &&
+            // The "login-form 401": SAP refused a mutation while we hold a cached CSRF
+            // token, so the token and the session it is bound to are dead and must be
+            // discarded before the retry.
+            //
+            // Not keyed on the credential any more. It used to be "basic auth only —
+            // JWT/SAML lifecycles are managed elsewhere", and elsewhere was
+            // JwtAbapConnection, which is gone. Credential renewal now lives a layer
+            // ABOVE this, in CredentialAbapConnection, which wraps the whole request:
+            // these retries happen first and it only sees a 401 that survived them.
+            // Nothing collides, so nothing needs to be excluded.
+            const isCachedTokenStale = (normalizedMethod === 'POST' ||
+                normalizedMethod === 'PUT' ||
+                normalizedMethod === 'DELETE') &&
+                (0, IAdtTransport_js_1.refusalOf)(error)?.status === 401 &&
                 this.getCsrfToken() !== null;
             // Retry logic for CSRF token errors (403 with CSRF message) and the
             // login-form 401 pattern.
-            if (this.shouldRetryCsrf(error) || isCachedTokenStale) {
+            if (this.shouldRetryCsrf(error, normalizedMethod) || isCachedTokenStale) {
                 this.logger?.debug(isCachedTokenStale
                     ? 'Stale CSRF token / SAP session — invalidating and retrying'
                     : 'CSRF token validation failed, fetching new token and retrying request', {
@@ -695,7 +916,7 @@ class AbstractAbapConnection {
                     if (refreshedCookies) {
                         requestHeaders.Cookie = refreshedCookies;
                     }
-                    const retryResponse = await this.getAxiosInstance()(requestConfig);
+                    const retryResponse = await this.transport.send(requestConfig);
                     this.observeResponse(retryResponse.headers, lease.generation);
                     return retryResponse;
                 }
@@ -712,30 +933,30 @@ class AbstractAbapConnection {
                     throw error;
                 }
             }
-            // Retry logic for 401 errors on GET requests (authentication issue - need cookies)
-            // Only for basic auth - JWT auth will be handled by refresh logic below
-            if (error instanceof axios_1.AxiosError &&
-                error.response?.status === 401 &&
-                normalizedMethod === 'GET' &&
-                this.config.authType === 'basic' // Only for basic auth
-            ) {
+            // A 401 on a GET where cookies have since arrived: the first request had
+            // none, and the session they name is what the retry needs. Guarded below
+            // on actually holding some, so a wire that issues no cookies — RFC —
+            // never takes it.
+            if ((0, IAdtTransport_js_1.refusalOf)(error)?.status === 401 && normalizedMethod === 'GET') {
                 // If we already have cookies from error response, retry immediately
-                if (this.cookies) {
-                    this.logger?.debug(`[DEBUG] BaseAbapConnection - 401 on GET request, retrying with cookies from error response`);
-                    requestHeaders.Cookie = this.cookies;
-                    const retryResponse = await this.getAxiosInstance()(requestConfig);
+                const afterError = this.transport.cookies();
+                if (afterError) {
+                    this.logger?.debug(`401 on GET request, retrying with cookies from error response`);
+                    requestHeaders.Cookie = afterError;
+                    const retryResponse = await this.transport.send(requestConfig);
                     this.observeResponse(retryResponse.headers, lease.generation);
                     return retryResponse;
                 }
                 // If no cookies, try to get them via CSRF token fetch
-                this.logger?.debug(`[DEBUG] BaseAbapConnection - 401 on GET request, attempting to get cookies via CSRF token fetch`);
+                this.logger?.debug(`401 on GET request, attempting to get cookies via CSRF token fetch`);
