@mcp-abap-adt/connection 5.0.0 → 6.0.0

package/dist/connection/HttpTransport.d.ts

@@ -0,0 +1,178 @@
+/**
+ * An ADT request carried over HTTP.
+ *
+ * The obvious one, and until now the one that did not exist as a thing: RFC was
+ * an object while HTTP was a branch inside `getAxiosInstance()`. An axis with a
+ * code path on one end cannot be named in a type — a default type parameter has
+ * nothing to point at — so this is what makes the two ends symmetrical.
+ *
+ * No `open()` or `close()`. A request opens its own socket and there is no
+ * conversation to establish or give back; those members exist for a transport
+ * that owns a wire, which is RFC.
+ *
+ * **Where the two axes touch.** TLS client-certificate material comes from the
+ * CREDENTIAL — a certificate authenticates through the transport rather than
+ * through a header — and configures this. It is taken as a thunk rather than a
+ * value so it is read when the client is first built, by which time the
+ * credential has been prepared and knows what it holds. Read in a constructor,
+ * it would be whatever was loaded before the connection started, which for a
+ * certificate is nothing.
+ */
+import { type AgentOptions } from 'node:https';
+import type { ILogger } from '../logger.js';
+import type { IAdtEstablishContext, IAdtSessionContext, IAdtTransport, IAdtTransportRequest, IAdtTransportResponse } from './IAdtTransport.js';
+export declare class HttpTransport implements IAdtTransport {
+    private readonly agentOptions;
+    protected readonly logger: ILogger | null;
+    /**
+     * `client` because SAP answers `sap-usercontext` with the system default
+     * rather than the client that was asked for, and later requests then route
+     * to a client the caller never named — on a read-only one, every write
+     * comes back 403.
+     */
+    private readonly options;
+    /**
+     * A real wire, usable on its own: it sends, holds a jar, and earns a CSRF
+     * token. What the two subclasses add is not the wire but the SESSION
+     * MECHANISM — the cloud resource, the platform logoff — which is a different
+     * question and the one the consumer answers by taking one of them.
+     *
+     * A bare one therefore does something well defined: it carries requests and
+     * never asks for or gives back a session. Which system a connector is for is
+     * enforced by its type parameter, not by this being unusable.
+     */
+    readonly kind: string;
+    private instance;
+    /**
+     * The wire's own state.
+     *
+     * Here rather than on the connection because it is what HTTP *is*: a cookie
+     * jar, the session those cookies address, and the application server the
+     * session lives on. A connection that held these would be holding them for
+     * every transport, including one that can never fill them.
+     */
+    private readonly jar;
+    private combined;
+    private appServer;
+    private token;
+    constructor(agentOptions?: () => AgentOptions, logger?: ILogger | null, 
+    /**
+     * `client` because SAP answers `sap-usercontext` with the system default
+     * rather than the client that was asked for, and later requests then route
+     * to a client the caller never named — on a read-only one, every write
+     * comes back 403.
+     */
+    options?: {
+        client?: string;
+        baseUrl?: string;
+    });
+    /**
+     * Fold a response into the wire state.
+     *
+     * Says nothing about what the change MEANS — whether a new session id is an
+     * establishment or a replacement is a question about the session's lifetime,
+     * which this has no way to answer and no business answering.
+     */
+    ingest(headers?: Record<string, unknown>): void;
+    /** What to put on the `Cookie` header, or nothing if the jar is empty. */
+    cookies(): string | null;
+    /**
+     * Which ABAP session this wire is on.
+     *
+     * `SAP_SESSIONID` and nothing else: `sap-usercontext` is ours and does not
+     * name a session, and a fingerprint that moved when it did would report a
+     * replacement every time the client was re-asserted.
+     */
+    sessionFingerprint(): Map<string, string>;
+    /**
+     * A session exists when the server named one.
+     *
+     * `SAP_SESSIONID` is what a lock is bound to, so its absence means there is
+     * nothing to hold one — the connection can read and can keep nothing.
+     */
+    sessionEstablished(): boolean;
+    /**
+     * Headers that keep this connection on the server its session lives on.
