@glion/mllp-client 0.16.0

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Default entry point of `@glion/mllp-client`.
+ *
+ * `import { MllpClient } from "@glion/mllp-client"` resolves here on
+ * Node and Bun. This module is a thin re-export of
+ * `@glion/mllp-client/node` so the common case stays a single
+ * import line.
+ *
+ * For other runtimes:
+ *
+ * - Deno: `@glion/mllp-client/deno`
+ * - Cloudflare Workers: `@glion/mllp-client/workers`
+ * - Custom transport / browser via a bridge: `@glion/mllp-client/core`
+ *
+ * Bundlers that honour the `workerd` and `deno` keys in this
+ * package's `exports` map will automatically pick the right entry
+ * for the target runtime — the per-runtime subpaths are also
+ * available as explicit imports for clarity.
+ *
+ * @module
+ */
+export type { Acknowledgment } from "./core/acknowledgment";
+export type { MllpConnect, MllpConnectParams, MllpDuplexStream, } from "./core/connect";
+export { MllpClientError, MllpClientErrorCode } from "./core/errors";
+export { MllpClient, nodeConnect } from "./runtimes/node";
+export type { BoundMllpClientOptions, MllpClientOptions, MllpClientTlsOptions, SendMode, SendOptions, } from "./runtimes/node";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,YAAY,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC1D,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,iBAAiB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+import { i as MllpClientErrorCode, r as MllpClientError } from "./client.js";
+import { n as nodeConnect, t as MllpClient } from "./node.js";
+export { MllpClient, MllpClientError, MllpClientErrorCode, nodeConnect };

package/dist/node.js

@@ -0,0 +1,214 @@
+import { i as MllpClientErrorCode, n as subscribeAbort, r as MllpClientError, t as MllpClient$1 } from "./client.js";
+import { connect } from "node:net";
+import { Readable, Writable } from "node:stream";
+import { connect as connect$1 } from "node:tls";
+//#region src/runtimes/internal/node-error-mapping.ts
+/**
+* Translation layer between Node's socket error surface and
+* `MllpClientError`. Lives in `runtimes/internal/` so it is unreachable
+* via the package's `exports` map (and therefore safe to evolve without
+* a major bump) while remaining importable from the per-runtime test
+* suite.
+*
+* **Drift contract.** Node does not document `error.code` as a stable
+* enum — values come from libuv (system errors) and OpenSSL (TLS
+* verification errors), and new codes can appear when Node bumps
+* either dependency. The mapping here is curated against:
+*
+* - System errors (`ECONN*`, `ENOTFOUND`, `ETIMEDOUT`, …) —
+*   {@link https://nodejs.org/api/errors.html#common-system-errors | Node — Common System Errors}.
+* - TLS X.509 verification errors (`CERT_HAS_EXPIRED`,
+*   `DEPTH_ZERO_SELF_SIGNED_CERT`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, …) —
+*   {@link https://nodejs.org/api/tls.html#x509-certificate-error-codes | Node — X.509 Certificate Error Codes}
+*   (Node surfaces the upstream OpenSSL `X509_V_ERR_*` names).
+* - Node-specific TLS errors (`ERR_TLS_*`) —
+*   {@link https://nodejs.org/api/errors.html#nodejs-error-codes | Node — Node.js Error Codes}.
+*
+* **The list does not aim to be exhaustive.** Two fallbacks absorb
+* the long tail without leaking native errors to callers:
+*
+* 1. Any unrecognised `error.code` whose `error.message` looks TLS-flavoured
+*    ({@link looksLikeTlsHandshakeError}) routes to `TLS_HANDSHAKE_FAILED`.
+*    This catches new OpenSSL X.509 codes, `ERR_SSL_*` codes that arrive
+*    without a stable name, and bare `Error("alert handshake failure")`-style
+*    throws from Node's TLS layer.
+* 2. Anything else routes to `CONNECTION_CLOSED`. Caller still gets a typed
+*    `MllpClientError` with the original Node error chained as `cause`; the
+*    caller's `error.code` discriminator is just less specific than ideal.
+*
+* **When to expand the explicit list.** Add a `case` only when a
+* real-world report (a user issue, a CI failure, a production
+* incident) shows a code consistently misclassified by the
+* fallbacks. Don't pre-emptively enumerate from upstream changelogs —
+* the fallback layer is doing its job for unknowns.
+*
+* @module
+*/
+/**
+* Translate a Node.js socket error into the matching
+* {@link MllpClientError} so callers see one consistent error shape
+* regardless of which native code path failed.
+*
+* See the module-level JSDoc for the full drift contract.
+*/
+function mapSocketError(error, host, port) {
+	if (error instanceof MllpClientError) return error;
+	const target = `${host}:${port}`;
+	switch (error.code) {
+		case "ECONNREFUSED":
+		case "ENOTFOUND":
+		case "EHOSTUNREACH":
+		case "ENETUNREACH": return new MllpClientError(MllpClientErrorCode.CONNECTION_REFUSED, `Could not connect to ${target}: ${error.message}`, { cause: error });
+		case "ETIMEDOUT": return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connection to ${target} timed out: ${error.message}`, { cause: error });
+		case "CERT_HAS_EXPIRED":
+		case "DEPTH_ZERO_SELF_SIGNED_CERT":
+		case "ERR_TLS_CERT_ALTNAME_INVALID":
+		case "ERR_TLS_HANDSHAKE_TIMEOUT":
+		case "SELF_SIGNED_CERT_IN_CHAIN":
+		case "UNABLE_TO_GET_ISSUER_CERT":
+		case "UNABLE_TO_GET_ISSUER_CERT_LOCALLY":
+		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE": return new MllpClientError(MllpClientErrorCode.TLS_HANDSHAKE_FAILED, `TLS handshake to ${target} failed: ${error.message}`, { cause: error });
+		default:
+			if (looksLikeTlsHandshakeError(error)) return new MllpClientError(MllpClientErrorCode.TLS_HANDSHAKE_FAILED, `TLS handshake to ${target} failed: ${error.message}`, { cause: error });
+			return new MllpClientError(MllpClientErrorCode.CONNECTION_CLOSED, `Connection error: ${error.message}`, { cause: error });
+	}
+}
+/**
+* Best-effort detector for TLS handshake errors that don't carry a
+* stable `error.code`. This is the drift-protection mechanism: when
+* Node or OpenSSL adds a new TLS error code we haven't enumerated,
+* a TLS-flavoured `error.message` keeps it routed to the typed
+* {@link MllpClientErrorCode.TLS_HANDSHAKE_FAILED} bucket rather than
+* falling through to `CONNECTION_CLOSED`.
+*
+* Triggers on: `ssl`, `tls`, `handshake`, `certificate` (case-insensitive).
+* Tested in `test/node.test.ts` so a future change here cannot
+* silently widen or narrow the routing.
+*/
+function looksLikeTlsHandshakeError(error) {
+	const msg = error.message.toLowerCase();
+	return msg.includes("ssl") || msg.includes("tls") || msg.includes("handshake") || msg.includes("certificate");
+}
+//#endregion
+//#region src/runtimes/node.ts
+/**
+* Node.js (and Bun) runtime adapter for `@glion/mllp-client`.
+*
+* Re-exports the core `MllpClient` pre-wired with a `connect`
+* implementation that uses Node's `node:net` and `node:tls` modules.
+* Application code on Node or Bun imports from this entry and never
+* has to think about transport plumbing:
+*
+* ```ts
+* import { MllpClient } from "@glion/mllp-client/node";
+*
+* const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
+* const ack = await client.send(rawHl7Message);
+* ```
+*
+* Bun ships a `node:net` shim that is API-compatible for our needs,
+* so this same adapter covers both runtimes.
+*
+* @module
+*/
+/**
+* MLLP client pre-wired with the Node/Bun connector. API-identical to
+* the core class — the only difference is that callers do not need
+* to supply `connect`.
+*/
+var MllpClient = class extends MllpClient$1 {
+	constructor(options) {
+		super({
+			...options,
+			connect: nodeConnect
+		});
+	}
+};
+/**
+* `MllpConnect` implementation backed by `node:net` (TCP) or
+* `node:tls` (TLS). Returns a {@link MllpDuplexStream} whose readable
+* and writable sides are the Web-Streams views of the underlying
+* Node socket.
+*
+* Exported alongside the class so advanced callers can compose it
+* with the core `MllpClient` directly (e.g., to wrap it with logging
+* or fault injection in tests).
+*/
+const nodeConnect = (params) => new Promise((resolve, reject) => {
+	const socket = openSocket(params);
+	const readyEvent = params.tls ? "secureConnect" : "connect";
+	const cleanupAbort = params.signal ? subscribeAbort(params.signal, () => {
+		socket.destroy();
+		reject(toAbortError(params.signal.reason, params.host, params.port));
+	}) : noop;
+	socket.once(readyEvent, () => {
+		cleanupAbort();
+		socket.setNoDelay(true);
+		resolve(toDuplex(socket));
+	});
+	socket.once("error", (error) => {
+		cleanupAbort();
+		socket.destroy();
+		reject(mapSocketError(error, params.host, params.port));
+	});
+});
+/** No-op disposer used when no abort signal was supplied. */
+function noop() {}
+/**
+* Translate an abort `reason` from the connect-phase signal into a typed
+* {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in
+* `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT.
+*/
+function toAbortError(reason, host, port) {
+	if (reason instanceof MllpClientError) return reason;
+	return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connect to ${host}:${port} aborted`, { cause: reason instanceof Error ? reason : void 0 });
+}
+/**
+* Open a raw TCP or TLS socket using Node's built-ins. Splits TLS
+* material into the shape `tls.connect()` expects and drops the
+* `insecure` flag into `rejectUnauthorized` (the only opt-out form).
+*/
+function openSocket(params) {
+	if (!params.tls) return connect({
+		host: params.host,
+		port: params.port
+	});
+	return connect$1({
+		ca: toBufferOrString(params.tls.ca),
+		cert: toBufferOrString(params.tls.cert),
+		host: params.host,
+		key: toBufferOrString(params.tls.key),
+		passphrase: params.tls.passphrase,
+		port: params.port,
+		rejectUnauthorized: params.tls.insecure !== true,
+		servername: params.tls.servername ?? params.host
+	});
+}
+/**
+* Coerce TLS material from the cross-runtime `string | Uint8Array`
+* shape into Node's expected `string | Buffer`. `Buffer.from(view)`
+* is a zero-copy wrap when the input is already a `Buffer`.
+*/
+function toBufferOrString(input) {
+	if (input === void 0) return;
+	return typeof input === "string" ? input : Buffer.from(input);
+}
+/**
+* Wrap a Node `Socket` in the {@link MllpDuplexStream} contract.
+* Bridges Node's stream model into Web Streams via `Readable.toWeb`
+* and `Writable.toWeb` (Node 18+).
+*/
+function toDuplex(socket) {
+	return {
+		close() {
+			if (!socket.destroyed) socket.destroy();
+			return Promise.resolve();
+		},
+		readable: Readable.toWeb(socket),
+		writable: Writable.toWeb(socket)
+	};
+}
+//#endregion
+export { nodeConnect as n, MllpClient as t };
+
+//# sourceMappingURL=node.js.map

