@secure-exec/core 0.1.1-rc.1 → 0.1.1-rc.3

package/dist/bridge/network.js

@@ -4,24 +4,41 @@
 const MAX_HTTP_BODY_BYTES = 50 * 1024 * 1024; // 50 MB
 import { exposeCustomGlobal } from "../shared/global-exposure.js";
 // Fetch polyfill
-export async function fetch(url, options = {}) {
+export async function fetch(input, options = {}) {
     if (typeof _networkFetchRaw === 'undefined') {
         console.error('fetch requires NetworkAdapter to be configured');
         throw new Error('fetch requires NetworkAdapter to be configured');
     }
+    // Extract URL and options from Request object (used by axios fetch adapter)
+    let resolvedUrl;
+    if (input instanceof Request) {
+        resolvedUrl = input.url;
+        options = {
+            method: input.method,
+            headers: Object.fromEntries(input.headers.entries()),
+            body: input.body,
+            ...options,
+        };
+    }
+    else {
+        resolvedUrl = String(input);
+    }
     const optionsJson = JSON.stringify({
         method: options.method || "GET",
         headers: options.headers || {},
         body: options.body || null,
     });
-    const response = await _networkFetchRaw(String(url), optionsJson);
+    const responseJson = await _networkFetchRaw.apply(undefined, [resolvedUrl, optionsJson], {
+        result: { promise: true },
+    });
+    const response = JSON.parse(responseJson);
     // Create Response-like object
     return {
         ok: response.ok,
         status: response.status,
         statusText: response.statusText,
         headers: new Map(Object.entries(response.headers || {})),
-        url: response.url || String(url),
+        url: response.url || resolvedUrl,
         redirected: response.redirected || false,
         type: "basic",
         async text() {
@@ -161,8 +178,10 @@ export const dns = {
         if (typeof options === "function") {
             cb = options;
         }
-        _networkDnsLookupRaw(hostname)
-            .then((result) => {
+        _networkDnsLookupRaw
+            .apply(undefined, [hostname], { result: { promise: true } })
+            .then((resultJson) => {
+            const result = JSON.parse(resultJson);
             if (result.error) {
                 const err = new Error(result.error);
                 err.code = result.code || "ENOTFOUND";
@@ -588,13 +607,27 @@ export class ClientRequest {
                 body: this._body || null,
                 ...tls,
             });
-            const response = await _networkHttpRequestRaw(url, optionsJson);
+            const responseJson = await _networkHttpRequestRaw.apply(undefined, [url, optionsJson], {
+                result: { promise: true },
+            });
+            const response = JSON.parse(responseJson);
             this.finished = true;
             // 101 Switching Protocols → fire 'upgrade' event
             if (response.status === 101) {
                 const res = new IncomingMessage(response);
-                const head = typeof Buffer !== "undefined" ? Buffer.alloc(0) : new Uint8Array(0);
-                this._emit("upgrade", res, this.socket, head);
+                // Use UpgradeSocket for bidirectional data relay when socketId is available
+                let socket = this.socket;
+                if (response.upgradeSocketId != null) {
+                    socket = new UpgradeSocket(response.upgradeSocketId, {
+                        host: this._options.hostname,
+                        port: Number(this._options.port) || 80,
+                    });
+                    upgradeSocketInstances.set(response.upgradeSocketId, socket);
+                }
+                const head = typeof Buffer !== "undefined"
+                    ? (response.body ? Buffer.from(response.body, "base64") : Buffer.alloc(0))
+                    : new Uint8Array(0);
+                this._emit("upgrade", res, socket, head);
                 return;
             }
             const res = new IncomingMessage(response);
@@ -807,6 +840,8 @@ class Agent {
 }
 let nextServerId = 1;
 const serverRequestListeners = new Map();
