@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/dist/connection/RfcTransport.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * An ADT request carried over RFC.
+ *
+ * `SADT_REST_RFC_ENDPOINT` is the standard FM Eclipse ADT uses for on-prem ADT
+ * through JCo, and what it carries is a request line, header fields and a body
+ * — an HTTP request in all but the wire. So this translates, and translating is
+ * the whole of its job.
+ *
+ * It exists because an RFC conversation is inherently stateful: one ABAP
+ * session for the connection's lifetime, which is the way through HTTP 423
+ * "invalid lock handle" on legacy systems (BASIS < 7.50) where stateful HTTP
+ * sessions are not usable.
+ *
+ * **What is NOT here.** Cookies, the CSRF token, `x-sap-adt-sessiontype` and
+ * the session lifecycle belong to the connection above this seam and are
+ * already in `request.headers` by the time `send()` is called. A transport that
+ * also captured cookies would be doing that work twice, and the two copies
+ * would disagree the first time one of them was cleared.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RfcTransport = void 0;
+const node_crypto_1 = require("node:crypto");
+/**
+ * ADT exception types, mapped to what they would have been over HTTP. Standard
+ * types, returned in `<exc:exception>` XML.
+ */
+const EXCEPTION_STATUS = {
+    ExceptionResourceNotFound: { code: 404, text: 'Not Found' },
+    ExceptionResourceNoAuthorization: { code: 403, text: 'Forbidden' },
+    ExceptionResourceAlreadyExists: { code: 409, text: 'Conflict' },
+    ExceptionResourceLocked: { code: 423, text: 'Locked' },
+    ExceptionBadRequest: { code: 400, text: 'Bad Request' },
+    ExceptionNotSupported: { code: 501, text: 'Not Implemented' },
+    ExceptionConflict: { code: 409, text: 'Conflict' },
+};
+function statusFromExceptionXml(body) {
+    const type = /<exc:type[^>]*>([^<]+)<\/exc:type>/.exec(body)?.[1]?.trim();
+    return ((type ? EXCEPTION_STATUS[type] : undefined) ?? {
+        code: 500,
+        text: 'Internal Server Error',
+    });
+}
+function message(e) {
+    if (e instanceof Error)
+        return e.message;
+    if (e && typeof e === 'object')
+        return JSON.stringify(e);
+    return String(e);
+}
+/** Axios's own default, which the classification above this seam is written against. */
+const admits2xx = (status) => status >= 200 && status < 300;
+class RfcTransport {
+    connect;
+    logger;
+    kind = 'rfc';
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    system = 'onprem';
+    conversation = null;
+    /** Names the conversation, and so the ABAP session it carries. */
+    conversationId = '';
+    /**
+     * Nothing to fold in. `SADT_REST_RFC_ENDPOINT` answers with two header
+     * fields — `~server_protocol` and `content-type` — on every call, including
+     * one that asks for a token with `x-csrf-token: fetch`, and on a stateful
+     * POST. Measured on E19. There is no ICM in this path, so there is no ICF
+     * session to cookie and no application server to be redispatched between.
+     */
+    ingest() { }
+    /** None, and never any: see `ingest()`. */
+    cookies() {
+        return null;
+    }
+    /**
+     * Nothing to establish. `open()` made the ABAP session, and there is no token
+     * to earn: this endpoint answers `x-csrf-token: fetch` with the same two
+     * header fields it answers everything else with. A wire with no
+     * cross-site request to forge against needs no token to prove one was not.
+     */
+    async establish(_context) { }
+    /** None: see `establish()`. */
+    csrfToken() {
+        return null;
+    }
+    /**
+     * Ignored. Nothing on this wire reads a token, and keeping one would be
+     * state that never leaves the object.
+     */
+    adoptCsrfToken() { }
+    /**
+     * The conversation, which IS the session — so it is fingerprinted by its own
+     * existence rather than by an address the server hands out.
+     */
+    /** The conversation IS the session, so it exists exactly while that does. */
+    sessionEstablished() {
+        return this.conversation?.alive ?? false;
+    }
+    sessionFingerprint() {
+        const fingerprint = new Map();
+        if (this.conversation?.alive) {
+            fingerprint.set('rfc-conversation', this.conversationId);
+        }
+        return fingerprint;
+    }
+    /** None: there is no dispatcher in front of this wire to stay bound to. */
+    affinityHeaders() {
+        return {};
+    }
+    /**
+     * Nothing to forget separately. The session ends when the conversation does,
+     * and that is `close()` — a wire whose state could be dropped while the
+     * conversation stayed open would be claiming a session it had disowned.
+     */
+    forgetSession() { }
+    /**
+     * The client is built by a factory rather than constructed here: the SDK is
+     * an optional dependency loaded by `require` at open time, and a transport
+     * that reached for it in its constructor could not be built at all on a
+     * machine without it.
+     */
+    constructor(connect, logger = null) {
+        this.connect = connect;
+        this.logger = logger;
+    }
+    async open() {
+        if (this.conversation?.alive)
+            return;
+        const conversation = this.connect();
+        try {
+            await conversation.open();
+        }
+        catch (e) {
+            throw new Error(`Failed to open RFC connection: ${message(e)}`);
+        }
+        this.conversation = conversation;