package/dist/node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.js","names":["CoreMllpClient","netConnect","tlsConnect"],"sources":["../src/runtimes/internal/node-error-mapping.ts","../src/runtimes/node.ts"],"sourcesContent":["/**\n * Translation layer between Node's socket error surface and\n * `MllpClientError`. Lives in `runtimes/internal/` so it is unreachable\n * via the package's `exports` map (and therefore safe to evolve without\n * a major bump) while remaining importable from the per-runtime test\n * suite.\n *\n * **Drift contract.** Node does not document `error.code` as a stable\n * enum — values come from libuv (system errors) and OpenSSL (TLS\n * verification errors), and new codes can appear when Node bumps\n * either dependency. The mapping here is curated against:\n *\n * - System errors (`ECONN*`, `ENOTFOUND`, `ETIMEDOUT`, …) —\n *   {@link https://nodejs.org/api/errors.html#common-system-errors | Node — Common System Errors}.\n * - TLS X.509 verification errors (`CERT_HAS_EXPIRED`,\n *   `DEPTH_ZERO_SELF_SIGNED_CERT`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, …) —\n *   {@link https://nodejs.org/api/tls.html#x509-certificate-error-codes | Node — X.509 Certificate Error Codes}\n *   (Node surfaces the upstream OpenSSL `X509_V_ERR_*` names).\n * - Node-specific TLS errors (`ERR_TLS_*`) —\n *   {@link https://nodejs.org/api/errors.html#nodejs-error-codes | Node — Node.js Error Codes}.\n *\n * **The list does not aim to be exhaustive.** Two fallbacks absorb\n * the long tail without leaking native errors to callers:\n *\n * 1. Any unrecognised `error.code` whose `error.message` looks TLS-flavoured\n *    ({@link looksLikeTlsHandshakeError}) routes to `TLS_HANDSHAKE_FAILED`.\n *    This catches new OpenSSL X.509 codes, `ERR_SSL_*` codes that arrive\n *    without a stable name, and bare `Error(\"alert handshake failure\")`-style\n *    throws from Node's TLS layer.\n * 2. Anything else routes to `CONNECTION_CLOSED`. Caller still gets a typed\n *    `MllpClientError` with the original Node error chained as `cause`; the\n *    caller's `error.code` discriminator is just less specific than ideal.\n *\n * **When to expand the explicit list.** Add a `case` only when a\n * real-world report (a user issue, a CI failure, a production\n * incident) shows a code consistently misclassified by the\n * fallbacks. Don't pre-emptively enumerate from upstream changelogs —\n * the fallback layer is doing its job for unknowns.\n *\n * @module\n */\n\nimport { MllpClientError, MllpClientErrorCode } from \"../../core/errors\";\n\n/** Node socket errors carry an optional system code (e.g. `ECONNREFUSED`). */\nexport type NodeError = Error & { code?: string };\n\n/**\n * Translate a Node.js socket error into the matching\n * {@link MllpClientError} so callers see one consistent error shape\n * regardless of which native code path failed.\n *\n * See the module-level JSDoc for the full drift contract.\n */\nexport function mapSocketError(\n  error: NodeError,\n  host: string,\n  port: number\n): MllpClientError {\n  if (error instanceof MllpClientError) {\n    return error;\n  }\n  const target = `${host}:${port}`;\n  switch (error.code) {\n    case \"ECONNREFUSED\":\n    case \"ENOTFOUND\":\n    case \"EHOSTUNREACH\":\n    case \"ENETUNREACH\": {\n      return new MllpClientError(\n        MllpClientErrorCode.CONNECTION_REFUSED,\n        `Could not connect to ${target}: ${error.message}`,\n        { cause: error }\n      );\n    }\n    case \"ETIMEDOUT\": {\n      return new MllpClientError(\n        MllpClientErrorCode.TIMEOUT,\n        `Connection to ${target} timed out: ${error.message}`,\n        { cause: error }\n      );\n    }\n    case \"CERT_HAS_EXPIRED\":\n    case \"DEPTH_ZERO_SELF_SIGNED_CERT\":\n    case \"ERR_TLS_CERT_ALTNAME_INVALID\":\n    case \"ERR_TLS_HANDSHAKE_TIMEOUT\":\n    case \"SELF_SIGNED_CERT_IN_CHAIN\":\n    case \"UNABLE_TO_GET_ISSUER_CERT\":\n    case \"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\":\n    case \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\": {\n      return new MllpClientError(\n        MllpClientErrorCode.TLS_HANDSHAKE_FAILED,\n        `TLS handshake to ${target} failed: ${error.message}`,\n        { cause: error }\n      );\n    }\n    default: {\n      if (looksLikeTlsHandshakeError(error)) {\n        return new MllpClientError(\n          MllpClientErrorCode.TLS_HANDSHAKE_FAILED,\n          `TLS handshake to ${target} failed: ${error.message}`,\n          { cause: error }\n        );\n      }\n      return new MllpClientError(\n        MllpClientErrorCode.CONNECTION_CLOSED,\n        `Connection error: ${error.message}`,\n        { cause: error }\n      );\n    }\n  }\n}\n\n/**\n * Best-effort detector for TLS handshake errors that don't carry a\n * stable `error.code`. This is the drift-protection mechanism: when\n * Node or OpenSSL adds a new TLS error code we haven't enumerated,\n * a TLS-flavoured `error.message` keeps it routed to the typed\n * {@link MllpClientErrorCode.TLS_HANDSHAKE_FAILED} bucket rather than\n * falling through to `CONNECTION_CLOSED`.\n *\n * Triggers on: `ssl`, `tls`, `handshake`, `certificate` (case-insensitive).\n * Tested in `test/node.test.ts` so a future change here cannot\n * silently widen or narrow the routing.\n */\nexport function looksLikeTlsHandshakeError(error: NodeError): boolean {\n  const msg = error.message.toLowerCase();\n  return (\n    msg.includes(\"ssl\") ||\n    msg.includes(\"tls\") ||\n    msg.includes(\"handshake\") ||\n    msg.includes(\"certificate\")\n  );\n}\n","/**\n * Node.js (and Bun) runtime adapter for `@glion/mllp-client`.\n *\n * Re-exports the core `MllpClient` pre-wired with a `connect`\n * implementation that uses Node's `node:net` and `node:tls` modules.\n * Application code on Node or Bun imports from this entry and never\n * has to think about transport plumbing:\n *\n * ```ts\n * import { MllpClient } from \"@glion/mllp-client/node\";\n *\n * const client = new MllpClient({ host: \"127.0.0.1\", port: 2575 });\n * const ack = await client.send(rawHl7Message);\n * ```\n *\n * Bun ships a `node:net` shim that is API-compatible for our needs,\n * so this same adapter covers both runtimes.\n *\n * @module\n */\n\nimport { connect as netConnect } from \"node:net\";\nimport type { Socket } from \"node:net\";\nimport { Readable, Writable } from \"node:stream\";\nimport { connect as tlsConnect } from \"node:tls\";\n\nimport { MllpClient as CoreMllpClient } from \"../core/client\";\nimport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n} from \"../core/client\";\nimport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nimport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\nimport { subscribeAbort } from \"../core/internal/subscribe-abort\";\nimport type { NodeError } from \"./internal/node-error-mapping\";\nimport { mapSocketError } from \"./internal/node-error-mapping\";\n\n// ---------------------------------------------------------------------------\n// Public class\n// ---------------------------------------------------------------------------\n\n/**\n * MLLP client pre-wired with the Node/Bun connector. API-identical to\n * the core class — the only difference is that callers do not need\n * to supply `connect`.