@jxburros/ai-nugget 0.3.1 → 0.6.0

package/dist/cjs/json.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractJson = extractJson;
+exports.extractJsonWithSchema = extractJsonWithSchema;
+exports.requireString = requireString;
+exports.requireNumber = requireNumber;
+exports.requireStringArray = requireStringArray;
+exports.requireOptionalString = requireOptionalString;
+const errors_js_1 = require("./errors.js");
+function extractJson(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        return null;
+    const direct = tryParse(trimmed);
+    if (direct.ok)
+        return direct.value;
+    const fenced = /```(?:json)?\s*([\s\S]*?)```/i.exec(text);
+    if (fenced?.[1]) {
+        const parsed = tryParse(fenced[1].trim());
+        if (parsed.ok)
+            return parsed.value;
+    }
+    for (const [open, close] of [['{', '}'], ['[', ']']]) {
+        for (const span of balancedSpans(text, open, close)) {
+            const parsed = tryParse(span);
+            if (parsed.ok)
+                return parsed.value;
+        }
+    }
+    return null;
+}
+/**
+ * Yields each top-level `open`/`close` balanced substring of `text`, tracking
+ * nesting depth and skipping over string-literal content (including escapes)
+ * so a stray brace inside a string or trailing prose can't prematurely close
+ * or extend a span. Used instead of first-`indexOf`/last-`lastIndexOf` so
+ * multiple JSON regions (or JSON followed by unrelated braces) don't get
+ * spliced into one bogus span.
+ */
+function* balancedSpans(text, open, close) {
+    let depth = 0;
+    let spanStart = -1;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < text.length; i += 1) {
+        const ch = text[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === '\\')
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+            continue;
+        }
+        if (ch === open) {
+            if (depth === 0)
+                spanStart = i;
+            depth += 1;
+            continue;
+        }
+        if (ch === close && depth > 0) {
+            depth -= 1;
+            if (depth === 0 && spanStart >= 0) {
+                yield text.slice(spanStart, i + 1);
+                spanStart = -1;
+            }
+        }
+    }
+}
+function extractJsonWithSchema(text, parse) {
+    const value = extractJson(text);
+    if (value === null)
+        throw new errors_js_1.AIError('No JSON object or array found in model output', { kind: 'invalid_response' });
+    try {
+        return parse(value);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'JSON did not match expected schema';
+        throw new errors_js_1.AIError(message, { kind: 'invalid_response', cause: error });
+    }
+}
+function requireString(record, key) {
+    const value = record[key];
+    if (typeof value !== 'string')
+        throw new Error(`Expected ${key} to be a string`);
+    return value;
+}
+function requireNumber(record, key) {
+    const value = record[key];
+    if (typeof value !== 'number' || !Number.isFinite(value))
+        throw new Error(`Expected ${key} to be a number`);
+    return value;
+}
+function requireStringArray(record, key) {
+    const value = record[key];
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string')) {
+        throw new Error(`Expected ${key} to be a string array`);
+    }
+    return value;
+}
+function requireOptionalString(record, key) {
+    const value = record[key];
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'string')
+        throw new Error(`Expected ${key} to be a string when present`);
+    return value;
+}
+function tryParse(text) {
+    try {
+        return { ok: true, value: JSON.parse(text) };
+    }
+    catch {
+        return { ok: false };
+    }
+}

