arc-1 1.6.0 → 1.8.0

package/dist/adt/http-retry-after.js

@@ -0,0 +1,37 @@
+/**
+ * Parse RFC 7231 `Retry-After` header into a delay in milliseconds.
+ *
+ * Accepts both forms allowed by the spec:
+ * - delta-seconds (e.g. `"5"`)
+ * - HTTP-date (e.g. `"Wed, 12 May 2026 14:30:00 GMT"`)
+ *
+ * On missing, NaN, malformed, past-date, or negative input, falls back to `fallbackMs`.
+ * Always clamps to `[0, 60_000]` ms so a misbehaving gateway can't stall us indefinitely
+ * and a too-small/past value can't degenerate into a hot retry loop.
+ *
+ * Returns `{ delayMs, source }` — `source: 'header' | 'fallback'` lets audit events
+ * record whether the delay came from the server or from our jitter floor (useful for
+ * capacity tuning).
+ */
+export function parseRetryAfter(header, fallbackMs) {
+    const clamp = (ms) => Math.max(0, Math.min(60_000, ms));
+    if (header == null || header === '') {
+        return { delayMs: clamp(fallbackMs), source: 'fallback' };
+    }
+    const trimmed = header.trim();
+    // delta-seconds form: integer (and only digits, optionally signed)
+    if (/^-?\d+$/.test(trimmed)) {
+        const seconds = Number.parseInt(trimmed, 10);
+        if (Number.isFinite(seconds)) {
+            return { delayMs: clamp(seconds * 1000), source: 'header' };
+        }
+        return { delayMs: clamp(fallbackMs), source: 'fallback' };
+    }
+    // HTTP-date form
+    const epochMs = Date.parse(trimmed);
+    if (Number.isFinite(epochMs)) {
+        return { delayMs: clamp(epochMs - Date.now()), source: 'header' };
+    }
+    return { delayMs: clamp(fallbackMs), source: 'fallback' };
+}
+//# sourceMappingURL=http-retry-after.js.map

package/dist/adt/http-retry-after.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-retry-after.js","sourceRoot":"","sources":["../../src/adt/http-retry-after.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAiC,EACjC,UAAkB;IAElB,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACxE,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,mEAAmE;IACnE,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IACD,iBAAiB;IACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC5D,CAAC"}

package/dist/adt/http.d.ts

@@ -9,6 +9,7 @@ import type { BTPProxyConfig } from '@arc-mcp/xsuaa-auth/btp';
 import { type AdtRequestOptions } from './http-deadline.js';
 import type { Semaphore } from './semaphore.js';
 export type { AdtRequestOptions } from './http-deadline.js';
+export { parseRetryAfter } from './http-retry-after.js';
 /** Session type for ADT requests */
 export type SessionType = 'stateful' | 'stateless' | undefined;
 /** Configuration for the ADT HTTP client */
@@ -106,6 +107,8 @@ export declare class AdtHttpClient {
     private dbRetryInProgress;
     /** Set after a 401 clears stale cookies — triggers file reload on the next request */
     private cookiesCleared;
+    /** Keeps a cold client at one SAP security session (see security-session-gate.ts). */
+    private readonly securitySessionGate;
     /** Shared by stateful clones so one rejected Basic credential cannot fan out internally. */
     private readonly authenticationAttemptState;
     constructor(config: AdtHttpConfig, authenticationAttemptState?: AuthenticationAttemptState);
@@ -136,7 +139,11 @@ export declare class AdtHttpClient {
      * Creates a new client instance with the stateful session header,
      * shares the main client's request state, and closes the backend context.
      */
-    withStatefulSession<T>(fn: (client: AdtHttpClient) => Promise<T>): Promise<T>;
+    withStatefulSession<T>(fn: (client: AdtHttpClient) => Promise<T>, cleanup?: {
+        timeoutMs: number;
+        noReplay: boolean;
+        onClose: (closed: boolean | undefined) => void;
+    }): Promise<T>;
     /** Close the SAP application context without changing the completed operation's result. */
     private closeStatefulSession;
     /** Core request method — wraps requestInner with optional concurrency limiter */
@@ -221,6 +228,8 @@ export declare class AdtHttpClient {
      * `config.cookies` and survive untouched. Returns undefined when empty.
