@mcp-abap-adt/connection 1.9.0 → 1.10.0

package/dist/auth/ntlm.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Detect whether a WWW-Authenticate header (or a Negotiate challenge token) indicates NTLM.
+ * NTLM is rejected: only Kerberos/SPNEGO Negotiate is acceptable.
+ *
+ * Two cases:
+ *  - the header offers the NTLM scheme directly: `WWW-Authenticate: NTLM`
+ *  - an NTLM token tunneled via Negotiate: `Negotiate <base64>` where the base64 decodes to
+ *    bytes starting with the NTLM signature "NTLMSSP\0" (base64 prefix "TlRMTVNTUAA").
+ */
+export declare function isNtlmChallenge(wwwAuthenticate: string | undefined): boolean;
+//# sourceMappingURL=ntlm.d.ts.map

package/dist/auth/ntlm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ntlm.d.ts","sourceRoot":"","sources":["../../src/auth/ntlm.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAiB5E"}

package/dist/auth/ntlm.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNtlmChallenge = isNtlmChallenge;
+/**
+ * Detect whether a WWW-Authenticate header (or a Negotiate challenge token) indicates NTLM.
+ * NTLM is rejected: only Kerberos/SPNEGO Negotiate is acceptable.
+ *
+ * Two cases:
+ *  - the header offers the NTLM scheme directly: `WWW-Authenticate: NTLM`
+ *  - an NTLM token tunneled via Negotiate: `Negotiate <base64>` where the base64 decodes to
+ *    bytes starting with the NTLM signature "NTLMSSP\0" (base64 prefix "TlRMTVNTUAA").
+ */
+function isNtlmChallenge(wwwAuthenticate) {
+    if (!wwwAuthenticate)
+        return false;
+    const value = wwwAuthenticate.trim();
+    if (!value)
+        return false;
+    // Split on commas to handle multiple offered schemes, e.g. "Negotiate, NTLM"
+    const parts = value.split(',').map((p) => p.trim());
+    for (const part of parts) {
+        const lower = part.toLowerCase();
+        // direct NTLM scheme offer (word-boundary, not e.g. "Negotiate")
+        if (/^ntlm\b/i.test(part))
+            return true;
+        // NTLM tunneled inside a Negotiate token
+        if (lower.startsWith('negotiate ')) {
+            const token = part.slice('negotiate '.length).trim();
+            if (token.startsWith('TlRMTVNTUAA'))
+                return true; // base64("NTLMSSP\0")
+        }
+    }
+    return false;
+}

package/dist/connection/AbstractAbapConnection.d.ts

@@ -13,6 +13,18 @@ declare abstract class AbstractAbapConnection implements AbapConnection {
     private sessionId;
     private sessionMode;
     private skipSessionType;
+    /**
+     * When true, requests are treated as part of an uninterruptible critical
+     * section (e.g. a lock → modify → unlock chain). In this state a short
+     * per-request timeout must NOT abort the request mid-flight, because
+     * aborting the socket drops the stateful ADT session and orphans the lock
+     * handle (leaving the object locked and inactive). While set, makeAdtRequest
+     * raises the effective timeout to CRITICAL_SECTION_TIMEOUT (a large ceiling)
+     * so the request runs to completion instead of being interrupted.
+     */
+    private inCriticalSection;
+    /** Reference count for nested beginCriticalSection()/endCriticalSection() pairs. */
+    private criticalSectionDepth;
     protected constructor(config: SapConfig, logger: ILogger | null, sessionId?: string, options?: {
         skipSessionType?: boolean;
     });
@@ -33,6 +45,30 @@ declare abstract class AbstractAbapConnection implements AbapConnection {
      * Get current session mode
      */
     getSessionMode(): 'stateless' | 'stateful';
+    /**
+     * Enter an uninterruptible critical section.
+     *
+     * Call this BEFORE acquiring a lock (and pair it with endCriticalSection()
+     * in a finally, AFTER unlocking). While in a critical section, a short
+     * per-request timeout is not applied — makeAdtRequest uses a large ceiling
+     * (CRITICAL_SECTION_TIMEOUT, env SAP_TIMEOUT_CRITICAL) instead — so a slow
+     * PUT/activate/unlock is not aborted mid-flight. Aborting mid-flight tears
+     * down the socket, which drops the stateful ADT session and orphans the
+     * lock handle, leaving the object locked and inactive.
+     *
+     * Nesting is reference-counted so nested begin/end pairs are safe.
+     */
+    beginCriticalSection(): void;
+    /**
+     * Leave the uninterruptible critical section. See beginCriticalSection().
+     * Safe to call more times than begin (clamped at 0). Normal per-request
+     * timeouts resume once the outermost section ends.
+     */
+    endCriticalSection(): void;
+    /**
+     * Whether requests are currently in an uninterruptible critical section.
+     */
+    isInCriticalSection(): boolean;
     /**
      * Set session ID
      * @deprecated Session ID is auto-generated, use setSessionType() to control session mode

