[tls] General compatibility improvements (#3596)

* wip

* subjectaltname

* more progress

* bindings

* fmt

* getCert/getPeerCertificate

* fix checkServerIdentity

* fix checkServerIdentity

* add a lot of TLSSocket functions

* getEphemeralKeyInfo fix and comment

* add alternative for getEphemeralKeyInfo

* add get session and set session

* fix isSessionReused

* get back the raw data for MSSQL

* fixeup

* fixup getSession + tests

* fix doc + fmt

* getFinished/getPeerFinished

* codegen

* fixup

* revert webkit

* more fixes

* ssl helper + revert test oops

* asserts

12 files changed, 2190 insertions, 7 deletions

diff --git a/src/bun.js/api/bun/socket.zig b/src/bun.js/api/bun/socket.zig
index 1d85c705c..0a18dd015 100644
--- a/src/bun.js/api/bun/socket.zig
+++ b/src/bun.js/api/bun/socket.zig
@@ -16,6 +16,8 @@ const Which = @import("../../../which.zig");
 const uws = @import("root").bun.uws;
 const ZigString = JSC.ZigString;
 const BoringSSL = bun.BoringSSL;
+const X509 = @import("./x509.zig");
+
 // const Corker = struct {
 //     ptr: ?*[16384]u8 = null,
 //     holder: ?*anyopaque = null,
@@ -56,6 +58,79 @@ const BoringSSL = bun.BoringSSL;
 //     }
 // };
 
+noinline fn getSSLException(globalThis: *JSC.JSGlobalObject, defaultMessage: []const u8) JSValue {
+    var zig_str: ZigString = ZigString.init("");
+    var output_buf: [4096]u8 = undefined;
+
+    output_buf[0] = 0;
+    var written: usize = 0;
+    var ssl_error = BoringSSL.ERR_get_error();
+    while (ssl_error != 0 and written < output_buf.len) : (ssl_error = BoringSSL.ERR_get_error()) {
+        if (written > 0) {
+            output_buf[written] = '\n';
+            written += 1;
+        }
+
+        if (BoringSSL.ERR_reason_error_string(
+            ssl_error,
+        )) |reason_ptr| {
+            const reason = std.mem.span(reason_ptr);
+            if (reason.len == 0) {
+                break;
+            }
+            @memcpy(output_buf[written..][0..reason.len], reason);
+            written += reason.len;
+        }
+
+        if (BoringSSL.ERR_func_error_string(
+            ssl_error,
+        )) |reason_ptr| {
+            const reason = std.mem.span(reason_ptr);
+            if (reason.len > 0) {
+                output_buf[written..][0.." via ".len].* = " via ".*;
+                written += " via ".len;
+                @memcpy(output_buf[written..][0..reason.len], reason);
+                written += reason.len;
+            }
+        }
+
+        if (BoringSSL.ERR_lib_error_string(
+            ssl_error,
+        )) |reason_ptr| {
+            const reason = std.mem.span(reason_ptr);
+            if (reason.len > 0) {
+                output_buf[written..][0] = ' ';
+                written += 1;
+                @memcpy(output_buf[written..][0..reason.len], reason);
+                written += reason.len;
+            }
+        }
+    }
+
+    if (written > 0) {
+        var message = output_buf[0..written];
+        zig_str = ZigString.init(std.fmt.allocPrint(bun.default_allocator, "OpenSSL {s}", .{message}) catch unreachable);
+        var encoded_str = zig_str.withEncoding();
+        encoded_str.mark();
+
+        // We shouldn't *need* to do this but it's not entirely clear.
+        BoringSSL.ERR_clear_error();
+    }
+
+    if (zig_str.len == 0) {
+        zig_str = ZigString.init(defaultMessage);
+    }
+
+    // store the exception in here
+    // toErrorInstance clones the string
+    const exception = zig_str.toErrorInstance(globalThis);
+
+    // reference it in stack memory
+    exception.ensureStillAlive();
+
+    return exception;
+}
+
 fn normalizeHost(input: anytype) @TypeOf(input) {
     if (input.len == 0) {
         return "localhost";
@@ -66,7 +141,6 @@ fn normalizeHost(input: anytype) @TypeOf(input) {
 
     return input;
 }
-
 const BinaryType = JSC.BinaryType;
 
 const WrappedType = enum {
@@ -1175,7 +1249,7 @@ fn NewSocket(comptime ssl: bool) type {
 
             // Add SNI support for TLS (mongodb and others requires this)
             if (comptime ssl) {
-                var ssl_ptr: *BoringSSL.SSL = @ptrCast(*BoringSSL.SSL, socket.getNativeHandle());
+                var ssl_ptr = this.socket.ssl();
                 if (!ssl_ptr.isInitFinished()) {
                     if (this.server_name) |server_name| {
                         const host = normalizeHost(server_name);
@@ -1880,6 +1954,107 @@ fn NewSocket(comptime ssl: bool) type {
             return JSValue.jsUndefined();
         }
 
+        pub fn getTLSTicket(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            var ssl_ptr = this.socket.ssl();
+            const session = BoringSSL.SSL_get_session(ssl_ptr) orelse return JSValue.jsUndefined();
+            var ticket: [*c]const u8 = undefined;
+            var length: usize = 0;
+            //The pointer is only valid while the connection is in use so we need to copy it
+            BoringSSL.SSL_SESSION_get0_ticket(session, @ptrCast([*c][*c]const u8, &ticket), &length);
+
+            if (ticket == null or length == 0) {
+                return JSValue.jsUndefined();
+            }
+
+            return JSC.ArrayBuffer.createBuffer(globalObject, ticket[0..length]);
+        }
+
+        pub fn setSession(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            callframe: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            const args = callframe.arguments(1);
+
+            if (args.len < 1) {
+                globalObject.throw("Expected session to be a string, Buffer or TypedArray", .{});
+                return .zero;
+            }
+
+            const session_arg = args.ptr[0];
+            var arena: bun.ArenaAllocator = bun.ArenaAllocator.init(bun.default_allocator);
+            defer arena.deinit();
+
+            var exception_ref = [_]JSC.C.JSValueRef{null};
+            var exception: JSC.C.ExceptionRef = &exception_ref;
+            if (JSC.Node.StringOrBuffer.fromJS(globalObject, arena.allocator(), session_arg, exception)) |sb| {
+                var session_slice = sb.slice();
+                var ssl_ptr = this.socket.ssl();
+                var tmp = @ptrCast([*c]const u8, session_slice.ptr);
+                const session = BoringSSL.d2i_SSL_SESSION(null, &tmp, @intCast(c_long, session_slice.len)) orelse return JSValue.jsUndefined();
+                if (BoringSSL.SSL_set_session(ssl_ptr, session) != 1) {
+                    globalObject.throwValue(getSSLException(globalObject, "SSL_set_session error"));
+                    return .zero;
+                }
+                return JSValue.jsUndefined();
+            } else if (exception.* != null) {
+                globalObject.throwValue(JSC.JSValue.c(exception.*));
+                return .zero;
+            } else {
+                globalObject.throw("Expected session to be a string, Buffer or TypedArray", .{});
+                return .zero;
+            }
+        }
+
+        pub fn getSession(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            var ssl_ptr = this.socket.ssl();
+            const session = BoringSSL.SSL_get_session(ssl_ptr) orelse return JSValue.jsUndefined();
+            const size = BoringSSL.i2d_SSL_SESSION(session, null);
+            if (size <= 0) {
+                return JSValue.jsUndefined();
+            }
+
+            const buffer_size = @intCast(usize, size);
+            var buffer = JSValue.createBufferFromLength(globalObject, buffer_size);
+            var buffer_ptr = @ptrCast([*c]u8, buffer.asArrayBuffer(globalObject).?.ptr);
+
+            const result_size = BoringSSL.i2d_SSL_SESSION(session, &buffer_ptr);
+            std.debug.assert(result_size == size);
+            return buffer;
+        }
+
         pub fn getALPNProtocol(
             this: *This,
             globalObject: *JSC.JSGlobalObject,
@@ -1895,7 +2070,7 @@ fn NewSocket(comptime ssl: bool) type {
             var alpn_proto: [*c]const u8 = null;
             var alpn_proto_len: u32 = 0;
 
