@mcp-abap-adt/connection 5.0.0 → 6.0.1

package/examples/basic-connection.js

@@ -4,7 +4,11 @@
  * Demonstrates simple connection to SAP system and making ADT request
  */
 
-const { createAbapConnection } = require('@mcp-abap-adt/connection');
+const {
+  OnPremHttpTransport,
+  AdtOnPremConnector,
+  BasicAuthProvider,
+} = require('@mcp-abap-adt/connection');
 
 async function main() {
   // Configuration from environment or hardcoded
@@ -18,8 +22,16 @@ async function main() {
 
   console.log('Creating connection to', config.url);
 
-  // Create connection (factory auto-detects cloud vs on-premise)
-  const connection = createAbapConnection(config, console);
+  // Which system (the class), which credential (the object). Neither is detected.
+  const connection = new AdtOnPremConnector(
+    config,
+    new BasicAuthProvider(config.username, config.password),
+    new OnPremHttpTransport(() => ({}), console, {
+      client: config.client,
+      baseUrl: config.url,
+    }),
+    console,
+  );
 
   try {
     // Connect and get CSRF token

package/examples/jwt-with-token-refresh.js

@@ -1,7 +1,7 @@
 /**
  * Example: JWT Connection with Automatic Token Refresh
  *
- * This example demonstrates how to create a JwtAbapConnection with
+ * This example demonstrates how to create a cloud connection with
  * automatic token refresh using ITokenRefresher from auth-broker.
  *
  * When a **401** occurs, the connection automatically:
@@ -16,7 +16,11 @@
  * change nothing.
  */
 
-const { JwtAbapConnection } = require('@mcp-abap-adt/connection');
+const {
+  CloudHttpTransport,
+  AdtCloudConnector,
+  TokenAuthProvider,
+} = require('@mcp-abap-adt/connection');
 // const { AuthBroker } = require('@mcp-abap-adt/auth-broker');
 
 // Simple logger
@@ -62,13 +66,17 @@ async function main() {
     jwtToken: initialToken,
   };
 
-  // Create connection with token refresher
-  // 4th parameter is the ITokenRefresher
-  const connection = new JwtAbapConnection(
+  // The refresher IS the credential: `TokenAuthProvider` asks it for a token on
+  // every request, so a provider that renews on expiry renews without anyone
+  // here deciding to. A bare string would be a token with nothing behind it.
+  const connection = new AdtCloudConnector(
     config,
+    new TokenAuthProvider(tokenRefresher),
+    new CloudHttpTransport(() => ({}), console, {
+      client: config.client,
+      baseUrl: config.url,
+    }),
     logger,
-    undefined,
-    tokenRefresher,
   );
 
   try {

package/examples/saml-connection.js

@@ -5,7 +5,11 @@
  * Session cookies are expected from prior login flow.
  */
 
-const { createAbapConnection } = require('@mcp-abap-adt/connection');
+const {
+  OnPremHttpTransport,
+  AdtOnPremConnector,
+  SamlAuthProvider,
+} = require('@mcp-abap-adt/connection');
 
 async function main() {
   const config = {
@@ -22,7 +26,16 @@ async function main() {
   }
 
   console.log('Creating SAML connection to', config.url);
-  const connection = createAbapConnection(config, console);
+  // The cookies ARE the credential — there is no Authorization header at all.
+  const connection = new AdtOnPremConnector(
+    config,
+    new SamlAuthProvider(config.sessionCookies),
+    new OnPremHttpTransport(() => ({}), console, {
+      client: config.client,
+      baseUrl: config.url,
+    }),
+    console,
+  );
 