      */
     private composeCookieHeader;
+    /** Read the current pair together after a wait or a response that can rotate the session. */
+    private refreshSessionHeaders;
     private storeCookies;
     /** Add SAP context query params unless the caller sends that context in headers. */
     private buildUrl;
@@ -239,6 +248,7 @@ export declare class AdtHttpClient {
      * interface is incompatible with npm undici@8 Agent/ProxyAgent instances.
      */
     private doFetch;
+    private sendRequest;
     /**
      * Execute an HTTP request through the BTP connectivity proxy using standard
      * HTTP proxy protocol (RFC 7230).
@@ -258,23 +268,4 @@ export declare class AdtHttpClient {
      */
     private doProxyRequest;
 }
-/**
- * Parse RFC 7231 `Retry-After` header into a delay in milliseconds.
- *
- * Accepts both forms allowed by the spec:
- * - delta-seconds (e.g. `"5"`)
- * - HTTP-date (e.g. `"Wed, 12 May 2026 14:30:00 GMT"`)
- *
- * On missing, NaN, malformed, past-date, or negative input, falls back to `fallbackMs`.
- * Always clamps to `[0, 60_000]` ms so a misbehaving gateway can't stall us indefinitely
- * and a too-small/past value can't degenerate into a hot retry loop.
- *
- * Returns `{ delayMs, source }` — `source: 'header' | 'fallback'` lets audit events
- * record whether the delay came from the server or from our jitter floor (useful for
- * capacity tuning).
- */
-export declare function parseRetryAfter(header: string | null | undefined, fallbackMs: number): {
-    delayMs: number;
-    source: 'header' | 'fallback';
-};
 //# sourceMappingURL=http.d.ts.map

package/dist/adt/http.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/adt/http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU9D,OAAO,EACL,KAAK,iBAAiB,EAOvB,MAAM,oBAAoB,CAAC;AAI5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAmE5D,oCAAoC;AACpC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,KAAK,IAAI,CAAC;IACtE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,0BAA0B;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,iBAAiB,CAAqE;IAC9F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,uBAAuB,CAAyB;IACxD,OAAO,CAAC,mBAAmB,CAAqB;IAEhD,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAgB;IAC9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS,CAAkC;IACnD,qEAAqE;IACrE,OAAO,CAAC,iBAAiB,CAAS;IAClC,sFAAsF;IACtF,OAAO,CAAC,cAAc,CAAS;IAC/B,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAA6B;IACxE,YAAY,MAAM,EAAE,aAAa,EAAE,0BAA0B,CAAC,EAAE,0BAA0B,EAYzF;IAED,yEAAyE;IACzE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAEhD;IAED,6GAA6G;IAC7G,gBAAgB,IAAI,OAAO,CAE1B;IAED,sHAAsH;IACtH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnD;IAED;;mGAE+F;IAC/F,IAAI,SAAS,IAAI,SAAS,GAAG,SAAS,CAErC;IAED,kBAAkB;IACZ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE3G;IAED,yDAAyD;IACnD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;IAED,yCAAyC;IACnC,IAAI,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,wCAAwC;IAClC,GAAG,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,2CAA2C;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9G;IAED;;;;;;OAMG;IACG,mBAAmB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAuBlF;IAED,2FAA2F;YAC7E,oBAAoB;IA+BlC,iFAAiF;YACnE,OAAO;YA0CP,kCAAkC;IAwBhD,gEAAgE;YAClD,YAAY;IAqgB1B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,kBAAkB;IAW1B,yEAAyE;IACzE,OAAO,CAAC,cAAc;IA2CtB;;;;OAIG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwIjE;IAED;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,mBAAmB;IAO3B;;;;;;;OAOG;IACH,gBAAgB,IAAI,IAAI,CAGvB;IAED;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAqB/B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAKpB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mBAAmB;IAc3B,OAAO,CAAC,YAAY;IAgBpB,oFAAoF;IACpF,OAAO,CAAC,QAAQ;IAkBhB,2FAA2F;IAC3F,OAAO,CAAC,eAAe;IAsBvB;;;;;;;;;;;OAWG;YACW,OAAO;IAyCrB;;;;;;;;;;;;;;;;OAgBG;YACW,cAAc;CA2E7B;AAOD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,UAAU,EAAE,MAAM,GACjB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAA;CAAE,CAoBpD"}