-            var ssl_ptr: *BoringSSL.SSL = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            var ssl_ptr = this.socket.ssl();
             BoringSSL.SSL_get0_alpn_selected(ssl_ptr, &alpn_proto, &alpn_proto_len);
             if (alpn_proto == null or alpn_proto_len == 0) {
                 return JSValue.jsBoolean(false);
@@ -1910,7 +2085,502 @@ fn NewSocket(comptime ssl: bool) type {
             }
             return ZigString.fromUTF8(slice).toValueGC(globalObject);
         }
+        pub fn exportKeyingMaterial(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            callframe: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            const args = callframe.arguments(3);
+            if (args.len < 2) {
+                globalObject.throw("Expected length and label to be provided", .{});
+                return .zero;
+            }
+            const length_arg = args.ptr[0];
+            if (!length_arg.isNumber()) {
+                globalObject.throw("Expected length to be a number", .{});
+                return .zero;
+            }
+
+            const length = length_arg.coerceToInt64(globalObject);
+            if (length < 0) {
+                globalObject.throw("Expected length to be a positive number", .{});
+                return .zero;
+            }
+
+            const label_arg = args.ptr[1];
+            if (!label_arg.isString()) {
+                globalObject.throw("Expected label to be a string", .{});
+                return .zero;
+            }
+
+            var label = label_arg.toSliceOrNull(globalObject) orelse {
+                globalObject.throw("Expected label to be a string", .{});
+                return .zero;
+            };
+
+            defer label.deinit();
+            const label_slice = label.slice();
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+
+            if (args.len > 2) {
+                const context_arg = args.ptr[2];
+
+                var arena: bun.ArenaAllocator = bun.ArenaAllocator.init(bun.default_allocator);
+                defer arena.deinit();
+
+                var exception_ref = [_]JSC.C.JSValueRef{null};
+                var exception: JSC.C.ExceptionRef = &exception_ref;
+                if (JSC.Node.StringOrBuffer.fromJS(globalObject, arena.allocator(), context_arg, exception)) |sb| {
+                    const context_slice = sb.slice();
+
+                    const buffer_size = @intCast(usize, length);
+                    var buffer = JSValue.createBufferFromLength(globalObject, buffer_size);
+                    var buffer_ptr = @ptrCast([*c]u8, buffer.asArrayBuffer(globalObject).?.ptr);
+
+                    const result = BoringSSL.SSL_export_keying_material(ssl_ptr, buffer_ptr, buffer_size, @ptrCast([*c]const u8, label_slice.ptr), label_slice.len, @ptrCast([*c]const u8, context_slice.ptr), context_slice.len, 1);
+                    if (result != 1) {
+                        globalObject.throwValue(getSSLException(globalObject, "Failed to export keying material"));
+                        return .zero;
+                    }
+                    return buffer;
+                } else if (exception.* != null) {
+                    globalObject.throwValue(JSC.JSValue.c(exception.*));
+                    return .zero;
+                } else {
+                    globalObject.throw("Expected context to be a string, Buffer or TypedArray", .{});
+                    return .zero;
+                }
+            } else {
+                const buffer_size = @intCast(usize, length);
+                var buffer = JSValue.createBufferFromLength(globalObject, buffer_size);
+                var buffer_ptr = @ptrCast([*c]u8, buffer.asArrayBuffer(globalObject).?.ptr);
+
+                const result = BoringSSL.SSL_export_keying_material(ssl_ptr, buffer_ptr, buffer_size, @ptrCast([*c]const u8, label_slice.ptr), label_slice.len, null, 0, 0);
+                if (result != 1) {
+                    globalObject.throwValue(getSSLException(globalObject, "Failed to export keying material"));
+                    return .zero;
+                }
+                return buffer;
+            }
+        }
+
+        pub fn getEphemeralKeyInfo(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsNull();
+            }
+
+            if (this.detached) {
+                return JSValue.jsNull();
+            }
+
+            // only available for clients
+            if (this.handlers.is_server) {
+                return JSValue.jsNull();
+            }
+            var result = JSValue.createEmptyObject(globalObject, 3);
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            // TODO: investigate better option or compatible way to get the key
+            // this implementation follows nodejs but for BoringSSL SSL_get_server_tmp_key will always return 0
+            // wich will result in a empty object
+            // var raw_key: [*c]BoringSSL.EVP_PKEY = undefined;
+            // if (BoringSSL.SSL_get_server_tmp_key(ssl_ptr, @ptrCast([*c][*c]BoringSSL.EVP_PKEY, &raw_key)) == 0) {
+            //     return result;
+            // }
+            var raw_key: [*c]BoringSSL.EVP_PKEY = BoringSSL.SSL_get_privatekey(ssl_ptr);
+            if (raw_key == null) {
+                return result;
+            }
+
+            const kid = BoringSSL.EVP_PKEY_id(raw_key);
+            const bits = BoringSSL.EVP_PKEY_bits(raw_key);
+
+            switch (kid) {
+                BoringSSL.EVP_PKEY_DH => {
+                    result.put(globalObject, ZigString.static("type"), ZigString.static("DH").toValue(globalObject));
+                    result.put(globalObject, ZigString.static("size"), JSValue.jsNumber(bits));
+                },
+
+                BoringSSL.EVP_PKEY_EC, BoringSSL.EVP_PKEY_X25519, BoringSSL.EVP_PKEY_X448 => {
+                    var curve_name: []const u8 = undefined;
+                    if (kid == BoringSSL.EVP_PKEY_EC) {
+                        const ec = BoringSSL.EVP_PKEY_get1_EC_KEY(raw_key);
+                        const nid = BoringSSL.EC_GROUP_get_curve_name(BoringSSL.EC_KEY_get0_group(ec));
+                        const nid_str = BoringSSL.OBJ_nid2sn(nid);
+                        if (nid_str != null) {
+                            curve_name = nid_str[0..bun.len(nid_str)];
+                        } else {
+                            curve_name = "";
+                        }
+                    } else {
+                        const kid_str = BoringSSL.OBJ_nid2sn(kid);
+                        if (kid_str != null) {
+                            curve_name = kid_str[0..bun.len(kid_str)];
+                        } else {
+                            curve_name = "";
+                        }
+                    }
+                    result.put(globalObject, ZigString.static("type"), ZigString.static("ECDH").toValue(globalObject));
+                    result.put(globalObject, ZigString.static("name"), ZigString.fromUTF8(curve_name).toValueGC(globalObject));
+                    result.put(globalObject, ZigString.static("size"), JSValue.jsNumber(bits));
+                },
+                else => {},
+            }
+            return result;
+        }
+
+        pub fn getCipher(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
 
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+            var result = JSValue.createEmptyObject(globalObject, 3);
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            const cipher = BoringSSL.SSL_get_current_cipher(ssl_ptr);
+            if (cipher == null) {
+                result.put(globalObject, ZigString.static("name"), JSValue.jsNull());
+                result.put(globalObject, ZigString.static("standardName"), JSValue.jsNull());
+                result.put(globalObject, ZigString.static("version"), JSValue.jsNull());
+                return result;
+            }
+
+            const name = BoringSSL.SSL_CIPHER_get_name(cipher);
+            if (name == null) {
+                result.put(globalObject, ZigString.static("name"), JSValue.jsNull());
+            } else {
+                result.put(globalObject, ZigString.static("name"), ZigString.fromUTF8(name[0..bun.len(name)]).toValueGC(globalObject));
+            }
+
+            const standard_name = BoringSSL.SSL_CIPHER_standard_name(cipher);
+            if (standard_name == null) {
+                result.put(globalObject, ZigString.static("standardName"), JSValue.jsNull());
+            } else {
+                result.put(globalObject, ZigString.static("standardName"), ZigString.fromUTF8(standard_name[0..bun.len(standard_name)]).toValueGC(globalObject));
+            }
+
+            const version = BoringSSL.SSL_CIPHER_get_version(cipher);
+            if (version == null) {
+                result.put(globalObject, ZigString.static("version"), JSValue.jsNull());
+            } else {
+                result.put(globalObject, ZigString.static("version"), ZigString.fromUTF8(version[0..bun.len(version)]).toValueGC(globalObject));
+            }
+
+            return result;
+        }
+
+        pub fn getTLSPeerFinishedMessage(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            // We cannot just pass nullptr to SSL_get_peer_finished()
+            // because it would further be propagated to memcpy(),
+            // where the standard requirements as described in ISO/IEC 9899:2011
+            // sections 7.21.2.1, 7.21.1.2, and 7.1.4, would be violated.
+            // Thus, we use a dummy byte.
+            var dummy: [1]u8 = undefined;
+            const size = BoringSSL.SSL_get_peer_finished(ssl_ptr, @ptrCast(*anyopaque, &dummy), @sizeOf(@TypeOf(dummy)));
+            if (size == 0) return JSValue.jsUndefined();
+
+            const buffer_size = @intCast(usize, size);
+            var buffer = JSValue.createBufferFromLength(globalObject, buffer_size);
+            var buffer_ptr = @ptrCast(*anyopaque, buffer.asArrayBuffer(globalObject).?.ptr);
+
+            const result_size = BoringSSL.SSL_get_peer_finished(ssl_ptr, buffer_ptr, buffer_size);
+            std.debug.assert(result_size == size);
+            return buffer;
+        }
+
+        pub fn getTLSFinishedMessage(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            // We cannot just pass nullptr to SSL_get_finished()
+            // because it would further be propagated to memcpy(),
+            // where the standard requirements as described in ISO/IEC 9899:2011
+            // sections 7.21.2.1, 7.21.1.2, and 7.1.4, would be violated.
+            // Thus, we use a dummy byte.
+            var dummy: [1]u8 = undefined;
+            const size = BoringSSL.SSL_get_finished(ssl_ptr, @ptrCast(*anyopaque, &dummy), @sizeOf(@TypeOf(dummy)));
+            if (size == 0) return JSValue.jsUndefined();
+
+            const buffer_size = @intCast(usize, size);
+            var buffer = JSValue.createBufferFromLength(globalObject, buffer_size);
+            var buffer_ptr = @ptrCast(*anyopaque, buffer.asArrayBuffer(globalObject).?.ptr);
+
+            const result_size = BoringSSL.SSL_get_finished(ssl_ptr, buffer_ptr, buffer_size);
+            std.debug.assert(result_size == size);
+            return buffer;
+        }
+
+        pub fn getSharedSigalgs(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            JSC.markBinding(@src());
+            if (comptime ssl == false) {
+                return JSValue.jsNull();
+            }
+
+            if (this.detached) {
+                return JSValue.jsNull();
+            }
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+
+            const nsig = BoringSSL.SSL_get_shared_sigalgs(ssl_ptr, 0, null, null, null, null, null);
+
+            const array = JSC.JSValue.createEmptyArray(globalObject, @intCast(usize, nsig));
+
+            for (0..@intCast(usize, nsig)) |i| {
+                var hash_nid: c_int = 0;
+                var sign_nid: c_int = 0;
+                var sig_with_md: []const u8 = "";
+
+                _ = BoringSSL.SSL_get_shared_sigalgs(ssl_ptr, @intCast(c_int, i), &sign_nid, &hash_nid, null, null, null);
+                switch (sign_nid) {
+                    BoringSSL.EVP_PKEY_RSA => {
+                        sig_with_md = "RSA";
+                    },
+                    BoringSSL.EVP_PKEY_RSA_PSS => {
+                        sig_with_md = "RSA-PSS";
+                    },
+
+                    BoringSSL.EVP_PKEY_DSA => {
+                        sig_with_md = "DSA";
+                    },
+
+                    BoringSSL.EVP_PKEY_EC => {
+                        sig_with_md = "ECDSA";
+                    },
+
+                    BoringSSL.NID_ED25519 => {
+                        sig_with_md = "Ed25519";
+                    },
+
+                    BoringSSL.NID_ED448 => {
+                        sig_with_md = "Ed448";
+                    },
+                    BoringSSL.NID_id_GostR3410_2001 => {
+                        sig_with_md = "gost2001";
+                    },
+
+                    BoringSSL.NID_id_GostR3410_2012_256 => {
+                        sig_with_md = "gost2012_256";
+                    },
+                    BoringSSL.NID_id_GostR3410_2012_512 => {
+                        sig_with_md = "gost2012_512";
+                    },
+                    else => {
+                        const sn_str = BoringSSL.OBJ_nid2sn(sign_nid);
+                        if (sn_str != null) {
+                            sig_with_md = sn_str[0..bun.len(sn_str)];
+                        } else {
+                            sig_with_md = "UNDEF";
+                        }
+                    },
+                }
+
+                const hash_str = BoringSSL.OBJ_nid2sn(hash_nid);
+                if (hash_str != null) {
+                    const hash_str_len = bun.len(hash_str);
+                    const hash_slice = hash_str[0..hash_str_len];
+                    const buffer = bun.default_allocator.alloc(u8, sig_with_md.len + hash_str_len + 1) catch unreachable;
+                    defer bun.default_allocator.free(buffer);
+
+                    bun.copy(u8, buffer, sig_with_md);
+                    buffer[sig_with_md.len] = '+';
+                    bun.copy(u8, buffer[sig_with_md.len + 1 ..], hash_slice);
+                    array.putIndex(globalObject, @intCast(u32, i), JSC.ZigString.fromUTF8(buffer).toValueGC(globalObject));
+                } else {
+                    const buffer = bun.default_allocator.alloc(u8, sig_with_md.len + 6) catch unreachable;
+                    defer bun.default_allocator.free(buffer);
+
+                    bun.copy(u8, buffer, sig_with_md);
+                    bun.copy(u8, buffer[sig_with_md.len..], "+UNDEF");
+                    array.putIndex(globalObject, @intCast(u32, i), JSC.ZigString.fromUTF8(buffer).toValueGC(globalObject));
+                }
+            }
+            return array;
+        }
+
+        pub fn getTLSVersion(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            JSC.markBinding(@src());
+            if (comptime ssl == false) {
+                return JSValue.jsNull();
+            }
+
+            if (this.detached) {
+                return JSValue.jsNull();
+            }
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            const version = BoringSSL.SSL_get_version(ssl_ptr);
+            if (version == null) return JSValue.jsNull();
+            const version_len = bun.len(version);
+            if (version_len == 0) return JSValue.jsNull();
+            const slice = version[0..version_len];
+            return ZigString.fromUTF8(slice).toValueGC(globalObject);
+        }
+
+        pub fn setMaxSendFragment(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            callframe: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            JSC.markBinding(@src());
+            if (comptime ssl == false) {
+                return JSValue.jsBoolean(false);
+            }
+
+            if (this.detached) {
+                return JSValue.jsBoolean(false);
+            }
+
+            const args = callframe.arguments(1);
+
+            if (args.len < 1) {
+                globalObject.throw("Expected size to be a number", .{});
+                return .zero;
+            }
+
+            const arg = args.ptr[0];
+            if (!arg.isNumber()) {
+                globalObject.throw("Expected size to be a number", .{});
+                return .zero;
+            }
+            const size = args.ptr[0].coerceToInt64(globalObject);
+            if (size < 1) {
+                globalObject.throw("Expected size to be greater than 1", .{});
+                return .zero;
+            }
+            if (size > 16384) {
+                globalObject.throw("Expected size to be less than 16385", .{});
+                return .zero;
+            }
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            return JSValue.jsBoolean(BoringSSL.SSL_set_max_send_fragment(ssl_ptr, @intCast(usize, size)) == 1);
+        }
+        pub fn getPeerCertificate(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            callframe: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            JSC.markBinding(@src());
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            const args = callframe.arguments(1);
+            var abbreviated: bool = true;
+            if (args.len > 0) {
+                const arg = args.ptr[0];
+                if (!arg.isBoolean()) {
+                    globalObject.throw("Expected abbreviated to be a boolean", .{});
+                    return .zero;
+                }
+                abbreviated = arg.toBoolean();
+            }
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+
+            if (abbreviated) {
+                if (this.handlers.is_server) {
+                    const cert = BoringSSL.SSL_get_peer_certificate(ssl_ptr);
+                    if (cert) |x509| {
+                        return X509.toJS(x509, globalObject);
+                    }
+                }
+
+                const cert_chain = BoringSSL.SSL_get_peer_cert_chain(ssl_ptr) orelse return JSValue.jsUndefined();
+                const cert = BoringSSL.sk_X509_value(cert_chain, 0) orelse return JSValue.jsUndefined();
+                return X509.toJS(cert, globalObject);
+            }
+            var cert: ?*BoringSSL.X509 = null;
+            if (this.handlers.is_server) {
+                cert = BoringSSL.SSL_get_peer_certificate(ssl_ptr);
+            }
+
+            const cert_chain = BoringSSL.SSL_get_peer_cert_chain(ssl_ptr);
+            const first_cert = if (cert) |c| c else if (cert_chain) |cc| BoringSSL.sk_X509_value(cc, 0) else null;
+
+            if (first_cert == null) {
+                return JSValue.jsUndefined();
+            }
+
+            // TODO: we need to support the non abbreviated version of this
+            return JSValue.jsUndefined();
+        }
+
+        pub fn getCertificate(
+            this: *This,
+            globalObject: *JSC.JSGlobalObject,
+            _: *JSC.CallFrame,
+        ) callconv(.C) JSValue {
+            if (comptime ssl == false) {
+                return JSValue.jsUndefined();
+            }
+
+            if (this.detached) {
+                return JSValue.jsUndefined();
+            }
+
+            const ssl_ptr = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+            const cert = BoringSSL.SSL_get_certificate(ssl_ptr);
+
+            if (cert) |x509| {
+                return X509.toJS(x509, globalObject);
+            }
+            return JSValue.jsUndefined();
+        }
         pub fn setServername(
             this: *This,
             globalObject: *JSC.JSGlobalObject,
@@ -1952,7 +2622,7 @@ fn NewSocket(comptime ssl: bool) type {
 
