react-native-nitro-net 0.2.0 → 0.3.1

package/lib/tls.d.ts

@@ -1,4 +1,4 @@
-import { Socket, Server as NetServer, SocketOptions } from './index';
+import { Socket, Server as NetServer, SocketOptions } from './net';
 export interface PeerCertificate {
     subject: {
         [key: string]: string;
@@ -26,6 +26,13 @@ export interface ConnectionOptions extends SocketOptions {
     pfx?: string | ArrayBuffer;
     passphrase?: string;
     keylog?: boolean;
+    /**
+     * Custom hostname verification function.
+     * If provided, it will be called after the TLS handshake to verify the peer certificate.
+     * Return `undefined` if valid, or an `Error` if invalid.
+     * If not provided, the default `checkServerIdentity` is used.
+     */
+    checkServerIdentity?: (hostname: string, cert: PeerCertificate) => Error | undefined;
 }
 export interface SecureContextOptions {
     pfx?: string | ArrayBuffer;
@@ -70,6 +77,20 @@ export declare class TLSSocket extends Socket {
     getSharedSigalgs(): string | undefined;
     renegotiate(options: any, callback: (err: Error | null) => void): boolean;
     disableRenegotiation(): void;
+    /**
+     * Enables trace output for this socket.
+     */
+    enableTrace(): void;
+    /**
+     * Exports keying material for use by external protocols.
+     *
+     * @param length The number of bytes to return.
+     * @param label A label identifying the keying material.
+     * @param context An optional context.
+     * @returns Buffer containing keying material.
+     * @throws Error if export fails (e.g., TLS not connected).
+     */
+    exportKeyingMaterial(length: number, label: string, context?: Buffer): Buffer;
     constructor(socket: Socket, options?: ConnectionOptions);
     constructor(options: ConnectionOptions);
     connect(options: any, connectionListener?: () => void): this;
@@ -122,3 +143,4 @@ export declare function parseCertString(certString: string): {
  * Mock implementation of convertTLSV1CertToPEM.
  */
 export declare function convertTLSV1CertToPEM(cert: string | Buffer): string;
+//# sourceMappingURL=tls.d.ts.map

package/lib/tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls.d.ts","sourceRoot":"","sources":["../src/tls.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,aAAa,EAAa,MAAM,OAAO,CAAA;AAW7E,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IAClC,MAAM,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAA;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACpD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,kBAAkB,CAAC,EAAE,OAAO,CAAA;IAC5B,OAAO,CAAC,EAAE,WAAW,CAAA;IACrB,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,KAAK,KAAK,GAAG,SAAS,CAAA;CACvF;AAED,MAAM,WAAW,oBAAoB;IACjC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACxB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACzB;AAED,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,eAAO,MAAM,mBAAmB,YAAY,CAAC;AAC7C,eAAO,MAAM,gBAAgB,EAAE,MAAM,EAAO,CAAC;AAC7C,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,gBAAgB,QAAmB,CAAC;AAEjD,qBAAa,aAAa;IACtB,OAAO,CAAC,GAAG,CAAS;gBAER,OAAO,CAAC,EAAE,oBAAoB;IAqB1C,eAAe,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAIxC,aAAa,IAAI,WAAW,GAAG,SAAS;IAIxC,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAItC,IAAI,EAAE,IAAI,MAAM,CAEf;IAGD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI;CAG9B;AAED,wBAAgB,mBAAmB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,aAAa,CAEjF;AAED,qBAAa,SAAU,SAAQ,MAAM;IACjC,OAAO,CAAC,WAAW,CAAC,CAAQ;IAE5B,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,IAAI,UAAU,IAAI,MAAM,GAAG,SAAS,CAEnC;IAED,IAAI,UAAU,IAAI,OAAO,CAGxB;IAED,IAAI,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAG3C;IAED,IAAI,YAAY,IAAI,MAAM,GAAG,SAAS,CAGrC;IAED,WAAW,IAAI,MAAM,GAAG,SAAS;IAKjC,SAAS,IAAI;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS;IAa1D,kBAAkB,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,eAAe,GAAG,EAAE;IAa5D,eAAe,IAAI,OAAO;IAK1B,UAAU,IAAI,WAAW,GAAG,SAAS;IAKrC,mBAAmB,IAAI,MAAM,GAAG,SAAS;IAKzC,WAAW,IAAI,MAAM,GAAG,SAAS;IAIjC,eAAe,IAAI,MAAM,GAAG,SAAS;IAIrC,gBAAgB,IAAI,MAAM,GAAG,SAAS;IAKtC,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO;IAWzE,oBAAoB,IAAI,IAAI;IAI5B;;OAEG;IACH,WAAW,IAAI,IAAI;IAOnB;;;;;;;;OAQG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM;gBAcjE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB;gBAC3C,OAAO,EAAE,iBAAiB;IAwB7B,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI;CA4ExE;AAED,wBAAgB,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,MAAM,IAAI,GAAG,SAAS,CAAA;AAC/F,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,MAAM,IAAI,GAAG,SAAS,CAAA;AAC7H,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,EAAE,MAAM,IAAI,GAAG,SAAS,CAAA;AAmC9G,qBAAa,MAAO,SAAQ,SAAS;IACjC,OAAO,CAAC,gBAAgB,CAAa;gBAEzB,OAAO,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI;IAkCxE,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IAO1E,gBAAgB,CAAC,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;KAAE,GAAG,IAAI;IAItF,aAAa,IAAI,WAAW,GAAG,SAAS;IAIxC,aAAa,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI;IAK7B,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,GAAG,GAAG,IAAI;CAwD/E;AAED,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,CAEjG;AAED,wBAAgB,UAAU,IAAI,MAAM,EAAE,CAYrC;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,KAAK,GAAG,SAAS,CAwC9F;AAMD;;;GAGG;AACH,qBAAa,YAAa,SAAQ,SAAS;gBAC3B,OAAO,CAAC,EAAE,iBAAiB;CAG1C;AAED;;GAEG;AACH,qBAAa,UAAU;IACZ,SAAS,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,YAAY,CAAC;gBAEnB,aAAa,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO;CAIrH;AAED,wBAAgB,gBAAgB,CAAC,aAAa,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,EAAE,OAAO,GAAG,UAAU,CAEnJ;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAQ7E;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAInE"}

