@mcp-abap-adt/connection 5.0.0 → 6.0.1

package/dist/connection/RfcTransport.js

@@ -0,0 +1,270 @@
+"use strict";
+/**
+ * An ADT request carried over RFC.
+ *
+ * `SADT_REST_RFC_ENDPOINT` is the standard FM Eclipse ADT uses for on-prem ADT
+ * through JCo, and what it carries is a request line, header fields and a body
+ * — an HTTP request in all but the wire. So this translates, and translating is
+ * the whole of its job.
+ *
+ * It exists because an RFC conversation is inherently stateful: one ABAP
+ * session for the connection's lifetime, which is the way through HTTP 423
+ * "invalid lock handle" on legacy systems (BASIS < 7.50) where stateful HTTP
+ * sessions are not usable.
+ *
+ * **What is NOT here.** Cookies, the CSRF token, `x-sap-adt-sessiontype` and
+ * the session lifecycle belong to the connection above this seam and are
+ * already in `request.headers` by the time `send()` is called. A transport that
+ * also captured cookies would be doing that work twice, and the two copies
+ * would disagree the first time one of them was cleared.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RfcTransport = void 0;
+const node_crypto_1 = require("node:crypto");
+/**
+ * ADT exception types, mapped to what they would have been over HTTP. Standard
+ * types, returned in `<exc:exception>` XML.
+ */
+const EXCEPTION_STATUS = {
+    ExceptionResourceNotFound: { code: 404, text: 'Not Found' },
+    ExceptionResourceNoAuthorization: { code: 403, text: 'Forbidden' },
+    ExceptionResourceAlreadyExists: { code: 409, text: 'Conflict' },
+    ExceptionResourceLocked: { code: 423, text: 'Locked' },
+    ExceptionBadRequest: { code: 400, text: 'Bad Request' },
+    ExceptionNotSupported: { code: 501, text: 'Not Implemented' },
+    ExceptionConflict: { code: 409, text: 'Conflict' },
+};
+function statusFromExceptionXml(body) {
+    const type = /<exc:type[^>]*>([^<]+)<\/exc:type>/.exec(body)?.[1]?.trim();
+    return ((type ? EXCEPTION_STATUS[type] : undefined) ?? {
+        code: 500,
+        text: 'Internal Server Error',
+    });
+}
+function message(e) {
+    if (e instanceof Error)
+        return e.message;
+    if (e && typeof e === 'object')
+        return JSON.stringify(e);
+    return String(e);
+}
+/** Axios's own default, which the classification above this seam is written against. */
+const admits2xx = (status) => status >= 200 && status < 300;
+class RfcTransport {
+    connect;
+    logger;
+    kind = 'rfc';
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    system = 'onprem';
+    conversation = null;
+    /** Names the conversation, and so the ABAP session it carries. */
+    conversationId = '';
+    /**
+     * Nothing to fold in. `SADT_REST_RFC_ENDPOINT` answers with two header
+     * fields — `~server_protocol` and `content-type` — on every call, including
+     * one that asks for a token with `x-csrf-token: fetch`, and on a stateful
+     * POST. Measured on E19. There is no ICM in this path, so there is no ICF
+     * session to cookie and no application server to be redispatched between.
+     */
+    ingest() { }
+    /** None, and never any: see `ingest()`. */
+    cookies() {
+        return null;
+    }
+    /**
+     * Nothing to establish. `open()` made the ABAP session, and there is no token
+     * to earn: this endpoint answers `x-csrf-token: fetch` with the same two
+     * header fields it answers everything else with. A wire with no
+     * cross-site request to forge against needs no token to prove one was not.
+     */
+    async establish(_context) { }
+    /** None: see `establish()`. */
+    csrfToken() {
+        return null;
+    }
+    /**
+     * Ignored. Nothing on this wire reads a token, and keeping one would be
+     * state that never leaves the object.
+     */
+    adoptCsrfToken() { }
+    /**
+     * The conversation, which IS the session — so it is fingerprinted by its own
+     * existence rather than by an address the server hands out.
+     */
+    /** The conversation IS the session, so it exists exactly while that does. */
+    sessionEstablished() {
+        return this.conversation?.alive ?? false;
+    }
+    sessionFingerprint() {
+        const fingerprint = new Map();
+        if (this.conversation?.alive) {
+            fingerprint.set('rfc-conversation', this.conversationId);
+        }
+        return fingerprint;
+    }
+    /** None: there is no dispatcher in front of this wire to stay bound to. */
+    affinityHeaders() {
+        return {};
+    }
+    /**
+     * Nothing to forget separately. The session ends when the conversation does,
+     * and that is `close()` — a wire whose state could be dropped while the
+     * conversation stayed open would be claiming a session it had disowned.
+     */
+    forgetSession() { }
+    /**
+     * The client is built by a factory rather than constructed here: the SDK is
+     * an optional dependency loaded by `require` at open time, and a transport
+     * that reached for it in its constructor could not be built at all on a
+     * machine without it.
+     */
+    constructor(connect, logger = null) {
+        this.connect = connect;
+        this.logger = logger;
+    }
+    async open() {
+        if (this.conversation?.alive)
+            return;
+        const conversation = this.connect();
+        try {
+            await conversation.open();
+        }
+        catch (e) {
+            throw new Error(`Failed to open RFC connection: ${message(e)}`);
+        }
+        this.conversation = conversation;
+        // Minted here, where the session begins. A conversation opened after an
+        // earlier one closed is a DIFFERENT ABAP session, and the fingerprint has
+        // to say so — a constant would report `unchanged` across a reconnect and
+        // hide exactly the replacement the identity policy exists to catch.
+        this.conversationId = (0, node_crypto_1.randomUUID)();
+        this.logger?.debug('RFC conversation opened (stateful by nature)');
