tm1npm 1.5.3 → 2.0.0

package/lib/services/RestService.js

@@ -1,11 +1,48 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RestService = exports.AuthenticationMode = void 0;
 const axios_1 = __importDefault(require("axios"));
+const https = __importStar(require("https"));
+const fs = __importStar(require("fs"));
 const TM1Exception_1 = require("../exceptions/TM1Exception");
+const Utils_1 = require("../utils/Utils");
+const PRODUCT_VERSION_AUTH_SUFFIX = '/Configuration/ProductVersion/$value';
 var AuthenticationMode;
 (function (AuthenticationMode) {
     AuthenticationMode[AuthenticationMode["BASIC"] = 1] = "BASIC";
@@ -22,37 +59,262 @@ class RestService {
     get version() {
         return this._serverVersion;
     }
+    // Sync accessors for cached role flags. Return false before the first
+    // is_*_admin() call resolves — callers that need the real value must
+    // await is_admin() / is_data_admin() / etc. first.
+    get isAdmin() { var _a; return (_a = this._isAdmin) !== null && _a !== void 0 ? _a : false; }
+    get isDataAdmin() { var _a; return (_a = this._isDataAdmin) !== null && _a !== void 0 ? _a : false; }
+    get isSecurityAdmin() { var _a; return (_a = this._isSecurityAdmin) !== null && _a !== void 0 ? _a : false; }
+    get isOpsAdmin() { var _a; return (_a = this._isOpsAdmin) !== null && _a !== void 0 ? _a : false; }
     constructor(config) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        this.sessionCookies = new Map();
         this.isConnected = false;
         this.config = { ...config };
+        this._asyncRequestsMode = (_a = config.asyncRequestsMode) !== null && _a !== void 0 ? _a : false;
+        this._cancelAtTimeout = (_b = config.cancelAtTimeout) !== null && _b !== void 0 ? _b : false;
+        this._timeout = (_c = config.timeout) !== null && _c !== void 0 ? _c : 60;
+        this._asyncPollingInitialDelay = (_d = config.asyncPollingInitialDelay) !== null && _d !== void 0 ? _d : 0.1;
+        this._asyncPollingMaxDelay = (_e = config.asyncPollingMaxDelay) !== null && _e !== void 0 ? _e : 1.0;
+        this._asyncPollingBackoffFactor = (_f = config.asyncPollingBackoffFactor) !== null && _f !== void 0 ? _f : 2.0;
+        this._reConnectOnSessionTimeout = (_g = config.reConnectOnSessionTimeout) !== null && _g !== void 0 ? _g : true;
+        this._reConnectOnRemoteDisconnect = (_h = config.reConnectOnRemoteDisconnect) !== null && _h !== void 0 ? _h : true;
+        this._remoteDisconnectMaxRetries = (_j = config.remoteDisconnectMaxRetries) !== null && _j !== void 0 ? _j : 5;
+        this._remoteDisconnectRetryDelay = (_k = config.remoteDisconnectRetryDelay) !== null && _k !== void 0 ? _k : 1;
+        this._remoteDisconnectMaxDelay = (_l = config.remoteDisconnectMaxDelay) !== null && _l !== void 0 ? _l : 30;
+        // Pre-populate admin flags for the built-in ADMIN user (mirrors tm1py)
+        if (config.user && (0, Utils_1.caseAndSpaceInsensitiveEquals)(config.user, 'ADMIN')) {
+            this._isAdmin = true;
+            this._isDataAdmin = true;
+            this._isSecurityAdmin = true;
+            this._isOpsAdmin = true;
+        }
         this.setupAxiosInstance();
+        if (this.config.sessionId) {
+            // Mirror tm1py's _set_session_id_cookie: v12 topologies use paSession,
+            // v11 and baseUrl overrides use TM1SessionId.
+            const topo = this.determineTopology();
+            const cookieName = (topo === 'ibm_cloud' || topo === 'pa_proxy' || topo === 's2s')
+                ? 'paSession'
+                : 'TM1SessionId';
+            this.sessionCookies.set(cookieName, this.config.sessionId);
+        }
+    }
+    getSessionCookieValue() {
+        for (const name of RestService.SESSION_COOKIE_NAMES) {
+            const value = this.sessionCookies.get(name);
+            if (value)
+                return value;
+        }
+        return undefined;
+    }
+    buildCookieHeader() {
+        if (this.sessionCookies.size === 0)
+            return undefined;
+        const parts = [];
+        for (const [name, value] of this.sessionCookies) {
+            parts.push(`${name}=${value}`);
+        }
+        return parts.join('; ');
+    }
+    parseSetCookieHeaders(setCookie) {
+        if (!setCookie)
+            return;
+        const list = RestService.normaliseSetCookie(setCookie);
+        for (const raw of list) {
+            const firstSegment = raw.split(';')[0];
+            const eqIdx = firstSegment.indexOf('=');
+            if (eqIdx <= 0)
+                continue;
+            // Strip CR/LF/NUL defensively to block header-injection via compromised response
+            const sanitize = (s) => s.replace(/[\r\n\0]/g, '').trim();
+            const name = sanitize(firstSegment.slice(0, eqIdx));
+            const value = sanitize(firstSegment.slice(eqIdx + 1));
+            if (!RestService.SESSION_COOKIE_NAMES.includes(name))
+                continue;
+            if (value === '') {
+                this.sessionCookies.delete(name);
+            }
+            else {
+                this.sessionCookies.set(name, value);
+            }
+        }
+    }
+    removeAuthorizationHeader() {
+        delete this.axiosInstance.defaults.headers.common['Authorization'];
+    }
+    deleteHeaderCaseInsensitive(headers, name) {
+        if (!headers)
+            return;
+        // axios 1.x may supply an AxiosHeaders instance with case-insensitive lookup; plain objects
+        // (common in retry paths and test mocks) are case-sensitive and require explicit iteration
+        const target = name.toLowerCase();
+        for (const key of Object.keys(headers)) {
+            if (key.toLowerCase() === target) {
+                delete headers[key];
+            }
+        }
     }
     setupAxiosInstance() {
         const baseURL = this.buildBaseUrl();
-        this.axiosInstance = axios_1.default.create({
+        const axiosConfig = {
             baseURL,
-            timeout: (this.config.timeout || 60) * 1000,
+            timeout: this._timeout * 1000,
             headers: {
                 ...RestService.HEADERS,
                 ...(this.config.sessionContext && { 'TM1-SessionContext': this.config.sessionContext })
             }
-        });
+        };
+        if (this.config.proxies) {
+            const proxyUrl = this.config.proxies.https || this.config.proxies.http;
+            if (proxyUrl) {
+                const parsed = new URL(proxyUrl);
+                axiosConfig.proxy = {
+                    host: parsed.hostname,
+                    port: parsed.port
+                        ? parseInt(parsed.port, 10)
+                        : (parsed.protocol === 'https:' ? 443 : 80),
+                    protocol: parsed.protocol.replace(':', ''),
+                    ...(parsed.username && {
+                        auth: {
+                            username: decodeURIComponent(parsed.username),
+                            password: decodeURIComponent(parsed.password)
+                        }
+                    })
+                };
+            }
+        }
+        if (this.config.sslContext) {
+            axiosConfig.httpsAgent = this.config.sslContext;
+        }
+        else if (this.config.cert) {
+            const [certPath, keyPath] = Array.isArray(this.config.cert)
+                ? this.config.cert
+                : [this.config.cert, undefined];
+            axiosConfig.httpsAgent = new https.Agent({
+                cert: fs.readFileSync(certPath),
+                key: keyPath ? fs.readFileSync(keyPath) : undefined
+            });
+        }
+        this.axiosInstance = axios_1.default.create(axiosConfig);
         this.setupInterceptors();
     }
     buildBaseUrl() {
-        if (this.config.baseUrl) {
-            return this.config.baseUrl;
+        return this.resolveRoots().serviceRoot;
+    }
+    /**
+     * Pick the deployment topology based on the provided config, mirroring
+     * tm1py's _determine_auth_mode + _construct_service_and_auth_root dispatch.
