@mcp-abap-adt/connection 6.0.0 → 7.0.0

package/CHANGELOG.md

@@ -7,11 +7,216 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.0.0] - 2026-09-08
+
+**Headers that belong to the request stop belonging to the session.**
+
+Nothing in the type surface changed: no signature narrowed, `IAbapConnection` is
+untouched, and code built against 6.x compiles unchanged. The major is for the
+wire — every request now looks different in an SAP trace, and on cloud it says
+something about the session it did not say before. A system that reacts badly to
+either should be findable by version rather than by reading a trace.
+
+### Changed
+
+- **BREAKING: `sap-adt-request-id` goes out on every request**, not only inside
+  the stateful branch, and `X-sap-adt-profiling` comes from a settable default
+  rather than a literal.
+
+  Only `x-sap-adt-sessiontype` ever belonged in that branch. A request id
+  identifies the **request**, and asking the server to report its own processing
+  time is not a property of the session either. It stayed invisible while every
+  write happened inside a lock window — the window was stateful, so the writes
+  carried all three — and `@mcp-abap-adt/adt-clients` has since narrowed
+  stateful to the `LOCK` and the `UNLOCK`, at which point the writes silently
+  lost two headers.
+
+  Eclipse sends both on everything. From an ADT 3.60.0 trace on E19, a stateless
+  source `PUT` carries `sap-adt-request-id` and `X-sap-adt-profiling` and no
+  session type at all. Measured on a BTP trial after the narrowing: of 792
+  requests in a full run, 99 carried a request id and **693 — 87.5% — carried
+  neither**.
+
+  Both are **defaults, not overrides**: a caller who names either in
+  `options.headers` keeps it, matched without case. `adt-clients` passes its own
+  id to `getDiscovery({ requestId })` so the id it logs is the id on the wire,
+  and a profiler run asks for something other than `server-time`.
+
+- **BREAKING (cloud): `x-sap-security-session: use` on every request**, once a
+  session exists.
+
+  ABAP Cloud issues its session as a resource asked for at
+  `/sap/bc/adt/core/http/sessions`, and this wire said the header exactly twice
+  in a session's life — `create` to open one, `use` on the `DELETE` that ends
+  it. Eclipse names it on everything in between. Measured from ADT 3.60.3
+  against a BTP trial: a plain `GET …/businessservices/odatav4/ZAC_SRVB01` and a
+  `POST …/unpublishjobs`, a read and a write, both stateless, both saying `use`
+  beside `saplb: appserver-dgm9s` and `saplb-options: REDISPATCH_ON_SHUTDOWN`.
+
+  That pair works together on a load-balanced landscape: here is the server, and
+  use the session that lives on it. In one full run against the same trial the
+  responses named two different application servers — `appserver-dgm9s` 501
+  times and `appserver-8q4vl` 290 — so which one answers is not a constant, and
+  the session is not on both.
+
+  **On-prem is deliberately unchanged**: its session arrives with the logon,
+  there is no trace of Eclipse sending this there, and adding it would be a
+  guess wearing a measurement's clothes.
+
+### Added
+
+- `setProfilingRequest(what: string | null)` / `getProfilingRequest()` — the
+  connection-wide `X-sap-adt-profiling` default, `null` to ask nothing.
+  `'server-time'` is what Eclipse asks for and stays the default. Nothing in
+  this package reads the answer back, which is an argument for being able to
+  turn it off rather than for switching it off: an investigation does read it,
+  and one settled this week that the unit is microseconds — a trial's unpublish
+  job answered `server-time=132512547` on a request that takes ~133 s.
+
+  **On the concrete class, not yet on the contract.** `AbapConnection` is
+  `IAbapConnection`, so a consumer holding the contract reaches these only by
+  casting. `@mcp-abap-adt/interfaces@38.1.0` publishes `IRequestProfiling`
+  (and `ICriticalSection`, for the section this package already has) as
+  capability atoms for exactly this — but this package is on `^21.0.0`, and
+  declaring them means moving seventeen majors, which is its own piece of work
+  and not this one. Until then the per-request route is the contract-level one:
+  `X-sap-adt-profiling` in `options.headers` is honoured and never overwritten.
+
+
+## [6.1.0] - 2026-09-03
+
+### Licence
+
+- **This package is now `LGPL-3.0-only`.** It was MIT up to and including 6.0.1, and
+  those versions stay MIT — a licence change is not retroactive, and anyone
+  already using 6.0.1 under MIT keeps that grant for 6.0.1.
+
+  The library licence of the GNU family, chosen for what it does *not* ask:
+  linking it into your own program — importing it, as every consumer of an npm
+  package does — does not put your program under the LGPL. What it asks is that
