arc-1 1.0.2 → 1.1.0

package/dist/adt/http-deadline.js

@@ -0,0 +1,106 @@
+import { setTimeout as sleep } from 'node:timers/promises';
+import { AdtNetworkError } from './errors.js';
+const DEFAULT_FETCH_TIMEOUT_MS = 120_000;
+function callerDeadlineRemaining(options) {
+    if (options?.deadline === undefined)
+        return undefined;
+    if (!Number.isFinite(options.deadline)) {
+        throw new RangeError('ADT request deadline must be a finite epoch-millisecond value.');
+    }
+    return Math.ceil(options.deadline - Date.now());
+}
+function requestDeadlineRemaining(options) {
+    const callerRemaining = callerDeadlineRemaining(options);
+    const configuredTimeout = options?.fetchTimeoutMs;
+    if (configuredTimeout !== undefined && (!Number.isFinite(configuredTimeout) || configuredTimeout <= 0)) {
+        throw new RangeError('ADT fetch timeout must be a positive finite millisecond value.');
+    }
+    const fetchTimeout = configuredTimeout === undefined ? DEFAULT_FETCH_TIMEOUT_MS : Math.ceil(configuredTimeout);
+    return callerRemaining === undefined ? fetchTimeout : Math.min(fetchTimeout, callerRemaining);
+}
+function requestTimeoutError() {
+    return new DOMException('The ADT request deadline was exceeded.', 'TimeoutError');
+}
+function requestAbortError(signal) {
+    const cause = signal.reason instanceof Error ? signal.reason : new Error('The ADT request was aborted.');
+    return new AdtNetworkError(cause.message, cause);
+}
+export function throwIfRequestCancelled(options) {
+    if (options?.signal?.aborted) {
+        throw requestAbortError(options.signal);
+    }
+    const callerRemaining = callerDeadlineRemaining(options);
+    if (callerRemaining !== undefined && callerRemaining <= 0) {
+        const cause = requestTimeoutError();
+        throw new AdtNetworkError(cause.message, cause);
+    }
+}
+/** Caller-owned cancellation only (no built-in fetch timeout). */
+export function requestBudgetSignal(options) {
+    throwIfRequestCancelled(options);
+    const signals = [];
+    if (options?.signal)
+        signals.push(options.signal);
+    const callerRemaining = callerDeadlineRemaining(options);
+    if (callerRemaining !== undefined)
+        signals.push(AbortSignal.timeout(Math.max(1, callerRemaining)));
+    if (signals.length === 0)
+        return undefined;
+    return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/** Await a non-fetch dependency without leaving an unhandled rejection after cancellation. */
+export async function awaitWithRequestSignal(operation, signal) {
+    if (!signal)
+        return operation;
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', onAbort);
+            fn();
+        };
+        const onAbort = () => finish(() => reject(requestAbortError(signal)));
+        signal.addEventListener('abort', onAbort, { once: true });
+        operation.then((value) => finish(() => resolve(value)), (error) => finish(() => reject(error)));
+        if (signal.aborted)
+            onAbort();
+    });
+}
+export function awaitWithinRequestBudget(operation, options) {
+    try {
+        return awaitWithRequestSignal(operation, requestBudgetSignal(options));
+    }
+    catch (error) {
+        // `operation` was already created by the caller. Observe any later rejection
+        // even when the deadline expires while a provider is returning its promise.