package/lib/tls.js

@@ -1,65 +1,59 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.SecurePair = exports.CryptoStream = exports.Server = exports.TLSSocket = exports.SecureContext = exports.SLAB_BUFFER_SIZE = exports.DEFAULT_ECDH_CURVE = exports.rootCertificates = exports.DEFAULT_MAX_VERSION = exports.DEFAULT_MIN_VERSION = void 0;
-exports.createSecureContext = createSecureContext;
-exports.connect = connect;
-exports.createServer = createServer;
-exports.getCiphers = getCiphers;
-exports.checkServerIdentity = checkServerIdentity;
-exports.createSecurePair = createSecurePair;
-exports.parseCertString = parseCertString;
-exports.convertTLSV1CertToPEM = convertTLSV1CertToPEM;
-const index_1 = require("./index");
-const Driver_1 = require("./Driver");
-exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
-exports.DEFAULT_MAX_VERSION = 'TLSv1.3';
-exports.rootCertificates = [];
-exports.DEFAULT_ECDH_CURVE = 'auto'; // Managed by rustls
-exports.SLAB_BUFFER_SIZE = 10 * 1024 * 1024; // 10MB default
-class SecureContext {
+import { Socket, Server as NetServer, isVerbose } from './net';
+import { Driver } from './Driver';
+function debugLog(message) {
+    if (isVerbose()) {
+        const timestamp = new Date().toISOString().split('T')[1].split('Z')[0];
+        console.log(`[NET DEBUG ${timestamp}] ${message}`);
+    }
+}
+export const DEFAULT_MIN_VERSION = 'TLSv1.2';
+export const DEFAULT_MAX_VERSION = 'TLSv1.3';
+export const rootCertificates = [];
+export const DEFAULT_ECDH_CURVE = 'auto'; // Managed by rustls
+export const SLAB_BUFFER_SIZE = 10 * 1024 * 1024; // 10MB default
+export class SecureContext {
     constructor(options) {
         if (options && options.pfx) {
-            this._id = Driver_1.Driver.createEmptySecureContext();
+            this._id = Driver.createEmptySecureContext();
             const pfx = typeof options.pfx === 'string' ? Buffer.from(options.pfx).buffer : options.pfx;
-            Driver_1.Driver.setPFXToSecureContext(this._id, pfx, options.passphrase);
+            Driver.setPFXToSecureContext(this._id, pfx, options.passphrase);
         }
         else if (options && options.cert && options.key) {
             const cert = Array.isArray(options.cert) ? options.cert[0] : options.cert;
             const key = Array.isArray(options.key) ? options.key[0] : options.key;
-            this._id = Driver_1.Driver.createSecureContext(cert, key, options.passphrase);
+            this._id = Driver.createSecureContext(cert, key, options.passphrase);
         }
         else {
-            this._id = Driver_1.Driver.createEmptySecureContext();
+            this._id = Driver.createEmptySecureContext();
         }
         if (options && options.ca) {
             const cas = Array.isArray(options.ca) ? options.ca : [options.ca];
             for (const ca of cas) {
-                Driver_1.Driver.addCACertToSecureContext(this._id, ca);
+                Driver.addCACertToSecureContext(this._id, ca);
             }
         }
     }
     setOCSPResponse(ocsp) {
-        Driver_1.Driver.setOCSPResponseToSecureContext(this._id, ocsp);
+        Driver.setOCSPResponseToSecureContext(this._id, ocsp);
     }
     getTicketKeys() {
-        return Driver_1.Driver.getTicketKeys(this._id);
+        return Driver.getTicketKeys(this._id);
     }
     setTicketKeys(keys) {
-        Driver_1.Driver.setTicketKeys(this._id, keys);
+        Driver.setTicketKeys(this._id, keys);
     }
     get id() {
         return this._id;
     }
     // Node.js doesn't have these on SecureContext but we might need them
     addCACert(ca) {
-        Driver_1.Driver.addCACertToSecureContext(this._id, ca);
+        Driver.addCACertToSecureContext(this._id, ca);
     }
 }
-exports.SecureContext = SecureContext;
-function createSecureContext(options) {
+export function createSecureContext(options) {
     return new SecureContext(options);
 }
-class TLSSocket extends index_1.Socket {
+export class TLSSocket extends Socket {
     get encrypted() {
         return true;
     }
@@ -131,23 +125,58 @@ class TLSSocket extends index_1.Socket {
     }
     renegotiate(options, callback) {
         if (callback) {
-            process.nextTick(() => callback(new Error('Renegotiation is not supported by rustls')));
+            setTimeout(() => {
+                const err = new Error('Renegotiation is not supported by rustls');
+                err.code = 'ERR_TLS_RENEGOTIATION_DISABLED';
+                callback(err);
+            }, 0);
         }
         return false;
     }
     disableRenegotiation() {
         // No-op, already effectively disabled
     }
+    /**
+     * Enables trace output for this socket.