package/dist/connection/AbstractAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,0BAA0B,CAAC;AAM7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,uBAAe,sBAAuB,YAAW,cAAc;IAW3D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAX3C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D,OAAO,CAAC,eAAe,CAAU;IAEjC,SAAS,aACU,MAAM,EAAE,SAAS,EACf,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAqBzC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAUpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB,KAAK,IAAI,IAAI;IAYP,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAevD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IA+R9B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;OAGG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC,GAC3C,OAAO,CAAC,MAAM,CAAC;IA2ClB;;OAEG;YACW,0BAA0B;IAsKxC;;OAEG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIlD,OAAO,CAAC,yBAAyB;IAkEjC;;;OAGG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE,OAAO,CAAC,gBAAgB;YAsBV,oBAAoB;IAiClC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,eAAe;CA+BxB;AAGD,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,YAAY,EAAkB,MAAM,0BAA0B,CAAC;AAM7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,uBAAe,sBAAuB,YAAW,cAAc;IAuB3D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAvB3C,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D,OAAO,CAAC,eAAe,CAAU;IACjC;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IAEjC,SAAS,aACU,MAAM,EAAE,SAAS,EACf,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE;IAqBzC;;;;;;;;;;;OAWG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAUpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;;;;;;;;;OAYG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB,KAAK,IAAI,IAAI;IAYP,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAevD;;;;;;;;OAQG;IACH,QAAQ,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE3B,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAwS9B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;OAGG;cACa,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC,GAC3C,OAAO,CAAC,MAAM,CAAC;IA2ClB;;OAEG;YACW,0BAA0B;IAsKxC;;OAEG;IACH,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAIlD,OAAO,CAAC,yBAAyB;IAkEjC;;;OAGG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE,OAAO,CAAC,gBAAgB;YAsBV,oBAAoB;IAiClC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,eAAe;CA+BxB;AAGD,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/connection/AbstractAbapConnection.js