+        void operation.catch(() => undefined);
+        return Promise.reject(error);
+    }
+}
+/** Compose the built-in per-fetch timeout with the caller's signal/deadline. */
+export function requestSignal(options) {
+    throwIfRequestCancelled(options);
+    const signals = [AbortSignal.timeout(requestDeadlineRemaining(options))];
+    if (options?.signal)
+        signals.unshift(options.signal);
+    return signals.length === 1 ? signals[0] : AbortSignal.any(signals);
+}
+/** Retry delays consume the same caller budget as their surrounding HTTP request. */
+export async function sleepWithinRequestBudget(delayMs, options) {
+    if (delayMs <= 0) {
+        throwIfRequestCancelled(options);
+        return;
+    }
+    const signal = requestSignal(options);
+    try {
+        await sleep(delayMs, undefined, { signal });
+    }
+    catch (error) {
+        if (signal.aborted)
+            throw signal.reason ?? requestTimeoutError();
+        throw error;
+    }
+}
+//# sourceMappingURL=http-deadline.js.map

package/dist/adt/http-deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-deadline.js","sourceRoot":"","sources":["../../src/adt/http-deadline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAgB9C,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAEzC,SAAS,uBAAuB,CAAC,OAAgC;IAC/D,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,UAAU,CAAC,gEAAgE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,wBAAwB,CAAC,OAAgC;IAChE,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAI,OAAyC,EAAE,cAAc,CAAC;IACrF,IAAI,iBAAiB,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,UAAU,CAAC,gEAAgE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/G,OAAO,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,IAAI,YAAY,CAAC,wCAAwC,EAAE,cAAc,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAmB;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzG,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgC;IACtE,IAAI,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,mBAAmB,EAAE,CAAC;QACpC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mBAAmB,CAAC,OAAgC;IAClE,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,IAAI,OAAO,EAAE,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,eAAe,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAI,SAAqB,EAAE,MAAoB;IACzF,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAE9B,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEtE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,SAAS,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EACvC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CACvC,CAAC;QACF,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAI,SAAqB,EAAE,OAAgC;IACjG,IAAI,CAAC;QACH,OAAO,sBAAsB,CAAC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6EAA6E;QAC7E,4EAA4E;QAC5E,KAAK,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,EAAE,MAAM;QAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAe,EAAE,OAAgC;IAC9F,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,MAAM,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACjE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/adt/http-wire-body.d.ts

@@ -0,0 +1,2 @@
+export declare function prepareDataPreviewWireBody(enabled: boolean, method: string, path: string, body: string | undefined, headers: Record<string, string>): string | Buffer | undefined;
+//# sourceMappingURL=http-wire-body.d.ts.map

package/dist/adt/http-wire-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-wire-body.d.ts","sourceRoot":"","sources":["../../src/adt/http-wire-body.ts"],"names":[],"mappings":"AAIA,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,GAAG,MAAM,GAAG,SAAS,CAS7B"}

package/dist/adt/http-wire-body.js

@@ -0,0 +1,14 @@
+import { gzipSync } from 'node:zlib';
+const GZIP_DATA_PREVIEW_PATHS = new Set(['/sap/bc/adt/datapreview/freestyle', '/sap/bc/adt/datapreview/ddic']);
+export function prepareDataPreviewWireBody(enabled, method, path, body, headers) {
+    const collectionPath = path.split(/[?#]/, 1)[0] ?? '';
+    if (!enabled || method !== 'POST' || !body || !GZIP_DATA_PREVIEW_PATHS.has(collectionPath))
+        return body;
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === 'content-encoding')
+            delete headers[key];
+    }
+    headers['Content-Encoding'] = 'gzip';
+    return gzipSync(body);
+}
+//# sourceMappingURL=http-wire-body.js.map

package/dist/adt/http-wire-body.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-wire-body.js","sourceRoot":"","sources":["../../src/adt/http-wire-body.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,mCAAmC,EAAE,8BAA8B,CAAC,CAAC,CAAC;AAE/G,MAAM,UAAU,0BAA0B,CACxC,OAAgB,EAChB,MAAc,EACd,IAAY,EACZ,IAAwB,EACxB,OAA+B;IAE/B,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,OAAO,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IAExG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,kBAAkB;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,kBAAkB,CAAC,GAAG,MAAM,CAAC;IACrC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC"}

package/dist/adt/http.d.ts

@@ -27,25 +27,9 @@
  *    No external HTTP dependencies — undici ships with Node.js 22+.
  */
 import type { BTPProxyConfig } from '@arc-mcp/xsuaa-auth/btp';
+import { type AdtRequestOptions } from './http-deadline.js';
 import type { Semaphore } from './semaphore.js';
-export interface AdtRequestOptions {
-    /**
-     * Some ADT subresources are optional and legitimately return 404, for example
-     * class local includes such as testclasses on classes without ABAP Unit code.
-     * Callers that handle those 404s can opt into debug-level audit logging.
-     */
-    suppressNotFoundLog?: boolean;
-    /**
-     * Startup capability/discovery probe. ANY non-2xx is expected here (the feature
-     * is simply absent/not activated, or the endpoint intentionally 400s without
-     * query params, e.g. the RAP probe on `/ddic/ddl/sources`). The outcome is
-     * captured as structured data and re-reported at a higher layer (feature map,
-     * the `Authorization probe: …` lines, the contextual discovery warn), so the
-     * raw `http_request` failure is logged at debug instead of warn to keep a
-     * healthy startup quiet. Unlike `suppressNotFoundLog` this is not limited to 404.
