Networking modules
Reference for Cruft's Node networking modules, node:net (TCP), node:tls (TLS 1.3), node:dns, node:dgram (UDP), and node:http2, with the surface each exposes and how deep it goes. All network operations are capability-gated in sealed modes.
Cruft's Node networking surface is the Node-idiom adapter over the host's own transports (TCP sockets, TLS 1.3, DNS, UDP, HTTP/2). Depth varies per module: node:net is focused (server + client socket lifecycle over the shared host polling loop); node:tls is focused client / partial server (TLS 1.3 client handshake over the host TLS layer; createServer is a partial adapter); node:dns and node:dns/promises are focused (lookup plus the common resolve family); node:dgram is focused (UDP sockets with message events); node:http2 is minimal (single-stream client session only). Sockets, DNS callbacks, and datagram delivery are all driven by the host event loop; open servers and bound sockets keep the process alive. Network operations are capability-gated: in sealed modes, connect/listen/DNS authority must be granted explicitly; it is never ambient. node:http/node:https are documented in the HTTP module.
Import forms
import net from 'node:net'; // bare 'net' also resolves
import tls from 'node:tls';
import dns from 'node:dns';
import dnsPromises from 'node:dns/promises'; // also dns.promises
import dgram from 'node:dgram';
import http2 from 'node:http2';node:net (TCP), focused
| Area | Surface |
|---|---|
| Module | createServer, connect / createConnection, isIP, isIPv4, isIPv6, Server, Socket, SocketAddress, BlockList, getDefaultAutoSelectFamily/setDefaultAutoSelectFamily (+ attempt-timeout variants) |
Server | listen, close, address, listening, ref/unref, connection events, full EventEmitter surface (on/once/off/emit/listeners/removeAllListeners/prepend*/setMaxListeners, …) |
Socket | connect, write, end, destroy, pause/resume, setEncoding, setKeepAlive, setNoDelay, setTimeout, cork/uncork, ref/unref; properties remoteAddress/remotePort/remoteFamily, localAddress/localPort, bytesRead/bytesWritten, readyState, connecting, readable/writable |
| Events | connection, data, end, close, error, timeout, finish |
Servers listen through the same host polling loop used by HTTP serving. Errors surface Node-style codes (e.g. ECONNRESET, ENOENT).
node:tls, focused client, partial server
| Area | Surface |
|---|---|
| Client | tls.connect(port, host[, options][, callback]) → TLSSocket performing a TLS 1.3 handshake; options include host, port, ca, servername, rejectUnauthorized, ALPNProtocols, checkServerIdentity |
TLSSocket | write, end, destroy, setEncoding, setNoDelay, setTimeout, address; encrypted, authorized; events secureConnect, data, close, error |
| Server (partial) | createServer, Server, secureConnection event; not full Node TLS server parity, and createSecureServer is not exported |
| Constants/helpers | createSecureContext, SecureContext, convertALPNProtocols, getCiphers, getCACertificates/setDefaultCACertificates, rootCertificates, DEFAULT_CIPHERS, DEFAULT_ECDH_CURVE, DEFAULT_MIN_VERSION/DEFAULT_MAX_VERSION, CLIENT_RENEG_LIMIT/CLIENT_RENEG_WINDOW |
node:dns and node:dns/promises, focused
Both forms route through the host DNS module's wire implementation. The promise API is available as node:dns/promises and as dns.promises.
| Area | Surface |
|---|---|
| Lookup | lookup(hostname[, options], cb), lookupService; hints constants ADDRCONFIG, V4MAPPED, ALL; result-order getDefaultResultOrder/setDefaultResultOrder (verbatim) |
| Resolve family | resolve, resolve4, resolve6, resolveAny, resolveCaa, resolveCname, resolveMx, resolveNaptr, resolveNs, resolvePtr, resolveSoa, resolveSrv, resolveTlsa, resolveTxt, reverse |
| Resolver | Resolver class with getServers/setServers and the resolve family |
| Errors | Bare-named constants (NOTFOUND, NODATA, SERVFAIL, REFUSED, TIMEOUT, FORMERR, CONNREFUSED, …) whose values are the E-prefixed strings (dns.NOTFOUND === "ENOTFOUND"), matching Node; the E-prefixed names themselves are not exported (dns.ENOTFOUND is undefined) |
Record objects carry Node-shaped fields (address/family for lookup; priority/exchange for MX; nsname/hostmaster/serial/refresh/retry/expire/minttl for SOA; priority/weight/port/name for SRV). DNS is host network authority under capability gating.
node:dgram (UDP), focused
| Area | Surface |
|---|---|
| Module | createSocket(type[, listener]) with udp4 / udp6 |
Socket | bind, send, connect/disconnect, close, address, ref/unref, setBroadcast, setTTL, setMulticastTTL, addMembership/dropMembership, setRecvBufferSize/setSendBufferSize |
| Events | listening, message (buffer + rinfo {address, family, port, size}), error, close |
Bound sockets are polled by the shared host event loop.
node:http2, minimal client
http2.connect(url) creates a minimal client session; .request(headers) returns a stream-like EventEmitter.
| Area | Surface |
|---|---|
| Session | connect(url), close, ping, goaway handling, ref/unref, setTimeout |
| Request stream | request(headers) → stream with write/end, pause/resume, setEncoding; events response, data, end, error, close |
Single-stream request/response is the documented path. TLS/h2 routes through the same host transport.
Limitations
Unlisted APIs should be assumed absent; never infer completeness from a module resolving.
- net: no IPC (Unix-socket/named-pipe) server documentation claim; treat pipe paths as untested. Half-open socket semantics and backpressure fidelity are not guaranteed to match Node exactly.
- tls: server adapter is partial (handshake machinery exists in the host TLS layer, Node-parity server behavior is not claimed); no renegotiation, no session resumption API, no OCSP, no PSK. TLS 1.3 only, do not expect TLS 1.2 interop knobs.
- dns: no
dns.ADDRCONFIG-driven interface filtering guarantees; caching behavior is host-defined, not Node's. - dgram: multicast membership helpers exist but multicast behavior beyond join/leave/TTL is unverified.
- http2: no server (
createServer/createSecureServerfor h2), no push streams, no broad multiplexing, no extended flow-control settings surface. ref/unrefare no-ops here. Sockets, servers, dgram sockets, and http2 sessions acceptref()/unref()so libraries that probe them do not throw, but the calls do nothing: an open socket or listening server keeps the event loop alive whether or not youunrefit. Only timers honorref/unref.- Everything here is capability-gated network authority; sealed compartments must be granted connect/listen/DNS rights explicitly.
All async completion (connects, reads, DNS answers, datagrams, h2 frames) is delivered via the host event loop; callback ordering follows the loop's scheduling rather than Node's exact libuv phase order.