+     *
+     * `sap-adt-saplb: fetch` asks the server to name itself — it answers on every
+     * request, so the binding survives a restart that moves us. `saplb` is that
+     * name sent back. `REDISPATCH_ON_SHUTDOWN` is what Eclipse asks for: if the
+     * server is going down, send us elsewhere rather than fail.
+     */
+    affinityHeaders(): Record<string, string>;
+    /**
+     * Earn a CSRF token, and with it the cookies that name the session.
+     *
+     * The token and the session are one thing on this wire: SAP binds a lock
+     * handle to the `SAP_SESSIONID` the same exchange sets, so a token kept
+     * across a new session would be presented against a session it was never
+     * issued for.
+     */
+    establish(context: IAdtEstablishContext): Promise<void>;
+    /** The token this wire earned, or nothing if it has not earned one. */
+    csrfToken(): string | null;
+    adoptCsrfToken(token: string | null): void;
+    /** Drop everything the wire was holding. The socket outlives none of it. */
+    forgetSession(): void;
+    /**
+     * Take the application server's name from a response, if it named one. Only
+     * ever from the server's own answer — never guessed.
+     */
+    private rememberAppServer;
+    /**
+     * Everything this wire adds to a request of its own accord: the cookies it
+     * holds, and the headers that keep it on the server its session lives on.
+     *
+     * Here rather than on the connection because they are HTTP's — a cookie jar
+     * and a dispatcher to stay bound to — and a connection that threaded them
+     * would be threading them for every wire, including one that has neither.
+     *
+     * MERGED with whatever the caller set: a SAML session IS the credential's
+     * cookie, and replacing it would send the request out unauthenticated while
+     * looking like it carried a session.
+     */
+    private dress;
+    /** A path becomes an address; anything already absolute is left alone. */
+    private address;
+    private client;
+    /**
+     * Nothing to ask for: an HTTP session arrives with the establishing call.
+     *
+     * Empty rather than absent. "There is no session resource here" is a fact
+     * about this wire, and a fact is stated, not left for a caller to discover by
+     * checking whether the method exists.
+     */
+    open(_context: IAdtSessionContext): Promise<void>;
+    /**
+     * Nothing to give back at this level.
+     *
+     * The two concrete wires override it — the cloud one DELETEs the session
+     * resource, the on-prem one sends the platform logoff. A bare HTTP wire has
+     * neither, and says so by doing nothing.
+     */
+    close(_context: IAdtSessionContext): Promise<void>;
+    /**
+     * Throws for a status the request does not admit — by doing nothing, because
+     * that is already what axios does, and `AxiosError` already carries
+     * `response`. The contract was written to describe this behaviour rather than
+     * to add it.
+     */
+    send(request: IAdtTransportRequest): Promise<IAdtTransportResponse>;
+    /**
+     * Send EXACTLY these headers, with nothing of the wire's live state mixed in.
+     *
+     * For a goodbye, and only for a goodbye. `disconnect()` dispatches the logoff
+     * without awaiting it, so the request is still being assembled while the
+     * connection is already free to `connect()` again — and by the time it goes
+     * out, the jar can hold a different session. Dressing it then merges the LIVE
+     * `SAP_SESSIONID` over the snapshot, and `mergeCookieHeaders` lets the later
+     * value win on a repeated name, so the goodbye for the old session arrives
+     * addressed to the new one and closes it.
+     *
+     * Reading the cookies synchronously is necessary and was not sufficient: the
+     * snapshot survived only until the send path put the jar back on top of it.
