@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/docs/INDEX.md

@@ -15,6 +15,7 @@ mcp-abap-connection/
 │   ├── INSTALLATION.md             # Setup and installation guide
 │   ├── USAGE.md                    # API documentation and examples
 │   ├── MIGRATION-2.0.md            # Moving to the explicit session lifecycle
+│   ├── MIGRATION-6.0.md            # the factory and the per-credential classes go; RFC is a transport
 │   ├── MIGRATION-4.0.md            # JWT error classification: 401 refreshes, 403 propagates
 │   ├── SCOPE.md                    # What this package does and does not own
 │   ├── STATEFUL_SESSION_GUIDE.md   # Stateful requests and lock windows
@@ -43,6 +44,7 @@ mcp-abap-connection/
 - 🔑 [JWT Auth Tools](./JWT_AUTH_TOOLS.md) - CLI tool for browser-based authentication
 
 ### Upgrading
+- 🚚 [Migrating to 6.0.0](./MIGRATION-6.0.md) - the factory and the per-credential classes are removed; the RFC wire is a transport you hand to the on-prem connector
 - 🧱 [Migrating to 4.0.0](./MIGRATION-4.0.md) - JWT error classification: a 401 refreshes, a 403 propagates with the server's message
 - 🧱 [Migrating to 2.0.0](./MIGRATION-2.0.md) - The explicit session lifecycle: `connect()` is required
 
@@ -72,8 +74,9 @@ mcp-abap-connection/
 ### API Reference
 - **Connection Interface**: [USAGE.md - API Reference](./USAGE.md#api-reference)
 - **Configuration Types**: [USAGE.md - Configuration Types](./USAGE.md#configuration-types)
-- **Factory Function**: `createAbapConnection()`
-- **Connection Classes**: `BaseAbapConnection`, `JwtAbapConnection`
+- **Connectors**: `AdtOnPremConnector`, `AdtCloudConnector`
+- **Credentials**: `BasicAuthProvider`, `TokenAuthProvider`, `SamlAuthProvider`, `CertificateAuthProvider`
+- **Transports**: `HttpTransport`, `RfcTransport` (+ `rfcConversationFrom()`)
 
 ## Version Highlights
 

package/docs/INSTALLATION.md

@@ -83,7 +83,7 @@ In your code:
 
 ```typescript
 import 'dotenv/config'; // or require('dotenv').config();
-import { createAbapConnection } from '@mcp-abap-adt/connection';
+import { AdtOnPremConnector, BasicAuthProvider } from '@mcp-abap-adt/connection';
 
 const config = {
   url: process.env.SAP_URL!,
@@ -138,7 +138,7 @@ See [JWT_AUTH_TOOLS.md](./JWT_AUTH_TOOLS.md) for detailed CLI documentation.
 ### Test Installation
 
 ```bash
-node -e "const { createAbapConnection } = require('@mcp-abap-adt/connection'); console.log('✓ Package loaded successfully');"
+node -e "const { AdtOnPremConnector } = require('@mcp-abap-adt/connection'); console.log('✓ Package loaded successfully');"
 ```
 
 ### Test Connection (Basic Auth)
@@ -146,7 +146,7 @@ node -e "const { createAbapConnection } = require('@mcp-abap-adt/connection'); c
 Create `test-connection.js`:
 
 ```javascript
-const { createAbapConnection } = require('@mcp-abap-adt/connection');
+const { AdtOnPremConnector, BasicAuthProvider } = require('@mcp-abap-adt/connection');
 
 const config = {
   url: 'https://your-sap-server.com',
@@ -163,7 +163,15 @@ const logger = {
   debug: (msg) => console.log('[DEBUG]', msg),
 };
 
-const connection = createAbapConnection(config, logger);
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new OnPremHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 
 connection.connect()
   .then(() =>
@@ -214,7 +222,13 @@ npm install --save-dev typescript @types/node
 ### TypeScript Example
 
 ```typescript
-import { createAbapConnection, SapConfig, ILogger } from '@mcp-abap-adt/connection';
+import {
+  AdtOnPremConnector,
+  BasicAuthProvider,
+  ILogger,
+  OnPremHttpTransport,
+  SapConfig,
+} from '@mcp-abap-adt/connection';
 
 const config: SapConfig = {
   url: 'https://your-sap-server.com',
@@ -231,7 +245,15 @@ const logger: ILogger = {
   debug: (msg: string) => console.log(msg),
 };
 
-const connection = createAbapConnection(config, logger);
+const connection = new AdtOnPremConnector(
+  config,
+  new BasicAuthProvider(config.username!, config.password!),
+  new OnPremHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 ```
 
 ## Troubleshooting

package/docs/JWT_AUTH_TOOLS.md

@@ -123,13 +123,29 @@ source .env
 Or configure `SapConfig` directly:
 