   try {
     console.log('Connecting using session cookies...');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/connection",
-  "version": "5.0.0",
+  "version": "6.0.1",
   "description": "ABAP connection layer for MCP ABAP ADT server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -35,25 +35,26 @@
     "url": "git+https://github.com/fr0ster/mcp-abap-connection.git"
   },
   "scripts": {
-    "chrono": "./tools/version-stats.sh",
-    "clean": "rm -rf dist tsconfig.tsbuildinfo",
-    "lint": "npx biome check --write src",
-    "lint:check": "npx biome check src",
-    "format": "npx biome format --write src",
-    "build": "npm run --silent clean && npx biome check src --diagnostic-level=error && npx tsc -p tsconfig.json",
+    "chrono": "node scripts/version-stats.mjs",
+    "clean": "node scripts/clean.mjs",
+    "lint": "npx biome check --write src scripts",
+    "lint:check": "npx biome check src scripts",
+    "format": "npx biome format --write src scripts",
+    "build": "npm run --silent clean && npx biome check src scripts --diagnostic-level=error && npx tsc -p tsconfig.json && npm run --silent typecheck:scripts",
     "build:fast": "npx tsc -p tsconfig.json",
     "test": "npm run --silent check:docs && jest",
-    "prepublishOnly": "npm run build && npm run check:docs",
-    "check:docs": "node scripts/check-docs.mjs"
+    "prepublishOnly": "npm run build && npm run check:docs && npm run --silent check:pack",
+    "check:docs": "node scripts/check-docs.mjs",
+    "typecheck:scripts": "npx tsc -p tsconfig.scripts.json",
+    "check:pack": "node scripts/check-pack.mjs"
   },
   "engines": {
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces": "^12.0.0",
+    "@mcp-abap-adt/interfaces": "^21.0.0",
     "axios": "^1.16.0",
     "commander": "^14.0.3",
-    "express": "^5.1.0",
     "open": "^11.0.0"
   },
   "optionalDependencies": {

package/dist/__tests__/helpers/session.d.ts

@@ -1,15 +0,0 @@
-/**
- * Test precondition: put a connection into the connected state without a
- * network round trip.
- *
- * `connect()` is mandatory now, so a test whose subject is something else —
- * timeouts, headers, retry classification — needs the session to exist before
- * it can say anything. Establishing it for real would mean teaching every such
- * mock to answer a CSRF fetch, which tests the wrong thing and adds retry
- * delays to suites that are not about connecting.
- *
- * Tests that ARE about connecting use a real stub instead; see
- * `connection/sessionComposition.test.ts`.
- */
-export declare function markConnectedForTest(connection: unknown, fingerprint?: Map<string, string>): void;
-//# sourceMappingURL=session.d.ts.map

package/dist/__tests__/helpers/session.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,OAAO,EACnB,WAAW,GAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAA4C,GAC1E,IAAI,CAMN"}

package/dist/__tests__/helpers/session.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.markConnectedForTest = markConnectedForTest;
-/**
- * Test precondition: put a connection into the connected state without a
- * network round trip.
- *
- * `connect()` is mandatory now, so a test whose subject is something else —
- * timeouts, headers, retry classification — needs the session to exist before
- * it can say anything. Establishing it for real would mean teaching every such
- * mock to answer a CSRF fetch, which tests the wrong thing and adds retry
- * delays to suites that are not about connecting.
- *
- * Tests that ARE about connecting use a real stub instead; see
- * `connection/sessionComposition.test.ts`.
- */
-function markConnectedForTest(connection, fingerprint = new Map([['SAP_SESSIONID_T_100', 'S1']])) {
-    connection.lifecycle.markConnected(fingerprint);
-}

