@mcp-abap-adt/connection 5.0.0 → 6.0.0

package/dist/connection/IAdtTransport.d.ts

@@ -0,0 +1,232 @@
+/**
+ * What carries an ADT request to the server.
+ *
+ * The credential says how a request proves who it is; this says what the
+ * request travels over. They are independent axes, and on-prem is where both
+ * are real choices: the same ADT REST call goes over HTTP, or over RFC to
+ * `SADT_REST_RFC_ENDPOINT` — the FM Eclipse ADT itself uses through JCo — on a
+ * system where stateful HTTP sessions are not usable. ABAP Cloud has one
+ * transport, so its connector takes no such parameter.
+ *
+ * **Said by the caller, never sniffed.** Which transport is in use is a fact
+ * about the deployment, not something to be discovered by trying one and
+ * watching it fail — the same rule `SessionStrategy` states for session
+ * mechanics.
+ */
+/** One request, in the terms every transport can honour. */
+export interface IAdtTransportRequest {
+    method: string;
+    url: string;
+    headers?: Record<string, string>;
+    data?: unknown;
+    /**
+     * Query parameters, unserialised.
+     *
+     * Part of the request rather than folded into `url` by the caller, because
+     * the two transports carry them differently: HTTP hands them to a client
+     * that serialises them, RFC has no such step and must write them into the
+     * URI itself. A transport that ignored them would send the request without
+     * its query — silently, and only on one of the two wires.
+     */
+    params?: Record<string, unknown>;
+    /** Milliseconds; absent means the transport's own default. */
+    timeout?: number;
+    /**
+     * Which statuses resolve rather than throw. Absent means the default: 2xx
+     * resolves, everything else throws — which the retry and 401 handling above
+     * this seam is written against.
+     */
+    validateStatus?: (status: number) => boolean;
+}
+/** What came back, in the terms every transport can produce. */
+export interface IAdtTransportResponse {
+    status: number;
+    statusText?: string;
+    /**
+     * Deliberately `unknown`: a transport names its own header container, and a
+     * caller narrows what it needs. HTTP has axios's, RFC builds one out of
+     * `HEADER_FIELDS`.
+     */
+    headers: unknown;
+    data: unknown;
+}
+/** What a transport needs from above to establish itself. */
+/**
+ * What a wire needs from the connection to ask for a session, or give one back.
+ *
+ * The same shape the establishing call takes, minus the retry knobs: opening a
+ * session is one request, and one that is retried is one the caller cannot
+ * reason about — a second session may already be open by the time the first
+ * answer arrives.
+ */
+export interface IAdtSessionContext {
+    /** The server, for a wire that addresses one. */
+    baseUrl: string;
+    /** Read once per request: a provider may renew behind the call. */
+    authHeaders: () => Promise<Record<string, string>>;
+    /** Anything the conversation carries — the ADT connection id, today. */
+    extraHeaders?: Record<string, string>;
+    /** Where to hand each answer, so the connection sees what the wire saw. */
+    observe: (headers: unknown) => void;
+}
+export interface IAdtEstablishContext extends IAdtSessionContext {
+    /**
+     * Where to hand each answer. The wire folds a response into its own state;
+     * whether a new session id is an establishment or a replacement is a question
+     * about the session's lifetime, which is decided above.
+     */
+    observe: (headers: unknown) => void;
+    /** How many times to ask again. Absent means the transport's own default. */
+    retries?: number;
+    /** Milliseconds between attempts. Absent means the transport's own default. */
+    retryDelayMs?: number;
+    /** Milliseconds per attempt. Absent means the transport's own default. */
+    timeoutMs?: number;
+    /**
+     * Which failures must not be retried.
+     *
+     * A verdict about the session — "the one we were on is gone" — is not a
+     * failed exchange: retrying would observe the SAME new session, read it as
+     * unchanged, and lose the replacement for good. The wire cannot tell those
+     * apart, so it asks.
+     */
+    isFatal?: (error: unknown) => boolean;
+}
+export interface IAdtTransport {
+    /** For logs, so which transport ran is never inferred from behaviour. */
+    readonly kind: string;
+    /**
+     * Get a session, in whatever way this wire has one.
+     *
+     * An RFC conversation is opened, and IS the session. ABAP Cloud publishes a
+     * session as a resource and this asks for one. On-prem HTTP has neither — its
+     * session arrives as a cookie on the establishing call — so its
+     * implementation is empty.
+     *
+     * **Required, not optional.** A wire with nothing to open writes an empty
+     * method, which is true of it; the alternative was the connection asking
+     * `open?.()` at every teardown — a runtime question about a collaborator it
+     * was handed, which is the thing a contract exists to answer instead.
+     *
+     * This used to be a `SessionStrategy` the connection selected and drove: a
+     * second wire abstraction beside this one, in the class every wire shares,
+     * describing a mechanism only some of them have.
+     */
+    open(context: IAdtSessionContext): Promise<void>;
+    /**
+     * Give the session back.
+     *
+     * Never throws, and a repeat call finds nothing owed — this is reached from