@@ -51,6 +51,18 @@ class AbstractAbapConnection {
     sessionId = null;
     sessionMode = 'stateless';
     skipSessionType;
+    /**
+     * When true, requests are treated as part of an uninterruptible critical
+     * section (e.g. a lock → modify → unlock chain). In this state a short
+     * per-request timeout must NOT abort the request mid-flight, because
+     * aborting the socket drops the stateful ADT session and orphans the lock
+     * handle (leaving the object locked and inactive). While set, makeAdtRequest
+     * raises the effective timeout to CRITICAL_SECTION_TIMEOUT (a large ceiling)
+     * so the request runs to completion instead of being interrupted.
+     */
+    inCriticalSection = false;
+    /** Reference count for nested beginCriticalSection()/endCriticalSection() pairs. */
+    criticalSectionDepth = 0;
     constructor(config, logger, sessionId, options) {
         this.config = config;
         this.logger = logger;
@@ -94,6 +106,44 @@ class AbstractAbapConnection {
     getSessionMode() {
         return this.sessionMode;
     }
+    /**
+     * Enter an uninterruptible critical section.
+     *
+     * Call this BEFORE acquiring a lock (and pair it with endCriticalSection()
+     * in a finally, AFTER unlocking). While in a critical section, a short
+     * per-request timeout is not applied — makeAdtRequest uses a large ceiling
+     * (CRITICAL_SECTION_TIMEOUT, env SAP_TIMEOUT_CRITICAL) instead — so a slow
+     * PUT/activate/unlock is not aborted mid-flight. Aborting mid-flight tears
+     * down the socket, which drops the stateful ADT session and orphans the
+     * lock handle, leaving the object locked and inactive.
+     *
+     * Nesting is reference-counted so nested begin/end pairs are safe.
+     */
+    beginCriticalSection() {
+        this.criticalSectionDepth++;
+        this.inCriticalSection = true;
+        this.logger?.debug(`Entered critical section (depth ${this.criticalSectionDepth})`);
+    }
+    /**
+     * Leave the uninterruptible critical section. See beginCriticalSection().
+     * Safe to call more times than begin (clamped at 0). Normal per-request
+     * timeouts resume once the outermost section ends.
+     */
+    endCriticalSection() {
+        if (this.criticalSectionDepth > 0) {
+            this.criticalSectionDepth--;
+        }
+        if (this.criticalSectionDepth === 0) {
+            this.inCriticalSection = false;
+        }
+        this.logger?.debug(`Left critical section (depth ${this.criticalSectionDepth})`);
+    }
+    /**
+     * Whether requests are currently in an uninterruptible critical section.
+     */
+    isInCriticalSection() {
+        return this.inCriticalSection;
+    }
     /**
      * Set session ID
      * @deprecated Session ID is auto-generated, use setSessionType() to control session mode
@@ -207,11 +257,19 @@ class AbstractAbapConnection {
                 }
             }
         }
+        // Inside an uninterruptible critical section (lock → modify → unlock), a
+        // short per-request timeout must not abort the request mid-flight — that
+        // would drop the stateful session and orphan the lock. Raise the effective
+        // timeout to the large critical-section ceiling for the whole request
+        // (also honoured on the retry paths below, which reuse requestConfig).
+        const effectiveTimeout = this.inCriticalSection
+            ? Math.max(timeout ?? 0, (0, timeouts_js_1.getCriticalSectionTimeout)())
+            : timeout;
         const requestConfig = {
             method: normalizedMethod,
             url: requestUrl,
             headers: requestHeaders,
-            timeout,
+            timeout: effectiveTimeout,
             params,
         };
         if (data !== undefined) {

package/dist/connection/KerberosAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"KerberosAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/KerberosAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,uGAAuG;AACvG,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,YAAY,CAAM;gBAEd,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;IAQ1E,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,mDAAmD;cACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA0B9B,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAS7C"}
+{"version":3,"file":"KerberosAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/KerberosAbapConnection.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,uGAAuG;AACvG,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,YAAY,CAAM;gBAEd,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;IAQ1E,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,mDAAmD;cACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5C;;;;OAIG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAiC9B,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAS7C"}