                 try {
                     // Try to get CSRF token (this will also get cookies)
-                    this.csrfToken = await this.fetchCsrfToken(requestUrl, 3, 1000, lease.generation);
-                    if (this.cookies) {
-                        requestHeaders.Cookie = this.cookies;
-                        this.logger?.debug(`[DEBUG] BaseAbapConnection - Retrying GET request with cookies from CSRF fetch`);
-                        const retryResponse = await this.getAxiosInstance()(requestConfig);
+                    this.setCsrfToken(await this.fetchCsrfToken(requestUrl, 3, 1000, lease.generation));
+                    const afterCsrf = this.transport.cookies();
+                    if (afterCsrf) {
+                        requestHeaders.Cookie = afterCsrf;
+                        this.logger?.debug(`Retrying GET request with cookies from CSRF fetch`);
+                        const retryResponse = await this.transport.send(requestConfig);
                         this.observeResponse(retryResponse.headers, lease.generation);
                         return retryResponse;
                     }
@@ -744,7 +965,7 @@ class AbstractAbapConnection {
                     if (this.isSessionVerdict(csrfError)) {
                         throw csrfError;
                     }
-                    this.logger?.debug(`[DEBUG] BaseAbapConnection - Failed to get CSRF token for 401 retry: ${csrfError instanceof Error ? csrfError.message : String(csrfError)}`);
+                    this.logger?.debug(`Failed to get CSRF token for 401 retry: ${csrfError instanceof Error ? csrfError.message : String(csrfError)}`);
                     // Fall through to throw original error
                 }
             }
@@ -752,326 +973,108 @@ class AbstractAbapConnection {
         }
     }
     /**
-     * Fetch CSRF token from SAP system
-     * Protected method for use by concrete implementations in their connect() method
+     * Ask the wire to establish itself, and hand back what it earned.
+     *
+     * The exchange itself is the transport's — it is the HTTP wire that has a
+     * token to earn and an endpoint to earn it from, and the RFC wire that has
+     * neither. What stays here is the part that is about the SESSION rather than
+     * the wire: fencing the answer by generation, and letting the identity policy
+     * read what it means.
      */
-    async fetchCsrfToken(url, retryCount = csrfConfig_js_1.CSRF_CONFIG.RETRY_COUNT, retryDelay = csrfConfig_js_1.CSRF_CONFIG.RETRY_DELAY, 
+    async fetchCsrfToken(_url, retryCount = csrfConfig_js_1.CSRF_CONFIG.RETRY_COUNT, retryDelay = csrfConfig_js_1.CSRF_CONFIG.RETRY_DELAY, 
     /** Fences the response effects; omitted during connect(), which has no lease. */
     generation) {
-        // Try primary endpoint first, then fallback for older systems
-        const baseUrl = url.includes('/sap/bc/adt/')
-            ? url.split('/sap/bc/adt')[0]
-            : url.endsWith('/')
-                ? url.slice(0, -1)
-                : url;
-        let endpoints;
-        // If the URL already contains a specific endpoint, use only that
-        if (url.includes(csrfConfig_js_1.CSRF_CONFIG.ENDPOINT)) {
-            endpoints = [url];
-        }
-        else if (url.includes(csrfConfig_js_1.CSRF_CONFIG.FALLBACK_ENDPOINT)) {
-            endpoints = [url];
-        }
-        else {
-            endpoints = [
-                `${baseUrl}${csrfConfig_js_1.CSRF_CONFIG.ENDPOINT}`,
-                `${baseUrl}${csrfConfig_js_1.CSRF_CONFIG.FALLBACK_ENDPOINT}`,
-            ];
-        }
-        let lastError;
-        for (const csrfUrl of endpoints) {
-            try {
-                return await this.fetchCsrfTokenFromEndpoint(csrfUrl, retryCount, retryDelay, generation);
-            }
-            catch (error) {
-                // Third layer with a catch on this path, and the last one that could
-                // bury a verdict: falling through to the fallback endpoint would open
-                // ANOTHER session, and by then the teardown has cleared the fingerprint
-                // so the new one reads as `established` and the loss disappears.