+        // Minted here, where the session begins. A conversation opened after an
+        // earlier one closed is a DIFFERENT ABAP session, and the fingerprint has
+        // to say so — a constant would report `unchanged` across a reconnect and
+        // hide exactly the replacement the identity policy exists to catch.
+        this.conversationId = (0, node_crypto_1.randomUUID)();
+        this.logger?.debug('RFC conversation opened (stateful by nature)');
+    }
+    /** Never throws, and a repeat call finds nothing owed. */
+    async close() {
+        const conversation = this.conversation;
+        if (!conversation)
+            return;
+        this.conversation = null;
+        this.conversationId = '';
+        try {
+            await conversation.close();
+            this.logger?.debug('RFC conversation closed');
+        }
+        catch (e) {
+            this.logger?.debug(`RFC close error: ${message(e)}`);
+        }
+    }
+    async send(request) {
+        if (!this.conversation?.alive) {
+            throw new Error('RFC transport is not open. Call connect() first.');
+        }
+        const method = request.method.toUpperCase();
+        // HTTP clients serialise `params`; RFC has no such step, so they go into
+        // the URI here or they do not travel at all.
+        let uri = request.url;
+        const query = Object.entries(request.params ?? {}).filter(([, v]) => v !== undefined && v !== null);
+        if (query.length > 0) {
+            const serialised = new URLSearchParams(query.map(([k, v]) => [k, String(v)])).toString();
+            uri += (uri.includes('?') ? '&' : '?') + serialised;
+        }
+        const headerFields = Object.entries(request.headers ?? {}).map(([NAME, VALUE]) => ({ NAME, VALUE: String(VALUE) }));
+        // ADT refuses a request with no Accept — `400 ExceptionResourceBadRequest:
+        // Accept header missing`, measured on E19. Over HTTP axios supplies the
+        // default and nobody notices; this endpoint forwards only what it is
+        // handed, so without this the same call dies on this wire alone.
+        if (!headerFields.some((h) => h.NAME.toLowerCase() === 'accept')) {
+            headerFields.push({ NAME: 'Accept', VALUE: '*/*' });
+        }
+        const body = request.data !== undefined && request.data !== null
+            ? String(request.data)
+            : '';
+        if (body &&
+            !headerFields.some((h) => h.NAME.toLowerCase() === 'content-type')) {
+            headerFields.push({
+                NAME: 'Content-Type',
+                VALUE: 'text/plain; charset=utf-8',
+            });
+        }
+        this.logger?.debug(`RFC → ${method} ${uri}`);
+        let raw;
+        try {
+            raw = await this.conversation.call('SADT_REST_RFC_ENDPOINT', {
+                REQUEST: {
+                    REQUEST_LINE: {
+                        METHOD: method,
+                        URI: uri,
+                        VERSION: 'HTTP/1.1',
+                    },
+                    HEADER_FIELDS: headerFields,
+                    MESSAGE_BODY: body ? Buffer.from(body, 'utf-8') : Buffer.alloc(0),
+                },
+            });
+        }
+        catch (e) {
+            // An RFC-level failure, not an answer: nothing came back to classify.
+            const msg = message(e);
+            this.logger?.error(`RFC call failed: ${msg}`);
+            throw new Error(`RFC call to SADT_REST_RFC_ENDPOINT failed: ${msg}`);
+        }
+        const answer = raw.RESPONSE ?? raw;
+        const rawCode = answer.STATUS_LINE?.STATUS_CODE ?? answer.STATUS_LINE?.CODE;
+        let status = typeof rawCode === 'string'
+            ? Number.parseInt(rawCode, 10)
+            : (rawCode ?? 0);
+        let statusText = answer.STATUS_LINE?.REASON_PHRASE ?? answer.STATUS_LINE?.REASON ?? '';
+        const data = answer.MESSAGE_BODY
+            ? Buffer.isBuffer(answer.MESSAGE_BODY)
+                ? answer.MESSAGE_BODY.toString('utf-8')
+                : String(answer.MESSAGE_BODY)
+            : '';
+        const headers = {};
+        for (const field of answer.HEADER_FIELDS ?? []) {
+            if (field.NAME && field.VALUE !== undefined) {
+                headers[String(field.NAME).toLowerCase()] = field.VALUE;
+            }
+        }
+        // BASIS < 7.50 answers without populating STATUS_LINE. Left alone, a
+        // failure would read as 200 with an error document in the body — which is
+        // the green run that inspected nothing, one layer down.
+        if (!status && data.includes('<exc:exception')) {
+            const detected = statusFromExceptionXml(data);
+            status = detected.code;
+            statusText = detected.text;
+            this.logger?.debug(`RFC: STATUS_LINE empty, read ${status} out of the exception XML`);
+        }
+        if (!status) {
+            status = 200;
+            statusText = statusText || 'OK';
+        }
+        this.logger?.debug(`RFC ← ${status} ${statusText} (${data.length} bytes)`);
+        const response = {
+            status,
+            statusText,
+            headers,
+            data,
+        };
+        const admits = request.validateStatus ?? admits2xx;
+        if (!admits(status)) {
+            const error = new Error(`Request failed with status ${status}: ${method} ${uri}`);
+            error.response = response;
+            throw error;
+        }
+        return response;
+    }
+}
+exports.RfcTransport = RfcTransport;