+     *
+     * Note: authUrl is intentionally excluded from the v12 signal set because
+     * tm1npm historically uses authUrl for CAM SSO (unlike tm1py, where auth_url
+     * is a v12-only field). apiKey is also excluded to avoid collision with the
+     * existing BASIC_API_KEY auth flow.
+     */
+    determineTopology() {
+        const c = this.config;
+        const hasV12Signal = !!(c.instance || c.database || c.iamUrl || c.paUrl || c.tenant);
+        // tm1py's _construct_service_and_auth_root routes v12 modes (IBM Cloud / PA
+        // Proxy / S2S) through their dedicated constructors even if base_url is
+        // supplied. Only non-v12 configs fall through to the base_url override.
+        if (!hasV12Signal)
+            return c.baseUrl ? 'base_url' : 'v11';
+        if (c.iamUrl)
+            return 'ibm_cloud';
+        if (c.address && c.user && !c.instance)
+            return 'pa_proxy';
+        return 's2s';
+    }
+    /**
+     * Resolve the TM1 service root and auth root URLs for the configured topology.
+     * Mirrors tm1py's _construct_service_and_auth_root return tuple.
+     */
+    resolveRoots() {
+        switch (this.determineTopology()) {
+            case 'base_url': return this.rootsFromBaseUrl();
+            case 'ibm_cloud': return this.rootsIbmCloud();
+            case 'pa_proxy': return this.rootsPaProxy();
+            case 's2s': return this.rootsS2s();
+            case 'v11':
+            default: return this.rootsV11();
         }
+    }
+    rootsV11() {
+        var _a;
         const protocol = this.config.ssl ? 'https' : 'http';
         const address = this.config.address || 'localhost';
-        const port = this.config.port || 8001;
-        return `${protocol}://${address}:${port}/api/v1`;
+        const port = (_a = this.config.port) !== null && _a !== void 0 ? _a : 8001;
+        const serviceRoot = `${protocol}://${address}:${port}/api/v1`;
+        return { serviceRoot, authRoot: serviceRoot + PRODUCT_VERSION_AUTH_SUFFIX };
+    }
+    rootsIbmCloud() {
+        const { address, tenant, database, ssl } = this.config;
+        if (!address || !tenant || !database) {
+            throw new Error("'address', 'tenant' and 'database' must be provided to connect to TM1 > v12 in IBM Cloud");
+        }
+        if (!ssl) {
+            throw new Error("'ssl' must be true to connect to TM1 > v12 in IBM Cloud");
+        }
+        const t = encodeURIComponent(tenant);
+        const d = encodeURIComponent(database);
+        const serviceRoot = `https://${address}/api/${t}/v0/tm1/${d}`;
+        return { serviceRoot, authRoot: serviceRoot + PRODUCT_VERSION_AUTH_SUFFIX };
+    }
+    rootsPaProxy() {
+        const { address, database, ssl } = this.config;
+        if (!address || !database) {
+            throw new Error("'address' and 'database' must be provided to connect to TM1 > v12 using PA Proxy");
+        }
+        const protocol = ssl ? 'https' : 'http';
+        const d = encodeURIComponent(database);
+        const serviceRoot = `${protocol}://${address}/tm1/${d}/api/v1`;
+        const authRoot = `${protocol}://${address}/login`;
+        return { serviceRoot, authRoot };
+    }
+    rootsS2s() {
+        const { instance, database, ssl, port } = this.config;
+        if (!instance || !database) {
+            throw new Error("'instance' and 'database' arguments are required for v12 authentication with 'address'");
+        }
+        const protocol = ssl ? 'https' : 'http';
+        const address = this.config.address && this.config.address.length > 0
+            ? this.config.address
+            : 'localhost';
+        const portPart = port != null ? `:${port}` : '';
+        const i = encodeURIComponent(instance);
+        const d = encodeURIComponent(database);
+        const serviceRoot = `${protocol}://${address}${portPart}/${i}/api/v1/Databases('${d}')`;
+        const authRoot = `${protocol}://${address}${portPart}/${i}/auth/v1/session`;
+        return { serviceRoot, authRoot };
+    }
+    rootsFromBaseUrl() {
+        const base = this.config.baseUrl;
+        if (this.config.address) {
+            throw new Error("Base URL and Address cannot be specified at the same time");
+        }
+        if (/api\/v1\/Databases/.test(base)) {
+            if (!this.config.authUrl) {
+                throw new Error("Auth_url missing — when connecting to planning analytics engine using base_url, you must specify a corresponding auth_url");
+            }
+            return { serviceRoot: base, authRoot: this.config.authUrl };
+        }
+        // Recognize baseUrl shapes documented in docs/connection-guide.md
+        // (TM1 11 IBM Cloud `/tm1/api/tm1`, TM1 12 PaaS/access-token `/v0/tm1/...`)
+        // and use them verbatim. Only fall through to /api/v1 suffixing when the
+        // URL clearly lacks any TM1 API path — matching tm1py's fallback.
+        const trimmed = base.replace(/\/+$/, '');
+        // Each alternative is $-anchored (after trailing-slash trim above) so the
+        // match intent is explicit: the URL already ends in a TM1 API suffix.
+        const hasApiSuffix = /\/api\/v1$|\/v0\/tm1\/[^/]+$|\/tm1\/api\/tm1$/.test(trimmed);
+        const serviceRoot = hasApiSuffix ? trimmed : `${trimmed}/api/v1`;
+        return { serviceRoot, authRoot: serviceRoot + PRODUCT_VERSION_AUTH_SUFFIX };
     }
     setupInterceptors() {
         // Request interceptor
         this.axiosInstance.interceptors.request.use((config) => {
-            if (this.sessionId) {
-                config.headers['TM1SessionId'] = this.sessionId;
+            const cookieHeader = this.buildCookieHeader();
+            if (cookieHeader) {
+                config.headers['Cookie'] = cookieHeader;
             }
             if (this.sandboxName) {
                 config.headers['TM1-Sandbox'] = this.sandboxName;
@@ -60,24 +322,30 @@ class RestService {
             return config;
         }, (error) => Promise.reject(error));
         // Response interceptor with retry logic
-        this.axiosInstance.interceptors.response.use((response) => response, async (error) => {
+        this.axiosInstance.interceptors.response.use((response) => {
             var _a;
+            this.parseSetCookieHeaders((_a = response.headers) === null || _a === void 0 ? void 0 : _a['set-cookie']);
+            return response;
+        }, async (error) => {
+            var _a, _b, _c, _d;
+            if (error.response) {
+                this.parseSetCookieHeaders((_a = error.response.headers) === null || _a === void 0 ? void 0 : _a['set-cookie']);
+            }
             const originalRequest = error.config;
             // Handle timeout errors
-            if (error.code === 'ECONNABORTED' || error.message.includes('timeout')) {
+            if (error.code === 'ECONNABORTED' || ((_c = (_b = error.message) === null || _b === void 0 ? void 0 : _b.includes) === null || _c === void 0 ? void 0 : _c.call(_b, 'timeout'))) {
                 throw new TM1Exception_1.TM1TimeoutException(`Request timeout: ${error.message}`);
             }
-            // Handle authentication errors with retry
-            if (((_a = error.response) === null || _a === void 0 ? void 0 : _a.status) === 401 && !originalRequest._retry) {
+            // Handle authentication errors with retry. Guarded by this.isConnected so a 401
+            // during disconnect()'s tm1.Close POST cannot recurse back into reAuthenticate().