 ```ts
-import { createAbapConnection } from "@mcp-abap-adt/connection";
-
-const connection = createAbapConnection({
+import {
+  AdtCloudConnector,
+  CloudHttpTransport,
+  TokenAuthProvider,
+} from "@mcp-abap-adt/connection";
+import type { SapConfig } from "@mcp-abap-adt/connection";
+
+const config: SapConfig = {
   url: process.env.SAP_URL!,
   authType: "jwt",
   jwtToken: process.env.SAP_JWT_TOKEN!,
-});
+};
+const logger = console;
+
+const connection = new AdtCloudConnector(
+  config,
+  new TokenAuthProvider(config.jwtToken!),
+  new CloudHttpTransport(() => ({}), logger, {
+    client: config.client,
+    baseUrl: config.url,
+  }),
+  logger,
+);
 
 // Note: Token refresh is handled by @mcp-abap-adt/auth-broker package
 // The refresh token credentials in .env are used by auth-broker, not connection

package/docs/MIGRATION-2.0.md

@@ -46,7 +46,7 @@ later, on the first request, as an unrelated-looking 401.
 
 ### 3. Requests are refused after a teardown
 
-`disconnect()` and `reset()` stop the connection from serving requests until the
+`disconnect()` stops the connection from serving requests until the
 next `connect()`. An in-flight request is not cut off and not waited for either:
 it runs to completion, and its result is fenced so it cannot touch a session
 established since.

