@glion/mllp-client 0.16.0 → 0.20.0

package/dist/node.js

@@ -1,214 +0,0 @@
-import { i as MllpClientErrorCode, n as subscribeAbort, r as MllpClientError, t as MllpClient$1 } from "./client.js";
-import { connect } from "node:net";
-import { Readable, Writable } from "node:stream";
-import { connect as connect$1 } from "node:tls";
-//#region src/runtimes/internal/node-error-mapping.ts
-/**
-* Translation layer between Node's socket error surface and
-* `MllpClientError`. Lives in `runtimes/internal/` so it is unreachable
-* via the package's `exports` map (and therefore safe to evolve without
-* a major bump) while remaining importable from the per-runtime test
-* suite.
-*
-* **Drift contract.** Node does not document `error.code` as a stable
-* enum — values come from libuv (system errors) and OpenSSL (TLS
-* verification errors), and new codes can appear when Node bumps
-* either dependency. The mapping here is curated against:
-*
-* - System errors (`ECONN*`, `ENOTFOUND`, `ETIMEDOUT`, …) —
-*   {@link https://nodejs.org/api/errors.html#common-system-errors | Node — Common System Errors}.
-* - TLS X.509 verification errors (`CERT_HAS_EXPIRED`,
-*   `DEPTH_ZERO_SELF_SIGNED_CERT`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, …) —
-*   {@link https://nodejs.org/api/tls.html#x509-certificate-error-codes | Node — X.509 Certificate Error Codes}
-*   (Node surfaces the upstream OpenSSL `X509_V_ERR_*` names).
-* - Node-specific TLS errors (`ERR_TLS_*`) —
-*   {@link https://nodejs.org/api/errors.html#nodejs-error-codes | Node — Node.js Error Codes}.
-*
-* **The list does not aim to be exhaustive.** Two fallbacks absorb
-* the long tail without leaking native errors to callers:
-*
-* 1. Any unrecognised `error.code` whose `error.message` looks TLS-flavoured
-*    ({@link looksLikeTlsHandshakeError}) routes to `TLS_HANDSHAKE_FAILED`.
-*    This catches new OpenSSL X.509 codes, `ERR_SSL_*` codes that arrive
-*    without a stable name, and bare `Error("alert handshake failure")`-style
-*    throws from Node's TLS layer.
-* 2. Anything else routes to `CONNECTION_CLOSED`. Caller still gets a typed
-*    `MllpClientError` with the original Node error chained as `cause`; the
-*    caller's `error.code` discriminator is just less specific than ideal.
-*
-* **When to expand the explicit list.** Add a `case` only when a
-* real-world report (a user issue, a CI failure, a production
-* incident) shows a code consistently misclassified by the
-* fallbacks. Don't pre-emptively enumerate from upstream changelogs —
-* the fallback layer is doing its job for unknowns.
-*
-* @module
-*/
-/**
-* Translate a Node.js socket error into the matching
-* {@link MllpClientError} so callers see one consistent error shape
-* regardless of which native code path failed.
-*
-* See the module-level JSDoc for the full drift contract.
-*/
-function mapSocketError(error, host, port) {
-	if (error instanceof MllpClientError) return error;
-	const target = `${host}:${port}`;
-	switch (error.code) {
-		case "ECONNREFUSED":
-		case "ENOTFOUND":
-		case "EHOSTUNREACH":
-		case "ENETUNREACH": return new MllpClientError(MllpClientErrorCode.CONNECTION_REFUSED, `Could not connect to ${target}: ${error.message}`, { cause: error });
-		case "ETIMEDOUT": return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connection to ${target} timed out: ${error.message}`, { cause: error });
-		case "CERT_HAS_EXPIRED":
-		case "DEPTH_ZERO_SELF_SIGNED_CERT":
-		case "ERR_TLS_CERT_ALTNAME_INVALID":
-		case "ERR_TLS_HANDSHAKE_TIMEOUT":
-		case "SELF_SIGNED_CERT_IN_CHAIN":
-		case "UNABLE_TO_GET_ISSUER_CERT":
-		case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY":
-		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE": return new MllpClientError(MllpClientErrorCode.TLS_HANDSHAKE_FAILED, `TLS handshake to ${target} failed: ${error.message}`, { cause: error });
-		default:
-			if (looksLikeTlsHandshakeError(error)) return new MllpClientError(MllpClientErrorCode.TLS_HANDSHAKE_FAILED, `TLS handshake to ${target} failed: ${error.message}`, { cause: error });
-			return new MllpClientError(MllpClientErrorCode.CONNECTION_CLOSED, `Connection error: ${error.message}`, { cause: error });
-	}
-}
-/**
-* Best-effort detector for TLS handshake errors that don't carry a
-* stable `error.code`. This is the drift-protection mechanism: when
-* Node or OpenSSL adds a new TLS error code we haven't enumerated,
-* a TLS-flavoured `error.message` keeps it routed to the typed
-* {@link MllpClientErrorCode.TLS_HANDSHAKE_FAILED} bucket rather than
-* falling through to `CONNECTION_CLOSED`.
-*
-* Triggers on: `ssl`, `tls`, `handshake`, `certificate` (case-insensitive).
-* Tested in `test/node.test.ts` so a future change here cannot
-* silently widen or narrow the routing.
-*/
-function looksLikeTlsHandshakeError(error) {
-	const msg = error.message.toLowerCase();
-	return msg.includes("ssl") || msg.includes("tls") || msg.includes("handshake") || msg.includes("certificate");
-}
-//#endregion
-//#region src/runtimes/node.ts
-/**
-* Node.js (and Bun) runtime adapter for `@glion/mllp-client`.
-*
-* Re-exports the core `MllpClient` pre-wired with a `connect`
-* implementation that uses Node's `node:net` and `node:tls` modules.
-* Application code on Node or Bun imports from this entry and never
-* has to think about transport plumbing:
-*
-* ```ts
-* import { MllpClient } from "@glion/mllp-client/node";
-*
-* const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
-* const ack = await client.send(rawHl7Message);
-* ```
-*
-* Bun ships a `node:net` shim that is API-compatible for our needs,
-* so this same adapter covers both runtimes.
-*
-* @module
-*/
-/**
-* MLLP client pre-wired with the Node/Bun connector. API-identical to
-* the core class — the only difference is that callers do not need
-* to supply `connect`.
-*/