+    }
+    /** Never throws, and a repeat call finds nothing owed. */
+    async close() {
+        const conversation = this.conversation;
+        if (!conversation)
+            return;
+        this.conversation = null;
+        this.conversationId = '';
+        try {
+            await conversation.close();
+            this.logger?.debug('RFC conversation closed');
+        }
+        catch (e) {
+            this.logger?.debug(`RFC close error: ${message(e)}`);
+        }
+    }
+    async send(request) {
+        if (!this.conversation?.alive) {
+            throw new Error('RFC transport is not open. Call connect() first.');
+        }
+        const method = request.method.toUpperCase();
+        // HTTP clients serialise `params`; RFC has no such step, so they go into
+        // the URI here or they do not travel at all.
+        let uri = request.url;
+        const query = Object.entries(request.params ?? {}).filter(([, v]) => v !== undefined && v !== null);
+        if (query.length > 0) {
+            const serialised = new URLSearchParams(query.map(([k, v]) => [k, String(v)])).toString();
+            uri += (uri.includes('?') ? '&' : '?') + serialised;
+        }
+        const headerFields = Object.entries(request.headers ?? {}).map(([NAME, VALUE]) => ({ NAME, VALUE: String(VALUE) }));
+        // ADT refuses a request with no Accept — `400 ExceptionResourceBadRequest:
+        // Accept header missing`, measured on E19. Over HTTP axios supplies the
+        // default and nobody notices; this endpoint forwards only what it is
+        // handed, so without this the same call dies on this wire alone.
+        if (!headerFields.some((h) => h.NAME.toLowerCase() === 'accept')) {
+            headerFields.push({ NAME: 'Accept', VALUE: '*/*' });
+        }
+        const body = request.data !== undefined && request.data !== null
+            ? String(request.data)
+            : '';
+        if (body &&
+            !headerFields.some((h) => h.NAME.toLowerCase() === 'content-type')) {
+            headerFields.push({
+                NAME: 'Content-Type',
+                VALUE: 'text/plain; charset=utf-8',
+            });
+        }
+        this.logger?.debug(`RFC → ${method} ${uri}`);
+        // `request.timeout` is deliberately not read, and the absence of the word
+        // here is what made that look like an oversight (#42).
+        //
+        // There is nothing to enforce it with: the SDK exposes no cancel, and an
+        // abandoned call still holds the conversation — the next one would queue
+        // behind a call nobody is waiting for. A deadline that reports failure
+        // while the wire stays busy is worse than none, because the error reads as
+        // "safe to retry" when it is not.
+        //
+        // Nor is one needed. What bounds this call is the server: a dialog step
+        // ends at `rdisp/max_wprun_time`. And a call that cannot be torn down
+        // mid-flight is precisely what the connection emulates over HTTP, where
+        // a critical section raises the caller's timeout to a ten-minute ceiling so
+        // an abort cannot orphan a lock handle. Here that comes free.
+        let raw;
+        try {
+            raw = await this.conversation.call('SADT_REST_RFC_ENDPOINT', {
+                REQUEST: {
+                    REQUEST_LINE: {
+                        METHOD: method,
+                        URI: uri,
+                        VERSION: 'HTTP/1.1',
+                    },
+                    HEADER_FIELDS: headerFields,
+                    MESSAGE_BODY: body ? Buffer.from(body, 'utf-8') : Buffer.alloc(0),
+                },
+            });
+        }
+        catch (e) {
+            // An RFC-level failure, not an answer: nothing came back to classify.
+            const msg = message(e);
+            this.logger?.error(`RFC call failed: ${msg}`);
+            throw new Error(`RFC call to SADT_REST_RFC_ENDPOINT failed: ${msg}`);
+        }
+        const answer = raw.RESPONSE ?? raw;
+        const rawCode = answer.STATUS_LINE?.STATUS_CODE ?? answer.STATUS_LINE?.CODE;
+        let status = typeof rawCode === 'string'
+            ? Number.parseInt(rawCode, 10)
+            : (rawCode ?? 0);
+        let statusText = answer.STATUS_LINE?.REASON_PHRASE ?? answer.STATUS_LINE?.REASON ?? '';
+        const data = answer.MESSAGE_BODY
+            ? Buffer.isBuffer(answer.MESSAGE_BODY)
+                ? answer.MESSAGE_BODY.toString('utf-8')
+                : String(answer.MESSAGE_BODY)
+            : '';
+        const headers = {};
+        for (const field of answer.HEADER_FIELDS ?? []) {
+            if (field.NAME && field.VALUE !== undefined) {
+                headers[String(field.NAME).toLowerCase()] = field.VALUE;
+            }
+        }
+        // BASIS < 7.50 answers without populating STATUS_LINE. Left alone, a
+        // failure would read as 200 with an error document in the body — which is
+        // the green run that inspected nothing, one layer down.
+        if (!status && data.includes('<exc:exception')) {
+            const detected = statusFromExceptionXml(data);
+            status = detected.code;
+            statusText = detected.text;
+            this.logger?.debug(`RFC: STATUS_LINE empty, read ${status} out of the exception XML`);
+        }
+        if (!status) {
+            status = 200;
+            statusText = statusText || 'OK';
+        }
+        this.logger?.debug(`RFC ← ${status} ${statusText} (${data.length} bytes)`);
+        const response = {
+            status,
+            statusText,
+            headers,
+            data,
+        };
+        const admits = request.validateStatus ?? admits2xx;
+        if (!admits(status)) {
+            const error = new Error(`Request failed with status ${status}: ${method} ${uri}`);
+            error.response = response;
+            throw error;
+        }
+        return response;
+    }
+}
+exports.RfcTransport = RfcTransport;