package/dist/cjs/keys.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeyRef = parseKeyRef;
+exports.envKeySource = envKeySource;
+exports.literalKeySource = literalKeySource;
+exports.memoryKeySource = memoryKeySource;
+exports.chainKeySources = chainKeySources;
+const util_js_1 = require("./util.js");
+function parseKeyRef(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return { kind: 'none' };
+    const braced = /^\$\{([A-Z0-9_]+)\}$/.exec(trimmed);
+    if (braced?.[1])
+        return { kind: 'env', name: braced[1] };
+    const dollar = /^\$([A-Z0-9_]+)$/.exec(trimmed);
+    if (dollar?.[1])
+        return { kind: 'env', name: dollar[1] };
+    if (/^[A-Z][A-Z0-9_]{2,}$/.test(trimmed))
+        return { kind: 'env', name: trimmed };
+    if (trimmed.startsWith('secret://'))
+        return { kind: 'brokered', ref: trimmed };
+    if (trimmed.startsWith('stored://'))
+        return { kind: 'stored', ref: trimmed.slice('stored://'.length) };
+    return { kind: 'literal', value: trimmed };
+}
+function envKeySource(env = (0, util_js_1.globalEnv)()) {
+    return {
+        async resolve(ref) {
+            if (ref.kind === 'none')
+                return { ok: true, apiKey: null };
+            if (ref.kind !== 'env')
+                return { ok: false, reason: 'denied' };
+            const apiKey = env[ref.name]?.trim();
+            return apiKey ? { ok: true, apiKey } : { ok: false, reason: 'missing' };
+        },
+    };
+}
+function literalKeySource() {
+    return {
+        async resolve(ref) {
+            if (ref.kind === 'none')
+                return { ok: true, apiKey: null };
+            if (ref.kind === 'literal')
+                return { ok: true, apiKey: ref.value };
+            return { ok: false, reason: 'denied' };
+        },
+    };
+}
+function memoryKeySource(values) {
+    return {
+        async resolve(ref) {
+            if (ref.kind === 'none')
+                return { ok: true, apiKey: null };
+            if (ref.kind === 'literal')
+                return { ok: true, apiKey: ref.value };
+            const key = ref.kind === 'env' ? ref.name : ref.ref;
+            const value = values[key]?.trim();
+            return value ? { ok: true, apiKey: value } : { ok: false, reason: 'missing' };
+        },
+    };
+}
+function chainKeySources(...sources) {
+    return {
+        async resolve(ref) {
+            let missing = false;
+            for (const source of sources) {
+                const result = await source.resolve(ref);
+                if (result.ok)
+                    return result;
+                if (result.reason === 'locked')
+                    return result;
+                if (result.reason === 'missing') {
+                    missing = true;
+                    continue;
+                }
+            }
+            return missing ? { ok: false, reason: 'missing' } : { ok: false, reason: 'denied' };
+        },
+    };
+}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/cjs/policy.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.allowAllPolicy = allowAllPolicy;
+exports.blocklistPolicy = blocklistPolicy;
+exports.allowlistPolicy = allowlistPolicy;
+exports.composePolicies = composePolicies;
+function allowAllPolicy() {
+    return { checkModel: () => ({ allowed: true }) };
+}
+function blocklistPolicy(patterns) {
+    return {
+        checkModel(provider, model) {
+            const target = `${provider}/${model}`;
+            const blocked = patterns.find((pattern) => pattern.test(target));
+            return blocked ? { allowed: false, reason: `Model blocked by policy: ${blocked}` } : { allowed: true };
+        },
+    };
+}
+function allowlistPolicy(prefixesByProvider) {
+    return {
+        checkModel(provider, model) {
+            const prefixes = prefixesByProvider[provider];
+            if (!prefixes || prefixes.length === 0)
+                return { allowed: false, reason: `No models are allowed for provider ${provider}` };
+            return prefixes.some((prefix) => prefix === '*' || model.startsWith(prefix))
+                ? { allowed: true }
+                : { allowed: false, reason: `Model is not allowed for provider ${provider}` };
+        },
+    };
+}
+function composePolicies(...policies) {
+    return {
+        checkModel(provider, model) {
+            for (const policy of policies) {
+                const result = policy.checkModel(provider, model);
+                if (!result.allowed)
+                    return result;
+            }
+            return { allowed: true };
+        },
+    };
+}