+// Server instances indexed by serverId — used by upgrade dispatch to emit 'upgrade' events
+const serverInstances = new Map();
 class ServerIncomingMessage {
     headers;
     rawHeaders;
@@ -1101,7 +1136,9 @@ class Server {
         else {
             serverRequestListeners.set(this._serverId, () => undefined);
         }
+        serverInstances.set(this._serverId, this);
     }
+    /** @internal Emit an event — used by upgrade dispatch to fire 'upgrade' events. */
     _emit(event, ...args) {
         const listeners = this._listeners[event];
         if (!listeners || listeners.length === 0)
@@ -1112,7 +1149,8 @@ class Server {
         if (typeof _networkHttpServerListenRaw === "undefined") {
             throw new Error("http.createServer requires NetworkAdapter.httpServerListen support");
         }
-        const result = await _networkHttpServerListenRaw(JSON.stringify({ serverId: this._serverId, port, hostname }));
+        const resultJson = await _networkHttpServerListenRaw.apply(undefined, [JSON.stringify({ serverId: this._serverId, port, hostname })], { result: { promise: true } });
+        const result = JSON.parse(resultJson);
         this._address = result.address;
         this.listening = true;
         this._handleId = `http-server:${this._serverId}`;
@@ -1149,10 +1187,13 @@ class Server {
                     await this._listenPromise;
                 }
                 if (this.listening && typeof _networkHttpServerCloseRaw !== "undefined") {
-                    await _networkHttpServerCloseRaw(this._serverId);
+                    await _networkHttpServerCloseRaw.apply(undefined, [this._serverId], {
+                        result: { promise: true },
+                    });
                 }
                 this.listening = false;
                 this._address = null;
+                serverInstances.delete(this._serverId);
                 if (this._handleId && typeof _unregisterHandle === "function") {
                     _unregisterHandle(this._handleId);
                 }
@@ -1225,11 +1266,12 @@ class Server {
     }
 }
 /** Route an incoming HTTP request to the server's request listener and return the serialized response. */
-async function dispatchServerRequest(serverId, request) {
+async function dispatchServerRequest(serverId, requestJson) {
     const listener = serverRequestListeners.get(serverId);
     if (!listener) {
         throw new Error(`Unknown HTTP server: ${serverId}`);
     }
+    const request = JSON.parse(requestJson);
     const incoming = new ServerIncomingMessage(request);
     const outgoing = new ServerResponseBridge();
     try {
@@ -1257,7 +1299,184 @@ async function dispatchServerRequest(serverId, request) {
         outgoing.end();
     }
     await outgoing.waitForClose();
-    return outgoing.serialize();
+    return JSON.stringify(outgoing.serialize());
+}
+// Upgrade socket for bidirectional data relay through the host bridge
+const upgradeSocketInstances = new Map();
+class UpgradeSocket {
+    remoteAddress;
+    remotePort;
+    localAddress = "127.0.0.1";
+    localPort = 0;
+    connecting = false;
+    destroyed = false;
+    writable = true;
+    readable = true;
+    readyState = "open";
+    bytesWritten = 0;
+    _listeners = {};
+    _socketId;
+    // Readable stream state stub for ws compatibility (socketOnClose checks _readableState.endEmitted)
+    _readableState = { endEmitted: false };
+    _writableState = { finished: false, errorEmitted: false };
+    constructor(socketId, options) {
+        this._socketId = socketId;
+        this.remoteAddress = options?.host || "127.0.0.1";
+        this.remotePort = options?.port || 80;
+    }
+    setTimeout(_ms, _cb) { return this; }
+    setNoDelay(_noDelay) { return this; }
+    setKeepAlive(_enable, _delay) { return this; }
+    ref() { return this; }
+    unref() { return this; }
+    cork() { }
+    uncork() { }
+    pause() { return this; }
+    resume() { return this; }
+    address() {
+        return { address: this.localAddress, family: "IPv4", port: this.localPort };
+    }
+    on(event, listener) {
+        if (!this._listeners[event])