+     */
+    protected sendDetached(request: IAdtTransportRequest): Promise<IAdtTransportResponse>;
+    private dispatch;
+}
+//# sourceMappingURL=HttpTransport.d.ts.map

package/dist/connection/HttpTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"HttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/HttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAS5B,qBAAa,aAAc,YAAW,aAAa;IA6B/C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IACzC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IApC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAU;IAE/B,OAAO,CAAC,QAAQ,CAA8B;IAE9C;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;IACjD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,KAAK,CAAuB;gBAGjB,YAAY,GAAE,MAAM,YAAyB,EAC3C,MAAM,GAAE,OAAO,GAAG,IAAW;IAChD;;;;;OAKG;IACc,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO;IAGtE;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAgC/C,0EAA0E;IAC1E,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB;;;;;;OAMG;IACH,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC;;;;;OAKG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;;;OAOG;IACH,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IASzC;;;;;;;OAOG;IACG,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmG7D,uEAAuE;IACvE,SAAS,IAAI,MAAM,GAAG,IAAI;IAI1B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1C,4EAA4E;IAC5E,aAAa,IAAI,IAAI;IASrB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK;IAab,0EAA0E;IAC1E,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;IAuBd;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAEvD;;;;;;OAMG;IACG,KAAK,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD;;;;;OAKG;IACG,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIzE;;;;;;;;;;;;;OAaG;cACa,YAAY,CAC1B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAInB,QAAQ;CA4BvB"}

package/dist/connection/HttpTransport.js

@@ -0,0 +1,402 @@
+"use strict";
+/**
+ * An ADT request carried over HTTP.
+ *
+ * The obvious one, and until now the one that did not exist as a thing: RFC was
+ * an object while HTTP was a branch inside `getAxiosInstance()`. An axis with a
+ * code path on one end cannot be named in a type — a default type parameter has
+ * nothing to point at — so this is what makes the two ends symmetrical.
+ *
+ * No `open()` or `close()`. A request opens its own socket and there is no
+ * conversation to establish or give back; those members exist for a transport
+ * that owns a wire, which is RFC.
+ *
+ * **Where the two axes touch.** TLS client-certificate material comes from the
+ * CREDENTIAL — a certificate authenticates through the transport rather than
+ * through a header — and configures this. It is taken as a thunk rather than a
+ * value so it is read when the client is first built, by which time the
+ * credential has been prepared and knows what it holds. Read in a constructor,
+ * it would be whatever was loaded before the connection started, which for a
+ * certificate is nothing.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpTransport = void 0;
+const node_https_1 = require("node:https");
+const axios_1 = __importDefault(require("axios"));
+const cookies_js_1 = require("../utils/cookies.js");
+const csrfConfig_js_1 = require("./csrfConfig.js");
+/** A 404 there means the system has no such endpoint, not that it is unwell. */
+function absentEndpoint(error) {
+    const status = error
+        ?.response?.status;
+    return status === 404 || status === 501;
+}
+class HttpTransport {
+    agentOptions;
+    logger;
+    options;
+    /**
+     * A real wire, usable on its own: it sends, holds a jar, and earns a CSRF
+     * token. What the two subclasses add is not the wire but the SESSION
+     * MECHANISM — the cloud resource, the platform logoff — which is a different
+     * question and the one the consumer answers by taking one of them.
+     *
+     * A bare one therefore does something well defined: it carries requests and
+     * never asks for or gives back a session. Which system a connector is for is
+     * enforced by its type parameter, not by this being unusable.
+     */
+    kind = 'http';
+    instance = null;
+    /**
+     * The wire's own state.
+     *
+     * Here rather than on the connection because it is what HTTP *is*: a cookie
+     * jar, the session those cookies address, and the application server the
+     * session lives on. A connection that held these would be holding them for
+     * every transport, including one that can never fill them.
+     */
+    jar = new Map();
+    combined = null;
+    appServer = null;
+    token = null;
+    constructor(agentOptions = () => ({}), logger = null, 
+    /**
+     * `client` because SAP answers `sap-usercontext` with the system default
+     * rather than the client that was asked for, and later requests then route
+     * to a client the caller never named — on a read-only one, every write
+     * comes back 403.
+     */
+    options = {}) {
+        this.agentOptions = agentOptions;
+        this.logger = logger;
+        this.options = options;
+    }
+    /**
+     * Fold a response into the wire state.
+     *
+     * Says nothing about what the change MEANS — whether a new session id is an
+     * establishment or a replacement is a question about the session's lifetime,
+     * which this has no way to answer and no business answering.
+     */
+    ingest(headers) {
+        if (!headers)
+            return;
+        this.rememberAppServer(headers);
+        const setCookie = headers['set-cookie'];
+        // Nothing was set, so nothing is folded in — not even the client, which is
+        // an assertion ON the cookies a response brought rather than a cookie of
+        // its own. Asserting it here would give a wire that has never been issued
+        // anything a `Cookie` header to send, and the code above reads a non-empty
+        // jar as "this connection holds something".