package/dist/connection/rfcConversation.d.ts

@@ -0,0 +1,44 @@
+/**
+ * An RFC conversation, from the config a consumer already holds.
+ *
+ * `RfcTransport` takes a factory rather than connection parameters, and that is
+ * deliberate: `@mcp-abap-adt/sap-rfc-lite` needs the SAP NW RFC SDK on the
+ * machine, and a transport that reached for it in its constructor could not be
+ * built at all where it is absent. But a factory is a poor front door — without
+ * this, reaching the RFC wire means every consumer writing the `require` and
+ * deriving `ashost` and `sysnr` for themselves, which is the derivation the
+ * per-transport connection class used to do for them.
+ *
+ * So the derivation lives here, once, and the SDK is still only touched when a
+ * conversation is actually opened.
+ */
+import type { SapConfig } from '../config/sapConfig.js';
+import type { IRfcConversation } from './RfcTransport.js';
+/** What the native client is constructed with. */
+export interface RfcConnectionParams {
+    ashost: string;
+    sysnr: string;
+    client: string;
+    user: string;
+    passwd: string;
+    lang: string;
+}
+/**
+ * Read out of the config, never asked of the server.
+ *
+ * The system number comes off the HTTP port by the SAP convention that 80XX is
+ * the ICM port for system XX — the convention the port itself follows, not a
+ * guess about the deployment. `SAP_SYSNR` overrides it for a port that follows
+ * no convention, which is the case on a system reached through 50400.
+ */
+export declare function rfcParamsFrom(config: SapConfig): RfcConnectionParams;
+/**
+ * The factory `RfcTransport` asks for.
+ *
+ * The SDK is loaded when a conversation is opened, not when this is called, so
+ * a consumer can build the transport on a machine that has no SDK and find out
+ * at `connect()` rather than at construction — with a message that says what to
+ * install.
+ */
+export declare function rfcConversationFrom(config: SapConfig): () => IRfcConversation;
+//# sourceMappingURL=rfcConversation.d.ts.map

package/dist/connection/rfcConversation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfcConversation.d.ts","sourceRoot":"","sources":["../../src/connection/rfcConversation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAoBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,gBAAgB,CAmB7E"}