+            this._listeners[event] = [];
+        this._listeners[event].push(listener);
+        return this;
+    }
+    addListener(event, listener) {
+        return this.on(event, listener);
+    }
+    once(event, listener) {
+        const wrapper = (...args) => {
+            this.off(event, wrapper);
+            listener(...args);
+        };
+        return this.on(event, wrapper);
+    }
+    off(event, listener) {
+        if (this._listeners[event]) {
+            const idx = this._listeners[event].indexOf(listener);
+            if (idx !== -1)
+                this._listeners[event].splice(idx, 1);
+        }
+        return this;
+    }
+    removeListener(event, listener) {
+        return this.off(event, listener);
+    }
+    removeAllListeners(event) {
+        if (event) {
+            delete this._listeners[event];
+        }
+        else {
+            this._listeners = {};
+        }
+        return this;
+    }
+    emit(event, ...args) {
+        const handlers = this._listeners[event];
+        if (handlers)
+            handlers.slice().forEach((fn) => fn.call(this, ...args));
+        return handlers !== undefined && handlers.length > 0;
+    }
+    listenerCount(event) {
+        return this._listeners[event]?.length || 0;
+    }
+    write(data, encodingOrCb, cb) {
+        if (this.destroyed)
+            return false;
+        const callback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
+        if (typeof _upgradeSocketWriteRaw !== "undefined") {
+            let base64;
+            if (typeof Buffer !== "undefined" && Buffer.isBuffer(data)) {
+                base64 = data.toString("base64");
+            }
+            else if (typeof data === "string") {
+                base64 = typeof Buffer !== "undefined" ? Buffer.from(data).toString("base64") : btoa(data);
+            }
+            else if (data instanceof Uint8Array) {
+                base64 = typeof Buffer !== "undefined" ? Buffer.from(data).toString("base64") : btoa(String.fromCharCode(...data));
+            }
+            else {
+                base64 = typeof Buffer !== "undefined" ? Buffer.from(String(data)).toString("base64") : btoa(String(data));
+            }
+            this.bytesWritten += base64.length;
+            _upgradeSocketWriteRaw.applySync(undefined, [this._socketId, base64]);
+        }
+        if (callback)
+            callback();
+        return true;
+    }
+    end(data) {
+        if (data)
+            this.write(data);
+        if (typeof _upgradeSocketEndRaw !== "undefined" && !this.destroyed) {
+            _upgradeSocketEndRaw.applySync(undefined, [this._socketId]);
+        }
+        this.writable = false;
+        this.emit("finish");
+        return this;
+    }
+    destroy(err) {
+        if (this.destroyed)
+            return this;
+        this.destroyed = true;
+        this.writable = false;
+        this.readable = false;
+        this._readableState.endEmitted = true;
+        this._writableState.finished = true;
+        if (typeof _upgradeSocketDestroyRaw !== "undefined") {
+            _upgradeSocketDestroyRaw.applySync(undefined, [this._socketId]);
+        }
+        upgradeSocketInstances.delete(this._socketId);
+        if (err)
+            this.emit("error", err);
+        this.emit("close", false);
+        return this;
+    }
+    // Push data received from the host into this socket
+    _pushData(data) {
+        this.emit("data", data);
+    }
+    // Signal end-of-stream from the host
+    _pushEnd() {
+        this.readable = false;
+        this._readableState.endEmitted = true;
+        this._writableState.finished = true;
+        this.emit("end");
+        this.emit("close", false);
+        upgradeSocketInstances.delete(this._socketId);
+    }
+}
+/** Route an incoming HTTP upgrade to the server's 'upgrade' event listeners. */
+function dispatchUpgradeRequest(serverId, requestJson, headBase64, socketId) {
+    const server = serverInstances.get(serverId);
+    if (!server) {
+        throw new Error(`Unknown HTTP server for upgrade: ${serverId}`);
+    }
+    const request = JSON.parse(requestJson);
