@glion/mllp-client 0.16.0 → 0.19.0

package/dist/runtimes/workers.js

@@ -1,143 +0,0 @@
-import { i as MllpClientErrorCode, n as subscribeAbort, r as MllpClientError, t as MllpClient$1 } from "../client.js";
-import { connect } from "cloudflare:sockets";
-//#region src/runtimes/workers.ts
-/**
-* Cloudflare Workers runtime adapter for `@glion/mllp-client`.
-*
-* Re-exports the core `MllpClient` pre-wired with a `connect`
-* implementation that uses the `cloudflare:sockets` API. Application
-* code on Workers imports from this entry:
-*
-* ```ts
-* import { MllpClient } from "@glion/mllp-client/workers";
-*
-* const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
-* const ack = await client.send(rawHl7Message);
-* ```
-*
-* The `cloudflare:sockets` module is only available inside the
-* Workers (`workerd`) runtime. Importing this entry from a Node or
-* Deno build will fail at module-resolution time — that's the
-* intended behaviour, since each runtime should pick its own
-* adapter.
-*
-* @module
-*/
-/**
-* MLLP client pre-wired with the Cloudflare Workers connector.
-* API-identical to the core class — the only difference is that
-* callers do not need to supply `connect`.
-*/
-var MllpClient = class extends MllpClient$1 {
-	constructor(options) {
-		super({
-			...options,
-			connect: workersConnect
-		});
-	}
-};
-/**
-* `MllpConnect` implementation backed by Cloudflare's
-* `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that
-* mirrors the Worker socket's already-Web-Streams shape.
-*
-* TLS is on iff `params.tls` is set (the core normalises `tls: true`
-* to `tls: {}` before reaching the adapter). Workers exposes a small
-* subset of TLS options compared to Node — `ca`, `cert`, `key`,
-* `passphrase`, and `servername` cannot be supplied programmatically
-* and are rejected with `INVALID_INPUT`. `insecure: true` is also
-* rejected: on Node it means "TLS on, certificate verification off",
-* but Workers does not expose a way to disable verification, so
-* silently downgrading to plain TCP would be a security regression.
-* Callers wanting plain TCP must pass `tls: false` (the constructor
-* defaults `tls` to `true`).
-*
-* **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`
-* does not surface enough detail to distinguish a TLS handshake
-* failure from a TCP connect failure. Both surface here as
-* `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the
-* underlying error and routes handshake failures to
-* `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that
-* switches on `error.code` must accept this asymmetry, or treat
-* `CONNECTION_REFUSED` as the supertype.
-*/
-const workersConnect = async (params) => {
-	rejectUnsupportedTlsMaterial(params.tls);
-	const socket = connect({
-		hostname: params.host,
-		port: params.port
-	}, {
-		allowHalfOpen: true,
-		secureTransport: params.tls ? "on" : "off"
-	});
-	const dispose = params.signal ? subscribeAbort(params.signal, () => {
-		socket.close().catch(() => {});
-	}) : null;
-	try {
-		await socket.opened;
-	} catch (error) {
-		if (params.signal?.aborted) throw toAbortError(params.signal.reason, params.host, params.port, error);
-		const wrapped = error instanceof Error ? error : new Error(String(error));
-		throw new MllpClientError(MllpClientErrorCode.CONNECTION_REFUSED, `Could not connect to ${params.host}:${params.port}: ${wrapped.message}`, { cause: wrapped });
-	} finally {
-		dispose?.();
-	}
-	return {
-		async close() {
-			try {
-				await socket.close();
-			} catch {}
-		},
-		readable: socket.readable,
-		writable: socket.writable
-	};
-};
-/**
-* Translate an abort `reason` from the connect-phase signal into a typed
-* {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in
-* `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT
-* with the reason chained as `cause`.
-*/
-function toAbortError(reason, host, port, fallbackCause) {
-	if (reason instanceof MllpClientError) return reason;
-	let cause;
-	if (reason instanceof Error) cause = reason;
-	else if (fallbackCause instanceof Error) cause = fallbackCause;
-	return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connect to ${host}:${port} aborted`, { cause });
-}
-/**
-* Reject TLS configuration the Workers runtime cannot honour.
-* Surfacing the mismatch as `INVALID_INPUT` is more honest than
-* silently dropping the material — operators who supply a custom CA,
-* client cert, key, passphrase, or servername expect it to take
-* effect.