+     */
+    enableTrace() {
+        const driver = this._driver;
+        if (driver) {
+            driver.enableTrace();
+        }
+    }
+    /**
+     * Exports keying material for use by external protocols.
+     *
+     * @param length The number of bytes to return.
+     * @param label A label identifying the keying material.
+     * @param context An optional context.
+     * @returns Buffer containing keying material.
+     * @throws Error if export fails (e.g., TLS not connected).
+     */
+    exportKeyingMaterial(length, label, context) {
+        const driver = this._driver;
+        if (driver) {
+            const ctx = context ? new Uint8Array(context).buffer : undefined;
+            const result = driver.exportKeyingMaterial(length, label, ctx);
+            if (result) {
+                return Buffer.from(result);
+            }
+        }
+        const err = new Error('exportKeyingMaterial failed: TLS connection may not be established');
+        err.code = 'ERR_TLS_EXPORT_KEYING_MATERIAL';
+        throw err;
+    }
     constructor(socketOrOptions, options) {
         let opts = {};
-        if (socketOrOptions instanceof index_1.Socket) {
+        if (socketOrOptions instanceof Socket) {
             opts = { ...options, socketDriver: socketOrOptions._driver };
         }
         else {
             opts = socketOrOptions || {};
         }
         super(opts);
-        if (socketOrOptions instanceof index_1.Socket) {
+        if (socketOrOptions instanceof Socket) {
             this._servername = socketOrOptions._servername;
         }
         this.on('event', (event, data) => {
@@ -174,6 +203,21 @@ class TLSSocket extends index_1.Socket {
             if (connectionListener)
                 this.once('secureConnect', connectionListener);
             this.once('connect', () => {
+                // After the native TLS handshake, perform hostname verification
+                if (rejectUnauthorized !== false) {
+                    const cert = this.getPeerCertificate();
+                    if (cert && Object.keys(cert).length > 0) {
+                        const verifyFn = (typeof options === 'object' && options.checkServerIdentity)
+                            ? options.checkServerIdentity
+                            : checkServerIdentity;
+                        const verifyErr = verifyFn(servername, cert);
+                        if (verifyErr) {
+                            this.emit('error', verifyErr);
+                            this.destroy(verifyErr);
+                            return;
+                        }
+                    }
+                }
                 this.emit('secureConnect');
             });
             if (session) {
@@ -194,17 +238,21 @@ class TLSSocket extends index_1.Socket {
             }
             if (path) {
                 if (secureContextId !== undefined) {
+                    debugLog(`TLSSocket.connect: Calling driver.connectUnixTLSWithContext(${path}, ${servername}, ctx=${secureContextId})`);
                     driver.connectUnixTLSWithContext(path, servername, rejectUnauthorized, secureContextId);
                 }
                 else {
+                    debugLog(`TLSSocket.connect: Calling driver.connectUnixTLS(${path}, ${servername})`);
                     driver.connectUnixTLS(path, servername, rejectUnauthorized);
                 }
             }
             else {
                 if (secureContextId !== undefined) {
+                    debugLog(`TLSSocket.connect: Calling driver.connectTLSWithContext(${host}, ${port}, ${servername}, ctx=${secureContextId})`);
                     driver.connectTLSWithContext(host, port, servername, rejectUnauthorized, secureContextId);
                 }
                 else {
+                    debugLog(`TLSSocket.connect: Calling driver.connectTLS(${host}, ${port}, ${servername})`);
                     driver.connectTLS(host, port, servername, rejectUnauthorized);
                 }
             }
@@ -212,8 +260,7 @@ class TLSSocket extends index_1.Socket {
         return this;
     }
 }
-exports.TLSSocket = TLSSocket;
-function connect(...args) {
+export function connect(...args) {
     let port;
     let host = 'localhost';
     let options = {};
@@ -247,7 +294,7 @@ function connect(...args) {
     }, listener);
     return socket;
 }
-class Server extends index_1.Server {
+export class Server extends NetServer {
     constructor(options, connectionListener) {
         super(options);
         this._secureContextId = 0;
@@ -261,6 +308,10 @@ class Server extends index_1.Server {
                 ca: options.ca
             }).id;
