@mcp-abap-adt/connection 9.3.0 → 9.3.3

package/CHANGELOG.md

@@ -7,6 +7,95 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [9.3.3] - 2026-09-27
+
+### Changed
+
+- **Over RFC, stateless calls reuse a conversation and reset its server
+  context when supported.** `@mcp-abap-adt/sap-rfc-lite` 0.2.0 adds
+  `resetServerContext()` (`RfcResetServerContext`), so each call gets a clean
+  ABAP context without logging in again. Measured on E19, this took about
+  0.24 s per call, compared with 0.67 s when opening a conversation each time.
+  Concurrent calls use a separate conversation so they cannot run between a
+  previous call and its reset. If reset fails, that conversation is closed.
+  With `sap-rfc-lite` 0.1.x, calls continue to use a new conversation each.
+  Create, read after create, two lock/write/unlock rounds and delete passed on
+  one E19 connection.
+
+## [9.3.2] - 2026-09-27
+
+### Fixed
+
+- **Over RFC, a request that is not stateful runs on a conversation of its
+  own.** `RfcTransport` carried everything on one conversation, one ABAP
+  session, so whatever a program left in it stayed:
+  - after a package was created or written, every further write or delete of
+    it answered 400 PAK/058 "Package … is already locked" (`CL_PACKAGE`'s
+    instance buffer);
+  - a read straight after a create answered 400 SADT_RESOURCE/007.
+
+  Now the conversation `open()` makes carries the requests marked `stateful`
+  (the lock and its release), and every other request opens one of its own
+  and closes it when it answers. That is Eclipse ADT's split over JCo: one
+  stateful enqueue session, every other call in a session of its own.
+  Measured on E19, one connection: create, read, two lock/PUT/unlock rounds
+  and a delete all pass. The price is a logon per non-stateful call — about
+  0.5 s on E19, against about 0.1 s for the call itself.
+
+  Stateful is decided the same way on both wires (`isStatefulRequest`): the
+  connection's flag, or a session header the caller wrote itself. And a call
+  whose own conversation is still logging on when the wire is closed sends
+  nothing: it closes that conversation and refuses, rather than delivering a
+  `PUT` or `DELETE` on a wire already given back.
+
+## [9.3.1] - 2026-09-27
+
+### Fixed
+
+- **Over HTTP, a request that is not stateful no longer reaches the stateful
+  context.** `sap-contextid` names the context a `LOCK` opens, and SAP routes any
+  request that carries it into that context — session header or none. The wire
+  sent the whole jar on every request, so a "stateless" `PUT` after a `LOCK` ran
+  in the lock's context. Measured 2026-09-27 on one connection, a package locked,
+  written and unlocked twice:
+  - E19 (BASIS 816): the second `PUT` answered 400 PAK/058 "Package … is already
+    locked" — the first save was still in that context's `CL_PACKAGE` buffer, and
+    a delete on the same connection was refused the same way;
+  - E98 (BASIS 756): every `PUT` answered 423 "Resource … is not locked (invalid
+    lock handle)".
+
+  With the cookie kept to the stateful requests, both systems wrote twice and
+  deleted on the same connection. That is Eclipse ADT's split too: its trace
+  shows one stateful session for `LOCK` and `UNLOCK` alone and every other
+  request, the `PUT` included, outside it. The jar still holds the cookie, so
+  the `UNLOCK` that follows reaches the context holding the lock.
+
+  The cookie is filtered on the header as it finally goes out, not only on
+  the jar: the connection's CSRF and 401 retries write the whole jar into the
+  request's own `Cookie`, and a caller can spell that header in lower case.
+  Either way, a non-stateful request does not carry the context.
+
+### Changed
+
+- **The session type is the wire's to express, not the connection's.**
+  `setSessionType('stateful')` now marks each request `stateful: true` on
+  `IAdtTransportRequest` instead of writing `x-sap-adt-sessiontype` into its
+  headers.
+  - `HttpTransport` adds `x-sap-adt-sessiontype: stateful` and `sap-contextid`
+    to stateful requests only (overridable through `sessionTypeHeaders()`;
+    `LegacyOnPremHttpTransport` sends no header, as before). The legacy wire
+    decides stateful before it drops a header the caller wrote, so a caller
+    that asks for the session that way — `AdtClassLegacy` — keeps its context
+    cookie, and its `UNLOCK` still reaches the lock.
+  - `RfcTransport` sends no session header, which is what Eclipse's JCo trace
+    shows.
+
+  A request whose caller wrote the header themselves is still treated as
+  stateful.
+
+  **What a consumer does:** nothing, through the connectors. A custom
+  `IAdtTransport` reads `request.stateful` where it used to find the header.
+
 ## [9.3.0] - 2026-09-26
 
 ### Changed
@@ -1783,7 +1872,10 @@ const connection = createAbapConnection(config, logger);
 - JWT token refresh now properly handles connection errors (401/403 during initial connect)
 - Permission errors (403 with "ExceptionResourceNoAccess") no longer trigger JWT refresh loops
 - Proper separation: base class handles HTTP/session, concrete classes handle auth-specific errors
-[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.3.0...HEAD
+[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.3.3...HEAD
+[9.3.3]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.3.2...v9.3.3
+[9.3.2]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.3.1...v9.3.2
+[9.3.1]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.3.0...v9.3.1
 [9.3.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.2.2...v9.3.0
 [9.2.2]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.2.1...v9.2.2
 [9.2.1]: https://github.com/fr0ster/mcp-abap-connection/compare/v9.2.0...v9.2.1

package/README.md

@@ -292,6 +292,14 @@ where stateful HTTP sessions are not usable: an RFC conversation is one ABAP
 session for its whole lifetime, which is the way past `423 invalid lock handle`
 on BASIS < 7.50.
 
+Since 9.3.2, LOCK and UNLOCK in stateful mode share the persistent RFC
+conversation; stateless requests use a separate ABAP context. With
+`sap-rfc-lite` 0.2.0 or newer, that context is reset between calls on a kept
+conversation; older clients open one conversation per call. This prevents stale
+package state from causing PAK/058 on later writes or SADT_RESOURCE/007 on a
+read after create. Concurrent calls use a separate conversation. See
+[RFC conversation isolation](./docs/STATEFUL_SESSION_GUIDE.md#rfc-conversation-isolation-933).
+
 Needs the SAP NW RFC SDK on the machine and `npm install @mcp-abap-adt/sap-rfc-lite`.
 
 ```typescript
@@ -429,7 +437,11 @@ See [MIGRATION-4.0.md](./docs/MIGRATION-4.0.md).
 
 ### Stateful Sessions
 
-For operations that require session state (e.g., object modifications), you can enable stateful sessions:
+Enable stateful mode for requests that need the ABAP context, such as LOCK and
+UNLOCK. Switch to stateless for GET and PUT between them: a lock handle does
+not require the write itself to run in the lock’s context. Authentication
+cookies and the CSRF token remain available in both modes. See the
+[Stateful Session Guide](./docs/STATEFUL_SESSION_GUIDE.md) for transport behavior.
 
 ```typescript
 import {
@@ -450,18 +462,18 @@ const connection = new AdtOnPremConnector(
 );
 await connection.connect();
 
-// Enable stateful session mode (adds x-sap-adt-sessiontype: stateful header)
+// Enable the stateful HTTP context (session header and context cookie)
 connection.setSessionType("stateful");
 
-// Make requests - SAP will maintain session state
-await connection.makeAdtRequest({
-  method: "POST",
-  url: "/sap/bc/adt/objects/domains",
-  data: { /* domain data */ },
-  timeout: getTimeout("default"),
-});
+// Send the LOCK request here, then leave its context for GET / PUT.