+     * `disconnect()`, which promises to settle. What it does is the wire's: a
+     * DELETE on the address the server published, the platform's logoff, or
+     * closing the conversation.
+     */
+    close(context: IAdtSessionContext): Promise<void>;
+    /**
+     * Issue one request.
+     *
+     * Throws for a status `validateStatus` does not admit, carrying `response`
+     * on the error — that is the shape the request path classifies against, and
+     * a transport that resolved instead would turn a 401 into a success with a
+     * logon page in the body.
+     */
+    send(request: IAdtTransportRequest): Promise<IAdtTransportResponse>;
+    /**
+     * Fold a response into whatever state this wire keeps.
+     *
+     * Every transport answers, because every transport has an answer — HTTP
+     * keeps a cookie jar and the application server it was told about, RFC keeps
+     * nothing because its conversation carries the session itself. What the
+     * change MEANS is not asked here: whether a new session id is an
+     * establishment or a replacement is a question about the session's lifetime,
+     * and it is answered above.
+     */
+    ingest(headers?: Record<string, unknown>): void;
+    /** What to put on the `Cookie` header, or `null` for a wire that has none. */
+    cookies(): string | null;
+    /**
+     * Which session this wire is on, as something comparable.
+     *
+     * Empty means "this wire is on no session" — which for HTTP is a system that
+     * issued no `SAP_SESSIONID`, and for RFC never happens while the
+     * conversation is open, because the conversation IS the session.
+     */
+    sessionFingerprint(): Map<string, string>;
+    /**
+     * Does this wire hold a session it can work over?
+     *
+     * A verdict, not a fact for somebody else to interpret. The connection used
+     * to read a fingerprint and a `skipSessionType` flag and decide for every
+     * wire at once — which meant carrying, in the class they all share, a
+     * property of one deployment: BASIS 7.40, where the stateful header makes the
+     * server store locks in session memory instead of the enqueue table.
+     *
+     * Each wire answers for itself. HTTP has a session when the server named one.
+     * An RFC conversation IS the session. A wire whose system names no session is
+     * not a broken HTTP one — it is answering truthfully about itself.
+     */
+    sessionEstablished(): boolean;
+    /** Headers that keep this connection on the server its session lives on. */
+    affinityHeaders(): Record<string, string>;
+    /**
+     * Get this wire ready to carry a mutation.
+     *
+     * HTTP earns a CSRF token, and the cookies that name the session arrive with
+     * it. RFC has nothing to earn: the conversation was opened before this and IS
+     * the session, and `SADT_REST_RFC_ENDPOINT` returns neither a token nor a
+     * cookie however it is asked — so a shared implementation could only be one
+     * that fails on one of the two wires, which is what it did.
+     *
+     * The context is what the wire cannot know: which server, which credential,
+     * and where to hand the answer so the session lifetime above can fence and
+     * classify it.
+     */
+    establish(context: IAdtEstablishContext): Promise<void>;
+    /** The CSRF token this wire holds, or `null` for a wire that has none. */
+    csrfToken(): string | null;
+    /**
+     * Take a token earned elsewhere.
+     *
+     * A SAML credential does the exchange itself — the session cookie it earns is
+     * the point of it — and the token still has to reach the wire that will
+     * present it. `null` drops one without dropping the session around it.
+     */
+    adoptCsrfToken(token: string | null): void;
+    /** Drop the session state this wire was holding. */
+    forgetSession(): void;
+}
+/**
+ * The response a refusal carries, whichever client threw it.
+ *
+ * `IAdtTransport` promises exactly this about a failure and nothing more: the
+ * error has a `response`. `HttpTransport` throws an `AxiosError`, which happens
+ * to satisfy it; `RfcTransport` throws a plain `Error` with the field, which is
+ * what the contract asks for.
+ *
+ * Read structurally, because `instanceof AxiosError` is a question about which
+ * HTTP client is installed — an answer no other wire can give, and the reason
+ * observing a failing response, and noticing a dead session in one, were
+ * reachable over one wire only.
+ */
+/**
+ * Which system a wire is for.
+ *
+ * A marker rather than a class, because a consumer writes their own transports
+ * — that is the whole reason the wire is an argument. Constraining a connector
+ * to the shipped classes would have made "bring your own wire" impossible while
+ * appearing to allow it, since these classes carry private state and so compare
+ * nominally.
+ *
+ * It is still the CALLER who says which system: declaring `system` is that
+ * statement, made once by whoever writes the transport rather than at every
+ * construction. Nothing reads it at runtime and nothing infers from it — its
+ * only job is to stop "ABAP Cloud over RFC" from compiling.
+ */
+export interface IOnPremTransport extends IAdtTransport {
+    readonly system: 'onprem';
+}
+export interface ICloudTransport extends IAdtTransport {
+    readonly system: 'cloud';
+}
+export declare function refusalOf(error: unknown): IAdtTransportResponse | null;
+//# sourceMappingURL=IAdtTransport.d.ts.map

