Use the native implementation of node:tls (#8514)

* Use the native implementation of `node:tls`

* fixup! lock file

* sync with `[email protected]`

* fixup! lockfile

Author: vicb

.changeset/loud-crabs-remain.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/unenv-preset": patch
+---
+
+sync with `[email protected]`

.changeset/small-pigs-marry.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/unenv-preset": minor
+---
+
+Use the native implementation for `connect` and `TLSSocket` from `node:tls`

fixtures/nodejs-hybrid-app/src/index.ts

@@ -30,6 +30,8 @@ export default {
 				return testRequireUnenvAliasedPackages();
 			case "/test-immediate":
 				return await testImmediate();
+			case "/test-tls":
+				return await testTls();
 		}
 
 		return new Response(
@@ -39,6 +41,7 @@ export default {
 <a href="test-x509-certificate">Test X509Certificate</a>
 <a href="test-require-alias">Test require unenv aliased packages</a>
 <a href="test-immediate">Test setImmediate</a>
+<a href="test-tls">node:tls</a>
 `,
 			{ headers: { "Content-Type": "text/html; charset=utf-8" } }
 		);
@@ -195,3 +198,12 @@ async function testPostgresLibrary(env: Env, ctx: Context) {
 	ctx.waitUntil(client.end());
 	return resp;
 }
+
+async function testTls(env: Env, ctx: Context) {
+	const tls = await import("node:tls");
+
+	assert.strictEqual(typeof tls.connect, "function");
+	assert.strictEqual(typeof tls.TLSSocket, "function");
+
+	return new Response("OK");
+}

fixtures/nodejs-hybrid-app/tests/index.test.ts

@@ -64,4 +64,10 @@ describe("nodejs compat", () => {
 		const response = await fetch(`http://${ip}:${port}/test-immediate`);
 		await expect(response.text()).resolves.toBe("OK");
 	});
+
+	test("node:tls", async ({ expect }) => {
+		const { ip, port } = wrangler;
+		const response = await fetch(`http://${ip}:${port}/test-tls`);
+		await expect(response.text()).resolves.toBe("OK");
+	});
 });

packages/unenv-preset/package.json

@@ -53,8 +53,8 @@
 		"wrangler": "workspace:*"
 	},
 	"peerDependencies": {
-		"unenv": "2.0.0-rc.14",
-		"workerd": "^1.20250124.0"
+		"unenv": "2.0.0-rc.15",
+		"workerd": "^1.20250310.0"
 	},
 	"peerDependenciesMeta": {
 		"workerd": {

packages/unenv-preset/src/preset.ts

@@ -46,6 +46,7 @@ const hybridNodeCompatModules = [
 	"crypto",
 	"module",
 	"process",
+	"tls",
 	"util",
 ];
 

packages/unenv-preset/src/runtime/node/tls.ts

@@ -0,0 +1,62 @@
+import {
+	checkServerIdentity,
+	CLIENT_RENEG_LIMIT,
+	CLIENT_RENEG_WINDOW,
+	convertALPNProtocols,
+	createSecureContext,
+	createSecurePair,
+	createServer,
+	DEFAULT_CIPHERS,
+	DEFAULT_ECDH_CURVE,
+	DEFAULT_MAX_VERSION,
+	DEFAULT_MIN_VERSION,
+	getCiphers,
+	rootCertificates,
+	SecureContext,
+	Server,
+} from "unenv/node/tls";
+import type nodeTls from "node:tls";
+
+export {
+	checkServerIdentity,
+	CLIENT_RENEG_LIMIT,
+	CLIENT_RENEG_WINDOW,
+	convertALPNProtocols,
+	createSecureContext,
+	createSecurePair,
+	createServer,
+	DEFAULT_CIPHERS,
+	DEFAULT_ECDH_CURVE,
+	DEFAULT_MAX_VERSION,
+	DEFAULT_MIN_VERSION,
+	getCiphers,
+	rootCertificates,
+	SecureContext,
+	Server,
+} from "unenv/node/tls";
+
+const workerdTls = process.getBuiltinModule("node:tls");
+
+// Natively implemented in workerd
+export const { connect, TLSSocket } = workerdTls;
+
+export default {
+	CLIENT_RENEG_LIMIT,
+	CLIENT_RENEG_WINDOW,
+	DEFAULT_CIPHERS,
+	DEFAULT_ECDH_CURVE,
+	DEFAULT_MAX_VERSION,
+	DEFAULT_MIN_VERSION,
+	// @ts-expect-error
+	SecureContext,
+	Server,
+	TLSSocket,
+	checkServerIdentity,
+	connect,
+	convertALPNProtocols,
+	createSecureContext,
+	createSecurePair,
+	createServer,
+	getCiphers,
+	rootCertificates,
+} satisfies typeof nodeTls;