@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/dist/connection/JwtAbapConnection.js

@@ -1,358 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JwtAbapConnection = void 0;
-const node_async_hooks_1 = require("node:async_hooks");
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
-const axios_1 = require("axios");
-const SessionLifecycle_js_1 = require("../session/SessionLifecycle.js");
-const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-const csrfConfig_js_1 = require("./csrfConfig.js");
-/**
- * Is this worth refreshing a token for?
- *
- * 401 only. A 403 means the server authenticated the caller and refused the
- * action anyway — a new token is the same caller, so refreshing answers a
- * question nobody asked and, worse, used to end with the original error
- * replaced by "JWT token has expired". See issue #30.
- */
-function isTokenExpiryCandidate(error) {
-    return error instanceof axios_1.AxiosError && error.response?.status === 401;
-}
-/**
- * JWT Authentication connection for SAP BTP Cloud systems
- *
- * Supports automatic token refresh via ITokenRefresher injection:
- * - a **401** triggers a token refresh when a tokenRefresher is available;
- * - without one, or when the refresh does not help, the server's own error is
- *   thrown unchanged — status and body intact;
- * - a **403** is never a token problem. It propagates as it arrived, because a
- *   new token is the same caller and cannot change a permissions answer.
- */
-class JwtAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
-    tokenRefresher;
-    currentToken;
-    /** Bumped by any token refresh, token-only ones included. */
-    tokenGeneration = 0;
-    /** Single-flight over the token fetch alone. Touches no session state. */
-    tokenRefreshInFlight;
-    /**
-     * The `tokenGeneration` a completed session recovery was built for. Only
-     * `performRenewal` moves it, and only after `recoverSession` resolves.
-     *
-     * Separate from `tokenGeneration` because a token-only refresh — which
-     * `fetchCsrfToken` does, from inside an establishment — bumps that counter
-     * without rebuilding anything. Reading it as "the session is settled" made
-     * the outer handler retry a request whose session was never rebuilt.
-     */
-    recoveredGeneration = 0;
-    /**
-     * Single-flight over the whole credential renewal, session included.
-     *
-     * Sharing only the token fetch leaves the expensive half racing: `recover`
-     * and `cleanup` never join (`SessionLifecycle.transition`), so two concurrent
-     * renewals queue as cleanup A → recover A → cleanup B → recover B, and A's
-     * retry meets a session B has just torn down.
-     */
-    renewalInFlight;
-    /**
-     * Per connection, deliberately NOT static. `baseline` is compared against
-     * `this.tokenGeneration`, which is instance state — a store shared between
-     * instances would let one connection's operation hand its baseline to
-     * another's, and the comparison would be between unrelated counters.
-     */
-    recoveryScope = new node_async_hooks_1.AsyncLocalStorage();
-    constructor(config, logger, sessionId, tokenRefresher) {
-        JwtAbapConnection.validateConfig(config);
-        super(config, logger || null, sessionId);
-        this.tokenRefresher = tokenRefresher;
-        if (!config.jwtToken) {
-            throw new Error('jwtToken is required for JwtAbapConnection');
-        }
-        this.currentToken = config.jwtToken;
-    }
-    buildAuthorizationHeader() {
-        // Use currentToken which may have been refreshed
-        const tokenPreview = this.currentToken
-            ? `${this.currentToken.substring(0, 10)}...${this.currentToken.substring(Math.max(0, this.currentToken.length - 4))}`
-            : 'null';
-        this.logger?.debug(`[DEBUG] JwtAbapConnection.buildAuthorizationHeader - Using token: ${tokenPreview}`);
-        return `Bearer ${this.currentToken}`;
-    }
-    /**
-     * For the public entry point: this call is its own operation, always.
-     *
-     * A re-entrant `makeAdtRequest` — from a logger or a refresher callback the
-     * connection itself invokes while a scope is live — is a new caller-visible
-     * operation. Inheriting there would hand it a baseline from somebody else's
-     * refresh, which reads as "already refreshed for me" and skips a refresh it
-     * needs.
-     */
-    inNewRecoveryScope(fn) {
-        const scope = {
-            baseline: this.tokenGeneration,
-            active: true,
-        };
-        return this.recoveryScope.run(scope, async () => {
-            try {
-                return await fn();
-            }
-            finally {
-                scope.active = false;
-            }
-        });
-    }
-    /** For the inner levels: join the operation in progress, or start one. */
-    inRecoveryScope(fn) {
-        const inherited = this.recoveryScope.getStore();
-        // Only a scope that is still running. A store reached through an async
-        // resource that outlived its operation is stale, and its baseline describes
-        // a credential state that has since moved.