package/dist/connection/IAdtTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IAdtTransport.d.ts","sourceRoot":"","sources":["../../src/connection/IAdtTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC9C;AAED,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,6DAA6D;AAC7D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEpE;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAEhD,8EAA8E;IAC9E,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;;OAMG;IACH,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,kBAAkB,IAAI,OAAO,CAAC;IAE9B,4EAA4E;IAC5E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,0EAA0E;IAC1E,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3C,oDAAoD;IACpD,aAAa,IAAI,IAAI,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAQtE"}

package/dist/connection/IAdtTransport.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * What carries an ADT request to the server.
+ *
+ * The credential says how a request proves who it is; this says what the
+ * request travels over. They are independent axes, and on-prem is where both
+ * are real choices: the same ADT REST call goes over HTTP, or over RFC to
+ * `SADT_REST_RFC_ENDPOINT` — the FM Eclipse ADT itself uses through JCo — on a
+ * system where stateful HTTP sessions are not usable. ABAP Cloud has one
+ * transport, so its connector takes no such parameter.
+ *
+ * **Said by the caller, never sniffed.** Which transport is in use is a fact
+ * about the deployment, not something to be discovered by trying one and
+ * watching it fail — the same rule `SessionStrategy` states for session
+ * mechanics.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.refusalOf = refusalOf;
+function refusalOf(error) {
+    const response = error
+        ?.response;
+    if (!response || typeof response !== 'object')
+        return null;
+    const candidate = response;
+    return typeof candidate.status === 'number'
+        ? response
+        : null;
+}