             const host = normalizeHost(@as([]const u8, slice));
             if (host.len > 0) {
-                var ssl_ptr: *BoringSSL.SSL = @ptrCast(*BoringSSL.SSL, this.socket.getNativeHandle());
+                var ssl_ptr = this.socket.ssl();
                 if (ssl_ptr.isInitFinished()) {
                     // match node.js exceptions
                     globalObject.throw("Already started.", .{});
@@ -2222,6 +2892,7 @@ pub fn NewWrappedHandler(comptime tls: bool) type {
             if (comptime tls) {
                 TLSSocket.onData(this.tls, socket, data);
             } else {
+                // tedius use this
                 TLSSocket.onData(this.tcp, socket, data);
             }
         }
diff --git a/src/bun.js/api/bun/x509.zig b/src/bun.js/api/bun/x509.zig
new file mode 100644
index 000000000..707009936
--- /dev/null
+++ b/src/bun.js/api/bun/x509.zig
@@ -0,0 +1,560 @@
+const BoringSSL = bun.BoringSSL;
+const bun = @import("root").bun;
+const ZigString = JSC.ZigString;
+const std = @import("std");
+const JSC = @import("root").bun.JSC;
+const JSValue = JSC.JSValue;
+const JSGlobalObject = JSC.JSGlobalObject;
+
+fn x509GetNameObject(globalObject: *JSGlobalObject, name: ?*BoringSSL.X509_NAME) JSValue {
+    const cnt = BoringSSL.X509_NAME_entry_count(name);
+    if (cnt <= 0) {
+        return JSValue.jsUndefined();
+    }
+    var result = JSValue.createEmptyObject(globalObject, 1);
+
+    for (0..@intCast(usize, cnt)) |i| {
+        const entry = BoringSSL.X509_NAME_get_entry(name, @intCast(c_int, i)) orelse continue;
+        // We intentionally ignore the value of X509_NAME_ENTRY_set because the
+        // representation as an object does not allow grouping entries into sets
+        // anyway, and multi-value RDNs are rare, i.e., the vast majority of
+        // Relative Distinguished Names contains a single type-value pair only.
+        const type_ = BoringSSL.X509_NAME_ENTRY_get_object(entry);
+
+        // If BoringSSL knows the type, use the short name of the type as the key, and
+        // the numeric representation of the type's OID otherwise.
+        const type_nid = BoringSSL.OBJ_obj2nid(type_);
+        var type_buf: [80]u8 = undefined;
+        var name_slice: []const u8 = undefined;
+        if (type_nid != BoringSSL.NID_undef) {
+            const type_str = BoringSSL.OBJ_nid2sn(type_nid);
+            if (type_str == null) {
+                continue;
+            }
+            name_slice = type_str[0..bun.len(type_str)];
+        } else {
+            const length = BoringSSL.OBJ_obj2txt(&type_buf, @sizeOf(@TypeOf(type_buf)), type_, 1);
+            if (length <= 0) {
+                continue;
+            }
+            name_slice = type_buf[0..@intCast(usize, length)];
+        }
+
+        const value_data = BoringSSL.X509_NAME_ENTRY_get_data(entry);
+
+        var value_str: [*c]u8 = undefined;
+        const value_str_len = BoringSSL.ASN1_STRING_to_UTF8(&value_str, value_data);
+        if (value_str_len < 0) {
+            continue;
+        }
+        const value_slice = value_str[0..@intCast(usize, value_str_len)];
+        defer BoringSSL.OPENSSL_free(value_str);
+        // For backward compatibility, we only create arrays if multiple values
+        // exist for the same key. That is not great but there is not much we can
+        // change here without breaking things. Note that this creates nested data
+        // structures, yet still does not allow representing Distinguished Names
+        // accurately.
+        if (result.getTruthy(globalObject, name_slice)) |value| {
+            if (value.jsType().isArray()) {
+                value.push(globalObject, JSC.ZigString.fromUTF8(value_slice).toValueGC(globalObject));
+            } else {
+                const prop_name = JSC.ZigString.fromUTF8(name_slice);
+                const array = JSValue.createEmptyArray(globalObject, 2);
+                array.putIndex(globalObject, 0, value);
+                array.putIndex(globalObject, 1, JSC.ZigString.fromUTF8(value_slice).toValueGC(globalObject));
+                result.put(globalObject, &prop_name, array);
+            }
+        } else {
+            const prop_name = JSC.ZigString.fromUTF8(name_slice);
+            result.put(globalObject, &prop_name, JSC.ZigString.fromUTF8(value_slice).toValueGC(globalObject));
+        }
+    }
+    return result;
+}
+
+inline fn isSafeAltName(name: []const u8, utf8: bool) bool {
+    for (name) |c| {
+        switch (c) {
+            '"',
+            '\\',
+            // These mess with encoding rules.
+            // Fall through.
+            ',',
+            // Commas make it impossible to split the list of subject alternative
+            // names unambiguously, which is why we have to escape.
+            // Fall through.
+            '\'',
+            => {
+                // Single quotes are unlikely to appear in any legitimate values, but they
+                // could be used to make a value look like it was escaped (i.e., enclosed
+                // in single/double quotes).
+                return false;
+            },
+            else => {
+                if (utf8) {
+                    // In UTF8 strings, we require escaping for any ASCII control character,
+                    // but NOT for non-ASCII characters. Note that all bytes of any code
+                    // point that consists of more than a single byte have their MSB set.
+                    if (c < ' ' or c == '\x7f') {
+                        return false;
+                    }
+                } else {
+                    // Check if the char is a control character or non-ASCII character. Note
+                    // that char may or may not be a signed type. Regardless, non-ASCII
+                    // values will always be outside of this range.
+                    if (c < ' ' or c > '~') {
+                        return false;
+                    }
+                }
+            },
+        }
+    }
+    return true;
+}
+
+inline fn printAltName(out: *BoringSSL.BIO, name: []const u8, utf8: bool, safe_prefix: ?[*]const u8) void {
+    if (isSafeAltName(name, utf8)) {
+        // For backward-compatibility, append "safe" names without any
+        // modifications.
+        if (safe_prefix) |prefix| {
+            _ = BoringSSL.BIO_printf(out, "%s:", prefix);
+        }
+        _ = BoringSSL.BIO_write(out, @ptrCast([*]const u8, name.ptr), @intCast(c_int, name.len));
+    } else {
+        // If a name is not "safe", we cannot embed it without special
+        // encoding. This does not usually happen, but we don't want to hide
+        // it from the user either. We use JSON compatible escaping here.
+        _ = BoringSSL.BIO_write(out, "\"", 1);
+        if (safe_prefix) |prefix| {
+            _ = BoringSSL.BIO_printf(out, "%s:", prefix);
+        }
+        for (name) |c| {
+            if (c == '\\') {
+                _ = BoringSSL.BIO_write(out, "\\\\", 2);
+            } else if (c == '"') {
+                _ = BoringSSL.BIO_write(out, "\\\"", 2);
+            } else if ((c >= ' ' and c != ',' and c <= '~') or (utf8 and (c & 0x80) != 0)) {
+                // Note that the above condition explicitly excludes commas, which means
+                // that those are encoded as Unicode escape sequences in the "else"
+                // block. That is not strictly necessary, and Node.js itself would parse
+                // it correctly either way. We only do this to account for third-party
+                // code that might be splitting the string at commas (as Node.js itself
+                // used to do).
+                _ = BoringSSL.BIO_write(out, bun.cast([*]const u8, &c), 1);
+            } else {
+                // Control character or non-ASCII character. We treat everything as
+                // Latin-1, which corresponds to the first 255 Unicode code points.
+                const hex = "0123456789abcdef";
+                const u = [_]u8{ '\\', 'u', '0', '0', hex[(c & 0xf0) >> 4], hex[c & 0x0f] };
+                _ = BoringSSL.BIO_write(out, &u, @sizeOf(@TypeOf(u)));
+            }
+        }
+        _ = BoringSSL.BIO_write(out, "\"", 1);
+    }
+}
+
+inline fn printLatin1AltName(out: *BoringSSL.BIO, name: *BoringSSL.ASN1_IA5STRING, safe_prefix: ?[*]const u8) void {
+    printAltName(out, name.data[0..@intCast(usize, name.length)], false, safe_prefix);
+}
+
+inline fn printUTF8AltName(out: *BoringSSL.BIO, name: *BoringSSL.ASN1_UTF8STRING, safe_prefix: ?[*]const u8) void {
+    printAltName(out, name.data[0..@intCast(usize, name.length)], true, safe_prefix);
+}
+
+pub const kX509NameFlagsRFC2253WithinUtf8JSON = BoringSSL.XN_FLAG_RFC2253 & ~BoringSSL.ASN1_STRFLGS_ESC_MSB & ~BoringSSL.ASN1_STRFLGS_ESC_CTRL;
+
+// This function emulates the behavior of i2v_GENERAL_NAME in a safer and less
+// ambiguous way. "othername:" entries use the GENERAL_NAME_print format.
+fn x509PrintGeneralName(out: *BoringSSL.BIO, name: *BoringSSL.GENERAL_NAME) bool {
+    if (name.name_type == .GEN_DNS) {
+        _ = BoringSSL.BIO_write(out, "DNS:", 4);
+        // Note that the preferred name syntax (see RFCs 5280 and 1034) with
+        // wildcards is a subset of what we consider "safe", so spec-compliant DNS
+        // names will never need to be escaped.
+        printLatin1AltName(out, name.d.dNSName, null);
+    } else if (name.name_type == .GEN_EMAIL) {
+        _ = BoringSSL.BIO_write(out, "email:", 6);
+        printLatin1AltName(out, name.d.rfc822Name, null);
+    } else if (name.name_type == .GEN_URI) {
+        _ = BoringSSL.BIO_write(out, "URI:", 4);
+        // The set of "safe" names was designed to include just about any URI,