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../../src/adt/http.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAU9D,OAAO,EACL,KAAK,iBAAiB,EAOvB,MAAM,oBAAoB,CAAC;AAM5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAGhD,YAAY,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAmExD,oCAAoC;AACpC,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;AAE/D,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,4EAA4E;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+EAA+E;IAC/E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,yEAAyE;IACzE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,GAAG,CAAA;KAAE,KAAK,IAAI,CAAC;IACtE,0DAA0D;IAC1D,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAED,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,0BAA0B;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;CACrB;AAED;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,iBAAiB,CAAqE;IAC9F,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,SAAS,CAAM;IACvB,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,uBAAuB,CAAyB;IACxD,OAAO,CAAC,mBAAmB,CAAqB;IAEhD,OAAO,CAAC,wBAAwB,CAAS;IACzC,OAAO,CAAC,MAAM,CAAgB;IAC9B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,SAAS,CAAkC;IACnD,qEAAqE;IACrE,OAAO,CAAC,iBAAiB,CAAS;IAClC,sFAAsF;IACtF,OAAO,CAAC,cAAc,CAAS;IAC/B,sFAAsF;IACtF,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA6B;IACjE,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,0BAA0B,CAA6B;IACxE,YAAY,MAAM,EAAE,aAAa,EAAE,0BAA0B,CAAC,EAAE,0BAA0B,EAYzF;IAED,yEAAyE;IACzE,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAEhD;IAED,6GAA6G;IAC7G,gBAAgB,IAAI,OAAO,CAE1B;IAED,sHAAsH;IACtH,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEnD;IAED;;mGAE+F;IAC/F,IAAI,SAAS,IAAI,SAAS,GAAG,SAAS,CAErC;IAED,kBAAkB;IACZ,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE3G;IAED,yDAAyD;IACnD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE5G;IAED,yCAAyC;IACnC,IAAI,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,wCAAwC;IAClC,GAAG,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,WAAW,CAAC,CAEtB;IAED,2CAA2C;IACrC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9G;IAED;;;;;;OAMG;IACG,mBAAmB,CAAC,CAAC,EACzB,EAAE,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,EACzC,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,GAAG,SAAS,KAAK,IAAI,CAAA;KAAE,GACjG,OAAO,CAAC,CAAC,CAAC,CAiCZ;IAED,2FAA2F;YAC7E,oBAAoB;IAiClC,iFAAiF;YACnE,OAAO;YA2CP,kCAAkC;IAwBhD,gEAAgE;YAClD,YAAY;IAigB1B,OAAO,CAAC,uBAAuB;IAO/B,OAAO,CAAC,wBAAwB;IAiBhC,OAAO,CAAC,kBAAkB;IAW1B,yEAAyE;IACzE,OAAO,CAAC,cAAc;IA2CtB;;;;OAIG;IACG,cAAc,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0IjE;IAED;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IAIxB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,OAAO,CAAC,mBAAmB;IAM3B;;;;;;;OAOG;IACH,gBAAgB,IAAI,IAAI,CAGvB;IAED;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAqB/B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAMpB;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,mBAAmB;IAc3B,6FAA6F;IAC7F,OAAO,CAAC,qBAAqB;IAO7B,OAAO,CAAC,YAAY;IAapB,oFAAoF;IACpF,OAAO,CAAC,QAAQ;IAkBhB,2FAA2F;IAC3F,OAAO,CAAC,eAAe;IAsBvB;;;;;;;;;;;OAWG;YACW,OAAO;YAuCP,WAAW;IAyCzB;;;;;;;;;;;;;;;;OAgBG;YACW,cAAc;CA2E7B"}

package/dist/adt/http.js

@@ -15,10 +15,13 @@ import { resolveCookies } from './cookies.js';
 import { resolveAcceptType, resolveContentType } from './discovery.js';
 import { AdtApiError, AdtNetworkError, AdtResponseLimitError } from './errors.js';
 import { awaitWithinRequestBudget, requestBudgetSignal, requestSignal, sleepWithinRequestBudget, throwIfRequestCancelled, withoutResponseBudget, } from './http-deadline.js';
+import { parseRetryAfter } from './http-retry-after.js';
 import { prepareDataPreviewWireBody } from './http-wire-body.js';
 import { legacyContentHandlerFallback, rejectEmptyAdtHtmlResponse } from './legacy-content-handler.js';
 import { fetchWithAttemptBudget } from './request-attempt-budget.js';
+import { hasSecuritySessionCookie, SecuritySessionGate } from './security-session-gate.js';
 import { resolveSapUserAgent } from './user-agent.js';
+export { parseRetryAfter } from './http-retry-after.js';
 /**
  * Opt-in wire-level debug logging.
