@volter/tabnode 0.5.19 → 0.5.20

package/dist/assets/{runtime-worker-ChOZScpd.js → runtime-worker-IRKbkQwk.js}

@@ -19014,16 +19014,30 @@ nodePath.parse;
 nodePath.format;
 nodePath.toNamespacedPath;
 nodePath.matchesGlob;
+function loopback(host) {
+  const bare = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+  const name = bare.toLowerCase();
+  return name === "" || name === "localhost" || name === "::1" || name.startsWith("127.");
+}
 function createTlsModule(require2) {
   const NetSocket = require2 ? require2("net").Socket : lazyExport("net", "Socket");
-  const Events = require2 ? require2("events").EventEmitter : EventEmitter;
+  const netServer = () => (require2 ? require2("net") : nodeLibInternalRequire("net")).Server;
   class TLSSocket2 extends NetSocket {
     constructor(_socket, _options3) {
       super({ allowHalfOpen: false });
       __publicField(this, "authorized", false);
       __publicField(this, "encrypted", true);
     }
-    connect(..._args) {
+    connect(...args) {
+      const options = args[0];
+      const host = String((options == null ? void 0 : options.host) ?? (options == null ? void 0 : options.hostname) ?? "localhost");
+      if (options && typeof options === "object" && options.socket === void 0 && loopback(host)) {
+        this.once("connect", () => {
+          this.authorized = true;
+          this.emit("secureConnect");
+        });
+        return NetSocket.prototype.connect.call(this, { port: options.port, host });
+      }
       this.connecting = true;
       queueMicrotask(() => queueMicrotask(() => this.destroy(Object.assign(
         new Error("TLS transport is unavailable in this runtime; HTTPS requires an admitted HTTP transport."),
@@ -19046,34 +19060,53 @@ function createTlsModule(require2) {
       return false;
     }
   }
-  class Server2 extends Events {
-    constructor(_options3, _connectionListener) {
-      super();
+  let chained = false;
+  const Server2 = function TLSServer(options, secureConnectionListener) {
+    if (!(this instanceof Server2)) return new Server2(options, secureConnectionListener);
+    const NetServer = netServer();
+    if (!chained) {
+      Object.setPrototypeOf(Server2.prototype, NetServer.prototype);
+      Object.setPrototypeOf(Server2, NetServer);
+      chained = true;
     }
-    listen(..._args) {
-      return this;
-    }
-    close(_callback3) {
-      return this;
-    }
-    address() {
-      return null;
+    if (typeof options === "function") {
+      secureConnectionListener = options;
+      options = {};
     }
+    NetServer.call(this, options ?? {}, function secure(socket) {
+      socket.encrypted = true;
+      socket.authorized = false;
+      this.emit("secureConnection", socket);
+    });
+    if (secureConnectionListener) this.on("secureConnection", secureConnectionListener);
+    return this;
+  };
+  Object.assign(Server2.prototype, {
+    addContext(_hostname, _context) {
+    },
     getTicketKeys() {
       return (require2 ? require2("buffer").Buffer : Buffer).from("");
-    }
+    },
     setTicketKeys(_keys) {
-    }
+    },
     setSecureContext(_options3) {
     }
+  });
+  function createServer2(options, secureConnectionListener) {
+    return new Server2(options, secureConnectionListener);
   }
-  function createServer2(_options3, _connectionListener) {
-    return new Server2(_options3, _connectionListener);
-  }
-  function connect2(_options3, _callback3) {
+  function connect2(...args) {
+    const options = {};
+    let callback;
+    for (const arg of args) {
+      if (typeof arg === "function") callback = arg;
+      else if (typeof arg === "number" || typeof arg === "string" && options.port === void 0 && /^\d+$/u.test(arg)) options.port = arg;
+      else if (typeof arg === "string") options.host = arg;
+      else if (arg && typeof arg === "object") Object.assign(options, arg);
+    }
     const socket = new TLSSocket2();
-    if (_callback3) socket.once("secureConnect", _callback3);
-    return socket.connect();
+    if (callback) socket.once("secureConnect", callback);
+    return socket.connect(options);
   }
   const createSecureContext2 = (_options3) => ({});
   const getCiphers2 = () => ["TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256"];
@@ -21103,10 +21136,17 @@ var implementation$1 = function bind2(that) {
 var implementation = implementation$1;
 var functionBind = Function.prototype.bind || implementation;
 var functionCall = Function.prototype.call;
-var functionApply = Function.prototype.apply;
+var functionApply;
+var hasRequiredFunctionApply;
+function requireFunctionApply() {
+  if (hasRequiredFunctionApply) return functionApply;
+  hasRequiredFunctionApply = 1;
+  functionApply = Function.prototype.apply;
+  return functionApply;
+}
 var reflectApply = typeof Reflect !== "undefined" && Reflect && Reflect.apply;
 var bind$2 = functionBind;
-var $apply$1 = functionApply;
+var $apply$1 = requireFunctionApply();
 var $call$2 = functionCall;
 var $reflectApply = reflectApply;
 var actualApply = $reflectApply || bind$2.call($call$2, $apply$1);
@@ -21226,7 +21266,7 @@ var hasSymbols = requireHasSymbols()();
 var getProto = requireGetProto();
 var $ObjectGPO = requireObject_getPrototypeOf();
 var $ReflectGPO = requireReflect_getPrototypeOf();
-var $apply = functionApply;
+var $apply = requireFunctionApply();
 var $call = functionCall;
 var needsEval = {};
 var TypedArray = typeof Uint8Array === "undefined" || !getProto ? undefined$1 : getProto(Uint8Array);
@@ -21867,7 +21907,7 @@ function requireApplyBind() {
   if (hasRequiredApplyBind) return applyBind;
   hasRequiredApplyBind = 1;
   var bind3 = functionBind;
-  var $apply2 = functionApply;
+  var $apply2 = requireFunctionApply();
   var actualApply$1 = actualApply;
   applyBind = function applyBind2() {
     return actualApply$1(bind3, $apply2, arguments);