package/dist/connection/LegacyOnPremHttpTransport.d.ts

@@ -0,0 +1,40 @@
+/**
+ * An on-prem system old enough that the stateful header hurts.
+ *
+ * On BASIS 7.40, `x-sap-adt-sessiontype: stateful` makes the server keep locks
+ * in ABAP session memory instead of the global enqueue table, and the next
+ * `PUT` over that lock comes back `423`. Such a system also names no HTTP
+ * session, so a connection that insisted on a `SAP_SESSIONID` would refuse to
+ * connect to a system that is working fine.
+ *
+ * Both of those used to be one flag on the connection — `skipSessionType` —
+ * carried in the class every wire shares, describing one deployment. It is a
+ * deployment, so it is a wire: taking this one is the caller saying which
+ * system they are dialling, exactly as taking the cloud or the on-prem wire is.
+ */
+import type { IAdtTransportRequest, IAdtTransportResponse } from './IAdtTransport.js';
+import { OnPremHttpTransport } from './OnPremHttpTransport.js';
+export declare class LegacyOnPremHttpTransport extends OnPremHttpTransport {
+    readonly kind = "onprem-http-legacy";
+    /**
+     * The header never goes out, whatever the caller set the session type to.
+     *
+     * Dropped here rather than refused above: `setSessionType()` records what the
+     * caller wants, and what actually travels is the wire's business. A caller
+     * that asks for a stateful session on this system gets one — through the RFC
+     * conversation, or through this wire's own session — without the header that
+     * would move its locks somewhere they cannot be released.
+     */
+    send(request: IAdtTransportRequest): Promise<IAdtTransportResponse>;
+    private withoutSessionType;
+    /**
+     * This system names no session, and that is not a failure.
+     *
+     * The rule above — refuse to connect when the server issued no
+     * `SAP_SESSIONID` — exists because a connection without one can read and can
+     * hold nothing. Here there is nothing to hold that way in the first place, so
+     * answering "no session" would refuse a system that works.
+     */
+    sessionEstablished(): boolean;
+}
+//# sourceMappingURL=LegacyOnPremHttpTransport.d.ts.map

package/dist/connection/LegacyOnPremHttpTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LegacyOnPremHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/LegacyOnPremHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAI/D,qBAAa,yBAA0B,SAAQ,mBAAmB;IAChE,SAAkB,IAAI,wBAAwB;IAE9C;;;;;;;;OAQG;IACY,IAAI,CACjB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,kBAAkB;IAY1B;;;;;;;OAOG;IACM,kBAAkB,IAAI,OAAO;CAGvC"}

package/dist/connection/LegacyOnPremHttpTransport.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * An on-prem system old enough that the stateful header hurts.
+ *
+ * On BASIS 7.40, `x-sap-adt-sessiontype: stateful` makes the server keep locks
+ * in ABAP session memory instead of the global enqueue table, and the next
+ * `PUT` over that lock comes back `423`. Such a system also names no HTTP
+ * session, so a connection that insisted on a `SAP_SESSIONID` would refuse to
+ * connect to a system that is working fine.
+ *
+ * Both of those used to be one flag on the connection — `skipSessionType` —
+ * carried in the class every wire shares, describing one deployment. It is a
+ * deployment, so it is a wire: taking this one is the caller saying which
+ * system they are dialling, exactly as taking the cloud or the on-prem wire is.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyOnPremHttpTransport = void 0;
+const OnPremHttpTransport_js_1 = require("./OnPremHttpTransport.js");
+const SESSION_TYPE_HEADER = 'x-sap-adt-sessiontype';
+class LegacyOnPremHttpTransport extends OnPremHttpTransport_js_1.OnPremHttpTransport {
+    kind = 'onprem-http-legacy';
+    /**
+     * The header never goes out, whatever the caller set the session type to.
+     *
+     * Dropped here rather than refused above: `setSessionType()` records what the
+     * caller wants, and what actually travels is the wire's business. A caller
+     * that asks for a stateful session on this system gets one — through the RFC
+     * conversation, or through this wire's own session — without the header that
+     * would move its locks somewhere they cannot be released.
+     */
+    async send(request) {
+        return super.send(this.withoutSessionType(request));
+    }
+    withoutSessionType(request) {
+        if (!request.headers)
+            return request;
+        const headers = {};
+        for (const [name, value] of Object.entries(request.headers)) {
+            if (name.toLowerCase() === SESSION_TYPE_HEADER)
+                continue;
+            headers[name] = value;
+        }
+        return { ...request, headers };
+    }
+    /**
+     * This system names no session, and that is not a failure.
+     *
+     * The rule above — refuse to connect when the server issued no
+     * `SAP_SESSIONID` — exists because a connection without one can read and can
+     * hold nothing. Here there is nothing to hold that way in the first place, so
+     * answering "no session" would refuse a system that works.
+     */
+    sessionEstablished() {
+        return true;
+    }
+}
+exports.LegacyOnPremHttpTransport = LegacyOnPremHttpTransport;