package/dist/cjs/redact.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionRedactor = exports.LABELED_SECRET_PATTERNS = exports.SECRET_PATTERNS = void 0;
+exports.createDefaultRedactor = createDefaultRedactor;
+/**
+ * Prefixed secret formats. Each pattern is anchored on a vendor prefix that is
+ * distinctive enough that a match is a secret, not a coincidence.
+ */
+exports.SECRET_PATTERNS = [
+    /sk-[A-Za-z0-9_-]{20,}/g,
+    /sk-proj-[A-Za-z0-9_-]{20,}/g,
+    /sk-ant-[A-Za-z0-9_-]{20,}/g,
+    /AIza[0-9A-Za-z_-]{20,}/g,
+    /gsk_[0-9A-Za-z_-]{20,}/g,
+    /xai-[0-9A-Za-z_-]{20,}/g,
+    /hf_[0-9A-Za-z]{20,}/g,
+    /nvapi-[0-9A-Za-z_-]{20,}/g,
+    /ghp_[0-9A-Za-z_]{20,}/g,
+    /github_pat_[0-9A-Za-z_]{20,}/g,
+    /glpat-[0-9A-Za-z_-]{20,}/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/gi,
+    /xox[baprs]-[0-9A-Za-z-]{10,}/g,
+    /AKIA[0-9A-Z]{16}/g,
+    /ASIA[0-9A-Z]{16}/g,
+    /SG\.[0-9A-Za-z_-]{10,}\.[0-9A-Za-z_-]{10,}/g,
+    /rk_live_[0-9A-Za-z]{20,}/g,
+    /pk_live_[0-9A-Za-z]{20,}/g,
+    /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g,
+    /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/g,
+];
+/**
+ * Unprefixed/opaque secrets — Azure OpenAI `api-key` values, AWS *secret*
+ * access keys, generic bearer/session tokens — carry no distinctive prefix, so
+ * matching them on shape alone would redact commit SHAs, content hashes, and
+ * base64 payloads. These patterns instead anchor on the *label* that precedes
+ * the value (`api-key: …`, `"aws_secret_access_key": "…"`, `password=…`) and
+ * redact only the value, keeping the label readable in logs.
+ *
+ * Exact-match registration (`SessionRedactor.addSecret`, which the handler does
+ * for every resolved key) remains the only guaranteed catch for a bare,
+ * unlabeled, unprefixed secret.
+ */
+exports.LABELED_SECRET_PATTERNS = [
+    new RegExp(
+    // Lookbehind rather than `\b` so an underscore-joined prefix still matches
+    // the label (`aws_secret_access_key`, `azure_api_key`).
+    String.raw `(?<![A-Za-z0-9])(api[_-]?key|apikey|secret[_-]?access[_-]?key|access[_-]?token|auth[_-]?token|session[_-]?token|client[_-]?secret|refresh[_-]?token|private[_-]?key|password|passwd)` +
+        // Optional closing quote handles JSON keys (`"api_key": "…"`).
+        String.raw `(["']?\s*[:=]\s*|\s+)` +
+        String.raw `(["']?)([A-Za-z0-9/+_.~-]{16,}={0,2})\3`, 'gi'),
+];
+function createDefaultRedactor(extraSecrets = []) {
+    const secrets = new Set([...extraSecrets].filter((value) => value.length >= 6));
+    return {
+        redact(text) {
+            let output = text;
+            for (const pattern of exports.SECRET_PATTERNS)
+                output = output.replace(pattern, '[REDACTED]');
+            for (const pattern of exports.LABELED_SECRET_PATTERNS) {
+                output = output.replace(pattern, (_match, label, separator, quote) => `${label}${separator}${quote}[REDACTED]${quote}`);
+            }
+            for (const secret of secrets)
+                output = output.split(secret).join('[REDACTED]');
+            return output;
+        },
+    };
+}
+class SessionRedactor {
+    secrets = new Set();
+    addSecret(value) {
+        if (value && value.length >= 6)
+            this.secrets.add(value);
+    }
+    redact(text) {
+        return createDefaultRedactor(this.secrets).redact(text);
+    }
+}
+exports.SessionRedactor = SessionRedactor;

package/dist/cjs/tokens.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.estimateTokens = estimateTokens;
+exports.estimatedUsage = estimatedUsage;
+exports.mergeUsage = mergeUsage;
+function estimateTokens(text) {
+    return Math.ceil(text.length / 4);
+}
+function estimatedUsage(inputText, outputText) {
+    return {
+        inputTokens: estimateTokens(inputText),
+        outputTokens: estimateTokens(outputText),
+        estimated: true,
+    };
+}
+function mergeUsage(a, b) {
+    return {
+        inputTokens: (a.inputTokens ?? 0) + (b.inputTokens ?? 0),
+        outputTokens: (a.outputTokens ?? 0) + (b.outputTokens ?? 0),
+        estimated: a.estimated || b.estimated,
+    };
+}