-                if (this.isSessionVerdict(error)) {
-                    throw error;
-                }
-                lastError = error instanceof Error ? error : new Error(String(error));
-                this.logger?.debug(`CSRF token not available from ${csrfUrl}, trying next endpoint...`);
-            }
-        }
-        // All endpoints exhausted
-        throw lastError ?? new Error('CSRF token fetch failed unexpectedly');
-    }
-    /**
-     * Fetch CSRF token from a specific endpoint with retries
-     */
-    async fetchCsrfTokenFromEndpoint(csrfUrl, retryCount, retryDelay, generation) {
-        this.logger?.debug(`Fetching CSRF token from: ${csrfUrl}`);
-        for (let attempt = 0; attempt <= retryCount; attempt++) {
-            try {
-                if (attempt > 0) {
-                    this.logger?.debug(`Retry attempt ${attempt}/${retryCount} for CSRF token`);
-                }
-                const authHeaders = await this.getAuthHeaders();
-                const headers = {
-                    ...authHeaders,
-                    ...csrfConfig_js_1.CSRF_CONFIG.REQUIRED_HEADERS,
-                };
-                // The token fetch belongs to the same ADT conversation as every other
-                // request this connection makes. Without the connection id the server
-                // sees a caller that merely happens to present our cookies, so a fetch
-                // issued while a lock is held reads as a stranger reaching into the
-                // session. makeAdtRequest sends this header for all session types; this
-                // path must not be the exception.
-                if (this.sessionId) {
-                    headers['sap-adt-connection-id'] = this.sessionId;
-                }
-                // Always add cookies if available - they are needed for session continuity
-                // Even on first attempt, if we have cookies from previous session or error response, use them
-                if (this.cookies) {
-                    headers.Cookie = this.cookies;
-                    this.logger?.debug(`[DEBUG] BaseAbapConnection - Adding cookies to CSRF token request (attempt ${attempt + 1}, first 100 chars): ${this.cookies.substring(0, 100)}...`);
-                }
-                else {
-                    this.logger?.debug(`[DEBUG] BaseAbapConnection - No cookies available for CSRF token request (will get fresh cookies from response)`);
-                }
-                // Log request details for debugging (only if debug logging is enabled)
-                this.logger?.debug(`[DEBUG] CSRF Token Request: url=${csrfUrl}, method=GET, hasAuth=${!!authHeaders.Authorization}, hasClient=${!!authHeaders['X-SAP-Client']}, hasCookies=${!!headers.Cookie}, attempt=${attempt + 1}`);
-                const response = await this.getAxiosInstance()({
-                    method: 'GET',
-                    url: csrfUrl,
-                    headers,
-                    timeout: (0, timeouts_js_1.getTimeout)('csrf'),
-                });
-                this.observeResponse(response.headers, generation);
-                const token = response.headers['x-csrf-token'];
-                if (!token) {
-                    this.logger?.error('No CSRF token in response headers', {
-                        headers: response.headers,
-                        status: response.status,
-                    });
-                    if (attempt < retryCount) {
-                        await new Promise((resolve) => setTimeout(resolve, retryDelay));
-                        continue;
-                    }
-                    throw new Error(csrfConfig_js_1.CSRF_ERROR_MESSAGES.NOT_IN_HEADERS);
-                }
-                if (response.headers['set-cookie']) {
-                    this.observeResponse(response.headers, generation);
-                    if (this.cookies) {
-                        this.logger?.debug(`[DEBUG] BaseAbapConnection - Cookies received from CSRF response (first 100 chars): ${this.cookies.substring(0, 100)}...`);
-                        this.logger?.debug('Cookies extracted from response', {
-                            cookieLength: this.cookies.length,
-                        });
-                    }
-                }
-                this.logger?.debug('CSRF token successfully obtained');
-                return token;
-            }
-            catch (error) {
-                // A session verdict is not a failed token fetch and must not be
-                // retried into silence: the retry would observe the SAME new session,
-                // read it as `unchanged`, and the replacement this raised would be gone
-                // for good. It leaves immediately, past the loop and past the caller's
-                // recovery.