+            if (((_d = error.response) === null || _d === void 0 ? void 0 : _d.status) === 401 && originalRequest && !originalRequest._retry
+                && this.isConnected && this._reConnectOnSessionTimeout) {
                 originalRequest._retry = true;
                 try {
-                    // Attempt re-authentication
                     await this.reAuthenticate();
-                    // Update the request with new session/token
-                    if (this.sessionId) {
-                        originalRequest.headers['TM1SessionId'] = this.sessionId;
-                    }
-                    // Retry the original request
+                    // Stale values would defeat the rebuild by the request interceptor on replay
+                    this.deleteHeaderCaseInsensitive(originalRequest.headers, 'Cookie');
+                    this.deleteHeaderCaseInsensitive(originalRequest.headers, 'Authorization');
                     return this.axiosInstance(originalRequest);
                 }
                 catch (reAuthError) {
@@ -86,13 +354,13 @@ class RestService {
                 }
             }
             // Handle connection errors with retry
-            if (this.shouldRetryRequest(error) && this.canRetryRequest(originalRequest)) {
+            if (originalRequest && this.shouldRetryRequest(error) && this.canRetryRequest(originalRequest)) {
                 return this.retryRequest(originalRequest);
             }
             const response = error.response;
             if (response) {
                 const message = this.extractErrorMessage(response);
-                throw new TM1Exception_1.TM1RestException(message, response);
+                throw new TM1Exception_1.TM1RestException(message, response.status, response);
             }
             throw new TM1Exception_1.TM1RestException(error.message);
         });
@@ -101,6 +369,8 @@ class RestService {
      * Determine if a request should be retried
      */
     shouldRetryRequest(error) {
+        if (!this._reConnectOnRemoteDisconnect)
+            return false;
         // Retry on network errors, timeouts, and 5xx server errors
         return !error.response ||
             error.code === 'ECONNRESET' ||
@@ -112,18 +382,40 @@ class RestService {
      * Check if a request can be retried
      */
     canRetryRequest(config) {
+        if (config._idempotent === false) {
+            return false;
+        }
         // Don't retry if already retried maximum times
         config._retryCount = config._retryCount || 0;
-        return config._retryCount < 3;
+        return config._retryCount < this._remoteDisconnectMaxRetries;
     }
     /**
-     * Retry a failed request with exponential backoff
+     * Retry a failed request with exponential backoff, reconnecting the
+     * session before replay. Mirrors tm1py's _handle_remote_disconnect,
+     * which calls _manage_http_adapter() + connect() prior to retrying
+     * so a dropped session is re-established rather than replayed dead.
      */
     async retryRequest(config) {
         config._retryCount = config._retryCount || 0;
         config._retryCount++;
-        const retryDelay = Math.pow(2, config._retryCount) * 1000; // Exponential backoff
+        const baseDelay = this._remoteDisconnectRetryDelay * Math.pow(2, config._retryCount - 1);
+        const retryDelay = Math.min(baseDelay, this._remoteDisconnectMaxDelay) * 1000;
         await new Promise(resolve => setTimeout(resolve, retryDelay));
+        // Re-establish session before replay. Clear sessionCookies first so
+        // connect() runs a full setupAuthentication (mirrors tm1py, whose
+        // connect() always re-runs _start_session / _set_session_id_cookie
+        // regardless of prior cookie state). Without this, a stale cookie
+        // from a server-invalidated session would be reused, the probe GET
+        // would 401, and the whole retry path would silently fail.
+        // Flip isConnected=false so the 401 re-auth branch cannot recurse
+        // through the probe.
+        this.sessionCookies.clear();
+        this.isConnected = false;
+        await this.connect();
+        // Drop stale Cookie/Authorization on the original config — the request
+        // interceptor rebuilds Cookie from sessionCookies on replay.
+        this.deleteHeaderCaseInsensitive(config.headers, 'Cookie');
+        this.deleteHeaderCaseInsensitive(config.headers, 'Authorization');
         return this.axiosInstance(config);
     }
     extractErrorMessage(response) {
@@ -140,22 +432,120 @@ class RestService {
             return `HTTP ${response.status}: ${response.statusText}`;
         }
     }
+    *waitTimeGenerator(timeout) {
+        let delay = this._asyncPollingInitialDelay;
+        let elapsed = 0;
+        if (timeout) {
+            while (elapsed < timeout) {
+                yield delay;
+                elapsed += delay;
+                delay = Math.min(delay * this._asyncPollingBackoffFactor, this._asyncPollingMaxDelay);
+            }
+        }
+        else {
+            while (true) {
+                yield delay;
+                delay = Math.min(delay * this._asyncPollingBackoffFactor, this._asyncPollingMaxDelay);
+            }
+        }
+    }
+    async _executeSyncRequest(method, url, data, timeout, idempotent, axiosExtras) {
+        const config = {
+            method: method,
+            url,
+            data,
+            ...axiosExtras
+        };
+        if (timeout !== undefined) {
+            config.timeout = timeout * 1000;
+        }
+        config._idempotent = idempotent !== null && idempotent !== void 0 ? idempotent : false;
+        return this.axiosInstance.request(config);
+    }
+    async _executeAsyncRequest(method, url, data, timeout, cancelAtTimeout, returnAsyncId, idempotent, axiosExtras) {
+        const preferValue = returnAsyncId ? 'respond-async' : 'respond-async,wait=55';
+        const config = {
+            method: method,
+            url,
+            data,
+            ...axiosExtras,
+            headers: {
+                ...axiosExtras === null || axiosExtras === void 0 ? void 0 : axiosExtras.headers,
+                Prefer: preferValue
+            }
+        };
+        if (timeout !== undefined) {
+            config.timeout = timeout * 1000;
+        }
+        config._idempotent = idempotent !== null && idempotent !== void 0 ? idempotent : false;
+        const response = await this.axiosInstance.request(config);
+        if (response.status !== 202) {
+            // Server completed synchronously. If the caller asked for an async
+            // ID (returnAsyncId: true) there is none to return — hand back the
+            // full response so the caller can inspect the result directly.