package/dist/index.mjs

@@ -19190,16 +19190,30 @@ const path = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty
   toNamespacedPath,
   win32
 }, Symbol.toStringTag, { value: "Module" }));
+function loopback(host2) {
+  const bare = host2.startsWith("[") && host2.endsWith("]") ? host2.slice(1, -1) : host2;
+  const name = bare.toLowerCase();
+  return name === "" || name === "localhost" || name === "::1" || name.startsWith("127.");
+}
 function createTlsModule(require2) {
   const NetSocket = require2 ? require2("net").Socket : lazyExport("net", "Socket");
-  const Events = require2 ? require2("events").EventEmitter : EventEmitter;
+  const netServer = () => (require2 ? require2("net") : nodeLibInternalRequire("net")).Server;
   class TLSSocket2 extends NetSocket {
     constructor(_socket, _options2) {
       super({ allowHalfOpen: false });
       __publicField(this, "authorized", false);
       __publicField(this, "encrypted", true);
     }
-    connect(..._args) {
+    connect(...args) {
+      const options = args[0];
+      const host2 = String((options == null ? void 0 : options.host) ?? (options == null ? void 0 : options.hostname) ?? "localhost");
+      if (options && typeof options === "object" && options.socket === void 0 && loopback(host2)) {
+        this.once("connect", () => {
+          this.authorized = true;
+          this.emit("secureConnect");
+        });
+        return NetSocket.prototype.connect.call(this, { port: options.port, host: host2 });
+      }
       this.connecting = true;
       queueMicrotask(() => queueMicrotask(() => this.destroy(Object.assign(
         new Error("TLS transport is unavailable in this runtime; HTTPS requires an admitted HTTP transport."),
@@ -19222,34 +19236,53 @@ function createTlsModule(require2) {
       return false;
     }
   }
-  class Server2 extends Events {
-    constructor(_options2, _connectionListener) {
-      super();
+  let chained = false;
+  const Server2 = function TLSServer(options, secureConnectionListener) {
+    if (!(this instanceof Server2)) return new Server2(options, secureConnectionListener);
+    const NetServer = netServer();
+    if (!chained) {
+      Object.setPrototypeOf(Server2.prototype, NetServer.prototype);
+      Object.setPrototypeOf(Server2, NetServer);
+      chained = true;
     }
-    listen(..._args) {
-      return this;
-    }
-    close(_callback3) {
-      return this;
-    }
-    address() {
-      return null;
+    if (typeof options === "function") {
+      secureConnectionListener = options;
+      options = {};
     }
+    NetServer.call(this, options ?? {}, function secure(socket) {
+      socket.encrypted = true;
+      socket.authorized = false;
+      this.emit("secureConnection", socket);
+    });
+    if (secureConnectionListener) this.on("secureConnection", secureConnectionListener);
+    return this;
+  };
+  Object.assign(Server2.prototype, {
+    addContext(_hostname, _context) {
+    },
     getTicketKeys() {
       return (require2 ? require2("buffer").Buffer : Buffer).from("");
-    }
+    },
     setTicketKeys(_keys) {
-    }
+    },
     setSecureContext(_options2) {
     }
+  });
+  function createServer2(options, secureConnectionListener) {
+    return new Server2(options, secureConnectionListener);
   }
-  function createServer2(_options2, _connectionListener) {
-    return new Server2(_options2, _connectionListener);
-  }
-  function connect2(_options2, _callback3) {
+  function connect2(...args) {
+    const options = {};
+    let callback;
+    for (const arg of args) {
+      if (typeof arg === "function") callback = arg;
+      else if (typeof arg === "number" || typeof arg === "string" && options.port === void 0 && /^\d+$/u.test(arg)) options.port = arg;
+      else if (typeof arg === "string") options.host = arg;
+      else if (arg && typeof arg === "object") Object.assign(options, arg);
+    }
     const socket = new TLSSocket2();
-    if (_callback3) socket.once("secureConnect", _callback3);
-    return socket.connect();
+    if (callback) socket.once("secureConnect", callback);
+    return socket.connect(options);
   }
   const createSecureContext2 = (_options2) => ({});
   const getCiphers2 = () => ["TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256"];
@@ -21279,10 +21312,17 @@ var implementation$1 = function bind2(that) {
 var implementation = implementation$1;
 var functionBind = Function.prototype.bind || implementation;
 var functionCall = Function.prototype.call;
-var functionApply = Function.prototype.apply;
+var functionApply;
+var hasRequiredFunctionApply;
+function requireFunctionApply() {
+  if (hasRequiredFunctionApply) return functionApply;
+  hasRequiredFunctionApply = 1;
+  functionApply = Function.prototype.apply;
+  return functionApply;
+}
 var reflectApply = typeof Reflect !== "undefined" && Reflect && Reflect.apply;
 var bind$2 = functionBind;
-var $apply$1 = functionApply;
+var $apply$1 = requireFunctionApply();
 var $call$2 = functionCall;
 var $reflectApply = reflectApply;
 var actualApply = $reflectApply || bind$2.call($call$2, $apply$1);
@@ -21402,7 +21442,7 @@ var hasSymbols = requireHasSymbols()();
 var getProto = requireGetProto();
 var $ObjectGPO = requireObject_getPrototypeOf();
 var $ReflectGPO = requireReflect_getPrototypeOf();
-var $apply = functionApply;
+var $apply = requireFunctionApply();
 var $call = functionCall;
 var needsEval = {};
 var TypedArray = typeof Uint8Array === "undefined" || !getProto ? undefined$1 : getProto(Uint8Array);
@@ -22043,7 +22083,7 @@ function requireApplyBind() {
   if (hasRequiredApplyBind) return applyBind;
   hasRequiredApplyBind = 1;
   var bind3 = functionBind;
-  var $apply2 = functionApply;
+  var $apply2 = requireFunctionApply();
   var actualApply$1 = actualApply;
   applyBind = function applyBind2() {
     return actualApply$1(bind3, $apply2, arguments);
@@ -39787,7 +39827,7 @@ class WorkerRuntime {
     this.worker = new Worker(
       new URL(
         /* @vite-ignore */
-        "/assets/runtime-worker-ChOZScpd.js",
+        "/assets/runtime-worker-IRKbkQwk.js",
         import.meta.url
       ),
       { type: "module" }
@@ -40016,7 +40056,8 @@ function installHttpClientTransport(factory, transportOptions = {}) {
     const connect2 = function(options, callback) {
       var _a2;
       const host2 = String(options.hostname ?? options.host ?? "localhost").toLowerCase();
-      if (protocol === "http:" && (local(host2) || options.socketPath) && !(local(host2) && !options.socketPath && ((_a2 = transportOptions.hostPorts) == null ? void 0 : _a2.call(transportOptions).has(Number(options.port ?? 80))))) {
+      const hostPort = local(host2) && !options.socketPath && ((_a2 = transportOptions.hostPorts) == null ? void 0 : _a2.call(transportOptions).has(Number(options.port ?? (protocol === "https:" ? 443 : 80))));
+      if (!hostPort && (protocol === "http:" && (local(host2) || options.socketPath) || protocol === "https:" && local(host2) && !options.socketPath)) {
         return original.call(this, options, callback);
       }
       try {