-var MllpClient = class extends MllpClient$1 {
-	constructor(options) {
-		super({
-			...options,
-			connect: nodeConnect
-		});
-	}
-};
-/**
-* `MllpConnect` implementation backed by `node:net` (TCP) or
-* `node:tls` (TLS). Returns a {@link MllpDuplexStream} whose readable
-* and writable sides are the Web-Streams views of the underlying
-* Node socket.
-*
-* Exported alongside the class so advanced callers can compose it
-* with the core `MllpClient` directly (e.g., to wrap it with logging
-* or fault injection in tests).
-*/
-const nodeConnect = (params) => new Promise((resolve, reject) => {
-	const socket = openSocket(params);
-	const readyEvent = params.tls ? "secureConnect" : "connect";
-	const cleanupAbort = params.signal ? subscribeAbort(params.signal, () => {
-		socket.destroy();
-		reject(toAbortError(params.signal.reason, params.host, params.port));
-	}) : noop;
-	socket.once(readyEvent, () => {
-		cleanupAbort();
-		socket.setNoDelay(true);
-		resolve(toDuplex(socket));
-	});
-	socket.once("error", (error) => {
-		cleanupAbort();
-		socket.destroy();
-		reject(mapSocketError(error, params.host, params.port));
-	});
-});
-/** No-op disposer used when no abort signal was supplied. */
-function noop() {}
-/**
-* Translate an abort `reason` from the connect-phase signal into a typed
-* {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in
-* `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT.
-*/
-function toAbortError(reason, host, port) {
-	if (reason instanceof MllpClientError) return reason;
-	return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connect to ${host}:${port} aborted`, { cause: reason instanceof Error ? reason : void 0 });
-}
-/**
-* Open a raw TCP or TLS socket using Node's built-ins. Splits TLS
-* material into the shape `tls.connect()` expects and drops the
-* `insecure` flag into `rejectUnauthorized` (the only opt-out form).
-*/
-function openSocket(params) {
-	if (!params.tls) return connect({
-		host: params.host,
-		port: params.port
-	});
-	return connect$1({
-		ca: toBufferOrString(params.tls.ca),
-		cert: toBufferOrString(params.tls.cert),
-		host: params.host,
-		key: toBufferOrString(params.tls.key),
-		passphrase: params.tls.passphrase,
-		port: params.port,
-		rejectUnauthorized: params.tls.insecure !== true,
-		servername: params.tls.servername ?? params.host
-	});
-}
-/**
-* Coerce TLS material from the cross-runtime `string | Uint8Array`
-* shape into Node's expected `string | Buffer`. `Buffer.from(view)`
-* is a zero-copy wrap when the input is already a `Buffer`.
-*/
-function toBufferOrString(input) {
-	if (input === void 0) return;
-	return typeof input === "string" ? input : Buffer.from(input);
-}
-/**
-* Wrap a Node `Socket` in the {@link MllpDuplexStream} contract.
-* Bridges Node's stream model into Web Streams via `Readable.toWeb`
-* and `Writable.toWeb` (Node 18+).
-*/
-function toDuplex(socket) {
-	return {
-		close() {
-			if (!socket.destroyed) socket.destroy();
-			return Promise.resolve();
-		},
-		readable: Readable.toWeb(socket),
-		writable: Writable.toWeb(socket)
-	};
-}
-//#endregion
-export { nodeConnect as n, MllpClient as t };
-
-//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"node.js","names":["CoreMllpClient","netConnect","tlsConnect"],"sources":["../src/runtimes/internal/node-error-mapping.ts","../src/runtimes/node.ts"],"sourcesContent":["/**\n * Translation layer between Node's socket error surface and\n * `MllpClientError`. Lives in `runtimes/internal/` so it is unreachable\n * via the package's `exports` map (and therefore safe to evolve without\n * a major bump) while remaining importable from the per-runtime test\n * suite.\n *\n * **Drift contract.** Node does not document `error.code` as a stable\n * enum — values come from libuv (system errors) and OpenSSL (TLS\n * verification errors), and new codes can appear when Node bumps\n * either dependency. The mapping here is curated against:\n *\n * - System errors (`ECONN*`, `ENOTFOUND`, `ETIMEDOUT`, …) —\n *   {@link https://nodejs.org/api/errors.html#common-system-errors | Node — Common System Errors}.\n * - TLS X.509 verification errors (`CERT_HAS_EXPIRED`,\n *   `DEPTH_ZERO_SELF_SIGNED_CERT`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, …) —\n *   {@link https://nodejs.org/api/tls.html#x509-certificate-error-codes | Node — X.509 Certificate Error Codes}\n *   (Node surfaces the upstream OpenSSL `X509_V_ERR_*` names).\n * - Node-specific TLS errors (`ERR_TLS_*`) —\n *   {@link https://nodejs.org/api/errors.html#nodejs-error-codes | Node — Node.js Error Codes}.\n *\n * **The list does not aim to be exhaustive.** Two fallbacks absorb\n * the long tail without leaking native errors to callers:\n *\n * 1. Any unrecognised `error.code` whose `error.message` looks TLS-flavoured\n *    ({@link looksLikeTlsHandshakeError}) routes to `TLS_HANDSHAKE_FAILED`.\n *    This catches new OpenSSL X.509 codes, `ERR_SSL_*` codes that arrive\n *    without a stable name, and bare `Error(\"alert handshake failure\")`-style\n *    throws from Node's TLS layer.\n * 2. Anything else routes to `CONNECTION_CLOSED`. Caller still gets a typed\n *    `MllpClientError` with the original Node error chained as `cause`; the\n *    caller's `error.code` discriminator is just less specific than ideal.\n *\n * **When to expand the explicit list.** Add a `case` only when a\n * real-world report (a user issue, a CI failure, a production\n * incident) shows a code consistently misclassified by the\n * fallbacks. Don't pre-emptively enumerate from upstream changelogs —\n * the fallback layer is doing its job for unknowns.\n *\n * @module\n */\n\nimport { MllpClientError, MllpClientErrorCode } from \"../../core/errors\";\n\n/** Node socket errors carry an optional system code (e.g. `ECONNREFUSED`). */\nexport type NodeError = Error & { code?: string };\n\n/**\n * Translate a Node.js socket error into the matching\n * {@link MllpClientError} so callers see one consistent error shape\n * regardless of which native code path failed.