package/dist/connection/rfcConversation.d.ts

@@ -0,0 +1,44 @@
+/**
+ * An RFC conversation, from the config a consumer already holds.
+ *
+ * `RfcTransport` takes a factory rather than connection parameters, and that is
+ * deliberate: `@mcp-abap-adt/sap-rfc-lite` needs the SAP NW RFC SDK on the
+ * machine, and a transport that reached for it in its constructor could not be
+ * built at all where it is absent. But a factory is a poor front door — without
+ * this, reaching the RFC wire means every consumer writing the `require` and
+ * deriving `ashost` and `sysnr` for themselves, which is the derivation the
+ * per-transport connection class used to do for them.
+ *
+ * So the derivation lives here, once, and the SDK is still only touched when a
+ * conversation is actually opened.
+ */
+import type { SapConfig } from '../config/sapConfig.js';
+import type { IRfcConversation } from './RfcTransport.js';
+/** What the native client is constructed with. */
+export interface RfcConnectionParams {
+    ashost: string;
+    sysnr: string;
+    client: string;
+    user: string;
+    passwd: string;
+    lang: string;
+}
+/**
+ * Read out of the config, never asked of the server.
+ *
+ * The system number comes off the HTTP port by the SAP convention that 80XX is
+ * the ICM port for system XX — the convention the port itself follows, not a
+ * guess about the deployment. `SAP_SYSNR` overrides it for a port that follows
+ * no convention, which is the case on a system reached through 50400.
+ */
+export declare function rfcParamsFrom(config: SapConfig): RfcConnectionParams;
+/**
+ * The factory `RfcTransport` asks for.
+ *
+ * The SDK is loaded when a conversation is opened, not when this is called, so
+ * a consumer can build the transport on a machine that has no SDK and find out
+ * at `connect()` rather than at construction — with a message that says what to
+ * install.
+ */
+export declare function rfcConversationFrom(config: SapConfig): () => IRfcConversation;
+//# sourceMappingURL=rfcConversation.d.ts.map