package/dist/shims/tls.d.ts

@@ -1,75 +1,43 @@
 /**
- * tls shim - TLS/SSL is not available in browser
- * No TLS transport is installed. A connection must fail asynchronously rather
- * than pretending to connect and leaving Node's HTTPS client waiting forever.
+ * tls: a tab's loopback carries no wire to protect. A TLS server listens on
+ * the engine's loopback as a net server does and hands its connections on as
+ * secure; a TLS connect to a loopback port pairs with that listener the same
+ * way. Bytes cross unencrypted because nothing lies between the two ends, and
+ * the browser holds TLS wherever there is a wire: a page reaches a guest
+ * server through the sandbox origin, and a request to another host goes out
+ * through the page's HTTP transport. A TLS connect to any other host fails
+ * asynchronously, rather than pretending to connect and leaving Node's HTTPS
+ * client waiting forever.
  */
-/** Native TLS refusal keeps the requesting graph's Socket identity. */
+import type { Socket } from '../node-lib/net-module';
+import type { EventEmitter } from '../node-lib/events-module';
+/** A TLS server as Node's module exposes it: constructed with or without `new`. */
+export interface TlsServer extends EventEmitter {
+    listen(...args: unknown[]): this;
+    close(callback?: (err?: Error) => void): this;
+    address(): {
+        port: number;
+        family: string;
+        address: string;
+    } | string | null;
+    addContext(hostname: string, context: unknown): void;
+    getTicketKeys(): Buffer;
+    setTicketKeys(keys: Buffer): void;
+    setSecureContext(options: unknown): void;
+}
+export interface TlsServerConstructor {
+    new (options?: unknown, secureConnectionListener?: (socket: Socket) => void): TlsServer;
+    (options?: unknown, secureConnectionListener?: (socket: Socket) => void): TlsServer;
+    readonly prototype: TlsServer;
+}
+/** Each graph's TLS keeps that graph's Socket and Server identity. */
 export declare function createTlsModule(require?: (name: string) => any): {
     TLSSocket: {
         new (_socket?: unknown, _options?: unknown): {
             [key: string]: unknown;
             authorized: boolean;
             encrypted: boolean;
-            connect(..._args: unknown[]): /*elided*/ any;
-            getPeerCertificate(_detailed?: boolean): object;
-            getCipher(): {
-                name: string;
-                version: string;
-            } | null;
-            getProtocol(): string | null;
-            setServername(_name: string): void;
-            renegotiate(_options: unknown, _callback: (err: Error | null) => void): boolean;
-            connecting: boolean;
-            pending: boolean;
-            readyState: string;
-            bufferSize: number | undefined;
-            bytesRead: number;
-            bytesWritten: number | undefined;
-            localAddress: string | undefined;
-            localPort: number | undefined;
-            localFamily: string | undefined;
-            remoteAddress: string | undefined;
-            remotePort: number | undefined;
-            remoteFamily: string | undefined;
-            timeout?: number;
-            server: import("../node-lib/net-module").Server | null;
-            _server: import("../node-lib/net-module").Server | null;
-            _handle: import("../node-lib/binding/stream_wrap").LibuvStreamWrap | null;
-            address(): import("../node-lib/net-module").AddressInfo | Record<string, never>;
-            setTimeout(timeout: number, callback?: (() => void) | undefined): /*elided*/ any;
-            setNoDelay(enable?: boolean): /*elided*/ any;
-            setKeepAlive(enable?: boolean, initialDelay?: number): /*elided*/ any;
-            resetAndDestroy(): /*elided*/ any;
-            destroySoon(): void;
-            ref(): /*elided*/ any;
-            unref(): /*elided*/ any;
-            cork(): void;
-            uncork(): void;
-            push(chunk: unknown, encoding?: string): boolean;
-            read(size?: number): string | Uint8Array | null;
-            pause(): /*elided*/ any;
-            resume(): /*elided*/ any;
-            destroy(error?: Error): /*elided*/ any;
-            setEncoding(encoding: string): /*elided*/ any;
-            pipe(destination: unknown, options?: unknown): unknown;
-            on(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-            once(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-            emit(event: string, ...args: unknown[]): boolean;
-            readable: boolean;
-            readableEnded: boolean;
-            destroyed: boolean;
-            isTTY?: boolean;
-            write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
-            end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
-            writable: boolean;
-        };
-    };
-    Server: {
-        new (_options?: unknown, _connectionListener?: (socket: {
-            [key: string]: unknown;
-            authorized: boolean;
-            encrypted: boolean;
-            connect(..._args: unknown[]): /*elided*/ any;
+            connect(...args: unknown[]): /*elided*/ any;
             getPeerCertificate(_detailed?: boolean): object;
             getCipher(): {
                 name: string;
@@ -121,122 +89,15 @@ export declare function createTlsModule(require?: (name: string) => any): {
             write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
             end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
             writable: boolean;
-        }) => void): {
-            listen(..._args: unknown[]): /*elided*/ any;
-            close(_callback?: (err?: Error) => void): /*elided*/ any;
-            address(): {
-                port: number;
-                family: string;
-                address: string;
-            } | string | null;
-            getTicketKeys(): Buffer;
-            setTicketKeys(_keys: Buffer): void;
-            setSecureContext(_options: unknown): void;
-            addListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            on(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            once(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            removeListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            off(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            removeAllListeners(event?: string | symbol): /*elided*/ any;
-            setMaxListeners(n: number): /*elided*/ any;
-            getMaxListeners(): number;
-            listeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-            rawListeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-            emit(event: string | symbol, ...args: unknown[]): boolean;
-            listenerCount(event: string | symbol, listener?: import("../node-lib/events-module").EventListener): number;
-            prependListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            prependOnceListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            eventNames(): Array<string | symbol>;
         };
     };
-    createServer: (_options?: unknown, _connectionListener?: (socket: {
-        [key: string]: unknown;
-        authorized: boolean;
-        encrypted: boolean;
-        connect(..._args: unknown[]): /*elided*/ any;
-        getPeerCertificate(_detailed?: boolean): object;
-        getCipher(): {
-            name: string;
-            version: string;
-        } | null;