  *
@@ -104,6 +107,8 @@ export class AdtHttpClient {
     dbRetryInProgress = false;
     /** Set after a 401 clears stale cookies — triggers file reload on the next request */
     cookiesCleared = false;
+    /** Keeps a cold client at one SAP security session (see security-session-gate.ts). */
+    securitySessionGate = new SecuritySessionGate();
     /** Shared by stateful clones so one rejected Basic credential cannot fan out internally. */
     authenticationAttemptState;
     constructor(config, authenticationAttemptState) {
@@ -163,7 +168,7 @@ export class AdtHttpClient {
      * Creates a new client instance with the stateful session header,
      * shares the main client's request state, and closes the backend context.
      */
-    async withStatefulSession(fn) {
+    async withStatefulSession(fn, cleanup) {
         const sessionConfig = {
             ...this.config,
             sessionType: 'stateful',
@@ -172,6 +177,7 @@ export class AdtHttpClient {
         // Share CSRF token and cookies so we don't need to re-fetch
         sessionClient.csrfToken = this.csrfToken;
         sessionClient.cookieJar = new Map(this.cookieJar);
+        sessionClient.cookieJar.delete('sap-contextid'); // A new write must open its own application context.
         sessionClient.discoveryMap = this.discoveryMap;
         sessionClient.negotiatedHeaders = new Map(this.negotiatedHeaders);
         sessionClient.reuseStatefulProxyClient = true;
@@ -179,7 +185,14 @@ export class AdtHttpClient {
             return await fn(sessionClient);
         }
         finally {
-            await sessionClient.closeStatefulSession();
+            const closed = await sessionClient.closeStatefulSession(cleanup
+                ? {
+                    deadline: Date.now() + cleanup.timeoutMs,
+                    retryTransientErrors: false,
+                    noReplay: cleanup.noReplay,
+                }
+                : undefined);
+            cleanup?.onClose(closed);
             try {
                 await sessionClient.statefulProxyClient?.close();
             }
@@ -189,7 +202,7 @@ export class AdtHttpClient {
         }
     }
     /** Close the SAP application context without changing the completed operation's result. */
-    async closeStatefulSession() {
+    async closeStatefulSession(options) {
         const contextId = this.cookieJar.get('sap-contextid');
         if (!contextId || contextId === '0')
             return;
@@ -198,24 +211,26 @@ export class AdtHttpClient {
         this.config.sessionType = 'stateless';
         try {
             try {
-                await this.get('/sap/bc/adt/core/http/sessions', { Accept: '*/*', 'sap-adt-purpose': 'close-session', 'sap-contextid': contextId }, { probe: true });
-                return;
+                await this.get('/sap/bc/adt/core/http/sessions', { Accept: '*/*', 'sap-adt-purpose': 'close-session', 'sap-contextid': contextId }, { probe: true, ...options });
+                return true;
             }
             catch (error) {
                 if (!(error instanceof AdtApiError && error.statusCode === 404))
                     throw error;
             }
             // NW 7.50 lacks the close resource; its stateful-header backport closes on discovery instead.
-            await this.head('/sap/bc/adt/core/discovery', { Accept: '*/*' }, { probe: true });
+            await this.head('/sap/bc/adt/core/discovery', { Accept: '*/*' }, { probe: true, ...options });
+            return true;
         }
         catch (error) {
             // NW 7.50 can return 400 after closing. The reset cookie confirms that cleanup succeeded.
             if (this.cookieJar.get('sap-contextid') === '0')
-                return;
+                return true;
             // Preserve the write result/error and keep SAP response text out of cleanup warnings.
