@mcp-abap-adt/connection 6.0.1 → 8.0.0

package/CHANGELOG.md

@@ -7,6 +7,159 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.0.0] - 2026-09-08
+
+**A consumer holding the contract can now do what the connection could always do.**
+
+### Changed
+
+- **BREAKING: onto `@mcp-abap-adt/interfaces@^39.0.0`**, from `^21.0.0`.
+  Seventeen majors, and the whole of it was eight compiler errors in one file.
+
+  - `makeAdtRequest` returns `IAdtWireResponse<T, D>`, not `IAdtResponse<T, D>`.
+    The two parted company when `IAdtResponse` became the result-or-failure
+    union a *member* answers, with `E extends IAdtError`; a connection answers
+    the raw HTTP shape, which is what `IAdtWireResponse` is. Six occurrences,
+    all of them the same rename — no behaviour moved.
+  - `isNetworkError` is this package's own again, in `src/utils/networkErrors.ts`.
+    `@mcp-abap-adt/interfaces` published it until 29.0.0, when that package
+    stopped emitting code: it holds types, interfaces and constants, and a
+    predicate is none of those. `NETWORK_ERROR_CODES` is still imported from
+    there — the codes are a constant, the judgement is not.
+
+### Added
+
+- **`flushGoodbye(timeoutMs?)`** — waits for the goodbye `disconnect()`
+  dispatched, within a budget.
+
+  `disconnect()` sends the logoff and does not await it, deliberately: a goodbye
+  carries no request timeout, and a server that never answers must not hold a
+  teardown open. That is right for a teardown and wrong for a reconnect —
+  `disconnect()` then `connect()` opens the next session while the previous
+  one's goodbye is still being assembled, and the server keeps both.
+
+  Measured on E19 through `@mcp-abap-adt/adt-clients`, whose harness recycled
+  the session after each test: a new ABAP session every one to two seconds for a
+  whole run, none released, each living to its own thirty-minute idle timeout.
+
+  The budget bounds the waiting, not the overlap: finishes in time and there is
+  none, does not and the caller proceeds while the goodbye stays outstanding.
+
+- **The connection declares the atoms it honours**: `ICriticalSection`,
+  `IRequestProfiling` and — through 39.0.0's addition to
+  `ISessionLifecycleAware` — `flushGoodbye`.
+
+  All four methods already existed here. What changed is that a consumer can
+  reach them: `AbapConnection` is `IAbapConnection`, so until now
+  `beginCriticalSection()`, `setProfilingRequest()` and `flushGoodbye()` were
+  reachable only by casting to the concrete class, which is the thing the
+  contracts package exists to make unnecessary.
+
+  A test narrows a connection to each atom from the base contract and calls
+  through it. Worth saying what that does and does not check: TypeScript is
+  structural, so removing an atom from the `implements` list changes nothing —
+  the class still has the methods. What the clause buys is the compiler
+  checking the class against the contract: removing `beginCriticalSection`
+  itself is `TS2420`, which is the failure worth having.
+
+
+## [7.0.0] - 2026-09-08
+
+**Headers that belong to the request stop belonging to the session.**
+
+Nothing in the type surface changed: no signature narrowed, `IAbapConnection` is
+untouched, and code built against 6.x compiles unchanged. The major is for the
+wire — every request now looks different in an SAP trace, and on cloud it says
+something about the session it did not say before. A system that reacts badly to
+either should be findable by version rather than by reading a trace.
+
+### Changed
+
+- **BREAKING: `sap-adt-request-id` goes out on every request**, not only inside
+  the stateful branch, and `X-sap-adt-profiling` comes from a settable default
+  rather than a literal.
+
+  Only `x-sap-adt-sessiontype` ever belonged in that branch. A request id
+  identifies the **request**, and asking the server to report its own processing
+  time is not a property of the session either. It stayed invisible while every
+  write happened inside a lock window — the window was stateful, so the writes
+  carried all three — and `@mcp-abap-adt/adt-clients` has since narrowed
+  stateful to the `LOCK` and the `UNLOCK`, at which point the writes silently
+  lost two headers.
+
+  Eclipse sends both on everything. From an ADT 3.60.0 trace on E19, a stateless
+  source `PUT` carries `sap-adt-request-id` and `X-sap-adt-profiling` and no
+  session type at all. Measured on a BTP trial after the narrowing: of 792
+  requests in a full run, 99 carried a request id and **693 — 87.5% — carried
+  neither**.
+
