@volter/world-core 3.0.120 → 3.0.122

package/dist/inject.cjs

@@ -780,6 +780,44 @@ async function followKeyless(first, target, reqInit, chain) {
 // streaming, aborts and timeouts behave as the client expects); its options are app-route.cjs's, shared with the twins'
 // deliveries.
 function requestApp(route, url, method, headers, extra, callback) {
+  if (route.proxy && url.protocol === 'https:') {
+    // Some clients inspect the response socket's TLS authorization themselves. CONNECT keeps
+    // that a real TLS result while the World proxy still inspects the enclosed HTTP request.
+    const agent = new https.Agent({ keepAlive: false });
+    const pending = new Set();
+    const destroy = agent.destroy.bind(agent);
+    agent.destroy = () => { for (const connect of pending) connect.destroy(); pending.clear(); destroy(); };
+    agent.createConnection = (options, done) => {
+      let settled = false;
+      let connected = false;
+      const finish = (error, socket) => {
+        if (settled) return;
+        settled = true; pending.delete(connect);
+        done(error, socket);
+      };
+      const connect = ORIGINALS.httpRequest({ hostname: route.proxy.hostname, port: route.proxy.port || 80,
+        method: 'CONNECT', path: `${url.hostname}:${url.port || 443}`, agent: false, timeout: options.timeout });
+      pending.add(connect);
+      connect.once('error', finish);
+      connect.once('close', () => { if (!connected) finish(new Error('World proxy CONNECT closed')); });
+      connect.once('timeout', () => connect.destroy(new Error('World proxy CONNECT timed out')));
+      connect.once('connect', (response, socket, head) => {
+        connected = true;
+        if (response.statusCode !== 200) { socket.destroy(); finish(new Error(`World proxy CONNECT answered ${response.statusCode}`)); return; }
+        if (head.length) socket.unshift(head);
+        try {
+          // The existing TLS guard verifies this socket's actual World-proxy peer before allowing its SNI.
+          finish(null, tls.connect({ ...options, socket, servername: options.servername || url.hostname }));
+        } catch (error) { socket.destroy(); finish(error); }
+      });
+      connect.end();
+    };
+    const options = { protocol: 'https:', hostname: url.hostname, port: url.port || 443,
+      path: url.pathname + url.search, method, headers: headersForProxy(headers, url), agent, ...extra };
+    const request = callback ? ORIGINALS.httpsRequest(options, callback) : ORIGINALS.httpsRequest(options);
+    request.once('close', () => agent.destroy());
+    return request;
+  }
   const options = route.proxy
     ? { protocol: 'http:', hostname: route.proxy.hostname, port: route.proxy.port, path: url.href, method,
       headers: headersForProxy(headers, url), agent: false, ...extra }

package/inject.cjs

@@ -780,6 +780,44 @@ async function followKeyless(first, target, reqInit, chain) {
 // streaming, aborts and timeouts behave as the client expects); its options are app-route.cjs's, shared with the twins'
 // deliveries.
 function requestApp(route, url, method, headers, extra, callback) {
+  if (route.proxy && url.protocol === 'https:') {
+    // Some clients inspect the response socket's TLS authorization themselves. CONNECT keeps
+    // that a real TLS result while the World proxy still inspects the enclosed HTTP request.
+    const agent = new https.Agent({ keepAlive: false });
+    const pending = new Set();
+    const destroy = agent.destroy.bind(agent);
+    agent.destroy = () => { for (const connect of pending) connect.destroy(); pending.clear(); destroy(); };
+    agent.createConnection = (options, done) => {
+      let settled = false;
+      let connected = false;
+      const finish = (error, socket) => {
+        if (settled) return;
+        settled = true; pending.delete(connect);
+        done(error, socket);
+      };
+      const connect = ORIGINALS.httpRequest({ hostname: route.proxy.hostname, port: route.proxy.port || 80,
+        method: 'CONNECT', path: `${url.hostname}:${url.port || 443}`, agent: false, timeout: options.timeout });
+      pending.add(connect);
+      connect.once('error', finish);
+      connect.once('close', () => { if (!connected) finish(new Error('World proxy CONNECT closed')); });
+      connect.once('timeout', () => connect.destroy(new Error('World proxy CONNECT timed out')));
+      connect.once('connect', (response, socket, head) => {
+        connected = true;
+        if (response.statusCode !== 200) { socket.destroy(); finish(new Error(`World proxy CONNECT answered ${response.statusCode}`)); return; }
+        if (head.length) socket.unshift(head);
+        try {
+          // The existing TLS guard verifies this socket's actual World-proxy peer before allowing its SNI.
+          finish(null, tls.connect({ ...options, socket, servername: options.servername || url.hostname }));
+        } catch (error) { socket.destroy(); finish(error); }
+      });
+      connect.end();
+    };
+    const options = { protocol: 'https:', hostname: url.hostname, port: url.port || 443,
+      path: url.pathname + url.search, method, headers: headersForProxy(headers, url), agent, ...extra };
+    const request = callback ? ORIGINALS.httpsRequest(options, callback) : ORIGINALS.httpsRequest(options);
+    request.once('close', () => agent.destroy());
+    return request;
+  }
   const options = route.proxy
     ? { protocol: 'http:', hostname: route.proxy.hostname, port: route.proxy.port, path: url.href, method,
       headers: headersForProxy(headers, url), agent: false, ...extra }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "3.0.120",
+  "version": "3.0.122",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",