             logger.warn('Failed to close stateful ADT session.', {
                 statusCode: error instanceof AdtApiError ? error.statusCode : undefined,
             });
+            return false;
         }
     }
     /** Core request method — wraps requestInner with optional concurrency limiter */
@@ -236,6 +251,8 @@ export class AdtHttpClient {
                 }
                 if (!options?.signal && options?.deadline === undefined)
                     throw error;
+                if (options?.signal?.aborted)
+                    throwIfRequestCancelled(options);
                 const cause = error instanceof Error ? error : new Error(String(error));
                 throw new AdtNetworkError(cause.message, cause);
             }
@@ -364,15 +381,13 @@ export class AdtHttpClient {
         const url = this.buildUrl(path, sapContextInHeaders);
         const httpStart = Date.now();
         // Per-request guards to prevent infinite retry loops
-        const retryTransientErrors = options?.retryTransientErrors !== false;
+        const retryTransientErrors = options?.noReplay !== true && options?.retryTransientErrors !== false;
         let negotiationRetried = false;
         let authRetried = false;
         let retried429 = false;
         try {
-            let response = await this.doFetch(url, method, headers, wireBody, options);
+            let response = await this.doFetch(url, method, headers, wireBody, options, this.config.retryUnauthorized !== false && options?.noReplay !== true);
             let responseBody = await response.text();
-            // Persist any Set-Cookie headers from the response
-            this.storeCookies(response);
             // Detect broken DB connection on the assigned work process.
             // SAP's ICM routes all requests with the same session cookie to the same
             // work process. If that WP has a broken HANA connection, every request fails
@@ -414,7 +429,6 @@ export class AdtHttpClient {
                     }
                     const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                     const retryBody = await retryResp.text();
-                    this.storeCookies(retryResp);
                     const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path, expectBody);
                     logger.emitAudit({
                         timestamp: new Date().toISOString(),
@@ -448,9 +462,9 @@ export class AdtHttpClient {
                     errorBody: `503 Service Unavailable — retrying in ${Math.round(jitterMs)}ms (${source})`,
                 });
                 await sleepWithinRequestBudget(jitterMs, options);
+                this.refreshSessionHeaders(method, headers);
                 const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResp.text();
-                this.storeCookies(retryResp);
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
                     level: retryResp.status === 503 ? 'warn' : 'info',
@@ -480,9 +494,9 @@ export class AdtHttpClient {
                     errorBody: `429 Too Many Requests — retrying in ${Math.round(jitterMs)}ms (${source})`,
                 });
                 await sleepWithinRequestBudget(jitterMs, options);
+                this.refreshSessionHeaders(method, headers);
                 const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResp.text();
-                this.storeCookies(retryResp);
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
                     level: retryResp.status === 429 ? 'warn' : 'info',
@@ -499,7 +513,10 @@ export class AdtHttpClient {
             // Uses per-request guard (not instance-level) so concurrent requests each get their own retry.
             // On success, reassigns response/responseBody and falls through to downstream handlers
             // (403 CSRF, 406/415 negotiation) so combined-failure recovery works.
-            if (response.status === 401 && !authRetried && this.config.retryUnauthorized !== false) {
+            if (response.status === 401 &&
+                !authRetried &&
+                this.config.retryUnauthorized !== false &&
+                options?.noReplay !== true) {
                 authRetried = true;
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
@@ -511,8 +528,6 @@ export class AdtHttpClient {
                     durationMs: Date.now() - httpStart,
                     errorBody: '401 session expired — resetting session and retrying',
                 });
-                // Clear session to force fresh authentication
-                this.resetSession();
                 // Pick up an out-of-band rotated cookie file so the call that observes the
                 // expiry can recover; the lazy `cookiesCleared` reload stays the fallback.
                 // `cookieFile`, not `isCookieAuthMode()` — cookieString has nothing to re-read,
@@ -542,7 +557,6 @@ export class AdtHttpClient {
                 }
                 response = await this.doFetch(url, method, headers, wireBody, options);
                 responseBody = await response.text();
-                this.storeCookies(response);
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
                     level: 'info',
@@ -561,7 +575,7 @@ export class AdtHttpClient {
                 // Fall through to downstream handlers (403/406/415/normal)
             }
             // Handle CSRF token refresh on 403 (modifying requests only)
-            if (response.status === 403 && isModifyingMethod(method)) {
+            if (options?.noReplay !== true && response.status === 403 && isModifyingMethod(method)) {
                 await this.fetchCsrfToken(withoutResponseBudget(options));
                 headers['X-CSRF-Token'] = this.csrfToken;
                 // Update cookie header after CSRF fetch may have set new cookies. Use the
@@ -573,12 +587,13 @@ export class AdtHttpClient {
                 }
                 response = await this.doFetch(url, method, headers, wireBody, options);
                 responseBody = await response.text();
-                this.storeCookies(response);
                 // A refreshed session can still need legacy content negotiation below (#996).
