@mcp-abap-adt/connection 5.0.0 → 6.0.0

package/dist/auth/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/auth/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC1B,UAAU,EACV,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,2DAA2D;AAC3D,qBAAa,iBAAkB,YAAW,aAAa;IAInD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,QAAQ,CAAC,IAAI,WAAW;gBAGL,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG7B,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;CAG7C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,aAAa;IAYnD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,QAAQ,CAAC,IAAI,WAAW;IAExB;;;;;;;OAOG;gBAEgB,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAU5C;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAGxC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAF3C,QAAQ,CAAC,IAAI,UAAU;gBAEM,cAAc,EAAE,MAAM;IAE7C,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI5C,8BAA8B;IAC9B,OAAO,IAAI,MAAM;CAGlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAKzD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAqC;gBAGlC,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU;IAG/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI5C,iBAAiB,IAAI,YAAY;CASlC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/auth/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,UAAU,EACV,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,2DAA2D;AAC3D,qBAAa,iBAAkB,YAAW,aAAa;IAiBnD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjB3B,QAAQ,CAAC,IAAI,WAAW;IAExB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;gBAKtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG7B,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGpD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,oBAAoB;IAyB1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAxBzB,QAAQ,CAAC,IAAI,WAAW;IAExB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;IAIzC;;;;;;;OAOG;gBAEgB,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnD;;;;;;;;;;;;;;;;;;OAkBG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAWxC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAV3C,QAAQ,CAAC,IAAI,UAAU;IAEvB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;gBAIZ,cAAc,EAAE,MAAM;IAEnD,0EAA0E;IACpE,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInD,8BAA8B;IAC9B,OAAO,IAAI,MAAM;CAGlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAWzD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,OAAO,CAAC,QAAQ,CAAqC;gBAGlC,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU;IAG/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,+DAA+D;IACzD,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInD,iBAAiB,IAAI,oBAAoB;CAS1C"}

package/dist/auth/providers.js

@@ -15,6 +15,16 @@ class BasicAuthProvider {
     username;
     password;
     kind = 'basic';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
     constructor(username, password) {
         this.username = username;
         this.password = password;
@@ -39,6 +49,16 @@ exports.BasicAuthProvider = BasicAuthProvider;
 class TokenAuthProvider {
     source;
     kind = 'token';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
     /**
      * A token, or something that can produce one.
      *
@@ -69,6 +89,17 @@ class TokenAuthProvider {
     /**
      * The token was refused, so force a new one.
      *
+     * Declared through `IRenewableCredential` rather than as an optional member
+     * of every credential, so a consumer narrows to it: a password has nothing
+     * behind it to ask again, and a SAML session was negotiated elsewhere.
+     *
+     * **Nothing in this package calls it.** A token that EXPIRED is replaced
+     * inside `authorizationHeader()` above, which is asked per request — nobody
+     * decides anything. This is the other case, a token the source still believes
+     * in and the server refuses, and whether a refusal meant that is a judgement
+     * made with what the caller knows. So the refusal surfaces, and this is the
+     * seam the caller decides with.
+     *
      * `getToken()` is documented to return the cached token while it believes it
      * is still valid — which is exactly the situation after a 401 on a token the
      * provider has not yet noticed is dead. `refreshToken()` is the contract's
@@ -93,11 +124,18 @@ exports.TokenAuthProvider = TokenAuthProvider;
 class SamlAuthProvider {
     sessionCookies;
     kind = 'saml';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
     constructor(sessionCookies) {
         this.sessionCookies = sessionCookies;
     }
+    /** Not a header: this credential authenticates with the cookies below. */
     async authorizationHeader() {
-        return '';
+        return null;
     }
     /** The cookies to present. */
     cookies() {
@@ -116,6 +154,10 @@ class CertificateAuthProvider {
     loader;
     config;
     kind = 'certificate';
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
     material = null;
     constructor(loader, config) {
         this.loader = loader;
@@ -126,10 +168,11 @@ class CertificateAuthProvider {
             this.material = await this.loader.load(this.config);
         }
     }
+    /** Not a header: this credential authenticates through TLS. */
     async authorizationHeader() {
-        return '';
+        return null;
     }
-    httpsAgentOptions() {
+    transportMaterial() {
         if (!this.material) {
             throw new Error('CertificateAuthProvider: certificate material not loaded. connect() prepares it; a request before that has nothing to present.');
         }

package/dist/connection/AbstractAbapConnection.d.ts

@@ -2,8 +2,8 @@ import { type IAdtResponse, type ISessionLifecycleAware } from '@mcp-abap-adt/in
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import { SessionLifecycle } from '../session/SessionLifecycle.js';
-import type { SessionStrategy } from '../session/SessionStrategy.js';
 import type { AbapConnection, AbapRequestOptions } from './AbapConnection.js';
+import { type IAdtSessionContext, type IAdtTransport } from './IAdtTransport.js';
 /**
  * Declares the capabilities explicitly rather than satisfying them by accident.