-        if (inherited?.active)
-            return fn();
-        return this.inNewRecoveryScope(fn);
-    }
-    /**
-     * The baseline this operation is reasoning from.
-     *
-     * The `active` check here and the one in `inRecoveryScope` OVERLAP: each
-     * compensates for the other, and the stale-context test only fails when both
-     * are removed. Kept as two because they answer different questions — "may I
-     * join this scope" and "may I trust this baseline" — and a reader who finds
-     * one redundant would be deleting half a guarantee.
-     */
-    currentBaseline() {
-        const scope = this.recoveryScope.getStore();
-        // No live scope means a caller reached a handler by a path that does not
-        // open one, or through a stale async context. Either way, treat it as its
-        // own operation rather than trusting a baseline nobody is standing behind.
-        return scope?.active ? scope.baseline : this.tokenGeneration;
-    }
-    /**
-     * Fetch a new token, unless somebody already did for this operation.
-     *
-     * Single-flighted so two concurrent handlers — including two nested
-     * `fetchCsrfToken` calls, which is a level `renewalInFlight` cannot reach —
-     * share one network call instead of racing and leaving `currentToken` as
-     * whichever settled last.
-     *
-     * @returns true when the caller may retry.
-     */
-    refreshTokenOnce(baseline) {
-        if (this.tokenGeneration > baseline)
-            return Promise.resolve(true);
-        if (this.tokenRefreshInFlight)
-            return this.tokenRefreshInFlight;
-        if (!this.tokenRefresher) {
-            this.logger?.debug(`[DEBUG] JwtAbapConnection - No tokenRefresher available, cannot refresh token`);
-            return Promise.resolve(false);
-        }
-        // Identity-checked clear, as SessionLifecycle.transition does with its
-        // tail: a joiner settling late must not clear a fetch somebody started
-        // after it.
-        const inFlight = this.performTokenRefresh().finally(() => {
-            if (this.tokenRefreshInFlight === inFlight) {
-                this.tokenRefreshInFlight = undefined;
-            }
-        });
-        this.tokenRefreshInFlight = inFlight;
-        return inFlight;
-    }
-    async performTokenRefresh() {
-        try {
-            this.logger?.debug(`[DEBUG] JwtAbapConnection - Refreshing token via tokenRefresher...`);
-            // biome-ignore lint/style/noNonNullAssertion: refreshTokenOnce checks it
-            this.currentToken = await this.tokenRefresher.refreshToken();
-            this.tokenGeneration += 1;
-            this.logger?.debug(`[DEBUG] JwtAbapConnection - Token refreshed successfully`);
-            return true;
-        }
-        catch (error) {
-            this.logger?.error(`[ERROR] JwtAbapConnection - Failed to refresh token: ${error instanceof Error ? error.message : String(error)}`);
-            return false;
-        }
-    }
-    /**
-     * Renew the credential and the session it belongs to, once, shared.
-     */
-    renewCredential(baselineEpoch, baseline) {
-        if (this.renewalInFlight)
-            return this.renewalInFlight;
-        // Identity-checked clear, as SessionLifecycle.transition does with its
-        // tail: a joiner settling late must not clear a renewal somebody started
-        // after it.
-        const inFlight = this.performRenewal(baselineEpoch, baseline).finally(() => {
-            if (this.renewalInFlight === inFlight)
-                this.renewalInFlight = undefined;
-        });
-        this.renewalInFlight = inFlight;
-        return inFlight;
-    }
-    async performRenewal(baselineEpoch, baseline) {
-        // Shared with the token-only path, and a no-op when the token is already
-        // newer than the one that failed — then what is missing is the session, and
-        // a second fetch answers a question nobody asked.
-        if (!(await this.refreshTokenOnce(baseline)))
-            return false;
-        this.logger?.debug(`[DEBUG] JwtAbapConnection - Recovering session after token refresh...`);
-        // The renewed credential cannot keep the old ABAP session, so this is a
-        // session-lost teardown — internal, or it would cancel the very recovery it
-        // is setting up. reset() would be the caller-origin one.
-        this.discardSession();
-        // Re-establish before retrying: the retry goes through admission, and a
-        // discarded session admits nothing.
-        await this.recoverSession(baselineEpoch);
-        // Only here: a session now exists that was built with this token.
-        this.recoveredGeneration = this.tokenGeneration;
-        return true;
-    }
-    /**
-     * May this operation retry?