package/dist/cjs/transport.js

@@ -0,0 +1,172 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withTimeout = withTimeout;
+exports.fetchJson = fetchJson;
+exports.postResponse = postResponse;
+exports.sseLines = sseLines;
+exports.ndjsonLines = ndjsonLines;
+exports.textLines = textLines;
+const errors_js_1 = require("./errors.js");
+function withTimeout(ms, external, idleMs) {
+    const controller = new AbortController();
+    let didTimeOut = false;
+    const timer = setTimeout(() => {
+        didTimeOut = true;
+        controller.abort(new errors_js_1.AIError(`Request timed out after ${ms}ms`, { kind: 'timeout' }));
+    }, ms);
+    // Optional idle timeout: aborts only when no chunk has arrived for `idleMs`,
+    // rearmed on every `bump()`. Keeps a long but healthy stream alive while the
+    // total `ms` ceiling still bounds a truly stuck call.
+    let idleTimer;
+    const armIdle = () => {
+        if (idleMs === undefined)
+            return;
+        if (idleTimer)
+            clearTimeout(idleTimer);
+        idleTimer = setTimeout(() => {
+            didTimeOut = true;
+            controller.abort(new errors_js_1.AIError(`Request idle for ${idleMs}ms`, { kind: 'timeout' }));
+        }, idleMs);
+    };
+    const onAbort = () => controller.abort(external?.reason);
+    if (external) {
+        if (external.aborted)
+            onAbort();
+        else
+            external.addEventListener('abort', onAbort, { once: true });
+    }
+    armIdle();
+    return {
+        signal: controller.signal,
+        done() {
+            clearTimeout(timer);
+            if (idleTimer)
+                clearTimeout(idleTimer);
+            external?.removeEventListener('abort', onAbort);
+        },
+        timedOut() {
+            return didTimeOut;
+        },
+        bump() {
+            armIdle();
+        },
+    };
+}
+async function fetchJson(url, init) {
+    const timeout = withTimeout(init.timeoutMs, init.signal ?? undefined);
+    const started = Date.now();
+    try {
+        const res = await fetch(url, { ...init, signal: timeout.signal });
+        const raw = await res.text().catch(() => '');
+        if (!res.ok)
+            throw (0, errors_js_1.classify)(res.status, raw, init.provider, res.headers);
+        return { data: raw.trim() ? tolerantJson(raw) : null, status: res.status, totalMs: Date.now() - started };
+    }
+    catch (error) {
+        if (timeout.timedOut())
+            throw new errors_js_1.AIError(`Request timed out after ${init.timeoutMs}ms`, { kind: 'timeout', provider: init.provider });
+        throw (0, errors_js_1.fromUnknown)(error, init.provider);
+    }
+    finally {
+        timeout.done();
+    }
+}
+/**
+ * POST a JSON body and return the raw {@link Response} for streaming.
+ *
+ * The caller owns the abort/timeout `signal` and is responsible for keeping it
+ * alive until the response body has been fully consumed — passing a
+ * `withTimeout()` signal here and cleaning it up only after the stream ends is
+ * what lets external cancellation and the timeout apply for the *whole* stream,
+ * not merely the connection handshake. Non-2xx responses are classified and
+ * thrown before the body is handed back.
+ */
+async function postResponse(url, body, headers, signal, provider) {
+    let res;
+    try {
+        res = await fetch(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...headers },
+            body: JSON.stringify(body),
+            signal,
+        });
+    }
+    catch (error) {
+        throw (0, errors_js_1.fromUnknown)(error, provider);
+    }
+    if (!res.ok) {
+        const raw = await res.text().catch(() => '');
+        throw (0, errors_js_1.classify)(res.status, raw, provider, res.headers);
+    }
+    return res;
+}
+async function* sseLines(res) {
+    for await (const line of textLines(res)) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith(':'))
+            continue;
+        if (!trimmed.startsWith('data:'))
+            continue;
+        const data = trimmed.slice(5).trim();
+        if (!data || data === '[DONE]')
+            continue;
+        yield data;
+    }
+}
+async function* ndjsonLines(res) {
+    for await (const line of textLines(res)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            yield JSON.parse(trimmed);
+        }
+        catch {
+            throw new errors_js_1.AIError('Provider returned malformed NDJSON', { kind: 'invalid_response' });
+        }
+    }
+}
+async function* textLines(res) {
+    if (!res.body) {
+        const raw = await res.text().catch(() => '');
+        for (const line of raw.split(/\r?\n/))
+            yield line;
+        return;
+    }
+    const reader = res.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let completed = false;
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done) {
+                completed = true;
+                break;
+            }
+            buffer += decoder.decode(value, { stream: true });
+            let newlineIndex;
+            while ((newlineIndex = buffer.indexOf('\n')) >= 0) {
+                const line = buffer.slice(0, newlineIndex);
+                buffer = buffer.slice(newlineIndex + 1);
+                yield line;
+            }
+        }
+        buffer += decoder.decode();
+        if (buffer.trim())
+            yield buffer;
+    }
+    finally {
+        if (!completed)
+            await reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+}
+function tolerantJson(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return { text: raw };
+    }
+}

package/dist/cjs/types.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.modelRef = modelRef;
+function modelRef(source, model) {
+    return `${source.provider}/${model}`;
+}