+        // with a few exceptions, most notably URIs that contains commas (see
+        // RFC 2396). In other words, most legitimate URIs will not require
+        // escaping.
+        printLatin1AltName(out, name.d.uniformResourceIdentifier, null);
+    } else if (name.name_type == .GEN_DIRNAME) {
+        // Earlier versions of Node.js used X509_NAME_oneline to print the X509_NAME
+        // object. The format was non standard and should be avoided. The use of
+        // X509_NAME_oneline is discouraged by OpenSSL but was required for backward
+        // compatibility. Conveniently, X509_NAME_oneline produced ASCII and the
+        // output was unlikely to contains commas or other characters that would
+        // require escaping. However, it SHOULD NOT produce ASCII output since an
+        // RFC5280 AttributeValue may be a UTF8String.
+        // Newer versions of Node.js have since switched to X509_NAME_print_ex to
+        // produce a better format at the cost of backward compatibility. The new
+        // format may contain Unicode characters and it is likely to contain commas,
+        // which require escaping. Fortunately, the recently safeguarded function
+        // printAltName handles all of that safely.
+        _ = BoringSSL.BIO_printf(out, "DirName:");
+
+        const tmp = BoringSSL.BIO_new(BoringSSL.BIO_s_mem()) orelse return false;
+
+        if (BoringSSL.X509_NAME_print_ex(tmp, name.d.dirn, 0, kX509NameFlagsRFC2253WithinUtf8JSON) < 0) {
+            return false;
+        }
+        var oline: [*]const u8 = undefined;
+        const n_bytes = BoringSSL.BIO_get_mem_data(tmp, @ptrCast([*c][*c]u8, &oline));
+        if (n_bytes <= 0) return false;
+        printAltName(out, oline[0..@intCast(usize, n_bytes)], true, null);
+    } else if (name.name_type == .GEN_OTHERNAME) {
+        // The format that is used here is based on OpenSSL's implementation of
+        // GENERAL_NAME_print (as of OpenSSL 3.0.1). Earlier versions of Node.js
+        // instead produced the same format as i2v_GENERAL_NAME, which was somewhat
+        // awkward, especially when passed to translatePeerCertificate.
+        var unicode: bool = true;
+        var prefix: ?[*]const u8 = null;
+
+        const nid = BoringSSL.OBJ_obj2nid(name.d.otherName.type_id);
+        switch (nid) {
+            BoringSSL.NID_id_on_SmtpUTF8Mailbox => {
+                prefix = "SmtpUTF8Mailbox";
+            },
+            BoringSSL.NID_XmppAddr => {
+                prefix = "XmppAddr";
+            },
+            BoringSSL.NID_SRVName => {
+                prefix = "SRVName";
+                unicode = false;
+            },
+            BoringSSL.NID_ms_upn => {
+                prefix = "UPN";
+            },
+            BoringSSL.NID_NAIRealm => {
+                prefix = "NAIRealm";
+            },
+            else => {
+                prefix = null;
+            },
+        }
+        if (name.d.otherName.value) |v| {
+            const val_type = v.type;
+            if (prefix == null or
+                (unicode and val_type != BoringSSL.V_ASN1_UTF8STRING) or
+                (!unicode and val_type != BoringSSL.V_ASN1_IA5STRING))
+            {
+                _ = BoringSSL.BIO_printf(out, "othername:<unsupported>");
+            } else {
+                _ = BoringSSL.BIO_printf(out, "othername:");
+                if (unicode) {
+                    printUTF8AltName(out, v.value.utf8string, prefix);
+                } else {
+                    printLatin1AltName(out, v.value.ia5string, prefix);
+                }
+            }
+        } else {
+            _ = BoringSSL.BIO_printf(out, "othername:<unsupported>");
+        }
+    } else if (name.name_type == .GEN_IPADD) {
+        _ = BoringSSL.BIO_printf(out, "IP Address:");
+        const ip = name.d.ip;
+        const b = ip.data;
+        if (ip.length == 4) {
+            _ = BoringSSL.BIO_printf(out, "%d.%d.%d.%d", b[0], b[1], b[2], b[3]);
+        } else if (ip.length == 16) {
+            for (0..8) |j| {
+                const pair: u16 = (@intCast(u16, b[2 * j]) << 8) | @intCast(u16, b[2 * j + 1]);
+                _ = BoringSSL.BIO_printf(out, if (j == 0) "%X" else ":%X", pair);
+            }
+        } else {
+            _ = BoringSSL.BIO_printf(out, "<invalid length=%d>", ip.length);
+        }
+    } else if (name.name_type == .GEN_RID) {
+        // Unlike OpenSSL's default implementation, never print the OID as text and
+        // instead always print its numeric representation.
+        var oline: [256]u8 = undefined;
+        _ = BoringSSL.OBJ_obj2txt(&oline, @sizeOf(@TypeOf(oline)), name.d.rid, 1);
+        _ = BoringSSL.BIO_printf(out, "Registered ID:%s", &oline);
+    } else if (name.name_type == .GEN_X400) {
+        _ = BoringSSL.BIO_printf(out, "X400Name:<unsupported>");
+    } else if (name.name_type == .GEN_EDIPARTY) {
+        _ = BoringSSL.BIO_printf(out, "EdiPartyName:<unsupported>");
+    } else {
+        return false;
+    }
+    return true;
+}
+
+fn x509InfoAccessPrint(out: *BoringSSL.BIO, ext: *BoringSSL.X509_EXTENSION) bool {
+    const method = BoringSSL.X509V3_EXT_get(ext);
+    if (method != BoringSSL.X509V3_EXT_get_nid(BoringSSL.NID_info_access)) {
+        return false;
+    }
+
+    if (BoringSSL.X509V3_EXT_d2i(ext)) |descs_| {
+        const descs: *BoringSSL.AUTHORITY_INFO_ACCESS = bun.cast(*BoringSSL.AUTHORITY_INFO_ACCESS, descs_);
+        defer BoringSSL.sk_ACCESS_DESCRIPTION_pop_free(descs, BoringSSL.sk_ACCESS_DESCRIPTION_free);
+        for (0..BoringSSL.sk_ACCESS_DESCRIPTION_num(descs)) |i| {
+            const gen = BoringSSL.sk_ACCESS_DESCRIPTION_value(descs, i);
+            if (gen) |desc| {
+                if (i != 0) {
+                    _ = BoringSSL.BIO_write(out, "\n", 1);
+                }
+                var tmp: [80]u8 = undefined;
+                _ = BoringSSL.i2t_ASN1_OBJECT(&tmp, @sizeOf(@TypeOf(tmp)), desc.method);
+                _ = BoringSSL.BIO_printf(out, "%s - ", &tmp);
+
+                if (!x509PrintGeneralName(out, desc.location)) {
+                    return false;
+                }
+            }
+        }
+        return true;
+    }
+    return false;
+}
+fn x509SubjectAltNamePrint(out: *BoringSSL.BIO, ext: *BoringSSL.X509_EXTENSION) bool {
+    const method = BoringSSL.X509V3_EXT_get(ext);
+    if (method != BoringSSL.X509V3_EXT_get_nid(BoringSSL.NID_subject_alt_name)) {
+        return false;
+    }
+
+    if (BoringSSL.X509V3_EXT_d2i(ext)) |names_| {
+        const names: *BoringSSL.struct_stack_st_GENERAL_NAME = bun.cast(*BoringSSL.struct_stack_st_GENERAL_NAME, names_);
+        defer BoringSSL.sk_GENERAL_NAME_pop_free(names, BoringSSL.sk_GENERAL_NAME_free);
+        for (0..BoringSSL.sk_GENERAL_NAME_num(names)) |i| {
+            const gen = BoringSSL.sk_GENERAL_NAME_value(names, i);
+            if (gen) |gen_name| {
+                if (i != 0) {
+                    _ = BoringSSL.BIO_write(out, ", ", 2);
+                }
+
+                if (!x509PrintGeneralName(out, gen_name)) {
+                    return false;
+                }
+            }
+        }
+
+        return true;
+    }
+    return false;
+}
+
+fn x509GetSubjectAltNameString(globalObject: *JSGlobalObject, bio: *BoringSSL.BIO, cert: *BoringSSL.X509) JSValue {
+    const index = BoringSSL.X509_get_ext_by_NID(cert, BoringSSL.NID_subject_alt_name, -1);
+    if (index < 0)
+        return JSValue.jsUndefined();
+
+    defer _ = BoringSSL.BIO_reset(bio);
+
+    const ext = BoringSSL.X509_get_ext(cert, index) orelse return JSValue.jsUndefined();
+
+    if (!x509SubjectAltNamePrint(bio, ext)) {
+        return JSValue.jsNull();
+    }
+
+    return JSC.ZigString.fromUTF8(bio.slice()).toValueGC(globalObject);
+}
+
+fn x509GetInfoAccessString(globalObject: *JSGlobalObject, bio: *BoringSSL.BIO, cert: *BoringSSL.X509) JSValue {
+    const index = BoringSSL.X509_get_ext_by_NID(cert, BoringSSL.NID_info_access, -1);
+    if (index < 0)
+        return JSValue.jsUndefined();
+    defer _ = BoringSSL.BIO_reset(bio);
+    const ext = BoringSSL.X509_get_ext(cert, index) orelse return JSValue.jsUndefined();
+
+    if (!x509InfoAccessPrint(bio, ext)) {
+        return JSValue.jsNull();
+    }
+
+    return JSC.ZigString.fromUTF8(bio.slice()).toValueGC(globalObject);
+}
+
+fn addFingerprintDigest(md: []const u8, mdSize: c_uint, fingerprint: []u8) usize {
+    const hex: []const u8 = "0123456789ABCDEF";
+    var idx: usize = 0;
+
+    const slice = md[0..@intCast(usize, mdSize)];
+    for (slice) |byte| {
+        fingerprint[idx] = hex[(byte & 0xF0) >> 4];
+        fingerprint[idx + 1] = hex[byte & 0x0F];
+        fingerprint[idx + 2] = ':';
+        idx += 3;
+    }
+    const length = if (idx > 0) (idx - 1) else 0;
+    fingerprint[length] = 0;
+    return length;
+}
+
+fn getFingerprintDigest(cert: *BoringSSL.X509, method: *const BoringSSL.EVP_MD, globalObject: *JSGlobalObject) JSValue {
+    var md: [BoringSSL.EVP_MAX_MD_SIZE]u8 = undefined;
+    var md_size: c_uint = 0;
+    var fingerprint: [BoringSSL.EVP_MAX_MD_SIZE * 3]u8 = undefined;
+
+    if (BoringSSL.X509_digest(cert, method, @ptrCast([*c]u8, &md), &md_size) != 0) {
+        const length = addFingerprintDigest(&md, md_size, &fingerprint);
+        return JSC.ZigString.fromUTF8(fingerprint[0..length]).toValueGC(globalObject);
+    }
+    return JSValue.jsUndefined();
+}
+
+fn getSerialNumber(cert: *BoringSSL.X509, globalObject: *JSGlobalObject) JSValue {
+    const serial_number = BoringSSL.X509_get_serialNumber(cert);
+    if (serial_number != null) {
+        const bignum = BoringSSL.ASN1_INTEGER_to_BN(serial_number, null);
+        if (bignum != null) {
+            const data = BoringSSL.BN_bn2hex(bignum);