\n *\n * See the module-level JSDoc for the full drift contract.\n */\nexport function mapSocketError(\n  error: NodeError,\n  host: string,\n  port: number\n): MllpClientError {\n  if (error instanceof MllpClientError) {\n    return error;\n  }\n  const target = `${host}:${port}`;\n  switch (error.code) {\n    case \"ECONNREFUSED\":\n    case \"ENOTFOUND\":\n    case \"EHOSTUNREACH\":\n    case \"ENETUNREACH\": {\n      return new MllpClientError(\n        MllpClientErrorCode.CONNECTION_REFUSED,\n        `Could not connect to ${target}: ${error.message}`,\n        { cause: error }\n      );\n    }\n    case \"ETIMEDOUT\": {\n      return new MllpClientError(\n        MllpClientErrorCode.TIMEOUT,\n        `Connection to ${target} timed out: ${error.message}`,\n        { cause: error }\n      );\n    }\n    case \"CERT_HAS_EXPIRED\":\n    case \"DEPTH_ZERO_SELF_SIGNED_CERT\":\n    case \"ERR_TLS_CERT_ALTNAME_INVALID\":\n    case \"ERR_TLS_HANDSHAKE_TIMEOUT\":\n    case \"SELF_SIGNED_CERT_IN_CHAIN\":\n    case \"UNABLE_TO_GET_ISSUER_CERT\":\n    case \"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\":\n    case \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\": {\n      return new MllpClientError(\n        MllpClientErrorCode.TLS_HANDSHAKE_FAILED,\n        `TLS handshake to ${target} failed: ${error.message}`,\n        { cause: error }\n      );\n    }\n    default: {\n      if (looksLikeTlsHandshakeError(error)) {\n        return new MllpClientError(\n          MllpClientErrorCode.TLS_HANDSHAKE_FAILED,\n          `TLS handshake to ${target} failed: ${error.message}`,\n          { cause: error }\n        );\n      }\n      return new MllpClientError(\n        MllpClientErrorCode.CONNECTION_CLOSED,\n        `Connection error: ${error.message}`,\n        { cause: error }\n      );\n    }\n  }\n}\n\n/**\n * Best-effort detector for TLS handshake errors that don't carry a\n * stable `error.code`. This is the drift-protection mechanism: when\n * Node or OpenSSL adds a new TLS error code we haven't enumerated,\n * a TLS-flavoured `error.message` keeps it routed to the typed\n * {@link MllpClientErrorCode.TLS_HANDSHAKE_FAILED} bucket rather than\n * falling through to `CONNECTION_CLOSED`.\n *\n * Triggers on: `ssl`, `tls`, `handshake`, `certificate` (case-insensitive).\n * Tested in `test/node.test.ts` so a future change here cannot\n * silently widen or narrow the routing.\n */\nexport function looksLikeTlsHandshakeError(error: NodeError): boolean {\n  const msg = error.message.toLowerCase();\n  return (\n    msg.includes(\"ssl\") ||\n    msg.includes(\"tls\") ||\n    msg.includes(\"handshake\") ||\n    msg.includes(\"certificate\")\n  );\n}\n","/**\n * Node.js (and Bun) runtime adapter for `@glion/mllp-client`.\n *\n * Re-exports the core `MllpClient` pre-wired with a `connect`\n * implementation that uses Node's `node:net` and `node:tls` modules.\n * Application code on Node or Bun imports from this entry and never\n * has to think about transport plumbing:\n *\n * ```ts\n * import { MllpClient } from \"@glion/mllp-client/node\";\n *\n * const client = new MllpClient({ host: \"127.0.0.1\", port: 2575 });\n * const ack = await client.send(rawHl7Message);\n * ```\n *\n * Bun ships a `node:net` shim that is API-compatible for our needs,\n * so this same adapter covers both runtimes.\n *\n * @module\n */\n\nimport { connect as netConnect } from \"node:net\";\nimport type { Socket } from \"node:net\";\nimport { Readable, Writable } from \"node:stream\";\nimport { connect as tlsConnect } from \"node:tls\";\n\nimport { MllpClient as CoreMllpClient } from \"../core/client\";\nimport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n} from \"../core/client\";\nimport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nimport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\nimport { subscribeAbort } from \"../core/internal/subscribe-abort\";\nimport type { NodeError } from \"./internal/node-error-mapping\";\nimport { mapSocketError } from \"./internal/node-error-mapping\";\n\n// ---------------------------------------------------------------------------\n// Public class\n// ---------------------------------------------------------------------------\n\n/**\n * MLLP client pre-wired with the Node/Bun connector. API-identical to\n * the core class — the only difference is that callers do not need\n * to supply `connect`.\n */\nexport class MllpClient extends CoreMllpClient {\n  constructor(options: BoundMllpClientOptions) {\n    super({ ...options, connect: nodeConnect });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport type { Acknowledgment } from \"../core/acknowledgment\";\nexport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nexport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n  SendMode,\n  SendOptions,\n} from \"../core/client\";\nexport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\n\n// ---------------------------------------------------------------------------\n// Node connector\n// ---------------------------------------------------------------------------\n\n/**\n * `MllpConnect` implementation backed by `node:net` (TCP) or\n * `node:tls` (TLS). Returns a {@link MllpDuplexStream} whose readable\n * and writable sides are the Web-Streams views of the underlying\n * Node socket.\n *\n * Exported alongside the class so advanced callers can compose it\n * with the core `MllpClient` directly (e.g., to wrap it with logging\n * or fault injection in tests).