+    const incoming = new ServerIncomingMessage(request);
+    const head = typeof Buffer !== "undefined" ? Buffer.from(headBase64, "base64") : new Uint8Array(0);
+    const socket = new UpgradeSocket(socketId, {
+        host: incoming.headers["host"]?.split(":")[0] || "127.0.0.1",
+    });
+    upgradeSocketInstances.set(socketId, socket);
+    // Emit 'upgrade' on the server — ws.WebSocketServer listens for this
+    server._emit("upgrade", incoming, socket, head);
+}
+/** Push data from host to an upgrade socket. */
+function onUpgradeSocketData(socketId, dataBase64) {
+    const socket = upgradeSocketInstances.get(socketId);
+    if (socket) {
+        const data = typeof Buffer !== "undefined" ? Buffer.from(dataBase64, "base64") : new Uint8Array(0);
+        socket._pushData(data);
+    }
+}
+/** Signal end-of-stream from host to an upgrade socket. */
+function onUpgradeSocketEnd(socketId) {
+    const socket = upgradeSocketInstances.get(socketId);
+    if (socket) {
+        socket._pushEnd();
+    }
 }
 // Function-based ServerResponse constructor — allows .call() inheritance
 // used by light-my-request (Fastify's inject), which does
@@ -1403,12 +1622,408 @@ export const http2 = {
         throw new Error("http2.createSecureServer is not supported in sandbox");
     },
 };
+// ----------------------------------------------------------------
+// net module — TCP socket bridge
+// ----------------------------------------------------------------
+const netSocketInstances = new Map();
+class NetSocket {
+    remoteAddress = "";
+    remotePort = 0;
+    remoteFamily = "";
+    localAddress = "0.0.0.0";
+    localPort = 0;
+    connecting = true;
+    pending = true;
+    destroyed = false;
+    writable = true;
+    readable = true;
+    readyState = "opening";
+    bytesRead = 0;
+    bytesWritten = 0;
+    _listeners = {};
+    /** @internal socket ID shared with TLS upgrade bridge */
+    _socketId = -1;
+    _connectHost = "";
+    _connectPort = 0;
+    // Stream state stubs for compatibility (ssh2 checks _readableState.ended)
+    _readableState = { endEmitted: false, ended: false };
+    _writableState = { finished: false, errorEmitted: false, ended: false };
+    constructor(_options) {
+        // Options like { allowHalfOpen } are accepted but ignored
+    }
+    connect(...args) {
+        // Parse overloaded signatures: connect(port, host?, cb?) or connect({port, host}, cb?)
+        let port;
+        let host;
+        let connectListener;
+        if (typeof args[0] === "object" && args[0] !== null) {
+            const opts = args[0];
+            port = Number(opts.port);
+            host = String(opts.host || "127.0.0.1");
+            if (typeof args[1] === "function")
+                connectListener = args[1];
+        }
+        else {
+            port = Number(args[0]);
+            host = typeof args[1] === "string" ? args[1] : "127.0.0.1";
+            if (typeof args[1] === "function") {
+                connectListener = args[1];
+                host = "127.0.0.1";
+            }
+            else if (typeof args[2] === "function") {
+                connectListener = args[2];
+            }
+        }
+        this._connectHost = host;
+        this._connectPort = port;
+        if (connectListener)
+            this.once("connect", connectListener);
+        if (typeof _netSocketConnectRaw === "undefined") {
+            // Schedule error emission asynchronously like real Node
+            Promise.resolve().then(() => {
+                const err = new Error("net.Socket requires NetworkAdapter to be configured");
+                this._onError(err.message);
+            });
+            return this;
+        }
+        // Register active handle
+        if (typeof _registerHandle !== "undefined") {
+            _registerHandle(`net.socket:${host}:${port}`, `TCP connection to ${host}:${port}`);
+        }
+        // Synchronous call: host creates socket, starts connecting, returns socketId
+        this._socketId = _netSocketConnectRaw.applySync(undefined, [host, port]);
+        netSocketInstances.set(this._socketId, this);