package/dist/connection/rfcConversation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfcConversation.d.ts","sourceRoot":"","sources":["../../src/connection/rfcConversation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,kDAAkD;AAClD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAoBpE;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,gBAAgB,CAmB7E"}

package/dist/connection/rfcConversation.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * An RFC conversation, from the config a consumer already holds.
+ *
+ * `RfcTransport` takes a factory rather than connection parameters, and that is
+ * deliberate: `@mcp-abap-adt/sap-rfc-lite` needs the SAP NW RFC SDK on the
+ * machine, and a transport that reached for it in its constructor could not be
+ * built at all where it is absent. But a factory is a poor front door — without
+ * this, reaching the RFC wire means every consumer writing the `require` and
+ * deriving `ashost` and `sysnr` for themselves, which is the derivation the
+ * per-transport connection class used to do for them.
+ *
+ * So the derivation lives here, once, and the SDK is still only touched when a
+ * conversation is actually opened.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rfcParamsFrom = rfcParamsFrom;
+exports.rfcConversationFrom = rfcConversationFrom;
+/**
+ * Read out of the config, never asked of the server.
+ *
+ * The system number comes off the HTTP port by the SAP convention that 80XX is
+ * the ICM port for system XX — the convention the port itself follows, not a
+ * guess about the deployment. `SAP_SYSNR` overrides it for a port that follows
+ * no convention, which is the case on a system reached through 50400.
+ */
+function rfcParamsFrom(config) {
+    if (!config.url) {
+        throw new Error('An RFC conversation needs a url to take its host from');
+    }
+    if (!config.username || !config.password) {
+        throw new Error('An RFC conversation needs both a username and a password');
+    }
+    const parsed = new URL(config.url);
+    const port = Number.parseInt(parsed.port || '8000', 10);
+    const derived = String(port - 8000).padStart(2, '0');
+    return {
+        ashost: parsed.hostname,
+        sysnr: process.env.SAP_SYSNR?.trim() || derived,
+        client: config.client || '000',
+        user: config.username,
+        passwd: config.password,
+        lang: 'EN',
+    };
+}
+/**
+ * The factory `RfcTransport` asks for.
+ *
+ * The SDK is loaded when a conversation is opened, not when this is called, so
+ * a consumer can build the transport on a machine that has no SDK and find out
+ * at `connect()` rather than at construction — with a message that says what to
+ * install.
+ */
+function rfcConversationFrom(config) {
+    const params = rfcParamsFrom(config);
+    return () => {
+        let Client;
+        try {
+            // Dynamic, because the SDK is an optional peer: it needs the SAP NW RFC
+            // SDK installed on the machine, and most consumers travel over HTTP.
+            // biome-ignore lint/correctness/noNodejsModules: optional by design
+            Client = require('@mcp-abap-adt/sap-rfc-lite').Client;
+        }
+        catch (error) {
+            throw new Error('@mcp-abap-adt/sap-rfc-lite is not available. To take the RFC wire, ' +
+                'install the SAP NW RFC SDK and run: npm install @mcp-abap-adt/sap-rfc-lite. ' +
+                `Details: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return new Client(params);
+    };
+}

