add missing native APIs in node:tls (#8638)

Author: vicb

.changeset/short-dryers-look.md

@@ -0,0 +1,7 @@
+---
+"@cloudflare/unenv-preset": patch
+---
+
+Use native APIs in `node:tls`
+
+Uses `checkServerIdentity`, `createSecureContext`, and `SecureContext` from workerd rather than the unenv polyfill.

fixtures/nodejs-hybrid-app/src/index.ts

@@ -207,6 +207,9 @@ async function testTls() {
 
 	assert.strictEqual(typeof tls.connect, "function");
 	assert.strictEqual(typeof tls.TLSSocket, "function");
+	assert.strictEqual(typeof tls.checkServerIdentity, "function");
+	assert.strictEqual(typeof tls.createSecureContext, "function");
+	assert.strictEqual(typeof tls.SecureContext, "function");
 
 	return new Response("OK");
 }

packages/unenv-preset/package.json

@@ -54,7 +54,7 @@
 	},
 	"peerDependencies": {
 		"unenv": "2.0.0-rc.15",
-		"workerd": "^1.20250311.0"
+		"workerd": "^1.20250320.0"
 	},
 	"peerDependenciesMeta": {
 		"workerd": {

packages/unenv-preset/src/runtime/node/tls.ts

@@ -1,9 +1,7 @@
 import {
-	checkServerIdentity,
 	CLIENT_RENEG_LIMIT,
 	CLIENT_RENEG_WINDOW,
 	convertALPNProtocols,
-	createSecureContext,
 	createSecurePair,
 	createServer,
 	DEFAULT_CIPHERS,
@@ -12,17 +10,14 @@ import {
 	DEFAULT_MIN_VERSION,
 	getCiphers,
 	rootCertificates,
-	SecureContext,
 	Server,
 } from "unenv/node/tls";
 import type nodeTls from "node:tls";
 
 export {
-	checkServerIdentity,
 	CLIENT_RENEG_LIMIT,
 	CLIENT_RENEG_WINDOW,
 	convertALPNProtocols,
-	createSecureContext,
 	createSecurePair,
 	createServer,
 	DEFAULT_CIPHERS,
@@ -31,14 +26,20 @@ export {
 	DEFAULT_MIN_VERSION,
 	getCiphers,
 	rootCertificates,
-	SecureContext,
 	Server,
 } from "unenv/node/tls";
 
 const workerdTls = process.getBuiltinModule("node:tls");
 
 // Natively implemented in workerd
-export const { connect, TLSSocket } = workerdTls;
+export const {
+	checkServerIdentity,
+	connect,
+	createSecureContext,
+	// @ts-expect-error Node typings wrongly declare `SecureContext` as an interface
+	SecureContext,
+	TLSSocket,
+} = workerdTls;
 
 export default {
 	CLIENT_RENEG_LIMIT,