package/dist/connection/rfcConversation.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * An RFC conversation, from the config a consumer already holds.
+ *
+ * `RfcTransport` takes a factory rather than connection parameters, and that is
+ * deliberate: `@mcp-abap-adt/sap-rfc-lite` needs the SAP NW RFC SDK on the
+ * machine, and a transport that reached for it in its constructor could not be
+ * built at all where it is absent. But a factory is a poor front door — without
+ * this, reaching the RFC wire means every consumer writing the `require` and
+ * deriving `ashost` and `sysnr` for themselves, which is the derivation the
+ * per-transport connection class used to do for them.
+ *
+ * So the derivation lives here, once, and the SDK is still only touched when a
+ * conversation is actually opened.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rfcParamsFrom = rfcParamsFrom;
+exports.rfcConversationFrom = rfcConversationFrom;
+/**
+ * Read out of the config, never asked of the server.
+ *
+ * The system number comes off the HTTP port by the SAP convention that 80XX is
+ * the ICM port for system XX — the convention the port itself follows, not a
+ * guess about the deployment. `SAP_SYSNR` overrides it for a port that follows
+ * no convention, which is the case on a system reached through 50400.
+ */
+function rfcParamsFrom(config) {
+    if (!config.url) {
+        throw new Error('An RFC conversation needs a url to take its host from');
+    }
+    if (!config.username || !config.password) {
+        throw new Error('An RFC conversation needs both a username and a password');
+    }
+    const parsed = new URL(config.url);
+    const port = Number.parseInt(parsed.port || '8000', 10);
+    const derived = String(port - 8000).padStart(2, '0');
+    return {
+        ashost: parsed.hostname,
+        sysnr: process.env.SAP_SYSNR?.trim() || derived,
+        client: config.client || '000',
+        user: config.username,
+        passwd: config.password,
+        lang: 'EN',
+    };
+}
+/**
+ * The factory `RfcTransport` asks for.
+ *
+ * The SDK is loaded when a conversation is opened, not when this is called, so
+ * a consumer can build the transport on a machine that has no SDK and find out
+ * at `connect()` rather than at construction — with a message that says what to
+ * install.
+ */
+function rfcConversationFrom(config) {
+    const params = rfcParamsFrom(config);
+    return () => {
+        let Client;
+        try {
+            // Dynamic, because the SDK is an optional peer: it needs the SAP NW RFC
+            // SDK installed on the machine, and most consumers travel over HTTP.
+            // biome-ignore lint/correctness/noNodejsModules: optional by design
+            Client = require('@mcp-abap-adt/sap-rfc-lite').Client;
+        }
+        catch (error) {
+            throw new Error('@mcp-abap-adt/sap-rfc-lite is not available. To take the RFC wire, ' +
+                'install the SAP NW RFC SDK and run: npm install @mcp-abap-adt/sap-rfc-lite. ' +
+                `Details: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return new Client(params);
+    };
+}

