@mcp-abap-adt/connection 6.0.0 → 7.0.0

package/LICENSE

@@ -1,21 +1,165 @@
-MIT License
-
-Copyright (c) 2025 Oleksii Kyslytsia
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+                   GNU LESSER GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+
+  This version of the GNU Lesser General Public License incorporates
+the terms and conditions of version 3 of the GNU General Public
+License, supplemented by the additional permissions listed below.
+
+  0. Additional Definitions.
+
+  As used herein, "this License" refers to version 3 of the GNU Lesser
+General Public License, and the "GNU GPL" refers to version 3 of the GNU
+General Public License.
+
+  "The Library" refers to a covered work governed by this License,
+other than an Application or a Combined Work as defined below.
+
+  An "Application" is any work that makes use of an interface provided
+by the Library, but which is not otherwise based on the Library.
+Defining a subclass of a class defined by the Library is deemed a mode
+of using an interface provided by the Library.
+
+  A "Combined Work" is a work produced by combining or linking an
+Application with the Library.  The particular version of the Library
+with which the Combined Work was made is also called the "Linked
+Version".
+
+  The "Minimal Corresponding Source" for a Combined Work means the
+Corresponding Source for the Combined Work, excluding any source code
+for portions of the Combined Work that, considered in isolation, are
+based on the Application, and not on the Linked Version.
+
+  The "Corresponding Application Code" for a Combined Work means the
+object code and/or source code for the Application, including any data
+and utility programs needed for reproducing the Combined Work from the
+Application, but excluding the System Libraries of the Combined Work.
+
+  1. Exception to Section 3 of the GNU GPL.
+
+  You may convey a covered work under sections 3 and 4 of this License
+without being bound by section 3 of the GNU GPL.
+
+  2. Conveying Modified Versions.
+
+  If you modify a copy of the Library, and, in your modifications, a
+facility refers to a function or data to be supplied by an Application
+that uses the facility (other than as an argument passed when the
+facility is invoked), then you may convey a copy of the modified
+version:
+
+   a) under this License, provided that you make a good faith effort to
+   ensure that, in the event an Application does not supply the
+   function or data, the facility still operates, and performs
+   whatever part of its purpose remains meaningful, or
+
+   b) under the GNU GPL, with none of the additional permissions of
+   this License applicable to that copy.
+
+  3. Object Code Incorporating Material from Library Header Files.
+
+  The object code form of an Application may incorporate material from
+a header file that is part of the Library.  You may convey such object
+code under terms of your choice, provided that, if the incorporated
+material is not limited to numerical parameters, data structure
+layouts and accessors, or small macros, inline functions and templates
+(ten or fewer lines in length), you do both of the following:
+
+   a) Give prominent notice with each copy of the object code that the
+   Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the object code with a copy of the GNU GPL and this license
+   document.
+
+  4. Combined Works.
+
+  You may convey a Combined Work under terms of your choice that,
+taken together, effectively do not restrict modification of the
+portions of the Library contained in the Combined Work and reverse
+engineering for debugging such modifications, if you also do each of
+the following:
+
+   a) Give prominent notice with each copy of the Combined Work that
+   the Library is used in it and that the Library and its use are
+   covered by this License.
+
+   b) Accompany the Combined Work with a copy of the GNU GPL and this license
+   document.
+
+   c) For a Combined Work that displays copyright notices during
+   execution, include the copyright notice for the Library among
+   these notices, as well as a reference directing the user to the
+   copies of the GNU GPL and this license document.
+
+   d) Do one of the following:
+
+       0) Convey the Minimal Corresponding Source under the terms of this
+       License, and the Corresponding Application Code in a form
+       suitable for, and under terms that permit, the user to
+       recombine or relink the Application with a modified version of
+       the Linked Version to produce a modified Combined Work, in the
+       manner specified by section 6 of the GNU GPL for conveying
+       Corresponding Source.
+
+       1) Use a suitable shared library mechanism for linking with the
+       Library.  A suitable mechanism is one that (a) uses at run time
+       a copy of the Library already present on the user's computer
+       system, and (b) will operate properly with a modified version
+       of the Library that is interface-compatible with the Linked
+       Version.
+
+   e) Provide Installation Information, but only if you would otherwise
+   be required to provide such information under section 6 of the
+   GNU GPL, and only to the extent that such information is
+   necessary to install and execute a modified version of the
+   Combined Work produced by recombining or relinking the
+   Application with a modified version of the Linked Version. (If
+   you use option 4d0, the Installation Information must accompany
+   the Minimal Corresponding Source and Corresponding Application
+   Code. If you use option 4d1, you must provide the Installation
+   Information in the manner specified by section 6 of the GNU GPL
+   for conveying Corresponding Source.)
+
+  5. Combined Libraries.
+
+  You may place library facilities that are a work based on the
+Library side by side in a single library together with other library
+facilities that are not Applications and are not covered by this
+License, and convey such a combined library under terms of your
+choice, if you do both of the following:
+
+   a) Accompany the combined library with a copy of the same work based
+   on the Library, uncombined with any other library facilities,
+   conveyed under the terms of this License.
+
+   b) Give prominent notice with the combined library that part of it
+   is a work based on the Library, and explaining where to find the
+   accompanying uncombined form of the same work.
+
+  6. Revised Versions of the GNU Lesser General Public License.
+
+  The Free Software Foundation may publish revised and/or new versions
+of the GNU Lesser General Public License from time to time. Such new
+versions will be similar in spirit to the present version, but may
+differ in detail to address new problems or concerns.
+
+  Each version is given a distinguishing version number. If the
+Library as you received it specifies that a certain numbered version
+of the GNU Lesser General Public License "or any later version"
+applies to it, you have the option of following the terms and
+conditions either of that published version or of any later version
+published by the Free Software Foundation. If the Library as you
+received it does not specify a version number of the GNU Lesser
+General Public License, you may choose any version of the GNU Lesser
+General Public License ever published by the Free Software Foundation.
+
+  If the Library as you received it specifies that a proxy can decide
+whether future versions of the GNU Lesser General Public License shall
+apply, that proxy's public statement of acceptance of any version is
+permanent authorization for you to choose that version for the
+Library.