+        return this;
+    }
+    setTimeout(_ms, _cb) { return this; }
+    setNoDelay(_noDelay) { return this; }
+    setKeepAlive(_enable, _delay) { return this; }
+    setMaxListeners(_n) { return this; }
+    getMaxListeners() { return 10; }
+    ref() { return this; }
+    unref() { return this; }
+    cork() { }
+    uncork() { }
+    pause() { return this; }
+    resume() { return this; }
+    pipe(destination) { return destination; }
+    address() {
+        return { address: this.localAddress, family: "IPv4", port: this.localPort };
+    }
+    listeners(event) {
+        return (this._listeners[event] || []).slice();
+    }
+    rawListeners(event) {
+        return this.listeners(event);
+    }
+    eventNames() {
+        return Object.keys(this._listeners).filter((k) => (this._listeners[k]?.length ?? 0) > 0);
+    }
+    prependListener(event, listener) {
+        if (!this._listeners[event])
+            this._listeners[event] = [];
+        this._listeners[event].unshift(listener);
+        return this;
+    }
+    prependOnceListener(event, listener) {
+        const wrapper = (...args) => {
+            this.off(event, wrapper);
+            listener(...args);
+        };
+        return this.prependListener(event, wrapper);
+    }
+    on(event, listener) {
+        if (!this._listeners[event])
+            this._listeners[event] = [];
+        this._listeners[event].push(listener);
+        return this;
+    }
+    addListener(event, listener) { return this.on(event, listener); }
+    once(event, listener) {
+        const wrapper = (...args) => {
+            this.off(event, wrapper);
+            listener(...args);
+        };
+        return this.on(event, wrapper);
+    }
+    off(event, listener) {
+        if (this._listeners[event]) {
+            const idx = this._listeners[event].indexOf(listener);
+            if (idx !== -1)
+                this._listeners[event].splice(idx, 1);
+        }
+        return this;
+    }
+    removeListener(event, listener) { return this.off(event, listener); }
+    removeAllListeners(event) {
+        if (event) {
+            delete this._listeners[event];
+        }
+        else {
+            this._listeners = {};
+        }
+        return this;
+    }
+    emit(event, ...args) {
+        const handlers = this._listeners[event];
+        if (handlers)
+            handlers.slice().forEach((fn) => fn.call(this, ...args));
+        return handlers !== undefined && handlers.length > 0;
+    }
+    listenerCount(event) {
+        return this._listeners[event]?.length || 0;
+    }
+    write(data, encodingOrCb, cb) {
+        if (this.destroyed)
+            return false;
+        const callback = typeof encodingOrCb === "function" ? encodingOrCb : cb;
+        if (typeof _netSocketWriteRaw !== "undefined" && this._socketId >= 0) {
+            let base64;
+            if (typeof Buffer !== "undefined" && Buffer.isBuffer(data)) {
+                base64 = data.toString("base64");
+            }
+            else if (typeof data === "string") {
+                const encoding = typeof encodingOrCb === "string" ? encodingOrCb : "utf8";
+                base64 = typeof Buffer !== "undefined" ? Buffer.from(data, encoding).toString("base64") : btoa(data);
+            }
+            else if (data instanceof Uint8Array) {
+                base64 = typeof Buffer !== "undefined" ? Buffer.from(data).toString("base64") : btoa(String.fromCharCode(...data));
+            }
+            else {
+                base64 = typeof Buffer !== "undefined" ? Buffer.from(String(data)).toString("base64") : btoa(String(data));
+            }
+            this.bytesWritten += base64.length;
+            _netSocketWriteRaw.applySync(undefined, [this._socketId, base64]);
+        }
+        if (callback)
+            callback();
+        return true;
+    }
+    end(data, encodingOrCb, cb) {
+        if (data !== undefined && data !== null)
+            this.write(data, encodingOrCb, cb);
+        if (typeof _netSocketEndRaw !== "undefined" && this._socketId >= 0 && !this.destroyed) {
+            _netSocketEndRaw.applySync(undefined, [this._socketId]);