-     */
-    probe?: boolean;
-}
+export type { AdtRequestOptions } from './http-deadline.js';
 /** Session type for ADT requests */
 export type SessionType = 'stateful' | 'stateless' | undefined;
 /** Configuration for the ADT HTTP client */
@@ -56,6 +40,8 @@ export interface AdtHttpConfig {
     client?: string;
     language?: string;
     insecure?: boolean;
+    /** Gzip non-empty data-preview POST bodies for approved WAF compatibility. */
+    gzipDataPreviewBody?: boolean;
     cookies?: Record<string, string>;
     /** Path to cookie file — enables hot-reload on stale auth */
     cookieFile?: string;
@@ -119,6 +105,7 @@ export declare class AdtHttpClient {
     private negotiatedHeaders;
     private csrfToken;
     private dispatcher;
+    private longOperationDispatcher;
     private config;
     /**
      * Cookie jar — stores Set-Cookie headers from responses and sends them back.
@@ -152,13 +139,13 @@ export declare class AdtHttpClient {
     /** GET request */
     get(path: string, headers?: Record<string, string>, options?: AdtRequestOptions): Promise<AdtResponse>;
     /** HEAD request — lightweight probe, no response body */
-    head(path: string, headers?: Record<string, string>): Promise<AdtResponse>;
+    head(path: string, headers?: Record<string, string>, options?: AdtRequestOptions): Promise<AdtResponse>;
     /** POST request (includes CSRF token) */
-    post(path: string, body?: string, contentType?: string, headers?: Record<string, string>): Promise<AdtResponse>;
+    post(path: string, body?: string, contentType?: string, headers?: Record<string, string>, options?: AdtRequestOptions): Promise<AdtResponse>;
     /** PUT request (includes CSRF token) */
-    put(path: string, body: string, contentType?: string, headers?: Record<string, string>): Promise<AdtResponse>;
+    put(path: string, body: string, contentType?: string, headers?: Record<string, string>, options?: AdtRequestOptions): Promise<AdtResponse>;
     /** DELETE request (includes CSRF token) */
-    delete(path: string, headers?: Record<string, string>): Promise<AdtResponse>;
+    delete(path: string, headers?: Record<string, string>, options?: AdtRequestOptions): Promise<AdtResponse>;
     /**
      * Execute a function within an isolated stateful session.
      * Ensures lock/modify/unlock share the same SAP session cookies.
@@ -181,7 +168,7 @@ export declare class AdtHttpClient {
      * Fetch CSRF token from SAP.
      * Uses HEAD /sap/bc/adt/core/discovery for speed.
      */
-    fetchCsrfToken(): Promise<void>;
+    fetchCsrfToken(options?: AdtRequestOptions): Promise<void>;
     /**
      * Detect "database connection is not open" error from SAP.
      * This happens when a work process loses its HANA DB connection.
@@ -304,5 +291,4 @@ export declare function parseRetryAfter(header: string | null | undefined, fallb
     delayMs: number;
     source: 'header' | 'fallback';
 };
-export {};
 //# sourceMappingURL=http.d.ts.map

package/dist/adt/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/adt/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAQ9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,WAAW,iBAAiB;IAChC;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAkED,oCAAoC;AACpC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,KAAK,IAAI,CAAC;IACtE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,0BAA0B;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,iBAAiB,CAAqE;IAC9F,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,MAAM,CAAgB;IAC9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS,CAAkC;IACnD,qEAAqE;IACrE,OAAO,CAAC,iBAAiB,CAAS;IAClC,sFAAsF;IACtF,OAAO,CAAC,cAAc,CAAS;IAC/B,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAA6B;IACxE,YAAY,MAAM,EAAE,aAAa,EAAE,0BAA0B,CAAC,EAAE,0BAA0B,EAWzF;IAED,yEAAyE;IACzE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAEhD;IAED,6GAA6G;IAC7G,gBAAgB,IAAI,OAAO,CAE1B;IAED,sHAAsH;IACtH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnD;IAED;;mGAE+F;IAC/F,IAAI,SAAS,IAAI,SAAS,GAAG,SAAS,CAErC;IAED,kBAAkB;IACZ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE3G;IAED,yDAAyD;IACnD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAE/E;IAED,yCAAyC;IACnC,IAAI,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,wCAAwC;IAClC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAElH;IAED,2CAA2C;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAEjF;IAED;;;;;;OAMG;IACG,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAYlF;IAED,iFAAiF;YACnE,OAAO;YA2BP,kCAAkC;IAiBhD,gEAAgE;YAClD,YAAY;IAigB1B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,kBAAkB;IAW1B,yEAAyE;IACzE,OAAO,CAAC,cAAc;IAyCtB;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAmIpC;IAED;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;OAOG;IACH,gBAAgB,IAAI,IAAI,CAGvB;IAED;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAqB/B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAKpB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mBAAmB;IAc3B,OAAO,CAAC,YAAY;IAgBpB,mEAAmE;IACnE,OAAO,CAAC,QAAQ;IAkBhB,2FAA2F;IAC3F,OAAO,CAAC,eAAe;IAsBvB;;;;;;;;;;;OAWG;YACW,OAAO;IA0BrB;;;;;;;;;;;;;;;;OAgBG;YACW,cAAc;CA2E7B;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,CAoBpD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/adt/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAQ9D,OAAO,EACL,KAAK,iBAAiB,EAMvB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAkE5D,oCAAoC;AACpC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,KAAK,IAAI,CAAC;IACtE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,0BAA0B;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,iBAAiB,CAAqE;IAC9F,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,uBAAuB,CAAyB;IACxD,OAAO,CAAC,MAAM,CAAgB;IAC9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS,CAAkC;IACnD,qEAAqE;IACrE,OAAO,CAAC,iBAAiB,CAAS;IAClC,sFAAsF;IACtF,OAAO,CAAC,cAAc,CAAS;IAC/B,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAA6B;IACxE,YAAY,MAAM,EAAE,aAAa,EAAE,0BAA0B,CAAC,EAAE,0BAA0B,EAWzF;IAED,yEAAyE;IACzE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAEhD;IAED,6GAA6G;IAC7G,gBAAgB,IAAI,OAAO,CAE1B;IAED,sHAAsH;IACtH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnD;IAED;;mGAE+F;IAC/F,IAAI,SAAS,IAAI,SAAS,GAAG,SAAS,CAErC;IAED,kBAAkB;IACZ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE3G;IAED,yDAAyD;IACnD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;IAED,yCAAyC;IACnC,IAAI,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,wCAAwC;IAClC,GAAG,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,2CAA2C;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9G;IAED;;;;;;OAMG;IACG,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAYlF;IAED,iFAAiF;YACnE,OAAO;YAoCP,kCAAkC;IAwBhD,gEAAgE;YAClD,YAAY;IA4gB1B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,kBAAkB;IAW1B,yEAAyE;IACzE,OAAO,CAAC,cAAc;IAyCtB;;;OAGG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqI/D;IAED;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;OAOG;IACH,gBAAgB,IAAI,IAAI,CAGvB;IAED;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAqB/B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAKpB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mBAAmB;IAc3B,OAAO,CAAC,YAAY;IAgBpB,mEAAmE;IACnE,OAAO,CAAC,QAAQ;IAkBhB,2FAA2F;IAC3F,OAAO,CAAC,eAAe;IAsBvB;;;;;;;;;;;OAWG;YACW,OAAO;IAgCrB;;;;;;;;;;;;;;;;OAgBG;YACW,cAAc;CA4E7B;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,CAoBpD"}

package/dist/adt/http.js

@@ -33,6 +33,8 @@ import { traceHeaders } from '../server/trace-context.js';
 import { resolveCookies } from './cookies.js';
 import { resolveAcceptType, resolveContentType } from './discovery.js';
 import { AdtApiError, AdtNetworkError } from './errors.js';
+import { awaitWithinRequestBudget, requestBudgetSignal, requestSignal, sleepWithinRequestBudget, throwIfRequestCancelled, } from './http-deadline.js';
+import { prepareDataPreviewWireBody } from './http-wire-body.js';
 /**
  * Opt-in wire-level debug logging.
  *
@@ -95,6 +97,7 @@ export class AdtHttpClient {
     negotiatedHeaders = new Map();
     csrfToken = '';
     dispatcher;
+    longOperationDispatcher;
     config;
     /**
      * Cookie jar — stores Set-Cookie headers from responses and sends them back.