package/dist/index.d.ts

@@ -1,17 +1,20 @@
 export type { IWebSocketCloseInfo, IWebSocketConnectOptions, IWebSocketMessageEnvelope, IWebSocketMessageHandler, IWebSocketTransport, } from '@mcp-abap-adt/interfaces';
 export { FileCertificateMaterialLoader } from './auth/FileCertificateMaterialLoader.js';
+export { BasicAuthProvider, CertificateAuthProvider, SamlAuthProvider, TokenAuthProvider, } from './auth/providers.js';
 export type { SapAuthType, SapConfig, SapConnectionType, } from './config/sapConfig.js';
 export { sapConfigSignature } from './config/sapConfig.js';
 export type { AbapConnection, AbapRequestOptions, } from './connection/AbapConnection.js';
-export { BaseAbapConnection, BaseAbapConnection as OnPremAbapConnection, } from './connection/BaseAbapConnection.js';
-export { CertificateAbapConnection } from './connection/CertificateAbapConnection.js';
-export { createAbapConnection } from './connection/connectionFactory.js';
+export { AdtCloudConnector } from './connection/AdtCloudConnector.js';
+export { AdtOnPremConnector } from './connection/AdtOnPremConnector.js';
+export { CloudHttpTransport } from './connection/CloudHttpTransport.js';
 export { CSRF_CONFIG, CSRF_ERROR_MESSAGES } from './connection/csrfConfig.js';
 export { GenericWebSocketTransport, type IWebSocketFactory, type IWebSocketLike, } from './connection/GenericWebSocketTransport.js';
-export { JwtAbapConnection, JwtAbapConnection as CloudAbapConnection, } from './connection/JwtAbapConnection.js';
-export { KerberosAbapConnection } from './connection/KerberosAbapConnection.js';
-export { RfcAbapConnection } from './connection/RfcAbapConnection.js';
-export { SamlAbapConnection } from './connection/SamlAbapConnection.js';
+export { HttpTransport } from './connection/HttpTransport.js';
+export type { IAdtEstablishContext, IAdtSessionContext, IAdtTransport, IAdtTransportRequest, IAdtTransportResponse, ICloudTransport, IOnPremTransport, } from './connection/IAdtTransport.js';
+export { LegacyOnPremHttpTransport } from './connection/LegacyOnPremHttpTransport.js';
+export { OnPremHttpTransport } from './connection/OnPremHttpTransport.js';
+export { type IRfcConversation, RfcTransport, } from './connection/RfcTransport.js';
+export { type RfcConnectionParams, rfcConversationFrom, rfcParamsFrom, } from './connection/rfcConversation.js';
 export type { ILogger } from './logger.js';
 export { getTimeout, getTimeoutConfig, type TimeoutConfig, } from './utils/timeouts.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,YAAY,EACV,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AAOxC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,IAAI,oBAAoB,GAC3C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,IAAI,mBAAmB,GACzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAKxF,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAQxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EACL,KAAK,gBAAgB,EACrB,YAAY,GACb,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,aAAa,GACd,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,41 +1,53 @@
 "use strict";
 // Types - re-exported from interfaces package with backward compatibility aliases
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getTimeoutConfig = exports.getTimeout = exports.SamlAbapConnection = exports.RfcAbapConnection = exports.KerberosAbapConnection = exports.CloudAbapConnection = exports.JwtAbapConnection = exports.GenericWebSocketTransport = exports.CSRF_ERROR_MESSAGES = exports.CSRF_CONFIG = exports.createAbapConnection = exports.CertificateAbapConnection = exports.OnPremAbapConnection = exports.BaseAbapConnection = exports.sapConfigSignature = exports.FileCertificateMaterialLoader = void 0;
+exports.getTimeoutConfig = exports.getTimeout = exports.rfcParamsFrom = exports.rfcConversationFrom = exports.RfcTransport = exports.OnPremHttpTransport = exports.LegacyOnPremHttpTransport = exports.HttpTransport = exports.GenericWebSocketTransport = exports.CSRF_ERROR_MESSAGES = exports.CSRF_CONFIG = exports.CloudHttpTransport = exports.AdtOnPremConnector = exports.AdtCloudConnector = exports.sapConfigSignature = exports.TokenAuthProvider = exports.SamlAuthProvider = exports.CertificateAuthProvider = exports.BasicAuthProvider = exports.FileCertificateMaterialLoader = void 0;
 var FileCertificateMaterialLoader_js_1 = require("./auth/FileCertificateMaterialLoader.js");
 Object.defineProperty(exports, "FileCertificateMaterialLoader", { enumerable: true, get: function () { return FileCertificateMaterialLoader_js_1.FileCertificateMaterialLoader; } });
+// IAuthProvider is deliberately NOT re-exported. It lives in
+// @mcp-abap-adt/interfaces and a consumer imports it from there — the same rule
+// the session-lifecycle vocabulary follows below, and for the same reason: two
+// names for one contract let the two drift.
+var providers_js_1 = require("./auth/providers.js");
+Object.defineProperty(exports, "BasicAuthProvider", { enumerable: true, get: function () { return providers_js_1.BasicAuthProvider; } });
+Object.defineProperty(exports, "CertificateAuthProvider", { enumerable: true, get: function () { return providers_js_1.CertificateAuthProvider; } });
+Object.defineProperty(exports, "SamlAuthProvider", { enumerable: true, get: function () { return providers_js_1.SamlAuthProvider; } });
+Object.defineProperty(exports, "TokenAuthProvider", { enumerable: true, get: function () { return providers_js_1.TokenAuthProvider; } });
 // Config utilities