\n */\nexport class MllpClient extends CoreMllpClient {\n  constructor(options: BoundMllpClientOptions) {\n    super({ ...options, connect: nodeConnect });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport type { Acknowledgment } from \"../core/acknowledgment\";\nexport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nexport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n  SendMode,\n  SendOptions,\n} from \"../core/client\";\nexport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\n\n// ---------------------------------------------------------------------------\n// Node connector\n// ---------------------------------------------------------------------------\n\n/**\n * `MllpConnect` implementation backed by `node:net` (TCP) or\n * `node:tls` (TLS). Returns a {@link MllpDuplexStream} whose readable\n * and writable sides are the Web-Streams views of the underlying\n * Node socket.\n *\n * Exported alongside the class so advanced callers can compose it\n * with the core `MllpClient` directly (e.g., to wrap it with logging\n * or fault injection in tests).\n */\nexport const nodeConnect: MllpConnect = (params) =>\n  // oxlint-disable-next-line promise/avoid-new\n  new Promise<MllpDuplexStream>((resolve, reject) => {\n    const socket = openSocket(params);\n    const readyEvent = params.tls ? \"secureConnect\" : \"connect\";\n\n    const cleanupAbort = params.signal\n      ? subscribeAbort(params.signal, () => {\n          socket.destroy();\n          reject(toAbortError(params.signal!.reason, params.host, params.port));\n        })\n      : noop;\n\n    socket.once(readyEvent, () => {\n      cleanupAbort();\n      // Disable Nagle so small MLLP frames flush immediately.\n      socket.setNoDelay(true);\n      resolve(toDuplex(socket));\n    });\n\n    socket.once(\"error\", (error: NodeError) => {\n      cleanupAbort();\n      socket.destroy();\n      reject(mapSocketError(error, params.host, params.port));\n    });\n  });\n\n/** No-op disposer used when no abort signal was supplied. */\nfunction noop(): void {\n  /* nothing to dispose */\n}\n\n/**\n * Translate an abort `reason` from the connect-phase signal into a typed\n * {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in\n * `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT.\n */\nfunction toAbortError(\n  reason: unknown,\n  host: string,\n  port: number\n): MllpClientError {\n  if (reason instanceof MllpClientError) {\n    return reason;\n  }\n  return new MllpClientError(\n    MllpClientErrorCode.TIMEOUT,\n    `Connect to ${host}:${port} aborted`,\n    { cause: reason instanceof Error ? reason : undefined }\n  );\n}\n\n/**\n * Open a raw TCP or TLS socket using Node's built-ins. Splits TLS\n * material into the shape `tls.connect()` expects and drops the\n * `insecure` flag into `rejectUnauthorized` (the only opt-out form).\n */\nfunction openSocket(params: MllpConnectParams): Socket {\n  if (!params.tls) {\n    return netConnect({ host: params.host, port: params.port });\n  }\n  return tlsConnect({\n    ca: toBufferOrString(params.tls.ca),\n    cert: toBufferOrString(params.tls.cert),\n    host: params.host,\n    key: toBufferOrString(params.tls.key),\n    passphrase: params.tls.passphrase,\n    port: params.port,\n    // Verification is on by default; the only opt-out is the\n    // explicit `insecure: true`. Spelling the mapping out protects\n    // against future Node default changes.\n    rejectUnauthorized: params.tls.insecure !== true,\n    servername: params.tls.servername ?? params.host,\n  });\n}\n\n/**\n * Coerce TLS material from the cross-runtime `string | Uint8Array`\n * shape into Node's expected `string | Buffer`. `Buffer.from(view)`\n * is a zero-copy wrap when the input is already a `Buffer`.\n */\nfunction toBufferOrString(\n  input: string | Uint8Array | undefined\n): string | Buffer | undefined {\n  if (input === undefined) {\n    return;\n  }\n  return typeof input === \"string\" ? input : Buffer.from(input);\n}\n\n/**\n * Wrap a Node `Socket` in the {@link MllpDuplexStream} contract.\n * Bridges Node's stream model into Web Streams via `Readable.toWeb`\n * and `Writable.toWeb` (Node 18+).\n */\nfunction toDuplex(socket: Socket): MllpDuplexStream {\n  return {\n    // `socket.destroy()` is sync and non-throwing — no work to await,\n    // so we resolve immediately. The async signature is for the\n    // contract (Workers' `socket.close()` is genuinely async).\n    close() {\n      if (!socket.destroyed) {\n        socket.destroy();\n      }\n      return Promise.resolve();\n    },\n    readable: Readable.toWeb(socket) as ReadableStream<Uint8Array>,\n    writable: Writable.toWeb(socket) as WritableStream<Uint8Array>,\n  };\n}\n\n// Node socket-error translation lives in\n// `./internal/node-error-mapping` so the per-runtime test suite can\n// pin the drift-protection contract directly. See that module's\n// JSDoc for the curated list and fallback behaviour.\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,SAAgB,eACd,OACA,MACA,MACiB;AACjB,KAAI,iBAAiB,gBACnB,QAAO;CAET,MAAM,SAAS,GAAG,KAAK,GAAG;AAC1B,SAAQ,MAAM,MAAd;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,cACH,QAAO,IAAI,gBACT,oBAAoB,oBACpB,wBAAwB,OAAO,IAAI,MAAM,WACzC,EAAE,OAAO,OAAO,CACjB;EAEH,KAAK,YACH,QAAO,IAAI,gBACT,oBAAoB,SACpB,iBAAiB,OAAO,cAAc,MAAM,WAC5C,EAAE,OAAO,OAAO,CACjB;EAEH,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,kCACH,QAAO,IAAI,gBACT,oBAAoB,sBACpB,oBAAoB,OAAO,WAAW,MAAM,WAC5C,EAAE,OAAO,OAAO,CACjB;EAEH;AACE,OAAI,2BAA2B,MAAM,CACnC,QAAO,IAAI,gBACT,oBAAoB,sBACpB,oBAAoB,OAAO,WAAW,MAAM,WAC5C,EAAE,OAAO,OAAO,CACjB;AAEH,UAAO,IAAI,gBACT,oBAAoB,mBACpB,qBAAqB,MAAM,WAC3B,EAAE,OAAO,OAAO,CACjB;;;;;;;;;;;;;;;AAiBP,SAAgB,2BAA2B,OAA2B;CACpE,MAAM,MAAM,MAAM,QAAQ,aAAa;AACvC,QACE,IAAI,SAAS,MAAM,IACnB,IAAI,SAAS,MAAM,IACnB,IAAI,SAAS,YAAY,IACzB,IAAI,SAAS,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/E/B,IAAa,aAAb,cAAgCA,aAAe;CAC7C,YAAY,SAAiC;AAC3C,QAAM;GAAE,GAAG;GAAS,SAAS;GAAa,CAAC;;;;;;;;;;;;;AAqC/C,MAAa,eAA4B,WAEvC,IAAI,SAA2B,SAAS,WAAW;CACjD,MAAM,SAAS,WAAW,OAAO;CACjC,MAAM,aAAa,OAAO,MAAM,kBAAkB;CAElD,MAAM,eAAe,OAAO,SACxB,eAAe,OAAO,cAAc;AAClC,SAAO,SAAS;AAChB,SAAO,aAAa,OAAO,OAAQ,QAAQ,OAAO,MAAM,OAAO,KAAK,CAAC;GACrE,GACF;AAEJ,QAAO,KAAK,kBAAkB;AAC5B,gBAAc;AAEd,SAAO,WAAW,KAAK;AACvB,UAAQ,SAAS,OAAO,CAAC;GACzB;AAEF,QAAO,KAAK,UAAU,UAAqB;AACzC,gBAAc;AACd,SAAO,SAAS;AAChB,SAAO,eAAe,OAAO,OAAO,MAAM,OAAO,KAAK,CAAC;GACvD;EACF;;AAGJ,SAAS,OAAa;;;;;;AAStB,SAAS,aACP,QACA,MACA,MACiB;AACjB,KAAI,kBAAkB,gBACpB,QAAO;AAET,QAAO,IAAI,gBACT,oBAAoB,SACpB,cAAc,KAAK,GAAG,KAAK,WAC3B,EAAE,OAAO,kBAAkB,QAAQ,SAAS,KAAA,GAAW,CACxD;;;;;;;AAQH,SAAS,WAAW,QAAmC;AACrD,KAAI,CAAC,OAAO,IACV,QAAOC,QAAW;EAAE,MAAM,OAAO;EAAM,MAAM,OAAO;EAAM,CAAC;AAE7D,QAAOC,UAAW;EAChB,IAAI,iBAAiB,OAAO,IAAI,GAAG;EACnC,MAAM,iBAAiB,OAAO,IAAI,KAAK;EACvC,MAAM,OAAO;EACb,KAAK,iBAAiB,OAAO,IAAI,IAAI;EACrC,YAAY,OAAO,IAAI;EACvB,MAAM,OAAO;EAIb,oBAAoB,OAAO,IAAI,aAAa;EAC5C,YAAY,OAAO,IAAI,cAAc,OAAO;EAC7C,CAAC;;;;;;;AAQJ,SAAS,iBACP,OAC6B;AAC7B,KAAI,UAAU,KAAA,EACZ;AAEF,QAAO,OAAO,UAAU,WAAW,QAAQ,OAAO,KAAK,MAAM;;;;;;;AAQ/D,SAAS,SAAS,QAAkC;AAClD,QAAO;EAIL,QAAQ;AACN,OAAI,CAAC,OAAO,UACV,QAAO,SAAS;AAElB,UAAO,QAAQ,SAAS;;EAE1B,UAAU,SAAS,MAAM,OAAO;EAChC,UAAU,SAAS,MAAM,OAAO;EACjC"}