@@ -122,7 +125,7 @@ export class AdtHttpClient {
         // (see doProxyRequest()) — undici 8.x ProxyAgent always uses CONNECT tunneling,
         // which BTP's connectivity proxy doesn't support (HTTP 405).
         if (!config.btpProxy && config.insecure) {
-            this.dispatcher = new Agent({ connect: { rejectUnauthorized: false } });
+            this.dispatcher = new Agent({ connect: { rejectUnauthorized: false }, headersTimeout: 0, bodyTimeout: 0 });
         }
     }
     /** Inject startup discovery data used for proactive MIME negotiation. */
@@ -148,20 +151,20 @@ export class AdtHttpClient {
         return this.request('GET', path, undefined, undefined, headers, options);
     }
     /** HEAD request — lightweight probe, no response body */
-    async head(path, headers) {
-        return this.request('HEAD', path, undefined, undefined, headers);
+    async head(path, headers, options) {
+        return this.request('HEAD', path, undefined, undefined, headers, options);
     }
     /** POST request (includes CSRF token) */
-    async post(path, body, contentType, headers) {
-        return this.request('POST', path, body, contentType, headers);
+    async post(path, body, contentType, headers, options) {
+        return this.request('POST', path, body, contentType, headers, options);
     }
     /** PUT request (includes CSRF token) */
-    async put(path, body, contentType, headers) {
-        return this.request('PUT', path, body, contentType, headers);
+    async put(path, body, contentType, headers, options) {
+        return this.request('PUT', path, body, contentType, headers, options);
     }
     /** DELETE request (includes CSRF token) */
-    async delete(path, headers) {
-        return this.request('DELETE', path, undefined, undefined, headers);
+    async delete(path, headers, options) {
+        return this.request('DELETE', path, undefined, undefined, headers, options);
     }
     /**
      * Execute a function within an isolated stateful session.
@@ -185,43 +188,60 @@ export class AdtHttpClient {
     }
     /** Core request method — wraps requestInner with optional concurrency limiter */
     async request(method, path, body, contentType, extraHeaders, options) {
-        const execute = () => {
-            if (this.config.semaphore) {
-                return this.config.semaphore.run(() => this.requestInner(method, path, body, contentType, extraHeaders, options));
+        throwIfRequestCancelled(options);
+        const execute = async () => {
+            try {
+                if (this.config.semaphore) {
+                    return await this.config.semaphore.run(() => this.requestInner(method, path, body, contentType, extraHeaders, options), requestBudgetSignal(options));
+                }
+                return await this.requestInner(method, path, body, contentType, extraHeaders, options);
+            }
+            catch (error) {
+                if (error instanceof AdtApiError || error instanceof AdtNetworkError)
+                    throw error;
+                if (!options?.signal && options?.deadline === undefined)
+                    throw error;
+                const cause = error instanceof Error ? error : new Error(String(error));
+                throw new AdtNetworkError(cause.message, cause);
             }
-            return this.requestInner(method, path, body, contentType, extraHeaders, options);
         };
         // Shared Basic clients disable 401 retries. Serialize their internal HTTP fan-out as well:
         // feature probes and compound handlers can otherwise start several requests with the same
         // expired password before the first 401 is observed. Once rejected, later requests on this
         // per-call client fail locally and never contact SAP.
         if (this.config.retryUnauthorized === false) {
-            return this.runSerializedAuthenticationAttempt(path, execute);
+            return this.runSerializedAuthenticationAttempt(path, execute, options);
         }
         return execute();
     }
-    async runSerializedAuthenticationAttempt(path, execute) {
+    async runSerializedAuthenticationAttempt(path, execute, options) {
         const previous = this.authenticationAttemptState.tail;
         let release;
         this.authenticationAttemptState.tail = new Promise((resolve) => {
             release = resolve;
         });
-        await previous;
+        let turnStarted = false;
         try {
+            await awaitWithinRequestBudget(previous, options);
+            turnStarted = true;
             if (this.authenticationAttemptState.rejected) {
                 throw new AdtApiError('Shared Basic authentication was already rejected for this request.', 401, path);
             }
             return await execute();
         }
         finally {
-            release();
+            if (turnStarted)
+                release();
+            else
+                void previous.then(release, release);
         }
     }
     /** Inner request method — CSRF, retries, content negotiation */
     async requestInner(method, path, body, contentType, extraHeaders, options) {
+        throwIfRequestCancelled(options);
         // Auto-fetch CSRF token for modifying requests
         if (isModifyingMethod(method) && !this.csrfToken) {
-            await this.fetchCsrfToken();
+            await this.fetchCsrfToken(options);
         }
         const headers = { Accept: '*/*' };
         const negotiationKey = this.normalizeHeaderCacheKey(path);
@@ -253,19 +273,19 @@ export class AdtHttpClient {
         if (this.config.disableSaml) {
             headers['X-SAP-SAML2'] = 'disabled';
         }
-        if (isModifyingMethod(method)) {
-            headers['X-CSRF-Token'] = this.csrfToken;
-        }
         if (this.config.sessionType === 'stateful') {
             headers['X-sap-adt-sessiontype'] = 'stateful';
         }
         if (contentType) {
             headers['Content-Type'] = contentType;
         }
+        // Keep `body` as the logical plaintext for debug audit fields; only `wireBody` is sent.