  * `AbapConnection` is the base contract every transport honours; these two are
@@ -28,6 +28,16 @@ import type { AbapConnection, AbapRequestOptions } from './AbapConnection.js';
  */
 declare abstract class AbstractAbapConnection implements AbapConnection, ISessionLifecycleAware {
     private readonly config;
+    /**
+     * Required, and constructed by the caller.
+     *
+     * There is no default to fall back to and nothing is worked out from the
+     * config: the wire is a fact about the deployment, and a library that
+     * picked one would be guessing at the thing this design exists to stop
+     * guessing at. It also carries what the caller alone can wire — the
+     * credential's TLS material, the client — which is why it arrives built.
+     */
+    readonly transport: IAdtTransport;
     protected readonly logger: ILogger | null;
     /**
      * Owns session state, admission and teardown ordering. Composed rather than
@@ -35,20 +45,17 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * transports share this unit instead of a base class.
      */
     protected readonly lifecycle: SessionLifecycle;
-    private axiosInstance;
-    private csrfToken;
-    private cookies;
-    private cookieStore;
     private baseUrl;
     private sessionId;
     private sessionMode;
-    private skipSessionType;
     /**
      * When true, requests are treated as part of an uninterruptible critical
      * section (e.g. a lock → modify → unlock chain). In this state a short
-     * per-request timeout must NOT abort the request mid-flight, because
-     * aborting the socket drops the stateful ADT session and orphans the lock
-     * handle (leaving the object locked and inactive). While set, makeAdtRequest
+     * per-request timeout must NOT abort the request mid-flight: the abort ends
+     * nothing server-side — only the server ends an ABAP session, on an idle
+     * timeout this side cannot see — it ends what this side KNOWS. Whether the
+     * change was applied becomes unknowable, and the handle `unlock` needs is
+     * lost while the lock lives on in that session. While set, makeAdtRequest
      * raises the effective timeout to CRITICAL_SECTION_TIMEOUT (a large ceiling)
      * so the request runs to completion instead of being interrupted.
      */
@@ -56,7 +63,6 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     /** Reference count for nested beginCriticalSection()/endCriticalSection() pairs. */
     private criticalSectionDepth;
     /** The default release deadline, validated once at construction. */
-    private readonly releaseDeadlineMs;
     /**
      * The logoff for the session this connection last held, while it is on its
      * way. One, because a connection holds one session: `connect()` opens it and
@@ -90,7 +96,6 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * with the rest of the session state: it names a server for a session that no
      * longer exists.
      */
-    private appServer;
     /**
      * Whether the preflight opened a session of its own.
      *
@@ -99,23 +104,27 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * Only a preflight answered with a session address opened one, and only that
      * is worth saying goodbye to when establishment then fails.
      */
-    private preflightOpenedSession;
-    private sessionStrategy;
-    private pendingRelease;
-    protected constructor(config: SapConfig, logger: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
+    protected constructor(config: SapConfig, 
+    /**
+     * Required, and constructed by the caller.
+     *
+     * There is no default to fall back to and nothing is worked out from the
+     * config: the wire is a fact about the deployment, and a library that
+     * picked one would be guessing at the thing this design exists to stop
+     * guessing at. It also carries what the caller alone can wire — the
+     * credential's TLS material, the client — which is why it arrives built.
+     */
+    transport: IAdtTransport, logger: ILogger | null, sessionId?: string);
     /**
      * Set session type (stateful or stateless)
      * Controls whether x-sap-adt-sessiontype: stateful header is added to requests
      * - stateful: SAP maintains session state between requests (locks, transactions)
      * - stateless: Each request is independent
      *
-     * When skipSessionType is enabled (via constructor options), this is a no-op:
-     * the x-sap-adt-sessiontype header will never be sent. This is needed for
-     * older BASIS versions (e.g. 7.40) where the stateful header causes locks
-     * to be stored in ABAP session memory instead of the global enqueue table,
-     * resulting in HTTP 423 on subsequent PUT requests.
+     * Whether the header actually goes out is the WIRE's: a system where the
+     * stateful header makes the server store locks in session memory instead of
+     * the enqueue table — BASIS 7.40 — is a different deployment, and a
+     * deployment is a transport, not a flag on the connection.