package/docs/MIGRATION-5.0.md

@@ -0,0 +1,116 @@
+# Migrating to 5.0.0
+
+Two things changed, and the second is why the first was possible.
+
+**A connection now closes what it opened.** `disconnect()` tells the server the
+session is finished instead of only dropping the cookie, and `connect()` fails
+when the server opened no session rather than handing back a connection whose
+first lock would be dead.
+
+**The class you take says which system you are dialling, not which credential
+you hold.** `AdtOnPremConnector` and `AdtCloudConnector` are handed an auth
+provider; the five auth classes still work and are deprecated.
+
+---
+
+## If you use `createAbapConnection()`
+
+It still works, unchanged, and now warns once per call that the connection is
+being chosen from `authType`. Say which system instead:
+
+```ts
+// before
+const conn = createAbapConnection(config, logger, undefined, tokenRefresher);
+
+// after
+const conn = createAbapConnection(config, logger, undefined, tokenRefresher, {
+  system: 'cloud',   // or 'onprem'
+});
+```
+
+Nothing is detected. The two systems do not manage sessions the same way, and
+asking the server which it is does not work: `/sap/bc/adt/core/http/sessions`
+answers on on-prem too, and its `DELETE` there leaves the session open while the
+platform logoff removes it. Only you know where you are pointing.
+
+## If you build a connection class directly
+
+```ts
+// before                                    // after
+new BaseAbapConnection(cfg, log)             new AdtOnPremConnector(cfg, new BasicAuthProvider(user, pass), log)
+new JwtAbapConnection(cfg, log, id, refr)    new AdtCloudConnector(cfg, new TokenAuthProvider(refr), log)
+new SamlAbapConnection(cfg, log)             new AdtOnPremConnector(cfg, new SamlAuthProvider(cookies), log)
+new CertificateAbapConnection(cfg, log)      new AdtOnPremConnector(cfg, new CertificateAuthProvider(loader, cfg), log)
+```
+
+`KerberosAbapConnection` has no provider yet — its SPNEGO exchange *is* the CSRF
+fetch — so keep using the class. See #35.
+
+The old classes are not removed and not scheduled for removal here.
+
+## `reset()` is gone — BREAKING
+
+There is no local-only discard, because there is no local-only session: it lives
+on the server, and dropping the cookie leaves it there.
+
+```ts
+conn.reset();                 // before
+await conn.disconnect();      // after — and connect() again to carry on
+```
+
+A caller that does not want to wait simply does not `await` it, which is what
+`reset()` was mostly used for. `RfcAbapConnection` keeps `close()`.
+
+## `connect()` can now fail where it used to warn — BREAKING
+
+When the server authenticates the request but opens no session, `connect()`
+rejects with `ADT_NOT_CONNECTED` and a message saying what happened, what still
+works, and the usual cause. It used to log a warning and hand the connection
+back — and the failure then surfaced a request later, as `400 Session not found`
+with the object half-edited.
+
+Verified rather than assumed: a connection that received no `SAP_SESSIONID` is
+listed in the server's own session list as **nothing at all**.
+
+Nothing is retried on your behalf. Whether to wait, retry, or release sessions
+the user still holds depends on things only you know.
+
+## `disconnect()` now makes a network call
+
+It tells the server the session is finished. Two consequences:
+
+- **It can wait.** By default it does not: `SAP_RELEASE_DEADLINE_MS` is `0`,
+  because waiting is for steps whose successor needs the server to have caught
+  up, and a teardown has none. Pass `disconnect({ deadlineMs })` if you want a
+  bounded wait — the deadline bounds the **wait**, never the request.
+- **Requests still in flight will start failing.** The session they are running
+  on is the one being released. That is you having asked to disconnect, not a
+  race — finish or abandon your chains first.
+
+It still never throws, including on a nonsense `deadlineMs`: its place is a
+`finally`, where an exception would replace the error that sent you there.
+
+## Token renewal, if you use a provider
+
+Nothing to do, but worth knowing what changed. The connector no longer caches
+the token it was given. It asks the provider per request — cheap, because the
+provider caches — and on a `401` it tells the provider its answer was refused
+(`refreshToken()`, per that contract), asks again, and only if the answer
+changed rebuilds the session and retries once. An unchanged answer means the
+server refused those credentials, and the `401` reaches you.
+
+So a password does the right thing with no configuration, and a bearer token is
+renewed without a class of its own.
+
+## Sessions are a shared, per-user resource
+
+Not an API change, a fact worth having. The limit is per user and the pool is
+shared with everything else logged on as them, a SAP GUI session included. The
+timeout is **idle-based**: a connection that keeps working keeps its session,
+one that goes quiet past the window loses it. There is no keepalive timer here,
+deliberately — how long to hold a session is yours to decide.
+
+And the shape of the problem this release addresses, seen from the other end: a
+process that opens a connection per check and never disconnects filled a
+system's session list at one session every ten seconds. Releasing what you open
+is half of it; opening one connection instead of one per check is the other.