         }
+        else {
+            // Create empty secure context to allow late configuration (addContext)
+            this._secureContextId = createSecureContext().id;
+        }
         this.on('connection', (socket) => {
             const tlsSocket = new TLSSocket(socket);
             this.emit('secureConnection', tlsSocket);
@@ -279,18 +330,18 @@ class Server extends index_1.Server {
         if (!this._secureContextId) {
             throw new Error("Cannot addContext to a non-TLS server. Provide initial cert/key in constructor.");
         }
-        Driver_1.Driver.addContextToSecureContext(this._secureContextId, hostname, context.cert, context.key);
+        Driver.addContextToSecureContext(this._secureContextId, hostname, context.cert, context.key);
     }
     setSecureContext(options) {
         this._secureContextId = createSecureContext(options).id;
     }
     getTicketKeys() {
-        return this._secureContextId ? Driver_1.Driver.getTicketKeys(this._secureContextId) : undefined;
+        return this._secureContextId ? Driver.getTicketKeys(this._secureContextId) : undefined;
     }
     setTicketKeys(keys) {
         if (!this._secureContextId)
             throw new Error("Not a TLS server");
-        Driver_1.Driver.setTicketKeys(this._secureContextId, keys);
+        Driver.setTicketKeys(this._secureContextId, keys);
     }
     listen(port, host, backlog, callback) {
         if (!this._secureContextId) {
@@ -338,18 +389,23 @@ class Server extends index_1.Server {
         if (_callback)
             this.once('listening', _callback);
         const driver = this._driver;
-        if (handle || _path) {
-            console.warn("TLS over Unix sockets/handles not fully implemented yet");
+        if (_path) {
+            driver.listenTLSUnix(_path, this._secureContextId, _backlog);
+        }
+        else if (handle) {
+            console.warn("TLS over handles not fully implemented yet");
+            driver.listenTLS(_port || 0, this._secureContextId, _backlog, ipv6Only, reusePort);
+        }
+        else {
+            driver.listenTLS(_port || 0, this._secureContextId, _backlog, ipv6Only, reusePort);
         }
-        driver.listenTLS(_port || 0, this._secureContextId, _backlog, ipv6Only, reusePort);
         return this;
     }
 }
-exports.Server = Server;
-function createServer(options, connectionListener) {
+export function createServer(options, connectionListener) {
     return new Server(options, connectionListener);
 }
-function getCiphers() {
+export function getCiphers() {
     return [
         'TLS_AES_128_GCM_SHA256',
         'TLS_AES_256_GCM_SHA384',
@@ -362,7 +418,7 @@ function getCiphers() {
         'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256'
     ];
 }
-function checkServerIdentity(hostname, cert) {
+export function checkServerIdentity(hostname, cert) {
     const subject = cert.subject;
     const dnsNames = [];
     // In a real implementation we'd extract SANs from the cert object if available.
@@ -408,29 +464,27 @@ function checkServerIdentity(hostname, cert) {
  * Legacy CryptoStream for Node.js compatibility.
  * In this implementation, it's a simple wrapper around TLSSocket.
  */
-class CryptoStream extends TLSSocket {
+export class CryptoStream extends TLSSocket {
     constructor(options) {
         super(options || {});
     }
 }
-exports.CryptoStream = CryptoStream;
 /**
  * Legacy SecurePair for Node.js compatibility.
  */
-class SecurePair {
+export class SecurePair {
     constructor(secureContext, isServer, requestCert, rejectUnauthorized) {
         this.cleartext = new CryptoStream();
         this.encrypted = this.cleartext; // Logically the same in our simplified model
     }
 }
-exports.SecurePair = SecurePair;
-function createSecurePair(secureContext, isServer, requestCert, rejectUnauthorized) {
+export function createSecurePair(secureContext, isServer, requestCert, rejectUnauthorized) {
     return new SecurePair(secureContext, isServer, requestCert, rejectUnauthorized);
 }
 /**
  * Legacy certificate string parser.
  */
-function parseCertString(certString) {
+export function parseCertString(certString) {
     const out = {};
     const parts = certString.split('/');
     for (const part of parts) {
@@ -443,7 +497,7 @@ function parseCertString(certString) {
 /**
  * Mock implementation of convertTLSV1CertToPEM.
  */
-function convertTLSV1CertToPEM(cert) {
+export function convertTLSV1CertToPEM(cert) {
     if (typeof cert === 'string' && cert.includes('BEGIN CERTIFICATE'))
         return cert;
     const body = (cert instanceof Buffer) ? cert.toString('base64') : Buffer.from(cert).toString('base64');