+connection.setSessionType("stateless");
+
+// Send GET / PUT with the lock handle here.
+// Return to the same context when sending UNLOCK.
+connection.setSessionType("stateful");
+// Send UNLOCK here, then restore the default mode.
+connection.setSessionType("stateless");
 
-// Note: Session state persistence is handled by @mcp-abap-adt/auth-broker package
 ```
 
 ### Custom Logger

package/dist/connection/AbstractAbapConnection.d.ts

@@ -126,7 +126,9 @@ declare abstract class AbstractAbapConnection implements AbapConnection, ISessio
     transport: IAdtTransport, logger: ILogger | null, sessionId?: string);
     /**
      * Set session type (stateful or stateless)
-     * Controls whether x-sap-adt-sessiontype: stateful header is added to requests
+     * Marks the requests that follow as `stateful` for the transport, which says
+     * so on its own wire (over HTTP: `x-sap-adt-sessiontype: stateful` and the
+     * context cookie; over RFC: nothing)
      * - stateful: SAP maintains session state between requests (locks, transactions)
      * - stateless: Each request is independent
      *

package/dist/connection/AbstractAbapConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,yCAAyC,CAAC;AAOjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAqC5B,uBAAe,sBACb,YACE,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB;IAuGjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAhH3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAE5D;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,gBAAgB,CAAgC;IACxD;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,OAAO,CAAoC;IAEnD,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH;;;;;;;OAOG;IAEH,SAAS,aACU,MAAM,EAAE,SAAS;IAClC;;;;;;;;OAQG;IACM,SAAS,EAAE,aAAa,EACd,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM;IAoBpB;;;;;;;;;;OAUG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAOpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI9C,oDAAoD;IACpD,mBAAmB,IAAI,MAAM,GAAG,IAAI;IAIpC;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;OAcG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuCjC;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnD,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IAEH;;;;;;;;;OASG;IAEH;;;;;;OAMG;IACH,SAAS,CAAC,cAAc,IAAI,kBAAkB;YAUhC,kBAAkB;IAqJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASnD;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI;IA2BP;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAc7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAcpB,cAAc;IAuY5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;;;;;;OAQG;cACa,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAqBlB,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAMlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMlD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,eAAe;CA6BxB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}
+{"version":3,"file":"AbstractAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/AbstractAbapConnection.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACvB,MAAM,yCAAyC,CAAC;AAOjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAEL,gBAAgB,EAEjB,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAGnB,MAAM,oBAAoB,CAAC;AAqC5B,uBAAe,sBACb,YACE,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB;IAuGjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,EAAE,aAAa;IACjC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAhH3C;;;;OAIG;IACH,SAAS,CAAC,QAAQ,CAAC,SAAS,mBAA0B;IAEtD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,WAAW,CAAyC;IAE5D;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,gBAAgB,CAAgC;IACxD;;;;;;;;;;OAUG;IACH;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,OAAO,CAAoC;IAEnD,OAAO,CAAC,iBAAiB,CAAS;IAClC,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,oEAAoE;IACpE;;;;;;;;;;;;;;OAcG;IACH;;;;OAIG;IACH;;;;;;;;;;;;OAYG;IACH;;;;;;;OAOG;IAEH,SAAS,aACU,MAAM,EAAE,SAAS;IAClC;;;;;;;;OAQG;IACM,SAAS,EAAE,aAAa,EACd,MAAM,EAAE,OAAO,GAAG,IAAI,EACzC,SAAS,CAAC,EAAE,MAAM;IAoBpB;;;;;;;;;;;;OAYG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,WAAW,GAAG,IAAI;IAOpD;;OAEG;IACH,cAAc,IAAI,WAAW,GAAG,UAAU;IAI1C;;;;OAIG;IACH,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI9C,oDAAoD;IACpD,mBAAmB,IAAI,MAAM,GAAG,IAAI;IAIpC;;;;;;;;;;;;;;OAcG;IACH,oBAAoB,IAAI,IAAI;IAQ5B;;;;OAIG;IACH,kBAAkB,IAAI,IAAI;IAY1B;;OAEG;IACH,mBAAmB,IAAI,OAAO;IAI9B;;;OAGG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrC;;OAEG;IACH,YAAY,IAAI,MAAM,GAAG,IAAI;IAI7B,SAAS,IAAI,SAAS;IAItB;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAEpD;;;;;;;;;;;;;;OAcG;cACa,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAElD;;;;;;;;OAQG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuCjC;;;;;;;;;;;;;;OAcG;IACG,YAAY,CAAC,SAAS,SAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBnD,WAAW,IAAI,OAAO;IAItB;;;;;;;;;OASG;IACH,kBAAkB,IAAI,MAAM,GAAG,IAAI;IAInC;;;;;;;;;;;;OAYG;cACa,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMpE;;;;;;;;;;;;OAYG;IACH;;;;OAIG;IAEH;;;;;;;;;OASG;IAEH;;;;;;OAMG;IACH,SAAS,CAAC,cAAc,IAAI,kBAAkB;YAUhC,kBAAkB;IAqJhC,sEAAsE;IACtE,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED;;;;;;OAMG;IACH,SAAS,KAAK,iBAAiB,IAAI,MAAM,CAExC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,SAAS,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAShD,6DAA6D;IAC7D,SAAS,CAAC,cAAc,IAAI,IAAI;IAIhC;;;;;;;OAOG;IACH,SAAS,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;IASnD;;;;;;;;OAQG;IACH,SAAS,CAAC,eAAe,CACvB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACjC,UAAU,CAAC,EAAE,MAAM,GAClB,IAAI;IA2BP;;;;;;;;;;;;;;;OAeG;IACH,OAAO,CAAC,mBAAmB;IAc3B;;;;;;;;OAQG;IACH,OAAO,CAAC,qBAAqB;IAc7B,+EAA+E;IAC/E,OAAO,CAAC,iBAAiB;IASzB;;;;;;;OAOG;IACH,SAAS,CAAC,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAI7C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC;IAI7B,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAejD,cAAc,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,GAAG,EACnC,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAcpB,cAAc;IAwY5B,SAAS,CAAC,QAAQ,CAAC,wBAAwB,IAAI,MAAM;IAErD;;;;;;;;OAQG;cACa,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,UAAU,GAAE,MAAgC,EAC5C,UAAU,GAAE,MAAgC;IAC5C,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC;IAqBlB,SAAS,CAAC,YAAY,IAAI,MAAM,GAAG,IAAI;IAIvC;;OAEG;IACH,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAMlD;;OAEG;IACH,SAAS,CAAC,UAAU,IAAI,MAAM,GAAG,IAAI;IAIrC;;;;;;OAMG;IACH,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAMlD;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,IAAI,OAAO,YAAY,EAAE,YAAY;IAInE;;;;;;;;OAQG;YACW,eAAe;IAW7B;;;;;;;;OAQG;IACH,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,eAAe;CA6BxB;AAED,OAAO,EAAE,sBAAsB,EAAE,CAAC"}

package/dist/connection/AbstractAbapConnection.js

@@ -170,7 +170,9 @@ class AbstractAbapConnection {
     }
     /**
      * Set session type (stateful or stateless)
-     * Controls whether x-sap-adt-sessiontype: stateful header is added to requests
+     * Marks the requests that follow as `stateful` for the transport, which says
+     * so on its own wire (over HTTP: `x-sap-adt-sessiontype: stateful` and the
+     * context cookie; over RFC: nothing)
      * - stateful: SAP maintains session state between requests (locks, transactions)
      * - stateless: Each request is independent
      *
@@ -857,11 +859,11 @@ class AbstractAbapConnection {
             !hasHeader(requestHeaders, 'x-sap-adt-profiling')) {
             requestHeaders['X-sap-adt-profiling'] = this.profilingRequest;
         }
-        // And this one really is the session's: it says how the server should treat
-        // the request, which is the only one of the three that varies with the mode.