package/docs/MIGRATION-6.0.md

@@ -0,0 +1,359 @@
+# Migration to 6.0
+
+The factory and the six connection classes are gone. What replaces them is not a
+new API so much as the one 5.0 introduced, now the only one: **you state which
+system, which credential, and which wire, and nothing is worked out for you.**
+
+**The wire is a required argument.** There is no default to fall back to and
+nothing is derived from the config, because which wire a deployment uses is a
+fact about the deployment. It also carries the two things only you can supply —
+the credential's TLS material and the client — so it arrives built.
+
+If you already moved to `AdtOnPremConnector` / `AdtCloudConnector` in 5.0, most
+of this does not apply to you — skip to [Taking the RFC wire](#taking-the-rfc-wire).
+
+## What was removed
+
+| removed | take instead |
+|---|---|
+| `createAbapConnection()` | `new AdtOnPremConnector(...)` or `new AdtCloudConnector(...)` |
+| `BaseAbapConnection`, `OnPremAbapConnection` | `AdtOnPremConnector` + `BasicAuthProvider` |
+| `JwtAbapConnection`, `CloudAbapConnection` | `AdtCloudConnector` + `TokenAuthProvider` |
+| `SamlAbapConnection` | `AdtOnPremConnector` + `SamlAuthProvider` |
+| `CertificateAbapConnection` | `AdtOnPremConnector` + `CertificateAuthProvider` |
+| `KerberosAbapConnection` | — see [Kerberos](#kerberos) |
+| `RfcAbapConnection`, `connectionType: 'rfc'` | `AdtOnPremConnector` + `RfcTransport` |
+| `disconnect({ deadlineMs })` | `disconnect()` — see [Teardown](#teardown) |
+
+## Why
+
+The factory switched on things the caller had already said. Given
+`options.system` it did no inference at all, and without it, it inferred the
+session mechanism from the credential — which is the arrangement that gets one
+of them wrong: a bearer token against an on-prem system is ordinary, and it does
+not make that system a cloud one.
+
+The classes had the same shape of problem one level down. Six subclasses
+distinguished by an argument, and `RfcAbapConnection` was a second translation of
+`SADT_REST_RFC_ENDPOINT` beside `RfcTransport` — two of those drift, and these
+had: the class was missing a default `Accept` header and carried cookie-handling
+code that could never run.
+
+## Basic
+
+```diff
+-import { createAbapConnection } from '@mcp-abap-adt/connection';
++import {
++  AdtOnPremConnector,
++  BasicAuthProvider,
++} from '@mcp-abap-adt/connection';
+
+-const connection = createAbapConnection(config, logger, undefined, undefined, {
+-  system: 'onprem',
+-});
++const connection = new AdtOnPremConnector(
++  config,
++  new BasicAuthProvider(config.username!, config.password!),
++  new OnPremHttpTransport(() => ({}), logger, {
++    client: config.client,
++    baseUrl: config.url,
++  }),
++  logger,
++);
+```
+
+`client` is not decoration: SAP answers `sap-usercontext` with the system
+default rather than the client you asked for, and later requests then route to a
+client you never named — on a read-only one, every write comes back `403`.
+
+## JWT / OAuth2
+
+```diff
+-const connection = createAbapConnection(config, logger, undefined, refresher, {
+-  system: 'cloud',
+-});
++const connection = new AdtCloudConnector(
++  config,
++  new TokenAuthProvider(refresher),
++  new CloudHttpTransport(() => ({}), logger, {
++    client: config.client,
++    baseUrl: config.url,
++  }),
++  logger,
++);
+```
+
+The cloud wire is not the on-prem one with a different name. It asks for a
+session at `/sap/bc/adt/core/http/sessions` and gives it back by `DELETE` on the
+address the server publishes; the on-prem wire has neither, and says goodbye
+through the platform logoff. Handing the wrong one to a connector does not
+compile.
+
+The `ITokenRefresher` that used to be a constructor slot **is** the credential
+now. Hand `TokenAuthProvider` a bare string instead and you get a token with
+nothing behind it — fine for a short task, wrong for anything long-lived.
+
+One behaviour to know about: **a credential refused during `connect()` now
+surfaces.** The old class renewed and retried inside its own CSRF fetch. It does
+not any more, and deliberately: renewal is the provider's, and the provider does
+it on an expiry it can see, on every call that asks for a header. A token the
+provider still believes in and the server refuses is a credential that needs
+attention, and `connect()` is one call you make — so the refusal is yours to
+answer.
+
+The request path changed the same way, and in the same direction: a 401 is no
+longer answered here either. See [A refused credential](#a-refused-credential).
+
+## SAML
+
+```diff
+-const connection = new SamlAbapConnection(config, logger);
++const connection = new AdtOnPremConnector(
++  config,
++  new SamlAuthProvider(config.sessionCookies!),
++  new OnPremHttpTransport(() => ({}), logger, {
++    client: config.client,
++    baseUrl: config.url,
++  }),
++  logger,
++);
+```
+
+The cookies are the credential — there is no `Authorization` header at all.
+
+## Certificates
+