-*
-* `insecure: true` is rejected separately because the rationale is
-* different: Workers cannot disable certificate verification
-* independently, and silently dropping to plain TCP would downgrade an
-* explicitly TLS-typed configuration to plaintext — a runtime-dependent
-* security regression vs. the Node adapter.
-*
-* For all rejected fields the error message names the field, points to
-* the Cloudflare TCP-sockets docs, and lists the platform-side
-* mechanisms (Hyperdrive, Worker bindings, upstream TLS termination)
-* so an operator porting from Node has a concrete next step.
-*/
-function rejectUnsupportedTlsMaterial(tls) {
-	if (!tls) return;
-	const unsupported = [];
-	if (tls.ca) unsupported.push("ca");
-	if (tls.cert) unsupported.push("cert");
-	if (tls.key) unsupported.push("key");
-	if (tls.passphrase !== void 0) unsupported.push("passphrase");
-	if (tls.servername !== void 0) unsupported.push("servername");
-	if (unsupported.length > 0) {
-		const fields = unsupported.map((f) => `\`tls.${f}\``).join(", ");
-		throw new MllpClientError(MllpClientErrorCode.INVALID_INPUT, `Cloudflare Workers does not accept programmatic TLS material (${fields}). Configure TLS via the Cloudflare platform — Hyperdrive, Worker bindings, or terminate TLS upstream of the receiver. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/`);
-	}
-	if (tls.insecure === true) throw new MllpClientError(MllpClientErrorCode.INVALID_INPUT, "Cloudflare Workers does not support disabling TLS certificate verification (`tls.insecure: true`). Pass `tls: false` for plain TCP (caller takes the security trade-off explicitly), or terminate TLS upstream of the receiver via the Cloudflare platform. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/");
-}
-//#endregion
-export { MllpClient, MllpClientError, MllpClientErrorCode, workersConnect };
-
-//# sourceMappingURL=workers.js.map

package/dist/runtimes/workers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workers.js","names":["CoreMllpClient","workerSocketConnect"],"sources":["../../src/runtimes/workers.ts"],"sourcesContent":["/**\n * Cloudflare Workers runtime adapter for `@glion/mllp-client`.\n *\n * Re-exports the core `MllpClient` pre-wired with a `connect`\n * implementation that uses the `cloudflare:sockets` API. Application\n * code on Workers imports from this entry:\n *\n * ```ts\n * import { MllpClient } from \"@glion/mllp-client/workers\";\n *\n * const client = new MllpClient({ host: \"127.0.0.1\", port: 2575 });\n * const ack = await client.send(rawHl7Message);\n * ```\n *\n * The `cloudflare:sockets` module is only available inside the\n * Workers (`workerd`) runtime. Importing this entry from a Node or\n * Deno build will fail at module-resolution time — that's the\n * intended behaviour, since each runtime should pick its own\n * adapter.\n *\n * @module\n */\n\n// `cloudflare:sockets` is a runtime-provided module — its shape is\n// declared in `./cloudflare-sockets.d.ts`. See that file for why we\n// do not use `@cloudflare/workers-types` (it pollutes Web Streams\n// globals project-wide, which breaks the Node adapter's\n// `node:stream/web` types).\nimport { connect as workerSocketConnect } from \"cloudflare:sockets\";\n\nimport { MllpClient as CoreMllpClient } from \"../core/client\";\nimport type {\n  BoundMllpClientOptions,\n  MllpClientTlsOptions,\n} from \"../core/client\";\nimport type { MllpConnect, MllpDuplexStream } from \"../core/connect\";\nimport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\nimport { subscribeAbort } from \"../core/internal/subscribe-abort\";\n\n// ---------------------------------------------------------------------------\n// Public class\n// ---------------------------------------------------------------------------\n\n/**\n * MLLP client pre-wired with the Cloudflare Workers connector.\n * API-identical to the core class — the only difference is that\n * callers do not need to supply `connect`.