-        if (this.sessionMode === 'stateful') {
-            requestHeaders['x-sap-adt-sessiontype'] = 'stateful';
-        }
+        // The session mode is NOT a header here. How a request asks for the
+        // stateful session is the wire's: HTTP says it with
+        // `x-sap-adt-sessiontype: stateful` and the context cookie, RFC with
+        // neither. It travels as `stateful` on the request below, and each
+        // transport expresses it its own way.
         // Add auth headers (these MUST NOT be overridden)
         Object.assign(requestHeaders, await this.getAuthHeaders());
         // Read once: the wire is asked what it holds, and the same value is what
@@ -909,6 +911,7 @@ class AbstractAbapConnection {
             // `unknown` on the caller's options, a record on the seam: the two
             // transports serialise a query differently and both need the pairs.
             params: params,
+            stateful: this.sessionMode === 'stateful',
         };
         if (data !== undefined) {
             requestConfig.data = data;

package/dist/connection/HttpTransport.d.ts

@@ -21,6 +21,7 @@
 import { type AgentOptions } from 'node:https';
 import type { ILogger } from '../logger.js';
 import type { IAdtEstablishContext, IAdtSessionContext, IAdtTransport, IAdtTransportRequest, IAdtTransportResponse } from './IAdtTransport.js';
+export { isStatefulRequest } from './statefulRequest.js';
 export declare class HttpTransport implements IAdtTransport {
     private readonly agentOptions;
     protected readonly logger: ILogger | null;
@@ -141,6 +142,13 @@ export declare class HttpTransport implements IAdtTransport {
      * looking like it carried a session.
      */
     private dress;
+    /**
+     * How this wire asks for the stateful session: `x-sap-adt-sessiontype:
+     * stateful`, as Eclipse sends on its `LOCK` and `UNLOCK` over HTTP. A wire
+     * whose system is hurt by the header overrides this (BASIS 7.40, see
+     * `LegacyOnPremHttpTransport`).
+     */
+    protected sessionTypeHeaders(): Record<string, string>;
     /** A path becomes an address; anything already absolute is left alone. */
     private address;
     private client;

package/dist/connection/HttpTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"HttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/HttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAS5B,qBAAa,aAAc,YAAW,aAAa;IA6B/C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IACzC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IApC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAU;IAE/B,OAAO,CAAC,QAAQ,CAA8B;IAE9C;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;IACjD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,KAAK,CAAuB;gBAGjB,YAAY,GAAE,MAAM,YAAyB,EAC3C,MAAM,GAAE,OAAO,GAAG,IAAW;IAChD;;;;;OAKG;IACc,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO;IAGtE;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAgC/C,0EAA0E;IAC1E,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB;;;;;;OAMG;IACH,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC;;;;;OAKG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;;;OAOG;IACH,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IASzC;;;;;;;OAOG;IACH,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIlD;;;;;;;OAOG;IACG,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmG7D,uEAAuE;IACvE,SAAS,IAAI,MAAM,GAAG,IAAI;IAI1B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1C,4EAA4E;IAC5E,aAAa,IAAI,IAAI;IASrB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK;IAcb,0EAA0E;IAC1E,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;IAuBd;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAEvD;;;;;;OAMG;IACG,KAAK,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD;;;;;OAKG;IACG,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIzE;;;;;;;;;;;;;OAaG;cACa,YAAY,CAC1B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAInB,QAAQ;CA4BvB"}
+{"version":3,"file":"HttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/HttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EACV,oBAAoB,EACpB,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAuC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AASzD,qBAAa,aAAc,YAAW,aAAa;IA6B/C,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IACzC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO;IApC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAU;IAE/B,OAAO,CAAC,QAAQ,CAA8B;IAE9C;;;;;;;OAOG;IACH,OAAO,CAAC,QAAQ,CAAC,GAAG,CAA6B;IACjD,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,KAAK,CAAuB;gBAGjB,YAAY,GAAE,MAAM,YAAyB,EAC3C,MAAM,GAAE,OAAO,GAAG,IAAW;IAChD;;;;;OAKG;IACc,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO;IAGtE;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAgC/C,0EAA0E;IAC1E,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB;;;;;;OAMG;IACH,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC;;;;;OAKG;IACH,kBAAkB,IAAI,OAAO;IAI7B;;;;;;;OAOG;IACH,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IASzC;;;;;;;OAOG;IACH,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIlD;;;;;;;OAOG;IACG,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmG7D,uEAAuE;IACvE,SAAS,IAAI,MAAM,GAAG,IAAI;IAI1B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1C,4EAA4E;IAC5E,aAAa,IAAI,IAAI;IASrB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAWzB;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,KAAK;IA6Bb;;;;;OAKG;IACH,SAAS,CAAC,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAItD,0EAA0E;IAC1E,OAAO,CAAC,OAAO;IAQf,OAAO,CAAC,MAAM;IAuBd;;;;;;OAMG;IACG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAEvD;;;;;;OAMG;IACG,KAAK,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAExD;;;;;OAKG;IACG,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAIzE;;;;;;;;;;;;;OAaG;cACa,YAAY,CAC1B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;YAInB,QAAQ;CA4BvB"}

package/dist/connection/HttpTransport.js

@@ -23,11 +23,49 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HttpTransport = void 0;
+exports.HttpTransport = exports.isStatefulRequest = void 0;
 const node_https_1 = require("node:https");
 const axios_1 = __importDefault(require("axios"));
 const cookies_js_1 = require("../utils/cookies.js");
 const csrfConfig_js_1 = require("./csrfConfig.js");
+const statefulRequest_js_1 = require("./statefulRequest.js");
+/** The cookie that names a stateful ABAP context. */
+const CONTEXT_COOKIE = 'sap-contextid';
+/**
+ * A `Cookie` header without `sap-contextid`, for a request that is not stateful.
+ *
+ * `sap-contextid` names the stateful ABAP context a `LOCK` opened, and SAP
+ * routes any request carrying it into that context — header or no header. So
+ * a "stateless" request that carried it was not stateless: it ran in the
+ * lock's context. Measured on E19 (BASIS 816) and E98 (BASIS 756), 2026-09-27,
+ * one connection, a package locked, written and unlocked twice:
+ *
+ * - E19: the second `PUT` answered 400 PAK/058 "Package … is already locked" —
+ *   the first write's save was still in that context's `CL_PACKAGE` buffer;
+ * - E98: every `PUT` answered 423 "Resource … is not locked (invalid lock
+ *   handle)".
+ *
+ * Without the cookie on the non-stateful requests, both systems wrote twice
+ * and deleted on the same connection. Eclipse ADT does the same thing its
+ * own way: its trace shows one stateful session for `LOCK` and `UNLOCK`
+ * alone, and every other request — the `PUT` included — in a session of its
+ * own.
+ *
+ * The jar itself keeps the cookie: the stateful requests that follow, the
+ * `UNLOCK` above all, still need to reach the context that holds the lock.
+ */
+function withoutContextCookie(cookie) {
+    if (!cookie)
+        return cookie;
+    const kept = cookie
+        .split(/;\s*/)
+        .filter((pair) => pair && pair.split('=')[0]?.trim() !== CONTEXT_COOKIE)
+        .join('; ');
+    return kept || undefined;
+}
+// The one verdict every wire takes; re-exported for the wires built on this one.