+  Both are **defaults, not overrides**: a caller who names either in
+  `options.headers` keeps it, matched without case. `adt-clients` passes its own
+  id to `getDiscovery({ requestId })` so the id it logs is the id on the wire,
+  and a profiler run asks for something other than `server-time`.
+
+- **BREAKING (cloud): `x-sap-security-session: use` on every request**, once a
+  session exists.
+
+  ABAP Cloud issues its session as a resource asked for at
+  `/sap/bc/adt/core/http/sessions`, and this wire said the header exactly twice
+  in a session's life — `create` to open one, `use` on the `DELETE` that ends
+  it. Eclipse names it on everything in between. Measured from ADT 3.60.3
+  against a BTP trial: a plain `GET …/businessservices/odatav4/ZAC_SRVB01` and a
+  `POST …/unpublishjobs`, a read and a write, both stateless, both saying `use`
+  beside `saplb: appserver-dgm9s` and `saplb-options: REDISPATCH_ON_SHUTDOWN`.
+
+  That pair works together on a load-balanced landscape: here is the server, and
+  use the session that lives on it. In one full run against the same trial the
+  responses named two different application servers — `appserver-dgm9s` 501
+  times and `appserver-8q4vl` 290 — so which one answers is not a constant, and
+  the session is not on both.
+
+  **On-prem is deliberately unchanged**: its session arrives with the logon,
+  there is no trace of Eclipse sending this there, and adding it would be a
+  guess wearing a measurement's clothes.
+
+### Added
+
+- `setProfilingRequest(what: string | null)` / `getProfilingRequest()` — the
+  connection-wide `X-sap-adt-profiling` default, `null` to ask nothing.
+  `'server-time'` is what Eclipse asks for and stays the default. Nothing in
+  this package reads the answer back, which is an argument for being able to
+  turn it off rather than for switching it off: an investigation does read it,
+  and one settled this week that the unit is microseconds — a trial's unpublish
+  job answered `server-time=132512547` on a request that takes ~133 s.
+
+  **On the concrete class, not yet on the contract.** `AbapConnection` is
+  `IAbapConnection`, so a consumer holding the contract reaches these only by
+  casting. `@mcp-abap-adt/interfaces@38.1.0` publishes `IRequestProfiling`
+  (and `ICriticalSection`, for the section this package already has) as
+  capability atoms for exactly this — but this package is on `^21.0.0`, and
+  declaring them means moving seventeen majors, which is its own piece of work
+  and not this one. Until then the per-request route is the contract-level one:
+  `X-sap-adt-profiling` in `options.headers` is honoured and never overwritten.
+
+
+## [6.1.0] - 2026-09-03
+
+### Licence
+
+- **This package is now `LGPL-3.0-only`.** It was MIT up to and including 6.0.1, and
+  those versions stay MIT — a licence change is not retroactive, and anyone
+  already using 6.0.1 under MIT keeps that grant for 6.0.1.
+
+  The library licence of the GNU family, chosen for what it does *not* ask:
+  linking it into your own program — importing it, as every consumer of an npm
+  package does — does not put your program under the LGPL. What it asks is that
+  changes to this library stay free and that your users can substitute their own
+  build of it.
+
+  Both texts ship in the package: `LICENSE` is the LGPL, `COPYING` is the GPL it
+  is written on top of. The LGPL is a set of additional permissions over the GPL,
+  so it cannot be read without both.
+
+  Copyright © 2025–2026 Oleksii Kyslytsia.
+
+
 ## [6.0.1] - 2026-08-25
 
 ### Removed
@@ -1360,8 +1513,11 @@ const connection = createAbapConnection(config, logger);
 - JWT token refresh now properly handles connection errors (401/403 during initial connect)
 - Permission errors (403 with "ExceptionResourceNoAccess") no longer trigger JWT refresh loops
 - Proper separation: base class handles HTTP/session, concrete classes handle auth-specific errors
-[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.1...HEAD
+[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v8.0.0...HEAD
+[8.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v7.0.0...v8.0.0
+[7.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.1.0...v7.0.0
 [6.0.1]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.0...v6.0.1
+[6.1.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.1...v6.1.0
 [6.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v5.0.0...v6.0.0
 [5.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v4.0.0...v5.0.0
 [4.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v3.0.0...v4.0.0