package/dist/runtimes/internal/node-error-mapping.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Translation layer between Node's socket error surface and
+ * `MllpClientError`. Lives in `runtimes/internal/` so it is unreachable
+ * via the package's `exports` map (and therefore safe to evolve without
+ * a major bump) while remaining importable from the per-runtime test
+ * suite.
+ *
+ * **Drift contract.** Node does not document `error.code` as a stable
+ * enum — values come from libuv (system errors) and OpenSSL (TLS
+ * verification errors), and new codes can appear when Node bumps
+ * either dependency. The mapping here is curated against:
+ *
+ * - System errors (`ECONN*`, `ENOTFOUND`, `ETIMEDOUT`, …) —
+ *   {@link https://nodejs.org/api/errors.html#common-system-errors | Node — Common System Errors}.
+ * - TLS X.509 verification errors (`CERT_HAS_EXPIRED`,
+ *   `DEPTH_ZERO_SELF_SIGNED_CERT`, `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, …) —
+ *   {@link https://nodejs.org/api/tls.html#x509-certificate-error-codes | Node — X.509 Certificate Error Codes}
+ *   (Node surfaces the upstream OpenSSL `X509_V_ERR_*` names).
+ * - Node-specific TLS errors (`ERR_TLS_*`) —
+ *   {@link https://nodejs.org/api/errors.html#nodejs-error-codes | Node — Node.js Error Codes}.
+ *
+ * **The list does not aim to be exhaustive.** Two fallbacks absorb
+ * the long tail without leaking native errors to callers:
+ *
+ * 1. Any unrecognised `error.code` whose `error.message` looks TLS-flavoured
+ *    ({@link looksLikeTlsHandshakeError}) routes to `TLS_HANDSHAKE_FAILED`.
+ *    This catches new OpenSSL X.509 codes, `ERR_SSL_*` codes that arrive
+ *    without a stable name, and bare `Error("alert handshake failure")`-style
+ *    throws from Node's TLS layer.
+ * 2. Anything else routes to `CONNECTION_CLOSED`. Caller still gets a typed
+ *    `MllpClientError` with the original Node error chained as `cause`; the
+ *    caller's `error.code` discriminator is just less specific than ideal.
+ *
+ * **When to expand the explicit list.** Add a `case` only when a
+ * real-world report (a user issue, a CI failure, a production
+ * incident) shows a code consistently misclassified by the
+ * fallbacks. Don't pre-emptively enumerate from upstream changelogs —
+ * the fallback layer is doing its job for unknowns.
+ *
+ * @module
+ */
+import { MllpClientError } from "../../core/errors";
+/** Node socket errors carry an optional system code (e.g. `ECONNREFUSED`). */
+export type NodeError = Error & {
+    code?: string;
+};
+/**
+ * Translate a Node.js socket error into the matching
+ * {@link MllpClientError} so callers see one consistent error shape
+ * regardless of which native code path failed.
+ *
+ * See the module-level JSDoc for the full drift contract.
+ */
+export declare function mapSocketError(error: NodeError, host: string, port: number): MllpClientError;
+/**
+ * Best-effort detector for TLS handshake errors that don't carry a
+ * stable `error.code`. This is the drift-protection mechanism: when
+ * Node or OpenSSL adds a new TLS error code we haven't enumerated,
+ * a TLS-flavoured `error.message` keeps it routed to the typed
+ * {@link MllpClientErrorCode.TLS_HANDSHAKE_FAILED} bucket rather than
+ * falling through to `CONNECTION_CLOSED`.
+ *
+ * Triggers on: `ssl`, `tls`, `handshake`, `certificate` (case-insensitive).
+ * Tested in `test/node.test.ts` so a future change here cannot
+ * silently widen or narrow the routing.
+ */
+export declare function looksLikeTlsHandshakeError(error: NodeError): boolean;
+//# sourceMappingURL=node-error-mapping.d.ts.map