\n */\nexport class MllpClient extends CoreMllpClient {\n  constructor(options: BoundMllpClientOptions) {\n    super({ ...options, connect: workersConnect });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport type { Acknowledgment } from \"../core/acknowledgment\";\nexport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nexport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n  SendMode,\n  SendOptions,\n} from \"../core/client\";\nexport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\n\n// ---------------------------------------------------------------------------\n// Workers connector\n// ---------------------------------------------------------------------------\n\n/**\n * `MllpConnect` implementation backed by Cloudflare's\n * `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that\n * mirrors the Worker socket's already-Web-Streams shape.\n *\n * TLS is on iff `params.tls` is set (the core normalises `tls: true`\n * to `tls: {}` before reaching the adapter). Workers exposes a small\n * subset of TLS options compared to Node — `ca`, `cert`, `key`,\n * `passphrase`, and `servername` cannot be supplied programmatically\n * and are rejected with `INVALID_INPUT`. `insecure: true` is also\n * rejected: on Node it means \"TLS on, certificate verification off\",\n * but Workers does not expose a way to disable verification, so\n * silently downgrading to plain TCP would be a security regression.\n * Callers wanting plain TCP must pass `tls: false` (the constructor\n * defaults `tls` to `true`).\n *\n * **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`\n * does not surface enough detail to distinguish a TLS handshake\n * failure from a TCP connect failure. Both surface here as\n * `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the\n * underlying error and routes handshake failures to\n * `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that\n * switches on `error.code` must accept this asymmetry, or treat\n * `CONNECTION_REFUSED` as the supertype.\n */\nexport const workersConnect: MllpConnect = async (params) => {\n  rejectUnsupportedTlsMaterial(params.tls);\n\n  const socket = workerSocketConnect(\n    { hostname: params.host, port: params.port },\n    {\n      allowHalfOpen: true,\n      secureTransport: params.tls ? \"on\" : \"off\",\n    }\n  );\n\n  // Honour the caller's abort signal — when it fires we close the\n  // pending socket so `socket.opened` rejects with the abort.\n  const dispose = params.signal\n    ? subscribeAbort(params.signal, () => {\n        // oxlint-disable-next-line promise/prefer-await-to-then\n        socket.close().catch(() => {\n          /* socket already closing — non-actionable */\n        });\n      })\n    : null;\n\n  try {\n    await socket.opened;\n  } catch (error) {\n    if (params.signal?.aborted) {\n      throw toAbortError(params.signal.reason, params.host, params.port, error);\n    }\n    const wrapped = error instanceof Error ? error : new Error(String(error));\n    throw new MllpClientError(\n      MllpClientErrorCode.CONNECTION_REFUSED,\n      `Could not connect to ${params.host}:${params.port}: ${wrapped.message}`,\n      { cause: wrapped }\n    );\n  } finally {\n    dispose?.();\n  }\n\n  return {\n    // The contract requires `close()` to resolve (never reject) and to\n    // be idempotent. workerd's `socket.close()` is genuinely async; we\n    // await it and swallow any rejection so the contract holds.\n    // Teardown errors at this point are non-actionable — the request\n    // lifecycle is already ending.\n    async close() {\n      try {\n        await socket.close();\n      } catch {\n        /* idempotent close or close-time error — non-actionable */\n      }\n    },\n    readable: socket.readable,\n    writable: socket.writable,\n  };\n};\n\n/**\n * Translate an abort `reason` from the connect-phase signal into a typed\n * {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in\n * `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT\n * with the reason chained as `cause`.