-        getProtocol(): string | null;
-        setServername(_name: string): void;
-        renegotiate(_options: unknown, _callback: (err: Error | null) => void): boolean;
-        connecting: boolean;
-        pending: boolean;
-        readyState: string;
-        bufferSize: number | undefined;
-        bytesRead: number;
-        bytesWritten: number | undefined;
-        localAddress: string | undefined;
-        localPort: number | undefined;
-        localFamily: string | undefined;
-        remoteAddress: string | undefined;
-        remotePort: number | undefined;
-        remoteFamily: string | undefined;
-        timeout?: number;
-        server: import("../node-lib/net-module").Server | null;
-        _server: import("../node-lib/net-module").Server | null;
-        _handle: import("../node-lib/binding/stream_wrap").LibuvStreamWrap | null;
-        address(): import("../node-lib/net-module").AddressInfo | Record<string, never>;
-        setTimeout(timeout: number, callback?: (() => void) | undefined): /*elided*/ any;
-        setNoDelay(enable?: boolean): /*elided*/ any;
-        setKeepAlive(enable?: boolean, initialDelay?: number): /*elided*/ any;
-        resetAndDestroy(): /*elided*/ any;
-        destroySoon(): void;
-        ref(): /*elided*/ any;
-        unref(): /*elided*/ any;
-        cork(): void;
-        uncork(): void;
-        push(chunk: unknown, encoding?: string): boolean;
-        read(size?: number): string | Uint8Array | null;
-        pause(): /*elided*/ any;
-        resume(): /*elided*/ any;
-        destroy(error?: Error): /*elided*/ any;
-        setEncoding(encoding: string): /*elided*/ any;
-        pipe(destination: unknown, options?: unknown): unknown;
-        on(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-        once(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-        emit(event: string, ...args: unknown[]): boolean;
-        readable: boolean;
-        readableEnded: boolean;
-        destroyed: boolean;
-        isTTY?: boolean;
-        write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
-        end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
-        writable: boolean;
-    }) => void) => {
-        listen(..._args: unknown[]): /*elided*/ any;
-        close(_callback?: (err?: Error) => void): /*elided*/ any;
-        address(): {
-            port: number;
-            family: string;
-            address: string;
-        } | string | null;
-        getTicketKeys(): Buffer;
-        setTicketKeys(_keys: Buffer): void;
-        setSecureContext(_options: unknown): void;
-        addListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        on(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        once(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        removeListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        off(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        removeAllListeners(event?: string | symbol): /*elided*/ any;
-        setMaxListeners(n: number): /*elided*/ any;
-        getMaxListeners(): number;
-        listeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-        rawListeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-        emit(event: string | symbol, ...args: unknown[]): boolean;
-        listenerCount(event: string | symbol, listener?: import("../node-lib/events-module").EventListener): number;
-        prependListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        prependOnceListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        eventNames(): Array<string | symbol>;
-    };
-    connect: (_options: unknown, _callback?: () => void) => {
+    Server: TlsServerConstructor;
+    createServer: (options?: unknown, secureConnectionListener?: (socket: Socket) => void) => TlsServer;
+    connect: (...args: unknown[]) => {
         [key: string]: unknown;
         authorized: boolean;
         encrypted: boolean;
-        connect(..._args: unknown[]): /*elided*/ any;
+        connect(...args: unknown[]): /*elided*/ any;
         getPeerCertificate(_detailed?: boolean): object;
         getCipher(): {
             name: string;
@@ -303,7 +164,7 @@ declare const tls: {
             [key: string]: unknown;
             authorized: boolean;
             encrypted: boolean;
-            connect(..._args: unknown[]): /*elided*/ any;
+            connect(...args: unknown[]): /*elided*/ any;
             getPeerCertificate(_detailed?: boolean): object;
             getCipher(): {
                 name: string;
@@ -357,179 +218,13 @@ declare const tls: {
             writable: boolean;
         };
     };
-    Server: {
-        new (_options?: unknown, _connectionListener?: (socket: {
-            [key: string]: unknown;
-            authorized: boolean;
-            encrypted: boolean;
-            connect(..._args: unknown[]): /*elided*/ any;
-            getPeerCertificate(_detailed?: boolean): object;
-            getCipher(): {
-                name: string;
-                version: string;
-            } | null;
-            getProtocol(): string | null;
-            setServername(_name: string): void;
-            renegotiate(_options: unknown, _callback: (err: Error | null) => void): boolean;
-            connecting: boolean;
-            pending: boolean;
-            readyState: string;
-            bufferSize: number | undefined;
-            bytesRead: number;
-            bytesWritten: number | undefined;
-            localAddress: string | undefined;
-            localPort: number | undefined;
-            localFamily: string | undefined;
-            remoteAddress: string | undefined;
-            remotePort: number | undefined;
-            remoteFamily: string | undefined;
-            timeout?: number;
-            server: import("../node-lib/net-module").Server | null;
-            _server: import("../node-lib/net-module").Server | null;
-            _handle: import("../node-lib/binding/stream_wrap").LibuvStreamWrap | null;
-            address(): import("../node-lib/net-module").AddressInfo | Record<string, never>;
-            setTimeout(timeout: number, callback?: (() => void) | undefined): /*elided*/ any;
-            setNoDelay(enable?: boolean): /*elided*/ any;
-            setKeepAlive(enable?: boolean, initialDelay?: number): /*elided*/ any;
-            resetAndDestroy(): /*elided*/ any;
-            destroySoon(): void;
-            ref(): /*elided*/ any;
-            unref(): /*elided*/ any;
-            cork(): void;
-            uncork(): void;
-            push(chunk: unknown, encoding?: string): boolean;
-            read(size?: number): string | Uint8Array | null;
-            pause(): /*elided*/ any;
-            resume(): /*elided*/ any;
-            destroy(error?: Error): /*elided*/ any;
-            setEncoding(encoding: string): /*elided*/ any;
-            pipe(destination: unknown, options?: unknown): unknown;
-            on(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-            once(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-            emit(event: string, ...args: unknown[]): boolean;
-            readable: boolean;
-            readableEnded: boolean;
-            destroyed: boolean;
-            isTTY?: boolean;
-            write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
-            end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
-            writable: boolean;