package/dist/runtimes/internal/node-error-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-error-mapping.d.ts","sourceRoot":"","sources":["../../../src/runtimes/internal/node-error-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,eAAe,EAAuB,MAAM,mBAAmB,CAAC;AAEzE,8EAA8E;AAC9E,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAElD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX,eAAe,CAoDjB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAQpE"}

package/dist/runtimes/node.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Node.js (and Bun) runtime adapter for `@glion/mllp-client`.
+ *
+ * Re-exports the core `MllpClient` pre-wired with a `connect`
+ * implementation that uses Node's `node:net` and `node:tls` modules.
+ * Application code on Node or Bun imports from this entry and never
+ * has to think about transport plumbing:
+ *
+ * ```ts
+ * import { MllpClient } from "@glion/mllp-client/node";
+ *
+ * const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
+ * const ack = await client.send(rawHl7Message);
+ * ```
+ *
+ * Bun ships a `node:net` shim that is API-compatible for our needs,
+ * so this same adapter covers both runtimes.
+ *
+ * @module
+ */
+import { MllpClient as CoreMllpClient } from "../core/client";
+import type { BoundMllpClientOptions } from "../core/client";
+import type { MllpConnect } from "../core/connect";
+/**
+ * MLLP client pre-wired with the Node/Bun connector. API-identical to
+ * the core class — the only difference is that callers do not need
+ * to supply `connect`.
+ */
+export declare class MllpClient extends CoreMllpClient {
+    constructor(options: BoundMllpClientOptions);
+}
+export type { Acknowledgment } from "../core/acknowledgment";
+export type { MllpConnect, MllpConnectParams, MllpDuplexStream, } from "../core/connect";
+export type { BoundMllpClientOptions, MllpClientOptions, MllpClientTlsOptions, SendMode, SendOptions, } from "../core/client";
+export { MllpClientError, MllpClientErrorCode } from "../core/errors";
+/**
+ * `MllpConnect` implementation backed by `node:net` (TCP) or
+ * `node:tls` (TLS). Returns a {@link MllpDuplexStream} whose readable
+ * and writable sides are the Web-Streams views of the underlying
+ * Node socket.
+ *
+ * Exported alongside the class so advanced callers can compose it
+ * with the core `MllpClient` directly (e.g., to wrap it with logging
+ * or fault injection in tests).
+ */
+export declare const nodeConnect: MllpConnect;
+//# sourceMappingURL=node.d.ts.map

package/dist/runtimes/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/runtimes/node.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EACV,sBAAsB,EAGvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACV,WAAW,EAGZ,MAAM,iBAAiB,CAAC;AAUzB;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,cAAc;gBAChC,OAAO,EAAE,sBAAsB;CAG5C;AAMD,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAMtE;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,EAAE,WAyBtB,CAAC"}

package/dist/runtimes/node.js

@@ -0,0 +1,3 @@
+import { i as MllpClientErrorCode, r as MllpClientError } from "../client.js";
+import { n as nodeConnect, t as MllpClient } from "../node.js";
+export { MllpClient, MllpClientError, MllpClientErrorCode, nodeConnect };