+            return response;
+        }
+        const location = response.headers['location'] || '';
+        const match = typeof location === 'string' ? location.match(/\('([^']+)'\)/) : null;
+        const asyncId = match ? match[1] : undefined;
+        if (!asyncId) {
+            throw new TM1Exception_1.TM1RestException(`Async request returned 202 but no valid async ID in Location header: ${location}`);
+        }
+        if (returnAsyncId) {
+            return asyncId;
+        }
+        return this._pollAsyncResponse(asyncId, timeout !== null && timeout !== void 0 ? timeout : this._timeout, cancelAtTimeout !== null && cancelAtTimeout !== void 0 ? cancelAtTimeout : this._cancelAtTimeout);
+    }
+    async _pollAsyncResponse(asyncId, timeout, cancelAtTimeout) {
+        for (const wait of this.waitTimeGenerator(timeout)) {
+            const response = await this.retrieve_async_response(asyncId);
+            if (response.status === 200 || response.status === 201) {
+                this.verifyAsyncResultHeader(response);
+                return response;
+            }
+            await new Promise(resolve => setTimeout(resolve, wait * 1000));
+        }
+        if (cancelAtTimeout) {
+            try {
+                await this.cancel_async_operation(asyncId);
+            }
+            catch (cancelError) {
+                console.warn(`Failed to cancel async operation ${asyncId} at timeout:`, cancelError);
+            }
+        }
+        throw new TM1Exception_1.TM1TimeoutException(`Async operation ${asyncId} timed out after ${timeout} seconds`, timeout);
+    }
+    async _request(method, url, data, options) {
+        var _a, _b, _c, _d, _e;
+        const timeout = (_a = options === null || options === void 0 ? void 0 : options.timeout) !== null && _a !== void 0 ? _a : this._timeout;
+        const cancelAtTimeout = (_b = options === null || options === void 0 ? void 0 : options.cancelAtTimeout) !== null && _b !== void 0 ? _b : this._cancelAtTimeout;
+        const asyncMode = (options === null || options === void 0 ? void 0 : options.returnAsyncId) || ((_c = options === null || options === void 0 ? void 0 : options.asyncRequestsMode) !== null && _c !== void 0 ? _c : this._asyncRequestsMode);
+        const verifyResponse = (_d = options === null || options === void 0 ? void 0 : options.verifyResponse) !== null && _d !== void 0 ? _d : true;
+        const idempotent = (_e = options === null || options === void 0 ? void 0 : options.idempotent) !== null && _e !== void 0 ? _e : false;
+        const { asyncRequestsMode: _asyncModeOpt, returnAsyncId, cancelAtTimeout: _cancelAtTimeoutOpt, idempotent: _idempotentOpt, verifyResponse: _verifyResponseOpt, timeout: _timeoutOpt, ...axiosExtras } = options !== null && options !== void 0 ? options : {};
+        if (!verifyResponse && axiosExtras.validateStatus === undefined) {
+            axiosExtras.validateStatus = () => true;
+        }
+        if (asyncMode) {
+            return this._executeAsyncRequest(method, url, data, timeout, cancelAtTimeout, returnAsyncId, idempotent, axiosExtras);
+        }
+        return this._executeSyncRequest(method, url, data, timeout, idempotent, axiosExtras);
+    }
     async connect() {
         try {
-            // Set up authentication based on configuration
-            await this.setupAuthentication();
-            // Test connection
-            const response = await this.axiosInstance.get('/Configuration/ServerName');
-            // Extract session ID from response headers
-            const setCookie = response.headers['set-cookie'];
-            if (setCookie) {
-                for (const cookie of setCookie) {
-                    const match = cookie.match(/TM1SessionId=([^;]+)/);
-                    if (match) {
-                        this.sessionId = match[1];
-                        break;
-                    }
-                }
+            if (this.getSessionCookieValue() === undefined) {
+                await this.setupAuthentication();
+            }
+            // Mark probe non-idempotent so the response interceptor's retry
+            // branch skips it. Without this, a retry-triggered connect() whose
+            // probe also fails would spawn another connect(), recursively,
+            // bypassing remoteDisconnectMaxRetries (each probe has its own
+            // fresh _retryCount).
+            await this.axiosInstance.get('/Configuration/ServerName', { _idempotent: false });
+            // Strip Authorization only if the session cookie is established; Bearer/API-key
+            // modes that never issue a cookie must keep Authorization to stay authenticated
+            if (this.getSessionCookieValue()) {
+                this.removeAuthorizationHeader();
             }
             this.isConnected = true;
         }
@@ -164,34 +554,36 @@ class RestService {
         }
     }
     async disconnect() {
-        if (this.isConnected && this.sessionId) {
+        const shouldClose = this.isConnected;
+        // Flip isConnected first so a 401 on tm1.Close cannot trigger reAuthenticate recursion
+        this.isConnected = false;
+        if (shouldClose) {
             try {
                 await this.axiosInstance.post('/ActiveSession/tm1.Close', {});
             }
             catch (error) {
                 // Ignore errors during disconnect
             }
-            this.isConnected = false;
-            this.sessionId = undefined;
         }
+        this.sessionCookies.clear();
     }
-    async get(url, config) {
-        return this.axiosInstance.get(url, config);
+    async get(url, options) {
+        return this._request('GET', url, undefined, { idempotent: true, ...options });
     }
-    async post(url, data, config) {
-        return this.axiosInstance.post(url, data, config);
+    async post(url, data, options) {
+        return this._request('POST', url, data, options);
     }
-    async patch(url, data, config) {
-        return this.axiosInstance.patch(url, data, config);
+    async patch(url, data, options) {
+        return this._request('PATCH', url, data, options);
     }
-    async put(url, data, config) {
-        return this.axiosInstance.put(url, data, config);
+    async put(url, data, options) {
+        return this._request('PUT', url, data, options);
     }
-    async delete(url, config) {
-        return this.axiosInstance.delete(url, config);
+    async delete(url, options) {
+        return this._request('DELETE', url, undefined, options);
     }
     getSessionId() {
-        return this.sessionId;
+        return this.getSessionCookieValue();
     }
     setSandbox(sandboxName) {
         this.sandboxName = sandboxName;
@@ -200,175 +592,298 @@ class RestService {
         return this.sandboxName;
     }
     isLoggedIn() {
-        return this.isConnected && !!this.sessionId;
+        return this.isConnected && (!!this.getSessionCookieValue() ||
+            !!this.axiosInstance.defaults.headers.common['Authorization']);
     }
     async getApiMetadata() {
         const response = await this.get("/$metadata");
         return response.data;
     }
+    // =========================================================================
+    // Authentication helpers — mirror tm1py's _build_authorization_token*,
+    // _generate_*_access_token, and _start_session flows
+    // =========================================================================
     /**
-     * Set up authentication based on configuration
+     * Build an httpsAgent option that skips TLS verification when verify is false.
      */
-    async setupAuthentication() {
-        // Access Token authentication (TM1 12+ with JWT tokens)
-        if (this.config.accessToken) {
-            this.axiosInstance.defaults.headers.common['Authorization'] = `Bearer ${this.config.accessToken}`;
-            return;
-        }
-        // API Key authentication (TM1 12+ PAaaS)
-        if (this.config.apiKey) {
-            if (this.config.user === 'apikey') {
-                // IBM Cloud API Key style
-                this.axiosInstance.defaults.headers.common['Authorization'] = `Basic ${Buffer.from(`apikey:${this.config.apiKey}`).toString('base64')}`;
-            }
-            else {
-                // Basic API Key style
-                this.axiosInstance.defaults.headers.common['API-Key'] = this.config.apiKey;
+    static insecureAgentOption(verify) {
+        return verify === false
+            ? { httpsAgent: new https.Agent({ rejectUnauthorized: false }) }
+            : {};
+    }
+    /**
+     * Normalise a Set-Cookie header value (string | string[] | undefined) into a string[].