+var statefulRequest_js_2 = require("./statefulRequest.js");
+Object.defineProperty(exports, "isStatefulRequest", { enumerable: true, get: function () { return statefulRequest_js_2.isStatefulRequest; } });
 /** A 404 there means the system has no such endpoint, not that it is unwell. */
 function absentEndpoint(error) {
     const status = error
@@ -307,17 +345,46 @@ class HttpTransport {
      * cookie, and replacing it would send the request out unauthenticated while
      * looking like it carried a session.
      */
-    dress(headers) {
+    dress(request) {
+        const headers = request.headers;
+        const stateful = (0, statefulRequest_js_1.isStatefulRequest)(request);
         const dressed = {
             ...this.affinityHeaders(),
             ...this.sessionHeaders(),
+            ...(stateful ? this.sessionTypeHeaders() : {}),
             ...headers,
         };
-        const merged = (0, cookies_js_1.mergeCookieHeaders)(headers?.Cookie, this.combined ?? undefined);
-        if (merged)
-            dressed.Cookie = merged;
+        // Whatever the caller spelled the header as: HTTP does not tell `Cookie`
+        // from `cookie`, and a lowercase one spread in above would bypass the
+        // filter below.
+        let callerCookie;
+        for (const name of Object.keys(dressed)) {
+            if (name.toLowerCase() !== 'cookie')
+                continue;
+            callerCookie = (0, cookies_js_1.mergeCookieHeaders)(callerCookie, dressed[name]);
+            delete dressed[name];
+        }
+        const merged = (0, cookies_js_1.mergeCookieHeaders)(callerCookie, this.combined ?? undefined);
+        // Filtered on the merged header, not only on the jar: a caller's own
+        // `Cookie` can carry the context too — the connection's CSRF and 401
+        // retries put the whole jar there — and a non-stateful request must not
+        // reach the context whichever way the cookie arrived.
+        const cookie = stateful ? merged : withoutContextCookie(merged);
+        if (cookie)
+            dressed.Cookie = cookie;
+        else
+            delete dressed.Cookie;
         return dressed;
     }
+    /**
+     * How this wire asks for the stateful session: `x-sap-adt-sessiontype:
+     * stateful`, as Eclipse sends on its `LOCK` and `UNLOCK` over HTTP. A wire
+     * whose system is hurt by the header overrides this (BASIS 7.40, see
+     * `LegacyOnPremHttpTransport`).
+     */
+    sessionTypeHeaders() {
+        return { [statefulRequest_js_1.SESSION_TYPE_HEADER]: 'stateful' };
+    }
     /** A path becomes an address; anything already absolute is left alone. */
     address(url) {
         if (!url.startsWith('/') || !this.options.baseUrl)
@@ -367,7 +434,7 @@ class HttpTransport {
      * to add it.
      */
     async send(request) {
-        return this.dispatch(request, this.dress(request.headers));
+        return this.dispatch(request, this.dress(request));
     }
     /**
      * Send EXACTLY these headers, with nothing of the wire's live state mixed in.

package/dist/connection/IAdtTransport.d.ts

@@ -37,6 +37,18 @@ export interface IAdtTransportRequest {
      * this seam is written against.
      */
     validateStatus?: (status: number) => boolean;
+    /**
+     * Whether the request runs in the stateful session — the one a lock is
+     * taken and released in.
+     *
+     * A flag rather than a header, because how a session is asked for is the
+     * wire's own business. Over HTTP it is `x-sap-adt-sessiontype: stateful`
+     * plus the `sap-contextid` cookie that addresses the context; over RFC it is
+     * neither — Eclipse's JCo trace carries no session header at all. A request
+     * that is not stateful must not reach that context: see
+     * `HttpTransport.dress`.
+     */
+    stateful?: boolean;
 }
 /** What came back, in the terms every transport can produce. */
 export interface IAdtTransportResponse {

package/dist/connection/IAdtTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IAdtTransport.d.ts","sourceRoot":"","sources":["../../src/connection/IAdtTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;CAC9C;AAED,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,6DAA6D;AAC7D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEpE;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAEhD,8EAA8E;IAC9E,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;;OAMG;IACH,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,kBAAkB,IAAI,OAAO,CAAC;IAE9B,4EAA4E;IAC5E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,0EAA0E;IAC1E,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3C,oDAAoD;IACpD,aAAa,IAAI,IAAI,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAQtE"}
+{"version":3,"file":"IAdtTransport.d.ts","sourceRoot":"","sources":["../../src/connection/IAdtTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,gEAAgE;AAChE,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,6DAA6D;AAC7D;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,2EAA2E;IAC3E,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,oBAAqB,SAAQ,kBAAkB;IAC9D;;;;OAIG;IACH,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;;;;;;;;;OAgBG;IACH,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;;;;OAOG;IACH,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;OAOG;IACH,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEpE;;;;;;;;;OASG;IACH,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAEhD,8EAA8E;IAC9E,OAAO,IAAI,MAAM,GAAG,IAAI,CAAC;IAEzB;;;;;;OAMG;IACH,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,kBAAkB,IAAI,OAAO,CAAC;IAE9B,4EAA4E;IAC5E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExD,0EAA0E;IAC1E,SAAS,IAAI,MAAM,GAAG,IAAI,CAAC;IAE3B;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3C,oDAAoD;IACpD,aAAa,IAAI,IAAI,CAAC;CACvB;AAED;;;;;;;;;;;;GAYG;AACH;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,GAAG,IAAI,CAQtE"}

package/dist/connection/LegacyOnPremHttpTransport.d.ts

@@ -16,8 +16,11 @@ import type { IAdtTransportRequest, IAdtTransportResponse } from './IAdtTranspor
 import { OnPremHttpTransport } from './OnPremHttpTransport.js';
 export declare class LegacyOnPremHttpTransport extends OnPremHttpTransport {
     readonly kind = "onprem-http-legacy";
+    /** The stateful header is the one this system is hurt by, so it asks with none. */
+    protected sessionTypeHeaders(): Record<string, string>;
     /**
-     * The header never goes out, whatever the caller set the session type to.
+     * The header never goes out, whatever the caller set the session type to —
+     * not even when a caller wrote it into the request themselves.
      *
      * Dropped here rather than refused above: `setSessionType()` records what the
      * caller wants, and what actually travels is the wire's business. A caller

package/dist/connection/LegacyOnPremHttpTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"LegacyOnPremHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/LegacyOnPremHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAI/D,qBAAa,yBAA0B,SAAQ,mBAAmB;IAChE,SAAkB,IAAI,wBAAwB;IAE9C;;;;;;;;OAQG;IACY,IAAI,CACjB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAIjC,OAAO,CAAC,kBAAkB;IAY1B;;;;;;;OAOG;IACM,kBAAkB,IAAI,OAAO;CAGvC"}
+{"version":3,"file":"LegacyOnPremHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/LegacyOnPremHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAK/D,qBAAa,yBAA0B,SAAQ,mBAAmB;IAChE,SAAkB,IAAI,wBAAwB;IAE9C,mFAAmF;cAChE,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAI/D;;;;;;;;;OASG;IACY,IAAI,CACjB,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IAUjC,OAAO,CAAC,kBAAkB;IAY1B;;;;;;;OAOG;IACM,kBAAkB,IAAI,OAAO;CAGvC"}

package/dist/connection/LegacyOnPremHttpTransport.js

@@ -16,11 +16,17 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LegacyOnPremHttpTransport = void 0;
 const OnPremHttpTransport_js_1 = require("./OnPremHttpTransport.js");
+const statefulRequest_js_1 = require("./statefulRequest.js");
 const SESSION_TYPE_HEADER = 'x-sap-adt-sessiontype';
 class LegacyOnPremHttpTransport extends OnPremHttpTransport_js_1.OnPremHttpTransport {
     kind = 'onprem-http-legacy';
+    /** The stateful header is the one this system is hurt by, so it asks with none. */
+    sessionTypeHeaders() {
+        return {};
+    }
     /**
-     * The header never goes out, whatever the caller set the session type to.
