@mcp-abap-adt/connection 5.0.0 → 6.0.0

package/dist/connection/AdtCloudConnector.d.ts

@@ -15,15 +15,20 @@
  * inferred — not from the credential, not from the host name, not from what the
  * server answers.
  */
-import type { IAuthProvider } from '../auth/IAuthProvider.js';
+import type { IAuthProvider } from '@mcp-abap-adt/interfaces';
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
-import type { SessionStrategy } from '../session/SessionStrategy.js';
+import type { CloudHttpTransport } from './CloudHttpTransport.js';
 import { CredentialAbapConnection } from './CredentialAbapConnection.js';
-export declare class AdtCloudConnector extends CredentialAbapConnection {
-    constructor(config: SapConfig, credential: IAuthProvider, logger?: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
-    protected createSessionStrategy(): SessionStrategy;
+import type { ICloudTransport } from './IAdtTransport.js';
+export declare class AdtCloudConnector<TCredential extends IAuthProvider = IAuthProvider, 
+/**
+ * Constrained to the cloud wire, so "cloud over RFC" does not compile.
+ * There is no such deployment, and a connector that accepted the transport
+ * would be offering a combination that cannot exist.
+ */
+TTransport extends ICloudTransport = CloudHttpTransport> extends CredentialAbapConnection<TCredential> {
+    readonly transport: TTransport;
+    constructor(config: SapConfig, credential: TCredential, transport: TTransport, logger?: ILogger | null, sessionId?: string);
 }
 //# sourceMappingURL=AdtCloudConnector.d.ts.map

package/dist/connection/AdtCloudConnector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdtCloudConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtCloudConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,qBAAa,iBAAkB,SAAQ,wBAAwB;gBAE3D,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,aAAa,EACzB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;cAKtB,qBAAqB,IAAI,eAAe;CAG5D"}
+{"version":3,"file":"AdtCloudConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtCloudConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qBAAa,iBAAiB,CAC5B,WAAW,SAAS,aAAa,GAAG,aAAa;AACjD;;;;GAIG;AACH,UAAU,SAAS,eAAe,GAAG,kBAAkB,CACvD,SAAQ,wBAAwB,CAAC,WAAW,CAAC;IAC7C,SAAiB,SAAS,EAAE,UAAU,CAAC;gBAGrC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,WAAW,EACvB,SAAS,EAAE,UAAU,EACrB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM;CAIrB"}

package/dist/connection/AdtCloudConnector.js

@@ -18,14 +18,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdtCloudConnector = void 0;
-const CloudSecuritySessionStrategy_js_1 = require("../session/CloudSecuritySessionStrategy.js");
 const CredentialAbapConnection_js_1 = require("./CredentialAbapConnection.js");
 class AdtCloudConnector extends CredentialAbapConnection_js_1.CredentialAbapConnection {
-    constructor(config, credential, logger = null, sessionId, options) {
-        super(config, credential, logger, sessionId, options);
-    }
-    createSessionStrategy() {
-        return new CloudSecuritySessionStrategy_js_1.CloudSecuritySessionStrategy(this.logger);
+    constructor(config, credential, transport, logger = null, sessionId) {
+        super(config, credential, transport, logger, sessionId);
     }
 }
 exports.AdtCloudConnector = AdtCloudConnector;