+     */
+    static normaliseSetCookie(raw) {
+        if (!raw)
+            return [];
+        return Array.isArray(raw) ? raw : [raw];
+    }
+    /**
+     * Extract a named cookie value from raw Set-Cookie headers.
+     */
+    static extractCookieValue(raw, name) {
+        const prefix = name + '=';
+        for (const header of RestService.normaliseSetCookie(raw)) {
+            const segment = header.split(';')[0];
+            if (segment.startsWith(prefix)) {
+                return segment.slice(prefix.length);
             }
-            return;
-        }
-        // CAM (Cognos Access Manager) authentication
-        if (this.config.authUrl && this.config.camPassport) {
-            await this.setupCamAuthentication();
-            return;
         }
-        // CAM SSO authentication
-        if (this.config.authUrl && this.config.user && this.config.password && this.config.namespace) {
-            await this.setupCamSsoAuthentication();
-            return;
-        }
-        // Service-to-Service authentication
-        if (this.config.applicationClientId && this.config.applicationClientSecret) {
-            await this.setupServiceToServiceAuthentication();
-            return;
+        return undefined;
+    }
+    /**
+     * Build Basic Authorization header.
+     * Mirrors tm1py's _build_authorization_token_basic.
+     */
+    static _buildAuthorizationTokenBasic(user, password) {
+        return 'Basic ' + Buffer.from(`${user}:${password}`).toString('base64');
+    }
+    /**
+     * Build CAMNamespace Authorization header.
+     * Mirrors tm1py's _build_authorization_token_cam (non-gateway path).
+     */
+    static _buildAuthorizationTokenCam(user, password, namespace) {
+        return 'CAMNamespace ' + Buffer.from(`${user}:${password}:${namespace}`).toString('base64');
+    }
+    /**
+     * Build CAMPassport Authorization token via gateway SSO.
+     * Mirrors tm1py's _build_authorization_token_cam (gateway path).
+     * Makes a GET request to the gateway URL with CAMNamespace as a query
+     * parameter and extracts the cam_passport cookie from the response.
+     *
+     * Note: tm1py uses HttpNegotiateAuth (NTLM/Kerberos) for gateway requests,
+     * which is Windows-only. This implementation sends a plain GET and relies on
+     * the gateway being accessible without NTLM. For environments requiring NTLM,
+     * pass a pre-obtained cam_passport via config.camPassport instead.
+     */
+    static async _buildAuthorizationTokenCamSso(gateway, namespace, verify) {
+        const response = await axios_1.default.get(gateway, {
+            params: { CAMNamespace: namespace },
+            ...RestService.insecureAgentOption(verify)
+        });
+        if (response.status !== 200) {
+            throw new Error('Failed to authenticate through CAM. Expected status_code 200, received status_code: ' +
+                response.status);
         }
-        // Basic authentication (default)
-        if (this.config.user && this.config.password) {
-            const credentials = Buffer.from(`${this.config.user}:${this.config.password}`).toString('base64');
-            this.axiosInstance.defaults.headers.common['Authorization'] = `Basic ${credentials}`;
-            // Add namespace for TM1 Cloud
-            if (this.config.namespace) {
-                this.axiosInstance.defaults.headers.common['TM1-Namespace'] = this.config.namespace;
-            }
-            return;
+        const passport = RestService.extractCookieValue(response.headers['set-cookie'], 'cam_passport');
+        if (!passport) {
+            throw new Error("Failed to authenticate through CAM. HTTP response does not contain 'cam_passport' cookie");
         }
-        throw new Error('No valid authentication configuration provided');
+        return 'CAMPassport ' + passport;
     }
     /**
-     * Set up CAM (Cognos Access Manager) authentication
+     * Generate IBM IAM Cloud access token.
+     * Mirrors tm1py's _generate_ibm_iam_cloud_access_token.
      */
-    async setupCamAuthentication() {
-        if (!this.config.authUrl || !this.config.camPassport) {
-            throw new Error('CAM authentication requires authUrl and camPassport');
-        }
-        try {
-            const authResponse = await axios_1.default.post(this.config.authUrl, {
-                parameters: [{
-                        name: 'CAMPassport',
-                        value: this.config.camPassport
-                    }]
-            }, {
-                headers: {
-                    'Content-Type': 'application/json'
-                }
-            });
-            if (authResponse.data && authResponse.data.sessionId) {
-                this.sessionId = authResponse.data.sessionId;
-                this.axiosInstance.defaults.headers.common['TM1SessionId'] = this.sessionId;
-            }
-            else {
-                throw new Error('CAM authentication failed: No session ID returned');
-            }
+    async _generateIbmIamCloudAccessToken() {
+        var _a;
+        const { iamUrl, apiKey } = this.config;
+        if (!iamUrl || !apiKey) {
+            throw new Error("'iamUrl' and 'apiKey' must be provided to generate access token from IBM Cloud");
         }
-        catch (error) {
-            throw new Error(`CAM authentication failed: ${error}`);
+        const payload = `grant_type=urn%3Aibm%3Aparams%3Aoauth%3Agrant-type%3Aapikey&apikey=${encodeURIComponent(apiKey)}`;
+        const headers = {
+            'Accept': 'application/json',
+            'Content-Type': 'application/x-www-form-urlencoded'
+        };
+        const response = await axios_1.default.post(iamUrl, payload, {
+            headers,
+            ...RestService.insecureAgentOption(this.config.verify)
+        });
+        if (!((_a = response.data) === null || _a === void 0 ? void 0 : _a.access_token)) {
+            throw new Error(`Failed to generate access_token from URL: '${iamUrl}'`);
         }
+        return response.data.access_token;
     }
     /**
-     * Set up CAM SSO authentication
+     * Generate CPD (Cloud Pak for Data) access token.
+     * Mirrors tm1py's _generate_cpd_access_token.
      */
-    async setupCamSsoAuthentication() {
-        if (!this.config.authUrl || !this.config.user || !this.config.password || !this.config.namespace) {
-            throw new Error('CAM SSO authentication requires authUrl, user, password, and namespace');
+    async _generateCpdAccessToken(credentials) {
+        var _a;
+        const { cpdUrl } = this.config;
+        if (!cpdUrl) {
+            throw new Error("'cpdUrl' must be provided to authenticate via CPD/Cloud Pak for Data");
         }
-        try {
-            const authPayload = {
-                username: this.config.user,
-                password: this.config.password,
-                namespace: this.config.namespace
-            };
-            const authResponse = await axios_1.default.post(this.config.authUrl, authPayload, {
-                headers: {
-                    'Content-Type': 'application/json'
-                }
-            });
-            if (authResponse.data && authResponse.data.token) {
-                this.axiosInstance.defaults.headers.common['Authorization'] = `Bearer ${authResponse.data.token}`;
-            }
-            else if (authResponse.data && authResponse.data.sessionId) {
-                this.sessionId = authResponse.data.sessionId;
-                this.axiosInstance.defaults.headers.common['TM1SessionId'] = this.sessionId;
-            }
-            else {
-                throw new Error('CAM SSO authentication failed: No token or session ID returned');
-            }
+        const url = `${cpdUrl}/v1/preauth/signin`;
+        const headers = { 'Content-Type': 'application/json;charset=UTF-8' };
+        const response = await axios_1.default.post(url, credentials, {
+            headers,
+            ...RestService.insecureAgentOption(this.config.verify)
+        });
+        if (!((_a = response.data) === null || _a === void 0 ? void 0 : _a.token)) {
+            throw new Error(`Failed to generate CPD access token from URL: '${url}'`);
         }
-        catch (error) {
-            throw new Error(`CAM SSO authentication failed: ${error}`);
+        return response.data.token;
+    }
+    /**
+     * Authenticate with PA Proxy using a CPD JWT token.