+     * The header never goes out, whatever the caller set the session type to —
+     * not even when a caller wrote it into the request themselves.
      *
      * Dropped here rather than refused above: `setSessionType()` records what the
      * caller wants, and what actually travels is the wire's business. A caller
@@ -29,7 +35,13 @@ class LegacyOnPremHttpTransport extends OnPremHttpTransport_js_1.OnPremHttpTrans
      * would move its locks somewhere they cannot be released.
      */
     async send(request) {
-        return super.send(this.withoutSessionType(request));
+        // Decided before the header is dropped: a caller that asked for the
+        // stateful session by writing the header itself still gets its context
+        // cookie, only without the header this system is hurt by.
+        return super.send({
+            ...this.withoutSessionType(request),
+            stateful: (0, statefulRequest_js_1.isStatefulRequest)(request),
+        });
     }
     withoutSessionType(request) {
         if (!request.headers)

package/dist/connection/RfcTransport.d.ts

@@ -11,9 +11,32 @@
  * "invalid lock handle" on legacy systems (BASIS < 7.50) where stateful HTTP
  * sessions are not usable.
  *
- * **What is NOT here.** Cookies, the CSRF token, `x-sap-adt-sessiontype` and
- * the session lifecycle belong to the connection above this seam and are
- * already in `request.headers` by the time `send()` is called. A transport that
+ * **Two conversations, the way Eclipse ADT holds them over JCo.** Its trace
+ * shows one long-lived stateful session (`JCoEnqueueSystemSession`) for `LOCK`
+ * and `UNLOCK`, and every other call — the `PUT` included — in a session of
+ * its own. Here:
+ *
+ * - the persistent conversation, opened by `open()` and kept while this wire
+ *   lives, carries the requests marked `stateful` — the lock and what must
+ *   share its session;
+ * - every other request opens a conversation of its own, and closes it when
+ *   it answers.
+ *
+ * One conversation for everything kept whatever an ABAP program left in the
+ * session. `CL_PACKAGE` buffers its instances for the life of the session and
+ * a save leaves them changeable, so after a create or a write every further
+ * write or delete of that package answered 400 PAK/058 "Package … is already
+ * locked"; a read straight after a create answered 400 SADT_RESOURCE/007.
+ * Measured on E19 (2026-09-27): LOCK and UNLOCK on one conversation, the PUT
+ * on another — two writes in a row fail on a shared second conversation and
+ * pass on a fresh one per call. The price is a logon per non-stateful call
+ * (~0.5 s on E19, against ~0.1 s for the call itself).
+ *
+ * **What is NOT here.** Cookies, the CSRF token and the session lifecycle
+ * belong to the connection above this seam and are already in
+ * `request.headers` by the time `send()` is called. `x-sap-adt-sessiontype` is
+ * not sent at all: over RFC `request.stateful` picks the conversation, and
+ * Eclipse's JCo trace carries no session header either. A transport that
  * also captured cookies would be doing that work twice, and the two copies
  * would disagree the first time one of them was cleared.
  */
@@ -25,6 +48,13 @@ export interface IRfcConversation {
     close(): Promise<void>;
     call(fm: string, params: Record<string, unknown>): Promise<Record<string, any>>;
     readonly alive: boolean;
+    /**
+     * Ends the ABAP session context and keeps the connection open
+     * (`RfcResetServerContext`, `@mcp-abap-adt/sap-rfc-lite` >= 0.2.0). Where it
+     * exists, one conversation serves the non-stateful calls, reset after each;
+     * where it does not, each such call opens a conversation of its own.
+     */
+    resetServerContext?(): Promise<void>;
 }
 /** What this wire does beyond carrying the request. */
 export interface IRfcTransportOptions {
@@ -53,6 +83,23 @@ export declare class RfcTransport implements IOnPremTransport {
     /** Which system this wire is for. Read by the compiler, never at runtime. */
     readonly system: "onprem";
     private conversation;
+    /**
+     * Bumped by every `close()`. A call that opened a conversation of its own
+     * compares it after the logon: the wire may have been closed while that
+     * logon was under way, and a write must not go out on a wire the caller has
+     * already given back.
+     */
+    private generation;
+    /**
+     * The conversation the non-stateful calls share when the client can reset
+     * it: opened on the first such call, reset after every call, closed with the
+     * wire. `null` until then, or after a reset failed.
+     */
+    private stateless;
+    /** Taken by the call on `stateless` until its reset is done. */
+    private statelessBusy;
+    /** `false` once a client showed it cannot reset; then every call opens its own. */
+    private canReset;
     /** Names the conversation, and so the ABAP session it carries. */
     private conversationId;
     /**
@@ -107,5 +154,31 @@ export declare class RfcTransport implements IOnPremTransport {
     /** Never throws, and a repeat call finds nothing owed. */
     close(): Promise<void>;
     send(request: IAdtTransportRequest): Promise<IAdtTransportResponse>;
+    /**
+     * A request that is not stateful, in a fresh ABAP session.
+     *
+     * Where the client can reset (`resetServerContext`), one kept conversation
+     * serves these calls and is reset after each: a fresh context without a new
+     * logon, ~0.1 s instead of ~0.5 s on E19. Where it cannot, or while that
+     * conversation is busy with another call, the call opens a conversation of
+     * its own and closes it when it answers.
+     *
+     * A call and its reset go together: a second call on the kept conversation
+     * before the first one's reset would run in the first one's context — a
+     * package the first one saved would refuse the second one's write (PAK/058).
+     * So a concurrent call takes a conversation of its own instead of waiting.
+     */
+    private carryOnItsOwn;
+    private carryOnKept;
+    /** A conversation opened for this one call, closed when it answers. */
+    private carryOnThrowaway;
+    /**
+     * A new conversation, logged on. The logon takes time (~0.5 s on E19); if the
+     * wire was closed meanwhile, the conversation is closed again and nothing is
+     * sent — not a PUT, not a DELETE — on a wire already given back.
+     */
+    private openOwn;
+    private closeQuietly;
+    private carry;
 }
 //# sourceMappingURL=RfcTransport.d.ts.map

package/dist/connection/RfcTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RfcTransport.d.ts","sourceRoot":"","sources":["../../src/connection/RfcTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,oBAAoB,EAEpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAgFD,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,qBAAa,YAAa,YAAW,gBAAgB;IA+EjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAhF1B,QAAQ,CAAC,IAAI,SAAS;IAEtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC,OAAO,CAAC,YAAY,CAAiC;IACrD,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAM;IAE5B;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAEd,2CAA2C;IAC3C,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D,+BAA+B;IAC/B,SAAS,IAAI,IAAI;IAIjB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAEtB;;;OAGG;IACH,6EAA6E;IAC7E,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC,2EAA2E;IAC3E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIzC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAErB;;;;;OAKG;gBAEgB,OAAO,EAAE,MAAM,gBAAgB,EAC/B,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,OAAO,GAAE,oBAAyB;IAGrD,oDAAoD;IACpD,OAAO,CAAC,OAAO;IAcT,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAkK1E"}
+{"version":3,"file":"RfcTransport.d.ts","sourceRoot":"","sources":["../../src/connection/RfcTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,oBAAoB,EAEpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAG5B,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACtC;AAgFD,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACnC;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAKD,qBAAa,YAAa,YAAW,gBAAgB;IAiGjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlG1B,QAAQ,CAAC,IAAI,SAAS;IAEtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC,OAAO,CAAC,YAAY,CAAiC;IACrD;;;;;OAKG;IACH,OAAO,CAAC,UAAU,CAAK;IAEvB;;;;OAIG;IACH,OAAO,CAAC,SAAS,CAAiC;IAClD,gEAAgE;IAChE,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAsB;IACtC,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAM;IAE5B;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAEd,2CAA2C;IAC3C,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D,+BAA+B;IAC/B,SAAS,IAAI,IAAI;IAIjB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAEtB;;;OAGG;IACH,6EAA6E;IAC7E,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC,2EAA2E;IAC3E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIzC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAErB;;;;;OAKG;gBAEgB,OAAO,EAAE,MAAM,gBAAgB,EAC/B,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,OAAO,GAAE,oBAAyB;IAGrD,oDAAoD;IACpD,OAAO,CAAC,OAAO;IAcT,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAwB3B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwBtB,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAezE;;;;;;;;;;;;;OAaG;YACW,aAAa;YAUb,WAAW;IAqDzB,uEAAuE;YACzD,gBAAgB;IAa9B;;;;OAIG;YACW,OAAO;YAgBP,YAAY;YAQZ,KAAK;CAyKpB"}

package/dist/connection/RfcTransport.js

@@ -12,15 +12,39 @@
  * "invalid lock handle" on legacy systems (BASIS < 7.50) where stateful HTTP
  * sessions are not usable.