package/dist/connection/AdtOnPremConnector.d.ts

@@ -16,15 +16,28 @@
  * asked for this connector — not because of what is in the header, and not
  * because anything worked out where it was pointing.
  */
-import type { IAuthProvider } from '../auth/IAuthProvider.js';
+import type { IAuthProvider } from '@mcp-abap-adt/interfaces';
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
-import type { SessionStrategy } from '../session/SessionStrategy.js';
 import { CredentialAbapConnection } from './CredentialAbapConnection.js';
-export declare class AdtOnPremConnector extends CredentialAbapConnection {
-    constructor(config: SapConfig, credential: IAuthProvider, logger?: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
-    protected createSessionStrategy(): SessionStrategy;
+import type { IOnPremTransport } from './IAdtTransport.js';
+import type { OnPremHttpTransport } from './OnPremHttpTransport.js';
+export declare class AdtOnPremConnector<TCredential extends IAuthProvider = IAuthProvider, 
+/**
+ * The two wires an on-prem system actually offers. Said by the caller: the
+ * same ADT call travels over HTTP, or over RFC on a system where stateful
+ * HTTP sessions are not usable.
+ */
+TTransport extends IOnPremTransport = OnPremHttpTransport> extends CredentialAbapConnection<TCredential> {
+    /**
+     * The transport this was built with, in the type.
+     *
+     * `declare` because the base already assigns it — this only narrows what the
+     * caller gets back, which is the whole point of the parameter: a signature
+     * can ask for `AdtOnPremConnector<IAuthProvider, RfcTransport>` instead of
+     * taking any connection and casting.
+     */
+    readonly transport: TTransport;
+    constructor(config: SapConfig, credential: TCredential, transport: TTransport, logger?: ILogger | null, sessionId?: string);
 }
 //# sourceMappingURL=AdtOnPremConnector.d.ts.map

package/dist/connection/AdtOnPremConnector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AdtOnPremConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtOnPremConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAEzE,qBAAa,kBAAmB,SAAQ,wBAAwB;gBAE5D,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,aAAa,EACzB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;cAKtB,qBAAqB,IAAI,eAAe;CAG5D"}
+{"version":3,"file":"AdtOnPremConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtOnPremConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,qBAAa,kBAAkB,CAC7B,WAAW,SAAS,aAAa,GAAG,aAAa;AACjD;;;;GAIG;AACH,UAAU,SAAS,gBAAgB,GAAG,mBAAmB,CACzD,SAAQ,wBAAwB,CAAC,WAAW,CAAC;IAC7C;;;;;;;OAOG;IACH,SAAiB,SAAS,EAAE,UAAU,CAAC;gBAGrC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,WAAW,EACvB,SAAS,EAAE,UAAU,EACrB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM;CAIrB"}

package/dist/connection/AdtOnPremConnector.js

@@ -19,14 +19,10 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdtOnPremConnector = void 0;
-const IcfSessionStrategy_js_1 = require("../session/IcfSessionStrategy.js");
 const CredentialAbapConnection_js_1 = require("./CredentialAbapConnection.js");
 class AdtOnPremConnector extends CredentialAbapConnection_js_1.CredentialAbapConnection {
-    constructor(config, credential, logger = null, sessionId, options) {
-        super(config, credential, logger, sessionId, options);
-    }
-    createSessionStrategy() {
-        return new IcfSessionStrategy_js_1.IcfSessionStrategy(this.logger);
+    constructor(config, credential, transport, logger = null, sessionId) {
+        super(config, credential, transport, logger, sessionId);
     }
 }
 exports.AdtOnPremConnector = AdtOnPremConnector;