-     *
-     * The order of the checks is the design, not style.
-     */
-    async ensureRecovered(baselineEpoch) {
-        // 1. A renewal in flight is joined REGARDLESS of generation. A newer token
-        //    is no use while the session it belongs to is still being rebuilt:
-        //    retrying now is how a caller meets a closed admission door.
-        //
-        //    This overlaps check 2 as the counters stand — `recoveredGeneration`
-        //    only moves after `recoverSession` resolves, so check 2 cannot report a
-        //    rebuild that has not finished, and removing either guard alone leaves
-        //    the concurrency test green. Both are kept on purpose: this one states
-        //    the rule ("never decide anything while a renewal is running") without
-        //    depending on when some other counter happens to move, and it is what
-        //    keeps the invariant true if check 2's counter is ever changed.
-        if (this.renewalInFlight)
-            return this.renewalInFlight;
-        const baseline = this.currentBaseline();
-        // 2. A full renewal COMPLETED since this operation began — token, and the
-        //    session built with it. Not `tokenGeneration`: that moves on a
-        //    token-only refresh, which rebuilds nothing.
-        if (this.recoveredGeneration > baseline)
-            return true;
-        // 3. Nobody has. Renew, and let everyone else join.
-        return this.renewCredential(baselineEpoch, baseline);
-    }
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    async establishSession() {
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
-        this.logger?.debug(`[DEBUG] JwtAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
-        try {
-            // Try to get CSRF token (this will also get cookies)
-            const token = await this.fetchCsrfToken(discoveryUrl);
-            this.setCsrfToken(token);
-            this.logger?.debug('Successfully connected to SAP system', {
-                hasCsrfToken: !!this.getCsrfToken(),
-                hasCookies: !!this.getCookies(),
-                cookieLength: this.getCookies()?.length || 0,
-            });
-        }
-        catch (error) {
-            if (isTokenExpiryCandidate(error)) {
-                this.logger?.error('[ERROR] JwtAbapConnection.establishSession - 401 while establishing; fetchCsrfToken has already refreshed and retried for this');
-            }
-            throw error;
-        }
-    }
-    /**
-     * Override makeAdtRequest to handle JWT auth errors with automatic token refresh
-     */
-    async makeAdtRequest(options) {
-        // A public call is its own operation, whatever scope it starts in.
-        return this.inNewRecoveryScope(() => this.attemptRequest(options));
-    }
-    async attemptRequest(options) {
-        // Captured before the attempt: a recovery asks "has the caller asked to
-        // stop since this request began", not since some later bookkeeping step.
-        const baselineEpoch = this.teardownEpoch;
-        this.logger?.debug(`[DEBUG] JwtAbapConnection.makeAdtRequest - Starting request: ${options.method} ${options.url}`);
-        try {
-            const response = await super.makeAdtRequest(options);
-            this.logger?.debug(`[DEBUG] JwtAbapConnection.makeAdtRequest - Request succeeded: ${response.status}`);
-            return response;
-        }
-        catch (error) {
-            this.logger?.debug(`[DEBUG] JwtAbapConnection.makeAdtRequest - Request failed: ${error instanceof Error ? error.message : String(error)}`);
-            if (isTokenExpiryCandidate(error)) {
-                this.logger?.debug(`[DEBUG] JwtAbapConnection.makeAdtRequest - Got 401, attempting token refresh...`);
-                if (await this.ensureRecovered(baselineEpoch)) {
-                    // A renewal this operation joined was fenced against the STARTER's
-                    // baseline, not this one's, and establishAndCommit's own epoch checks
-                    // belong to the establishment that ran. Between the last of them and
-                    // this retry there is a gap nothing else watches: the connection can
-                    // be torn down by its caller and made usable again, and a retry would
-                    // then go out on a session that caller discarded.
-                    if (this.teardownEpoch !== baselineEpoch) {
-                        throw (0, SessionLifecycle_js_1.sessionError)(interfaces_1.ADT_SESSION_ERROR.NOT_CONNECTED, 'Retry abandoned: a teardown was requested for this connection');
-                    }
-                    try {
-                        return await super.makeAdtRequest(options);
-                    }
-                    catch (retryError) {
-                        // A 401 that survived a renewal is the case the deleted message
-                        // was about, and it only shows up here — the log below fires when
-                        // the renewal never happened, which is a different fact.