  *
- * **What is NOT here.** Cookies, the CSRF token, `x-sap-adt-sessiontype` and
- * the session lifecycle belong to the connection above this seam and are
- * already in `request.headers` by the time `send()` is called. A transport that
+ * **Two conversations, the way Eclipse ADT holds them over JCo.** Its trace
+ * shows one long-lived stateful session (`JCoEnqueueSystemSession`) for `LOCK`
+ * and `UNLOCK`, and every other call — the `PUT` included — in a session of
+ * its own. Here:
+ *
+ * - the persistent conversation, opened by `open()` and kept while this wire
+ *   lives, carries the requests marked `stateful` — the lock and what must
+ *   share its session;
+ * - every other request opens a conversation of its own, and closes it when
+ *   it answers.
+ *
+ * One conversation for everything kept whatever an ABAP program left in the
+ * session. `CL_PACKAGE` buffers its instances for the life of the session and
+ * a save leaves them changeable, so after a create or a write every further
+ * write or delete of that package answered 400 PAK/058 "Package … is already
+ * locked"; a read straight after a create answered 400 SADT_RESOURCE/007.
+ * Measured on E19 (2026-09-27): LOCK and UNLOCK on one conversation, the PUT
+ * on another — two writes in a row fail on a shared second conversation and
+ * pass on a fresh one per call. The price is a logon per non-stateful call
+ * (~0.5 s on E19, against ~0.1 s for the call itself).
+ *
+ * **What is NOT here.** Cookies, the CSRF token and the session lifecycle
+ * belong to the connection above this seam and are already in
+ * `request.headers` by the time `send()` is called. `x-sap-adt-sessiontype` is
+ * not sent at all: over RFC `request.stateful` picks the conversation, and
+ * Eclipse's JCo trace carries no session header either. A transport that
  * also captured cookies would be doing that work twice, and the two copies
  * would disagree the first time one of them was cleared.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RfcTransport = void 0;
 const node_crypto_1 = require("node:crypto");
+const statefulRequest_js_1 = require("./statefulRequest.js");
 /**
  * ADT exception types, mapped to what they would have been over HTTP. Standard
  * types, returned in `<exc:exception>` XML.
@@ -98,6 +122,23 @@ class RfcTransport {
     /** Which system this wire is for. Read by the compiler, never at runtime. */
     system = 'onprem';
     conversation = null;
+    /**
+     * Bumped by every `close()`. A call that opened a conversation of its own
+     * compares it after the logon: the wire may have been closed while that
+     * logon was under way, and a write must not go out on a wire the caller has
+     * already given back.
+     */
+    generation = 0;
+    /**
+     * The conversation the non-stateful calls share when the client can reset
+     * it: opened on the first such call, reset after every call, closed with the
+     * wire. `null` until then, or after a reset failed.
+     */
+    stateless = null;
+    /** Taken by the call on `stateless` until its reset is done. */
+    statelessBusy = false;
+    /** `false` once a client showed it cannot reset; then every call opens its own. */
+    canReset;
     /** Names the conversation, and so the ABAP session it carries. */
     conversationId = '';
     /**
@@ -179,6 +220,7 @@ class RfcTransport {
     async open() {
         if (this.conversation?.alive)
             return;
+        const generation = this.generation;
         const conversation = this.connect();
         try {
             await conversation.open();
@@ -186,21 +228,39 @@ class RfcTransport {
         catch (e) {
             throw new Error(`Failed to open RFC connection: ${message(e)}`);
         }
+        // close() ran while this logged on: the session it would have handed out
+        // belongs to a wire already given back, so it is closed, not kept.
+        if (generation !== this.generation) {
+            await this.closeQuietly(conversation);
+            throw new Error('RFC transport was closed while it was being opened.');
+        }
         this.conversation = conversation;
         // Minted here, where the session begins. A conversation opened after an
         // earlier one closed is a DIFFERENT ABAP session, and the fingerprint has
         // to say so — a constant would report `unchanged` across a reconnect and
         // hide exactly the replacement the identity policy exists to catch.
         this.conversationId = (0, node_crypto_1.randomUUID)();
-        this.logger?.debug('RFC conversation opened (stateful by nature)');
+        this.logger?.debug('RFC conversation opened (the stateful one)');
     }
     /** Never throws, and a repeat call finds nothing owed. */
     async close() {
+        // Everything the wire holds is given up BEFORE the first await. Closing
+        // takes time, and a send() that ran meanwhile would otherwise find the
+        // old stateful conversation still `alive` — a lock request carried on a
+        // session already being given back — or open a stateless one of its own
+        // and send a write after close(). With both references gone and the
+        // generation moved on, such a send() is refused as "not open", and a
+        // logon still under way sees the change and sends nothing.
+        this.generation += 1;
+        const stateless = this.stateless;
         const conversation = this.conversation;
-        if (!conversation)
-            return;
+        this.stateless = null;
         this.conversation = null;
         this.conversationId = '';
+        if (stateless)
+            await this.closeQuietly(stateless);
+        if (!conversation)
+            return;
         try {
             await conversation.close();
             this.logger?.debug('RFC conversation closed');
@@ -213,6 +273,123 @@ class RfcTransport {
         if (!this.conversation?.alive) {
             throw new Error('RFC transport is not open. Call connect() first.');
         }
+        // The same verdict HTTP takes: the flag the connection sets, or a session
+        // header the caller wrote itself. A caller that asks for the lock's
+        // session either way has to land on the conversation that holds it.
+        // Taken once, here: every await below compares against it, and a call
+        // that finds the wire closed since it began sends nothing.
+        const generation = this.generation;
+        return (0, statefulRequest_js_1.isStatefulRequest)(request)
+            ? this.carry(request, this.conversation, generation)
+            : this.carryOnItsOwn(request, generation);
+    }
+    /**
+     * A request that is not stateful, in a fresh ABAP session.
+     *
+     * Where the client can reset (`resetServerContext`), one kept conversation
+     * serves these calls and is reset after each: a fresh context without a new
+     * logon, ~0.1 s instead of ~0.5 s on E19. Where it cannot, or while that
+     * conversation is busy with another call, the call opens a conversation of
+     * its own and closes it when it answers.
+     *
+     * A call and its reset go together: a second call on the kept conversation
+     * before the first one's reset would run in the first one's context — a
+     * package the first one saved would refuse the second one's write (PAK/058).