+     * Mirrors tm1py's PA_PROXY flow in _start_session.
+     */
+    async _authenticateWithPaProxy(jwt) {
+        const authRoot = this.resolveRoots().authRoot;
+        const headers = { 'Content-Type': 'application/x-www-form-urlencoded' };
+        const payload = `jwt=${jwt}`;
+        const response = await axios_1.default.post(authRoot, payload, {
+            headers,
+            ...RestService.insecureAgentOption(this.config.verify)
+        });
+        const setCookie = response.headers['set-cookie'];
+        const csrfValue = RestService.extractCookieValue(setCookie, 'ba-sso-csrf');
+        if (csrfValue) {
+            this.axiosInstance.defaults.headers.common['ba-sso-authenticity'] = csrfValue;
         }
+        this.parseSetCookieHeaders(setCookie);
     }
     /**
-     * Set up Service-to-Service authentication
+     * Authenticate Service-to-Service (v12).
+     * Mirrors tm1py's SERVICE_TO_SERVICE flow in _start_session:
+     * Uses Basic auth with applicationClientId:applicationClientSecret,
+     * then POSTs {"User": user} to the auth endpoint.
      */
-    async setupServiceToServiceAuthentication() {
-        if (!this.config.applicationClientId || !this.config.applicationClientSecret) {
+    async _authenticateServiceToService() {
+        var _a;
+        const { applicationClientId, applicationClientSecret, user } = this.config;
+        if (!applicationClientId || !applicationClientSecret) {
             throw new Error('Service-to-Service authentication requires applicationClientId and applicationClientSecret');
         }
-        try {
-            const tokenEndpoint = this.config.authUrl || `${this.buildBaseUrl()}/oauth/token`;
-            const tokenPayload = {
-                grant_type: 'client_credentials',
-                client_id: this.config.applicationClientId,
-                client_secret: this.config.applicationClientSecret
-            };
-            const tokenResponse = await axios_1.default.post(tokenEndpoint, tokenPayload, {
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                }
-            });
-            if (tokenResponse.data && tokenResponse.data.access_token) {
-                this.axiosInstance.defaults.headers.common['Authorization'] = `Bearer ${tokenResponse.data.access_token}`;
+        // Guard: v11 and plain baseUrl topologies resolve authRoot to a metadata
+        // probe URL, not a token endpoint. Require explicit authUrl in those cases.
+        if (!this.config.authUrl) {
+            const topo = this.determineTopology();
+            const baseUrlIsV12 = topo === 'base_url'
+                && /api\/v1\/Databases/.test((_a = this.config.baseUrl) !== null && _a !== void 0 ? _a : '');
+            if (topo === 'v11' || (topo === 'base_url' && !baseUrlIsV12)) {
+                throw new Error("'authUrl' is required for Service-to-Service authentication on v11 topology");
             }
-            else {
-                throw new Error('Service-to-Service authentication failed: No access token returned');
-            }
-        }
-        catch (error) {
-            throw new Error(`Service-to-Service authentication failed: ${error}`);
         }
+        const authRoot = this.config.authUrl || this.resolveRoots().authRoot;
+        const basicAuth = Buffer.from(`${applicationClientId}:${applicationClientSecret}`).toString('base64');
+        this.axiosInstance.defaults.headers.common['Authorization'] = `Basic ${basicAuth}`;
+        const response = await axios_1.default.post(authRoot, JSON.stringify({ User: user }), {
+            headers: {
+                ...RestService.HEADERS,
+                'Authorization': `Basic ${basicAuth}`
+            },
+            ...RestService.insecureAgentOption(this.config.verify)
+        });
+        this.parseSetCookieHeaders(response.headers['set-cookie']);
     }
     /**
-     * Get the authentication mode being used
+     * Determine the authentication mode from config.
+     * Mirrors tm1py's _determine_auth_mode, using the URL topology as the
+     * primary discriminator for v12 modes.
      */
     getAuthenticationMode() {
-        if (this.config.accessToken) {
-            return AuthenticationMode.ACCESS_TOKEN;
-        }
-        if (this.config.apiKey) {
-            return this.config.user === 'apikey' ?
-                AuthenticationMode.IBM_CLOUD_API_KEY :
-                AuthenticationMode.BASIC_API_KEY;
-        }
-        if (this.config.authUrl && this.config.camPassport) {
-            return AuthenticationMode.CAM;
-        }
-        if (this.config.authUrl && this.config.user && this.config.password && this.config.namespace) {
-            return AuthenticationMode.CAM_SSO;
+        const topo = this.determineTopology();
+        const c = this.config;
+        switch (topo) {
+            case 'ibm_cloud':
+                return AuthenticationMode.IBM_CLOUD_API_KEY;
+            case 'pa_proxy':
+                return AuthenticationMode.PA_PROXY;
+            case 's2s':
+                return AuthenticationMode.SERVICE_TO_SERVICE;
+            case 'v11':
+            case 'base_url':
+            default: {
+                // v11 / base_url: check auth-specific config flags
+                if (c.accessToken)
+                    return AuthenticationMode.ACCESS_TOKEN;
+                if (c.apiKey)
+                    return AuthenticationMode.BASIC_API_KEY;
+                if (c.applicationClientId && c.applicationClientSecret) {
+                    return AuthenticationMode.SERVICE_TO_SERVICE;
+                }
+                if (c.camPassport)
+                    return AuthenticationMode.CAM;
+                if (c.gateway && c.namespace)
+                    return AuthenticationMode.CAM_SSO;
+                if (c.integratedLogin)
+                    return AuthenticationMode.WIA;
+                if (c.namespace)
+                    return AuthenticationMode.CAM;
+                return AuthenticationMode.BASIC;
+            }
         }
-        if (this.config.applicationClientId && this.config.applicationClientSecret) {
-            return AuthenticationMode.SERVICE_TO_SERVICE;
+    }
+    /**
+     * Set up authentication based on configuration.
+     * Mirrors tm1py's _start_session routing.