package/dist/connection/OnPremHttpTransport.d.ts

@@ -0,0 +1,45 @@
+/**
+ * An on-prem system over HTTP: the wire where the logon IS the session.
+ *
+ * There is nothing to open. The session arrives as a `SAP_SESSIONID` cookie on
+ * the establishing call, which is why SM04 shows those sessions opened by
+ * `P=/sap/bc/adt/discovery` — one per `connect()`, and one left behind per
+ * `connect()` that never said it was finished.
+ *
+ * ADT publishes no session resource here — `/sap/bc/adt/core/http/sessions`
+ * does not exist — so the goodbye is the platform's own,
+ * `/sap/public/bc/icf/logoff`, which answers `200` while expiring the session
+ * cookie.
+ *
+ * **Taking this transport is the consumer saying which system it is dialling.**
+ * It does not ask the server which it is, and does not try the cloud mechanism
+ * first to see whether it answers.
+ */
+import { HttpTransport } from './HttpTransport.js';
+import type { IAdtEstablishContext, IAdtSessionContext, IOnPremTransport } from './IAdtTransport.js';
+export declare class OnPremHttpTransport extends HttpTransport implements IOnPremTransport {
+    readonly kind: string;
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    readonly system: "onprem";
+    /**
+     * Whether an establishment actually succeeded.
+     *
+     * Cookies alone cannot answer it: a 401 that refuses us can carry a
+     * `Set-Cookie`, and that is debris, not a session. Telling the server we are
+     * finished with something we never had sends a request nobody asked for —
+     * into the middle of an authentication exchange, in the case that found this.
+     */
+    private established;
+    establish(context: IAdtEstablishContext): Promise<void>;
+    forgetSession(): void;
+    /**
+     * Nothing to ask for: the session comes with the establishing request.
+     *
+     * Stated by being absent rather than by a method that returns `false`. A wire
+     * that has no session resource has nothing to say here, and a `false` was
+     * only ever read by the connection to decide whether to send a close — a
+     * decision that is now this class's, below.
+     */
+    close(context: IAdtSessionContext): Promise<void>;
+}
+//# sourceMappingURL=OnPremHttpTransport.d.ts.map

package/dist/connection/OnPremHttpTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"OnPremHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/OnPremHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAI5B,qBAAa,mBACX,SAAQ,aACR,YAAW,gBAAgB;IAE3B,SAAkB,IAAI,EAAE,MAAM,CAAiB;IAE/C,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC;;;;;;;OAOG;IACH,OAAO,CAAC,WAAW,CAAS;IAEb,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7D,aAAa,IAAI,IAAI;IAK9B;;;;;;;OAOG;IAEY,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAuCjE"}