+        }
+        this.writable = false;
+        this.readyState = this.readable ? "readOnly" : "closed";
+        this.emit("finish");
+        return this;
+    }
+    destroy(err) {
+        if (this.destroyed)
+            return this;
+        this.destroyed = true;
+        this.writable = false;
+        this.readable = false;
+        this.readyState = "closed";
+        this._readableState.endEmitted = true;
+        this._writableState.finished = true;
+        if (typeof _netSocketDestroyRaw !== "undefined" && this._socketId >= 0) {
+            _netSocketDestroyRaw.applySync(undefined, [this._socketId]);
+        }
+        this._cleanup();
+        if (err)
+            this.emit("error", err);
+        this.emit("close", !!err);
+        return this;
+    }
+    // Host→Guest event dispatch handlers
+    _onConnect() {
+        this.connecting = false;
+        this.pending = false;
+        this.remoteAddress = this._connectHost;
+        this.remotePort = this._connectPort;
+        this.remoteFamily = "IPv4";
+        this.readyState = "open";
+        this.emit("connect");
+        this.emit("ready");
+    }
+    _onData(dataBase64) {
+        const buf = typeof Buffer !== "undefined" ? Buffer.from(dataBase64, "base64") : new Uint8Array(0);
+        this.bytesRead += buf.length;
+        this.emit("data", buf);
+    }
+    _onEnd() {
+        this.readable = false;
+        this._readableState.endEmitted = true;
+        this._readableState.ended = true;
+        this.readyState = this.writable ? "writeOnly" : "closed";
+        this.emit("end");
+    }
+    _onError(message) {
+        const err = new Error(message);
+        this.destroy(err);
+    }
+    _onClose(hadError) {
+        this._cleanup();
+        if (!this.destroyed) {
+            this.destroyed = true;
+            this.readable = false;
+            this.writable = false;
+            this.readyState = "closed";
+            this.emit("close", hadError);
+        }
+    }
+    _cleanup() {
+        if (this._socketId >= 0) {
+            netSocketInstances.delete(this._socketId);
+            if (typeof _unregisterHandle !== "undefined") {
+                _unregisterHandle(`net.socket:${this._connectHost}:${this._connectPort}`);
+            }
+        }
+    }
+}
+/** Dispatch events from host to guest net sockets. */
+function onNetSocketDispatch(socketId, type, data) {
+    const socket = netSocketInstances.get(socketId);
+    if (!socket)
+        return;
+    switch (type) {
+        case "connect":
+            socket._onConnect();
+            break;
+        case "data":
+            socket._onData(data);
+            break;
+        case "end":
+            socket._onEnd();
+            break;
+        case "error":
+            socket._onError(data);
+            break;
+        case "close":
+            socket._onClose(data === "1");
+            break;
+        case "secureConnect":
+            socket.emit("secureConnect");
+            break;
+    }
+}
+// Validate IP address format
+function netIsIP(input) {
+    if (typeof input !== "string")
+        return 0;
+    // IPv4: four octets 0-255
+    if (/^(\d{1,3}\.){3}\d{1,3}$/.test(input)) {
+        const parts = input.split(".");
+        if (parts.every((p) => { const n = Number(p); return n >= 0 && n <= 255; }))
+            return 4;
+    }
+    // IPv6: simplified check
+    if (/^(::)?([0-9a-fA-F]{1,4}(::?)){0,7}([0-9a-fA-F]{1,4})?$/.test(input))
+        return 6;
+    if (/^::ffff:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(input))
+        return 6;
+    return 0;
+}
+export const net = {
+    Socket: NetSocket,
+    connect(portOrOpts, hostOrCb, cb) {
+        const socket = new NetSocket();
+        socket.connect(portOrOpts, hostOrCb, cb);
+        return socket;
+    },
+    createConnection(portOrOpts, hostOrCb, cb) {
+        return net.connect(portOrOpts, hostOrCb, cb);
+    },
+    createServer() {
+        throw new Error("net.createServer is not supported in sandbox");
+    },
+    isIP: netIsIP,
+    isIPv4(input) { return netIsIP(input) === 4; },