 var sapConfig_js_1 = require("./config/sapConfig.js");
 Object.defineProperty(exports, "sapConfigSignature", { enumerable: true, get: function () { return sapConfig_js_1.sapConfigSignature; } });
+var AdtCloudConnector_js_1 = require("./connection/AdtCloudConnector.js");
+Object.defineProperty(exports, "AdtCloudConnector", { enumerable: true, get: function () { return AdtCloudConnector_js_1.AdtCloudConnector; } });
+var AdtOnPremConnector_js_1 = require("./connection/AdtOnPremConnector.js");
+Object.defineProperty(exports, "AdtOnPremConnector", { enumerable: true, get: function () { return AdtOnPremConnector_js_1.AdtOnPremConnector; } });
+var CloudHttpTransport_js_1 = require("./connection/CloudHttpTransport.js");
+Object.defineProperty(exports, "CloudHttpTransport", { enumerable: true, get: function () { return CloudHttpTransport_js_1.CloudHttpTransport; } });
 // The session lifecycle vocabulary — ISessionLifecycleAware, ADT_SESSION_ERROR —
 // is deliberately NOT exported here. It lives in @mcp-abap-adt/interfaces, and a
 // consumer imports it from there: re-exporting a contract type gives it two
 // names and lets the two drift.
 // Connection classes - only final implementations
 // Deprecated aliases for backward compatibility
-var BaseAbapConnection_js_1 = require("./connection/BaseAbapConnection.js");
-Object.defineProperty(exports, "BaseAbapConnection", { enumerable: true, get: function () { return BaseAbapConnection_js_1.BaseAbapConnection; } });
-Object.defineProperty(exports, "OnPremAbapConnection", { enumerable: true, get: function () { return BaseAbapConnection_js_1.BaseAbapConnection; } });
-var CertificateAbapConnection_js_1 = require("./connection/CertificateAbapConnection.js");
-Object.defineProperty(exports, "CertificateAbapConnection", { enumerable: true, get: function () { return CertificateAbapConnection_js_1.CertificateAbapConnection; } });
-// Factory
-var connectionFactory_js_1 = require("./connection/connectionFactory.js");
-Object.defineProperty(exports, "createAbapConnection", { enumerable: true, get: function () { return connectionFactory_js_1.createAbapConnection; } });
 // CSRF configuration
 var csrfConfig_js_1 = require("./connection/csrfConfig.js");
 Object.defineProperty(exports, "CSRF_CONFIG", { enumerable: true, get: function () { return csrfConfig_js_1.CSRF_CONFIG; } });
 Object.defineProperty(exports, "CSRF_ERROR_MESSAGES", { enumerable: true, get: function () { return csrfConfig_js_1.CSRF_ERROR_MESSAGES; } });
 var GenericWebSocketTransport_js_1 = require("./connection/GenericWebSocketTransport.js");
 Object.defineProperty(exports, "GenericWebSocketTransport", { enumerable: true, get: function () { return GenericWebSocketTransport_js_1.GenericWebSocketTransport; } });
-var JwtAbapConnection_js_1 = require("./connection/JwtAbapConnection.js");
-Object.defineProperty(exports, "JwtAbapConnection", { enumerable: true, get: function () { return JwtAbapConnection_js_1.JwtAbapConnection; } });
-Object.defineProperty(exports, "CloudAbapConnection", { enumerable: true, get: function () { return JwtAbapConnection_js_1.JwtAbapConnection; } });
-var KerberosAbapConnection_js_1 = require("./connection/KerberosAbapConnection.js");
-Object.defineProperty(exports, "KerberosAbapConnection", { enumerable: true, get: function () { return KerberosAbapConnection_js_1.KerberosAbapConnection; } });
-var RfcAbapConnection_js_1 = require("./connection/RfcAbapConnection.js");
-Object.defineProperty(exports, "RfcAbapConnection", { enumerable: true, get: function () { return RfcAbapConnection_js_1.RfcAbapConnection; } });
-var SamlAbapConnection_js_1 = require("./connection/SamlAbapConnection.js");
-Object.defineProperty(exports, "SamlAbapConnection", { enumerable: true, get: function () { return SamlAbapConnection_js_1.SamlAbapConnection; } });
+// The transport axis. Both ends are objects, so a caller can name either.
+var HttpTransport_js_1 = require("./connection/HttpTransport.js");
+Object.defineProperty(exports, "HttpTransport", { enumerable: true, get: function () { return HttpTransport_js_1.HttpTransport; } });
+var LegacyOnPremHttpTransport_js_1 = require("./connection/LegacyOnPremHttpTransport.js");
+Object.defineProperty(exports, "LegacyOnPremHttpTransport", { enumerable: true, get: function () { return LegacyOnPremHttpTransport_js_1.LegacyOnPremHttpTransport; } });
+var OnPremHttpTransport_js_1 = require("./connection/OnPremHttpTransport.js");
+Object.defineProperty(exports, "OnPremHttpTransport", { enumerable: true, get: function () { return OnPremHttpTransport_js_1.OnPremHttpTransport; } });
+var RfcTransport_js_1 = require("./connection/RfcTransport.js");
+Object.defineProperty(exports, "RfcTransport", { enumerable: true, get: function () { return RfcTransport_js_1.RfcTransport; } });
+// The front door to the RFC wire: the derivation a consumer would otherwise
+// copy, and the SDK loaded only when a conversation is opened.
+var rfcConversation_js_1 = require("./connection/rfcConversation.js");
+Object.defineProperty(exports, "rfcConversationFrom", { enumerable: true, get: function () { return rfcConversation_js_1.rfcConversationFrom; } });
+Object.defineProperty(exports, "rfcParamsFrom", { enumerable: true, get: function () { return rfcConversation_js_1.rfcParamsFrom; } });
 // Timeouts
 var timeouts_js_1 = require("./utils/timeouts.js");
 Object.defineProperty(exports, "getTimeout", { enumerable: true, get: function () { return timeouts_js_1.getTimeout; } });