+A certificate authenticates through the transport rather than through a header,
+so this is the one place the two axes touch — and you wire them, because nobody
+else can:
+
+```diff
+-const connection = new CertificateAbapConnection(config, logger);
++const credential = new CertificateAuthProvider(config, certLoader);
++
++const connection = new AdtOnPremConnector(
++  config,
++  credential,
++  new OnPremHttpTransport(
++    // A thunk, not a value: the material is loaded during connect(), so a
++    // wire that read it at construction would read nothing.
++    () => credential.transportMaterial?.() ?? {},
++    logger,
++    { client: config.client, baseUrl: config.url },
++  ),
++  logger,
++);
+```
+
+Forget the thunk and mTLS silently does not happen — the connection is built,
+the requests go out, and the server refuses them for a reason that says nothing
+about the certificate.
+
+## Taking the RFC wire
+
+`connectionType: 'rfc'` is gone. The wire is an argument now, which is what it
+always was in fact:
+
+```diff
+-const connection = createAbapConnection(
+-  { ...config, connectionType: 'rfc' },
+-  logger,
+-);
++import {
++  AdtOnPremConnector,
++  BasicAuthProvider,
++  RfcTransport,
++  rfcConversationFrom,
++} from '@mcp-abap-adt/connection';
++
++const connection = new AdtOnPremConnector(
++  config,
++  new BasicAuthProvider(config.username!, config.password!),
++  new RfcTransport(rfcConversationFrom(config), logger),
++  logger,
++);
+```
+
+The wire sits where the HTTP one sits, because it is the same argument. There is
+no option to set and no config field to flip.
+
+`rfcConversationFrom(config)` does what the class's constructor did: `ashost`
+from the url, `sysnr` from the HTTP port by the SAP convention that `80XX` is
+the ICM port for system `XX`, `SAP_SYSNR` overriding it for a port that follows
+no convention. The SAP NW RFC SDK is loaded when a conversation opens, not when
+this is called, so a machine without it fails at `connect()` with a message
+saying what to install.
+
+Everything above the wire is unchanged: `makeAdtRequest`, `setSessionType`,
+`disconnect`, and the session lifecycle. Three things are better than they were
+on the removed class:
+
+- a default `Accept` is supplied, so a call that names none is answered rather
+  than refused with `400 ExceptionResourceBadRequest`
+- `disconnect()` and `getSessionIdentity()` exist, which they did not
+- the identity is the conversation, and it changes when the conversation does —
+  so reconnecting reads as a different session instead of the same one
+
+**Where to look for the session.** An HTTP session is an ICF session and appears
+in **SM05**. An RFC conversation appears in **SMGW → Logged on Clients** as
+`NWRFC`, and never in SM05, because there is no ICM in that path.
+
+## Teardown
+
+`disconnect()` takes no arguments.
+
+```diff
+-await connection.disconnect({ deadlineMs: 5000 });
++await connection.disconnect();
+```
+
+It **notifies**: it tells the server the session is finished and does not act on
+the answer — whether and when the session is freed is the server's affair. The
+`deadlineMs` it used to accept bounded a wait for that answer, which bought you
+nothing and was the one thing that could make a teardown unbounded, since the
+goodbye carries no request timeout by design. `SAP_RELEASE_DEADLINE_MS` is gone
+with it.
+
+Everything else is unchanged: it resolves rather than throws, always settles,
+and a repeat call performs whatever is still owed.
+
+## Writing your own credential
+
+The shipped ones need no change from you — they are handed to a connector and
+that is all. If you wrote your own against `IAuthProvider`, it now states all of
+itself. Five members, and three of them are usually empty:
+
+```diff
+ class MyCredential implements IAuthProvider {
+   readonly kind = 'mine';
++  async prepare(): Promise<void> {}
+   async authorizationHeader(): Promise<string | null> { … }
++  cookies(): string | null { return null; }
++  transportMaterial(): ICertificateMaterial { return {}; }
+ }
+```
+
+Empty is not ceremony: "nothing to prepare", "I am not cookies", "I contribute
+no TLS material" are facts about a credential, and a fact is stated rather than
+left for a connection to discover by checking whether a method exists. What it
+buys is that no base class asks anything — every question about a collaborator
+is answered by the type.
+
+**One credential still has no home, and this is the honest statement of it.**
+SPNEGO's token is consumed by the first request that carries it, so the exchange
+and the establishing call are the same act — and `establish()` may retry, asking
+`authorizationHeader()` again per attempt, which for that credential means
+presenting something already spent.
+
+An earlier cut of this release answered it with an atom the connection narrowed
+to. That is gone: a contract earns its place by something implementing it, and
+nothing here implements that one. What such a credential needs is either an
+exchange it owns end to end, or a signal that the establishing request