package/nitrogen/generated/android/RustCNet+autolinking.cmake

@@ -35,11 +35,13 @@ target_sources(
   # Shared Nitrogen C++ sources
   ../nitrogen/generated/shared/c++/HybridNetSocketDriverSpec.cpp
   ../nitrogen/generated/shared/c++/HybridNetServerDriverSpec.cpp
+  ../nitrogen/generated/shared/c++/HybridHttpParserSpec.cpp
   ../nitrogen/generated/shared/c++/HybridNetDriverSpec.cpp
   ../nitrogen/generated/shared/c++/HybridNitroBufferSpec.cpp
   # Android-specific Nitrogen C++ sources
   ../nitrogen/generated/android/c++/JHybridNetSocketDriverSpec.cpp
   ../nitrogen/generated/android/c++/JHybridNetServerDriverSpec.cpp
+  ../nitrogen/generated/android/c++/JHybridHttpParserSpec.cpp
   ../nitrogen/generated/android/c++/JHybridNetDriverSpec.cpp
 )
 

package/nitrogen/generated/android/RustCNetOnLoad.cpp

@@ -18,6 +18,7 @@
 #include "JHybridNetSocketDriverSpec.hpp"
 #include "JFunc_void_double_std__shared_ptr_ArrayBuffer_.hpp"
 #include "JHybridNetServerDriverSpec.hpp"
+#include "JHybridHttpParserSpec.hpp"
 #include "JHybridNetDriverSpec.hpp"
 #include "HybridNetDriver.hpp"
 
@@ -33,6 +34,7 @@ int initialize(JavaVM* vm) {
     margelo::nitro::net::JHybridNetSocketDriverSpec::registerNatives();
     margelo::nitro::net::JFunc_void_double_std__shared_ptr_ArrayBuffer__cxx::registerNatives();
     margelo::nitro::net::JHybridNetServerDriverSpec::registerNatives();
+    margelo::nitro::net::JHybridHttpParserSpec::registerNatives();
     margelo::nitro::net::JHybridNetDriverSpec::registerNatives();
 