+     * So a concurrent call takes a conversation of its own instead of waiting.
+     */
+    async carryOnItsOwn(request, generation) {
+        if (this.canReset !== false && !this.statelessBusy) {
+            return this.carryOnKept(request, generation);
+        }
+        return this.carryOnThrowaway(request, generation);
+    }
+    async carryOnKept(request, generation) {
+        this.statelessBusy = true;
+        try {
+            if (!this.stateless?.alive) {
+                const opened = await this.openOwn(generation);
+                // Checked again after the await: close() may have run since openOwn()
+                // checked, and a conversation of a closed wire must not become the
+                // kept one of the next.
+                if (generation !== this.generation) {
+                    await this.closeQuietly(opened);
+                    throw new Error('RFC transport was closed while the call was being opened; nothing was sent.');
+                }
+                if (typeof opened.resetServerContext !== 'function') {
+                    // An older client: it cannot be reset, so it is used once and closed,
+                    // and every later call opens its own.
+                    this.canReset = false;
+                    try {
+                        return await this.carry(request, opened, generation);
+                    }
+                    finally {
+                        await this.closeQuietly(opened);
+                    }
+                }
+                this.canReset = true;
+                this.stateless = opened;
+                this.logger?.debug('RFC stateless conversation opened (reset per call)');
+            }
+            const kept = this.stateless;
+            try {
+                return await this.carry(request, kept, generation);
+            }
+            finally {
+                try {
+                    await kept.resetServerContext?.();
+                }
+                catch (e) {
+                    // A context that could not be reset must not serve the next call.
+                    this.logger?.debug(`RFC reset failed, dropping the conversation: ${message(e)}`);
+                    if (this.stateless === kept)
+                        this.stateless = null;
+                    await this.closeQuietly(kept);
+                }
+            }
+        }
+        finally {
+            this.statelessBusy = false;
+        }
+    }
+    /** A conversation opened for this one call, closed when it answers. */
+    async carryOnThrowaway(request, generation) {
+        const own = await this.openOwn(generation);
+        this.logger?.debug('RFC conversation opened for one stateless call');
+        try {
+            return await this.carry(request, own, generation);
+        }
+        finally {
+            await this.closeQuietly(own);
+        }
+    }
+    /**
+     * A new conversation, logged on. The logon takes time (~0.5 s on E19); if the
+     * wire was closed meanwhile, the conversation is closed again and nothing is
+     * sent — not a PUT, not a DELETE — on a wire already given back.
+     */
+    async openOwn(generation) {
+        const own = this.connect();
+        try {
+            await own.open();
+        }
+        catch (e) {
+            throw new Error(`Failed to open RFC connection: ${message(e)}`);
+        }
+        if (generation !== this.generation || !this.conversation?.alive) {
+            await this.closeQuietly(own);
+            throw new Error('RFC transport was closed while the call was being opened; nothing was sent.');
+        }
+        return own;
+    }
+    async closeQuietly(conversation) {
+        try {
+            await conversation.close();
+        }
+        catch (e) {
+            this.logger?.debug(`RFC close error: ${message(e)}`);
+        }
+    }
+    async carry(request, conversation, generation) {
         const method = request.method.toUpperCase();
         // HTTP clients serialise `params`; RFC has no such step, so they go into
         // the URI here or they do not travel at all.
@@ -268,9 +445,14 @@ class RfcTransport {
         // mid-flight is precisely what the connection emulates over HTTP, where
         // a critical section raises the caller's timeout to a ten-minute ceiling so
         // an abort cannot orphan a lock handle. Here that comes free.
+        // The last point before anything leaves: nothing awaits between this
+        // check and the call, so a close() that ran at any await above stops it.
+        if (generation !== this.generation) {
+            throw new Error('RFC transport was closed before the call was sent; nothing was sent.');
+        }
         let raw;
         try {
-            raw = await this.conversation.call('SADT_REST_RFC_ENDPOINT', {
+            raw = await conversation.call('SADT_REST_RFC_ENDPOINT', {
                 REQUEST: {
                     REQUEST_LINE: {
                         METHOD: method,

package/dist/connection/statefulRequest.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Whether a request runs in the stateful session — the one a lock is taken and
+ * released in.
+ *
+ * One verdict for every wire. HTTP expresses it as a header and the context
+ * cookie, RFC as the conversation it picks; if the two wires decided it
+ * differently, a caller that asked for the session one way would keep its lock
+ * on one wire and lose it on the other.
+ */
+import type { IAdtTransportRequest } from './IAdtTransport.js';
+/** The header that asks SAP for the stateful session over HTTP. */
+export declare const SESSION_TYPE_HEADER = "x-sap-adt-sessiontype";
+/**
+ * Marked so by the connection, or — kept for callers that still write it
+ * themselves — carrying the session header already. Taken on the request as
+ * the caller made it, before a wire rewrites it.
+ */
+export declare function isStatefulRequest(request: IAdtTransportRequest): boolean;
+//# sourceMappingURL=statefulRequest.d.ts.map

package/dist/connection/statefulRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"statefulRequest.d.ts","sourceRoot":"","sources":["../../src/connection/statefulRequest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE/D,mEAAmE;AACnE,eAAO,MAAM,mBAAmB,0BAA0B,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAaxE"}

package/dist/connection/statefulRequest.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SESSION_TYPE_HEADER = void 0;
+exports.isStatefulRequest = isStatefulRequest;
+/** The header that asks SAP for the stateful session over HTTP. */
+exports.SESSION_TYPE_HEADER = 'x-sap-adt-sessiontype';
+/**
+ * Marked so by the connection, or — kept for callers that still write it
+ * themselves — carrying the session header already. Taken on the request as
+ * the caller made it, before a wire rewrites it.
+ */
+function isStatefulRequest(request) {
+    if (request.stateful)
+        return true;
+    const headers = request.headers;
+    if (!headers)
+        return false;
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() === exports.SESSION_TYPE_HEADER &&
+            String(value).toLowerCase() === 'stateful') {
+            return true;
+        }
+    }
+    return false;
+}

package/docs/INDEX.md

@@ -69,7 +69,7 @@ mcp-abap-connection/
 
 ### Session Management
 - **Overview**: [USAGE.md - Session Management](./USAGE.md#session-management)
-- **Stateful Mode**: Use `setSessionType('stateful')` for session headers
+- **Stateful Mode**: Use `setSessionType('stateful')` for the LOCK / UNLOCK context; use stateless mode for GET / PUT
 - **Session State Persistence**: Handled by `@mcp-abap-adt/auth-broker` package
 - **API Methods**:
   - `getSessionId()` - Get current session ID (auto-generated UUID)

package/docs/STATEFUL_SESSION_GUIDE.md

@@ -1,8 +1,8 @@
 # Stateful Session Guide (Connection Layer)
 
 > **The header is not what tracks your lock.** `setSessionType('stateful')` sets
-> a per-request header and nothing more — another handler can flip it back while
-> your lock is genuinely open, and a batch never sets it at all. Nothing in this
+> the mode for subsequent requests; HTTP uses it to select the session header
+> and context cookie. Another handler can flip it back while your lock is open. Nothing in this
 > layer tracks locks: that belongs to `@mcp-abap-adt/adt-clients`, which holds the
 > handles and pairs each LOCK with its UNLOCK per object. What the connection
 > offers is `beginCriticalSection()` / `endCriticalSection()`, so a short timeout
@@ -24,6 +24,62 @@ The connection layer **does not** decide when to lock/unlock objects—that logi
 
 ---
 
+## HTTP context isolation (9.3.1)
+
+The authentication session (`SAP_SESSIONID`) and the stateful ABAP context
+(`sap-contextid`) have different roles. HTTP requests keep authentication
+cookies and the CSRF token in either mode. Only stateful requests carry
+`sap-contextid`; the jar retains it while stateless requests run so that a
+later UNLOCK can still reach the context holding the lock.