package/dist/index.d.ts

@@ -1,21 +1,20 @@
 export type { IWebSocketCloseInfo, IWebSocketConnectOptions, IWebSocketMessageEnvelope, IWebSocketMessageHandler, IWebSocketTransport, } from '@mcp-abap-adt/interfaces';
 export { FileCertificateMaterialLoader } from './auth/FileCertificateMaterialLoader.js';
-export type { IAuthProvider } from './auth/IAuthProvider.js';
 export { BasicAuthProvider, CertificateAuthProvider, SamlAuthProvider, TokenAuthProvider, } from './auth/providers.js';
 export type { SapAuthType, SapConfig, SapConnectionType, } from './config/sapConfig.js';
 export { sapConfigSignature } from './config/sapConfig.js';
 export type { AbapConnection, AbapRequestOptions, } from './connection/AbapConnection.js';
 export { AdtCloudConnector } from './connection/AdtCloudConnector.js';
 export { AdtOnPremConnector } from './connection/AdtOnPremConnector.js';
-export { BaseAbapConnection, BaseAbapConnection as OnPremAbapConnection, } from './connection/BaseAbapConnection.js';
-export { CertificateAbapConnection } from './connection/CertificateAbapConnection.js';
-export { createAbapConnection } from './connection/connectionFactory.js';
+export { CloudHttpTransport } from './connection/CloudHttpTransport.js';
 export { CSRF_CONFIG, CSRF_ERROR_MESSAGES } from './connection/csrfConfig.js';
 export { GenericWebSocketTransport, type IWebSocketFactory, type IWebSocketLike, } from './connection/GenericWebSocketTransport.js';
-export { JwtAbapConnection, JwtAbapConnection as CloudAbapConnection, } from './connection/JwtAbapConnection.js';
-export { KerberosAbapConnection } from './connection/KerberosAbapConnection.js';
-export { RfcAbapConnection } from './connection/RfcAbapConnection.js';
-export { SamlAbapConnection } from './connection/SamlAbapConnection.js';
+export { HttpTransport } from './connection/HttpTransport.js';
+export type { IAdtEstablishContext, IAdtSessionContext, IAdtTransport, IAdtTransportRequest, IAdtTransportResponse, ICloudTransport, IOnPremTransport, } from './connection/IAdtTransport.js';
+export { LegacyOnPremHttpTransport } from './connection/LegacyOnPremHttpTransport.js';
+export { OnPremHttpTransport } from './connection/OnPremHttpTransport.js';
+export { type IRfcConversation, RfcTransport, } from './connection/RfcTransport.js';
+export { type RfcConnectionParams, rfcConversationFrom, rfcParamsFrom, } from './connection/rfcConversation.js';
 export type { ILogger } from './logger.js';
 export { getTimeout, getTimeoutConfig, type TimeoutConfig, } from './utils/timeouts.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AACxF,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAOxE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,IAAI,oBAAoB,GAC3C,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AAEtF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,2CAA2C,CAAC;AACnD,OAAO,EACL,iBAAiB,EACjB,iBAAiB,IAAI,mBAAmB,GACzC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EACV,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,6BAA6B,EAAE,MAAM,yCAAyC,CAAC;AAKxF,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,WAAW,EACX,SAAS,EACT,iBAAiB,GAClB,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,YAAY,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAQxE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EACL,yBAAyB,EACzB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,2CAA2C,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EACL,KAAK,gBAAgB,EACrB,YAAY,GACb,MAAM,8BAA8B,CAAC;AAGtC,OAAO,EACL,KAAK,mBAAmB,EACxB,mBAAmB,EACnB,aAAa,GACd,MAAM,iCAAiC,CAAC;AACzC,YAAY,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,KAAK,aAAa,GACnB,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -1,9 +1,13 @@
 "use strict";
 // Types - re-exported from interfaces package with backward compatibility aliases
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getTimeoutConfig = exports.getTimeout = exports.SamlAbapConnection = exports.RfcAbapConnection = exports.KerberosAbapConnection = exports.CloudAbapConnection = exports.JwtAbapConnection = exports.GenericWebSocketTransport = exports.CSRF_ERROR_MESSAGES = exports.CSRF_CONFIG = exports.createAbapConnection = exports.CertificateAbapConnection = exports.OnPremAbapConnection = exports.BaseAbapConnection = exports.AdtOnPremConnector = exports.AdtCloudConnector = exports.sapConfigSignature = exports.TokenAuthProvider = exports.SamlAuthProvider = exports.CertificateAuthProvider = exports.BasicAuthProvider = exports.FileCertificateMaterialLoader = void 0;
+exports.getTimeoutConfig = exports.getTimeout = exports.rfcParamsFrom = exports.rfcConversationFrom = exports.RfcTransport = exports.OnPremHttpTransport = exports.LegacyOnPremHttpTransport = exports.HttpTransport = exports.GenericWebSocketTransport = exports.CSRF_ERROR_MESSAGES = exports.CSRF_CONFIG = exports.CloudHttpTransport = exports.AdtOnPremConnector = exports.AdtCloudConnector = exports.sapConfigSignature = exports.TokenAuthProvider = exports.SamlAuthProvider = exports.CertificateAuthProvider = exports.BasicAuthProvider = exports.FileCertificateMaterialLoader = void 0;
 var FileCertificateMaterialLoader_js_1 = require("./auth/FileCertificateMaterialLoader.js");
 Object.defineProperty(exports, "FileCertificateMaterialLoader", { enumerable: true, get: function () { return FileCertificateMaterialLoader_js_1.FileCertificateMaterialLoader; } });
+// IAuthProvider is deliberately NOT re-exported. It lives in
+// @mcp-abap-adt/interfaces and a consumer imports it from there — the same rule
+// the session-lifecycle vocabulary follows below, and for the same reason: two
+// names for one contract let the two drift.