-        }) => void): {
-            listen(..._args: unknown[]): /*elided*/ any;
-            close(_callback?: (err?: Error) => void): /*elided*/ any;
-            address(): {
-                port: number;
-                family: string;
-                address: string;
-            } | string | null;
-            getTicketKeys(): Buffer;
-            setTicketKeys(_keys: Buffer): void;
-            setSecureContext(_options: unknown): void;
-            addListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            on(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            once(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            removeListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            off(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            removeAllListeners(event?: string | symbol): /*elided*/ any;
-            setMaxListeners(n: number): /*elided*/ any;
-            getMaxListeners(): number;
-            listeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-            rawListeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-            emit(event: string | symbol, ...args: unknown[]): boolean;
-            listenerCount(event: string | symbol, listener?: import("../node-lib/events-module").EventListener): number;
-            prependListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            prependOnceListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-            eventNames(): Array<string | symbol>;
-        };
-    };
-    createServer: (_options?: unknown, _connectionListener?: (socket: {
-        [key: string]: unknown;
-        authorized: boolean;
-        encrypted: boolean;
-        connect(..._args: unknown[]): /*elided*/ any;
-        getPeerCertificate(_detailed?: boolean): object;
-        getCipher(): {
-            name: string;
-            version: string;
-        } | null;
-        getProtocol(): string | null;
-        setServername(_name: string): void;
-        renegotiate(_options: unknown, _callback: (err: Error | null) => void): boolean;
-        connecting: boolean;
-        pending: boolean;
-        readyState: string;
-        bufferSize: number | undefined;
-        bytesRead: number;
-        bytesWritten: number | undefined;
-        localAddress: string | undefined;
-        localPort: number | undefined;
-        localFamily: string | undefined;
-        remoteAddress: string | undefined;
-        remotePort: number | undefined;
-        remoteFamily: string | undefined;
-        timeout?: number;
-        server: import("../node-lib/net-module").Server | null;
-        _server: import("../node-lib/net-module").Server | null;
-        _handle: import("../node-lib/binding/stream_wrap").LibuvStreamWrap | null;
-        address(): import("../node-lib/net-module").AddressInfo | Record<string, never>;
-        setTimeout(timeout: number, callback?: (() => void) | undefined): /*elided*/ any;
-        setNoDelay(enable?: boolean): /*elided*/ any;
-        setKeepAlive(enable?: boolean, initialDelay?: number): /*elided*/ any;
-        resetAndDestroy(): /*elided*/ any;
-        destroySoon(): void;
-        ref(): /*elided*/ any;
-        unref(): /*elided*/ any;
-        cork(): void;
-        uncork(): void;
-        push(chunk: unknown, encoding?: string): boolean;
-        read(size?: number): string | Uint8Array | null;
-        pause(): /*elided*/ any;
-        resume(): /*elided*/ any;
-        destroy(error?: Error): /*elided*/ any;
-        setEncoding(encoding: string): /*elided*/ any;
-        pipe(destination: unknown, options?: unknown): unknown;
-        on(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-        once(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-        emit(event: string, ...args: unknown[]): boolean;
-        readable: boolean;
-        readableEnded: boolean;
-        destroyed: boolean;
-        isTTY?: boolean;
-        write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
-        end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
-        writable: boolean;
-    }) => void) => {
-        listen(..._args: unknown[]): /*elided*/ any;
-        close(_callback?: (err?: Error) => void): /*elided*/ any;
-        address(): {
-            port: number;
-            family: string;
-            address: string;
-        } | string | null;
-        getTicketKeys(): Buffer;
-        setTicketKeys(_keys: Buffer): void;
-        setSecureContext(_options: unknown): void;
-        addListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        on(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        once(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        removeListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        off(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        removeAllListeners(event?: string | symbol): /*elided*/ any;
-        setMaxListeners(n: number): /*elided*/ any;
-        getMaxListeners(): number;
-        listeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-        rawListeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-        emit(event: string | symbol, ...args: unknown[]): boolean;
-        listenerCount(event: string | symbol, listener?: import("../node-lib/events-module").EventListener): number;
-        prependListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        prependOnceListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        eventNames(): Array<string | symbol>;
-    };
-    connect: (_options: unknown, _callback?: () => void) => {
+    Server: TlsServerConstructor;
+    createServer: (options?: unknown, secureConnectionListener?: (socket: Socket) => void) => TlsServer;
+    connect: (...args: unknown[]) => {
         [key: string]: unknown;
         authorized: boolean;
         encrypted: boolean;
-        connect(..._args: unknown[]): /*elided*/ any;
+        connect(...args: unknown[]): /*elided*/ any;
         getPeerCertificate(_detailed?: boolean): object;
         getCipher(): {
             name: string;
@@ -595,7 +290,7 @@ export declare const TLSSocket: {
         [key: string]: unknown;
         authorized: boolean;
         encrypted: boolean;
-        connect(..._args: unknown[]): /*elided*/ any;
+        connect(...args: unknown[]): /*elided*/ any;
         getPeerCertificate(_detailed?: boolean): object;
         getCipher(): {
             name: string;
@@ -648,177 +343,11 @@ export declare const TLSSocket: {
         end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
         writable: boolean;
     };
-}, Server: {
-    new (_options?: unknown, _connectionListener?: (socket: {
-        [key: string]: unknown;
-        authorized: boolean;
-        encrypted: boolean;
-        connect(..._args: unknown[]): /*elided*/ any;
-        getPeerCertificate(_detailed?: boolean): object;
-        getCipher(): {
-            name: string;
-            version: string;
-        } | null;
-        getProtocol(): string | null;
-        setServername(_name: string): void;
-        renegotiate(_options: unknown, _callback: (err: Error | null) => void): boolean;
-        connecting: boolean;
-        pending: boolean;
-        readyState: string;
-        bufferSize: number | undefined;
-        bytesRead: number;
-        bytesWritten: number | undefined;
-        localAddress: string | undefined;
-        localPort: number | undefined;
-        localFamily: string | undefined;