package/dist/connection/KerberosAbapConnection.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.KerberosAbapConnection = void 0;
 const axios_1 = require("axios");
 const kerberosSpnego_js_1 = require("../auth/kerberosSpnego.js");
+const ntlm_js_1 = require("../auth/ntlm.js");
 const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
 /** Kerberos / SPNEGO single-leg auth: send Negotiate token, reuse the resulting SAP session cookie. */
 class KerberosAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
@@ -43,12 +44,17 @@ class KerberosAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapCon
             this.setCsrfToken(token);
         }
         catch (error) {
-            this.logger?.warn(`[WARN] KerberosAbapConnection - connect deferred: ${error instanceof Error ? error.message : String(error)}`);
-            if (error instanceof axios_1.AxiosError &&
-                error.response?.headers &&
-                this.getCookies()) {
-                this.logger?.debug('[DEBUG] KerberosAbapConnection - cookies captured from error response during connect');
+            if (error instanceof axios_1.AxiosError && error.response?.headers) {
+                const wwwAuth = error.response.headers['www-authenticate'];
+                if ((0, ntlm_js_1.isNtlmChallenge)(wwwAuth)) {
+                    throw new Error('KerberosAbapConnection: server offered NTLM authentication, which is rejected. ' +
+                        'Only Kerberos/SPNEGO is supported. Ensure the SAP system accepts Kerberos (SPNEGO) for your user.');
+                }
+                if (this.getCookies()) {
+                    this.logger?.debug('[DEBUG] KerberosAbapConnection - cookies captured from error response during connect');
+                }
             }
+            this.logger?.warn(`[WARN] KerberosAbapConnection - connect deferred: ${error instanceof Error ? error.message : String(error)}`);
         }
     }
     buildAuthorizationHeader() {

package/dist/utils/timeouts.d.ts

@@ -2,4 +2,14 @@ import type { ITimeoutConfig } from '@mcp-abap-adt/interfaces';
 export type TimeoutConfig = ITimeoutConfig;
 export declare function getTimeoutConfig(): ITimeoutConfig;
 export declare function getTimeout(type?: 'default' | 'csrf' | 'long' | number): number;
+/**
+ * Large ceiling timeout applied while a connection is inside an uninterruptible
+ * critical section (lock → modify → unlock). A short per-request timeout must
+ * not abort such a request mid-flight: aborting tears down the socket, which
+ * drops the stateful ADT session and orphans the lock handle (object left
+ * locked and inactive). Configurable via SAP_TIMEOUT_CRITICAL (ms).
+ * Default 600000 (10 minutes) — a generous ceiling that still guards against a
+ * permanently dead socket hanging forever.
+ */
+export declare function getCriticalSectionTimeout(): number;
 //# sourceMappingURL=timeouts.d.ts.map

package/dist/utils/timeouts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeouts.d.ts","sourceRoot":"","sources":["../../src/utils/timeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAED,wBAAgB,UAAU,CACxB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAkB,GACrD,MAAM,CAOR"}
+{"version":3,"file":"timeouts.d.ts","sourceRoot":"","sources":["../../src/utils/timeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAED,wBAAgB,UAAU,CACxB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAkB,GACrD,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}

package/dist/utils/timeouts.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getTimeoutConfig = getTimeoutConfig;
 exports.getTimeout = getTimeout;
+exports.getCriticalSectionTimeout = getCriticalSectionTimeout;
 function getTimeoutConfig() {
     const defaultTimeout = parseInt(process.env.SAP_TIMEOUT_DEFAULT || '45000', 10);
     const csrfTimeout = parseInt(process.env.SAP_TIMEOUT_CSRF || '15000', 10);
@@ -19,3 +20,15 @@ function getTimeout(type = 'default') {
     const config = getTimeoutConfig();
     return config[type];
 }
+/**
+ * Large ceiling timeout applied while a connection is inside an uninterruptible
+ * critical section (lock → modify → unlock). A short per-request timeout must
+ * not abort such a request mid-flight: aborting tears down the socket, which
+ * drops the stateful ADT session and orphans the lock handle (object left
+ * locked and inactive). Configurable via SAP_TIMEOUT_CRITICAL (ms).
+ * Default 600000 (10 minutes) — a generous ceiling that still guards against a
+ * permanently dead socket hanging forever.
+ */
+function getCriticalSectionTimeout() {
+    return parseInt(process.env.SAP_TIMEOUT_CRITICAL || '600000', 10);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/connection",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "ABAP connection layer for MCP ABAP ADT server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -47,7 +47,7 @@
   },
   "dependencies": {
     "@mcp-abap-adt/interfaces": "^7.2.0",
-    "axios": "^1.13.5",
+    "axios": "^1.16.0",
     "commander": "^14.0.3",
     "express": "^5.1.0",
     "open": "^11.0.0"