\n */\nexport const nodeConnect: MllpConnect = (params) =>\n  // oxlint-disable-next-line promise/avoid-new\n  new Promise<MllpDuplexStream>((resolve, reject) => {\n    const socket = openSocket(params);\n    const readyEvent = params.tls ? \"secureConnect\" : \"connect\";\n\n    const cleanupAbort = params.signal\n      ? subscribeAbort(params.signal, () => {\n          socket.destroy();\n          reject(toAbortError(params.signal!.reason, params.host, params.port));\n        })\n      : noop;\n\n    socket.once(readyEvent, () => {\n      cleanupAbort();\n      // Disable Nagle so small MLLP frames flush immediately.\n      socket.setNoDelay(true);\n      resolve(toDuplex(socket));\n    });\n\n    socket.once(\"error\", (error: NodeError) => {\n      cleanupAbort();\n      socket.destroy();\n      reject(mapSocketError(error, params.host, params.port));\n    });\n  });\n\n/** No-op disposer used when no abort signal was supplied. */\nfunction noop(): void {\n  /* nothing to dispose */\n}\n\n/**\n * Translate an abort `reason` from the connect-phase signal into a typed\n * {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in\n * `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT.\n */\nfunction toAbortError(\n  reason: unknown,\n  host: string,\n  port: number\n): MllpClientError {\n  if (reason instanceof MllpClientError) {\n    return reason;\n  }\n  return new MllpClientError(\n    MllpClientErrorCode.TIMEOUT,\n    `Connect to ${host}:${port} aborted`,\n    { cause: reason instanceof Error ? reason : undefined }\n  );\n}\n\n/**\n * Open a raw TCP or TLS socket using Node's built-ins. Splits TLS\n * material into the shape `tls.connect()` expects and drops the\n * `insecure` flag into `rejectUnauthorized` (the only opt-out form).\n */\nfunction openSocket(params: MllpConnectParams): Socket {\n  if (!params.tls) {\n    return netConnect({ host: params.host, port: params.port });\n  }\n  return tlsConnect({\n    ca: toBufferOrString(params.tls.ca),\n    cert: toBufferOrString(params.tls.cert),\n    host: params.host,\n    key: toBufferOrString(params.tls.key),\n    passphrase: params.tls.passphrase,\n    port: params.port,\n    // Verification is on by default; the only opt-out is the\n    // explicit `insecure: true`. Spelling the mapping out protects\n    // against future Node default changes.\n    rejectUnauthorized: params.tls.insecure !== true,\n    servername: params.tls.servername ?? params.host,\n  });\n}\n\n/**\n * Coerce TLS material from the cross-runtime `string | Uint8Array`\n * shape into Node's expected `string | Buffer`. `Buffer.from(view)`\n * is a zero-copy wrap when the input is already a `Buffer`.\n */\nfunction toBufferOrString(\n  input: string | Uint8Array | undefined\n): string | Buffer | undefined {\n  if (input === undefined) {\n    return;\n  }\n  return typeof input === \"string\" ? input : Buffer.from(input);\n}\n\n/**\n * Wrap a Node `Socket` in the {@link MllpDuplexStream} contract.\n * Bridges Node's stream model into Web Streams via `Readable.toWeb`\n * and `Writable.toWeb` (Node 18+).\n */\nfunction toDuplex(socket: Socket): MllpDuplexStream {\n  return {\n    // `socket.destroy()` is sync and non-throwing — no work to await,\n    // so we resolve immediately. The async signature is for the\n    // contract (Workers' `socket.close()` is genuinely async).\n    close() {\n      if (!socket.destroyed) {\n        socket.destroy();\n      }\n      return Promise.resolve();\n    },\n    readable: Readable.toWeb(socket) as ReadableStream<Uint8Array>,\n    writable: Writable.toWeb(socket) as WritableStream<Uint8Array>,\n  };\n}\n\n// Node socket-error translation lives in\n// `./internal/node-error-mapping` so the per-runtime test suite can\n// pin the drift-protection contract directly. See that module's\n// JSDoc for the curated list and fallback behaviour.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAgB,eACd,OACA,MACA,MACiB;AACjB,KAAI,iBAAiB,gBACnB,QAAO;CAET,MAAM,SAAS,GAAG,KAAK,GAAG;AAC1B,SAAQ,MAAM,MAAd;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,cACH,QAAO,IAAI,gBACT,oBAAoB,oBACpB,wBAAwB,OAAO,IAAI,MAAM,WACzC,EAAE,OAAO,OAAO,CACjB;EAEH,KAAK,YACH,QAAO,IAAI,gBACT,oBAAoB,SACpB,iBAAiB,OAAO,cAAc,MAAM,WAC5C,EAAE,OAAO,OAAO,CACjB;EAEH,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,kCACH,QAAO,IAAI,gBACT,oBAAoB,sBACpB,oBAAoB,OAAO,WAAW,MAAM,WAC5C,EAAE,OAAO,OAAO,CACjB;EAEH;AACE,OAAI,2BAA2B,MAAM,CACnC,QAAO,IAAI,gBACT,oBAAoB,sBACpB,oBAAoB,OAAO,WAAW,MAAM,WAC5C,EAAE,OAAO,OAAO,CACjB;AAEH,UAAO,IAAI,gBACT,oBAAoB,mBACpB,qBAAqB,MAAM,WAC3B,EAAE,OAAO,OAAO,CACjB;;;;;;;;;;;;;;;AAiBP,SAAgB,2BAA2B,OAA2B;CACpE,MAAM,MAAM,MAAM,QAAQ,aAAa;AACvC,QACE,IAAI,SAAS,MAAM,IACnB,IAAI,SAAS,MAAM,IACnB,IAAI,SAAS,YAAY,IACzB,IAAI,SAAS,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/E/B,IAAa,aAAb,cAAgCA,aAAe;CAC7C,YAAY,SAAiC;AAC3C,QAAM;GAAE,GAAG;GAAS,SAAS;GAAa,CAAC;;;;;;;;;;;;;AAqC/C,MAAa,eAA4B,WAEvC,IAAI,SAA2B,SAAS,WAAW;CACjD,MAAM,SAAS,WAAW,OAAO;CACjC,MAAM,aAAa,OAAO,MAAM,kBAAkB;CAElD,MAAM,eAAe,OAAO,SACxB,eAAe,OAAO,cAAc;AAClC,SAAO,SAAS;AAChB,SAAO,aAAa,OAAO,OAAQ,QAAQ,OAAO,MAAM,OAAO,KAAK,CAAC;GACrE,GACF;AAEJ,QAAO,KAAK,kBAAkB;AAC5B,gBAAc;AAEd,SAAO,WAAW,KAAK;AACvB,UAAQ,SAAS,OAAO,CAAC;GACzB;AAEF,QAAO,KAAK,UAAU,UAAqB;AACzC,gBAAc;AACd,SAAO,SAAS;AAChB,SAAO,eAAe,OAAO,OAAO,MAAM,OAAO,KAAK,CAAC;GACvD;EACF;;AAGJ,SAAS,OAAa;;;;;;AAStB,SAAS,aACP,QACA,MACA,MACiB;AACjB,KAAI,kBAAkB,gBACpB,QAAO;AAET,QAAO,IAAI,gBACT,oBAAoB,SACpB,cAAc,KAAK,GAAG,KAAK,WAC3B,EAAE,OAAO,kBAAkB,QAAQ,SAAS,KAAA,GAAW,CACxD;;;;;;;AAQH,SAAS,WAAW,QAAmC;AACrD,KAAI,CAAC,OAAO,IACV,QAAOC,QAAW;EAAE,MAAM,OAAO;EAAM,MAAM,OAAO;EAAM,CAAC;AAE7D,QAAOC,UAAW;EAChB,IAAI,iBAAiB,OAAO,IAAI,GAAG;EACnC,MAAM,iBAAiB,OAAO,IAAI,KAAK;EACvC,MAAM,OAAO;EACb,KAAK,iBAAiB,OAAO,IAAI,IAAI;EACrC,YAAY,OAAO,IAAI;EACvB,MAAM,OAAO;EAIb,oBAAoB,OAAO,IAAI,aAAa;EAC5C,YAAY,OAAO,IAAI,cAAc,OAAO;EAC7C,CAAC;;;;;;;AAQJ,SAAS,iBACP,OAC6B;AAC7B,KAAI,UAAU,KAAA,EACZ;AAEF,QAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,MAAM;;;;;;;AAQ/D,SAAS,SAAS,QAAkC;AAClD,QAAO;EAIL,QAAQ;AACN,OAAI,CAAC,OAAO,UACV,QAAO,SAAS;AAElB,UAAO,QAAQ,SAAS;;EAE1B,UAAU,SAAS,MAAM,OAAO;EAChC,UAAU,SAAS,MAAM,OAAO;EACjC"}