+        const wireBody = prepareDataPreviewWireBody(this.config.gzipDataPreviewBody === true, method, path, body, headers);
         // Auth: Bearer token (BTP ABAP) or Basic Auth (on-premise)
         this.applyAuthHeader(headers);
         if (this.config.bearerTokenProvider) {
-            const token = await this.config.bearerTokenProvider();
+            throwIfRequestCancelled(options);
+            const token = await awaitWithinRequestBudget(this.config.bearerTokenProvider(), options);
             headers.Authorization = `Bearer ${token}`;
         }
         // Lazy cookie reload: if cookies were cleared on a previous 401,
@@ -273,6 +293,12 @@ export class AdtHttpClient {
         if (this.cookiesCleared && this.isCookieAuthMode()) {
             this.reloadCookiesFromSource();
         }
+        // Read the CSRF token together with the cookie header below — SAP binds the token to the
+        // session cookie, and a concurrent fetchCsrfToken() can replace both across the bearer
+        // await above; a torn pair 403s. The retry paths below already read them adjacently.
+        if (isModifyingMethod(method)) {
+            headers['X-CSRF-Token'] = this.csrfToken;
+        }
         // Build cookie header from config cookies + cookie jar, with the jar winning
         // on a name collision (see composeCookieHeader — issue #293).
         const cookieHeader = this.composeCookieHeader();
@@ -297,7 +323,7 @@ export class AdtHttpClient {
         let authRetried = false;
         let retried429 = false;
         try {
-            let response = await this.doFetch(url, method, headers, body);
+            let response = await this.doFetch(url, method, headers, wireBody, options);
             let responseBody = await response.text();
             // Persist any Set-Cookie headers from the response
             this.storeCookies(response);
@@ -323,7 +349,7 @@ export class AdtHttpClient {
                     this.resetSession();
                     // Re-fetch CSRF token (needed for modifying requests, harmless for reads)
                     if (isModifyingMethod(method)) {
-                        await this.fetchCsrfToken();
+                        await this.fetchCsrfToken(options);
                         headers['X-CSRF-Token'] = this.csrfToken;
                     }
                     // Rebuild cookie header from fresh jar
@@ -337,7 +363,7 @@ export class AdtHttpClient {
                     else {
                         delete headers.Cookie;
                     }
-                    const retryResp = await this.doFetch(url, method, headers, body);
+                    const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                     const retryBody = await retryResp.text();
                     this.storeCookies(retryResp);
                     const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path);
@@ -374,8 +400,8 @@ export class AdtHttpClient {
                     durationMs: Date.now() - httpStart,
                     errorBody: `503 Service Unavailable — retrying in ${Math.round(jitterMs)}ms (${source})`,
                 });
-                await new Promise((resolve) => setTimeout(resolve, jitterMs));
-                const retryResp = await this.doFetch(url, method, headers, body);
+                await sleepWithinRequestBudget(jitterMs, options);
+                const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResp.text();
                 this.storeCookies(retryResp);
                 logger.emitAudit({
@@ -410,8 +436,8 @@ export class AdtHttpClient {
                     durationMs: Date.now() - httpStart,
                     errorBody: `429 Too Many Requests — retrying in ${Math.round(jitterMs)}ms (${source})`,
                 });
-                await new Promise((resolve) => setTimeout(resolve, jitterMs));
-                const retryResp = await this.doFetch(url, method, headers, body);
+                await sleepWithinRequestBudget(jitterMs, options);
+                const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResp.text();
                 this.storeCookies(retryResp);
                 logger.emitAudit({
@@ -454,12 +480,13 @@ export class AdtHttpClient {
                 // Re-apply auth credentials
                 this.applyAuthHeader(headers);
                 if (this.config.bearerTokenProvider) {
-                    const token = await this.config.bearerTokenProvider();
+                    throwIfRequestCancelled(options);
+                    const token = await awaitWithinRequestBudget(this.config.bearerTokenProvider(), options);
                     headers.Authorization = `Bearer ${token}`;
                 }
                 // Re-fetch CSRF token for modifying requests
                 if (isModifyingMethod(method)) {
-                    await this.fetchCsrfToken();
+                    await this.fetchCsrfToken(options);
                     headers['X-CSRF-Token'] = this.csrfToken;
                 }
                 // Rebuild cookie header from config cookies + fresh jar (jar wins).