package/dist/connection/CloudHttpTransport.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ABAP Cloud over HTTP: the wire where a session is a resource with an address.
+ *
+ * Asked for at `/sap/bc/adt/core/http/sessions` with `x-sap-security-session:
+ * create` and `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on
+ * the address the server publishes in the answer. Reproduced from Eclipse ADT
+ * 3.60 and measured against a BTP trial: without that request the same
+ * connection gets `sap-usercontext` and `sap-XSRF_*` and no session for a lock
+ * to be bound to, which is how "cloud issues no SAP_SESSIONID" came to be
+ * believed.
+ *
+ * **Taking this transport is the consumer saying which system it is dialling.**
+ * Nothing here asks the server what it is. The strategy this replaces treated a
+ * 404 on the session resource as "then this must be on-prem" and quietly fell
+ * back to the platform logoff — an inference, and the only one left in this
+ * layer. A consumer that reaches an on-prem system with this transport has
+ * taken the wrong one, and finds out rather than being silently downgraded.
+ */
+import { HttpTransport } from './HttpTransport.js';
+import type { IAdtSessionContext, ICloudTransport } from './IAdtTransport.js';
+export declare class CloudHttpTransport extends HttpTransport implements ICloudTransport {
+    readonly kind = "cloud-http";
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    readonly system: "cloud";
+    /** The address this server published for our session — the only close target. */
+    private resource;
+    open(context: IAdtSessionContext): Promise<void>;
+    close(context: IAdtSessionContext): Promise<void>;
+    /**
+     * The `securitysession` link's href, by its `rel` rather than by position.
+     *
+     * The document carries three links — the session, the logoff resource and
+     * system information — and their order is not a contract.
+     */
+    private securitySessionHref;
+}
+//# sourceMappingURL=CloudHttpTransport.d.ts.map

package/dist/connection/CloudHttpTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/CloudHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAa9E,qBAAa,kBACX,SAAQ,aACR,YAAW,eAAe;IAE1B,SAAkB,IAAI,gBAAgB;IAEtC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,OAAO,CAAU;IAEnC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAuB;IAExB,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDhD,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4ChE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}

package/dist/{session/CloudSecuritySessionStrategy.js → connection/CloudHttpTransport.js}