+     */
+    async setupAuthentication() {
+        const authMode = this.getAuthenticationMode();
+        const password = this.config.decodeB64 && this.config.password
+            ? RestService.b64_decode_password(this.config.password)
+            : this.config.password;
+        switch (authMode) {
+            case AuthenticationMode.ACCESS_TOKEN:
+                this.axiosInstance.defaults.headers.common['Authorization'] =
+                    `Bearer ${this.config.accessToken}`;
+                break;
+            case AuthenticationMode.BASIC_API_KEY:
+                if (this.config.user === 'apikey') {
+                    this.axiosInstance.defaults.headers.common['Authorization'] =
+                        RestService._buildAuthorizationTokenBasic('apikey', this.config.apiKey);
+                }
+                else {
+                    this.axiosInstance.defaults.headers.common['API-Key'] = this.config.apiKey;
+                }
+                break;
+            case AuthenticationMode.IBM_CLOUD_API_KEY: {
+                const accessToken = await this._generateIbmIamCloudAccessToken();
+                this.axiosInstance.defaults.headers.common['Authorization'] =
+                    `Bearer ${accessToken}`;
+                break;
+            }
+            case AuthenticationMode.PA_PROXY: {
+                if (!this.config.user || !password) {
+                    throw new Error('PA Proxy authentication requires user and password');
+                }
+                const jwt = await this._generateCpdAccessToken({
+                    username: this.config.user,
+                    password
+                });
+                await this._authenticateWithPaProxy(jwt);
+                break;
+            }
+            case AuthenticationMode.SERVICE_TO_SERVICE:
+                await this._authenticateServiceToService();
+                break;
+            case AuthenticationMode.CAM_SSO: {
+                // CAM_SSO is only reached when gateway is set (see getAuthenticationMode)
+                const token = await RestService._buildAuthorizationTokenCamSso(this.config.gateway, this.config.namespace, this.config.verify);
+                this.axiosInstance.defaults.headers.common['Authorization'] = token;
+                break;
+            }
+            case AuthenticationMode.CAM: {
+                if (this.config.camPassport) {
+                    this.axiosInstance.defaults.headers.common['Authorization'] =
+                        'CAMPassport ' + this.config.camPassport;
+                }
+                else if (this.config.namespace && this.config.user && password) {
+                    this.axiosInstance.defaults.headers.common['Authorization'] =
+                        RestService._buildAuthorizationTokenCam(this.config.user, password, this.config.namespace);
+                }
+                else {
+                    throw new Error('CAM authentication requires either camPassport or user/password/namespace');
+                }
+                break;
+            }
+            case AuthenticationMode.WIA:
+                throw new Error('Windows Integrated Authentication (WIA) is not supported in Node.js. ' +
+                    'Use CAM or Basic authentication instead.');
+            case AuthenticationMode.BASIC:
+            default: {
+                if (!this.config.user || !password) {
+                    throw new Error('No valid authentication configuration provided');
+                }
+                this.axiosInstance.defaults.headers.common['Authorization'] =
+                    RestService._buildAuthorizationTokenBasic(this.config.user, password);
+                break;
+            }
         }
-        return AuthenticationMode.BASIC;
     }
     /**
      * Re-authenticate using stored configuration
@@ -408,10 +923,10 @@ class RestService {
     getConnectionStats() {
         return {
             isConnected: this.isConnected,
-            sessionId: this.sessionId,
+            sessionId: this.getSessionCookieValue(),
             authMode: this.getAuthenticationMode(),
             baseUrl: this.buildBaseUrl(),
-            timeout: (this.config.timeout || 60) * 1000,
+            timeout: this._timeout,
             sandbox: this.sandboxName
         };
     }
@@ -485,13 +1000,14 @@ class RestService {
      * Check if currently connected to TM1
      */
     is_connected() {
-        return this.isConnected && !!this.sessionId;
+        return this.isConnected && (!!this.getSessionCookieValue() ||
+            !!this.axiosInstance.defaults.headers.common['Authorization']);
     }
     /**
      * Get the current session ID
      */
     session_id() {
-        return this.sessionId;
+        return this.getSessionCookieValue();
     }
     /**
      * Get TM1 server version (async method for tm1py compatibility)
@@ -514,56 +1030,69 @@ class RestService {
         this._serverVersion = version;
     }
     /**
-     * Check if current user is admin
+     * Fetch the active user's group names as a CaseAndSpaceInsensitiveSet so
+     * membership tests are case- and whitespace-insensitive (mirrors tm1py).
+     * Concurrent callers (e.g. Promise.all([is_admin(), is_data_admin(), ...]))
+     * coalesce onto a single in-flight request.
+     */
+    fetchActiveUserGroupNames() {
+        if (this._activeUserGroupsPromise)
+            return this._activeUserGroupsPromise;
+        const clear = () => { this._activeUserGroupsPromise = undefined; };
+        const fetch = this.get('/ActiveUser/Groups').then((response) => {
+            var _a, _b;
+            clear();
+            const set = new Utils_1.CaseAndSpaceInsensitiveSet();
+            const value = (_b = (_a = response.data) === null || _a === void 0 ? void 0 : _a.value) !== null && _b !== void 0 ? _b : [];
+            for (const group of value) {
+                if (group === null || group === void 0 ? void 0 : group.Name)
+                    set.add(group.Name);
+            }
+            return set;
+        }, (err) => { clear(); throw err; });
+        this._activeUserGroupsPromise = fetch;
+        return fetch;
+    }
+    /**
+     * Check if current user is admin. Result is cached after the first
+     * computation, and pre-populated when the configured user is ADMIN.
      */
     async is_admin() {
-        try {
-            const response = await this.get('/ActiveUser/Groups');
-            const groups = response.data.value || [];
-            return groups.some((g) => g.Name === 'ADMIN');
-        }
-        catch (error) {
-            return false;
-        }
+        if (this._isAdmin !== undefined)
+            return this._isAdmin;
+        const groups = await this.fetchActiveUserGroupNames();
+        this._isAdmin = groups.has('ADMIN');
+        return this._isAdmin;
     }
     /**
-     * Check if current user is data admin
+     * Check if current user is data admin (member of Admin or DataAdmin).
      */
     async is_data_admin() {
-        try {
-            const response = await this.get('/ActiveUser/Groups');
-            const groups = response.data.value || [];
-            return groups.some((g) => g.Name === 'ADMIN' || g.Name === 'DataAdmin');
-        }
-        catch (error) {
-            return false;
-        }
+        if (this._isDataAdmin !== undefined)
+            return this._isDataAdmin;
+        const groups = await this.fetchActiveUserGroupNames();
+        this._isDataAdmin = groups.has('Admin') || groups.has('DataAdmin');
+        return this._isDataAdmin;
     }
     /**
-     * Check if current user is ops admin
+     * Check if current user is ops admin (member of Admin or OperationsAdmin).
      */
     async is_ops_admin() {
-        try {
-            const response = await this.get('/ActiveUser/Groups');
-            const groups = response.data.value || [];
-            return groups.some((g) => g.Name === 'ADMIN' || g.Name === 'OperationsAdmin');
-        }
-        catch (error) {
-            return false;
-        }
+        if (this._isOpsAdmin !== undefined)
+            return this._isOpsAdmin;
+        const groups = await this.fetchActiveUserGroupNames();
+        this._isOpsAdmin = groups.has('Admin') || groups.has('OperationsAdmin');
+        return this._isOpsAdmin;
     }
     /**
-     * Check if current user is security admin
+     * Check if current user is security admin (member of Admin or SecurityAdmin).