package/README.md

@@ -745,7 +745,28 @@ See [CHANGELOG.md](./CHANGELOG.md) for detailed version history and breaking cha
 
 ## License
 
-MIT
+**GNU Lesser General Public License v3.0 only** (`LGPL-3.0-only`).
+Earlier published versions were MIT and stay MIT — a licence change is not
+retroactive.
+
+Copyright © 2025–2026 Oleksii Kyslytsia
+
+This library is free software: you can redistribute it and/or modify it under the
+terms of the GNU Lesser General Public License as published by the Free Software
+Foundation, version 3.
+
+It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
+without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
+PURPOSE. See the GNU Lesser General Public License for more details.
+
+Both texts ship with the package and both are needed: [`LICENSE`](LICENSE) is the
+LGPL, [`COPYING`](COPYING) is the GPL it is written on top of, since the LGPL is a
+set of additional permissions over the GPL and cannot be read alone.
+
+**What this means if you depend on this package.** Linking it into your own
+program — importing it, as every consumer of an npm package does — does not put
+your program under the LGPL. What the licence asks is that changes *to this
+library* stay free, and that your users can replace it with their own build.
 
 ## Repository
 

package/bin/sap-abap-auth.js

@@ -3,7 +3,6 @@ const fs = require("fs");
 const path = require("path");
 const axios = require("axios");
 const { program } = require("commander");
-const express = require("express");
 const open = require("open").default;
 const http = require("http");
 
@@ -262,6 +261,57 @@ function getJwtAuthorizationUrl(serviceKey, port = 3001) {
   )}&response_type=code&redirect_uri=${encodeURIComponent(redirectUri)}`;
 }
 