@@ -1,102 +1,112 @@
 "use strict";
 /**
- * ABAP Cloud: a session is a resource, asked for and given back by address.
+ * ABAP Cloud over HTTP: the wire where a session is a resource with an address.
  *
- * Captured from Eclipse ADT 3.60 against a BTP trial and reproduced here with a
- * bearer token, which is what made the difference visible: **the server issues
- * `SAP_SESSIONID` to whoever asks for a session, and we never asked.** The
- * request that asks carries `x-sap-security-session: create` — `use` does not
- * do it — and `sap-adt-purpose: preflight_logon`. The response sets the cookie
- * and publishes the session's own address in a `securitysession` link, which is
- * the address a close goes to.
+ * Asked for at `/sap/bc/adt/core/http/sessions` with `x-sap-security-session:
+ * create` and `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on
+ * the address the server publishes in the answer. Reproduced from Eclipse ADT
+ * 3.60 and measured against a BTP trial: without that request the same
+ * connection gets `sap-usercontext` and `sap-XSRF_*` and no session for a lock
+ * to be bound to, which is how "cloud issues no SAP_SESSIONID" came to be
+ * believed.
  *
- * Without that request the same connection gets `sap-usercontext` and
- * `sap-XSRF_*` and nothing else, no `securitysession` link, and no session for
- * a lock to be bound to — which is how "cloud does not issue SAP_SESSIONID"
- * came to be believed.
+ * **Taking this transport is the consumer saying which system it is dialling.**
+ * Nothing here asks the server what it is. The strategy this replaces treated a
+ * 404 on the session resource as "then this must be on-prem" and quietly fell
+ * back to the platform logoff — an inference, and the only one left in this
+ * layer. A consumer that reaches an on-prem system with this transport has
+ * taken the wrong one, and finds out rather than being silently downgraded.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CloudSecuritySessionStrategy = void 0;
+exports.CloudHttpTransport = void 0;
 const cookies_js_1 = require("../utils/cookies.js");
 const timeouts_js_1 = require("../utils/timeouts.js");
-const SessionStrategy_js_1 = require("./SessionStrategy.js");
+const HttpTransport_js_1 = require("./HttpTransport.js");
 const SESSIONS_PATH = '/sap/bc/adt/core/http/sessions';
 /** The versioned media types Eclipse asks this resource for, newest first. */
 const SESSION_ACCEPT = 'application/vnd.sap.adt.core.http.session.v3+xml, ' +
     'application/vnd.sap.adt.core.http.session.v2+xml, ' +
     'application/vnd.sap.adt.core.http.session.v1+xml';
 const SECURITY_SESSION_REL = 'http://www.sap.com/adt/categories/core/http/sessions/securitysession';
-class CloudSecuritySessionStrategy extends SessionStrategy_js_1.SessionStrategy {
-    kind = 'cloud-security-session';
+class CloudHttpTransport extends HttpTransport_js_1.HttpTransport {
+    kind = 'cloud-http';
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    system = 'cloud';
     /** The address this server published for our session — the only close target. */
     resource = null;
-    async openSession(transport) {
+    async open(context) {
         try {
             // Read ONCE. The contract lets a provider answer differently each time —
             // a token provider renews behind the call — so two reads can build one
-            // request out of two different credentials, and for a token provider they
-            // also double the work.
-            const auth = await transport.authHeaders();
-            const response = await transport.send({
+            // request out of two different credentials.
+            const auth = await context.authHeaders();
+            const response = await this.send({
                 method: 'GET',
                 // The cache-buster is Eclipse's; kept because this must not be served
                 // from anything's cache — a cached session document would hand back an
                 // address that belongs to a session somebody else already ended.
-                url: `${transport.baseUrl}${SESSIONS_PATH}?_=${Date.now()}`,
+                url: `${context.baseUrl}${SESSIONS_PATH}?_=${Date.now()}`,
                 // Bounded: connect() waits for this one.
-                timeoutMs: (0, timeouts_js_1.getTimeout)('csrf'),
-                // Its SAP_SESSIONID is the session.
-                adoptCookies: true,
+                timeout: (0, timeouts_js_1.getTimeout)('csrf'),
                 headers: {
                     ...auth,
+                    ...context.extraHeaders,
                     Accept: SESSION_ACCEPT,
-                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, transport.cookies() ?? undefined),
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, this.cookies() ?? undefined),
                     'sap-adt-purpose': 'preflight_logon',
                     'x-sap-security-session': 'create',
                 },
             });
-            // 404 is the answer "this system has no session resource", which is what
-            // on-prem says. Not an error, and not something to retry.
-            if (response.status === 404) {
-                return false;
-            }
+            // Its SAP_SESSIONID is the session, so the answer is folded in before
+            // anything is read out of it.
+            context.observe(response.headers);
+            this.ingest(response.headers);
             const resource = this.securitySessionHref(response.data);
             if (!resource) {
                 // Answered, but published no session of its own — so there is no
-                // address to give one back by, and claiming this mechanism would leave
-                // the close with nothing to send. Falls back to the platform's logoff,
-                // which needs no address.
+                // address to give one back by. Said out loud rather than worked
+                // around: the establishment that follows reports what a connection
+                // without a session means, and this is the fact it will be reporting.
                 this.logger?.debug(`Session resource answered ${response.status} but published no securitysession link`);
-                return false;
+                return;
             }
             this.resource = resource;
             this.logger?.debug(`Security session opened: ${resource}`);
-            return true;
         }
         catch (error) {
-            // Never fatal here. If no session was opened, the establishment that
-            // follows says so with the whole picture; a transport error raised from
-            // a preflight would replace that with something less useful.
+            // Not fatal here. If no session was opened, the establishment that
+            // follows says so with the whole picture; an error raised from a
+            // preflight would replace that with something less useful.
             this.logger?.debug(`Could not open a security session: ${error instanceof Error ? error.message : String(error)}`);
-            return false;
         }
     }
-    async closeSession(transport) {
+    async close(context) {
         const resource = this.resource;
-        if (!resource || !transport.cookies()) {
+        this.resource = null;
+        // Read SYNCHRONOUSLY, before the first await. A close is dispatched
+        // without being awaited, so the teardown's `forgetSession()` runs while
+        // this is suspended — and a goodbye assembled afterwards would carry no
+        // cookie, which is the one thing that proves the session is ours to end.
+        const cookies = this.cookies();
+        const csrf = this.csrfToken();
+        // Snapshotted for the same reason: the DELETE must reach the server holding
+        // this session, not whichever one the wire is pinned to when it goes out.
+        const affinity = this.affinityHeaders();
+        if (!resource || !cookies) {
             // No address to send it to, or no cookie to prove the session is ours —
-            // holding the cookie is the whole permission.
+            // holding the cookie is the whole permission to end one.
             return;
         }
-        const csrf = transport.csrfToken();
         try {
-            const auth = await transport.authHeaders();
-            await transport.send({
+            const auth = await context.authHeaders();
+            await this.sendDetached({
                 method: 'DELETE',
-                url: new URL(resource, transport.baseUrl).toString(),
+                url: new URL(resource, context.baseUrl).toString(),
                 headers: {
+                    ...affinity,
                     ...auth,
-                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, transport.cookies() ?? undefined),
+                    ...context.extraHeaders,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, cookies),
                     'x-sap-security-session': 'use',
                     // A state change, so the server wants the token. Without one the
                     // request is refused with 403 — which is still just a message the
@@ -132,4 +142,4 @@ class CloudSecuritySessionStrategy extends SessionStrategy_js_1.SessionStrategy
         return undefined;
     }
 }
-exports.CloudSecuritySessionStrategy = CloudSecuritySessionStrategy;
+exports.CloudHttpTransport = CloudHttpTransport;