-                        if (isTokenExpiryCandidate(retryError)) {
-                            this.logger?.error('[ERROR] JwtAbapConnection.makeAdtRequest - 401 persists after a credential renewal; the credential may need re-authentication');
-                        }
-                        throw retryError;
-                    }
-                }
-                this.logger?.error('[ERROR] JwtAbapConnection.makeAdtRequest - 401 persists and the token could not be refreshed; the credential may need re-authentication');
-            }
-            throw error;
-        }
-    }
-    /**
-     * Override fetchCsrfToken to handle JWT auth errors with automatic token refresh
-     */
-    async fetchCsrfToken(url, retryCount = csrfConfig_js_1.CSRF_CONFIG.RETRY_COUNT, retryDelay = csrfConfig_js_1.CSRF_CONFIG.RETRY_DELAY, 
-    /** Fences the response effects; omitted during connect(), which has no lease. */
-    generation) {
-        // An inner level: join the operation in progress, or start one when
-        // reached directly — a bare connect() is still an operation with a
-        // baseline.
-        return this.inRecoveryScope(() => this.attemptCsrfToken(url, retryCount, retryDelay, generation));
-    }
-    async attemptCsrfToken(url, retryCount, retryDelay, generation) {
-        try {
-            // Try to fetch CSRF token using parent implementation
-            return await super.fetchCsrfToken(url, retryCount, retryDelay, generation);
-        }
-        catch (error) {
-            // A 401 here may be an expired token; anything else is not ours to
-            // interpret — a 403 least of all, since a new token is the same caller.
-            if (isTokenExpiryCandidate(error)) {
-                if (await this.refreshTokenOnce(this.currentBaseline())) {
-                    // Retry CSRF token fetch with new token
-                    this.logger?.debug(`[DEBUG] JwtAbapConnection.fetchCsrfToken - Retrying after token refresh...`);
-                    try {
-                        return await super.fetchCsrfToken(url, retryCount, retryDelay, generation);
-                    }
-                    catch (retryError) {
-                        if (isTokenExpiryCandidate(retryError)) {
-                            this.logger?.error('[ERROR] JwtAbapConnection.fetchCsrfToken - 401 persists after a token refresh; the credential may need re-authentication');
-                        }
-                        throw retryError;
-                    }
-                }
-                this.logger?.error('[ERROR] JwtAbapConnection.fetchCsrfToken - 401 persists and the token could not be refreshed; the credential may need re-authentication');
-            }
-            // Re-throw other errors
-            throw error;
-        }
-    }
-    static validateConfig(config) {
-        if (config.authType !== 'jwt') {
-            throw new Error(`JWT connection expects authType "jwt", got "${config.authType}"`);
-        }
-        if (!config.jwtToken) {
-            throw new Error('JWT authentication requires SAP_JWT_TOKEN to be provided');
-        }
-    }
-}
-exports.JwtAbapConnection = JwtAbapConnection;

package/dist/connection/KerberosAbapConnection.d.ts

@@ -1,24 +0,0 @@
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import { AbstractAbapConnection } from './AbstractAbapConnection.js';
-/** Kerberos / SPNEGO single-leg auth: send Negotiate token, reuse the resulting SAP session cookie. */
-export declare class KerberosAbapConnection extends AbstractAbapConnection {
-    private spn;
-    private currentToken;
-    constructor(config: SapConfig, logger?: ILogger | null, sessionId?: string);
-    private static validateConfig;
-    /** Generate the SPNEGO token once (single-leg). */
-    protected ensureToken(): Promise<void>;
-    /**
-     * Generates the SPNEGO token and primes the session. MUST be called before the first
-     * request — the first request carries the Negotiate header; SAP then issues a session
-     * cookie which is reused for subsequent requests.
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    protected establishSession(): Promise<void>;
-    protected buildAuthorizationHeader(): string;
-}
-//# sourceMappingURL=KerberosAbapConnection.d.ts.map

package/dist/connection/KerberosAbapConnection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"KerberosAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/KerberosAbapConnection.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAErE,uGAAuG;AACvG,qBAAa,sBAAuB,SAAQ,sBAAsB;IAChE,OAAO,CAAC,GAAG,CAAS;IACpB,OAAO,CAAC,YAAY,CAAM;gBAEd,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;IAQ1E,OAAO,CAAC,MAAM,CAAC,cAAc;IAa7B,mDAAmD;cACnC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5C;;;;OAIG;IACH;;;OAGG;cACa,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqFjD,SAAS,CAAC,wBAAwB,IAAI,MAAM;CAS7C"}

package/dist/connection/KerberosAbapConnection.js

@@ -1,120 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.KerberosAbapConnection = void 0;
-const axios_1 = require("axios");
-const kerberosSpnego_js_1 = require("../auth/kerberosSpnego.js");
-const ntlm_js_1 = require("../auth/ntlm.js");
-const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
-/** Kerberos / SPNEGO single-leg auth: send Negotiate token, reuse the resulting SAP session cookie. */
-class KerberosAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
-    spn;
-    currentToken = '';
-    constructor(config, logger, sessionId) {
-        KerberosAbapConnection.validateConfig(config);
-        super(config, logger || null, sessionId);
-        this.spn =
-            config.kerberosSpn ??