@@ -470,7 +497,7 @@ export class AdtHttpClient {
                 else {
                     delete headers.Cookie;
                 }
-                response = await this.doFetch(url, method, headers, body);
+                response = await this.doFetch(url, method, headers, wireBody, options);
                 responseBody = await response.text();
                 this.storeCookies(response);
                 logger.emitAudit({
@@ -492,7 +519,7 @@ export class AdtHttpClient {
             }
             // Handle CSRF token refresh on 403 (modifying requests only)
             if (response.status === 403 && isModifyingMethod(method)) {
-                await this.fetchCsrfToken();
+                await this.fetchCsrfToken(options);
                 headers['X-CSRF-Token'] = this.csrfToken;
                 // Update cookie header after CSRF fetch may have set new cookies. Use the
                 // merged builder (jar wins) so auth cookies in config.cookies (e.g.
@@ -501,7 +528,7 @@ export class AdtHttpClient {
                 if (csrfRefreshedCookieHeader) {
                     headers.Cookie = csrfRefreshedCookieHeader;
                 }
-                const retryResponse = await this.doFetch(url, method, headers, body);
+                const retryResponse = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResponse.text();
                 this.storeCookies(retryResponse);
                 const result = this.handleResponse(retryResponse.status, retryResponse.headers, retryBody, path);
@@ -570,7 +597,7 @@ export class AdtHttpClient {
                         durationMs: Date.now() - httpStart,
                         errorBody: `Content negotiation ${response.status} — retrying with fallback headers`,
                     });
-                    const retryResp = await this.doFetch(url, method, fallbackHeaders, body);
+                    const retryResp = await this.doFetch(url, method, fallbackHeaders, wireBody, options);
                     const retryBody = await retryResp.text();
                     this.storeCookies(retryResp);
                     // Store CSRF token from retry response
@@ -657,6 +684,8 @@ export class AdtHttpClient {
                 });
                 throw err;
             }
+            if (err instanceof AdtNetworkError)
+                throw err;
             const message = err instanceof Error ? err.message : String(err);
             throw new AdtNetworkError(message, err instanceof Error ? err : undefined);
         }
@@ -729,7 +758,8 @@ export class AdtHttpClient {
      * Fetch CSRF token from SAP.
      * Uses HEAD /sap/bc/adt/core/discovery for speed.
      */
-    async fetchCsrfToken() {
+    async fetchCsrfToken(options) {
+        throwIfRequestCancelled(options);
         const url = this.buildUrl('/sap/bc/adt/core/discovery');
         const headers = {
             'X-CSRF-Token': 'fetch',
@@ -744,7 +774,8 @@ export class AdtHttpClient {
         // Auth: Bearer token (BTP ABAP) or Basic Auth (on-premise)
         this.applyAuthHeader(headers);
         if (this.config.bearerTokenProvider) {
-            const token = await this.config.bearerTokenProvider();
+            throwIfRequestCancelled(options);
+            const token = await awaitWithinRequestBudget(this.config.bearerTokenProvider(), options);
             headers.Authorization = `Bearer ${token}`;
         }
         // Principal Propagation via SAP-Connectivity-Authentication header (Option 2).
@@ -765,7 +796,7 @@ export class AdtHttpClient {
             headers.Cookie = cookieHeader;
         }
         try {
-            let response = await this.doFetch(url, 'HEAD', headers);
+            let response = await this.doFetch(url, 'HEAD', headers, undefined, options);
             // Retry once on 503 — ICM may be temporarily overloaded (thread/MPI exhaustion)
             if (response.status === 503) {
                 const jitterMs = 1000 + Math.random() * 1000;
@@ -779,8 +810,8 @@ export class AdtHttpClient {
                     durationMs: 0,
                     errorBody: `CSRF fetch got 503 — retrying in ${Math.round(jitterMs)}ms`,
                 });
-                await new Promise((resolve) => setTimeout(resolve, jitterMs));
-                response = await this.doFetch(url, 'HEAD', headers);
+                await sleepWithinRequestBudget(jitterMs, options);
+                response = await this.doFetch(url, 'HEAD', headers, undefined, options);
             }
             // Preserve any session established by HEAD before deciding whether GET is needed.
             // The fallback request must use the same SAP session as the eventual write.