             }
             // Retry negotiation once, including the narrowly matched NW 7.40 handler error.
             const legacyFallback = legacyContentHandlerFallback(response.status, responseBody, method, negotiationKey, headers);
-            if ((response.status === 406 || response.status === 415 || legacyFallback) && !negotiationRetried) {
+            if (options?.noReplay !== true &&
+                (response.status === 406 || response.status === 415 || legacyFallback) &&
+                !negotiationRetried) {
                 negotiationRetried = true;
                 const fallbackHeaders = { ...headers };
                 let headersChanged = false;
@@ -621,14 +636,9 @@ export class AdtHttpClient {
                         durationMs: Date.now() - httpStart,
                         errorBody: `Content negotiation ${response.status} — retrying with fallback headers`,
                     });
+                    this.refreshSessionHeaders(method, fallbackHeaders);
                     const retryResp = await this.doFetch(url, method, fallbackHeaders, wireBody, options);
                     const retryBody = await retryResp.text();
-                    this.storeCookies(retryResp);
-                    // Store CSRF token from retry response
-                    const retryToken = retryResp.headers.get('x-csrf-token');
-                    if (retryToken && retryToken !== 'Required') {
-                        this.csrfToken = retryToken;
-                    }
                     const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path, expectBody);
                     const currentContentType = contentType ?? headers['Content-Type'];
                     const negotiated = {};
@@ -656,11 +666,6 @@ export class AdtHttpClient {
                 }
                 // No meaningful header change — fall through to normal error handling
             }
-            // Store CSRF token from response
-            const responseToken = response.headers.get('x-csrf-token');
-            if (responseToken && responseToken !== 'Required') {
-                this.csrfToken = responseToken;
-            }
             const result = this.handleResponse(response.status, response.headers, responseBody, path, expectBody);
             logger.emitAudit({
                 timestamp: new Date().toISOString(),
@@ -711,6 +716,8 @@ export class AdtHttpClient {
             }
             if (err instanceof AdtNetworkError || err instanceof AdtResponseLimitError)
                 throw err;
+            if (options?.signal?.aborted)
+                throwIfRequestCancelled(options);
             const message = err instanceof Error ? err.message : String(err);
             throw new AdtNetworkError(message, err instanceof Error ? err : undefined);
         }
@@ -818,12 +825,6 @@ export class AdtHttpClient {
         if (this.cookiesCleared && this.isCookieAuthMode()) {
             this.reloadCookiesFromSource();
         }
-        // A token only counts as proof when the response itself succeeded: SAP returns one on
-        // failures too, and the old code accepted a token from a 401 — masking the auth error.
-        const usableToken = (response) => {
-            const token = response.headers.get('x-csrf-token')?.trim();
-            return response.ok && token && token.toLowerCase() !== 'required' ? token : undefined;
-        };
         // Every probe keeps the same identity, current cookies and caller's request budget.
         const probe = async (method) => {
             const cookieHeader = this.composeCookieHeader();
@@ -833,7 +834,6 @@ export class AdtHttpClient {
                 delete headers.Cookie;
             const started = Date.now();
             const response = await this.doFetch(this.buildUrl(path), method, headers, undefined, options);
-            this.storeCookies(response);
             logger.emitAudit({
                 timestamp: new Date().toISOString(),
                 level: 'debug',
@@ -842,11 +842,11 @@ export class AdtHttpClient {
                 path,
                 statusCode: response.status,
                 durationMs: Date.now() - started,
-                success: !!usableToken(response),
-                adtMode: this.config.sessionType ?? 'unspecified',
-                hasContext: /(?:^|;\s*)sap-contextid=/.test(cookieHeader ?? ''),
+                success: !!usableCsrfToken(response),
+                adtMode: headers['X-sap-adt-sessiontype'] === undefined ? 'unspecified' : (this.config.sessionType ?? 'unspecified'),
+                hasContext: /(?:^|;\s*)sap-contextid=/.test(headers.Cookie ?? ''),
             });
-            if (method === 'GET' && response.status === 200 && !usableToken(response)) {
+            if (method === 'GET' && response.status === 200 && !usableCsrfToken(response)) {
                 // Check login pages, but preserve the header-only legacy discovery fallback.
                 this.handleResponse(response.status, response.headers, await response.text(), path, false);
             }
@@ -877,16 +877,23 @@ export class AdtHttpClient {
             // The tested 7.50/7.58/8.16 systems returned HEAD 400 with a token; GET returned 200.