-                `${config.kerberosService ?? 'HTTP'}@${new URL(config.url).hostname}`;
-    }
-    static validateConfig(config) {
-        if (config.authType !== 'kerberos') {
-            throw new Error(`Kerberos connection expects authType "kerberos", got "${config.authType}"`);
-        }
-        if (config.connectionType === 'rfc') {
-            throw new Error('Kerberos auth is not supported with connectionType "rfc".');
-        }
-    }
-    /** Generate the SPNEGO token once (single-leg). */
-    async ensureToken() {
-        if (!this.currentToken)
-            this.currentToken = await (0, kerberosSpnego_js_1.generateSpnegoToken)(this.spn);
-    }
-    /**
-     * Generates the SPNEGO token and primes the session. MUST be called before the first
-     * request — the first request carries the Negotiate header; SAP then issues a session
-     * cookie which is reused for subsequent requests.
-     */
-    /**
-     * Establishes the session for this auth type. Called by
-     * AbstractAbapConnection.connect(), which owns the lifecycle around it.
-     */
-    async establishSession() {
-        await this.ensureToken();
-        const baseUrl = await this.getBaseUrl();
-        const discoveryUrl = `${baseUrl}/sap/bc/adt/discovery`;
-        this.logger?.debug(`[DEBUG] KerberosAbapConnection - Connecting to SAP system: ${discoveryUrl}`);
-        try {
-            // ONE attempt, deliberately — the shared default is 3 retries a second
-            // apart, and every one of them corrupts this exchange:
-            //
-            //  - A GSS token is one-shot. Replaying it is meaningless at best, and
-            //    replay protection may answer it differently than the original.
-            //  - Worse, a 401 that sets a cookie silences buildAuthorizationHeader()
-            //    (a cookie carries auth after the first round trip), so the retry
-            //    goes out with NO Authorization at all and draws the server's plain
-            //    opening challenge.
-            //
-            // Either way the classifier below would read the LAST response and name
-            // the wrong cause. The retry cannot help here anyway: nothing about a
-            // rejected token changes by waiting a second. Retrying a transient
-            // network failure is the caller's business now that connect() is
-            // explicit, and a fresh connect() mints a fresh token.
-            const token = await this.fetchCsrfToken(discoveryUrl, 0, 0);
-            this.setCsrfToken(token);
-        }
-        catch (error) {
-            // The token went out and was not accepted, so it is spent. Keeping it
-            // would make every later connect() replay a token already known to fail.
-            this.currentToken = '';
-            if (error instanceof axios_1.AxiosError && error.response?.headers) {
-                const wwwAuth = error.response.headers['www-authenticate'];
-                if ((0, ntlm_js_1.isNtlmChallenge)(wwwAuth)) {
-                    throw new Error('KerberosAbapConnection: server offered NTLM authentication, which is rejected. ' +
-                        'Only Kerberos/SPNEGO is supported. Ensure the SAP system accepts Kerberos (SPNEGO) for your user.');
-                }
-                if (this.getCookies()) {
-                    this.logger?.debug('[DEBUG] KerberosAbapConnection - cookies captured from error response during connect');
-                }
-                // A 401 carrying a Negotiate token is a CONTINUATION, not a success.
-                //
-                // Per RFC 4559 the server is handing back gssapi-data for the client to
-                // feed into its GSS context and retry. This client cannot do that:
-                // generateSpnegoToken() calls step('') once and discards the context,
-                // so there is nothing to continue with. The token it holds is the
-                // initial one, and sending it again produces the same 401.
-                //
-                // So this fails, and says why — resolving here would claim a readiness
-                // that does not exist and move the failure to the first real request,
-                // where it reads as an unrelated auth error.