package/dist/runtimes/internal/node-error-mapping.d.ts

@@ -1,68 +0,0 @@
-/**
- * Translation layer between Node's socket error surface and
- * `MllpClientError`. Lives in `runtimes/internal/` so it is unreachable
- * via the package's `exports` map (and therefore safe to evolve without
- * a major bump) while remaining importable from the per-runtime test
- * suite.
- *
- * **Drift contract.** Node does not document `error.code` as a stable
- * enum — values come from libuv (system errors) and OpenSSL (TLS
- * verification errors), and new codes can appear when Node bumps
- * either dependency. The mapping here is curated against:
- *
- * - System errors (`ECONN*`, `ENOTFOUND`, `ETIMEDOUT`, …) —
- *   {@link https://nodejs.org/api/errors.html#common-system-errors | Node — Common System Errors}.
- * - TLS X.509 verification errors (`CERT_HAS_EXPIRED`,
- *   `DEPTH_ZERO_SELF_SIGNED_CERT`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, …) —
- *   {@link https://nodejs.org/api/tls.html#x509-certificate-error-codes | Node — X.509 Certificate Error Codes}
- *   (Node surfaces the upstream OpenSSL `X509_V_ERR_*` names).
- * - Node-specific TLS errors (`ERR_TLS_*`) —
- *   {@link https://nodejs.org/api/errors.html#nodejs-error-codes | Node — Node.js Error Codes}.
- *
- * **The list does not aim to be exhaustive.** Two fallbacks absorb
- * the long tail without leaking native errors to callers:
- *
- * 1. Any unrecognised `error.code` whose `error.message` looks TLS-flavoured
- *    ({@link looksLikeTlsHandshakeError}) routes to `TLS_HANDSHAKE_FAILED`.
- *    This catches new OpenSSL X.509 codes, `ERR_SSL_*` codes that arrive
- *    without a stable name, and bare `Error("alert handshake failure")`-style
- *    throws from Node's TLS layer.
- * 2. Anything else routes to `CONNECTION_CLOSED`. Caller still gets a typed
- *    `MllpClientError` with the original Node error chained as `cause`; the
- *    caller's `error.code` discriminator is just less specific than ideal.
- *
- * **When to expand the explicit list.** Add a `case` only when a
- * real-world report (a user issue, a CI failure, a production
- * incident) shows a code consistently misclassified by the
- * fallbacks. Don't pre-emptively enumerate from upstream changelogs —
- * the fallback layer is doing its job for unknowns.
- *
- * @module
- */
-import { MllpClientError } from "../../core/errors";
-/** Node socket errors carry an optional system code (e.g. `ECONNREFUSED`). */
-export type NodeError = Error & {
-    code?: string;
-};
-/**
- * Translate a Node.js socket error into the matching
- * {@link MllpClientError} so callers see one consistent error shape
- * regardless of which native code path failed.
- *
- * See the module-level JSDoc for the full drift contract.
- */
-export declare function mapSocketError(error: NodeError, host: string, port: number): MllpClientError;
-/**
- * Best-effort detector for TLS handshake errors that don't carry a
- * stable `error.code`. This is the drift-protection mechanism: when
- * Node or OpenSSL adds a new TLS error code we haven't enumerated,
- * a TLS-flavoured `error.message` keeps it routed to the typed
- * {@link MllpClientErrorCode.TLS_HANDSHAKE_FAILED} bucket rather than
- * falling through to `CONNECTION_CLOSED`.
- *
- * Triggers on: `ssl`, `tls`, `handshake`, `certificate` (case-insensitive).
- * Tested in `test/node.test.ts` so a future change here cannot
- * silently widen or narrow the routing.
- */
-export declare function looksLikeTlsHandshakeError(error: NodeError): boolean;
-//# sourceMappingURL=node-error-mapping.d.ts.map

package/dist/runtimes/internal/node-error-mapping.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"node-error-mapping.d.ts","sourceRoot":"","sources":["../../../src/runtimes/internal/node-error-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,eAAe,EAAuB,MAAM,mBAAmB,CAAC;AAEzE,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,eAAe,CAoDjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAQpE"}

package/dist/runtimes/node.d.ts

@@ -1,47 +0,0 @@
-/**
- * Node.js (and Bun) runtime adapter for `@glion/mllp-client`.
- *
- * Re-exports the core `MllpClient` pre-wired with a `connect`
- * implementation that uses Node's `node:net` and `node:tls` modules.
- * Application code on Node or Bun imports from this entry and never
- * has to think about transport plumbing:
- *
- * ```ts
- * import { MllpClient } from "@glion/mllp-client/node";
- *
- * const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
- * const ack = await client.send(rawHl7Message);
- * ```
- *
- * Bun ships a `node:net` shim that is API-compatible for our needs,
- * so this same adapter covers both runtimes.
- *
- * @module
- */
-import { MllpClient as CoreMllpClient } from "../core/client";
-import type { BoundMllpClientOptions } from "../core/client";
-import type { MllpConnect } from "../core/connect";
-/**
- * MLLP client pre-wired with the Node/Bun connector. API-identical to
- * the core class — the only difference is that callers do not need
- * to supply `connect`.
- */
-export declare class MllpClient extends CoreMllpClient {
-    constructor(options: BoundMllpClientOptions);
-}
-export type { Acknowledgment } from "../core/acknowledgment";
-export type { MllpConnect, MllpConnectParams, MllpDuplexStream, } from "../core/connect";
-export type { BoundMllpClientOptions, MllpClientOptions, MllpClientTlsOptions, SendMode, SendOptions, } from "../core/client";
-export { MllpClientError, MllpClientErrorCode } from "../core/errors";
-/**
- * `MllpConnect` implementation backed by `node:net` (TCP) or
- * `node:tls` (TLS). Returns a {@link MllpDuplexStream} whose readable
- * and writable sides are the Web-Streams views of the underlying
- * Node socket.
- *
- * Exported alongside the class so advanced callers can compose it
- * with the core `MllpClient` directly (e.g., to wrap it with logging
- * or fault injection in tests).
- */
-export declare const nodeConnect: MllpConnect;
-//# sourceMappingURL=node.d.ts.map

package/dist/runtimes/node.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/runtimes/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EACV,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AAUzB;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,cAAc;gBAChC,OAAO,EAAE,sBAAsB;CAG5C;AAMD,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAMtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,EAAE,WAyBtB,CAAC"}

package/dist/runtimes/node.js

@@ -1,3 +0,0 @@
-import { i as MllpClientErrorCode, r as MllpClientError } from "../client.js";
-import { n as nodeConnect, t as MllpClient } from "../node.js";
-export { MllpClient, MllpClientError, MllpClientErrorCode, nodeConnect };