package/dist/connection/CredentialAbapConnection.d.ts

@@ -13,16 +13,17 @@
  * chose the subclass, and is never worked out here.
  */
 import type { AgentOptions } from 'node:https';
-import type { IAbapRequestOptions, IAdtResponse } from '@mcp-abap-adt/interfaces';
-import type { IAuthProvider } from '../auth/IAuthProvider.js';
+import type { IAuthProvider } from '@mcp-abap-adt/interfaces';
 import type { SapConfig } from '../config/sapConfig.js';
 import type { ILogger } from '../logger.js';
 import { AbstractAbapConnection } from './AbstractAbapConnection.js';
-export declare abstract class CredentialAbapConnection extends AbstractAbapConnection {
-    protected readonly credential: IAuthProvider;
-    constructor(config: SapConfig, credential: IAuthProvider, logger?: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
+import { type IAdtTransport } from './IAdtTransport.js';
+export declare abstract class CredentialAbapConnection<TCredential extends IAuthProvider = IAuthProvider> extends AbstractAbapConnection {
+    /** Public because the type is the point: a caller can reach what it gave. */
+    readonly credential: TCredential;
+    constructor(config: SapConfig, 
+    /** Public because the type is the point: a caller can reach what it gave. */
+    credential: TCredential, transport: IAdtTransport, logger?: ILogger | null, sessionId?: string);
     /**
      * Whatever the credential needs before the first request goes out.
      *
@@ -32,8 +33,6 @@ export declare abstract class CredentialAbapConnection extends AbstractAbapConne
      * evaluated — outside every catch, with no request sent.
      */
     /** The header last put on the wire, so a change can be seen. */
-    private lastAuthorization;
-    private credentialRenewal?;
     protected prepareCredential(): Promise<void>;
     /**
      * Nothing here: the header is asked for asynchronously in `getAuthHeaders()`,
@@ -51,38 +50,6 @@ export declare abstract class CredentialAbapConnection extends AbstractAbapConne
      */
     getAuthHeaders(): Promise<Record<string, string>>;
     protected getHttpsAgentOptions(): AgentOptions;
-    /**
-     * One retry, and only when the credential actually changed.
-     *
-     * A provider renews on its own — `BaseTokenProvider` checks expiry and
-     * refreshes before answering — so a 401 has two very different causes, and
-     * asking again tells them apart. A different answer means the token was
-     * stale: the ABAP session built on the old one is dead, so it is rebuilt and
-     * the request goes once more. The same answer means the server refused these
-     * credentials, and repeating them would only ask a second time.
-     *
-     * This is why no renewal strategy is injected. The provider owns "get me a
-     * valid credential"; what is left is "the credential changed, so the session
-     * is gone", which belongs to whoever owns the session and cannot be done from
-     * outside it.
-     */
-    makeAdtRequest<T = any, D = any>(options: IAbapRequestOptions): Promise<IAdtResponse<T, D>>;
-    /**
-     * Ask the provider again; if it answers differently, rebuild the session.
-     *
-     * Single-flight, because concurrent operations meet the same 401 at the same
-     * moment and the session must be rebuilt once, not once per request in
-     * flight. Everyone joins the first one and gets its verdict.
-     */
-    private rebuiltAfterCredentialChange;
-    /**
-     * The establishing call, shared because it always was.
-     *
-     * Failure is a warning rather than a throw, as it has been: the first request
-     * retries it, and a system that answers the discovery call badly may still
-     * answer everything else. What decides whether the connection is usable is
-     * the session check that follows, not this.
-     */
     protected establishSession(): Promise<void>;
 }
 //# sourceMappingURL=CredentialAbapConnection.d.ts.map