+  changes to this library stay free and that your users can substitute their own
+  build of it.
+
+  Both texts ship in the package: `LICENSE` is the LGPL, `COPYING` is the GPL it
+  is written on top of. The LGPL is a set of additional permissions over the GPL,
+  so it cannot be read without both.
+
+  Copyright © 2025–2026 Oleksii Kyslytsia.
+
+
+## [6.0.1] - 2026-08-25
+
+### Removed
+
+- **`express` is no longer a dependency.** It was a runtime dependency for one
+  thing: the localhost server in `bin/sap-abap-auth.js` that catches the OAuth2
+  redirect. The library never touched it, and that file already imported
+  `node:http`. Rewritten on `node:http`, which sheds 5.6MB of `node_modules` and
+  the transitive tree the Dependabot bumps kept arriving for — `qs`,
+  `body-parser` and `follow-redirects` were all express's.
+
+  Two things express was doing implicitly are now stated: a request is the
+  redirect only when it is a `GET` for `/callback`, so a browser fetching
+  `/favicon.ico` no longer reaches the handler waiting for an authorization
+  code; and the success page declares `text/html`, which `res.send()` used to
+  infer. Exercised as a server: `200` with the page, `400` without a code, `404`
+  for anything else including a `POST`.
+
+  Runtime dependencies are now `@mcp-abap-adt/interfaces`, `axios`, `commander`
+  and `open`. The end-to-end flow was measured against the BTP trial — see
+  *Verified* below.
+
+### Changed
+
+- **The browser wait is the caller's to set.** `bin/sap-abap-auth.js` waited a
+  fixed five minutes for the redirect, and a real BTP login does not fit in it —
+  the identity provider, a password manager and whatever second factor the
+  tenant asks for all happen before the redirect is issued. Measured twice, and
+  both times the window closed first; the browser then had nowhere to redirect
+  to, which reads as the authentication having failed rather than as a timeout.
+
+  `--timeout <minutes>`, or `SAP_AUTH_TIMEOUT_MS` for a script that would rather
+  not pass an argument, with the flag winning when both are given. Anything that
+  is not a positive number is refused by name rather than silently becoming a
+  default. **The default is now fifteen minutes**, which covered the login this
+  was measured against with room to spare and still bounds an abandoned run.
+
+### Verified
+
+- **The whole chain, end to end**: `bin/sap-abap-auth.js auth` → browser
+  authorization against the tenant's UAA → redirect to `localhost:3001/callback`
+  → code exchanged for a token → `.env` written with `SAP_JWT_TOKEN`,
+  `SAP_REFRESH_TOKEN` and the UAA fields.
+
+- Each seam the express removal touched, measured on the real handler rather
+  than a stand-in: `GET /favicon.ico` answers `404` and does not reach the
+  handler waiting for a code — routing express used to do; `GET /callback` with
+  no code answers `400`; the success page comes back
+  `200 text/html; charset=utf-8`, the Content-Type `res.send()` used to infer
+  and `node:http` will not.
+
+- **The issued token then drove this library** against the trial:
+  `AdtCloudConnector` with `CloudHttpTransport` connected, took a session
+  (`SAP_SESSIONID_TRL_100`), answered a `GET /sap/bc/adt/discovery` with `200`
+  and 444826 bytes of XML, and `disconnect()` left `isConnected()` false.
+
+### Fixed
+
+- **The live RFC suite skips a wire the machine did not install.** It asked for
+  four environment variables and nothing else, so a checkout with an env file
+  and no SAP NW RFC SDK ran the suite anyway and went eleven tests red, all on
+  `@mcp-abap-adt/sap-rfc-lite is not available`. The dependency is `optional` —
+  `npm ci` leaves it out WITHOUT failing, which is what optional means — so
+  nothing warns and the next run is red for a reason unrelated to the change
+  under test.
+
+  Nothing here is configured at build time the way a C package is: the installed
+  optional dependency IS the choice of wire, made at install and readable only
+  at runtime. `canRun()` now reads it with `require.resolve`, asking whether the
+  wire could be taken rather than loading a native addon to find out. Measured
+  in both states: SDK hidden — 11 skipped, 2 passed, green; SDK present — 13
+  passed.
+
+- `RfcTransport` says why it ignores `request.timeout`. No behaviour change: the
+  file contained no occurrence of the word, and that silence read as an
+  oversight. It is deliberate — the SDK exposes no cancel, its per-call
+  `timeout` is parsed into a commented-out branch, and an abandoned call still
+  holds the conversation, so the next one would queue behind a call nobody is
+  waiting for. A deadline that reports failure while the wire stays busy is
+  worse than none, because the error reads as "safe to retry" when it is not.
+  The server bounds the call at `rdisp/max_wprun_time`.
+
 ## [6.0.0] - 2026-08-24
 