package/dist/session/SessionLifecycle.d.ts

@@ -7,8 +7,23 @@
  * this unit testable without a server, and it is where the hard part lives:
  * ordering, admission, and telling one session from the next.
  *
- * Design: docs/superpowers/specs/2026-07-31-teardown-policy-design.md in
- * @mcp-abap-adt/adt-clients.
+ * What it guarantees, since the design note it used to point at lived in another
+ * package and has been deleted with the work it described:
+ *
+ *   - **One transition at a time**, on a serializing tail. Connects join
+ *     connects and disconnects join disconnects, so concurrent callers share one
+ *     establishment or one teardown rather than racing to build and demolish the
+ *     same session.
+ *   - **Admission is synchronous.** A request is admitted, or refused, in the
+ *     same step that counts it — so nothing can be admitted and still be
+ *     invisible to a teardown draining at that instant.
+ *   - **A teardown waits for nothing.** In-flight requests run to completion
+ *     untouched; their results are fenced by session generation so a late answer
+ *     cannot write over a session established since.
+ *   - **Identity is observed, never assumed.** A changed fingerprint means the
+ *     session we had is gone and this is a different one, which is fatal to
+ *     anything held against the old one;
+ *     an unchanged one says nothing about whether the server still has it.
  */
 import { type AdtSessionErrorCode } from '@mcp-abap-adt/interfaces';
 export type TransitionKind = 'connect' | 'disconnect' | 'recover' | 'cleanup';

package/dist/session/SessionLifecycle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SessionLifecycle.d.ts","sourceRoot":"","sources":["../../src/session/SessionLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC9B,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,GAAG;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAMvC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAK;IAErB,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,WAAW,CAAiC;IAIpD,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAM5B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;;;;OAKG;IACH,aAAa,CAAC,WAAW,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GAAG,IAAI;IAOzE;;;;;;OAMG;IACH,cAAc,IAAI,IAAI;IAItB,gBAAgB,IAAI,IAAI;IAKxB;;;;;;OAMG;IACH,OAAO,CACL,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACvC,WAAW,GAAG,aAAa,GAAG,UAAU;IAiB3C,YAAY,IAAI,IAAI;IAMpB,4EAA4E;IAC5E,YAAY,IAAI,YAAY;IAiB5B,2FAA2F;IAC3F,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO;IAM3D,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,oBAAoB,GAAG,IAAI;IAelE,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAID;;;;;;;;;OASG;IACH,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAuBvE"}
+{"version":3,"file":"SessionLifecycle.d.ts","sourceRoot":"","sources":["../../src/session/SessionLifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAElC,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;AAE9E,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yDAAyD;IACzD,OAAO,IAAI,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0FAA0F;IAC1F,MAAM,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC9B,iFAAiF;IACjF,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,wBAAgB,YAAY,CAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,GAAG;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,CAMvC;AAED,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,KAAK,CAAgD;IAC7D,OAAO,CAAC,WAAW,CAA6B;IAChD,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,UAAU,CAAK;IAEvB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAK;IAErB,OAAO,CAAC,IAAI,CAAuC;IACnD,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,WAAW,CAAiC;IAIpD,4EAA4E;IAC5E,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,GAAG,IAAI,CAM5B;IAED,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;;;;;;;;;;OAaG;IACH,IAAI,iBAAiB,IAAI,MAAM,CAE9B;IAED;;;;;OAKG;IACH,aAAa,CAAC,WAAW,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GAAG,IAAI;IAOzE;;;;;;OAMG;IACH,cAAc,IAAI,IAAI;IAItB,gBAAgB,IAAI,IAAI;IAKxB;;;;;;OAMG;IACH,OAAO,CACL,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACvC,WAAW,GAAG,aAAa,GAAG,UAAU;IAiB3C,YAAY,IAAI,IAAI;IAMpB,4EAA4E;IAC5E,YAAY,IAAI,YAAY;IAiB5B,2FAA2F;IAC3F,IAAI,gBAAgB,IAAI,MAAM,CAE7B;IAED;;;;;;;OAOG;IACH,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,GAAG,OAAO;IAM3D,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,oBAAoB,GAAG,IAAI;IAelE,IAAI,iBAAiB,IAAI,OAAO,CAE/B;IAID;;;;;;;;;OASG;IACH,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAuBvE"}

package/dist/session/SessionLifecycle.js

@@ -8,8 +8,23 @@
  * this unit testable without a server, and it is where the hard part lives:
  * ordering, admission, and telling one session from the next.
  *
- * Design: docs/superpowers/specs/2026-07-31-teardown-policy-design.md in
- * @mcp-abap-adt/adt-clients.
+ * What it guarantees, since the design note it used to point at lived in another
+ * package and has been deleted with the work it described:
+ *
+ *   - **One transition at a time**, on a serializing tail. Connects join
+ *     connects and disconnects join disconnects, so concurrent callers share one
+ *     establishment or one teardown rather than racing to build and demolish the
+ *     same session.
+ *   - **Admission is synchronous.** A request is admitted, or refused, in the
+ *     same step that counts it — so nothing can be admitted and still be
+ *     invisible to a teardown draining at that instant.
+ *   - **A teardown waits for nothing.** In-flight requests run to completion
+ *     untouched; their results are fenced by session generation so a late answer
+ *     cannot write over a session established since.
+ *   - **Identity is observed, never assumed.** A changed fingerprint means the
+ *     session we had is gone and this is a different one, which is fatal to
+ *     anything held against the old one;
+ *     an unchanged one says nothing about whether the server still has it.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionLifecycle = void 0;