package/dist/runtimes/workers.d.ts

@@ -1,64 +0,0 @@
-/**
- * Cloudflare Workers runtime adapter for `@glion/mllp-client`.
- *
- * Re-exports the core `MllpClient` pre-wired with a `connect`
- * implementation that uses the `cloudflare:sockets` API. Application
- * code on Workers imports from this entry:
- *
- * ```ts
- * import { MllpClient } from "@glion/mllp-client/workers";
- *
- * const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
- * const ack = await client.send(rawHl7Message);
- * ```
- *
- * The `cloudflare:sockets` module is only available inside the
- * Workers (`workerd`) runtime. Importing this entry from a Node or
- * Deno build will fail at module-resolution time — that's the
- * intended behaviour, since each runtime should pick its own
- * adapter.
- *
- * @module
- */
-import { MllpClient as CoreMllpClient } from "../core/client";
-import type { BoundMllpClientOptions } from "../core/client";
-import type { MllpConnect } from "../core/connect";
-/**
- * MLLP client pre-wired with the Cloudflare Workers connector.
- * API-identical to the core class — the only difference is that
- * callers do not need to supply `connect`.
- */
-export declare class MllpClient extends CoreMllpClient {
-    constructor(options: BoundMllpClientOptions);
-}
-export type { Acknowledgment } from "../core/acknowledgment";
-export type { MllpConnect, MllpConnectParams, MllpDuplexStream, } from "../core/connect";
-export type { BoundMllpClientOptions, MllpClientOptions, MllpClientTlsOptions, SendMode, SendOptions, } from "../core/client";
-export { MllpClientError, MllpClientErrorCode } from "../core/errors";
-/**
- * `MllpConnect` implementation backed by Cloudflare's
- * `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that
- * mirrors the Worker socket's already-Web-Streams shape.
- *
- * TLS is on iff `params.tls` is set (the core normalises `tls: true`
- * to `tls: {}` before reaching the adapter). Workers exposes a small
- * subset of TLS options compared to Node — `ca`, `cert`, `key`,
- * `passphrase`, and `servername` cannot be supplied programmatically
- * and are rejected with `INVALID_INPUT`. `insecure: true` is also
- * rejected: on Node it means "TLS on, certificate verification off",
- * but Workers does not expose a way to disable verification, so
- * silently downgrading to plain TCP would be a security regression.
- * Callers wanting plain TCP must pass `tls: false` (the constructor
- * defaults `tls` to `true`).
- *
- * **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`
- * does not surface enough detail to distinguish a TLS handshake
- * failure from a TCP connect failure. Both surface here as
- * `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the
- * underlying error and routes handshake failures to
- * `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that
- * switches on `error.code` must accept this asymmetry, or treat
- * `CONNECTION_REFUSED` as the supertype.
- */
-export declare const workersConnect: MllpConnect;
-//# sourceMappingURL=workers.d.ts.map

package/dist/runtimes/workers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../../src/runtimes/workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,iBAAiB,CAAC;AAQrE;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,cAAc;gBAChC,OAAO,EAAE,sBAAsB;CAG5C;AAMD,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAMtE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,cAAc,EAAE,WAsD5B,CAAC"}

package/dist/runtimes/workers.js

@@ -1,143 +0,0 @@
-import { i as MllpClientErrorCode, n as subscribeAbort, r as MllpClientError, t as MllpClient$1 } from "../client.js";
-import { connect } from "cloudflare:sockets";
-//#region src/runtimes/workers.ts
-/**
-* Cloudflare Workers runtime adapter for `@glion/mllp-client`.
-*
-* Re-exports the core `MllpClient` pre-wired with a `connect`
-* implementation that uses the `cloudflare:sockets` API. Application
-* code on Workers imports from this entry:
-*
-* ```ts
-* import { MllpClient } from "@glion/mllp-client/workers";
-*
-* const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
-* const ack = await client.send(rawHl7Message);
-* ```
-*
-* The `cloudflare:sockets` module is only available inside the
-* Workers (`workerd`) runtime. Importing this entry from a Node or
-* Deno build will fail at module-resolution time — that's the
-* intended behaviour, since each runtime should pick its own
-* adapter.
-*
-* @module
-*/
-/**
-* MLLP client pre-wired with the Cloudflare Workers connector.
-* API-identical to the core class — the only difference is that
-* callers do not need to supply `connect`.
-*/
-var MllpClient = class extends MllpClient$1 {
-	constructor(options) {
-		super({
-			...options,
-			connect: workersConnect
-		});
-	}
-};
-/**
-* `MllpConnect` implementation backed by Cloudflare's
-* `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that
-* mirrors the Worker socket's already-Web-Streams shape.
-*
-* TLS is on iff `params.tls` is set (the core normalises `tls: true`
-* to `tls: {}` before reaching the adapter). Workers exposes a small
-* subset of TLS options compared to Node — `ca`, `cert`, `key`,
-* `passphrase`, and `servername` cannot be supplied programmatically
-* and are rejected with `INVALID_INPUT`. `insecure: true` is also
-* rejected: on Node it means "TLS on, certificate verification off",
-* but Workers does not expose a way to disable verification, so
-* silently downgrading to plain TCP would be a security regression.
-* Callers wanting plain TCP must pass `tls: false` (the constructor
-* defaults `tls` to `true`).
-*
-* **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`
-* does not surface enough detail to distinguish a TLS handshake
-* failure from a TCP connect failure. Both surface here as
-* `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the
-* underlying error and routes handshake failures to
-* `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that
-* switches on `error.code` must accept this asymmetry, or treat
-* `CONNECTION_REFUSED` as the supertype.
-*/
-const workersConnect = async (params) => {
-	rejectUnsupportedTlsMaterial(params.tls);
-	const socket = connect({
-		hostname: params.host,
-		port: params.port
-	}, {
-		allowHalfOpen: true,
-		secureTransport: params.tls ? "on" : "off"
-	});
-	const dispose = params.signal ? subscribeAbort(params.signal, () => {
-		socket.close().catch(() => {});
-	}) : null;
-	try {
-		await socket.opened;
-	} catch (error) {
-		if (params.signal?.aborted) throw toAbortError(params.signal.reason, params.host, params.port, error);
-		const wrapped = error instanceof Error ? error : new Error(String(error));
-		throw new MllpClientError(MllpClientErrorCode.CONNECTION_REFUSED, `Could not connect to ${params.host}:${params.port}: ${wrapped.message}`, { cause: wrapped });
-	} finally {
-		dispose?.();
-	}
-	return {
-		async close() {
-			try {
-				await socket.close();
-			} catch {}
-		},
-		readable: socket.readable,
-		writable: socket.writable
-	};
-};
-/**
-* Translate an abort `reason` from the connect-phase signal into a typed
-* {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in
-* `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT
-* with the reason chained as `cause`.
-*/
-function toAbortError(reason, host, port, fallbackCause) {
-	if (reason instanceof MllpClientError) return reason;
-	let cause;
-	if (reason instanceof Error) cause = reason;
-	else if (fallbackCause instanceof Error) cause = fallbackCause;
-	return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connect to ${host}:${port} aborted`, { cause });
-}
-/**
-* Reject TLS configuration the Workers runtime cannot honour.
-* Surfacing the mismatch as `INVALID_INPUT` is more honest than
-* silently dropping the material — operators who supply a custom CA,
-* client cert, key, passphrase, or servername expect it to take
-* effect.
-*
-* `insecure: true` is rejected separately because the rationale is
-* different: Workers cannot disable certificate verification
-* independently, and silently dropping to plain TCP would downgrade an
-* explicitly TLS-typed configuration to plaintext — a runtime-dependent
-* security regression vs. the Node adapter.
-*
-* For all rejected fields the error message names the field, points to
-* the Cloudflare TCP-sockets docs, and lists the platform-side
-* mechanisms (Hyperdrive, Worker bindings, upstream TLS termination)
-* so an operator porting from Node has a concrete next step.
-*/
-function rejectUnsupportedTlsMaterial(tls) {
-	if (!tls) return;
-	const unsupported = [];
-	if (tls.ca) unsupported.push("ca");
-	if (tls.cert) unsupported.push("cert");
-	if (tls.key) unsupported.push("key");
-	if (tls.passphrase !== void 0) unsupported.push("passphrase");
-	if (tls.servername !== void 0) unsupported.push("servername");
-	if (unsupported.length > 0) {
-		const fields = unsupported.map((f) => `\`tls.${f}\``).join(", ");
-		throw new MllpClientError(MllpClientErrorCode.INVALID_INPUT, `Cloudflare Workers does not accept programmatic TLS material (${fields}). Configure TLS via the Cloudflare platform — Hyperdrive, Worker bindings, or terminate TLS upstream of the receiver. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/`);
-	}
-	if (tls.insecure === true) throw new MllpClientError(MllpClientErrorCode.INVALID_INPUT, "Cloudflare Workers does not support disabling TLS certificate verification (`tls.insecure: true`). Pass `tls: false` for plain TCP (caller takes the security trade-off explicitly), or terminate TLS upstream of the receiver via the Cloudflare platform. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/");
-}
-//#endregion
-export { MllpClient, MllpClientError, MllpClientErrorCode, workersConnect };
-
-//# sourceMappingURL=workers.js.map

