Module tls 

TLS client for Seq.

Wraps a connected may::net::TcpStream in a rustls::ClientConnection and stores the result in the shared STREAMS registry as StreamKind::Tls. Existing net.tcp.read / net.tcp.write / net.tcp.close builtins dispatch over the StreamKind enum transparently — the user upgrades a Socket and keeps using it.

Surface

net.tls.client ( Socket String -- Socket Bool ) — consumes a connected TCP socket and a hostname, returns the same Socket id now pointing at a TLS-wrapped stream. The hostname drives SNI and webpki certificate validation; trust roots come from webpki-roots.

Handshake timing

Eager: the handshake completes inside this builtin via conn.complete_io(&mut tcp). A bad cert, expired cert, hostname mismatch, or any other TLS-layer error surfaces as (0, false) — matching the way every other fallible Seq networking word reports failure. A subsequent net.tcp.read reads application data only.

Known limitations (v1)

• net.tcp.close on a TLS-wrapped socket is a hard close — the underlying TcpStream is dropped without first sending the TLS close_notify alert. RFC 5246 expects clients to send the alert before closing; modern servers tolerate truncation but some older stacks log it as a truncation-attack indicator. A graceful-shutdown variant is a planned follow-up.
• No client-certificate authentication (mTLS).
• No caller-side ALPN selection — rustls defaults apply.
• No way to inspect the negotiated cipher / peer certificate from Seq. Planned follow-ups once the four-layer stack stabilises.

Functions

patch_seq_tls_client^⚠

Upgrade a connected Socket to TLS.