package/dist/auth/IAuthProvider.d.ts

@@ -1,84 +0,0 @@
-/**
- * How a connection proves who it is — passed in, not inherited.
- *
- * The class a consumer takes says which SYSTEM it is dialling; this says how it
- * authenticates there. The two are independent: a communication user against
- * ABAP Cloud and a bearer token against on-prem are both ordinary, and a design
- * where the credential picks the system's session mechanism gets one of them
- * wrong whichever way it guesses.
- *
- * Deliberately not "give me a token". Four of the five ways in are not tokens:
- * basic is a header built from a username, a certificate is TLS material and no
- * header at all, and SPNEGO is a negotiation with the server. What every one of
- * them has in common is small, and it is this.
- *
- * `establishSession()` is NOT here. Measured across all five implementations it
- * is the same work — fetch a CSRF token from `/sap/bc/adt/discovery`, keep it,
- * tolerate a failure — with the only difference being a step before it, which is
- * `prepare()`.
- */
-import type { AgentOptions } from 'node:https';
-export interface IAuthProvider {
-    /** For logs, so which credential ran is never inferred from behaviour. */
-    readonly kind: string;
-    /**
-     * Get ready before anything is sent: load key material, unlock a store.
-     * Called once per establishment, before the first request.
-     *
-     * Not for tokens. A stateful token provider caches and renews on its own, so
-     * asking it IS the preparation — and holding what it returned would hide the
-     * renewal it exists to do.
-     *
-     * Optional because most credentials are ready as constructed. A credential
-     * that throws here fails the connect, which is correct — it has nothing to
-     * authenticate with.
-     */
-    prepare?(): Promise<void>;
-    /**
-     * The `Authorization` header value, or `''` when this credential is not a
-     * header — a certificate authenticates through TLS and has none.
-     *
-     * **Asked per request, and asynchronous, because the answer can change.** A
-     * token provider checks expiry and renews behind this call; anything cached
-     * on this side would serve the stale token and defeat it. Cheap in the
-     * ordinary case for the same reason: the provider holds the token and only
-     * goes to the network when it has expired.
-     */
-    authorizationHeader(): Promise<string>;
-    /**
-     * The server refused what this last handed out; get a new one.
-     *
-     * Separate from `authorizationHeader()` because the two questions are
-     * different, and the token contract says so: `getToken()` "may return cached
-     * token if still valid", while `refreshToken()` is documented as the one to
-     * call "when getToken() returned a token that was rejected by server". Asking
-     * the first again after a 401 gets the same rejected token back, and the
-     * renewal never happens.
-     *
-     * Omitted by credentials that cannot be renewed — a password is a password.
-     */
-    renew?(): Promise<void>;
-    /**
-     * Cookies this credential authenticates with, for the ways in where the
-     * session was negotiated elsewhere and handed over — SAML is one.
-     *
-     * Part of the contract rather than a method a provider happens to have: the
-     * first version left it off, so `SamlAuthProvider` held the cookies, nothing
-     * ever asked for them, and the recommended replacement authenticated with
-     * nothing at all.
-     */
-    cookies?(): string;
-    /**
-     * TLS options for credentials that live in the transport rather than in a
-     * header. Omitted by everything else.
-     */
-    httpsAgentOptions?(): AgentOptions;
-    /**
-     * Fetch the CSRF token this credential's own way.
-     *
-     * Only SPNEGO needs it: its token is consumed by one request and the exchange
-     * is the fetch. Everything else leaves it out and gets the shared path.
-     */
-    fetchCsrfToken?(url: string): Promise<string>;
-}
-//# sourceMappingURL=IAuthProvider.d.ts.map

package/dist/auth/IAuthProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"IAuthProvider.d.ts","sourceRoot":"","sources":["../../src/auth/IAuthProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B;;;;;;;;;OASG;IACH,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAExB;;;;;;;;OAQG;IACH,OAAO,CAAC,IAAI,MAAM,CAAC;IAEnB;;;OAGG;IACH,iBAAiB,CAAC,IAAI,YAAY,CAAC;IAEnC;;;;;OAKG;IACH,cAAc,CAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C"}

package/dist/auth/IAuthProvider.js

@@ -1,21 +0,0 @@
-"use strict";
-/**
- * How a connection proves who it is — passed in, not inherited.
- *
- * The class a consumer takes says which SYSTEM it is dialling; this says how it
- * authenticates there. The two are independent: a communication user against
- * ABAP Cloud and a bearer token against on-prem are both ordinary, and a design
- * where the credential picks the system's session mechanism gets one of them
- * wrong whichever way it guesses.
- *
- * Deliberately not "give me a token". Four of the five ways in are not tokens:
- * basic is a header built from a username, a certificate is TLS material and no
- * header at all, and SPNEGO is a negotiation with the server. What every one of
- * them has in common is small, and it is this.
- *
- * `establishSession()` is NOT here. Measured across all five implementations it
- * is the same work — fetch a CSRF token from `/sap/bc/adt/discovery`, keep it,
- * tolerate a failure — with the only difference being a step before it, which is
- * `prepare()`.
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/connection/BaseAbapConnection.d.ts

@@ -1,29 +0,0 @@
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import { AbstractAbapConnection } from './AbstractAbapConnection.js';
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `BasicAuthProvider`:
- *
- *   new AdtOnPremConnector(config, new BasicAuthProvider(user, pass), logger)
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-export declare class BaseAbapConnection extends AbstractAbapConnection {
-    constructor(config: SapConfig, logger?: ILogger | null, sessionId?: string, options?: {
-        skipSessionType?: boolean;
-    });
-    /**
-     * Connect to SAP system with Basic Auth
-     * Fetches CSRF token which also establishes session cookies
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    protected establishSession(): Promise<void>;
-    protected buildAuthorizationHeader(): string;
-    private static validateConfig;
-}
-//# sourceMappingURL=BaseAbapConnection.d.ts.map