package/dist/utils/cookies.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Join two `Cookie` header values, later wins on a repeated name.
+ *
+ * Used wherever a request already carries cookies and more are added: a
+ * credential can BE cookies — a SAML session is handed over as `MYSAPSSO2` —
+ * so writing the session jar over the header drops the very thing the request
+ * authenticates with. Both belong on the wire: one says who we are, the other
+ * which session we are in. A name in both is the session's, because that is the
+ * one the server just issued.
+ */
+export declare function mergeCookieHeaders(existing: string | undefined, incoming: string | undefined): string;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/utils/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/utils/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,GAAG,SAAS,GAC3B,MAAM,CASR"}

package/dist/utils/cookies.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeCookieHeaders = mergeCookieHeaders;
+/**
+ * Join two `Cookie` header values, later wins on a repeated name.
+ *
+ * Used wherever a request already carries cookies and more are added: a
+ * credential can BE cookies — a SAML session is handed over as `MYSAPSSO2` —
+ * so writing the session jar over the header drops the very thing the request
+ * authenticates with. Both belong on the wire: one says who we are, the other
+ * which session we are in. A name in both is the session's, because that is the
+ * one the server just issued.
+ */
+function mergeCookieHeaders(existing, incoming) {
+    const parts = [existing, incoming].filter(Boolean).join('; ');
+    const byName = new Map();
+    for (const part of parts.split(';')) {
+        const pair = part.trim();
+        if (!pair)
+            continue;
+        byName.set(pair.slice(0, pair.indexOf('=')), pair);
+    }
+    return [...byName.values()].join('; ');
+}

package/dist/utils/timeouts.d.ts

@@ -5,9 +5,12 @@ export declare function getTimeout(type?: 'default' | 'csrf' | 'long' | number):
 /**
  * Large ceiling timeout applied while a connection is inside an uninterruptible
  * critical section (lock → modify → unlock). A short per-request timeout must
- * not abort such a request mid-flight: aborting tears down the socket, which
- * drops the stateful ADT session and orphans the lock handle (object left
- * locked and inactive). Configurable via SAP_TIMEOUT_CRITICAL (ms).
+ * not abort such a request mid-flight — not because aborting ends anything on
+ * the server, but because it ends what the CLIENT knows: the modification may
+ * or may not have been applied, and the handle `unlock` needs is gone, while
+ * the lock and the ABAP session holding it sit there until that server-side
+ * idle timeout, which this side can neither read nor influence.
+ * Configurable via SAP_TIMEOUT_CRITICAL (ms).
  * Default 600000 (10 minutes) — a generous ceiling that still guards against a
  * permanently dead socket hanging forever.
  */

package/dist/utils/timeouts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeouts.d.ts","sourceRoot":"","sources":["../../src/utils/timeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAED,wBAAgB,UAAU,CACxB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAkB,GACrD,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}
+{"version":3,"file":"timeouts.d.ts","sourceRoot":"","sources":["../../src/utils/timeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAED,wBAAgB,UAAU,CACxB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAkB,GACrD,MAAM,CAOR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}

package/dist/utils/timeouts.js

@@ -23,9 +23,12 @@ function getTimeout(type = 'default') {
 /**
  * Large ceiling timeout applied while a connection is inside an uninterruptible
  * critical section (lock → modify → unlock). A short per-request timeout must
- * not abort such a request mid-flight: aborting tears down the socket, which
- * drops the stateful ADT session and orphans the lock handle (object left
- * locked and inactive). Configurable via SAP_TIMEOUT_CRITICAL (ms).
+ * not abort such a request mid-flight — not because aborting ends anything on
+ * the server, but because it ends what the CLIENT knows: the modification may
+ * or may not have been applied, and the handle `unlock` needs is gone, while
+ * the lock and the ABAP session holding it sit there until that server-side
+ * idle timeout, which this side can neither read nor influence.
+ * Configurable via SAP_TIMEOUT_CRITICAL (ms).
  * Default 600000 (10 minutes) — a generous ceiling that still guards against a
  * permanently dead socket hanging forever.
  */