      */
     setSessionType(type: 'stateful' | 'stateless'): void;
     /**
@@ -129,9 +138,11 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * in a finally, AFTER unlocking). While in a critical section, a short
      * per-request timeout is not applied — makeAdtRequest uses a large ceiling
      * (CRITICAL_SECTION_TIMEOUT, env SAP_TIMEOUT_CRITICAL) instead — so a slow
-     * PUT/activate/unlock is not aborted mid-flight. Aborting mid-flight tears
-     * down the socket, which drops the stateful ADT session and orphans the
-     * lock handle, leaving the object locked and inactive.
+     * PUT/activate/unlock is not aborted mid-flight. An abort does not end the
+     * ABAP session — that session is the server's, and only the server ends it,
+     * on an idle timeout this side cannot influence — it strands the caller:
+     * the outcome is unknown and the handle `unlock` needs is gone, while the
+     * lock survives inside the ABAP session that owns it.
      *
      * Nesting is reference-counted so nested begin/end pairs are safe.
      */
@@ -207,12 +218,12 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * request cannot use, so the leak surfaces as a half-written object rather
      * than as anything about sessions.
      *
-     * **The logoff is the only thing waited for**, under `deadlineMs`, and
-     * deciding that bound is the caller's — see the parameter. Nothing else is
-     * waited for: finishing chains and releasing locks stay the caller's to do
-     * before calling, and waiting here on a request whose caller chose no timeout
-     * is what made a teardown unbounded, which blocks every later transition on
-     * the serialized tail.
+     * **Nothing is waited for.** The logoff is dispatched, not awaited: this
+     * method notifies, and whether the server has acted on the notice is not
+     * something it reports. Finishing chains and releasing locks stay the
+     * caller's to do BEFORE calling — waiting here on a request that carries no
+     * timeout by design is what made a teardown unbounded, which blocks every
+     * later transition on the serialized tail.
      *
      * **Requests already in flight are not waited for, and the logoff ends the
      * session they are running on** — so they will start failing against a
@@ -221,58 +232,13 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * dropped the cookie. Generation fencing (see `SessionLifecycle.isCurrent`)
      * keeps their results from reaching this connection either way.
      *
-     * @param options.deadlineMs How long to spend telling the server, measured
-     *   from this call and including time spent queued behind another transition.
-     *   **Defaults to `SAP_RELEASE_DEADLINE_MS`, which is `0` — do not wait.**
-     *   Waiting is for steps whose successor needs the server to have caught up;
-     *   a teardown has none. The logoff is still sent at `0`, because saying so
-     *   is not conditional on caring when it lands; its outcome is logged when it
-     *   arrives rather than awaited. Pass a positive value to bound a wait you
-     *   have chosen to take. Anything that is not a finite, non-negative number
-     *   is reported and the default used instead — this method is called from a
-     *   `finally`, where throwing would replace the error that sent the caller
-     *   there. The configured default is checked once, at construction, so a
-     *   misconfigured `SAP_RELEASE_DEADLINE_MS` fails before a connection exists
-     *   rather than at every teardown.
-     */
-    disconnect(options?: {
-        deadlineMs?: number;
-    }): Promise<void>;
-    /**
-     * Tells the server this session is no longer needed. Best effort, and the
-     * answer is not depended on: whether and when the server frees it is its own
-     * affair, and this connection does not check afterwards.
-     *
-     * ICF rather than ADT because ADT publishes no such endpoint: its discovery
-     * document lists none on any reachable system — on-prem, cloud, or legacy —
-     * and the ADT logon is the discovery call itself. `/sap/public/bc/icf/logoff`
-     * is the platform's own, and answers `200` while expiring the session cookie.
-     *
-     * **One session, this connection's own.** A repeat `connect()` opens a NEW
-     * one, with a new `SAP_SESSIONID`, so an earlier session is not this
-     * connection's business any more: its logoff is already on the wire, or the
-     * system will time it out. Nothing here retries, counts, or keeps a list —
-     * how many connections to run and how carefully stays with the caller.
-     *
-     * **It ends the session, not this object's use of it.** The cookies are the
-     * only thing tying anyone to a session, so a second connection given the same
-     * cookies works in the same ABAP session and can use the locks taken in it —
-     * and this logoff closes that session for all of them at once. Whoever hands
-     * the cookies around owns that decision; this method cannot see the copies.
-     *
-     * Never throws. `disconnect()` must always settle, and a session we could not
-     * close is better than a teardown that does not finish; the local state is
-     * cleared either way.