 var providers_js_1 = require("./auth/providers.js");
 Object.defineProperty(exports, "BasicAuthProvider", { enumerable: true, get: function () { return providers_js_1.BasicAuthProvider; } });
 Object.defineProperty(exports, "CertificateAuthProvider", { enumerable: true, get: function () { return providers_js_1.CertificateAuthProvider; } });
@@ -16,35 +20,34 @@ var AdtCloudConnector_js_1 = require("./connection/AdtCloudConnector.js");
 Object.defineProperty(exports, "AdtCloudConnector", { enumerable: true, get: function () { return AdtCloudConnector_js_1.AdtCloudConnector; } });
 var AdtOnPremConnector_js_1 = require("./connection/AdtOnPremConnector.js");
 Object.defineProperty(exports, "AdtOnPremConnector", { enumerable: true, get: function () { return AdtOnPremConnector_js_1.AdtOnPremConnector; } });
+var CloudHttpTransport_js_1 = require("./connection/CloudHttpTransport.js");
+Object.defineProperty(exports, "CloudHttpTransport", { enumerable: true, get: function () { return CloudHttpTransport_js_1.CloudHttpTransport; } });
 // The session lifecycle vocabulary — ISessionLifecycleAware, ADT_SESSION_ERROR —
 // is deliberately NOT exported here. It lives in @mcp-abap-adt/interfaces, and a
 // consumer imports it from there: re-exporting a contract type gives it two
 // names and lets the two drift.
 // Connection classes - only final implementations
 // Deprecated aliases for backward compatibility
-var BaseAbapConnection_js_1 = require("./connection/BaseAbapConnection.js");
-Object.defineProperty(exports, "BaseAbapConnection", { enumerable: true, get: function () { return BaseAbapConnection_js_1.BaseAbapConnection; } });
-Object.defineProperty(exports, "OnPremAbapConnection", { enumerable: true, get: function () { return BaseAbapConnection_js_1.BaseAbapConnection; } });
-var CertificateAbapConnection_js_1 = require("./connection/CertificateAbapConnection.js");
-Object.defineProperty(exports, "CertificateAbapConnection", { enumerable: true, get: function () { return CertificateAbapConnection_js_1.CertificateAbapConnection; } });
-// Factory
-var connectionFactory_js_1 = require("./connection/connectionFactory.js");
-Object.defineProperty(exports, "createAbapConnection", { enumerable: true, get: function () { return connectionFactory_js_1.createAbapConnection; } });
 // CSRF configuration
 var csrfConfig_js_1 = require("./connection/csrfConfig.js");
 Object.defineProperty(exports, "CSRF_CONFIG", { enumerable: true, get: function () { return csrfConfig_js_1.CSRF_CONFIG; } });
 Object.defineProperty(exports, "CSRF_ERROR_MESSAGES", { enumerable: true, get: function () { return csrfConfig_js_1.CSRF_ERROR_MESSAGES; } });
 var GenericWebSocketTransport_js_1 = require("./connection/GenericWebSocketTransport.js");
 Object.defineProperty(exports, "GenericWebSocketTransport", { enumerable: true, get: function () { return GenericWebSocketTransport_js_1.GenericWebSocketTransport; } });
-var JwtAbapConnection_js_1 = require("./connection/JwtAbapConnection.js");
-Object.defineProperty(exports, "JwtAbapConnection", { enumerable: true, get: function () { return JwtAbapConnection_js_1.JwtAbapConnection; } });
-Object.defineProperty(exports, "CloudAbapConnection", { enumerable: true, get: function () { return JwtAbapConnection_js_1.JwtAbapConnection; } });
-var KerberosAbapConnection_js_1 = require("./connection/KerberosAbapConnection.js");
-Object.defineProperty(exports, "KerberosAbapConnection", { enumerable: true, get: function () { return KerberosAbapConnection_js_1.KerberosAbapConnection; } });
-var RfcAbapConnection_js_1 = require("./connection/RfcAbapConnection.js");
-Object.defineProperty(exports, "RfcAbapConnection", { enumerable: true, get: function () { return RfcAbapConnection_js_1.RfcAbapConnection; } });
-var SamlAbapConnection_js_1 = require("./connection/SamlAbapConnection.js");
-Object.defineProperty(exports, "SamlAbapConnection", { enumerable: true, get: function () { return SamlAbapConnection_js_1.SamlAbapConnection; } });
+// The transport axis. Both ends are objects, so a caller can name either.
+var HttpTransport_js_1 = require("./connection/HttpTransport.js");
+Object.defineProperty(exports, "HttpTransport", { enumerable: true, get: function () { return HttpTransport_js_1.HttpTransport; } });
+var LegacyOnPremHttpTransport_js_1 = require("./connection/LegacyOnPremHttpTransport.js");
+Object.defineProperty(exports, "LegacyOnPremHttpTransport", { enumerable: true, get: function () { return LegacyOnPremHttpTransport_js_1.LegacyOnPremHttpTransport; } });
+var OnPremHttpTransport_js_1 = require("./connection/OnPremHttpTransport.js");
+Object.defineProperty(exports, "OnPremHttpTransport", { enumerable: true, get: function () { return OnPremHttpTransport_js_1.OnPremHttpTransport; } });
+var RfcTransport_js_1 = require("./connection/RfcTransport.js");
+Object.defineProperty(exports, "RfcTransport", { enumerable: true, get: function () { return RfcTransport_js_1.RfcTransport; } });
+// The front door to the RFC wire: the derivation a consumer would otherwise
+// copy, and the SDK loaded only when a conversation is opened.
+var rfcConversation_js_1 = require("./connection/rfcConversation.js");
+Object.defineProperty(exports, "rfcConversationFrom", { enumerable: true, get: function () { return rfcConversation_js_1.rfcConversationFrom; } });
+Object.defineProperty(exports, "rfcParamsFrom", { enumerable: true, get: function () { return rfcConversation_js_1.rfcParamsFrom; } });
 // Timeouts
 var timeouts_js_1 = require("./utils/timeouts.js");
 Object.defineProperty(exports, "getTimeout", { enumerable: true, get: function () { return timeouts_js_1.getTimeout; } });