package/dist/connection/CredentialAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CredentialAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CredentialAbapConnection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AASrE,8BAAsB,wBAAyB,SAAQ,sBAAsB;IAGzE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa;gBAD5C,MAAM,EAAE,SAAS,EACE,UAAU,EAAE,aAAa,EAC5C,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAKzC;;;;;;;OAOG;IACH,gEAAgE;IAChE,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,iBAAiB,CAAC,CAAmB;cAEpB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAI5C;;;;;;OAMG;IACY,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;cAkB7C,oBAAoB,IAAI,YAAY;IAMvD;;;;;;;;;;;;;;OAcG;IAEY,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EAC5C,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAwB9B;;;;;;OAMG;IACH,OAAO,CAAC,4BAA4B;IAqCpC;;;;;;;OAOG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;CA4BlD"}
+{"version":3,"file":"CredentialAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CredentialAbapConnection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,KAAK,aAAa,EAAa,MAAM,oBAAoB,CAAC;AASnE,8BAAsB,wBAAwB,CAC5C,WAAW,SAAS,aAAa,GAAG,aAAa,CACjD,SAAQ,sBAAsB;IAG5B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,WAAW;gBAFhC,MAAM,EAAE,SAAS;IACjB,6EAA6E;IACpE,UAAU,EAAE,WAAW,EAChC,SAAS,EAAE,aAAa,EACxB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM;IAKpB;;;;;;;OAOG;IACH,gEAAgE;cAEvC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAI5C;;;;;;OAMG;IACY,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;cAiB7C,oBAAoB,IAAI,YAAY;cAIvC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;CAoDlD"}