-        remoteAddress: string | undefined;
-        remotePort: number | undefined;
-        remoteFamily: string | undefined;
-        timeout?: number;
-        server: import("../node-lib/net-module").Server | null;
-        _server: import("../node-lib/net-module").Server | null;
-        _handle: import("../node-lib/binding/stream_wrap").LibuvStreamWrap | null;
-        address(): import("../node-lib/net-module").AddressInfo | Record<string, never>;
-        setTimeout(timeout: number, callback?: (() => void) | undefined): /*elided*/ any;
-        setNoDelay(enable?: boolean): /*elided*/ any;
-        setKeepAlive(enable?: boolean, initialDelay?: number): /*elided*/ any;
-        resetAndDestroy(): /*elided*/ any;
-        destroySoon(): void;
-        ref(): /*elided*/ any;
-        unref(): /*elided*/ any;
-        cork(): void;
-        uncork(): void;
-        push(chunk: unknown, encoding?: string): boolean;
-        read(size?: number): string | Uint8Array | null;
-        pause(): /*elided*/ any;
-        resume(): /*elided*/ any;
-        destroy(error?: Error): /*elided*/ any;
-        setEncoding(encoding: string): /*elided*/ any;
-        pipe(destination: unknown, options?: unknown): unknown;
-        on(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-        once(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-        emit(event: string, ...args: unknown[]): boolean;
-        readable: boolean;
-        readableEnded: boolean;
-        destroyed: boolean;
-        isTTY?: boolean;
-        write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
-        end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
-        writable: boolean;
-    }) => void): {
-        listen(..._args: unknown[]): /*elided*/ any;
-        close(_callback?: (err?: Error) => void): /*elided*/ any;
-        address(): {
-            port: number;
-            family: string;
-            address: string;
-        } | string | null;
-        getTicketKeys(): Buffer;
-        setTicketKeys(_keys: Buffer): void;
-        setSecureContext(_options: unknown): void;
-        addListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        on(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        once(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        removeListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        off(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        removeAllListeners(event?: string | symbol): /*elided*/ any;
-        setMaxListeners(n: number): /*elided*/ any;
-        getMaxListeners(): number;
-        listeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-        rawListeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-        emit(event: string | symbol, ...args: unknown[]): boolean;
-        listenerCount(event: string | symbol, listener?: import("../node-lib/events-module").EventListener): number;
-        prependListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        prependOnceListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-        eventNames(): Array<string | symbol>;
-    };
-}, createServer: (_options?: unknown, _connectionListener?: (socket: {
-    [key: string]: unknown;
-    authorized: boolean;
-    encrypted: boolean;
-    connect(..._args: unknown[]): /*elided*/ any;
-    getPeerCertificate(_detailed?: boolean): object;
-    getCipher(): {
-        name: string;
-        version: string;
-    } | null;
-    getProtocol(): string | null;
-    setServername(_name: string): void;
-    renegotiate(_options: unknown, _callback: (err: Error | null) => void): boolean;
-    connecting: boolean;
-    pending: boolean;
-    readyState: string;
-    bufferSize: number | undefined;
-    bytesRead: number;
-    bytesWritten: number | undefined;
-    localAddress: string | undefined;
-    localPort: number | undefined;
-    localFamily: string | undefined;
-    remoteAddress: string | undefined;
-    remotePort: number | undefined;
-    remoteFamily: string | undefined;
-    timeout?: number;
-    server: import("../node-lib/net-module").Server | null;
-    _server: import("../node-lib/net-module").Server | null;
-    _handle: import("../node-lib/binding/stream_wrap").LibuvStreamWrap | null;
-    address(): import("../node-lib/net-module").AddressInfo | Record<string, never>;
-    setTimeout(timeout: number, callback?: (() => void) | undefined): /*elided*/ any;
-    setNoDelay(enable?: boolean): /*elided*/ any;
-    setKeepAlive(enable?: boolean, initialDelay?: number): /*elided*/ any;
-    resetAndDestroy(): /*elided*/ any;
-    destroySoon(): void;
-    ref(): /*elided*/ any;
-    unref(): /*elided*/ any;
-    cork(): void;
-    uncork(): void;
-    push(chunk: unknown, encoding?: string): boolean;
-    read(size?: number): string | Uint8Array | null;
-    pause(): /*elided*/ any;
-    resume(): /*elided*/ any;
-    destroy(error?: Error): /*elided*/ any;
-    setEncoding(encoding: string): /*elided*/ any;
-    pipe(destination: unknown, options?: unknown): unknown;
-    on(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-    once(event: string, listener: (...args: never[]) => void): /*elided*/ any;
-    emit(event: string, ...args: unknown[]): boolean;
-    readable: boolean;
-    readableEnded: boolean;
-    destroyed: boolean;
-    isTTY?: boolean;
-    write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
-    end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
-    writable: boolean;
-}) => void) => {
-    listen(..._args: unknown[]): /*elided*/ any;
-    close(_callback?: (err?: Error) => void): /*elided*/ any;
-    address(): {
-        port: number;
-        family: string;
-        address: string;
-    } | string | null;
-    getTicketKeys(): Buffer;
-    setTicketKeys(_keys: Buffer): void;
-    setSecureContext(_options: unknown): void;
-    addListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    on(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    once(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    removeListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    off(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    removeAllListeners(event?: string | symbol): /*elided*/ any;
-    setMaxListeners(n: number): /*elided*/ any;
-    getMaxListeners(): number;
-    listeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-    rawListeners(event: string | symbol): Array<import("../node-lib/events-module").EventListener>;
-    emit(event: string | symbol, ...args: unknown[]): boolean;
-    listenerCount(event: string | symbol, listener?: import("../node-lib/events-module").EventListener): number;
-    prependListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    prependOnceListener(event: string | symbol, listener: import("../node-lib/events-module").EventListener): /*elided*/ any;
-    eventNames(): Array<string | symbol>;
-}, connect: (_options: unknown, _callback?: () => void) => {
+}, Server: TlsServerConstructor, createServer: (options?: unknown, secureConnectionListener?: (socket: Socket) => void) => TlsServer, connect: (...args: unknown[]) => {
     [key: string]: unknown;
     authorized: boolean;
     encrypted: boolean;
-    connect(..._args: unknown[]): /*elided*/ any;
+    connect(...args: unknown[]): /*elided*/ any;
     getPeerCertificate(_detailed?: boolean): object;
     getCipher(): {
         name: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",