-                if ((0, ntlm_js_1.isNegotiateContinuation)(wwwAuth)) {
-                    throw new Error('KerberosAbapConnection: the server continued the SPNEGO exchange ' +
-                        '(401 with a Negotiate token), which requires feeding that token ' +
-                        'back into the GSS context and retrying. This client performs a ' +
-                        'single-leg exchange only — the context is discarded after the ' +
-                        'first step — so multi-leg SPNEGO is not supported. See ' +
-                        'https://www.rfc-editor.org/rfc/rfc4559');
-                }
-                // A BARE Negotiate is a different problem with a different fix: the
-                // initial Authorization has already gone out, so an empty challenge is
-                // the server declining it. No token came back, so there is nothing to
-                // step even for a client that supports multi-leg.
-                if ((0, ntlm_js_1.isBareNegotiateChallenge)(wwwAuth)) {
-                    throw new Error('KerberosAbapConnection: the server rejected the SPNEGO token ' +
-                        '(401 with a bare Negotiate challenge, no token returned). The ' +
-                        'credentials were not accepted — check the SPN, the ticket ' +
-                        '(klist / kinit), and that the user is permitted Kerberos logon.');
-                }
-            }
-            throw error;
-        }
-    }
-    buildAuthorizationHeader() {
-        if (this.getCookies())
-            return ''; // cookie carries auth after first round-trip
-        if (!this.currentToken) {
-            throw new Error('KerberosAbapConnection: SPNEGO token not yet available. Call connect() before making requests.');
-        }
-        return `Negotiate ${this.currentToken}`;
-    }
-}
-exports.KerberosAbapConnection = KerberosAbapConnection;

package/dist/connection/RfcAbapConnection.d.ts

@@ -1,49 +0,0 @@
-import type { IAbapRequestOptions, IAdtResponse } from '@mcp-abap-adt/interfaces';
-import type { SapConfig } from '../config/sapConfig.js';
-import type { ILogger } from '../logger.js';
-import type { AbapConnection } from './AbapConnection.js';
-/**
- * RFC-based connection for on-premise SAP systems.
- *
- * Uses @mcp-abap-adt/sap-rfc-lite to call SADT_REST_RFC_ENDPOINT — the same standard SAP FM
- * that Eclipse ADT uses for all on-premise ADT operations via JCo.
- *
- * RFC connections are inherently stateful: one ABAP session persists for the
- * entire connection lifetime. This solves the HTTP 423 "invalid lock handle"
- * problem on legacy systems (BASIS < 7.50) where HTTP stateful sessions
- * are not supported.
- *
- * Connection parameters are derived from the standard ISapConfig.url field:
- *   http://saphost:8000 → ashost=saphost, sysnr=00
- *
- * Prerequisites:
- *   - SAP NW RFC SDK installed on the machine
- *   - @mcp-abap-adt/sap-rfc-lite package installed: npm install @mcp-abap-adt/sap-rfc-lite
- */
-export declare class RfcAbapConnection implements AbapConnection {
-    private readonly config;
-    private readonly logger;
-    private rfcClient;
-    private readonly sessionId;
-    private readonly baseUrl;
-    private readonly rfcParams;
-    private sessionType;
-    private sessionCookie;
-    constructor(config: SapConfig, logger?: ILogger | null);
-    connect(): Promise<void>;
-    getBaseUrl(): Promise<string>;
-    getSessionId(): string | null;
-    setSessionType(type: 'stateful' | 'stateless'): void;
-    makeAdtRequest<T = any, D = any>(options: IAbapRequestOptions): Promise<IAdtResponse<T, D>>;
-    /**
-     * Reset the connection — for RFC this closes the session.
-     * Provides interface compatibility with HTTP connections.
-     */
-    reset(): void;
-    /**
-     * Close the RFC connection and release the ABAP session.
-     */
-    close(): Promise<void>;
-    private static validateConfig;
-}
-//# sourceMappingURL=RfcAbapConnection.d.ts.map

package/dist/connection/RfcAbapConnection.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"RfcAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/RfcAbapConnection.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAkG1D;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,iBAAkB,YAAW,cAAc;IASpD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IATzB,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;IAChD,OAAO,CAAC,WAAW,CAAyC;IAC5D,OAAO,CAAC,aAAa,CAAuB;gBAGzB,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,OAAO,GAAG,IAAW;IAa1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA8BxB,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAInC,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAU9C,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IA8L9B;;;OAGG;IACH,KAAK,IAAI,IAAI;IAIb;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAY5B,OAAO,CAAC,MAAM,CAAC,cAAc;CAqB9B"}