+            if (data != null) {
+                const slice = data[0..bun.len(data)];
+                // BoringSSL prints the hex value of the serialNumber in lower case, but we need upper case
+                toUpper(slice);
+                return JSC.ZigString.fromUTF8(slice).toValueGC(globalObject);
+            }
+        }
+    }
+    return JSValue.jsUndefined();
+}
+
+fn getRawDERCertificate(cert: *BoringSSL.X509, globalObject: *JSGlobalObject) JSValue {
+    const size = BoringSSL.i2d_X509(cert, null);
+    var buffer = JSValue.createBufferFromLength(globalObject, @intCast(usize, size));
+    var buffer_ptr = @ptrCast([*c]u8, buffer.asArrayBuffer(globalObject).?.ptr);
+    const result_size = BoringSSL.i2d_X509(cert, &buffer_ptr);
+    std.debug.assert(result_size == size);
+    return buffer;
+}
+
+fn toUpper(slice: []u8) void {
+    for (0..slice.len) |i| {
+        const c = slice[i];
+        if (c >= 'a' and c <= 'z') {
+            slice[i] &= 223;
+        }
+    }
+}
+
+pub fn toJS(cert: *BoringSSL.X509, globalObject: *JSGlobalObject) JSValue {
+    const bio = BoringSSL.BIO_new(BoringSSL.BIO_s_mem()) orelse {
+        globalObject.throw("Failed to create BIO", .{});
+        return .zero;
+    };
+    defer _ = BoringSSL.BIO_free(bio);
+    var result = JSValue.createEmptyObject(globalObject, 8);
+    // X509_check_ca() returns a range of values. Only 1 means "is a CA"
+    const is_ca = BoringSSL.X509_check_ca(cert) == 1;
+    const subject = BoringSSL.X509_get_subject_name(cert);
+    result.put(globalObject, ZigString.static("subject"), x509GetNameObject(globalObject, subject));
+    const issuer = BoringSSL.X509_get_issuer_name(cert);
+    result.put(globalObject, ZigString.static("issuer"), x509GetNameObject(globalObject, issuer));
+    result.put(globalObject, ZigString.static("subjectaltname"), x509GetSubjectAltNameString(globalObject, bio, cert));
+    result.put(globalObject, ZigString.static("infoAccess"), x509GetInfoAccessString(globalObject, bio, cert));
+    result.put(globalObject, ZigString.static("ca"), JSValue.jsBoolean(is_ca));
+
+    const pkey = BoringSSL.X509_get_pubkey(cert);
+
+    switch (BoringSSL.EVP_PKEY_id(pkey)) {
+        BoringSSL.EVP_PKEY_RSA => {
+            const rsa_key = BoringSSL.EVP_PKEY_get1_RSA(pkey);
+            if (rsa_key) |rsa| {
+                var n: [*c]const BoringSSL.BIGNUM = undefined;
+                var e: [*c]const BoringSSL.BIGNUM = undefined;
+                BoringSSL.RSA_get0_key(rsa, @ptrCast([*c][*c]const BoringSSL.BIGNUM, &n), @ptrCast([*c][*c]const BoringSSL.BIGNUM, &e), null);
+                _ = BoringSSL.BN_print(bio, n);
+
+                var bits = JSValue.jsUndefined();
+
+                const bits_value = BoringSSL.BN_num_bits(n);
+                if (bits_value > 0) {
+                    bits = JSValue.jsNumber(bits_value);
+                }
+
+                result.put(globalObject, ZigString.static("bits"), bits);
+                const slice = bio.slice();
+                // BoringSSL prints the hex value of the modulus in lower case, but we need upper case
+                toUpper(slice);
+                const modulus = JSC.ZigString.fromUTF8(slice).toValueGC(globalObject);
+                _ = BoringSSL.BIO_reset(bio);
+                result.put(globalObject, ZigString.static("modulus"), modulus);
+
+                const exponent_word = BoringSSL.BN_get_word(e);
+                _ = BoringSSL.BIO_printf(bio, "0x" ++ BoringSSL.BN_HEX_FMT1, exponent_word);
+                const exponent = JSC.ZigString.fromUTF8(bio.slice()).toValueGC(globalObject);
+                _ = BoringSSL.BIO_reset(bio);
+                result.put(globalObject, ZigString.static("exponent"), exponent);
+
+                const size = BoringSSL.i2d_RSA_PUBKEY(rsa, null);
+                if (size <= 0) {
+                    globalObject.throw("Failed to get public key length", .{});
+                    return .zero;
+                }
+
+                var buffer = JSValue.createBufferFromLength(globalObject, @intCast(usize, size));
+                var buffer_ptr = @ptrCast([*c]u8, buffer.asArrayBuffer(globalObject).?.ptr);
+
+                _ = BoringSSL.i2d_RSA_PUBKEY(rsa, &buffer_ptr);
+
+                result.put(globalObject, ZigString.static("pubkey"), buffer);
+            }
+        },
+        BoringSSL.EVP_PKEY_EC => {
+            const ec_key = BoringSSL.EVP_PKEY_get1_EC_KEY(pkey);
+            if (ec_key) |ec| {
+                const group = BoringSSL.EC_KEY_get0_group(ec);
+                var bits = JSValue.jsUndefined();
+                if (group) |g| {
+                    const bits_value = BoringSSL.EC_GROUP_order_bits(g);
+                    if (bits_value > 0) {
+                        bits = JSValue.jsNumber(bits_value);
+                    }
+                }
+                result.put(globalObject, ZigString.static("bits"), bits);
+
+                const ec_pubkey = BoringSSL.EC_KEY_get0_public_key(ec);
+                if (ec_pubkey) |point| {
+                    const form = BoringSSL.EC_KEY_get_conv_form(ec);
+                    const size = BoringSSL.EC_POINT_point2oct(group, point, form, null, 0, null);
+                    if (size <= 0) {
+                        globalObject.throw("Failed to get public key length", .{});
+                        return .zero;
+                    }
+
+                    var buffer = JSValue.createBufferFromLength(globalObject, @intCast(usize, size));
+                    var buffer_ptr = @ptrCast([*c]u8, buffer.asArrayBuffer(globalObject).?.ptr);
+
+                    const result_size = BoringSSL.EC_POINT_point2oct(group, point, form, buffer_ptr, size, null);
+                    std.debug.assert(result_size == size);
+                    result.put(globalObject, ZigString.static("pubkey"), buffer);
+                } else {
+                    result.put(globalObject, ZigString.static("pubkey"), JSValue.jsUndefined());
+                }
+                const nid = BoringSSL.EC_GROUP_get_curve_name(group);
+
+                if (nid != 0) {
+                    // Curve is well-known, get its OID and NIST nick-name (if it has one).
+                    const asn1Curve_str = BoringSSL.OBJ_nid2sn(nid);
+                    if (asn1Curve_str != null) {
+                        result.put(globalObject, ZigString.static("asn1Curve"), JSC.ZigString.fromUTF8(asn1Curve_str[0..bun.len(asn1Curve_str)]).toValueGC(globalObject));
+                    }
+                    const nistCurve_str = BoringSSL.EC_curve_nid2nist(nid);
+                    if (nistCurve_str != null) {
+                        result.put(globalObject, ZigString.static("nistCurve"), JSC.ZigString.fromUTF8(nistCurve_str[0..bun.len(nistCurve_str)]).toValueGC(globalObject));
+                    }
+                }
+            }
+        },
+        else => {},
+    }
+    _ = BoringSSL.ASN1_TIME_print(bio, BoringSSL.X509_get0_notBefore(cert));
+    result.put(globalObject, ZigString.static("valid_from"), JSC.ZigString.fromUTF8(bio.slice()).toValueGC(globalObject));
+    _ = BoringSSL.BIO_reset(bio);
+
+    _ = BoringSSL.ASN1_TIME_print(bio, BoringSSL.X509_get0_notAfter(cert));
+    result.put(globalObject, ZigString.static("valid_to"), JSC.ZigString.fromUTF8(bio.slice()).toValueGC(globalObject));
+    _ = BoringSSL.BIO_reset(bio);
+
+    result.put(globalObject, ZigString.static("fingerprint"), getFingerprintDigest(cert, BoringSSL.EVP_sha1(), globalObject));
+    result.put(globalObject, ZigString.static("fingerprint256"), getFingerprintDigest(cert, BoringSSL.EVP_sha256(), globalObject));
+    result.put(globalObject, ZigString.static("fingerprint512"), getFingerprintDigest(cert, BoringSSL.EVP_sha512(), globalObject));
+    result.put(globalObject, ZigString.static("serialNumber"), getSerialNumber(cert, globalObject));
+    result.put(globalObject, ZigString.static("raw"), getRawDERCertificate(cert, globalObject));
+    return result;
+}
diff --git a/src/bun.js/api/sockets.classes.ts b/src/bun.js/api/sockets.classes.ts
index 5bd073b9f..2a17ca39d 100644
--- a/src/bun.js/api/sockets.classes.ts
+++ b/src/bun.js/api/sockets.classes.ts
@@ -12,6 +12,59 @@ function generate(ssl) {
         fn: "getAuthorizationError",
         length: 0,
       },
+
+      getTLSFinishedMessage: {
+        fn: "getTLSFinishedMessage",
+        length: 0,
+      },
+      getTLSPeerFinishedMessage: {
+        fn: "getTLSPeerFinishedMessage",
+        length: 0,
+      },
+      getEphemeralKeyInfo: {
+        fn: "getEphemeralKeyInfo",
+        length: 0,
+      },
+      getCipher: {
+        fn: "getCipher",
+        length: 0,
+      },
+      getSession: {
+        fn: "getSession",
+        length: 0,
+      },
+      setSession: {
+        fn: "setSession",
+        length: 0,
+      },
+      getTLSTicket: {
+        fn: "getTLSTicket",
+        length: 0,
+      },
+      exportKeyingMaterial: {
+        fn: "exportKeyingMaterial",
+        length: 3,
+      },
+      setMaxSendFragment: {
+        fn: "setMaxSendFragment",
+        length: 1,
+      },
+      getSharedSigalgs: {
+        fn: "getSharedSigalgs",
+        length: 0,
+      },
+      getTLSVersion: {
+        fn: "getTLSVersion",
+        length: 0,
+      },
+      getPeerCertificate: {
+        fn: "getPeerCertificate",
+        length: 1,
+      },
+      getCertificate: {
+        fn: "getCertificate",
+        length: 0,
+      },
       authorized: {
         getter: "getAuthorized",
       },
diff --git a/src/bun.js/bindings/JSSink.cpp b/src/bun.js/bindings/JSSink.cpp
index 8be4fe95b..09a5a396c 100644
--- a/src/bun.js/bindings/JSSink.cpp
+++ b/src/bun.js/bindings/JSSink.cpp
@@ -1,6 +1,6 @@
 