+/**
+ * How long to wait for the browser to come back.
+ *
+ * Five minutes was the fixed value, and a real BTP login does not fit in it:
+ * the identity provider, a password manager and whatever second factor the
+ * tenant asks for all happen before the redirect is issued. Measured twice —
+ * both times the window closed first, and the browser then had nowhere to
+ * redirect to, which reads to the user as the authentication having failed.
+ *
+ * So it is a decision the caller makes: `--timeout` in minutes, or
+ * `SAP_AUTH_TIMEOUT_MS` for a script that would rather not pass an argument.
+ * The default is fifteen, which covered the login this was measured against
+ * with room to spare and still bounds a run that has been abandoned.
+ */
+const DEFAULT_AUTH_TIMEOUT_MS = 15 * 60 * 1000;
+
+function resolveAuthTimeout(minutes) {
+  if (minutes !== undefined) {
+    const value = Number(minutes);
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new Error(
+        `--timeout must be a positive number of minutes, got: ${minutes}`
+      );
+    }
+    return value * 60 * 1000;
+  }
+  const fromEnv = process.env.SAP_AUTH_TIMEOUT_MS;
+  if (fromEnv !== undefined && fromEnv !== "") {
+    const value = Number(fromEnv);
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new Error(
+        `SAP_AUTH_TIMEOUT_MS must be a positive number of milliseconds, got: ${fromEnv}`
+      );
+    }
+    return value;
+  }
+  return DEFAULT_AUTH_TIMEOUT_MS;
+}
+
+/**
+ * One reply, with the header express used to set on our behalf.
+ *
+ * `res.send()` chose a Content-Type from what it was handed; `node:http` sends
+ * exactly what it is told, so the type is stated here. Without it a browser is
+ * free to render the success page as plain text.
+ */
+function send(res, status, contentType, body) {
+  res.writeHead(status, { "Content-Type": contentType });
+  res.end(body);
+}
+
 /**
  * Starts a local server to intercept the authentication response
  * @param {Object} serviceKey SAP BTP service key object
@@ -269,26 +319,42 @@ function getJwtAuthorizationUrl(serviceKey, port = 3001) {
  * @param {string} flow Flow type: jwt (OAuth2)
  * @returns {Promise<{accessToken: string, refreshToken?: string}>} Promise that resolves to tokens
  */
-async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
+async function startAuthServer(
+  serviceKey,
+  browser = undefined,
+  flow = "jwt",
+  timeoutMs = DEFAULT_AUTH_TIMEOUT_MS
+) {
   return new Promise((resolve, reject) => {
-    const app = express();
-    const server = http.createServer(app);
     const PORT = 3001;
     let serverInstance = null;
 
     // Choose the authorization URL
     const authorizationUrl = getJwtAuthorizationUrl(serviceKey, PORT);
 
-    // JWT OAuth2 flow (get code, exchange for token)
-    app.get("/callback", async (req, res) => {
+    // JWT OAuth2 flow (get code, exchange for token). One route, and the
+    // routing express did is two comparisons: a browser fetching /favicon.ico
+    // must not be mistaken for the redirect we are waiting for.
+    const server = http.createServer(async (req, res) => {
+      const url = new URL(req.url, `http://localhost:${PORT}`);
+      if (req.method !== "GET" || url.pathname !== "/callback") {
+        send(res, 404, "text/plain; charset=utf-8", "Not Found");
+        return;
+      }
+
       try {
-        const { code } = req.query;
+        const code = url.searchParams.get("code");
         if (!code) {
-          res.status(400).send("Error: Authorization code missing");
+          send(
+            res,
+            400,
+            "text/plain; charset=utf-8",
+            "Error: Authorization code missing"
+          );
           return reject(new Error("Authorization code missing"));
         }
         console.log("Authorization code received");
-        res.send(`<!DOCTYPE html>
+        send(res, 200, "text/html; charset=utf-8", `<!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
@@ -363,7 +429,12 @@ async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
         }
       } catch (error) {
         console.error("Error handling callback:", error);
-        res.status(500).send("Error processing authentication");
+        send(
+          res,
+          500,
+          "text/plain; charset=utf-8",
+          "Error processing authentication"
+        );
         reject(error);
       }
     });
@@ -395,9 +466,17 @@ async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
     setTimeout(() => {
       if (serverInstance) {
         serverInstance.close();
-        reject(new Error("Authentication timeout. Process aborted."));
+        reject(
+          new Error(
+            `Authentication timeout after ${
+              timeoutMs >= 60000
+                ? `${Math.round(timeoutMs / 60000)} min`
+                : `${Math.round(timeoutMs / 1000)}s`
+            }. Process aborted. Raise it with --timeout <minutes> or SAP_AUTH_TIMEOUT_MS if the login needs longer.`
+          )
+        );
       }
-    }, 5 * 60 * 1000);
+    }, timeoutMs);
   });
 }
 