package/dist/utils/timeouts.d.ts

@@ -5,27 +5,14 @@ export declare function getTimeout(type?: 'default' | 'csrf' | 'long' | number):
 /**
  * Large ceiling timeout applied while a connection is inside an uninterruptible
  * critical section (lock → modify → unlock). A short per-request timeout must
- * not abort such a request mid-flight: aborting tears down the socket, which
- * drops the stateful ADT session and orphans the lock handle (object left
- * locked and inactive). Configurable via SAP_TIMEOUT_CRITICAL (ms).
+ * not abort such a request mid-flight — not because aborting ends anything on
+ * the server, but because it ends what the CLIENT knows: the modification may
+ * or may not have been applied, and the handle `unlock` needs is gone, while
+ * the lock and the ABAP session holding it sit there until that server-side
+ * idle timeout, which this side can neither read nor influence.
+ * Configurable via SAP_TIMEOUT_CRITICAL (ms).
  * Default 600000 (10 minutes) — a generous ceiling that still guards against a
  * permanently dead socket hanging forever.
  */
 export declare function getCriticalSectionTimeout(): number;
-/**
- * How long `disconnect()` may spend telling the server the session is done.
- *
- * **Zero by default: after a disconnect nothing waits on the answer.** Waiting
- * is for steps whose successor depends on the server having caught up — lock,
- * update, unlock, activate, each needing the one before it to have landed.
- * A teardown has no successor: the session is marked unneeded, the server
- * reclaims it whenever it reclaims it, and a caller blocked on that round trip
- * has bought nothing while holding up the serializing tail, where every later
- * connect and disconnect queues behind it.
- *
- * The knob exists for a caller that wants a bounded wait anyway — a test
- * asserting the logoff landed, a script that would rather see the failure —
- * and is theirs to set per call via `ISessionLifecycleAware.disconnect`.
- */
-export declare function getReleaseDeadline(): number;
 //# sourceMappingURL=timeouts.d.ts.map

package/dist/utils/timeouts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"timeouts.d.ts","sourceRoot":"","sources":["../../src/utils/timeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAED,wBAAgB,UAAU,CACxB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAkB,GACrD,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C"}
+{"version":3,"file":"timeouts.d.ts","sourceRoot":"","sources":["../../src/utils/timeouts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAG/D,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,wBAAgB,gBAAgB,IAAI,cAAc,CAajD;AAED,wBAAgB,UAAU,CACxB,IAAI,GAAE,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,MAAkB,GACrD,MAAM,CAOR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}