package/src/http-client-transport.ts

@@ -2,7 +2,8 @@
  * Node's Agent connection seam over a host HTTP exchange. Both sides of the
  * internal connection use Node's unmodified HTTP library: it parses requests,
  * generates responses and owns ClientRequest/IncomingMessage and backpressure.
- * No TLS socket or network metadata is fabricated. The host admits the target
+ * No TLS socket or network metadata is fabricated for a remote host; a
+ * loopback port stays the engine's own network, plain or TLS. The host admits the target
  * and capabilities before sending, and returns one response without retries.
  */
 import { httpModule, httpsModule } from './node-lib/http-module';
@@ -54,9 +55,12 @@ export function installHttpClientTransport(factory: HttpClientTransportFactory,
     const original = prototype.createConnection;
     const connect = function(this: unknown, options: Record<string, any>, callback: (error: Error | null, socket?: unknown) => void): unknown {
       const host = String(options.hostname ?? options.host ?? 'localhost').toLowerCase();
-      // Plain local HTTP is the engine's existing virtual network, except a port the host serves itself.
-      if (protocol === 'http:' && (local(host) || options.socketPath)
-        && !(local(host) && !options.socketPath && transportOptions.hostPorts?.().has(Number(options.port ?? 80)))) {
+      // Local HTTP, plain or TLS, is the engine's existing virtual network,
+      // except a port the host serves itself: a TLS connect to loopback pairs
+      // with the guest's listener, as `tls` does, with no wire to protect.
+      const hostPort = local(host) && !options.socketPath
+        && transportOptions.hostPorts?.().has(Number(options.port ?? (protocol === 'https:' ? 443 : 80)));
+      if (!hostPort && ((protocol === 'http:' && (local(host) || options.socketPath)) || (protocol === 'https:' && local(host) && !options.socketPath))) {
         return original.call(this, options, callback);
       }
       try {

package/src/shims/tls.ts

@@ -1,21 +1,51 @@
 /**
- * tls shim - TLS/SSL is not available in browser
- * No TLS transport is installed. A connection must fail asynchronously rather
- * than pretending to connect and leaving Node's HTTPS client waiting forever.
+ * tls: a tab's loopback carries no wire to protect. A TLS server listens on
+ * the engine's loopback as a net server does and hands its connections on as
+ * secure; a TLS connect to a loopback port pairs with that listener the same
+ * way. Bytes cross unencrypted because nothing lies between the two ends, and
+ * the browser holds TLS wherever there is a wire: a page reaches a guest
+ * server through the sandbox origin, and a request to another host goes out
+ * through the page's HTTP transport. A TLS connect to any other host fails
+ * asynchronously, rather than pretending to connect and leaving Node's HTTPS
+ * client waiting forever.
  */
 
-import { EventEmitter } from '../node-lib/events-module';
 import { lazyExport } from '../node-lib/lazy';
+import { nodeLibInternalRequire } from '../node-lib/load';
 import type { Socket } from '../node-lib/net-module';
+import type { EventEmitter } from '../node-lib/events-module';
+
+/** A TLS server as Node's module exposes it: constructed with or without `new`. */
+export interface TlsServer extends EventEmitter {
+  listen(...args: unknown[]): this;
+  close(callback?: (err?: Error) => void): this;
+  address(): { port: number; family: string; address: string } | string | null;
+  addContext(hostname: string, context: unknown): void;
+  getTicketKeys(): Buffer;
+  setTicketKeys(keys: Buffer): void;
+  setSecureContext(options: unknown): void;
+}
+export interface TlsServerConstructor {
+  new (options?: unknown, secureConnectionListener?: (socket: Socket) => void): TlsServer;
+  (options?: unknown, secureConnectionListener?: (socket: Socket) => void): TlsServer;
+  readonly prototype: TlsServer;
+}
+
+/** The names a loopback connect reaches, as the engine's tcp_wrap answers them. */
+function loopback(host: string): boolean {
+  const bare = host.startsWith('[') && host.endsWith(']') ? host.slice(1, -1) : host;
+  const name = bare.toLowerCase();
+  return name === '' || name === 'localhost' || name === '::1' || name.startsWith('127.');
+}
 