-     */
-    private releaseServerSession;
-    /**
-     * Waits up to `budgetMs` for a release already on its way, then detaches.
-     *
-     * Detaching, not cancelling: when the budget runs out this stops waiting and
-     * the request carries on to the server. Each caller of `disconnect()` gets
-     * its own, so one caller's patience is never charged to another's.
-     */
-    private awaitReleaseWithin;
+     * **Nothing to wait for.** This TELLS the server the session is finished and
+     * does not act on the answer — whether and when the session is freed is the
+     * server's affair. Waiting for a reply nobody reads was also the one thing
+     * that could make a teardown unbounded, since the goodbye carries no request
+     * timeout by design.
+     */
+    disconnect(): Promise<void>;
     isConnected(): boolean;
     /**
      * Fingerprint of the SAP-side session, or null when none is known.
@@ -317,7 +283,6 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * the session is ours, and nothing else. It cannot reach session state, so a
      * strategy can neither mark this connection connected nor tear it down.
      */
-    private sessionTransport;
     /**
      * Ask the server to open a session before the establishing call needs one.
      *
@@ -329,22 +294,13 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * is what happens when nobody asks.
      */
     /**
-     * Which session management this system uses — decided by the connection, not
-     * discovered by asking.
+     * What a wire needs from this connection to get a session, or give one back.
      *
-     * On-prem and cloud do not manage sessions the same way, and the two
-     * implementations exist for that reason. On-prem the session arrives with the
-     * establishing request and the platform's ICF logoff gives it back, exactly as
-     * it always has. Cloud opens a session resource and takes it back by DELETE on
-     * the address the server published.
-     *
-     * Probing was tried and is wrong: `/sap/bc/adt/core/http/sessions` answers on
-     * on-prem too — measured on S/4HANA, which publishes both the session resource
-     * and the ICF logoff in the same document — so a probe does not tell the two
-     * systems apart. It only tells whether an endpoint exists, and both have it.
+     * A snapshot in the sense that matters: a close is dispatched without being
+     * awaited, so nothing here may read the connection again once the teardown
+     * has cleared it.
      */
-    protected createSessionStrategy(): SessionStrategy;
-    private openServerSession;
+    protected sessionContext(): IAdtSessionContext;
     private establishAndCommit;
     /** The teardown epoch, for a recovery to capture before it starts. */
     protected get teardownEpoch(): number;
@@ -387,7 +343,7 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * turns "your lock is dead" back into "your request 403'd", which is the very
      * information the caller needs and the only one it cannot recover itself.
      */
-    private isSessionVerdict;
+    protected isSessionVerdict(error: unknown): boolean;
     /**
      * Folds a response into the session state AND acts on what it means, in one
      * step.
@@ -397,23 +353,7 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * later check reads `unchanged`. That is one call site forgetting, and it
      * happened — on the error path and on every retry response.
      */
-    private observeResponse;
-    /**
-     * Take the application server's name from a response, if it named one.
-     *
-     * Only ever set from the server's own answer — never guessed, and never kept
-     * across a teardown.
-     */
-    private rememberAppServer;
-    /**
-     * Headers that keep this connection on the server its session lives on.
-     *
-     * `sap-adt-saplb: fetch` asks the server to name itself — it answers on every
-     * request, so the binding survives a restart that moves us. `saplb` is that
-     * name sent back. `REDISPATCH_ON_SHUTDOWN` is what Eclipse asks for: if the
-     * server is going down, send us elsewhere rather than fail.
-     */
-    private affinityHeaders;
+    protected observeResponse(headers?: Record<string, unknown>, generation?: number): void;
     /**
      * Acts on what a response said about the session identity.
      *
@@ -458,19 +398,17 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     private performRequest;
     protected abstract buildAuthorizationHeader(): string;
     /**
-     * Fetch CSRF token from SAP system
-     * Protected method for use by concrete implementations in their connect() method
+     * Ask the wire to establish itself, and hand back what it earned.
+     *
+     * The exchange itself is the transport's — it is the HTTP wire that has a
+     * token to earn and an endpoint to earn it from, and the RFC wire that has
+     * neither. What stays here is the part that is about the SESSION rather than
+     * the wire: fencing the answer by generation, and letting the identity policy
+     * read what it means.