@@ -540,6 +619,10 @@ async function main() {
       "-f, --force",
       "Force browser authentication even if valid tokens exist in .env"
     )
+    .option(
+      "-t, --timeout <minutes>",
+      "How long to wait for the browser redirect, in minutes (default: 15, or SAP_AUTH_TIMEOUT_MS in ms)"
+    )
     .helpOption("-h, --help", "Show help for the auth command")
     .action(async (options) => {
       try {
@@ -594,7 +677,12 @@ async function main() {
         // Fallback to browser authentication if refresh failed or was skipped
         if (!tokens) {
           console.log("🌐 Starting browser authentication...");
-          tokens = await startAuthServer(serviceKey, options.browser, "jwt");
+          tokens = await startAuthServer(
+            serviceKey,
+            options.browser,
+            "jwt",
+            resolveAuthTimeout(options.timeout)
+          );
           if (!tokens || !tokens.accessToken) {
             console.error("JWT token was not obtained. Authentication failed.");
             process.exit(1);

package/dist/connection/AbstractAbapConnection.d.ts

@@ -4,28 +4,6 @@ import type { ILogger } from '../logger.js';
 import { SessionLifecycle } from '../session/SessionLifecycle.js';
 import type { AbapConnection, AbapRequestOptions } from './AbapConnection.js';
 import { type IAdtSessionContext, type IAdtTransport } from './IAdtTransport.js';
-/**
- * Declares the capabilities explicitly rather than satisfying them by accident.
- * `AbapConnection` is the base contract every transport honours; these two are
- * the HTTP session's own, and naming them means a signature that drifts from
- * the published contract fails to compile here instead of at the consumer.
- *
- * **This gives the consumer instruments; it does not decide for it.** `connect()`
- * opens one session and `disconnect()` closes it. How many connections to hold,
- * how long to hold them and when to let go stays with the caller — there are no
- * thresholds here, no pooling and no eviction, because none of that is knowable
- * from inside a single connection. A session this one did not open is not its
- * business: the session limit is per user and the pool is shared, so a SAP GUI
- * logon of the same user sits in the same list.
- *
- * **Nothing the server decides is treated as something to count on.** Whether it
- * issues a session cookie, whether it still holds a session it issued, how many
- * it will tolerate, how fast it answers a logoff — all of that is its own and
- * may differ by system and release. So each is observed and reported, never
- * relied upon: the logoff is best effort under a bound the caller sets, a
- * missing session cookie is a warning rather than a rule, and no code here
- * counts sessions or predicts the next answer from the last one.
- */
 declare abstract class AbstractAbapConnection implements AbapConnection, ISessionLifecycleAware {
     private readonly config;
     /**
@@ -48,6 +26,22 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     private baseUrl;
     private sessionId;
     private sessionMode;
+    /**
+     * What this connection asks the server to report about its own processing.
+     *
+     * Sent on every request as `X-sap-adt-profiling`, which is what Eclipse does
+     * — measured from an ADT 3.60.0 trace, where it rides on a stateless source
+     * `PUT` as readily as on a lock. `null` stops asking.
+     *
+     * Settable because it is a request's business, not a session's, and because
+     * a caller can already need something other than the default: a profiler run
+     * in `@mcp-abap-adt/adt-clients` writes its own value today, by putting the
+     * header in the request by hand. Nothing in this package reads the
+     * `server-time=…` that comes back — but an investigation does, and this
+     * session used it to establish that the unit is microseconds, so the default
+     * stays on and the way to turn it off is this property rather than a fork.
+     */
+    private profilingRequest;
     /**
      * When true, requests are treated as part of an uninterruptible critical
      * section (e.g. a lock → modify → unlock chain). In this state a short
@@ -131,6 +125,14 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
      * Get current session mode
      */
     getSessionMode(): 'stateless' | 'stateful';
+    /**
+     * What to ask the server to report, or `null` to ask nothing.
+     *
+     * @param what the `X-sap-adt-profiling` value; `'server-time'` is Eclipse's.
+     */
+    setProfilingRequest(what: string | null): void;
+    /** What this connection is currently asking for. */
+    getProfilingRequest(): string | null;
     /**
      * Enter an uninterruptible critical section.
      *