package/dist/connection/CredentialAbapConnection.js

@@ -15,8 +15,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CredentialAbapConnection = void 0;
-const axios_1 = require("axios");
 const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
+const IAdtTransport_js_1 = require("./IAdtTransport.js");
 /** A 401 from the server, whatever transport shape it arrives in. */
 function isUnauthorized(error) {
     const status = error?.response
@@ -25,8 +25,10 @@ function isUnauthorized(error) {
 }
 class CredentialAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
     credential;
-    constructor(config, credential, logger = null, sessionId, options) {
-        super(config, logger, sessionId, options);
+    constructor(config, 
+    /** Public because the type is the point: a caller can reach what it gave. */
+    credential, transport, logger = null, sessionId) {
+        super(config, transport, logger, sessionId);
         this.credential = credential;
     }
     /**
@@ -38,10 +40,8 @@ class CredentialAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapC
      * evaluated — outside every catch, with no request sent.
      */
     /** The header last put on the wire, so a change can be seen. */
-    lastAuthorization = '';
-    credentialRenewal;
     async prepareCredential() {
-        await this.credential.prepare?.();
+        await this.credential.prepare();
     }
     /**
      * Nothing here: the header is asked for asynchronously in `getAuthHeaders()`,
@@ -61,120 +61,42 @@ class CredentialAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapC
      */
     async getAuthHeaders() {
         const headers = await super.getAuthHeaders();
-        // Asked now, not kept: a token provider renews behind this call, and a
-        // value held from establishment would be the stale one.
+        // Asked per request, never held: a provider renews behind this call, and a
+        // value kept here would be the stale one.
         const authorization = await this.credential.authorizationHeader();
         if (authorization) {
             headers.Authorization = authorization;
-            this.lastAuthorization = authorization;
         }
-        const cookies = this.credential.cookies?.();
+        const cookies = this.credential.cookies();
         if (cookies) {
             headers.Cookie = cookies;
         }
         return headers;
     }
     getHttpsAgentOptions() {
-        return (this.credential.httpsAgentOptions?.() ?? super.getHttpsAgentOptions());
+        return this.credential.transportMaterial();
     }
-    /**
-     * One retry, and only when the credential actually changed.
-     *
-     * A provider renews on its own — `BaseTokenProvider` checks expiry and
-     * refreshes before answering — so a 401 has two very different causes, and
-     * asking again tells them apart. A different answer means the token was
-     * stale: the ABAP session built on the old one is dead, so it is rebuilt and
-     * the request goes once more. The same answer means the server refused these
-     * credentials, and repeating them would only ask a second time.
-     *
-     * This is why no renewal strategy is injected. The provider owns "get me a
-     * valid credential"; what is left is "the credential changed, so the session
-     * is gone", which belongs to whoever owns the session and cannot be done from
-     * outside it.
-     */
-    // biome-ignore lint/suspicious/noExplicitAny: matches the base signature exactly
-    async makeAdtRequest(options) {
-        // Which session this request is going out on. A 401 that comes back after
-        // the session has already been replaced says nothing about the credential:
-        // it was answered by a server we are no longer talking to.
-        const sentOn = this.sessionGeneration;
-        try {
-            return await super.makeAdtRequest(options);
-        }
-        catch (error) {
-            if (!isUnauthorized(error))
-                throw error;
-            if (!(await this.rebuiltAfterCredentialChange(sentOn)))
-                throw error;
-            // Exactly once, and to `super` deliberately: reaching for `this` would
-            // re-enter this method, and a provider that answers differently every
-            // time — a broken refresher, or a server refusing whatever it is given —
-            // would look like "the credential changed" forever.
-            //
-            // A test pins the request count at two, but it does NOT distinguish the
-            // two forms: swapping `super` for `this` leaves the suite green, and why
-            // it does not then recurse is unexplained. Treat this line as guarded by
-            // review, not by the suite.
-            return await super.makeAdtRequest(options);
-        }
-    }
-    /**
-     * Ask the provider again; if it answers differently, rebuild the session.
-     *
-     * Single-flight, because concurrent operations meet the same 401 at the same
-     * moment and the session must be rebuilt once, not once per request in
-     * flight. Everyone joins the first one and gets its verdict.
-     */
-    rebuiltAfterCredentialChange(sentOn) {
-        if (this.credentialRenewal)
-            return this.credentialRenewal;
-        const inFlight = (async () => {
-            // Somebody else already rebuilt while this request was in flight, so this
-            // refusal was answered by a session that no longer exists and says