     // Register Nitro Hybrid Objects

package/nitrogen/generated/android/c++/JHybridHttpParserSpec.cpp

@@ -0,0 +1,54 @@
+///
+/// JHybridHttpParserSpec.cpp
+/// This file was generated by nitrogen. DO NOT MODIFY THIS FILE.
+/// https://github.com/mrousavy/nitro
+/// Copyright © 2025 Marc Rousavy @ Margelo
+///
+
+#include "JHybridHttpParserSpec.hpp"
+
+
+
+#include <string>
+#include <NitroModules/ArrayBuffer.hpp>
+#include <NitroModules/JArrayBuffer.hpp>
+
+namespace margelo::nitro::net {
+
+  jni::local_ref<JHybridHttpParserSpec::jhybriddata> JHybridHttpParserSpec::initHybrid(jni::alias_ref<jhybridobject> jThis) {
+    return makeCxxInstance(jThis);
+  }
+
+  void JHybridHttpParserSpec::registerNatives() {
+    registerHybrid({
+      makeNativeMethod("initHybrid", JHybridHttpParserSpec::initHybrid),
+    });
+  }
+
+  size_t JHybridHttpParserSpec::getExternalMemorySize() noexcept {
+    static const auto method = javaClassStatic()->getMethod<jlong()>("getMemorySize");
+    return method(_javaPart);
+  }
+
+  void JHybridHttpParserSpec::dispose() noexcept {
+    static const auto method = javaClassStatic()->getMethod<void()>("dispose");
+    method(_javaPart);
+  }
+
+  std::string JHybridHttpParserSpec::toString() {
+    static const auto method = javaClassStatic()->getMethod<jni::JString()>("toString");
+    auto javaString = method(_javaPart);
+    return javaString->toStdString();
+  }
+
+  // Properties
+  
+
+  // Methods
+  std::string JHybridHttpParserSpec::feed(const std::shared_ptr<ArrayBuffer>& data) {
+    static const auto method = javaClassStatic()->getMethod<jni::local_ref<jni::JString>(jni::alias_ref<JArrayBuffer::javaobject> /* data */)>("feed");
+    auto __result = method(_javaPart, JArrayBuffer::wrap(data));
+    return __result->toStdString();
+  }
+
+} // namespace margelo::nitro::net

package/nitrogen/generated/android/c++/JHybridHttpParserSpec.hpp

@@ -0,0 +1,65 @@
+///
+/// HybridHttpParserSpec.hpp
+/// This file was generated by nitrogen. DO NOT MODIFY THIS FILE.
+/// https://github.com/mrousavy/nitro
+/// Copyright © 2025 Marc Rousavy @ Margelo
+///
+
+#pragma once
+
+#include <NitroModules/JHybridObject.hpp>
+#include <fbjni/fbjni.h>
+#include "HybridHttpParserSpec.hpp"
+
+
+
+
+namespace margelo::nitro::net {
+
+  using namespace facebook;
+
+  class JHybridHttpParserSpec: public jni::HybridClass<JHybridHttpParserSpec, JHybridObject>,
+                               public virtual HybridHttpParserSpec {
+  public:
+    static auto constexpr kJavaDescriptor = "Lcom/margelo/nitro/net/HybridHttpParserSpec;";
+    static jni::local_ref<jhybriddata> initHybrid(jni::alias_ref<jhybridobject> jThis);
+    static void registerNatives();
+
+  protected:
+    // C++ constructor (called from Java via `initHybrid()`)
+    explicit JHybridHttpParserSpec(jni::alias_ref<jhybridobject> jThis) :
+      HybridObject(HybridHttpParserSpec::TAG),
+      HybridBase(jThis),
+      _javaPart(jni::make_global(jThis)) {}
+
+  public:
+    ~JHybridHttpParserSpec() override {
+      // Hermes GC can destroy JS objects on a non-JNI Thread.
+      jni::ThreadScope::WithClassLoader([&] { _javaPart.reset(); });
+    }
+
+  public:
+    size_t getExternalMemorySize() noexcept override;
+    void dispose() noexcept override;
+    std::string toString() override;
+
+  public:
+    inline const jni::global_ref<JHybridHttpParserSpec::javaobject>& getJavaPart() const noexcept {
+      return _javaPart;
+    }
+
+  public:
+    // Properties
+    
+
+  public:
+    // Methods
+    std::string feed(const std::shared_ptr<ArrayBuffer>& data) override;
+
+  private:
+    friend HybridBase;
+    using HybridBase::HybridBase;
+    jni::global_ref<JHybridHttpParserSpec::javaobject> _javaPart;
+  };
+
+} // namespace margelo::nitro::net

package/nitrogen/generated/android/c++/JHybridNetDriverSpec.cpp

@@ -11,6 +11,8 @@
 namespace margelo::nitro::net { class HybridNetSocketDriverSpec; }
 // Forward declaration of `HybridNetServerDriverSpec` to properly resolve imports.
 namespace margelo::nitro::net { class HybridNetServerDriverSpec; }
+// Forward declaration of `HybridHttpParserSpec` to properly resolve imports.
+namespace margelo::nitro::net { class HybridHttpParserSpec; }
 // Forward declaration of `NetConfig` to properly resolve imports.
 namespace margelo::nitro::net { struct NetConfig; }
 