+    isIPv6(input) { return netIsIP(input) === 6; },
+};
+// ----------------------------------------------------------------
+// tls module — TLS socket upgrade bridge
+// ----------------------------------------------------------------
+/** TLS socket that wraps an existing NetSocket after host-side TLS upgrade. */
+class TLSSocket extends NetSocket {
+    encrypted = true;
+    authorized = false;
+    authorizationError = null;
+    alpnProtocol = false;
+    _wrappedSocket = null;
+    constructor(originalSocket) {
+        super();
+        this._wrappedSocket = originalSocket;
+        // Copy connection state from original socket
+        this.remoteAddress = originalSocket.remoteAddress;
+        this.remotePort = originalSocket.remotePort;
+        this.remoteFamily = originalSocket.remoteFamily;
+        this.localAddress = originalSocket.localAddress;
+        this.localPort = originalSocket.localPort;
+        this.connecting = false;
+        this.pending = false;
+        this.readyState = "open";
+        // Share the same socketId — bridge events route here after upgrade
+        this._socketId = originalSocket._socketId;
+        // Copy private connect info so _cleanup unregisters the correct handle
+        this._connectHost = originalSocket._connectHost;
+        this._connectPort = originalSocket._connectPort;
+        netSocketInstances.set(this._socketId, this);
+    }
+    _onSecureConnect() {
+        this.authorized = true;
+        this.emit("secureConnect");
+    }
+    // Forward end/close to the wrapped raw socket — Node.js tls.TLSSocket
+    // closes the underlying socket, which fires its 'close' event. Libraries
+    // like pg rely on the original socket's 'close' listener to detect shutdown.
+    _onEnd() {
+        super._onEnd();
+        if (this._wrappedSocket)
+            this._wrappedSocket._onEnd();
+    }
+    _onClose(hadError) {
+        super._onClose(hadError);
+        if (this._wrappedSocket) {
+            this._wrappedSocket._onClose(hadError);
+            this._wrappedSocket = null;
+        }
+    }
+}
+export const tlsModule = {
+    TLSSocket: TLSSocket,
+    connect(options) {
+        const existingSocket = options.socket;
+        if (!existingSocket || existingSocket._socketId < 0) {
+            throw new Error("tls.connect requires an existing connected socket via options.socket");
+        }
+        // Create TLS socket wrapper on sandbox side
+        const tlsSocket = new TLSSocket(existingSocket);
+        if (typeof _netSocketUpgradeTlsRaw === "undefined") {
+            Promise.resolve().then(() => {
+                tlsSocket._onError("tls.connect requires NetworkAdapter TLS support");
+            });
+            return tlsSocket;
+        }
+        // Tell host to wrap the underlying TCP socket with TLS
+        _netSocketUpgradeTlsRaw.applySync(undefined, [
+            existingSocket._socketId,
+            JSON.stringify({
+                rejectUnauthorized: options.rejectUnauthorized ?? true,
+                servername: options.servername,
+            }),
+        ]);
+        return tlsSocket;
+    },
+    createSecureContext(_options) {
+        return {};
+    },
+};
 // Export modules and make them available as globals for require()
 exposeCustomGlobal("_httpModule", http);
 exposeCustomGlobal("_httpsModule", https);
 exposeCustomGlobal("_http2Module", http2);
 exposeCustomGlobal("_dnsModule", dns);
+exposeCustomGlobal("_netModule", net);
+exposeCustomGlobal("_tlsModule", tlsModule);
 exposeCustomGlobal("_httpServerDispatch", dispatchServerRequest);
+exposeCustomGlobal("_httpServerUpgradeDispatch", dispatchUpgradeRequest);
+exposeCustomGlobal("_upgradeSocketData", onUpgradeSocketData);
+exposeCustomGlobal("_upgradeSocketEnd", onUpgradeSocketEnd);
+exposeCustomGlobal("_netSocketDispatch", onNetSocketDispatch);
 // Harden fetch API globals (non-writable, non-configurable)
 exposeCustomGlobal("fetch", fetch);
 exposeCustomGlobal("Headers", Headers);
@@ -1428,6 +2043,8 @@ export default {
     http,
     https,
     http2,
+    net,
+    tls: tlsModule,
     IncomingMessage,
     ClientRequest,
 };