 The wire owns what is the wire's, and the factory and per-credential classes are
 gone. See [Migration to 6.0](./docs/MIGRATION-6.0.md).
 
+### Added — tooling
+
+- **CI.** Until this release the only workflow ran on a tag, and `Release` went
+  from build straight to `npm pack` — so nothing ran the gate before a merge,
+  and the artifact a tag published had been tested nowhere but on a laptop.
+  `ci.yml` runs `lint:check`, `build`, `jest --no-cache`, `check:docs` and
+  `check:pack` on push and pull request, across ubuntu and windows on Node 18
+  and 20. Windows is in the matrix because npm is `npm.cmd` there and Node will
+  not execute a `.cmd` without a shell. `release.yml` runs the same three checks
+  between build and pack, so a tag is not a route around them.
+
+- **`check:pack`** — inspects `npm pack --dry-run --json` and refuses a tarball
+  carrying a test file, a `.tsbuildinfo`, a `.ts` source, an env file or an
+  npmrc. Both defects it was written for had already shipped once:
+  `dist/__tests__/` and 120KB of compiler bookkeeping, neither visible from
+  `files`, because it is the compiler that decides what `dist` holds.
+
+- **`typecheck:scripts`** — `scripts/*.ts` were checked by nothing, which is how
+  three live verification scripts came to sit on a constructor signature two
+  releases old.
+
+### Changed — packaging
+
+- 111 files / 182KB → 95 / 147KB. Test helpers and the compiler's incremental
+  state no longer ship.
+
 ### Added
 
 - **The transport axis is complete and public.** `IAdtTransport` now covers
@@ -1252,7 +1457,10 @@ const connection = createAbapConnection(config, logger);
 - JWT token refresh now properly handles connection errors (401/403 during initial connect)
 - Permission errors (403 with "ExceptionResourceNoAccess") no longer trigger JWT refresh loops
 - Proper separation: base class handles HTTP/session, concrete classes handle auth-specific errors
-[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.0...HEAD
+[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v7.0.0...HEAD
+[7.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.1.0...v7.0.0
+[6.0.1]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.0...v6.0.1
+[6.1.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.1...v6.1.0
 [6.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v5.0.0...v6.0.0
 [5.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v4.0.0...v5.0.0
 [4.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v3.0.0...v4.0.0