package/dist/runtimes/workers.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Cloudflare Workers runtime adapter for `@glion/mllp-client`.
+ *
+ * Re-exports the core `MllpClient` pre-wired with a `connect`
+ * implementation that uses the `cloudflare:sockets` API. Application
+ * code on Workers imports from this entry:
+ *
+ * ```ts
+ * import { MllpClient } from "@glion/mllp-client/workers";
+ *
+ * const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
+ * const ack = await client.send(rawHl7Message);
+ * ```
+ *
+ * The `cloudflare:sockets` module is only available inside the
+ * Workers (`workerd`) runtime. Importing this entry from a Node or
+ * Deno build will fail at module-resolution time — that's the
+ * intended behaviour, since each runtime should pick its own
+ * adapter.
+ *
+ * @module
+ */
+import { MllpClient as CoreMllpClient } from "../core/client";
+import type { BoundMllpClientOptions } from "../core/client";
+import type { MllpConnect } from "../core/connect";
+/**
+ * MLLP client pre-wired with the Cloudflare Workers connector.
+ * API-identical to the core class — the only difference is that
+ * callers do not need to supply `connect`.
+ */
+export declare class MllpClient extends CoreMllpClient {
+    constructor(options: BoundMllpClientOptions);
+}
+export type { Acknowledgment } from "../core/acknowledgment";
+export type { MllpConnect, MllpConnectParams, MllpDuplexStream, } from "../core/connect";
+export type { BoundMllpClientOptions, MllpClientOptions, MllpClientTlsOptions, SendMode, SendOptions, } from "../core/client";
+export { MllpClientError, MllpClientErrorCode } from "../core/errors";
+/**
+ * `MllpConnect` implementation backed by Cloudflare's
+ * `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that
+ * mirrors the Worker socket's already-Web-Streams shape.
+ *
+ * TLS is on iff `params.tls` is set (the core normalises `tls: true`
+ * to `tls: {}` before reaching the adapter). Workers exposes a small
+ * subset of TLS options compared to Node — `ca`, `cert`, `key`,
+ * `passphrase`, and `servername` cannot be supplied programmatically
+ * and are rejected with `INVALID_INPUT`. `insecure: true` is also
+ * rejected: on Node it means "TLS on, certificate verification off",
+ * but Workers does not expose a way to disable verification, so
+ * silently downgrading to plain TCP would be a security regression.
+ * Callers wanting plain TCP must pass `tls: false` (the constructor
+ * defaults `tls` to `true`).
+ *
+ * **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`
+ * does not surface enough detail to distinguish a TLS handshake
+ * failure from a TCP connect failure. Both surface here as
+ * `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the
+ * underlying error and routes handshake failures to
+ * `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that
+ * switches on `error.code` must accept this asymmetry, or treat
+ * `CONNECTION_REFUSED` as the supertype.
+ */
+export declare const workersConnect: MllpConnect;
+//# sourceMappingURL=workers.d.ts.map

package/dist/runtimes/workers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers.d.ts","sourceRoot":"","sources":["../../src/runtimes/workers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EACV,sBAAsB,EAEvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,iBAAiB,CAAC;AAQrE;;;;GAIG;AACH,qBAAa,UAAW,SAAQ,cAAc;gBAChC,OAAO,EAAE,sBAAsB;CAG5C;AAMD,YAAY,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAC7D,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,WAAW,GACZ,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAMtE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,cAAc,EAAE,WAsD5B,CAAC"}

package/dist/runtimes/workers.js

@@ -0,0 +1,143 @@
+import { i as MllpClientErrorCode, n as subscribeAbort, r as MllpClientError, t as MllpClient$1 } from "../client.js";
+import { connect } from "cloudflare:sockets";
+//#region src/runtimes/workers.ts
+/**
+* Cloudflare Workers runtime adapter for `@glion/mllp-client`.
+*
+* Re-exports the core `MllpClient` pre-wired with a `connect`
+* implementation that uses the `cloudflare:sockets` API. Application
+* code on Workers imports from this entry:
+*
+* ```ts
+* import { MllpClient } from "@glion/mllp-client/workers";
+*
+* const client = new MllpClient({ host: "127.0.0.1", port: 2575 });
+* const ack = await client.send(rawHl7Message);
+* ```
+*
+* The `cloudflare:sockets` module is only available inside the
+* Workers (`workerd`) runtime. Importing this entry from a Node or
+* Deno build will fail at module-resolution time — that's the
+* intended behaviour, since each runtime should pick its own
+* adapter.
+*
+* @module
+*/
+/**
+* MLLP client pre-wired with the Cloudflare Workers connector.
+* API-identical to the core class — the only difference is that
+* callers do not need to supply `connect`.
+*/
+var MllpClient = class extends MllpClient$1 {
+	constructor(options) {
+		super({
+			...options,
+			connect: workersConnect
+		});
+	}
+};
+/**
+* `MllpConnect` implementation backed by Cloudflare's
+* `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that
+* mirrors the Worker socket's already-Web-Streams shape.
+*
+* TLS is on iff `params.tls` is set (the core normalises `tls: true`
+* to `tls: {}` before reaching the adapter). Workers exposes a small
+* subset of TLS options compared to Node — `ca`, `cert`, `key`,
+* `passphrase`, and `servername` cannot be supplied programmatically
+* and are rejected with `INVALID_INPUT`. `insecure: true` is also
+* rejected: on Node it means "TLS on, certificate verification off",
+* but Workers does not expose a way to disable verification, so
+* silently downgrading to plain TCP would be a security regression.
+* Callers wanting plain TCP must pass `tls: false` (the constructor
+* defaults `tls` to `true`).
+*
+* **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`
+* does not surface enough detail to distinguish a TLS handshake
+* failure from a TCP connect failure. Both surface here as
+* `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the
+* underlying error and routes handshake failures to
+* `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that
+* switches on `error.code` must accept this asymmetry, or treat
+* `CONNECTION_REFUSED` as the supertype.
+*/
+const workersConnect = async (params) => {
+	rejectUnsupportedTlsMaterial(params.tls);
+	const socket = connect({
+		hostname: params.host,
+		port: params.port
+	}, {
+		allowHalfOpen: true,
+		secureTransport: params.tls ? "on" : "off"
+	});
+	const dispose = params.signal ? subscribeAbort(params.signal, () => {
+		socket.close().catch(() => {});
+	}) : null;
+	try {
+		await socket.opened;
+	} catch (error) {
+		if (params.signal?.aborted) throw toAbortError(params.signal.reason, params.host, params.port, error);
+		const wrapped = error instanceof Error ? error : new Error(String(error));
+		throw new MllpClientError(MllpClientErrorCode.CONNECTION_REFUSED, `Could not connect to ${params.host}:${params.port}: ${wrapped.message}`, { cause: wrapped });
+	} finally {
+		dispose?.();
+	}
+	return {
+		async close() {
+			try {
+				await socket.close();
+			} catch {}
+		},
+		readable: socket.readable,
+		writable: socket.writable
+	};
+};
+/**
+* Translate an abort `reason` from the connect-phase signal into a typed
+* {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in
+* `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT
+* with the reason chained as `cause`.
+*/
+function toAbortError(reason, host, port, fallbackCause) {
+	if (reason instanceof MllpClientError) return reason;
+	let cause;
+	if (reason instanceof Error) cause = reason;
+	else if (fallbackCause instanceof Error) cause = fallbackCause;
+	return new MllpClientError(MllpClientErrorCode.TIMEOUT, `Connect to ${host}:${port} aborted`, { cause });
+}
+/**
+* Reject TLS configuration the Workers runtime cannot honour.
+* Surfacing the mismatch as `INVALID_INPUT` is more honest than
+* silently dropping the material — operators who supply a custom CA,
+* client cert, key, passphrase, or servername expect it to take
+* effect.
+*
+* `insecure: true` is rejected separately because the rationale is
+* different: Workers cannot disable certificate verification
+* independently, and silently dropping to plain TCP would downgrade an
+* explicitly TLS-typed configuration to plaintext — a runtime-dependent
+* security regression vs. the Node adapter.
+*
+* For all rejected fields the error message names the field, points to
+* the Cloudflare TCP-sockets docs, and lists the platform-side
+* mechanisms (Hyperdrive, Worker bindings, upstream TLS termination)
+* so an operator porting from Node has a concrete next step.
+*/
+function rejectUnsupportedTlsMaterial(tls) {
+	if (!tls) return;
+	const unsupported = [];
+	if (tls.ca) unsupported.push("ca");
+	if (tls.cert) unsupported.push("cert");
+	if (tls.key) unsupported.push("key");
+	if (tls.passphrase !== void 0) unsupported.push("passphrase");
+	if (tls.servername !== void 0) unsupported.push("servername");
+	if (unsupported.length > 0) {
+		const fields = unsupported.map((f) => `\`tls.${f}\``).join(", ");
+		throw new MllpClientError(MllpClientErrorCode.INVALID_INPUT, `Cloudflare Workers does not accept programmatic TLS material (${fields}). Configure TLS via the Cloudflare platform — Hyperdrive, Worker bindings, or terminate TLS upstream of the receiver. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/`);
+	}
+	if (tls.insecure === true) throw new MllpClientError(MllpClientErrorCode.INVALID_INPUT, "Cloudflare Workers does not support disabling TLS certificate verification (`tls.insecure: true`). Pass `tls: false` for plain TCP (caller takes the security trade-off explicitly), or terminate TLS upstream of the receiver via the Cloudflare platform. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/");
+}
+//#endregion
+export { MllpClient, MllpClientError, MllpClientErrorCode, workersConnect };
+
+//# sourceMappingURL=workers.js.map