      */
     async is_security_admin() {
-        try {
-            const response = await this.get('/ActiveUser/Groups');
-            const groups = response.data.value || [];
-            return groups.some((g) => g.Name === 'ADMIN' || g.Name === 'SecurityAdmin');
-        }
-        catch (error) {
-            return false;
-        }
+        if (this._isSecurityAdmin !== undefined)
+            return this._isSecurityAdmin;
+        const groups = await this.fetchActiveUserGroupNames();
+        this._isSecurityAdmin = groups.has('Admin') || groups.has('SecurityAdmin');
+        return this._isSecurityAdmin;
     }
     /**
      * Add custom HTTP header to all requests
@@ -591,61 +1120,109 @@ class RestService {
         }
         return headers;
     }
+    /**
+     * Insert `tm1.compact=v0` into the Accept header (after the
+     * `application/json` segment) and return the previous header value.
+     * Mirrors tm1py's add_compact_json_header.
+     */
+    add_compact_json_header() {
+        var _a;
+        const original = (_a = this.axiosInstance.defaults.headers.common['Accept']) !== null && _a !== void 0 ? _a : '';
+        const parts = original.split(';');
+        // Insertion point matters: must come immediately after `application/json`
+        parts.splice(1, 0, 'tm1.compact=v0');
+        this.axiosInstance.defaults.headers.common['Accept'] = parts.join(';');
+        return original;
+    }
+    /**
+     * Decode a Base64-encoded password to its UTF-8 plaintext form
+     * (mirrors tm1py's b64_decode_password).
+     */
+    static b64_decode_password(encryptedPassword) {
+        return Buffer.from(encryptedPassword, 'base64').toString('utf-8');
+    }
+    /**
+     * Coerce a boolean/number/string config value to a boolean. Strings
+     * are stripped of whitespace and lowercased before comparison with
+     * `'true'` (mirrors tm1py's translate_to_boolean).
+     */
+    static translate_to_boolean(value) {
+        if (typeof value === 'boolean')
+            return value;
+        if (typeof value === 'number')
+            return Boolean(value);
+        if (typeof value === 'string') {
+            return value.replace(/\s+/g, '').toLowerCase() === 'true';
+        }
+        throw new Error(`Invalid argument: '${String(value)}'. Must be type 'boolean', 'number', or 'string'`);
+    }
     /**
      * Cancel an async operation by ID
      */
     async cancel_async_operation(async_id) {
-        try {
-            await this.post(`/AsyncOperations('${async_id}')/tm1.Cancel`);
-        }
-        catch (error) {
-            throw new TM1Exception_1.TM1RestException(`Failed to cancel async operation ${async_id}: ${error}`);
-        }
+        await this.delete((0, Utils_1.formatUrl)("/_async('{}')", async_id), { asyncRequestsMode: false });
     }
     /**
      * Retrieve async operation response
      */
     async retrieve_async_response(async_id) {
-        try {
-            const response = await this.get(`/AsyncOperations('${async_id}')`);
-            return response.data;
-        }
-        catch (error) {
-            throw new TM1Exception_1.TM1RestException(`Failed to retrieve async response ${async_id}: ${error}`);
-        }
+        // tm1py's retrieve_async_response returns the raw response without
+        // raising on non-2xx because its caller (_poll_async_response) gates
+        // on status_code in [200, 201]. Mirror that: accept all statuses so
+        // transient 404s (resource not yet materialized) or 202s (still
+        // running) flow through to the polling loop rather than aborting it.
+        return this.get((0, Utils_1.formatUrl)("/_async('{}')", async_id), {
+            asyncRequestsMode: false,
+            verifyResponse: false,
+            validateStatus: () => true
+        });
     }
     /**
-     * Get async operation status
+     * TM1 v12 returns completed async results with HTTP 200 and encodes
+     * the true operation status in the `asyncresult` header (e.g.
+     * "500 Internal Server Error"). Mirror tm1py's
+     * `_transform_async_response` by throwing on any embedded non-2xx
+     * status so callers are not handed a 500 as "success".
      */
-    async get_async_operation_status(async_id) {
-        try {
-            const response = await this.get(`/AsyncOperations('${async_id}')/Status/$value`);
-            return response.data;
-        }
-        catch (error) {
-            throw new TM1Exception_1.TM1RestException(`Failed to get async operation status ${async_id}: ${error}`);
-        }
+    verifyAsyncResultHeader(response) {
+        var _a;
+        const headerValue = (_a = response.headers) === null || _a === void 0 ? void 0 : _a['asyncresult'];
+        if (typeof headerValue !== 'string')
+            return;
+        const embeddedStatus = parseInt(headerValue.trim().split(/\s+/)[0], 10);
+        if (Number.isNaN(embeddedStatus))
+            return;
+        if (embeddedStatus >= 200 && embeddedStatus < 300)
+            return;
+        throw new TM1Exception_1.TM1RestException(`Async operation failed with status ${headerValue}`, embeddedStatus, response);
     }
     /**
-     * Wait for async operation to complete
+     * Wait for async operation to complete using a fixed polling cadence.
+     *
+     * Unlike the internal dispatcher's {@link waitTimeGenerator} (capped
+     * exponential backoff), this public helper polls every
+     * {@link poll_interval_seconds} seconds so existing callers who tuned
+     * the cadence keep their original behavior.
      */
-    async wait_for_async_operation(async_id, timeout_seconds = 300, poll_interval_seconds = 1) {
-        const start_time = Date.now();
-        const timeout_ms = timeout_seconds * 1000;
-        const poll_interval_ms = poll_interval_seconds * 1000;
-        while (Date.now() - start_time < timeout_ms) {
-            const status = await this.get_async_operation_status(async_id);
-            if (status === 'Completed' || status === 'CompletedSuccessfully') {
-                return await this.retrieve_async_response(async_id);
+    async wait_for_async_operation(async_id, timeout_seconds = 300, poll_interval_seconds = 1, cancel_at_timeout = false) {
+        const deadline = Date.now() + timeout_seconds * 1000;
+        while (Date.now() < deadline) {
+            const response = await this.retrieve_async_response(async_id);
+            if (response.status === 200 || response.status === 201) {
+                this.verifyAsyncResultHeader(response);
+                return response.data;
+            }
+            await new Promise(resolve => setTimeout(resolve, poll_interval_seconds * 1000));
+        }
+        if (cancel_at_timeout) {
+            try {
+                await this.cancel_async_operation(async_id);
             }
-            if (status === 'Failed' || status === 'CompletedWithError') {
-                const response = await this.retrieve_async_response(async_id);
-                throw new TM1Exception_1.TM1RestException(`Async operation failed: ${JSON.stringify(response)}`);
+            catch (cancelError) {
+                console.warn(`Failed to cancel async operation ${async_id} at timeout:`, cancelError);
             }
-            // Wait before polling again
-            await new Promise(resolve => setTimeout(resolve, poll_interval_ms));
         }
-        throw new TM1Exception_1.TM1TimeoutException(`Async operation ${async_id} timed out after ${timeout_seconds} seconds`);
+        throw new TM1Exception_1.TM1TimeoutException(`Async operation ${async_id} timed out after ${timeout_seconds} seconds`, timeout_seconds);
     }
     /**
      * Get active user name
@@ -730,4 +1307,5 @@ RestService.HEADERS = {
 };
 RestService.DEFAULT_CONNECTION_POOL_SIZE = 10;
 RestService.DEFAULT_POOL_CONNECTIONS = 1;
+RestService.SESSION_COOKIE_NAMES = ['TM1SessionId', 'paSession'];
 //# sourceMappingURL=RestService.js.map