-                if (this.isSessionVerdict(error)) {
-                    throw error;
-                }
-                if (error instanceof axios_1.AxiosError) {
-                    // Always try to extract cookies from error response, even on 401
-                    // This ensures cookies are available for subsequent requests
-                    if (error.response?.headers) {
-                        this.observeResponse(error.response.headers, generation);
-                        if (this.cookies) {
-                            this.logger?.debug('Cookies extracted from error response', {
-                                status: error.response.status,
-                                cookieLength: this.cookies.length,
-                            });
-                        }
-                    }
-                    this.logger?.error(`CSRF token error: ${error.message}`, {
-                        url: csrfUrl,
-                        status: error.response?.status,
-                        attempt: attempt + 1,
-                        maxAttempts: retryCount + 1,
-                    });
-                    if (error.response?.status === 405 &&
-                        error.response?.headers['x-csrf-token']) {
-                        this.logger?.debug('CSRF: SAP returned 405 (Method Not Allowed) — not critical, token found in header');
-                        const token = error.response.headers['x-csrf-token'];
-                        if (token) {
-                            this.observeResponse(error.response.headers, generation);
-                            return token;
-                        }
-                    }
-                    if (error.response?.headers['x-csrf-token']) {
-                        this.logger?.debug(`Got CSRF token despite error (status: ${error.response?.status})`);
-                        const token = error.response.headers['x-csrf-token'];
-                        this.observeResponse(error.response.headers, generation);
-                        return token;
-                    }
-                    if (error.response) {
-                        this.logger?.error('CSRF error details', {
-                            status: error.response.status,
-                            statusText: error.response.statusText,
-                            headers: Object.keys(error.response.headers),
-                            data: typeof error.response.data === 'string'
-                                ? error.response.data.slice(0, 200)
-                                : JSON.stringify(error.response.data).slice(0, 200),
-                        });
-                    }
-                    else if (error.request) {
-                        this.logger?.error('CSRF request error - no response received', {
-                            request: error.request.path,
-                        });
-                    }
-                }
-                else {
-                    this.logger?.error('CSRF non-axios error', {
-                        error: error instanceof Error ? error.message : String(error),
-                    });
-                }
-                if (attempt < retryCount) {
-                    await new Promise((resolve) => setTimeout(resolve, retryDelay));
-                    continue;
-                }
-                // Preserve original error information, especially AxiosError with response
-                if (error instanceof axios_1.AxiosError && error.response) {
-                    // Re-throw the original AxiosError to preserve response information
-                    throw error;
-                }
-                throw new Error(csrfConfig_js_1.CSRF_ERROR_MESSAGES.FETCH_FAILED(retryCount + 1, error instanceof Error ? error.message : String(error)));
-            }
-        }
-        throw new Error('CSRF token fetch failed unexpectedly');
+        // Dropped first, because this is only ever reached to REPLACE one: the
+        // establishment is idempotent and would hand back the very token the
+        // caller has just been told is stale.
+        this.transport.adoptCsrfToken(null);
+        await this.transport.establish({
+            baseUrl: this.baseUrl,
+            authHeaders: () => this.getAuthHeaders(),
+            extraHeaders: { 'sap-adt-connection-id': this.sessionId ?? '' },
+            observe: (headers) => this.observeResponse(headers, generation),
+            retries: retryCount,
+            retryDelayMs: retryDelay,
+            timeoutMs: (0, timeouts_js_1.getTimeout)('csrf'),
+            isFatal: (error) => this.isSessionVerdict(error),
+        });
+        const token = this.transport.csrfToken();
+        if (!token)
+            throw new Error(csrfConfig_js_1.CSRF_ERROR_MESSAGES.NOT_IN_HEADERS);
+        return token;
     }
-    /**
-     * Get CSRF token (protected for use by subclasses)
-     */
     getCsrfToken() {
-        return this.csrfToken;
+        return this.transport.csrfToken();
     }
     /**
      * Set CSRF token (protected for use by subclasses)
      */
     setCsrfToken(token) {
-        this.csrfToken = token;
+        // A credential that did the exchange itself hands the token to the wire
+        // that will present it.
+        this.transport.adoptCsrfToken(token);
     }
     /**
      * Get cookies (protected for use by subclasses)
      */
     getCookies() {
-        return this.cookies;
-    }
-    setInitialCookies(cookies) {
-        this.cookies = cookies;
+        return this.transport.cookies();
     }
     /**
-     * Folds a response's cookies into the jar and classifies what that means for
-     * the session identity. Returns the classification rather than acting on it:
-     * cookie parsing stays free of policy, and no exception fires in the middle
-     * of a state update. The caller decides.
+     * Seed the wire with cookies the caller already holds — a SAML session, which
+     * IS the credential rather than something a logon call earns.