package/dist/runtimes/workers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workers.js","names":["CoreMllpClient","workerSocketConnect"],"sources":["../../src/runtimes/workers.ts"],"sourcesContent":["/**\n * Cloudflare Workers runtime adapter for `@glion/mllp-client`.\n *\n * Re-exports the core `MllpClient` pre-wired with a `connect`\n * implementation that uses the `cloudflare:sockets` API. Application\n * code on Workers imports from this entry:\n *\n * ```ts\n * import { MllpClient } from \"@glion/mllp-client/workers\";\n *\n * const client = new MllpClient({ host: \"127.0.0.1\", port: 2575 });\n * const ack = await client.send(rawHl7Message);\n * ```\n *\n * The `cloudflare:sockets` module is only available inside the\n * Workers (`workerd`) runtime. Importing this entry from a Node or\n * Deno build will fail at module-resolution time — that's the\n * intended behaviour, since each runtime should pick its own\n * adapter.\n *\n * @module\n */\n\n// `cloudflare:sockets` is a runtime-provided module — its shape is\n// declared in `./cloudflare-sockets.d.ts`. See that file for why we\n// do not use `@cloudflare/workers-types` (it pollutes Web Streams\n// globals project-wide, which breaks the Node adapter's\n// `node:stream/web` types).\nimport { connect as workerSocketConnect } from \"cloudflare:sockets\";\n\nimport { MllpClient as CoreMllpClient } from \"../core/client\";\nimport type {\n  BoundMllpClientOptions,\n  MllpClientTlsOptions,\n} from \"../core/client\";\nimport type { MllpConnect, MllpDuplexStream } from \"../core/connect\";\nimport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\nimport { subscribeAbort } from \"../core/internal/subscribe-abort\";\n\n// ---------------------------------------------------------------------------\n// Public class\n// ---------------------------------------------------------------------------\n\n/**\n * MLLP client pre-wired with the Cloudflare Workers connector.\n * API-identical to the core class — the only difference is that\n * callers do not need to supply `connect`.\n */\nexport class MllpClient extends CoreMllpClient {\n  constructor(options: BoundMllpClientOptions) {\n    super({ ...options, connect: workersConnect });\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Re-exports\n// ---------------------------------------------------------------------------\n\nexport type { Acknowledgment } from \"../core/acknowledgment\";\nexport type {\n  MllpConnect,\n  MllpConnectParams,\n  MllpDuplexStream,\n} from \"../core/connect\";\nexport type {\n  BoundMllpClientOptions,\n  MllpClientOptions,\n  MllpClientTlsOptions,\n  SendMode,\n  SendOptions,\n} from \"../core/client\";\nexport { MllpClientError, MllpClientErrorCode } from \"../core/errors\";\n\n// ---------------------------------------------------------------------------\n// Workers connector\n// ---------------------------------------------------------------------------\n\n/**\n * `MllpConnect` implementation backed by Cloudflare's\n * `cloudflare:sockets` module. Returns a {@link MllpDuplexStream} that\n * mirrors the Worker socket's already-Web-Streams shape.\n *\n * TLS is on iff `params.tls` is set (the core normalises `tls: true`\n * to `tls: {}` before reaching the adapter). Workers exposes a small\n * subset of TLS options compared to Node — `ca`, `cert`, `key`,\n * `passphrase`, and `servername` cannot be supplied programmatically\n * and are rejected with `INVALID_INPUT`. `insecure: true` is also\n * rejected: on Node it means \"TLS on, certificate verification off\",\n * but Workers does not expose a way to disable verification, so\n * silently downgrading to plain TCP would be a security regression.\n * Callers wanting plain TCP must pass `tls: false` (the constructor\n * defaults `tls` to `true`).\n *\n * **Error-code divergence vs. the Node adapter.** `cloudflare:sockets`\n * does not surface enough detail to distinguish a TLS handshake\n * failure from a TCP connect failure. Both surface here as\n * `CONNECTION_REFUSED`. The Node adapter, by contrast, sniffs the\n * underlying error and routes handshake failures to\n * `TLS_HANDSHAKE_FAILED`. Callers writing cross-runtime code that\n * switches on `error.code` must accept this asymmetry, or treat\n * `CONNECTION_REFUSED` as the supertype.\n */\nexport const workersConnect: MllpConnect = async (params) => {\n  rejectUnsupportedTlsMaterial(params.tls);\n\n  const socket = workerSocketConnect(\n    { hostname: params.host, port: params.port },\n    {\n      allowHalfOpen: true,\n      secureTransport: params.tls ? \"on\" : \"off\",\n    }\n  );\n\n  // Honour the caller's abort signal — when it fires we close the\n  // pending socket so `socket.opened` rejects with the abort.\n  const dispose = params.signal\n    ? subscribeAbort(params.signal, () => {\n        // oxlint-disable-next-line promise/prefer-await-to-then\n        socket.close().catch(() => {\n          /* socket already closing — non-actionable */\n        });\n      })\n    : null;\n\n  try {\n    await socket.opened;\n  } catch (error) {\n    if (params.signal?.aborted) {\n      throw toAbortError(params.signal.reason, params.host, params.port, error);\n    }\n    const wrapped = error instanceof Error ? error : new Error(String(error));\n    throw new MllpClientError(\n      MllpClientErrorCode.CONNECTION_REFUSED,\n      `Could not connect to ${params.host}:${params.port}: ${wrapped.message}`,\n      { cause: wrapped }\n    );\n  } finally {\n    dispose?.