+succeeded — neither exists yet, and inventing the seam before there is a
+credential to test it against is how the last one came to be removed.
+
+Everything shipping today authenticates by header, cookie or TLS material, and
+those three are what `IAuthProvider` states.
+
+Needs `@mcp-abap-adt/interfaces` 21.0.0.
+
+## A refused credential
+
+The connector used to answer a `401` for you: it called `renew()` on the
+credential, compared the header with the previous one, and rebuilt the session if
+it had changed. It does not any more, and nothing replaces it — the refusal
+surfaces.
+
+Renewal splits in two, and only one half was ever automatic:
+
+- a token that **expired** is replaced inside `authorizationHeader()`, which is
+  asked per request. Nobody decides anything, and nothing changed here;
+- a token the provider still **believes in** and the server refuses is a
+  different thing, and whether that is what happened is a judgement made with
+  what you know.
+
+So handle it where you can:
+
+```diff
+-await conn.makeAdtRequest(options); // a 401 was retried underneath you
++try {
++  await conn.makeAdtRequest(options);
++} catch (error) {
++  if (isUnauthorized(error) && isRenewable(credential)) {
++    await credential.renew();
++    // ... and decide for yourself whether to try again
++  }
++  throw error;
++}
+```
+
+`isRenewable` is the narrowing the contract recommends, since only some
+credentials have it — a password has nothing behind it to ask again, and a SAML
+session was negotiated elsewhere:
+
+```typescript
+import type { IAuthProvider, IRenewableCredential } from '@mcp-abap-adt/interfaces';
+
+function isRenewable(c: IAuthProvider): c is IRenewableCredential {
+  return typeof (c as Partial<IRenewableCredential>).renew === 'function';
+}
+```
+
+Needs `@mcp-abap-adt/interfaces` 19.0.0, where `renew()` becomes that atom
+instead of an optional member every credential carried.
+
+**The connection is not torn down over it.** A refused credential is not a lost
+session, and discarding one the server never complained about would throw away
+work you can still finish.
+
+## Kerberos
+
+`KerberosAbapConnection` is removed without a direct replacement. It was
+single-leg only, and untested against a live KDC — issue #35 says so. If you
+depend on it, stay on 5.x and say so on that issue; a `KerberosAuthProvider`
+belongs on the credential axis and can be added there, but it should be added
+with a system to test it against.
+
+## Types you can now name
+
+The seam is public, so a signature can say what it needs instead of taking any
+connection and casting:
+
+```typescript
+import { AdtOnPremConnector, RfcTransport } from '@mcp-abap-adt/connection';
+import type {
+  IAdtTransport,
+  IAdtTransportRequest,
+  IAdtTransportResponse,
+  IAdtEstablishContext,
+  IAdtSessionContext,
+  IOnPremTransport,
+  ICloudTransport,
+  IRfcConversation,
+  RfcConnectionParams,
+} from '@mcp-abap-adt/connection';
+
+function overRfc(conn: AdtOnPremConnector<IAuthProvider, RfcTransport>) { /* ... */ }
+```
+
+### Bringing your own wire
+
+The connectors are constrained by a marker, not by the shipped classes, so a
+transport you write is a first-class one. Say which system it is for and it fits
+where the shipped wires fit:
+
+```typescript
+import type { IOnPremTransport } from '@mcp-abap-adt/connection';
+
+class RecordingTransport implements IOnPremTransport {
+  readonly kind = 'recording';
+  readonly system = 'onprem' as const;
+  // ... the rest of IAdtTransport
+}
+```
+
+`system` is read by the compiler and never at runtime. Its only job is to stop
+"ABAP Cloud over an on-prem wire" from compiling — which is also why the
+constraint is this marker and not `OnPremHttpTransport`: the shipped classes
+carry private state and compare nominally, so constraining to them would have
+made this impossible while appearing to allow it.

package/docs/SCOPE.md

@@ -35,7 +35,7 @@ It forwards every `(name, value)` pair from the JS `Client(params)` object to `R
 
 **4. For BTP on-prem scenarios (Cloud Connector), the JWT→x509/SNC swap happens server-side in the CC.** The client-side RFC call still carries classic credentials (x509 + SNC), not the JWT. Supporting that would be adding SNC-over-RFC for on-prem backends behind a CC tunnel — an on-prem extension, not a "cloud RFC" feature.
 
-**Conclusion:** "RFC to cloud" is not a missing feature that would be useful to add; it is a category error. ADT to cloud = HTTP (already supported here). RFC to on-prem = supported here via `connectionType: 'rfc'`. Anything claiming a third combination does not map to what the SAP stack actually exposes.
+**Conclusion:** "RFC to cloud" is not a missing feature that would be useful to add; it is a category error. ADT to cloud = HTTP (already supported here). RFC to on-prem = supported here, by handing `AdtOnPremConnector` an `RfcTransport`. Anything claiming a third combination does not map to what the SAP stack actually exposes.
 
 ## See also