+     *
+     * Handed over as a response would deliver them, because the wire owns the jar
+     * and how it stores them is its business, not this class's.
      */
-    updateCookiesFromResponse(headers) {
-        if (!headers) {
-            return 'unchanged';
-        }
-        const setCookie = headers['set-cookie'];
-        if (!setCookie) {
-            return 'unchanged';
-        }
-        const cookiesArray = Array.isArray(setCookie) ? setCookie : [setCookie];
-        for (const entry of cookiesArray) {
-            if (typeof entry !== 'string') {
-                continue;
-            }
-            const [nameValue] = entry.split(';');
-            if (!nameValue) {
-                continue;
-            }
-            const [name, ...rest] = nameValue.split('=');
-            if (!name) {
-                continue;
-            }
-            const trimmedName = name.trim();
-            const trimmedValue = rest.join('=').trim();
-            if (!trimmedName) {
-                continue;
-            }
-            this.cookieStore.set(trimmedName, trimmedValue);
-        }
-        // Enforce configured SAP client in sap-usercontext cookie.
-        // SAP may return sap-usercontext=sap-client=<default_client> based on system
-        // default rather than the X-SAP-Client header value, causing requests to be
-        // routed to the wrong client (e.g. a read-only client → 403 on write operations).
-        if (this.config.client) {
-            this.cookieStore.set('sap-usercontext', `sap-client=${this.config.client}`);
-        }
-        if (this.cookieStore.size === 0) {
-            return 'unchanged';
-        }
-        const combined = Array.from(this.cookieStore.entries())
-            .map(([name, value]) => (value ? `${name}=${value}` : name))
-            .join('; ');
-        if (!combined) {
-            return 'unchanged';
-        }
-        this.cookies = combined;
-        this.logger?.debug(`[DEBUG] BaseAbapConnection - Updated cookies from response (first 100 chars): ${this.cookies.substring(0, 100)}...`);
-        return this.lifecycle.observe(this.sessionFingerprint());
+    setInitialCookies(cookies) {
+        this.transport.ingest({
+            'set-cookie': cookies.split(';').map((entry) => entry.trim()),
+        });
     }
     /**
-     * Subclasses override to inject extra https.Agent options (e.g. mTLS cert/key/pfx).
-     * The returned options are merged with the base options (rejectUnauthorized).
+     * Subclasses override to inject extra https.Agent options (e.g. mTLS
+     * cert/key/pfx). The returned options are merged with the base options
+     * (rejectUnauthorized).
      */
     getHttpsAgentOptions() {
         return {};
     }
-    getAxiosInstance() {
-        if (!this.axiosInstance) {
-            const rejectUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '1' ||
-                (process.env.TLS_REJECT_UNAUTHORIZED === '1' &&
-                    process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0');
-            this.logger?.debug(`TLS configuration: rejectUnauthorized=${rejectUnauthorized}`);
-            this.axiosInstance = axios_1.default.create({
-                httpsAgent: new node_https_1.Agent({
-                    rejectUnauthorized,
-                    ...this.getHttpsAgentOptions(),
-                }),
-            });
-        }
-        return this.axiosInstance;
-    }
-    async ensureFreshCsrfToken(requestUrl) {
-        // If we already have a CSRF token, reuse it to keep the same SAP session
-        // SAP ties the lock handle to the HTTP session (SAP_SESSIONID cookie)
-        if (this.csrfToken) {
-            this.logger?.debug(`[DEBUG] BaseAbapConnection - Reusing existing CSRF token to maintain session`);
-            return;
-        }
-        try {
-            this.logger?.debug(`[DEBUG] BaseAbapConnection - Fetching NEW CSRF token (will create new SAP session)`);
-            this.csrfToken = await this.fetchCsrfToken(requestUrl);
-        }
-        catch (error) {
-            // fetchCsrfToken handles auth errors
-            // Just re-throw the error with minimal logging to avoid duplicate error messages
-            const errorMsg = error instanceof Error
-                ? error.message
-                : csrfConfig_js_1.CSRF_ERROR_MESSAGES.REQUIRED_FOR_MUTATION;
-            // Only log at DEBUG level to avoid duplicate error messages
-            // (fetchCsrfToken already logged the error at ERROR level if auth failed)
-            this.logger?.debug(`[DEBUG] BaseAbapConnection - ensureFreshCsrfToken failed: ${errorMsg}`);
-            throw error;
-        }
+    /**
+     * Make sure the wire is ready to carry a mutation.