package/dist/connection/BaseAbapConnection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"BaseAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/BaseAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,sBAAsB;gBAE1D,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAMzC;;;OAGG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6CjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAU5C,OAAO,CAAC,MAAM,CAAC,cAAc;CAmB9B"}

package/dist/connection/BaseAbapConnection.js

@@ -1,81 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BaseAbapConnection = void 0;
-const axios_1 = require("axios");
-const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `BasicAuthProvider`:
- *
- *   new AdtOnPremConnector(config, new BasicAuthProvider(user, pass), logger)
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-class BaseAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
-    constructor(config, logger, sessionId, options) {
-        BaseAbapConnection.validateConfig(config);
-        super(config, logger || null, sessionId, options);
-    }
-    /**
-     * Connect to SAP system with Basic Auth
-     * Fetches CSRF token which also establishes session cookies
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    async establishSession() {
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
-        this.logger?.debug(`[DEBUG] BaseAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
-        try {
-            // Try to get CSRF token (this will also get cookies)
-            const token = await this.fetchCsrfToken(discoveryUrl);
-            this.setCsrfToken(token);
-            this.logger?.debug('Successfully connected to SAP system', {
-                hasCsrfToken: !!this.getCsrfToken(),
-                hasCookies: !!this.getCookies(),
-                cookieLength: this.getCookies()?.length || 0,
-            });
-        }
-        catch (error) {
-            // For Basic auth, log warning but don't fail
-            // The retry logic in makeAdtRequest will handle transient errors automatically
-            const errorMsg = error instanceof Error ? error.message : String(error);
-            this.logger?.warn(`[WARN] BaseAbapConnection - Could not connect to SAP system upfront: ${errorMsg}. Will retry on first request.`);
-            // Still try to extract cookies from error response if available
-            if (error instanceof axios_1.AxiosError && error.response?.headers) {
-                // updateCookiesFromResponse is private, but cookies are extracted in fetchCsrfToken
-                if (this.getCookies()) {
-                    this.logger?.debug(`[DEBUG] BaseAbapConnection - Cookies extracted from error response during connect (first 100 chars): ${this.getCookies()?.substring(0, 100)}...`);
-                }
-            }
-            // Rethrow: a resolved connect() must mean a usable session exists. This
-            // used to swallow and resolve anyway, deferring establishment to the
-            // first request — coherent only while that lazy path existed. Without it,
-            // swallowing would leave a connection that reports success, holds
-            // nothing, and refuses every request.
-            throw error;
-        }
-    }
-    buildAuthorizationHeader() {
-        const { username, password } = this.getConfig();
-        const safeUsername = username ?? '';
-        const safePassword = password ?? '';
-        const token = Buffer.from(`${safeUsername}:${safePassword}`).toString('base64');
-        return `Basic ${token}`;
-    }
-    static validateConfig(config) {
-        if (config.authType !== 'basic') {
-            throw new Error(`Basic authentication connection expects authType "basic", got "${config.authType}"`);
-        }
-        if (!config.username || !config.password) {
-            throw new Error('Basic authentication requires both username and password');
-        }
-        if (!config.client) {
-            throw new Error('Basic authentication requires SAP_CLIENT to be provided');
-        }
-    }
-}
-exports.BaseAbapConnection = BaseAbapConnection;

package/dist/connection/CertificateAbapConnection.d.ts

@@ -1,35 +0,0 @@
-import type { AgentOptions } from 'node:https';
-import type { ICertificateMaterialLoader } from '@mcp-abap-adt/interfaces';
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import { AbstractAbapConnection } from './AbstractAbapConnection.js';
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `CertificateAuthProvider`:
- *
- *   new AdtOnPremConnector(config, new CertificateAuthProvider(loader, config), logger)
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-export declare class CertificateAbapConnection extends AbstractAbapConnection {
-    private loader;
-    private material;
-    constructor(config: SapConfig, logger?: ILogger | null, sessionId?: string, loader?: ICertificateMaterialLoader);
-    private static validateConfig;
-    protected ensureMaterial(): Promise<void>;
-    /**
-     * Loads certificate material and primes the session. MUST be called before the first
-     * request — the TLS agent is built lazily and needs the client cert present.
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    /** The material has to be loaded before anything is sent, preflight included. */
-    protected prepareCredential(): Promise<void>;
-    protected establishSession(): Promise<void>;
-    protected getHttpsAgentOptions(): AgentOptions;
-    protected buildAuthorizationHeader(): string;
-}
-//# sourceMappingURL=CertificateAbapConnection.d.ts.map