package/dist/connection/AbstractAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAE5B;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,uBAAe,sBACb,YAAW,cAAc,EAAE,sBAAsB;IAsE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IA/E3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAC5D;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH;;;;;;;OAOG;IAEH,SAAS,aACU,MAAM,EAAE,SAAS;IAClC;;;;;;;;OAQG;IACM,SAAS,EAAE,aAAa,EACd,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM;IAoBpB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAOpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkCjC,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IAEH;;;;;;;;;OASG;IAEH;;;;;;OAMG;IACH,SAAS,CAAC,cAAc,IAAI,kBAAkB;YAUhC,kBAAkB;IAqJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASnD;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI;IA2BP;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAc7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAchB,cAAc;IA8W5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;;;;;;OAQG;cACa,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAqBlB,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAMlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMlD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,eAAe;CA6BxB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AAMlC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAExC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAqC5B,uBAAe,sBACb,YAAW,cAAc,EAAE,sBAAsB;IAuF/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAhG3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAE5D;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,gBAAgB,CAAgC;IACxD;;;;;;;;;;OAUG;IACH,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH;;;;;;;OAOG;IAEH,SAAS,aACU,MAAM,EAAE,SAAS;IAClC;;;;;;;;OAQG;IACM,SAAS,EAAE,aAAa,EACd,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM;IAoBpB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAOpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI9C,oDAAoD;IACpD,mBAAmB,IAAI,MAAM,GAAG,IAAI;IAIpC;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;;;;;;OAmBG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkCjC,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IAEH;;;;;;;;;OASG;IAEH;;;;;;OAMG;IACH,SAAS,CAAC,cAAc,IAAI,kBAAkB;YAUhC,kBAAkB;IAqJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASnD;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI;IA2BP;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAc7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAchB,cAAc;IAuY5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;;;;;;OAQG;cACa,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAqBlB,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAMlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMlD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,eAAe;CA6BxB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/connection/AbstractAbapConnection.js