 // AUTO-GENERATED FILE. DO NOT EDIT.
-// Generated by 'make generate-sink' at 2023-07-09T17:58:51.559Z
+// Generated by 'make generate-sink' at 2023-07-17T20:32:20.223Z
 // To regenerate this file, run:
 //
 //   make generate-sink
diff --git a/src/bun.js/bindings/JSSink.h b/src/bun.js/bindings/JSSink.h
index 3826ef696..46111a0a2 100644
--- a/src/bun.js/bindings/JSSink.h
+++ b/src/bun.js/bindings/JSSink.h
@@ -1,6 +1,6 @@
 
 // AUTO-GENERATED FILE. DO NOT EDIT.
-// Generated by 'make generate-sink' at 2023-07-09T17:58:51.558Z
+// Generated by 'make generate-sink' at 2023-07-17T20:32:20.222Z
 //
 #pragma once
 
diff --git a/src/bun.js/bindings/JSSinkLookupTable.h b/src/bun.js/bindings/JSSinkLookupTable.h
index 7ff4c3f9c..e4ed81629 100644
--- a/src/bun.js/bindings/JSSinkLookupTable.h
+++ b/src/bun.js/bindings/JSSinkLookupTable.h
@@ -1,4 +1,4 @@
-// Automatically generated from src/bun.js/bindings/JSSink.cpp using /Users/ashcon/Desktop/code/bun/src/bun.js/WebKit/Source/JavaScriptCore/create_hash_table. DO NOT EDIT!
+// Automatically generated from src/bun.js/bindings/JSSink.cpp using /home/cirospaciari/Repos/bun/src/bun.js/WebKit/Source/JavaScriptCore/create_hash_table. DO NOT EDIT!
 
 
 
diff --git a/src/bun.js/bindings/ZigGeneratedClasses.cpp b/src/bun.js/bindings/ZigGeneratedClasses.cpp
index c11766926..245010158 100644
--- a/src/bun.js/bindings/ZigGeneratedClasses.cpp
+++ b/src/bun.js/bindings/ZigGeneratedClasses.cpp
@@ -17008,12 +17008,45 @@ JSC_DECLARE_CUSTOM_SETTER(TCPSocketPrototype__dataSetterWrap);
 extern "C" EncodedJSValue TCPSocketPrototype__end(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__endCallback);
 
+extern "C" EncodedJSValue TCPSocketPrototype__exportKeyingMaterial(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__exportKeyingMaterialCallback);
+
 extern "C" EncodedJSValue TCPSocketPrototype__flush(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__flushCallback);
 
 extern "C" EncodedJSValue TCPSocketPrototype__getAuthorizationError(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getAuthorizationErrorCallback);
 
+extern "C" EncodedJSValue TCPSocketPrototype__getCertificate(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getCertificateCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getCipher(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getCipherCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getEphemeralKeyInfo(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getEphemeralKeyInfoCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getPeerCertificate(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getPeerCertificateCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getSession(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getSessionCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getSharedSigalgs(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getSharedSigalgsCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getTLSFinishedMessage(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getTLSFinishedMessageCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getTLSPeerFinishedMessage(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getTLSPeerFinishedMessageCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getTLSTicket(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getTLSTicketCallback);
+
+extern "C" EncodedJSValue TCPSocketPrototype__getTLSVersion(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__getTLSVersionCallback);
+
 extern "C" JSC::EncodedJSValue TCPSocketPrototype__getListener(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject);
 JSC_DECLARE_CUSTOM_GETTER(TCPSocketPrototype__listenerGetterWrap);
 
@@ -17032,9 +17065,15 @@ JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__reloadCallback);
 extern "C" JSC::EncodedJSValue TCPSocketPrototype__getRemoteAddress(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject);
 JSC_DECLARE_CUSTOM_GETTER(TCPSocketPrototype__remoteAddressGetterWrap);
 
+extern "C" EncodedJSValue TCPSocketPrototype__setMaxSendFragment(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__setMaxSendFragmentCallback);
+
 extern "C" EncodedJSValue TCPSocketPrototype__setServername(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__setServernameCallback);
 
+extern "C" EncodedJSValue TCPSocketPrototype__setSession(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__setSessionCallback);
+
 extern "C" EncodedJSValue TCPSocketPrototype__shutdown(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TCPSocketPrototype__shutdownCallback);
 