\n */\nfunction toAbortError(\n  reason: unknown,\n  host: string,\n  port: number,\n  fallbackCause: unknown\n): MllpClientError {\n  if (reason instanceof MllpClientError) {\n    return reason;\n  }\n  let cause: Error | undefined;\n  if (reason instanceof Error) {\n    cause = reason;\n  } else if (fallbackCause instanceof Error) {\n    cause = fallbackCause;\n  }\n  return new MllpClientError(\n    MllpClientErrorCode.TIMEOUT,\n    `Connect to ${host}:${port} aborted`,\n    { cause }\n  );\n}\n\n/**\n * Reject TLS configuration the Workers runtime cannot honour.\n * Surfacing the mismatch as `INVALID_INPUT` is more honest than\n * silently dropping the material — operators who supply a custom CA,\n * client cert, key, passphrase, or servername expect it to take\n * effect.\n *\n * `insecure: true` is rejected separately because the rationale is\n * different: Workers cannot disable certificate verification\n * independently, and silently dropping to plain TCP would downgrade an\n * explicitly TLS-typed configuration to plaintext — a runtime-dependent\n * security regression vs. the Node adapter.\n *\n * For all rejected fields the error message names the field, points to\n * the Cloudflare TCP-sockets docs, and lists the platform-side\n * mechanisms (Hyperdrive, Worker bindings, upstream TLS termination)\n * so an operator porting from Node has a concrete next step.\n */\nfunction rejectUnsupportedTlsMaterial(\n  tls: MllpClientTlsOptions | undefined\n): void {\n  if (!tls) {\n    return;\n  }\n\n  const unsupported: string[] = [];\n  if (tls.ca) {\n    unsupported.push(\"ca\");\n  }\n  if (tls.cert) {\n    unsupported.push(\"cert\");\n  }\n  if (tls.key) {\n    unsupported.push(\"key\");\n  }\n  if (tls.passphrase !== undefined) {\n    unsupported.push(\"passphrase\");\n  }\n  if (tls.servername !== undefined) {\n    unsupported.push(\"servername\");\n  }\n\n  if (unsupported.length > 0) {\n    const fields = unsupported.map((f) => `\\`tls.${f}\\``).join(\", \");\n    throw new MllpClientError(\n      MllpClientErrorCode.INVALID_INPUT,\n      `Cloudflare Workers does not accept programmatic TLS material (${fields}). Configure TLS via the Cloudflare platform — Hyperdrive, Worker bindings, or terminate TLS upstream of the receiver. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/`\n    );\n  }\n\n  if (tls.insecure === true) {\n    throw new MllpClientError(\n      MllpClientErrorCode.INVALID_INPUT,\n      \"Cloudflare Workers does not support disabling TLS certificate verification (`tls.insecure: true`). Pass `tls: false` for plain TCP (caller takes the security trade-off explicitly), or terminate TLS upstream of the receiver via the Cloudflare platform. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/\"\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,aAAb,cAAgCA,aAAe;CAC7C,YAAY,SAAiC;AAC3C,QAAM;GAAE,GAAG;GAAS,SAAS;GAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDlD,MAAa,iBAA8B,OAAO,WAAW;AAC3D,8BAA6B,OAAO,IAAI;CAExC,MAAM,SAASC,QACb;EAAE,UAAU,OAAO;EAAM,MAAM,OAAO;EAAM,EAC5C;EACE,eAAe;EACf,iBAAiB,OAAO,MAAM,OAAO;EACtC,CACF;CAID,MAAM,UAAU,OAAO,SACnB,eAAe,OAAO,cAAc;AAElC,SAAO,OAAO,CAAC,YAAY,GAEzB;GACF,GACF;AAEJ,KAAI;AACF,QAAM,OAAO;UACN,OAAO;AACd,MAAI,OAAO,QAAQ,QACjB,OAAM,aAAa,OAAO,OAAO,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EAE3E,MAAM,UAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AACzE,QAAM,IAAI,gBACR,oBAAoB,oBACpB,wBAAwB,OAAO,KAAK,GAAG,OAAO,KAAK,IAAI,QAAQ,WAC/D,EAAE,OAAO,SAAS,CACnB;WACO;AACR,aAAW;;AAGb,QAAO;EAML,MAAM,QAAQ;AACZ,OAAI;AACF,UAAM,OAAO,OAAO;WACd;;EAIV,UAAU,OAAO;EACjB,UAAU,OAAO;EAClB;;;;;;;;AASH,SAAS,aACP,QACA,MACA,MACA,eACiB;AACjB,KAAI,kBAAkB,gBACpB,QAAO;CAET,IAAI;AACJ,KAAI,kBAAkB,MACpB,SAAQ;UACC,yBAAyB,MAClC,SAAQ;AAEV,QAAO,IAAI,gBACT,oBAAoB,SACpB,cAAc,KAAK,GAAG,KAAK,WAC3B,EAAE,OAAO,CACV;;;;;;;;;;;;;;;;;;;;AAqBH,SAAS,6BACP,KACM;AACN,KAAI,CAAC,IACH;CAGF,MAAM,cAAwB,EAAE;AAChC,KAAI,IAAI,GACN,aAAY,KAAK,KAAK;AAExB,KAAI,IAAI,KACN,aAAY,KAAK,OAAO;AAE1B,KAAI,IAAI,IACN,aAAY,KAAK,MAAM;AAEzB,KAAI,IAAI,eAAe,KAAA,EACrB,aAAY,KAAK,aAAa;AAEhC,KAAI,IAAI,eAAe,KAAA,EACrB,aAAY,KAAK,aAAa;AAGhC,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,SAAS,YAAY,KAAK,MAAM,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK;AAChE,QAAM,IAAI,gBACR,oBAAoB,eACpB,iEAAiE,OAAO,gMACzE;;AAGH,KAAI,IAAI,aAAa,KACnB,OAAM,IAAI,gBACR,oBAAoB,eACpB,sUACD"}