package/dist/connection/CertificateAbapConnection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"CertificateAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CertificateAbapConnection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC3B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,sBAAsB;IACnE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAAqC;gBAGnD,MAAM,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,0BAA0B;IAOrC,OAAO,CAAC,MAAM,CAAC,cAAc;cAyBb,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAM/C;;;OAGG;IACH;;;OAGG;IACH,iFAAiF;cACxD,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;cAI3C,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IA6BjD,SAAS,CAAC,oBAAoB,IAAI,YAAY;IAU9C,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAG7C"}

package/dist/connection/CertificateAbapConnection.js

@@ -1,91 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CertificateAbapConnection = void 0;
-const axios_1 = require("axios");
-const FileCertificateMaterialLoader_js_1 = require("../auth/FileCertificateMaterialLoader.js");
-const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-/**
- * @deprecated The class you take should say which SYSTEM you are dialling,
- * not which credential you hold — a session mechanism that rides along with
- * the credential gets one of them wrong. Use `AdtOnPremConnector` with `CertificateAuthProvider`:
- *
- *   new AdtOnPremConnector(config, new CertificateAuthProvider(loader, config), logger)
- *
- * Kept working, and not removed here: existing consumers are unaffected.
- */
-class CertificateAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
-    loader;
-    material = null;
-    constructor(config, logger, sessionId, loader) {
-        CertificateAbapConnection.validateConfig(config);
-        super(config, logger || null, sessionId);
-        this.loader = loader ?? new FileCertificateMaterialLoader_js_1.FileCertificateMaterialLoader();
-    }
-    static validateConfig(config) {
-        if (config.authType !== 'certificate') {
-            throw new Error(`Certificate connection expects authType "certificate", got "${config.authType}"`);
-        }
-        if (config.connectionType === 'rfc') {
-            throw new Error('Certificate auth is not supported with connectionType "rfc".');
-        }
-        const hasPem = !!(config.certPath && config.certKeyPath); // complete PEM pair present
-        const hasPfx = !!config.certPfxPath;
-        if (!hasPem && !hasPfx) {
-            throw new Error('Certificate auth requires certPfxPath OR (certPath AND certKeyPath).');
-        }
-        if ((config.certPath || config.certKeyPath) && config.certPfxPath) {
-            throw new Error('Certificate auth: provide either PEM pair OR PFX, not both.');
-        }
-    }
-    async ensureMaterial() {
-        if (!this.material) {
-            this.material = await this.loader.load(this.getConfig());
-        }
-    }
-    /**
-     * Loads certificate material and primes the session. MUST be called before the first
-     * request — the TLS agent is built lazily and needs the client cert present.
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    /** The material has to be loaded before anything is sent, preflight included. */
-    async prepareCredential() {
-        await this.ensureMaterial();
-    }
-    async establishSession() {
-        await this.ensureMaterial();
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
-        try {
-            const token = await this.fetchCsrfToken(discoveryUrl);
-            this.setCsrfToken(token);
-        }
-        catch (error) {
-            this.logger?.warn(`[WARN] CertificateAbapConnection - connect deferred: ${error instanceof Error ? error.message : String(error)}`);
-            if (error instanceof axios_1.AxiosError && error.response?.headers) {
-                if (this.getCookies()) {
-                    this.logger?.debug(`[DEBUG] CertificateAbapConnection - Cookies extracted from error response during connect (first 100 chars): ${this.getCookies()?.substring(0, 100)}...`);
-                }
-            }
-            // Rethrow: a resolved connect() must mean a usable session exists. This
-            // used to swallow and resolve anyway, deferring establishment to the
-            // first request — coherent only while that lazy path existed. Without it,
-            // swallowing would leave a connection that reports success, holds
-            // nothing, and refuses every request.
-            throw error;
-        }
-    }
-    getHttpsAgentOptions() {
-        if (!this.material) {
-            throw new Error('CertificateAbapConnection: certificate material not loaded. Call connect() before making requests.');
-        }
-        const { cert, key, pfx, passphrase } = this.material;
-        return { cert, key, pfx, passphrase };
-    }
-    buildAuthorizationHeader() {
-        return '';
-    }
-}
-exports.CertificateAbapConnection = CertificateAbapConnection;