package/dist/connection/OnPremHttpTransport.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * An on-prem system over HTTP: the wire where the logon IS the session.
+ *
+ * There is nothing to open. The session arrives as a `SAP_SESSIONID` cookie on
+ * the establishing call, which is why SM04 shows those sessions opened by
+ * `P=/sap/bc/adt/discovery` — one per `connect()`, and one left behind per
+ * `connect()` that never said it was finished.
+ *
+ * ADT publishes no session resource here — `/sap/bc/adt/core/http/sessions`
+ * does not exist — so the goodbye is the platform's own,
+ * `/sap/public/bc/icf/logoff`, which answers `200` while expiring the session
+ * cookie.
+ *
+ * **Taking this transport is the consumer saying which system it is dialling.**
+ * It does not ask the server which it is, and does not try the cloud mechanism
+ * first to see whether it answers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OnPremHttpTransport = void 0;
+const cookies_js_1 = require("../utils/cookies.js");
+const HttpTransport_js_1 = require("./HttpTransport.js");
+const ICF_LOGOFF_PATH = '/sap/public/bc/icf/logoff';
+class OnPremHttpTransport extends HttpTransport_js_1.HttpTransport {
+    kind = 'onprem-http';
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    system = 'onprem';
+    /**
+     * Whether an establishment actually succeeded.
+     *
+     * Cookies alone cannot answer it: a 401 that refuses us can carry a
+     * `Set-Cookie`, and that is debris, not a session. Telling the server we are
+     * finished with something we never had sends a request nobody asked for —
+     * into the middle of an authentication exchange, in the case that found this.
+     */
+    established = false;
+    async establish(context) {
+        await super.establish(context);
+        this.established = true;
+    }
+    forgetSession() {
+        super.forgetSession();
+        this.established = false;
+    }
+    /**
+     * Nothing to ask for: the session comes with the establishing request.
+     *
+     * Stated by being absent rather than by a method that returns `false`. A wire
+     * that has no session resource has nothing to say here, and a `false` was
+     * only ever read by the connection to decide whether to send a close — a
+     * decision that is now this class's, below.
+     */
+    async close(context) {
+        // Read synchronously, for the same reason as the cloud wire: the teardown
+        // clears the jar while this is suspended on its first await.
+        const cookies = this.cookies();
+        const established = this.established;
+        // Snapshotted too, and for the same reason as the cookies: the goodbye must
+        // reach the application server that holds THIS session, and by the time it
+        // goes out the wire may be pinned to the one holding the next.
+        const affinity = this.affinityHeaders();
+        if (!established || !cookies) {
+            // Holding the cookie is the whole permission to end a session, and it is
+            // why nothing is sent without one. The session limit is per user and the
+            // pool is shared — a SAP GUI logon of the same user sits in the same SM04
+            // list — so a connector that tidied up sessions it did not open would
+            // eventually close somebody's GUI.
+            return;
+        }
+        try {
+            // Read once: a provider may answer differently on a second call, and one
+            // request must be built from one credential.
+            const auth = await context.authHeaders();
+            await this.sendDetached({
+                method: 'GET',
+                url: `${context.baseUrl}${ICF_LOGOFF_PATH}`,
+                headers: {
+                    ...affinity,
+                    ...auth,
+                    ...context.extraHeaders,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, cookies),
+                },
+            });
+            this.logger?.debug('Told the server the session is finished');
+        }
+        catch (error) {
+            this.logger?.debug(`Could not tell the server the session is finished: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+}
+exports.OnPremHttpTransport = OnPremHttpTransport;