      */
-    protected fetchCsrfToken(url: string, retryCount?: number, retryDelay?: number, 
+    protected fetchCsrfToken(_url: string, retryCount?: number, retryDelay?: number, 
     /** Fences the response effects; omitted during connect(), which has no lease. */
     generation?: number): Promise<string>;
-    /**
-     * Fetch CSRF token from a specific endpoint with retries
-     */
-    private fetchCsrfTokenFromEndpoint;
-    /**
-     * Get CSRF token (protected for use by subclasses)
-     */
     protected getCsrfToken(): string | null;
     /**
      * Set CSRF token (protected for use by subclasses)
@@ -480,21 +418,30 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * Get cookies (protected for use by subclasses)
      */
     protected getCookies(): string | null;
-    protected setInitialCookies(cookies: string): void;
     /**
-     * Folds a response's cookies into the jar and classifies what that means for
-     * the session identity. Returns the classification rather than acting on it:
-     * cookie parsing stays free of policy, and no exception fires in the middle
-     * of a state update. The caller decides.
+     * Seed the wire with cookies the caller already holds — a SAML session, which
+     * IS the credential rather than something a logon call earns.
+     *
+     * Handed over as a response would deliver them, because the wire owns the jar
+     * and how it stores them is its business, not this class's.
      */
-    private updateCookiesFromResponse;
+    protected setInitialCookies(cookies: string): void;
     /**
-     * Subclasses override to inject extra https.Agent options (e.g. mTLS cert/key/pfx).
-     * The returned options are merged with the base options (rejectUnauthorized).
+     * Subclasses override to inject extra https.Agent options (e.g. mTLS
+     * cert/key/pfx). The returned options are merged with the base options
+     * (rejectUnauthorized).
      */
     protected getHttpsAgentOptions(): import('node:https').AgentOptions;
-    private getAxiosInstance;
-    private ensureFreshCsrfToken;
+    /**
+     * Make sure the wire is ready to carry a mutation.
+     *
+     * What ready MEANS is the wire's: HTTP holds a CSRF token and returns at once
+     * when it already has one; an RFC conversation has nothing to earn and does
+     * nothing. Demanding a token back was an HTTP assumption, and over RFC it
+     * raised `No CSRF token in response headers` before every write — swallowed
+     * by the caller, but logged as an error and repeated on the next one.
+     */
+    private ensureWireReady;
     /**
      * Clear SAP-side session state when SAP rejects the cached CSRF token + session
      * cookies (HTTP 401 on a mutation while a cached token exists). This forces the

package/dist/connection/AbstractAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAEV,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAOvC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAwB9E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,uBAAe,sBACb,YAAW,cAAc,EAAE,sBAAsB;IA8E/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IA7E3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D,OAAO,CAAC,eAAe,CAAU;IACjC;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,SAAS,CAAuB;IACxC;;;;;;;OAOG;IACH,OAAO,CAAC,sBAAsB,CAAS;IACvC,OAAO,CAAC,eAAe,CAAiD;IACxE,OAAO,CAAC,cAAc,CAAwD;IAE9E,SAAS,aACU,MAAM,EAAE,SAAS,EACf,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IA6BzC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAUpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;;;;;;;;;OAYG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAc9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA0CG;IACG,UAAU,CAAC,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAuDlE;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,oBAAoB;IAmElC;;;;;;OAMG;YACW,kBAAkB;IA0BhC,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAgExB;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,SAAS,CAAC,qBAAqB,IAAI,eAAe;YAIpC,iBAAiB;YAQjB,kBAAkB;IAuJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,OAAO,CAAC,gBAAgB;IASxB;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe;IA0BvB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IASvB;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAa7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IAezB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAU7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAchB,cAAc;IAsW5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;OAGG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAmDlB;;OAEG;YACW,0BAA0B;IA8LxC;;OAEG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIlD;;;;;OAKG;IACH,OAAO,CAAC,yBAAyB;IAqEjC;;;OAGG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE,OAAO,CAAC,gBAAgB;YAsBV,oBAAoB;IAiClC;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAoBzB,OAAO,CAAC,eAAe;CA+BxB;AAGD,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,uBAAe,sBACb,YAAW,cAAc,EAAE,sBAAsB;IAsE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IA/E3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH;;;;;;;OAOG;IAEH,SAAS,aACU,MAAM,EAAE,SAAS;IAClC;;;;;;;;OAQG;IACM,SAAS,EAAE,aAAa,EACd,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM;IAoBpB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAOpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkCjC,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IAEH;;;;;;;;;OASG;IAEH;;;;;;OAMG;IACH,SAAS,CAAC,cAAc,IAAI,kBAAkB;YAUhC,kBAAkB;IAqJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASnD;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI;IA2BP;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAc7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAchB,cAAc;IA8W5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;;;;;;OAQG;cACa,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAqBlB,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAMlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMlD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,eAAe;CA6BxB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}