@@ -29,6 +29,18 @@ const IAdtTransport_js_1 = require("./IAdtTransport.js");
  * missing session cookie is a warning rather than a rule, and no code here
  * counts sessions or predicts the next answer from the last one.
  */
+/**
+ * Whether a header is already set, whatever case the caller spelled it in.
+ *
+ * HTTP header names are case-insensitive and these arrive from two directions —
+ * this file writes `X-sap-adt-profiling`, a caller may write
+ * `x-sap-adt-profiling` — so a plain key lookup would answer "absent" for a
+ * header that is present and write it twice.
+ */
+function hasHeader(headers, name) {
+    const wanted = name.toLowerCase();
+    return Object.keys(headers).some((key) => key.toLowerCase() === wanted);
+}
 class AbstractAbapConnection {
     config;
     transport;
@@ -42,6 +54,22 @@ class AbstractAbapConnection {
     baseUrl;
     sessionId = null;
     sessionMode = 'stateless';
+    /**
+     * What this connection asks the server to report about its own processing.
+     *
+     * Sent on every request as `X-sap-adt-profiling`, which is what Eclipse does
+     * — measured from an ADT 3.60.0 trace, where it rides on a stateless source
+     * `PUT` as readily as on a lock. `null` stops asking.
+     *
+     * Settable because it is a request's business, not a session's, and because
+     * a caller can already need something other than the default: a profiler run
+     * in `@mcp-abap-adt/adt-clients` writes its own value today, by putting the
+     * header in the request by hand. Nothing in this package reads the
+     * `server-time=…` that comes back — but an investigation does, and this
+     * session used it to establish that the unit is microseconds, so the default
+     * stays on and the way to turn it off is this property rather than a fork.
+     */
+    profilingRequest = 'server-time';
     /**
      * When true, requests are treated as part of an uninterruptible critical
      * section (e.g. a lock → modify → unlock chain). In this state a short
@@ -147,6 +175,18 @@ class AbstractAbapConnection {
     getSessionMode() {
         return this.sessionMode;
     }
+    /**
+     * What to ask the server to report, or `null` to ask nothing.
+     *
+     * @param what the `X-sap-adt-profiling` value; `'server-time'` is Eclipse's.
+     */
+    setProfilingRequest(what) {
+        this.profilingRequest = what;
+    }
+    /** What this connection is currently asking for. */
+    getProfilingRequest() {
+        return this.profilingRequest;
+    }
     /**
      * Enter an uninterruptible critical section.
      *
@@ -747,11 +787,33 @@ class AbstractAbapConnection {
         if (this.sessionId) {
             requestHeaders['sap-adt-connection-id'] = this.sessionId;
         }
-        // Add stateful session headers if stateful mode is enabled
+        // A request id identifies the **request**, so every request gets a fresh
+        // one. It used to be written only in the stateful branch, which was
+        // invisible while every write happened inside a lock window — the window
+        // was stateful, so the writes carried it. `@mcp-abap-adt/adt-clients` has
+        // since narrowed stateful to the `LOCK` and the `UNLOCK`, and the writes
+        // silently lost the header as a side effect. Eclipse sends it on
+        // everything: measured on ADT 3.60.0, a stateless source `PUT` carries
+        // `sap-adt-request-id` and `X-sap-adt-profiling` and no session type at all.
+        //
+        // **A default, not an override.** The caller's headers were copied in
+        // above, and a caller who names either of these means it: `adt-clients`
+        // passes its own id to `getDiscovery({ requestId })` so the id it logs is
+        // the id on the wire, and a profiler run asks for something other than
+        // `server-time`. Replacing those would break the correlation the caller
+        // asked for, silently. The name is matched without case because HTTP does
+        // not distinguish it and callers spell it both ways.
+        if (!hasHeader(requestHeaders, 'sap-adt-request-id')) {
+            requestHeaders['sap-adt-request-id'] = (0, node_crypto_1.randomUUID)().replace(/-/g, '');
+        }
+        if (this.profilingRequest !== null &&
+            !hasHeader(requestHeaders, 'x-sap-adt-profiling')) {
+            requestHeaders['X-sap-adt-profiling'] = this.profilingRequest;
+        }
+        // And this one really is the session's: it says how the server should treat
+        // the request, which is the only one of the three that varies with the mode.
         if (this.sessionMode === 'stateful') {
             requestHeaders['x-sap-adt-sessiontype'] = 'stateful';
-            requestHeaders['sap-adt-request-id'] = (0, node_crypto_1.randomUUID)().replace(/-/g, '');
-            requestHeaders['X-sap-adt-profiling'] = 'server-time';
         }
         // Add auth headers (these MUST NOT be overridden)
         Object.assign(requestHeaders, await this.getAuthHeaders());