package/dist/connection/RfcTransport.d.ts

@@ -0,0 +1,89 @@
+/**
+ * An ADT request carried over RFC.
+ *
+ * `SADT_REST_RFC_ENDPOINT` is the standard FM Eclipse ADT uses for on-prem ADT
+ * through JCo, and what it carries is a request line, header fields and a body
+ * — an HTTP request in all but the wire. So this translates, and translating is
+ * the whole of its job.
+ *
+ * It exists because an RFC conversation is inherently stateful: one ABAP
+ * session for the connection's lifetime, which is the way through HTTP 423
+ * "invalid lock handle" on legacy systems (BASIS < 7.50) where stateful HTTP
+ * sessions are not usable.
+ *
+ * **What is NOT here.** Cookies, the CSRF token, `x-sap-adt-sessiontype` and
+ * the session lifecycle belong to the connection above this seam and are
+ * already in `request.headers` by the time `send()` is called. A transport that
+ * also captured cookies would be doing that work twice, and the two copies
+ * would disagree the first time one of them was cleared.
+ */
+import type { ILogger } from '../logger.js';
+import type { IAdtEstablishContext, IAdtTransportRequest, IAdtTransportResponse, IOnPremTransport } from './IAdtTransport.js';
+/** The slice of the native client this needs, so the SDK is not a hard dependency. */
+export interface IRfcConversation {
+    open(): Promise<void>;
+    close(): Promise<void>;
+    call(fm: string, params: Record<string, unknown>): Promise<Record<string, any>>;
+    readonly alive: boolean;
+}
+export declare class RfcTransport implements IOnPremTransport {
+    private readonly connect;
+    private readonly logger;
+    readonly kind = "rfc";
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    readonly system: "onprem";
+    private conversation;
+    /** Names the conversation, and so the ABAP session it carries. */
+    private conversationId;
+    /**
+     * Nothing to fold in. `SADT_REST_RFC_ENDPOINT` answers with two header
+     * fields — `~server_protocol` and `content-type` — on every call, including
+     * one that asks for a token with `x-csrf-token: fetch`, and on a stateful
+     * POST. Measured on E19. There is no ICM in this path, so there is no ICF
+     * session to cookie and no application server to be redispatched between.
+     */
+    ingest(): void;
+    /** None, and never any: see `ingest()`. */
+    cookies(): null;
+    /**
+     * Nothing to establish. `open()` made the ABAP session, and there is no token
+     * to earn: this endpoint answers `x-csrf-token: fetch` with the same two
+     * header fields it answers everything else with. A wire with no
+     * cross-site request to forge against needs no token to prove one was not.
+     */
+    establish(_context: IAdtEstablishContext): Promise<void>;
+    /** None: see `establish()`. */
+    csrfToken(): null;
+    /**
+     * Ignored. Nothing on this wire reads a token, and keeping one would be
+     * state that never leaves the object.
+     */
+    adoptCsrfToken(): void;
+    /**
+     * The conversation, which IS the session — so it is fingerprinted by its own
+     * existence rather than by an address the server hands out.
+     */
+    /** The conversation IS the session, so it exists exactly while that does. */
+    sessionEstablished(): boolean;
+    sessionFingerprint(): Map<string, string>;
+    /** None: there is no dispatcher in front of this wire to stay bound to. */
+    affinityHeaders(): Record<string, string>;
+    /**
+     * Nothing to forget separately. The session ends when the conversation does,
+     * and that is `close()` — a wire whose state could be dropped while the
+     * conversation stayed open would be claiming a session it had disowned.
+     */
+    forgetSession(): void;
+    /**
+     * The client is built by a factory rather than constructed here: the SDK is
+     * an optional dependency loaded by `require` at open time, and a transport
+     * that reached for it in its constructor could not be built at all on a
+     * machine without it.
+     */
+    constructor(connect: () => IRfcConversation, logger?: ILogger | null);
+    open(): Promise<void>;
+    /** Never throws, and a repeat call finds nothing owed. */
+    close(): Promise<void>;
+    send(request: IAdtTransportRequest): Promise<IAdtTransportResponse>;
+}
+//# sourceMappingURL=RfcTransport.d.ts.map

package/dist/connection/RfcTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RfcTransport.d.ts","sourceRoot":"","sources":["../../src/connection/RfcTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,oBAAoB,EAEpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAmCD,qBAAa,YAAa,YAAW,gBAAgB;IA+EjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IA/EzB,QAAQ,CAAC,IAAI,SAAS;IAEtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC,OAAO,CAAC,YAAY,CAAiC;IACrD,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAM;IAE5B;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAEd,2CAA2C;IAC3C,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D,+BAA+B;IAC/B,SAAS,IAAI,IAAI;IAIjB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAEtB;;;OAGG;IACH,6EAA6E;IAC7E,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC,2EAA2E;IAC3E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIzC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAErB;;;;;OAKG;gBAEgB,OAAO,EAAE,MAAM,gBAAgB,EAC/B,MAAM,GAAE,OAAO,GAAG,IAAW;IAG1C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA8H1E"}