+        if (!setCookie)
+            return;
+        for (const entry of Array.isArray(setCookie) ? setCookie : [setCookie]) {
+            if (typeof entry !== 'string')
+                continue;
+            const [nameValue] = entry.split(';');
+            if (!nameValue)
+                continue;
+            const [name, ...rest] = nameValue.split('=');
+            const trimmed = name?.trim();
+            if (!trimmed)
+                continue;
+            this.jar.set(trimmed, rest.join('=').trim());
+        }
+        if (this.options.client) {
+            this.jar.set('sap-usercontext', `sap-client=${this.options.client}`);
+        }
+        if (this.jar.size === 0)
+            return;
+        const combined = Array.from(this.jar.entries())
+            .map(([name, value]) => (value ? `${name}=${value}` : name))
+            .join('; ');
+        if (combined)
+            this.combined = combined;
+    }
+    /** What to put on the `Cookie` header, or nothing if the jar is empty. */
+    cookies() {
+        return this.combined;
+    }
+    /**
+     * Which ABAP session this wire is on.
+     *
+     * `SAP_SESSIONID` and nothing else: `sap-usercontext` is ours and does not
+     * name a session, and a fingerprint that moved when it did would report a
+     * replacement every time the client was re-asserted.
+     */
+    sessionFingerprint() {
+        const fingerprint = new Map();
+        for (const [name, value] of this.jar) {
+            if (name.startsWith('SAP_SESSIONID'))
+                fingerprint.set(name, value);
+        }
+        return fingerprint;
+    }
+    /**
+     * A session exists when the server named one.
+     *
+     * `SAP_SESSIONID` is what a lock is bound to, so its absence means there is
+     * nothing to hold one — the connection can read and can keep nothing.
+     */
+    sessionEstablished() {
+        return this.sessionFingerprint().size > 0;
+    }
+    /**
+     * Headers that keep this connection on the server its session lives on.
+     *
+     * `sap-adt-saplb: fetch` asks the server to name itself — it answers on every
+     * request, so the binding survives a restart that moves us. `saplb` is that
+     * name sent back. `REDISPATCH_ON_SHUTDOWN` is what Eclipse asks for: if the
+     * server is going down, send us elsewhere rather than fail.
+     */
+    affinityHeaders() {
+        return {
+            'sap-adt-saplb': 'fetch',
+            ...(this.appServer
+                ? { saplb: this.appServer, 'saplb-options': 'REDISPATCH_ON_SHUTDOWN' }
+                : {}),
+        };
+    }
+    /**
+     * Earn a CSRF token, and with it the cookies that name the session.
+     *
+     * The token and the session are one thing on this wire: SAP binds a lock
+     * handle to the `SAP_SESSIONID` the same exchange sets, so a token kept
+     * across a new session would be presented against a session it was never
+     * issued for.
+     */
+    async establish(context) {
+        // Idempotent. Asked again before a mutation, a wire that already holds a
+        // token must not spend a round trip earning another — SAP binds the lock
+        // handle to the session the token came with, so a second exchange would
+        // move the session out from under a lock taken against the first.
+        if (this.token)
+            return;
+        const base = context.baseUrl.endsWith('/')
+            ? context.baseUrl.slice(0, -1)
+            : context.baseUrl;
+        const endpoints = [
+            `${base}${csrfConfig_js_1.CSRF_CONFIG.ENDPOINT}`,
+            // BASIS < 7.52 has no /sap/bc/adt/core/discovery.
+            `${base}${csrfConfig_js_1.CSRF_CONFIG.FALLBACK_ENDPOINT}`,
+        ];
+        const retries = context.retries ?? csrfConfig_js_1.CSRF_CONFIG.RETRY_COUNT;
+        const delay = context.retryDelayMs ?? csrfConfig_js_1.CSRF_CONFIG.RETRY_DELAY;
+        let last;
+        for (const [index, url] of endpoints.entries()) {
+            // The fallback exists for a system that HAS no
+            // `/sap/bc/adt/core/discovery` — BASIS < 7.52 — which the server says by
+            // answering 404 there. Trying it after a refused connection or a timeout
+            // asks a host that is not answering to answer a different path, which
+            // doubles the wait before the caller is told what is actually wrong.
