Module tls 

Node tls module: real TLS over blocking rustls (rustls::StreamOwned wrapping a std::net::TcpStream).

Threading model mirrors net (see host::run_event_loop): background threads only move raw bytes and post IoTask closures onto the host channel; every JS-visible effect (building the TLSSocket, emitting secureConnect/data/ end/close, calling listeners) happens on the main thread when the loop runs the posted closure. Background closures NEVER capture a Value (the heap is a main-thread thread_local); they capture only Send data (u64 ids, byte vectors, TcpStreams, channel senders) and look the emitter up by id inside the posted IoTask.

Per TLS connection there is ONE owner thread that solely owns the StreamOwned. It reads with a short socket read-timeout (so a WouldBlock lets it loop) and drains an mpsc channel of WriteCmds produced by the main thread (socket.write/socket.end). Because reads and writes share the one rustls Connection, keeping both on a single thread avoids splitting the stateful cipher across threads.

Constants

MODULE_METHODS

tls module functions routed through stdlib::call.

SERVER_METHODS

Instance method names for the two @@native tags this module owns, exposed to stdlib::instance_has_method (property reads that yield a bound method).

SOCKET_METHODS

Functions

build_server_config

Build a ServerConfig from PEM key+cert bytes.

call

stdlib::call entry for tls.<method>.

client_config

The shared client ClientConfig for a given rejectUnauthorized setting. Public so the https client (https.request/https.get) reuses the same trust configuration as tls.connect.

connect

tls.connect(options[, cb]) / tls.connect(port[, host][, options][, cb]). Returns a TLSSocket immediately; the TCP connect + handshake run on a background thread and emit secureConnect (or error) when complete.

create_server

tls.createServer([options][, secureConnectionListener]). Parses key+cert into a ServerConfig eagerly (so a bad cert throws synchronously) and returns a TLSServer emitter.

create_server_with_config

Build a TLS server backed by a caller-supplied per-connection hook (used by https::create_server). Returns the TLSServer emitter; the caller stores its requestListener and registers the hook.

instance_call

new_emitter_object

Build a native emitter object (@@native tag + @@on/@@once maps + extras), sharing the EventEmitter shape with events/net.

socket_end

Signal end-of-write (TLS close-notify + TCP write shutdown) on a socket.

socket_write

Queue plaintext to be written by the socket’s owner thread (no-op if closed). Public so https server responses can write through the TLS channel.

Type Aliases

ConnHook

A native-thread hook run on the main thread for each freshly-handshaked connection. Set by https to attach its request parser; None for a plain tls server (which emits secureConnect/connection and calls its listener).