package/dist/utils/timeouts.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getTimeoutConfig = getTimeoutConfig;
 exports.getTimeout = getTimeout;
 exports.getCriticalSectionTimeout = getCriticalSectionTimeout;
-exports.getReleaseDeadline = getReleaseDeadline;
 function getTimeoutConfig() {
     const defaultTimeout = parseInt(process.env.SAP_TIMEOUT_DEFAULT || '45000', 10);
     const csrfTimeout = parseInt(process.env.SAP_TIMEOUT_CSRF || '15000', 10);
@@ -24,30 +23,15 @@ function getTimeout(type = 'default') {
 /**
  * Large ceiling timeout applied while a connection is inside an uninterruptible
  * critical section (lock → modify → unlock). A short per-request timeout must
- * not abort such a request mid-flight: aborting tears down the socket, which
- * drops the stateful ADT session and orphans the lock handle (object left
- * locked and inactive). Configurable via SAP_TIMEOUT_CRITICAL (ms).
+ * not abort such a request mid-flight — not because aborting ends anything on
+ * the server, but because it ends what the CLIENT knows: the modification may
+ * or may not have been applied, and the handle `unlock` needs is gone, while
+ * the lock and the ABAP session holding it sit there until that server-side
+ * idle timeout, which this side can neither read nor influence.
+ * Configurable via SAP_TIMEOUT_CRITICAL (ms).
  * Default 600000 (10 minutes) — a generous ceiling that still guards against a
  * permanently dead socket hanging forever.
  */
 function getCriticalSectionTimeout() {
     return parseInt(process.env.SAP_TIMEOUT_CRITICAL || '600000', 10);
 }
-/**
- * How long `disconnect()` may spend telling the server the session is done.
- *
- * **Zero by default: after a disconnect nothing waits on the answer.** Waiting
- * is for steps whose successor depends on the server having caught up — lock,
- * update, unlock, activate, each needing the one before it to have landed.
- * A teardown has no successor: the session is marked unneeded, the server
- * reclaims it whenever it reclaims it, and a caller blocked on that round trip
- * has bought nothing while holding up the serializing tail, where every later
- * connect and disconnect queues behind it.
- *
- * The knob exists for a caller that wants a bounded wait anyway — a test
- * asserting the logoff landed, a script that would rather see the failure —
- * and is theirs to set per call via `ISessionLifecycleAware.disconnect`.
- */
-function getReleaseDeadline() {
-    return parseInt(process.env.SAP_RELEASE_DEADLINE_MS || '0', 10);
-}

package/docs/INDEX.md

@@ -15,6 +15,7 @@ mcp-abap-connection/
 │   ├── INSTALLATION.md             # Setup and installation guide
 │   ├── USAGE.md                    # API documentation and examples
 │   ├── MIGRATION-2.0.md            # Moving to the explicit session lifecycle
+│   ├── MIGRATION-6.0.md            # the factory and the per-credential classes go; RFC is a transport
 │   ├── MIGRATION-4.0.md            # JWT error classification: 401 refreshes, 403 propagates
 │   ├── SCOPE.md                    # What this package does and does not own
 │   ├── STATEFUL_SESSION_GUIDE.md   # Stateful requests and lock windows
@@ -43,6 +44,7 @@ mcp-abap-connection/
 - 🔑 [JWT Auth Tools](./JWT_AUTH_TOOLS.md) - CLI tool for browser-based authentication
 
 ### Upgrading
+- 🚚 [Migrating to 6.0.0](./MIGRATION-6.0.md) - the factory and the per-credential classes are removed; the RFC wire is a transport you hand to the on-prem connector
 - 🧱 [Migrating to 4.0.0](./MIGRATION-4.0.md) - JWT error classification: a 401 refreshes, a 403 propagates with the server's message
 - 🧱 [Migrating to 2.0.0](./MIGRATION-2.0.md) - The explicit session lifecycle: `connect()` is required
 
@@ -72,8 +74,9 @@ mcp-abap-connection/
 ### API Reference
 - **Connection Interface**: [USAGE.md - API Reference](./USAGE.md#api-reference)
 - **Configuration Types**: [USAGE.md - Configuration Types](./USAGE.md#configuration-types)
-- **Factory Function**: `createAbapConnection()`
-- **Connection Classes**: `BaseAbapConnection`, `JwtAbapConnection`
+- **Connectors**: `AdtOnPremConnector`, `AdtCloudConnector`
+- **Credentials**: `BasicAuthProvider`, `TokenAuthProvider`, `SamlAuthProvider`, `CertificateAuthProvider`
+- **Transports**: `HttpTransport`, `RfcTransport` (+ `rfcConversationFrom()`)
 
 ## Version Highlights