();\n  }\n\n  return {\n    // The contract requires `close()` to resolve (never reject) and to\n    // be idempotent. workerd's `socket.close()` is genuinely async; we\n    // await it and swallow any rejection so the contract holds.\n    // Teardown errors at this point are non-actionable — the request\n    // lifecycle is already ending.\n    async close() {\n      try {\n        await socket.close();\n      } catch {\n        /* idempotent close or close-time error — non-actionable */\n      }\n    },\n    readable: socket.readable,\n    writable: socket.writable,\n  };\n};\n\n/**\n * Translate an abort `reason` from the connect-phase signal into a typed\n * {@link MllpClientError}. Mirrors the precedence in `normaliseSendError` in\n * `core/client.ts`: typed reasons pass through, anything else maps to TIMEOUT\n * with the reason chained as `cause`.\n */\nfunction toAbortError(\n  reason: unknown,\n  host: string,\n  port: number,\n  fallbackCause: unknown\n): MllpClientError {\n  if (reason instanceof MllpClientError) {\n    return reason;\n  }\n  let cause: Error | undefined;\n  if (reason instanceof Error) {\n    cause = reason;\n  } else if (fallbackCause instanceof Error) {\n    cause = fallbackCause;\n  }\n  return new MllpClientError(\n    MllpClientErrorCode.TIMEOUT,\n    `Connect to ${host}:${port} aborted`,\n    { cause }\n  );\n}\n\n/**\n * Reject TLS configuration the Workers runtime cannot honour.\n * Surfacing the mismatch as `INVALID_INPUT` is more honest than\n * silently dropping the material — operators who supply a custom CA,\n * client cert, key, passphrase, or servername expect it to take\n * effect.\n *\n * `insecure: true` is rejected separately because the rationale is\n * different: Workers cannot disable certificate verification\n * independently, and silently dropping to plain TCP would downgrade an\n * explicitly TLS-typed configuration to plaintext — a runtime-dependent\n * security regression vs. the Node adapter.\n *\n * For all rejected fields the error message names the field, points to\n * the Cloudflare TCP-sockets docs, and lists the platform-side\n * mechanisms (Hyperdrive, Worker bindings, upstream TLS termination)\n * so an operator porting from Node has a concrete next step.\n */\nfunction rejectUnsupportedTlsMaterial(\n  tls: MllpClientTlsOptions | undefined\n): void {\n  if (!tls) {\n    return;\n  }\n\n  const unsupported: string[] = [];\n  if (tls.ca) {\n    unsupported.push(\"ca\");\n  }\n  if (tls.cert) {\n    unsupported.push(\"cert\");\n  }\n  if (tls.key) {\n    unsupported.push(\"key\");\n  }\n  if (tls.passphrase !== undefined) {\n    unsupported.push(\"passphrase\");\n  }\n  if (tls.servername !== undefined) {\n    unsupported.push(\"servername\");\n  }\n\n  if (unsupported.length > 0) {\n    const fields = unsupported.map((f) => `\\`tls.${f}\\``).join(\", \");\n    throw new MllpClientError(\n      MllpClientErrorCode.INVALID_INPUT,\n      `Cloudflare Workers does not accept programmatic TLS material (${fields}). Configure TLS via the Cloudflare platform — Hyperdrive, Worker bindings, or terminate TLS upstream of the receiver. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/`\n    );\n  }\n\n  if (tls.insecure === true) {\n    throw new MllpClientError(\n      MllpClientErrorCode.INVALID_INPUT,\n      \"Cloudflare Workers does not support disabling TLS certificate verification (`tls.insecure: true`). Pass `tls: false` for plain TCP (caller takes the security trade-off explicitly), or terminate TLS upstream of the receiver via the Cloudflare platform. See https://developers.cloudflare.com/workers/runtime-apis/tcp-sockets/\"\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDA,IAAa,aAAb,cAAgCA,aAAe;CAC7C,YAAY,SAAiC;AAC3C,QAAM;GAAE,GAAG;GAAS,SAAS;GAAgB,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoDlD,MAAa,iBAA8B,OAAO,WAAW;AAC3D,8BAA6B,OAAO,IAAI;CAExC,MAAM,SAASC,QACb;EAAE,UAAU,OAAO;EAAM,MAAM,OAAO;EAAM,EAC5C;EACE,eAAe;EACf,iBAAiB,OAAO,MAAM,OAAO;EACtC,CACF;CAID,MAAM,UAAU,OAAO,SACnB,eAAe,OAAO,cAAc;AAElC,SAAO,OAAO,CAAC,YAAY,GAEzB;GACF,GACF;AAEJ,KAAI;AACF,QAAM,OAAO;UACN,OAAO;AACd,MAAI,OAAO,QAAQ,QACjB,OAAM,aAAa,OAAO,OAAO,QAAQ,OAAO,MAAM,OAAO,MAAM,MAAM;EAE3E,MAAM,UAAU,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,MAAM,CAAC;AACzE,QAAM,IAAI,gBACR,oBAAoB,oBACpB,wBAAwB,OAAO,KAAK,GAAG,OAAO,KAAK,IAAI,QAAQ,WAC/D,EAAE,OAAO,SAAS,CACnB;WACO;AACR,aAAW;;AAGb,QAAO;EAML,MAAM,QAAQ;AACZ,OAAI;AACF,UAAM,OAAO,OAAO;WACd;;EAIV,UAAU,OAAO;EACjB,UAAU,OAAO;EAClB;;;;;;;;AASH,SAAS,aACP,QACA,MACA,MACA,eACiB;AACjB,KAAI,kBAAkB,gBACpB,QAAO;CAET,IAAI;AACJ,KAAI,kBAAkB,MACpB,SAAQ;UACC,yBAAyB,MAClC,SAAQ;AAEV,QAAO,IAAI,gBACT,oBAAoB,SACpB,cAAc,KAAK,GAAG,KAAK,WAC3B,EAAE,OAAO,CACV;;;;;;;;;;;;;;;;;;;;AAqBH,SAAS,6BACP,KACM;AACN,KAAI,CAAC,IACH;CAGF,MAAM,cAAwB,EAAE;AAChC,KAAI,IAAI,GACN,aAAY,KAAK,KAAK;AAExB,KAAI,IAAI,KACN,aAAY,KAAK,OAAO;AAE1B,KAAI,IAAI,IACN,aAAY,KAAK,MAAM;AAEzB,KAAI,IAAI,eAAe,KAAA,EACrB,aAAY,KAAK,aAAa;AAEhC,KAAI,IAAI,eAAe,KAAA,EACrB,aAAY,KAAK,aAAa;AAGhC,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,SAAS,YAAY,KAAK,MAAM,SAAS,EAAE,IAAI,CAAC,KAAK,KAAK;AAChE,QAAM,IAAI,gBACR,oBAAoB,eACpB,iEAAiE,OAAO,gMACzE;;AAGH,KAAI,IAAI,aAAa,KACnB,OAAM,IAAI,gBACR,oBAAoB,eACpB,sUACD"}