+     *
+     * What ready MEANS is the wire's: HTTP holds a CSRF token and returns at once
+     * when it already has one; an RFC conversation has nothing to earn and does
+     * nothing. Demanding a token back was an HTTP assumption, and over RFC it
+     * raised `No CSRF token in response headers` before every write — swallowed
+     * by the caller, but logged as an error and repeated on the next one.
+     */
+    async ensureWireReady() {
+        await this.transport.establish({
+            baseUrl: this.baseUrl,
+            authHeaders: () => this.getAuthHeaders(),
+            extraHeaders: { 'sap-adt-connection-id': this.sessionId ?? '' },
+            observe: (headers) => this.observeResponse(headers),
+            isFatal: (error) => this.isSessionVerdict(error),
+        });
     }
     /**
      * Clear SAP-side session state when SAP rejects the cached CSRF token + session
      * cookies (HTTP 401 on a mutation while a cached token exists). This forces the
      * next request path to fetch a fresh token and a fresh SAP_SESSIONID cookie.
      *
-     * Distinct from reset(): this leaves the axios instance and interceptors in place.
+     * Distinct from disconnect(): this leaves the axios instance and interceptors
+     * in place, and tells the server nothing — it is a request-level repair, not a
+     * teardown.
      */
     invalidateSession() {
         this.setCsrfToken(null);
-        this.cookies = null;
-        this.cookieStore.clear();
+        // The wire's state described THAT session: the cookies, the fingerprint
+        // taken from them, and the application server it lived on. Sending the
+        // server name again would pin the next connect — preflight included — to a
+        // server whose session is gone.
+        this.transport.forgetSession();
+        // Everything else that described THAT session. The application server named
         // And the tracked identity, because WE discarded the session. Without this
         // the cookie that arrives next reads as a foreign replacement — and since a
         // replacement is now always fatal, our own deliberate re-authentication
@@ -1080,28 +1083,27 @@ class AbstractAbapConnection {
         // is not a session taken from under us.
         this.lifecycle.forgetIdentity();
     }
-    shouldRetryCsrf(error) {
-        if (!(error instanceof axios_1.AxiosError)) {
+    shouldRetryCsrf(error, method) {
+        const refusal = (0, IAdtTransport_js_1.refusalOf)(error);
+        if (!refusal) {
             return false;
         }
-        const responseData = error.response?.data;
+        const responseData = refusal.data;
         const responseText = typeof responseData === 'string'
             ? responseData
             : JSON.stringify(responseData || '');
-        // Don't retry for JWT auth - refresh logic will handle it
-        if (this.config.authType === 'jwt') {
-            return false;
-        }
         // Retry on 403 with CSRF message, or if response mentions CSRF token
         // Also retry on 401 for POST/PUT/DELETE if we don't have CSRF token yet (might need to get cookies first)
-        const method = error.config?.method?.toUpperCase();
-        const isPostPutDelete = method && ['POST', 'PUT', 'DELETE'].includes(method);
-        const needsCsrfToken = !!isPostPutDelete && !this.csrfToken;
-        return ((!!error.response &&
-            error.response.status === 403 &&
-            responseText.includes('CSRF')) ||
+        // Handed in rather than read off `error.config`, which is axios's own
+        // record of the request and does not exist on another wire's refusal. The
+        // caller already normalised the method; asking the error for it was asking
+        // the HTTP client.
+        const normalized = method?.toUpperCase();
+        const isPostPutDelete = normalized && ['POST', 'PUT', 'DELETE'].includes(normalized);
+        const needsCsrfToken = !!isPostPutDelete && !this.transport.csrfToken();
+        return ((refusal.status === 403 && responseText.includes('CSRF')) ||
             responseText.includes('CSRF token') ||
-            (needsCsrfToken && error.response?.status === 401));
+            (needsCsrfToken && refusal.status === 401));
     }
 }
 exports.AbstractAbapConnection = AbstractAbapConnection;