 // Keep the ordinary stream lifecycle (error, close, destroy) from Node's own
 // Socket. Resolve it lazily, like the other builtin classes, to avoid a loader
 // cycle while the engine is being imported.
-/** Native TLS refusal keeps the requesting graph's Socket identity. */
+/** Each graph's TLS keeps that graph's Socket and Server identity. */
 export function createTlsModule(require?: (name: string) => any) {
 const NetSocket = require ? require('net').Socket as new (options?: object) => Socket
     : lazyExport<new (options?: object) => Socket>('net', 'Socket');
-const Events = require ? require('events').EventEmitter as typeof EventEmitter : EventEmitter;
+const netServer = (): any => (require ? require('net') : nodeLibInternalRequire('net') as any).Server;
 
 class TLSSocket extends NetSocket {
   authorized = false;
@@ -25,7 +55,19 @@ class TLSSocket extends NetSocket {
     super({ allowHalfOpen: false });
   }
 
-  connect(..._args: unknown[]): this {
+  connect(...args: unknown[]): this {
+    const options = args[0] as { port?: unknown; host?: unknown; hostname?: unknown; socket?: unknown } | undefined;
+    const host = String(options?.host ?? options?.hostname ?? 'localhost');
+    if (options && typeof options === 'object' && options.socket === undefined && loopback(host)) {
+      // The peer is a listener of this engine, or nothing: a refused port
+      // fails as a net connect does.
+      this.once('connect', () => {
+        this.authorized = true;
+        this.emit('secureConnect');
+      });
+      return (NetSocket.prototype as unknown as { connect: (this: TLSSocket, options: object) => TLSSocket })
+        .connect.call(this, { port: options.port, host }) as this;
+    }
     this.connecting = true;
     // Never inherit a plain TCP connect while advertising an encrypted socket.
     // Agent assigns its socket on nextTick after connect returns, so failure
@@ -56,40 +98,57 @@ class TLSSocket extends NetSocket {
   }
 }
 
-class Server extends Events {
-  constructor(_options?: unknown, _connectionListener?: (socket: TLSSocket) => void) {
-    super();
-  }
-
-  listen(..._args: unknown[]): this {
-    return this;
-  }
-
-  close(_callback?: (err?: Error) => void): this {
-    return this;
+// A function constructor, as Node's: its own `https.js` builds an https.Server
+// by calling `tls.Server` on the instance, which a class refuses. It is a net
+// server, chained to the graph's `net.Server` when the first one is built.
+let chained = false;
+const Server = function TLSServer(this: TlsServer, options?: unknown, secureConnectionListener?: (socket: Socket) => void): TlsServer {
+  if (!(this instanceof Server)) return new Server(options, secureConnectionListener);
+  const NetServer = netServer();
+  if (!chained) {
+    Object.setPrototypeOf(Server.prototype, NetServer.prototype);
+    Object.setPrototypeOf(Server, NetServer);
+    chained = true;
   }
-
-  address(): { port: number; family: string; address: string } | string | null {
-    return null;
+  if (typeof options === 'function') {
+    secureConnectionListener = options as (socket: Socket) => void;
+    options = {};
   }
-
-  getTicketKeys(): Buffer {
+  NetServer.call(this, options ?? {}, function secure(this: TlsServer, socket: Socket & { encrypted?: boolean; authorized?: boolean }) {
+    socket.encrypted = true;
+    socket.authorized = false;
+    this.emit('secureConnection', socket);
+  });
+  if (secureConnectionListener) this.on('secureConnection', secureConnectionListener);
+  return this;
+} as unknown as TlsServerConstructor;
+
+Object.assign(Server.prototype, {
+  addContext(_hostname: string, _context: unknown) {},
+  getTicketKeys() {
     return (require ? require('buffer').Buffer : Buffer).from('');
-  }
+  },
+  setTicketKeys(_keys: Buffer) {},
+  setSecureContext(_options: unknown) {},
+});
 
-  setTicketKeys(_keys: Buffer): void {}
-
-  setSecureContext(_options: unknown): void {}
-}
-
-function createServer(_options?: unknown, _connectionListener?: (socket: TLSSocket) => void): Server {
-  return new Server(_options, _connectionListener);
+function createServer(options?: unknown, secureConnectionListener?: (socket: Socket) => void): TlsServer {
+  return new Server(options, secureConnectionListener);
 }
 
-function connect(_options: unknown, _callback?: () => void): TLSSocket {
+// tls.connect(options[, callback]) and tls.connect(port[, host][, options][, callback]).
+function connect(...args: unknown[]): TLSSocket {
+  const options: Record<string, unknown> = {};
+  let callback: (() => void) | undefined;
+  for (const arg of args) {
+    if (typeof arg === 'function') callback = arg as () => void;
+    else if (typeof arg === 'number' || (typeof arg === 'string' && options.port === undefined && /^\d+$/u.test(arg))) options.port = arg;
+    else if (typeof arg === 'string') options.host = arg;
+    else if (arg && typeof arg === 'object') Object.assign(options, arg);
+  }
   const socket = new TLSSocket();
-  if (_callback) socket.once('secureConnect', _callback);
-  return socket.connect();
+  if (callback) socket.once('secureConnect', callback);
+  return socket.connect(options);
 }
 
 const createSecureContext = (_options?: unknown) => ({});