             // Retry these HEAD refusals or a successful response without a token on the same path.
             // A successful HEAD with a usable token remains the one-request fast path.
-            if ([400, 403, 405].includes(response.status) || (response.ok && !usableToken(response))) {
+            const headStatus = response.status;
+            if ([400, 403, 405].includes(response.status) || (response.ok && !usableCsrfToken(response))) {
+                response = await probe('GET');
+            }
+            // Both stateful discovery probes can fail on affected routes (#1044). Bootstrap once
+            // without that header; keep identity/cookies and subsequent lock/write requests stateful.
+            if (this.config.sessionType === 'stateful' && headStatus === 400 && response.status === 400) {
+                delete headers['X-sap-adt-sessiontype'];
                 response = await probe('GET');
             }
             // Older ADT handlers may return an empty 200 for a missing core resource (#817).
             // A real auth/server failure must not be hidden by trying another endpoint.
-            if (response.status === 404 || response.status === 405 || (response.ok && !usableToken(response))) {
+            if (response.status === 404 || response.status === 405 || (response.ok && !usableCsrfToken(response))) {
                 path = '/sap/bc/adt/discovery';
                 response = await probe('GET');
             }
-            const token = usableToken(response);
+            const token = usableCsrfToken(response);
             if (!token) {
                 if (response.status === 401) {
                     if (this.isCookieAuthMode())
@@ -899,12 +906,13 @@ export class AdtHttpClient {
                 }
                 throw new AdtApiError(`No CSRF token in response (HTTP ${response.status})`, response.status, path);
             }
-            this.csrfToken = token;
             return path;
         }
         catch (err) {
             if (err instanceof AdtApiError || err instanceof AdtNetworkError)
                 throw err;
+            if (options?.signal?.aborted)
+                throwIfRequestCancelled(options);
             const message = err instanceof Error ? err.message : String(err);
             throw new AdtNetworkError(`CSRF token fetch failed: ${message}`, err instanceof Error ? err : undefined);
         }
@@ -943,8 +951,7 @@ export class AdtHttpClient {
      */
     clearCookiesAndMark() {
         this.config.cookies = {};
-        this.cookieJar.clear();
-        this.csrfToken = '';
+        this.resetSession();
         this.cookiesCleared = true;
     }
     /**
@@ -993,6 +1000,7 @@ export class AdtHttpClient {
     resetSession() {
         this.cookieJar.clear();
         this.csrfToken = '';
+        this.securitySessionGate.reset();
     }
     /**
      * Build the `Cookie` request header by merging the static `config.cookies`
@@ -1025,11 +1033,18 @@ export class AdtHttpClient {
             return undefined;
         return Array.from(merged, ([name, value]) => `${name}=${value}`).join('; ');
     }
+    /** Read the current pair together after a wait or a response that can rotate the session. */
+    refreshSessionHeaders(method, headers) {
+        const cookie = this.composeCookieHeader();
+        if (cookie)
+            headers.Cookie = cookie;
+        else
+            delete headers.Cookie;
+        if (isModifyingMethod(method))
+            headers['X-CSRF-Token'] = this.csrfToken;
+    }
     storeCookies(response) {
-        const setCookieHeaders = response.headers.getSetCookie();
-        if (!setCookieHeaders || setCookieHeaders.length === 0)
-            return;
-        for (const cookie of setCookieHeaders) {
+        for (const cookie of response.headers.getSetCookie() ?? []) {
             // Set-Cookie: name=value; Path=/; HttpOnly; ...
             const nameValue = cookie.split(';')[0];
             if (!nameValue)
@@ -1090,7 +1105,37 @@ export class AdtHttpClient {
      * Node 22's built-in fetch embeds an older undici version whose dispatcher
      * interface is incompatible with npm undici@8 Agent/ProxyAgent instances.
      */
-    async doFetch(url, method, headers, body, options) {
+    async doFetch(url, method, headers, body, options, resetOnUnauthorized = false) {
+        const cookieNames = () => [...this.cookieJar.keys(), ...Object.keys(this.config.cookies ?? {})];
+        const response = await this.securitySessionGate.run(() => hasSecuritySessionCookie(cookieNames()), async (waited) => {
+            const generation = this.securitySessionGate.generation;
+            if (waited) {
+                // A preceding response may have replaced both fields while this send waited.