package/dist/runtimes/workers.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"workers.js","names":["CoreMllpClient","workerSocketConnect"],"sources":["../../src/runtimes/workers.ts"],"sourcesContent":["/**\n * Cloudflare Workers runtime adapter for `@glion/mllp-client`.\n *\n * Re-exports the core `MllpClient` pre-wired with a `connect`\n * implementation that uses the `cloudflare:sockets` API. Application\n * code on Workers imports from this entry:\n *\n * ```ts\n * import { MllpClient } from \"@glion/mllp-client/workers\";\n *\n * const client = new MllpClient({ host: \"127.0.0.1\", port: 2575 });\n * const ack = await client.send(rawHl7Message);\n * ```\n *\n * The `cloudflare:sockets` module is only available inside the\n * Workers (`workerd`) runtime. Importing this entry from a Node or\n * Deno build will fail at module-resolution time — that's the\n * intended behaviour, since each runtime should pick its own\n * adapter.\n *\n * @module\n */\n\n// `cloudflare:sockets` is a runtime-provided module — its shape is\n// declared in `./cloudflare-sockets.d.ts`. See that file for why we\n// do not use `@cloudflare/workers-types` (it pollutes Web Streams\n// globals project-wide, which breaks the Node adapter's\n// `node:stream/web` types).\nimport { connect as workerSocketConnect } from \"cloudflare:sockets\";\n\nimport { MllpClient as CoreMllpClient } from \"../core/client\";\nimport type {\n  BoundMllpClientOptions,\n  MllpClientTlsOptions,\n} from \"../core/client\";\nimport type { MllpConnect, MllpDuplexStream } from \"../core/connect\";\nimport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\nimport { subscribeAbort } from \"../core/internal/subscribe-abort\";\n\n// ---------------------------------------------------------------------------\n// Public class\n// ---------------------------------------------------------------------------\n\n/**\n * MLLP client pre-wired with the Cloudflare Workers connector.\n * API-identical to the core class — the only difference is that\n * callers do not need to supply `connect`.\n */\nexport class MllpClient extends CoreMllpClient {\n  constructor(options: BoundMllpClientOptions) {\n    super({ ...options, connect: workersConnect });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport type { Acknowledgment } from \"../core/acknowledgment\";\nexport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nexport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n  SendMode,\n  SendOptions,\n} from \"../core/client\";\nexport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\n\n// ---------------------------------------------------------------------------\n// Workers connector\n// ---------------------------------------------------------------------------\n\n/**\n * `MllpConnect` implementation backed by Cloudflare's\n * `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that\n * mirrors the Worker socket's already-Web-Streams shape.\n *\n * TLS is on iff `params.tls` is set (the core normalises `tls: true`\n * to `tls: {}` before reaching the adapter). Workers exposes a small\n * subset of TLS options compared to Node — `ca`, `cert`, `key`,\n * `passphrase`, and `servername` cannot be supplied programmatically\n * and are rejected with `INVALID_INPUT`. `insecure: true` is also\n * rejected: on Node it means \"TLS on, certificate verification off\",\n * but Workers does not expose a way to disable verification, so\n * silently downgrading to plain TCP would be a security regression.\n * Callers wanting plain TCP must pass `tls: false` (the constructor\n * defaults `tls` to `true`).\n *\n * **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`\n * does not surface enough detail to distinguish a TLS handshake\n * failure from a TCP connect failure. Both surface here as\n * `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the\n * underlying error and routes handshake failures to\n * `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that\n * switches on `error.code` must accept this asymmetry, or treat\n * `CONNECTION_REFUSED` as the supertype.\n */\nexport const workersConnect: MllpConnect = async (params) => {\n  rejectUnsupportedTlsMaterial(params.tls);\n\n  const socket = workerSocketConnect(\n    { hostname: params.host, port: params.port },\n    {\n      allowHalfOpen: true,\n      secureTransport: params.tls ? \"on\" : \"off\",\n    }\n  );\n\n  // Honour the caller's abort signal — when it fires we close the\n  // pending socket so `socket.opened` rejects with the abort.\n  const dispose = params.signal\n    ? subscribeAbort(params.signal, () => {\n        // oxlint-disable-next-line promise/prefer-await-to-then\n        socket.close().catch(() => {\n          /* socket already closing — non-actionable */\n        });\n      })\n    : null;\n\n  try {\n    await socket.opened;\n  } catch (error) {\n    if (params.signal?.aborted) {\n      throw toAbortError(params.signal.reason, params.host, params.port, error);\n    }\n    const wrapped = error instanceof Error ? error : new Error(String(error));\n    throw new MllpClientError(\n      MllpClientErrorCode.CONNECTION_REFUSED,\n      `Could not connect to ${params.host}:${params.port}: ${wrapped.message}`,\n      { cause: wrapped }\n    );\n  } finally {\n    dispose?.