+
+Use stateful mode for LOCK and UNLOCK, and stateless mode for the intervening
+GET and PUT. Passing a lock handle to PUT does not require the context cookie.
+The ADT clients choose these modes; callers using connectors directly must
+choose the mode for each operation themselves.
+
+Before 9.3.1, the whole jar went out even in stateless mode. After LOCK, a PUT
+therefore ran in the lock's context. Package updates on E19 (BASIS 816) failed
+on the second write with **400 PAK/058, “Package … is already locked”**, and a
+subsequent delete failed too. On E98 (BASIS 756), PUT failed with **423,
+“Resource … is not locked (invalid lock handle)”**. Filtering the context
+cookie allowed two updates and a delete on one connection on both systems.
+The filter also applies to cookies supplied in request headers and retries.
+
+| Transport | Stateful request |
+| --- | --- |
+| HTTP (on-prem / cloud) | Sends `x-sap-adt-sessiontype: stateful` and the context cookie, when held |
+| Legacy on-prem HTTP | Keeps the context cookie but omits the session-type header |
+| RFC | Uses the persistent conversation for stateful requests; since 9.3.3 resets a kept stateless conversation between calls when supported |
+
+A caller-supplied stateful header is also recognized, including by the legacy
+HTTP transport before it removes that header. Custom `IAdtTransport`
+implementations must read `request.stateful`; the connection no longer adds
+`x-sap-adt-sessiontype` itself. The cookie fix was verified on E19 and E98;
+BASIS 7.40 and ABAP Cloud were not integration-tested for this change.
+
+## RFC conversation isolation (9.3.2 and 9.3.3)
+
+Stateful requests, including LOCK and UNLOCK, share the conversation opened
+by `connect()`. Since 9.3.3, `sap-rfc-lite` 0.2.0 and newer let stateless calls
+reuse a second conversation: the transport resets its ABAP server context after
+each call, keeping the RFC logon open. With older clients (0.1.x), or when a
+resettable conversation is busy, each stateless call gets a separate temporary
+conversation. Both `setSessionType('stateful')` and a caller-supplied stateful
+session header select the persistent conversation.
+
+Previously all RFC requests shared one ABAP session. On E19, saving a package
+left state in `CL_PACKAGE`'s instance buffer: later writes or deletes failed
+with **400 PAK/058, “Package … is already locked”**. Reading immediately after
+creation could fail with **400 SADT_RESOURCE/007**. With separate conversations,
+create, read, two lock/PUT/unlock rounds and delete passed on one connection.
+
+When using `sap-rfc-lite` 0.1.x, each stateless call pays for an RFC logon:
+about 0.5 s on E19, in addition to about 0.1 s for the call. With 0.2.0+, a
+resettable call took about 0.24 s total on E19. Direct connector users must mark
+LOCK and UNLOCK stateful to retain their conversation. If disconnect occurs
+while a temporary conversation is logging on, it is closed without sending
+the request; reconnect does not revive that pending request.
+
 ## Enabling Stateful Sessions
 
 Every example below builds on this much, so it is stated once:
@@ -62,10 +118,10 @@ const connection = new AdtOnPremConnector(
 );
 await connection.connect();   // required before any request
 
-// Enable stateful session mode (adds x-sap-adt-sessiontype: stateful header)
+// Enable the stateful HTTP context (session header and context cookie)
 connection.setSessionType('stateful');
 
-// Now all requests share the same session (cookies, CSRF token)
+// Following requests use the stateful context until the mode is changed
 await connection.makeAdtRequest({ method: 'GET', url: '/sap/bc/adt/discovery' , timeout: getTimeout('default') });
 
 // Switch back to stateless
@@ -178,7 +234,7 @@ wrong fixes:
 |---|---|---|
 | **the connection** | one TCP socket | you, the network, a timeout firing. **Ends nothing on the server** |
 | **the HTTP session** | the ICF conversation, held by the cookie jar on this side | dropping the cookies, or a logoff. Nothing about it is in doubt |
-| **the ABAP session** | the server-side context named by `SAP_SESSIONID_<SID>_<CLIENT>` — the roll area a stateful request runs in | **only the server.** Its own idle timeout, which this side can neither read nor influence, or an explicit logoff |
+| **the ABAP session** | the authentication session named by `SAP_SESSIONID_<SID>_<CLIENT>`; `sap-contextid` separately addresses the stateful ABAP context | **only the server.** Its own idle timeout, which this side can neither read nor influence, or an explicit logoff |
 | **the lock** | an enqueue entry, **owned by the ABAP session** | that ABAP session ending. **When it goes, its locks go with it** |
 
 The two middle rows are the ones worth keeping apart, because everything that

package/docs/USAGE.md

@@ -250,9 +250,13 @@ await connection.connect();
 await connection.makeAdtRequest({ method: 'GET', url: '/sap/bc/adt/discovery' , timeout: getTimeout('default') });
 ```
 
-### Stateful Mode (Session Headers)
+### Stateful Mode (HTTP Context)
 
-Enable stateful session mode for operations requiring consistent session state:
+Use stateful mode for LOCK and UNLOCK, then stateless mode for GET and PUT
+between them. Since 9.3.1, stateless HTTP requests omit `sap-contextid` while
+retaining authentication cookies and the CSRF token. This prevents package
+writes from running in the lock context and failing with PAK/058 or an invalid
+lock handle. See [HTTP context isolation](./STATEFUL_SESSION_GUIDE.md#http-context-isolation-931).
 
 ```typescript
 import { AdtOnPremConnector, BasicAuthProvider, OnPremHttpTransport, getTimeout } from '@mcp-abap-adt/connection';
@@ -267,10 +271,10 @@ const connection = new AdtOnPremConnector(
 );
 await connection.connect();
 
-// Enable stateful session mode (adds x-sap-adt-sessiontype: stateful header)
+// Enable the stateful HTTP context (session header and context cookie)
 connection.setSessionType('stateful');
 
-// Now all requests share the same session (cookies, CSRF token)
+// Following requests use the stateful context until the mode is changed
 await connection.makeAdtRequest({ method: 'GET', url: '/sap/bc/adt/discovery' , timeout: getTimeout('default') });
 
 // Check session mode
@@ -972,7 +976,7 @@ See [examples/](../examples/) for complete working examples:
 ## Best Practices
 
 1. **State the three axes**: the connector says which system, the provider says which credential, the transport says which wire. Nothing is detected, and a connection that had to guess would guess wrong on the case that matters
-2. **Enable Stateful Mode**: Use `setSessionType('stateful')` for multi-request operations (locks, transactions)
+2. **Enable Stateful Mode**: Use `setSessionType('stateful')` for LOCK / UNLOCK and stateless mode for intervening GET / PUT
 3. **Token Refresh**: For cloud systems, use `@mcp-abap-adt/auth-broker` for token refresh functionality
 4. **Session State Persistence**: Use `@mcp-abap-adt/auth-broker` for session state persistence
 5. **Handle Errors Gracefully**: Wrap requests in try-catch blocks and check `failure.response` for HTTP errors

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/connection",
-  "version": "9.3.0",
+  "version": "9.3.3",
   "description": "ABAP connection layer for MCP ABAP ADT server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -63,7 +63,7 @@
     "open": "^11.0.0"
   },
   "optionalDependencies": {
-    "@mcp-abap-adt/sap-rfc-lite": "^0.1.0"
+    "@mcp-abap-adt/sap-rfc-lite": "^0.1.0 || ^0.2.0"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",