+                // Keep the refreshed pair for this logical request's negotiation/retry paths too.
+                this.refreshSessionHeaders(method, headers);
+            }
+            const response = await this.sendRequest(url, method, headers, body, options);
+            const fetchingCsrf = headers['X-CSRF-Token']?.toLowerCase() === 'fetch';
+            if (generation === this.securitySessionGate.generation) {
+                // Store once at the headers boundary, before releasing the bootstrap owner.
+                this.storeCookies(response);
+                // Ordinary responses (including 404) can carry a token without proving a Fetch probe succeeded.
+                const token = fetchingCsrf ? usableCsrfToken(response) : response.headers.get('x-csrf-token');
+                if (token && token !== 'Required')
+                    this.csrfToken = token;
+                // Reset before releasing waiters; a slow 401 body must not clear their new session.
+                if (resetOnUnauthorized && response.status === 401)
+                    this.resetSession();
+            }
+            else if (fetchingCsrf) {
+                await response.body?.cancel();
+                throw new AdtNetworkError('SAP session changed during CSRF bootstrap. Retry the request.');
+            }
+            return response;
+        }, options);
+        return prepareBoundedResponse(response, url, options);
+    }
+    async sendRequest(url, method, headers, body, options) {
         throwIfRequestCancelled(options);
         // Forward the caller's W3C trace context to SAP so one trace spans agent → ARC-1 → SAP.
         // Empty unless the MCP client sent a valid `traceparent`; ARC-1 never originates a trace.
@@ -1117,7 +1162,7 @@ export class AdtHttpClient {
                 ...(dispatcher ? { dispatcher } : {}),
             }, options?.attemptBudget));
         }
-        return prepareBoundedResponse(response, url, options);
+        return response;
     }
     /**
      * Execute an HTTP request through the BTP connectivity proxy using standard
@@ -1201,41 +1246,10 @@ export class AdtHttpClient {
 function isModifyingMethod(method) {
     return ['POST', 'PUT', 'DELETE', 'PATCH'].includes(method.toUpperCase());
 }
-/**
- * Parse RFC 7231 `Retry-After` header into a delay in milliseconds.
- *
- * Accepts both forms allowed by the spec:
- * - delta-seconds (e.g. `"5"`)
- * - HTTP-date (e.g. `"Wed, 12 May 2026 14:30:00 GMT"`)
- *
- * On missing, NaN, malformed, past-date, or negative input, falls back to `fallbackMs`.
- * Always clamps to `[0, 60_000]` ms so a misbehaving gateway can't stall us indefinitely
- * and a too-small/past value can't degenerate into a hot retry loop.
- *
- * Returns `{ delayMs, source }` — `source: 'header' | 'fallback'` lets audit events
- * record whether the delay came from the server or from our jitter floor (useful for
- * capacity tuning).
- */
-export function parseRetryAfter(header, fallbackMs) {
-    const clamp = (ms) => Math.max(0, Math.min(60_000, ms));
-    if (header == null || header === '') {
-        return { delayMs: clamp(fallbackMs), source: 'fallback' };
-    }
-    const trimmed = header.trim();
-    // delta-seconds form: integer (and only digits, optionally signed)
-    if (/^-?\d+$/.test(trimmed)) {
-        const seconds = Number.parseInt(trimmed, 10);
-        if (Number.isFinite(seconds)) {
-            return { delayMs: clamp(seconds * 1000), source: 'header' };
-        }
-        return { delayMs: clamp(fallbackMs), source: 'fallback' };
-    }
-    // HTTP-date form
-    const epochMs = Date.parse(trimmed);
-    if (Number.isFinite(epochMs)) {
-        return { delayMs: clamp(epochMs - Date.now()), source: 'header' };
-    }
-    return { delayMs: clamp(fallbackMs), source: 'fallback' };
+/** A token on an unsuccessful response is not proof of authentication. */
+function usableCsrfToken(response) {
+    const token = response.headers.get('x-csrf-token')?.trim();
+    return response.ok && token && token.toLowerCase() !== 'required' ? token : undefined;
 }
 /**
  * Distinguish a real SAP logon page from a legitimate HTML response payload.