@@ -19,6 +21,8 @@ namespace margelo::nitro::net { struct NetConfig; }
 #include "JHybridNetSocketDriverSpec.hpp"
 #include "HybridNetServerDriverSpec.hpp"
 #include "JHybridNetServerDriverSpec.hpp"
+#include "HybridHttpParserSpec.hpp"
+#include "JHybridHttpParserSpec.hpp"
 #include <NitroModules/ArrayBuffer.hpp>
 #include <optional>
 #include <NitroModules/JArrayBuffer.hpp>
@@ -68,6 +72,11 @@ namespace margelo::nitro::net {
     auto __result = method(_javaPart);
     return __result->cthis()->shared_cast<JHybridNetServerDriverSpec>();
   }
+  std::shared_ptr<HybridHttpParserSpec> JHybridNetDriverSpec::createHttpParser(double mode) {
+    static const auto method = javaClassStatic()->getMethod<jni::local_ref<JHybridHttpParserSpec::javaobject>(double /* mode */)>("createHttpParser");
+    auto __result = method(_javaPart, mode);
+    return __result->cthis()->shared_cast<JHybridHttpParserSpec>();
+  }
   double JHybridNetDriverSpec::createSecureContext(const std::string& cert, const std::string& key, const std::optional<std::string>& passphrase) {
     static const auto method = javaClassStatic()->getMethod<double(jni::alias_ref<jni::JString> /* cert */, jni::alias_ref<jni::JString> /* key */, jni::alias_ref<jni::JString> /* passphrase */)>("createSecureContext");
     auto __result = method(_javaPart, jni::make_jstring(cert), jni::make_jstring(key), passphrase.has_value() ? jni::make_jstring(passphrase.value()) : nullptr);

package/nitrogen/generated/android/c++/JHybridNetDriverSpec.hpp

@@ -56,6 +56,7 @@ namespace margelo::nitro::net {
     // Methods
     std::shared_ptr<HybridNetSocketDriverSpec> createSocket(const std::optional<std::string>& id) override;
     std::shared_ptr<HybridNetServerDriverSpec> createServer() override;
+    std::shared_ptr<HybridHttpParserSpec> createHttpParser(double mode) override;
     double createSecureContext(const std::string& cert, const std::string& key, const std::optional<std::string>& passphrase) override;
     double createEmptySecureContext() override;
     void addCACertToSecureContext(double scId, const std::string& ca) override;

package/nitrogen/generated/android/c++/JHybridNetServerDriverSpec.cpp

@@ -86,6 +86,10 @@ namespace margelo::nitro::net {
     static const auto method = javaClassStatic()->getMethod<void(jni::alias_ref<jni::JString> /* path */, jni::alias_ref<jni::JDouble> /* backlog */)>("listenUnix");
     method(_javaPart, jni::make_jstring(path), backlog.has_value() ? jni::JDouble::valueOf(backlog.value()) : nullptr);
   }
+  void JHybridNetServerDriverSpec::listenTLSUnix(const std::string& path, double secureContextId, std::optional<double> backlog) {
+    static const auto method = javaClassStatic()->getMethod<void(jni::alias_ref<jni::JString> /* path */, double /* secureContextId */, jni::alias_ref<jni::JDouble> /* backlog */)>("listenTLSUnix");
+    method(_javaPart, jni::make_jstring(path), secureContextId, backlog.has_value() ? jni::JDouble::valueOf(backlog.value()) : nullptr);
+  }
   void JHybridNetServerDriverSpec::listenHandle(double fd, std::optional<double> backlog) {
     static const auto method = javaClassStatic()->getMethod<void(double /* fd */, jni::alias_ref<jni::JDouble> /* backlog */)>("listenHandle");
     method(_javaPart, fd, backlog.has_value() ? jni::JDouble::valueOf(backlog.value()) : nullptr);