@@ -17057,15 +17096,28 @@ static const HashTableValue JSTCPSocketPrototypeTableValues[] = {
     { "authorized"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TCPSocketPrototype__authorizedGetterWrap, 0 } },
     { "data"_s, static_cast<unsigned>(JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TCPSocketPrototype__dataGetterWrap, TCPSocketPrototype__dataSetterWrap } },
     { "end"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__endCallback, 3 } },
+    { "exportKeyingMaterial"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__exportKeyingMaterialCallback, 3 } },
     { "flush"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__flushCallback, 0 } },
     { "getAuthorizationError"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getAuthorizationErrorCallback, 0 } },
+    { "getCertificate"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getCertificateCallback, 0 } },
+    { "getCipher"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getCipherCallback, 0 } },
+    { "getEphemeralKeyInfo"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getEphemeralKeyInfoCallback, 0 } },
+    { "getPeerCertificate"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getPeerCertificateCallback, 1 } },
+    { "getSession"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getSessionCallback, 0 } },
+    { "getSharedSigalgs"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getSharedSigalgsCallback, 0 } },
+    { "getTLSFinishedMessage"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getTLSFinishedMessageCallback, 0 } },
+    { "getTLSPeerFinishedMessage"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getTLSPeerFinishedMessageCallback, 0 } },
+    { "getTLSTicket"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getTLSTicketCallback, 0 } },
+    { "getTLSVersion"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__getTLSVersionCallback, 0 } },
     { "listener"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TCPSocketPrototype__listenerGetterWrap, 0 } },
     { "localPort"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TCPSocketPrototype__localPortGetterWrap, 0 } },
     { "readyState"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TCPSocketPrototype__readyStateGetterWrap, 0 } },
     { "ref"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__refCallback, 0 } },
     { "reload"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__reloadCallback, 1 } },
     { "remoteAddress"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TCPSocketPrototype__remoteAddressGetterWrap, 0 } },
+    { "setMaxSendFragment"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__setMaxSendFragmentCallback, 1 } },
     { "setServername"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__setServernameCallback, 1 } },
+    { "setSession"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__setSessionCallback, 0 } },
     { "shutdown"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__shutdownCallback, 1 } },
     { "timeout"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__timeoutCallback, 1 } },
     { "unref"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TCPSocketPrototype__unrefCallback, 0 } },
@@ -17180,6 +17232,33 @@ JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__endCallback, (JSGlobalObject * lexi
     return TCPSocketPrototype__end(thisObject->wrapped(), lexicalGlobalObject, callFrame);
 }
 
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__exportKeyingMaterialCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__exportKeyingMaterial(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__flushCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -17234,6 +17313,276 @@ JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getAuthorizationErrorCallback, (JSG
     return TCPSocketPrototype__getAuthorizationError(thisObject->wrapped(), lexicalGlobalObject, callFrame);
 }
 
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getCertificateCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getCertificate(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getCipherCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getCipher(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getEphemeralKeyInfoCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getEphemeralKeyInfo(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getPeerCertificateCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getPeerCertificate(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getSessionCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getSession(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getSharedSigalgsCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getSharedSigalgs(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getTLSFinishedMessageCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getTLSFinishedMessage(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getTLSPeerFinishedMessageCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getTLSPeerFinishedMessage(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getTLSTicketCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getTLSTicket(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__getTLSVersionCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__getTLSVersion(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_CUSTOM_GETTER(TCPSocketPrototype__listenerGetterWrap, (JSGlobalObject * lexicalGlobalObject, EncodedJSValue thisValue, PropertyName attributeName))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -17355,6 +17704,33 @@ extern "C" EncodedJSValue TCPSocketPrototype__remoteAddressGetCachedValue(JSC::E
     return JSValue::encode(thisObject->m_remoteAddress.get());
 }
 
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__setMaxSendFragmentCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__setMaxSendFragment(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__setServernameCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -17382,6 +17758,33 @@ JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__setServernameCallback, (JSGlobalObj
     return TCPSocketPrototype__setServername(thisObject->wrapped(), lexicalGlobalObject, callFrame);
 }
 
+JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__setSessionCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTCPSocket* thisObject = jsDynamicCast<JSTCPSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TCPSocketPrototype__setSession(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_HOST_FUNCTION(TCPSocketPrototype__shutdownCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -17694,12 +18097,45 @@ JSC_DECLARE_CUSTOM_SETTER(TLSSocketPrototype__dataSetterWrap);
 extern "C" EncodedJSValue TLSSocketPrototype__end(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__endCallback);
 
+extern "C" EncodedJSValue TLSSocketPrototype__exportKeyingMaterial(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__exportKeyingMaterialCallback);
+
 extern "C" EncodedJSValue TLSSocketPrototype__flush(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__flushCallback);
 
 extern "C" EncodedJSValue TLSSocketPrototype__getAuthorizationError(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getAuthorizationErrorCallback);
 
+extern "C" EncodedJSValue TLSSocketPrototype__getCertificate(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getCertificateCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getCipher(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getCipherCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getEphemeralKeyInfo(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getEphemeralKeyInfoCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getPeerCertificate(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getPeerCertificateCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getSession(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getSessionCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getSharedSigalgs(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getSharedSigalgsCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getTLSFinishedMessage(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getTLSFinishedMessageCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getTLSPeerFinishedMessage(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getTLSPeerFinishedMessageCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getTLSTicket(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getTLSTicketCallback);
+
+extern "C" EncodedJSValue TLSSocketPrototype__getTLSVersion(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__getTLSVersionCallback);
+
 extern "C" JSC::EncodedJSValue TLSSocketPrototype__getListener(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject);
 JSC_DECLARE_CUSTOM_GETTER(TLSSocketPrototype__listenerGetterWrap);
 
@@ -17718,9 +18154,15 @@ JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__reloadCallback);
 extern "C" JSC::EncodedJSValue TLSSocketPrototype__getRemoteAddress(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject);
 JSC_DECLARE_CUSTOM_GETTER(TLSSocketPrototype__remoteAddressGetterWrap);
 
+extern "C" EncodedJSValue TLSSocketPrototype__setMaxSendFragment(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__setMaxSendFragmentCallback);
+
 extern "C" EncodedJSValue TLSSocketPrototype__setServername(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__setServernameCallback);
 
+extern "C" EncodedJSValue TLSSocketPrototype__setSession(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
+JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__setSessionCallback);
+
 extern "C" EncodedJSValue TLSSocketPrototype__shutdown(void* ptr, JSC::JSGlobalObject* lexicalGlobalObject, JSC::CallFrame* callFrame);
 JSC_DECLARE_HOST_FUNCTION(TLSSocketPrototype__shutdownCallback);
 
@@ -17743,15 +18185,28 @@ static const HashTableValue JSTLSSocketPrototypeTableValues[] = {
     { "authorized"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TLSSocketPrototype__authorizedGetterWrap, 0 } },
     { "data"_s, static_cast<unsigned>(JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TLSSocketPrototype__dataGetterWrap, TLSSocketPrototype__dataSetterWrap } },
     { "end"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__endCallback, 3 } },
+    { "exportKeyingMaterial"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__exportKeyingMaterialCallback, 3 } },
     { "flush"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__flushCallback, 0 } },
     { "getAuthorizationError"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getAuthorizationErrorCallback, 0 } },
+    { "getCertificate"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getCertificateCallback, 0 } },
+    { "getCipher"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getCipherCallback, 0 } },
+    { "getEphemeralKeyInfo"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getEphemeralKeyInfoCallback, 0 } },
+    { "getPeerCertificate"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getPeerCertificateCallback, 1 } },
+    { "getSession"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getSessionCallback, 0 } },
+    { "getSharedSigalgs"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getSharedSigalgsCallback, 0 } },
+    { "getTLSFinishedMessage"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getTLSFinishedMessageCallback, 0 } },
+    { "getTLSPeerFinishedMessage"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getTLSPeerFinishedMessageCallback, 0 } },
+    { "getTLSTicket"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getTLSTicketCallback, 0 } },
+    { "getTLSVersion"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__getTLSVersionCallback, 0 } },
     { "listener"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TLSSocketPrototype__listenerGetterWrap, 0 } },
     { "localPort"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TLSSocketPrototype__localPortGetterWrap, 0 } },
     { "readyState"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TLSSocketPrototype__readyStateGetterWrap, 0 } },
     { "ref"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__refCallback, 0 } },
     { "reload"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__reloadCallback, 1 } },
     { "remoteAddress"_s, static_cast<unsigned>(JSC::PropertyAttribute::ReadOnly | JSC::PropertyAttribute::CustomAccessor | JSC::PropertyAttribute::DOMAttribute | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::GetterSetterType, TLSSocketPrototype__remoteAddressGetterWrap, 0 } },
+    { "setMaxSendFragment"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__setMaxSendFragmentCallback, 1 } },
     { "setServername"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__setServernameCallback, 1 } },
+    { "setSession"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__setSessionCallback, 0 } },
     { "shutdown"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__shutdownCallback, 1 } },
     { "timeout"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__timeoutCallback, 1 } },
     { "unref"_s, static_cast<unsigned>(JSC::PropertyAttribute::Function | PropertyAttribute::DontDelete), NoIntrinsic, { HashTableValue::NativeFunctionType, TLSSocketPrototype__unrefCallback, 0 } },
@@ -17866,6 +18321,33 @@ JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__endCallback, (JSGlobalObject * lexi
     return TLSSocketPrototype__end(thisObject->wrapped(), lexicalGlobalObject, callFrame);
 }
 
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__exportKeyingMaterialCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__exportKeyingMaterial(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__flushCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -17920,6 +18402,276 @@ JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getAuthorizationErrorCallback, (JSG
     return TLSSocketPrototype__getAuthorizationError(thisObject->wrapped(), lexicalGlobalObject, callFrame);
 }
 
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getCertificateCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getCertificate(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getCipherCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getCipher(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getEphemeralKeyInfoCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getEphemeralKeyInfo(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getPeerCertificateCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getPeerCertificate(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getSessionCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getSession(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getSharedSigalgsCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getSharedSigalgs(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getTLSFinishedMessageCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getTLSFinishedMessage(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getTLSPeerFinishedMessageCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getTLSPeerFinishedMessage(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getTLSTicketCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getTLSTicket(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__getTLSVersionCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__getTLSVersion(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_CUSTOM_GETTER(TLSSocketPrototype__listenerGetterWrap, (JSGlobalObject * lexicalGlobalObject, EncodedJSValue thisValue, PropertyName attributeName))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -18041,6 +18793,33 @@ extern "C" EncodedJSValue TLSSocketPrototype__remoteAddressGetCachedValue(JSC::E
     return JSValue::encode(thisObject->m_remoteAddress.get());
 }
 