package/dist/connection/CloudHttpTransport.d.ts

@@ -22,6 +22,25 @@ export declare class CloudHttpTransport extends HttpTransport implements ICloudT
     readonly kind = "cloud-http";
     /** Which system this wire is for. Read by the compiler, never at runtime. */
     readonly system: "cloud";
+    /**
+     * `x-sap-security-session: use` — on every request, once there is a session.
+     *
+     * ABAP Cloud issues its session as a resource asked for at
+     * `/sap/bc/adt/core/http/sessions`, and Eclipse then names it on everything
+     * that follows rather than relying on the cookie alone. Measured from ADT
+     * 3.60.3 against a BTP trial: a plain
+     * `GET …/businessservices/odatav4/ZAC_SRVB01` carries it, and so does
+     * `POST …/unpublishjobs` — a read and a write, both stateless, both saying
+     * `use`.
+     *
+     * Only when a session exists: saying `use` with nothing to use is a claim
+     * about state this wire is not in, and `create` is the request that makes one.
+     *
+     * On-prem is left alone deliberately. Its session arrives with the logon and
+     * there is no trace of Eclipse sending this there, so adding it would be a
+     * guess wearing a measurement's clothes.
+     */
+    protected sessionHeaders(): Record<string, string>;
     /** The address this server published for our session — the only close target. */
     private resource;
     open(context: IAdtSessionContext): Promise<void>;

package/dist/connection/CloudHttpTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CloudHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/CloudHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAa9E,qBAAa,kBACX,SAAQ,aACR,YAAW,eAAe;IAE1B,SAAkB,IAAI,gBAAgB;IAEtC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,OAAO,CAAU;IAEnC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAuB;IAExB,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDhD,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4ChE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}
+{"version":3,"file":"CloudHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/CloudHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAa9E,qBAAa,kBACX,SAAQ,aACR,YAAW,eAAe;IAE1B,SAAkB,IAAI,gBAAgB;IAEtC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,OAAO,CAAU;IAEnC;;;;;;;;;;;;;;;;;OAiBG;cACgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI3D,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAuB;IAExB,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDhD,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4ChE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}

package/dist/connection/CloudHttpTransport.js

@@ -32,6 +32,27 @@ class CloudHttpTransport extends HttpTransport_js_1.HttpTransport {
     kind = 'cloud-http';
     /** Which system this wire is for. Read by the compiler, never at runtime. */
     system = 'cloud';
+    /**
+     * `x-sap-security-session: use` — on every request, once there is a session.
+     *
+     * ABAP Cloud issues its session as a resource asked for at
+     * `/sap/bc/adt/core/http/sessions`, and Eclipse then names it on everything
+     * that follows rather than relying on the cookie alone. Measured from ADT
+     * 3.60.3 against a BTP trial: a plain
+     * `GET …/businessservices/odatav4/ZAC_SRVB01` carries it, and so does
+     * `POST …/unpublishjobs` — a read and a write, both stateless, both saying
+     * `use`.
+     *
+     * Only when a session exists: saying `use` with nothing to use is a claim
+     * about state this wire is not in, and `create` is the request that makes one.
+     *
+     * On-prem is left alone deliberately. Its session arrives with the logon and
+     * there is no trace of Eclipse sending this there, so adding it would be a
+     * guess wearing a measurement's clothes.
+     */
+    sessionHeaders() {
+        return this.sessionEstablished() ? { 'x-sap-security-session': 'use' } : {};
+    }
     /** The address this server published for our session — the only close target. */
     resource = null;
     async open(context) {

package/dist/connection/HttpTransport.d.ts

@@ -100,6 +100,15 @@ export declare class HttpTransport implements IAdtTransport {
      * server is going down, send us elsewhere rather than fail.
      */
     affinityHeaders(): Record<string, string>;
+    /**
+     * What this wire says about the session it is already in, on every request.
+     *
+     * Empty here, because it is not the same on every wire: a cloud session is a
+     * resource that has to be named, an on-prem one arrives with the logon, and
+     * an RFC conversation has no such notion at all. A wire that has something to
+     * say overrides this.
+     */
+    protected sessionHeaders(): Record<string, string>;
     /**
      * Earn a CSRF token, and with it the cookies that name the session.
      *