package/dist/cjs/util.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asRecord = asRecord;
+exports.asString = asString;
+exports.asNumber = asNumber;
+exports.promptChars = promptChars;
+exports.textFromMessages = textFromMessages;
+exports.globalEnv = globalEnv;
+exports.applyProviderOptions = applyProviderOptions;
+exports.joinUrl = joinUrl;
+exports.mapWithConcurrency = mapWithConcurrency;
+exports.sleep = sleep;
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+}
+function asString(value) {
+    return typeof value === 'string' ? value : undefined;
+}
+function asNumber(value) {
+    return typeof value === 'number' && Number.isFinite(value) ? value : undefined;
+}
+function promptChars(messages) {
+    return messages.reduce((sum, message) => {
+        if (typeof message.content === 'string')
+            return sum + message.content.length;
+        return sum + message.content.reduce((partSum, part) => partSum + (part.text?.length ?? 0) + (part.imageBase64?.length ?? 0), 0);
+    }, 0);
+}
+function textFromMessages(messages) {
+    return messages.map((message) => {
+        if (typeof message.content === 'string')
+            return message.content;
+        return message.content.map((part) => part.text ?? '').join('');
+    }).join('\n');
+}
+function globalEnv() {
+    const maybeProcess = globalThis;
+    return maybeProcess.process?.env ?? {};
+}
+/**
+ * Merges app-supplied {@link ChatRequest.providerOptions} into a provider
+ * request body: shallow at the top level, and one level deep for each key in
+ * `nestedKeys` where both sides are plain objects (Ollama `options`, Google
+ * `generationConfig`). Values in `providerOptions` win on collision.
+ */
+function applyProviderOptions(body, providerOptions, nestedKeys = []) {
+    if (!providerOptions)
+        return body;
+    const merged = { ...body };
+    for (const [key, value] of Object.entries(providerOptions)) {
+        const base = asRecord(merged[key]);
+        if (nestedKeys.includes(key) && base && asRecord(value)) {
+            merged[key] = { ...base, ...value };
+        }
+        else {
+            merged[key] = value;
+        }
+    }
+    return merged;
+}
+/** Joins a base URL and path without producing a double slash, even if `base` ends with `/`. */
+function joinUrl(base, path) {
+    return `${base.replace(/\/+$/, '')}/${path.replace(/^\/+/, '')}`;
+}
+/**
+ * Runs `fn` over `items` with at most `limit` in flight at once, preserving
+ * input order in the returned array. Used to probe many local models
+ * concurrently without opening an unbounded number of sockets.
+ */
+async function mapWithConcurrency(items, limit, fn) {
+    const results = new Array(items.length);
+    let next = 0;
+    const workerCount = Math.max(1, Math.min(limit, items.length));
+    const worker = async () => {
+        for (;;) {
+            const index = next;
+            next += 1;
+            if (index >= items.length)
+                return;
+            results[index] = await fn(items[index], index);
+        }
+    };
+    await Promise.all(Array.from({ length: workerCount }, worker));
+    return results;
+}
+function sleep(ms, signal) {
+    if (ms <= 0)
+        return Promise.resolve();
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => signal?.removeEventListener('abort', onAbort);
+        const timer = setTimeout(() => {
+            settled = true;
+            cleanup();
+            resolve();
+        }, ms);
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            cleanup();
+            reject(new DOMException('Sleep aborted', 'AbortError'));
+        };
+        if (signal) {
+            if (signal.aborted)
+                onAbort();
+            else
+                signal.addEventListener('abort', onAbort, { once: true });
+        }
+    });
+}

package/dist/connect.d.ts

@@ -0,0 +1,31 @@
+import type { Connection } from './types.js';
+export interface EnvConnectionOptions {
+    /** Read from this env-like object instead of the process/global environment. */
+    env?: Record<string, string | undefined>;
+    /** Connection id. Defaults to `'app'`. */
+    id?: string;
+    /** Env var names to read (override if an app already uses different names). */
+    providerVar?: string;
+    modelVar?: string;
+    keyEnvVar?: string;
+    baseUrlVar?: string;
+    /** Fallbacks used when the corresponding env var is unset. */
+    defaultProvider?: string;
+    defaultModel?: string;
+    defaultKeyEnv?: string;
+}
+export interface EnvConnection {
+    connection: Connection;
+    model: string;
+}
+/**
+ * Resolves a server-side `Connection` plus a default `model` from app-owned
+ * env vars (`AI_PROVIDER`, `AI_MODEL`, `AI_KEY_ENV`, `AI_BASE_URL` unless
+ * overridden). This only collapses the config-reading boilerplate that was
+ * being hand-rolled the same way in every small server app; it does not add
+ * policy. `provider`/`baseUrl` still come from the server's own environment,
+ * never from client input, and the returned `keyRef` still resolves through
+ * `KeySource` at call time like any other `Connection`.
+ */
+export declare function envConnection(options?: EnvConnectionOptions): EnvConnection;
+//# sourceMappingURL=connect.d.ts.map