-            // nothing about the credential in use now. Retry on the new one; renewing
-            // again would force a second refresh and tear down a healthy session —
-            // which is what comparing against a connection-wide "last header" did,
-            // since by then that header was the NEW one.
-            if (this.sessionGeneration !== sentOn)
-                return true;
-            const before = this.lastAuthorization;
-            // Tell the credential its last answer was refused BEFORE asking again.
-            // Asking alone is not enough: a token provider returns the cached token
-            // while it believes it is valid, which after a 401 is precisely what it
-            // wrongly believes.
-            await this.credential.renew?.();
-            const now = await this.credential.authorizationHeader();
-            if (!now || now === before)
-                return false;
-            this.logger?.debug('The credential changed after a 401; the session built on the old one is gone. Rebuilding.');
-            const baseline = this.teardownEpoch;
-            this.discardSession();
-            await this.recoverSession(baseline);
-            return true;
-        })().finally(() => {
-            if (this.credentialRenewal === inFlight) {
-                this.credentialRenewal = undefined;
-            }
-        });
-        this.credentialRenewal = inFlight;
-        return inFlight;
-    }
-    /**
-     * The establishing call, shared because it always was.
-     *
-     * Failure is a warning rather than a throw, as it has been: the first request
-     * retries it, and a system that answers the discovery call badly may still
-     * answer everything else. What decides whether the connection is usable is
-     * the session check that follows, not this.
-     */
     async establishSession() {
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
         try {
-            const token = this.credential.fetchCsrfToken
-                ? await this.credential.fetchCsrfToken(discoveryUrl)
-                : await this.fetchCsrfToken(discoveryUrl);
-            this.setCsrfToken(token);
+            // The wire establishes itself, always. What that means is the wire's:
+            // HTTP earns a CSRF token and the cookies that name the session; an RFC
+            // conversation was opened before this and already IS the session, so it
+            // does nothing and holds no token. Demanding one here was what made
+            // `connect()` impossible over RFC.
+            //
+            // There is no second path. A credential that wanted to run the exchange
+            // itself would need the connection to ask which of the two does the work,
+            // and a credential whose way in IS a round trip does not need that: the
+            // wire asks `authHeaders()` PER ATTEMPT, so a one-shot token is offered
+            // on the establishing call and withheld afterwards by the credential
+            // itself, with nobody deciding anything.
+            await this.transport.establish({
+                baseUrl: await this.getBaseUrl(),
+                authHeaders: () => this.getAuthHeaders(),
+                extraHeaders: { 'sap-adt-connection-id': this.getSessionId() ?? '' },
+                observe: (headers) => this.observeResponse(headers),
+                isFatal: (error) => this.isSessionVerdict(error),
+            });
             this.logger?.debug('Connected', {
                 credential: this.credential.kind,
                 hasCsrfToken: !!this.getCsrfToken(),
@@ -182,13 +104,24 @@ class CredentialAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapC
             });
         }
         catch (error) {
-            this.logger?.warn(`Could not establish upfront (${this.credential.kind}): ${error instanceof Error ? error.message : String(error)}. The first request will retry.`);
-            // A rejecting response can still carry the cookies that matter; they are
-            // taken by fetchCsrfToken itself, so nothing is read out of the error
+            this.logger?.warn(`Could not establish (${this.credential.kind}): ${error instanceof Error ? error.message : String(error)}`);
+            // A rejecting response can still carry the cookies that matter; the wire
+            // folds them in as it establishes, so nothing is read out of the error
             // here beyond saying whether any arrived.
-            if (error instanceof axios_1.AxiosError && error.response?.headers) {
+            if ((0, IAdtTransport_js_1.refusalOf)(error)?.headers) {
                 this.logger?.debug(`Cookies after a failed establishment: ${this.getCookies() ? 'present' : 'none'}`);
             }
+            // Rethrow: a resolved connect() must mean a usable session exists.
+            //
+            // This warned and resolved, on the reasoning that "the first request will
+            // retry" — true while establishment could happen lazily, and left behind
+            // when connect() became mandatory. Swallowing now leaves a connection
+            // that reports success and holds nothing; worse, it skips the debris
+            // clearing in establishAndCommit()'s catch, so the Set-Cookie that came
+            // with the 401 survives as the session identity. A cookie is proof to
+            // every credential that auth is settled, so the NEXT connect() goes out
+            // with no credentials at all and fails for an unrelated reason.
+            throw error;
         }
     }
 }