package/nitrogen/generated/android/c++/JHybridNetServerDriverSpec.hpp

@@ -60,6 +60,7 @@ namespace margelo::nitro::net {
     void listen(double port, std::optional<double> backlog, std::optional<bool> ipv6Only, std::optional<bool> reusePort) override;
     void listenTLS(double port, double secureContextId, std::optional<double> backlog, std::optional<bool> ipv6Only, std::optional<bool> reusePort) override;
     void listenUnix(const std::string& path, std::optional<double> backlog) override;
+    void listenTLSUnix(const std::string& path, double secureContextId, std::optional<double> backlog) override;
     void listenHandle(double fd, std::optional<double> backlog) override;
     std::string getLocalAddress() override;
     void close() override;

package/nitrogen/generated/android/c++/JHybridNetSocketDriverSpec.cpp

@@ -175,6 +175,15 @@ namespace margelo::nitro::net {
     static const auto method = javaClassStatic()->getMethod<void()>("enableKeylog");
     method(_javaPart);
   }
+  void JHybridNetSocketDriverSpec::enableTrace() {
+    static const auto method = javaClassStatic()->getMethod<void()>("enableTrace");
+    method(_javaPart);
+  }
+  std::optional<std::shared_ptr<ArrayBuffer>> JHybridNetSocketDriverSpec::exportKeyingMaterial(double length, const std::string& label, const std::optional<std::shared_ptr<ArrayBuffer>>& context) {
+    static const auto method = javaClassStatic()->getMethod<jni::local_ref<JArrayBuffer::javaobject>(double /* length */, jni::alias_ref<jni::JString> /* label */, jni::alias_ref<JArrayBuffer::javaobject> /* context */)>("exportKeyingMaterial");
+    auto __result = method(_javaPart, length, jni::make_jstring(label), context.has_value() ? JArrayBuffer::wrap(context.value()) : nullptr);
+    return __result != nullptr ? std::make_optional(__result->cthis()->getArrayBuffer()) : std::nullopt;
+  }
   void JHybridNetSocketDriverSpec::setNoDelay(bool enable) {
     static const auto method = javaClassStatic()->getMethod<void(jboolean /* enable */)>("setNoDelay");
     method(_javaPart, enable);

package/nitrogen/generated/android/c++/JHybridNetSocketDriverSpec.hpp

@@ -80,6 +80,8 @@ namespace margelo::nitro::net {
     void destroy() override;
     void resetAndDestroy() override;
     void enableKeylog() override;
+    void enableTrace() override;
+    std::optional<std::shared_ptr<ArrayBuffer>> exportKeyingMaterial(double length, const std::string& label, const std::optional<std::shared_ptr<ArrayBuffer>>& context) override;
     void setNoDelay(bool enable) override;
     void setKeepAlive(bool enable, double delay) override;
     std::string getLocalAddress() override;

package/nitrogen/generated/android/c++/JNetConfig.hpp

@@ -33,8 +33,11 @@ namespace margelo::nitro::net {
       static const auto clazz = javaClassStatic();
       static const auto fieldWorkerThreads = clazz->getField<jni::JDouble>("workerThreads");
       jni::local_ref<jni::JDouble> workerThreads = this->getFieldValue(fieldWorkerThreads);
+      static const auto fieldDebug = clazz->getField<jni::JBoolean>("debug");
+      jni::local_ref<jni::JBoolean> debug = this->getFieldValue(fieldDebug);
       return NetConfig(
-        workerThreads != nullptr ? std::make_optional(workerThreads->value()) : std::nullopt
+        workerThreads != nullptr ? std::make_optional(workerThreads->value()) : std::nullopt,
+        debug != nullptr ? std::make_optional(static_cast<bool>(debug->value())) : std::nullopt
       );
     }
 
@@ -44,12 +47,13 @@ namespace margelo::nitro::net {
      */
     [[maybe_unused]]
     static jni::local_ref<JNetConfig::javaobject> fromCpp(const NetConfig& value) {
-      using JSignature = JNetConfig(jni::alias_ref<jni::JDouble>);
+      using JSignature = JNetConfig(jni::alias_ref<jni::JDouble>, jni::alias_ref<jni::JBoolean>);
       static const auto clazz = javaClassStatic();
       static const auto create = clazz->getStaticMethod<JSignature>("fromCpp");
       return create(
         clazz,
-        value.workerThreads.has_value() ? jni::JDouble::valueOf(value.workerThreads.value()) : nullptr
+        value.workerThreads.has_value() ? jni::JDouble::valueOf(value.workerThreads.value()) : nullptr,
+        value.debug.has_value() ? jni::JBoolean::valueOf(value.debug.value()) : nullptr
       );
     }
   };