+            if (index > 0 && !absentEndpoint(last))
+                break;
+            for (let attempt = 0; attempt <= retries; attempt++) {
+                try {
+                    // Read per attempt: a provider may renew behind the call.
+                    const auth = await context.authHeaders();
+                    const response = await this.send({
+                        method: 'GET',
+                        url,
+                        headers: {
+                            ...auth,
+                            ...context.extraHeaders,
+                            ...csrfConfig_js_1.CSRF_CONFIG.REQUIRED_HEADERS,
+                        },
+                        ...(context.timeoutMs !== undefined
+                            ? { timeout: context.timeoutMs }
+                            : {}),
+                    });
+                    // Handed up BEFORE the token is read: the cookies are the session,
+                    // and a fold that only happened on success would lose the session a
+                    // tokenless answer still opened.
+                    context.observe(response.headers);
+                    this.ingest(response.headers);
+                    const token = response.headers['x-csrf-token'];
+                    if (token) {
+                        this.token = token;
+                        this.logger?.debug('CSRF token obtained');
+                        return;
+                    }
+                    last = new Error(csrfConfig_js_1.CSRF_ERROR_MESSAGES.NOT_IN_HEADERS);
+                }
+                catch (error) {
+                    // Not a failed exchange: see `isFatal`. Leaves immediately, past the
+                    // retries and past the fallback endpoint.
+                    if (context.isFatal?.(error))
+                        throw error;
+                    last = error instanceof Error ? error : new Error(String(error));
+                    const response = error.response;
+                    if (response?.headers) {
+                        // A refusal can still carry the cookies that matter.
+                        context.observe(response.headers);
+                        this.ingest(response.headers);
+                        // …and the token itself. SAP answers 405 to a GET on some
+                        // endpoints and puts the token in the header anyway, and other
+                        // refusals carry one too. A retry would throw away a token the
+                        // server already handed over.
+                        const onError = response.headers['x-csrf-token'];
+                        if (onError) {
+                            this.token = onError;
+                            this.logger?.debug('CSRF token arrived on a refusal, and is kept');
+                            return;
+                        }
+                    }
+                }
+                if (attempt < retries) {
+                    await new Promise((resolve) => setTimeout(resolve, delay));
+                }
+            }
+        }
+        // The original error, with its `response`, when there was one: the
+        // classification above this reads `error.response.status`, and a generic
+        // replacement would tell it nothing.
+        throw last ?? new Error(csrfConfig_js_1.CSRF_ERROR_MESSAGES.NOT_IN_HEADERS);
+    }
+    /** The token this wire earned, or nothing if it has not earned one. */
+    csrfToken() {
+        return this.token;
+    }
+    adoptCsrfToken(token) {
+        this.token = token;
+    }
+    /** Drop everything the wire was holding. The socket outlives none of it. */
+    forgetSession() {
+        this.jar.clear();
+        this.combined = null;
+        this.appServer = null;
+        // The token was issued INTO the session being dropped. Kept, it would be
+        // presented against a session it was never bound to.
+        this.token = null;
+    }
+    /**
+     * Take the application server's name from a response, if it named one. Only
+     * ever from the server's own answer — never guessed.
+     */
+    rememberAppServer(headers) {
+        const key = Object.keys(headers).find((k) => k.toLowerCase() === 'sap-adt-saplb');
+        const value = key ? headers[key] : undefined;
+        if (typeof value === 'string' && value && value !== this.appServer) {
+            this.appServer = value;
+            this.logger?.debug(`Session is on application server ${value}`);
+        }
+    }
+    /**
+     * Everything this wire adds to a request of its own accord: the cookies it
+     * holds, and the headers that keep it on the server its session lives on.
+     *
+     * Here rather than on the connection because they are HTTP's — a cookie jar
+     * and a dispatcher to stay bound to — and a connection that threaded them
+     * would be threading them for every wire, including one that has neither.
+     *
+     * MERGED with whatever the caller set: a SAML session IS the credential's
+     * cookie, and replacing it would send the request out unauthenticated while
+     * looking like it carried a session.