();\n  }\n\n  return {\n    // The contract requires `close()` to resolve (never reject) and to\n    // be idempotent. workerd's `socket.close()` is genuinely async; we\n    // await it and swallow any rejection so the contract holds.\n    // Teardown errors at this point are non-actionable — the request\n    // lifecycle is already ending.\n    async close() {\n      try {\n        await socket.close();\n      } catch {\n        /* idempotent close or close-time error — non-actionable */\n      }\n    },\n    readable: socket.readable,\n    writable: socket.writable,\n  };\n};\n\n/**\n * Translate an abort `reason` from the connect-phase signal into a typed\n * {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in\n * `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT\n * with the reason chained as `cause`.\n */\nfunction toAbortError(\n  reason: unknown,\n  host: string,\n  port: number,\n  fallbackCause: unknown\n): MllpClientError {\n  if (reason instanceof MllpClientError) {\n    return reason;\n  }\n  let cause: Error | undefined;\n  if (reason instanceof Error) {\n    cause = reason;\n  } else if (fallbackCause instanceof Error) {\n    cause = fallbackCause;\n  }\n  return new MllpClientError(\n    MllpClientErrorCode.TIMEOUT,\n    `Connect to ${host}:${port} aborted`,\n    { cause }\n  );\n}\n\n/**\n * Reject TLS configuration the Workers runtime cannot honour.\n * Surfacing the mismatch as `INVALID_INPUT` is more honest than\n * silently dropping the material — operators who supply a custom CA,\n * client cert, key, passphrase, or servername expect it to take\n * effect.\n *\n * `insecure: true` is rejected separately because the rationale is\n * different: Workers cannot disable certificate verification\n * independently, and silently dropping to plain TCP would downgrade an\n * explicitly TLS-typed configuration to plaintext — a runtime-dependent\n * security regression vs. the Node adapter.\n *\n * For all rejected fields the error message names the field, points to\n * the Cloudflare TCP-sockets docs, and lists the platform-side\n * mechanisms (Hyperdrive, Worker bindings, upstream TLS termination)\n * so an operator porting from Node has a concrete next step.\n */\nfunction rejectUnsupportedTlsMaterial(\n  tls: MllpClientTlsOptions | undefined\n): void {\n  if (!tls) {\n    return;\n  }\n\n  const unsupported: string[] = [];\n  if (tls.ca) {\n    unsupported.push(\"ca\");\n  }\n  if (tls.cert) {\n    unsupported.push(\"cert\");\n  }\n  if (tls.key) {\n    unsupported.push(\"key\");\n  }\n  if (tls.passphrase !== undefined) {\n    unsupported.push(\"passphrase\");\n  }\n  if (tls.servername !== undefined) {\n    unsupported.push(\"servername\");\n  }\n\n  if (unsupported.length > 0) {\n    const fields = unsupported.map((f) => `\\`tls.${f}\\``).join(\", \");\n    throw new MllpClientError(\n      MllpClientErrorCode.INVALID_INPUT,\n      `Cloudflare Workers does not accept programmatic TLS material (${fields}). Configure TLS via the Cloudflare platform — Hyperdrive, Worker bindings, or terminate TLS upstream of the receiver. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/`\n    );\n  }\n\n  if (tls.insecure === true) {\n    throw new MllpClientError(\n      MllpClientErrorCode.INVALID_INPUT,\n      \"Cloudflare Workers does not support disabling TLS certificate verification (`tls.insecure: true`). Pass `tls: false` for plain TCP (caller takes the security trade-off explicitly), or terminate TLS upstream of the receiver via the Cloudflare platform. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/\"\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,aAAb,cAAgCA,aAAe;CAC7C,YAAY,SAAiC;AAC3C,QAAM;GAAE,GAAG;GAAS,SAAS;GAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDlD,MAAa,iBAA8B,OAAO,WAAW;AAC3D,8BAA6B,OAAO,IAAI;CAExC,MAAM,SAASC,QACb;EAAE,UAAU,OAAO;EAAM,MAAM,OAAO;EAAM,EAC5C;EACE,eAAe;EACf,iBAAiB,OAAO,MAAM,OAAO;EACtC,CACF;CAID,MAAM,UAAU,OAAO,SACnB,eAAe,OAAO,cAAc;AAElC,SAAO,OAAO,CAAC,YAAY,GAEzB;GACF,GACF;AAEJ,KAAI;AACF,QAAM,OAAO;UACN,OAAO;AACd,MAAI,OAAO,QAAQ,QACjB,OAAM,aAAa,OAAO,OAAO,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EAE3E,MAAM,UAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AACzE,QAAM,IAAI,gBACR,oBAAoB,oBACpB,wBAAwB,OAAO,KAAK,GAAG,OAAO,KAAK,IAAI,QAAQ,WAC/D,EAAE,OAAO,SAAS,CACnB;WACO;AACR,aAAW;;AAGb,QAAO;EAML,MAAM,QAAQ;AACZ,OAAI;AACF,UAAM,OAAO,OAAO;WACd;;EAIV,UAAU,OAAO;EACjB,UAAU,OAAO;EAClB;;;;;;;;AASH,SAAS,aACP,QACA,MACA,MACA,eACiB;AACjB,KAAI,kBAAkB,gBACpB,QAAO;CAET,IAAI;AACJ,KAAI,kBAAkB,MACpB,SAAQ;UACC,yBAAyB,MAClC,SAAQ;AAEV,QAAO,IAAI,gBACT,oBAAoB,SACpB,cAAc,KAAK,GAAG,KAAK,WAC3B,EAAE,OAAO,CACV;;;;;;;;;;;;;;;;;;;;AAqBH,SAAS,6BACP,KACM;AACN,KAAI,CAAC,IACH;CAGF,MAAM,cAAwB,EAAE;AAChC,KAAI,IAAI,GACN,aAAY,KAAK,KAAK;AAExB,KAAI,IAAI,KACN,aAAY,KAAK,OAAO;AAE1B,KAAI,IAAI,IACN,aAAY,KAAK,MAAM;AAEzB,KAAI,IAAI,eAAe,KAAA,EACrB,aAAY,KAAK,aAAa;AAEhC,KAAI,IAAI,eAAe,KAAA,EACrB,aAAY,KAAK,aAAa;AAGhC,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,SAAS,YAAY,KAAK,MAAM,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK;AAChE,QAAM,IAAI,gBACR,oBAAoB,eACpB,iEAAiE,OAAO,gMACzE;;AAGH,KAAI,IAAI,aAAa,KACnB,OAAM,IAAI,gBACR,oBAAoB,eACpB,sUACD"}