@@ -810,7 +841,7 @@ export class AdtHttpClient {
                         ? 'CSRF HEAD returned 403 — retrying with GET (S/4HANA Public Cloud compat)'
                         : 'CSRF HEAD returned no usable token — retrying with GET',
                 });
-                response = await this.doFetch(url, 'GET', headers);
+                response = await this.doFetch(url, 'GET', headers, undefined, options);
             }
             // Store cookies from the final CSRF response — critical for session correlation.
             this.storeCookies(response);
@@ -831,7 +862,7 @@ export class AdtHttpClient {
             this.csrfToken = token;
         }
         catch (err) {
-            if (err instanceof AdtApiError)
+            if (err instanceof AdtApiError || err instanceof AdtNetworkError)
                 throw err;
             const message = err instanceof Error ? err.message : String(err);
             throw new AdtNetworkError(`CSRF token fetch failed: ${message}`, err instanceof Error ? err : undefined);
@@ -1018,22 +1049,27 @@ export class AdtHttpClient {
      * Node 22's built-in fetch embeds an older undici version whose dispatcher
      * interface is incompatible with npm undici@8 Agent/ProxyAgent instances.
      */
-    async doFetch(url, method, headers, body) {
+    async doFetch(url, method, headers, body, options) {
+        throwIfRequestCancelled(options);
         // Forward the caller's W3C trace context to SAP so one trace spans agent → ARC-1 → SAP.
         // Empty unless the MCP client sent a valid `traceparent`; ARC-1 never originates a trace.
         // Injected here because doFetch is the single outbound choke point (the proxy branch below
         // spreads these headers too).
         const outbound = { ...headers, ...traceHeaders(getCurrentContext()) };
-        // BTP Connectivity proxy: use standard HTTP proxy protocol (not CONNECT)
         if (this.config.btpProxy) {
-            return this.doProxyRequest(url, method, outbound, body);
+            return this.doProxyRequest(url, method, outbound, body, options);
         }
+        // Let the explicit operation budget override undici's 300-second header timeout.
+        const dispatcher = this.dispatcher ??
+            (options?.fetchTimeoutMs === undefined
+                ? undefined
+                : (this.longOperationDispatcher ??= new Agent({ headersTimeout: 0, bodyTimeout: 0 })));
         return undiciFetch(url, {
             method,
             headers: outbound,
             body,
-            signal: AbortSignal.timeout(120_000),
-            ...(this.dispatcher ? { dispatcher: this.dispatcher } : {}),
+            signal: requestSignal(options),
+            ...(dispatcher ? { dispatcher } : {}),
         });
     }
     /**
@@ -1053,19 +1089,18 @@ export class AdtHttpClient {
      * to the proxy, and by setting the `path` to the full target URL, the proxy
      * forwards it to the Cloud Connector → on-premise SAP system.
      */
-    async doProxyRequest(url, method, headers, body) {
+    async doProxyRequest(url, method, headers, body, options) {
         const proxy = this.config.btpProxy;
         const proxyOrigin = `${proxy.protocol}://${proxy.host}:${proxy.port}`;
-        // Get proxy auth token
         let proxyAuth;
+        throwIfRequestCancelled(options);
         if (this.config.ppProxyAuth) {
             proxyAuth = this.config.ppProxyAuth;
         }
         else {
-            const proxyToken = await proxy.getProxyToken();
+            const proxyToken = await awaitWithinRequestBudget(proxy.getProxyToken(), options);
             proxyAuth = `Bearer ${proxyToken}`;
         }
-        // Extract host from target URL for the Host header
         const targetUrl = new URL(url);
         const hostHeader = targetUrl.port ? `${targetUrl.hostname}:${targetUrl.port}` : targetUrl.hostname;
         // Merge proxy headers with request headers
@@ -1079,7 +1114,8 @@ export class AdtHttpClient {
         if (proxy.locationId) {
             proxyHeaders['SAP-Connectivity-SCC-Location_ID'] = proxy.locationId;
         }
-        const client = new Client(proxyOrigin);
+        const clientOptions = options?.fetchTimeoutMs === undefined ? undefined : { headersTimeout: 0, bodyTimeout: 0 };
+        const client = new Client(proxyOrigin, clientOptions);
         try {
             const resp = await client.request({
                 method: method,
@@ -1087,7 +1123,7 @@ export class AdtHttpClient {
                 path: url,
                 headers: proxyHeaders,
                 body: body ?? undefined,
-                signal: AbortSignal.timeout(120_000),
+                signal: requestSignal(options),
             });
             // Convert undici response to a Response-like object that matches
             // what fetch() returns, so the rest of AdtHttpClient works unchanged.