+     */
+    dress(headers) {
+        const dressed = {
+            ...this.affinityHeaders(),
+            ...headers,
+        };
+        const merged = (0, cookies_js_1.mergeCookieHeaders)(headers?.Cookie, this.combined ?? undefined);
+        if (merged)
+            dressed.Cookie = merged;
+        return dressed;
+    }
+    /** A path becomes an address; anything already absolute is left alone. */
+    address(url) {
+        if (!url.startsWith('/') || !this.options.baseUrl)
+            return url;
+        const base = this.options.baseUrl.endsWith('/')
+            ? this.options.baseUrl.slice(0, -1)
+            : this.options.baseUrl;
+        return `${base}${url}`;
+    }
+    client() {
+        if (!this.instance) {
+            // Kept as it was: an explicit opt-IN, so a misread env var cannot quietly
+            // turn verification off.
+            const rejectUnauthorized = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '1' ||
+                (process.env.TLS_REJECT_UNAUTHORIZED === '1' &&
+                    process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0');
+            this.logger?.debug(`TLS configuration: rejectUnauthorized=${rejectUnauthorized}`);
+            this.instance = axios_1.default.create({
+                httpsAgent: new node_https_1.Agent({
+                    rejectUnauthorized,
+                    ...this.agentOptions(),
+                }),
+            });
+        }
+        return this.instance;
+    }
+    /**
+     * Nothing to ask for: an HTTP session arrives with the establishing call.
+     *
+     * Empty rather than absent. "There is no session resource here" is a fact
+     * about this wire, and a fact is stated, not left for a caller to discover by
+     * checking whether the method exists.
+     */
+    async open(_context) { }
+    /**
+     * Nothing to give back at this level.
+     *
+     * The two concrete wires override it — the cloud one DELETEs the session
+     * resource, the on-prem one sends the platform logoff. A bare HTTP wire has
+     * neither, and says so by doing nothing.
+     */
+    async close(_context) { }
+    /**
+     * Throws for a status the request does not admit — by doing nothing, because
+     * that is already what axios does, and `AxiosError` already carries
+     * `response`. The contract was written to describe this behaviour rather than
+     * to add it.
+     */
+    async send(request) {
+        return this.dispatch(request, this.dress(request.headers));
+    }
+    /**
+     * Send EXACTLY these headers, with nothing of the wire's live state mixed in.
+     *
+     * For a goodbye, and only for a goodbye. `disconnect()` dispatches the logoff
+     * without awaiting it, so the request is still being assembled while the
+     * connection is already free to `connect()` again — and by the time it goes
+     * out, the jar can hold a different session. Dressing it then merges the LIVE
+     * `SAP_SESSIONID` over the snapshot, and `mergeCookieHeaders` lets the later
+     * value win on a repeated name, so the goodbye for the old session arrives
+     * addressed to the new one and closes it.
+     *
+     * Reading the cookies synchronously is necessary and was not sufficient: the
+     * snapshot survived only until the send path put the jar back on top of it.
+     */
+    async sendDetached(request) {
+        return this.dispatch(request, { ...request.headers });
+    }
+    async dispatch(request, headers) {
+        const response = await this.client()({
+            method: request.method,
+            // The connection hands over a PATH; putting a server in front of it is
+            // this wire's job. RFC's is to write the same path into the request line
+            // as it stands — handed an absolute URL there, SADT_REST_RFC_ENDPOINT
+            // dumps with STRING_OFFSET_TOO_LARGE. Neither can be done for both from
+            // above, which is why addressing sits here.
+            url: this.address(request.url),
+            headers,
+            ...(request.data !== undefined ? { data: request.data } : {}),
+            ...(request.params !== undefined ? { params: request.params } : {}),
+            ...(request.timeout !== undefined ? { timeout: request.timeout } : {}),
+            ...(request.validateStatus !== undefined
+                ? { validateStatus: request.validateStatus }
+                : {}),
+        });
+        return {
+            status: response.status,
+            statusText: response.statusText,
+            headers: response.headers,
+            data: response.data,
+        };
+    }
+}
+exports.HttpTransport = HttpTransport;