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__setMaxSendFragmentCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__setMaxSendFragment(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__setServernameCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
 {
     auto& vm = lexicalGlobalObject->vm();
@@ -18068,6 +18847,33 @@ JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__setServernameCallback, (JSGlobalObj
     return TLSSocketPrototype__setServername(thisObject->wrapped(), lexicalGlobalObject, callFrame);
 }
 
+JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__setSessionCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
+{
+    auto& vm = lexicalGlobalObject->vm();
+
+    JSTLSSocket* thisObject = jsDynamicCast<JSTLSSocket*>(callFrame->thisValue());
+
+    if (UNLIKELY(!thisObject)) {
+        auto throwScope = DECLARE_THROW_SCOPE(vm);
+        return throwVMTypeError(lexicalGlobalObject, throwScope);
+    }
+
+    JSC::EnsureStillAliveScope thisArg = JSC::EnsureStillAliveScope(thisObject);
+
+#ifdef BUN_DEBUG
+    /** View the file name of the JS file that called this function
+     * from a debugger */
+    SourceOrigin sourceOrigin = callFrame->callerSourceOrigin(vm);
+    const char* fileName = sourceOrigin.string().utf8().data();
+    static const char* lastFileName = nullptr;
+    if (lastFileName != fileName) {
+        lastFileName = fileName;
+    }
+#endif
+
+    return TLSSocketPrototype__setSession(thisObject->wrapped(), lexicalGlobalObject, callFrame);
+}
+
 JSC_DEFINE_HOST_FUNCTION(TLSSocketPrototype__shutdownCallback, (JSGlobalObject * lexicalGlobalObject, CallFrame* callFrame))
 {
     auto& vm = lexicalGlobalObject->vm();
diff --git a/src/bun.js/bindings/bindings.cpp b/src/bun.js/bindings/bindings.cpp
index 552da4009..1c97a57a4 100644
--- a/src/bun.js/bindings/bindings.cpp
+++ b/src/bun.js/bindings/bindings.cpp
@@ -2190,6 +2190,14 @@ CPP_DECL void JSC__JSValue__putIndex(JSC__JSValue JSValue0, JSC__JSGlobalObject*
     array->putDirectIndex(arg1, arg2, value2);
 }
 
+CPP_DECL void JSC__JSValue__push(JSC__JSValue JSValue0, JSC__JSGlobalObject* arg1, JSC__JSValue JSValue3)
+{
+    JSC::JSValue value = JSC::JSValue::decode(JSValue0);
+    JSC::JSValue value2 = JSC::JSValue::decode(JSValue3);
+    JSC::JSArray* array = JSC::jsCast<JSC::JSArray*>(value);
+    array->push(arg1, value2);
+}
+
 JSC__JSValue JSC__JSValue__createStringArray(JSC__JSGlobalObject* globalObject, const ZigString* arg1,
     size_t arg2, bool clone)
 {
diff --git a/src/bun.js/bindings/bindings.zig b/src/bun.js/bindings/bindings.zig
index a28bb4297..5b627552b 100644
--- a/src/bun.js/bindings/bindings.zig
+++ b/src/bun.js/bindings/bindings.zig
@@ -3527,6 +3527,10 @@ pub const JSValue = enum(JSValueReprInt) {
         cppFn("putIndex", .{ value, globalObject, i, out });
     }
 
+    pub fn push(value: JSValue, globalObject: *JSGlobalObject, out: JSValue) void {
+        cppFn("push", .{ value, globalObject, out });
+    }
+
     pub fn as(value: JSValue, comptime ZigType: type) ?*ZigType {
         if (value.isEmptyOrUndefinedOrNull())
             return null;
@@ -4843,6 +4847,7 @@ pub const JSValue = enum(JSValueReprInt) {
         "put",
         "putDirect",
         "putIndex",
+        "push",
         "putRecord",
         "strictDeepEquals",
         "symbolFor",
diff --git a/src/bun.js/bindings/generated_classes.zig b/src/bun.js/bindings/generated_classes.zig
index 10aec1865..947be7a51 100644
--- a/src/bun.js/bindings/generated_classes.zig
+++ b/src/bun.js/bindings/generated_classes.zig
@@ -4458,10 +4458,32 @@ pub const JSTCPSocket = struct {
             @compileLog("Expected TCPSocket.setData to be a setter");
         if (@TypeOf(TCPSocket.end) != CallbackType)
             @compileLog("Expected TCPSocket.end to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.end)));
+        if (@TypeOf(TCPSocket.exportKeyingMaterial) != CallbackType)
+            @compileLog("Expected TCPSocket.exportKeyingMaterial to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.exportKeyingMaterial)));
         if (@TypeOf(TCPSocket.flush) != CallbackType)
             @compileLog("Expected TCPSocket.flush to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.flush)));
         if (@TypeOf(TCPSocket.getAuthorizationError) != CallbackType)
             @compileLog("Expected TCPSocket.getAuthorizationError to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getAuthorizationError)));
+        if (@TypeOf(TCPSocket.getCertificate) != CallbackType)
+            @compileLog("Expected TCPSocket.getCertificate to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getCertificate)));
+        if (@TypeOf(TCPSocket.getCipher) != CallbackType)
+            @compileLog("Expected TCPSocket.getCipher to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getCipher)));
+        if (@TypeOf(TCPSocket.getEphemeralKeyInfo) != CallbackType)
+            @compileLog("Expected TCPSocket.getEphemeralKeyInfo to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getEphemeralKeyInfo)));
+        if (@TypeOf(TCPSocket.getPeerCertificate) != CallbackType)
+            @compileLog("Expected TCPSocket.getPeerCertificate to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getPeerCertificate)));
+        if (@TypeOf(TCPSocket.getSession) != CallbackType)
+            @compileLog("Expected TCPSocket.getSession to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getSession)));
+        if (@TypeOf(TCPSocket.getSharedSigalgs) != CallbackType)
+            @compileLog("Expected TCPSocket.getSharedSigalgs to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getSharedSigalgs)));
+        if (@TypeOf(TCPSocket.getTLSFinishedMessage) != CallbackType)
+            @compileLog("Expected TCPSocket.getTLSFinishedMessage to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getTLSFinishedMessage)));
+        if (@TypeOf(TCPSocket.getTLSPeerFinishedMessage) != CallbackType)
+            @compileLog("Expected TCPSocket.getTLSPeerFinishedMessage to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getTLSPeerFinishedMessage)));
+        if (@TypeOf(TCPSocket.getTLSTicket) != CallbackType)
+            @compileLog("Expected TCPSocket.getTLSTicket to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getTLSTicket)));
+        if (@TypeOf(TCPSocket.getTLSVersion) != CallbackType)
+            @compileLog("Expected TCPSocket.getTLSVersion to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.getTLSVersion)));
         if (@TypeOf(TCPSocket.getListener) != GetterType)
             @compileLog("Expected TCPSocket.getListener to be a getter");
 
@@ -4478,8 +4500,12 @@ pub const JSTCPSocket = struct {
         if (@TypeOf(TCPSocket.getRemoteAddress) != GetterType)
             @compileLog("Expected TCPSocket.getRemoteAddress to be a getter");
 
+        if (@TypeOf(TCPSocket.setMaxSendFragment) != CallbackType)
+            @compileLog("Expected TCPSocket.setMaxSendFragment to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.setMaxSendFragment)));
         if (@TypeOf(TCPSocket.setServername) != CallbackType)
             @compileLog("Expected TCPSocket.setServername to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.setServername)));
+        if (@TypeOf(TCPSocket.setSession) != CallbackType)
+            @compileLog("Expected TCPSocket.setSession to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.setSession)));
         if (@TypeOf(TCPSocket.shutdown) != CallbackType)
             @compileLog("Expected TCPSocket.shutdown to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.shutdown)));
         if (@TypeOf(TCPSocket.timeout) != CallbackType)
@@ -4492,21 +4518,34 @@ pub const JSTCPSocket = struct {
             @compileLog("Expected TCPSocket.write to be a callback but received " ++ @typeName(@TypeOf(TCPSocket.write)));
         if (!JSC.is_bindgen) {
             @export(TCPSocket.end, .{ .name = "TCPSocketPrototype__end" });
+            @export(TCPSocket.exportKeyingMaterial, .{ .name = "TCPSocketPrototype__exportKeyingMaterial" });
             @export(TCPSocket.finalize, .{ .name = "TCPSocketClass__finalize" });
             @export(TCPSocket.flush, .{ .name = "TCPSocketPrototype__flush" });
             @export(TCPSocket.getALPNProtocol, .{ .name = "TCPSocketPrototype__getALPNProtocol" });
             @export(TCPSocket.getAuthorizationError, .{ .name = "TCPSocketPrototype__getAuthorizationError" });
             @export(TCPSocket.getAuthorized, .{ .name = "TCPSocketPrototype__getAuthorized" });
+            @export(TCPSocket.getCertificate, .{ .name = "TCPSocketPrototype__getCertificate" });
+            @export(TCPSocket.getCipher, .{ .name = "TCPSocketPrototype__getCipher" });
             @export(TCPSocket.getData, .{ .name = "TCPSocketPrototype__getData" });
+            @export(TCPSocket.getEphemeralKeyInfo, .{ .name = "TCPSocketPrototype__getEphemeralKeyInfo" });
             @export(TCPSocket.getListener, .{ .name = "TCPSocketPrototype__getListener" });
             @export(TCPSocket.getLocalPort, .{ .name = "TCPSocketPrototype__getLocalPort" });
+            @export(TCPSocket.getPeerCertificate, .{ .name = "TCPSocketPrototype__getPeerCertificate" });
             @export(TCPSocket.getReadyState, .{ .name = "TCPSocketPrototype__getReadyState" });
             @export(TCPSocket.getRemoteAddress, .{ .name = "TCPSocketPrototype__getRemoteAddress" });
+            @export(TCPSocket.getSession, .{ .name = "TCPSocketPrototype__getSession" });
+            @export(TCPSocket.getSharedSigalgs, .{ .name = "TCPSocketPrototype__getSharedSigalgs" });
+            @export(TCPSocket.getTLSFinishedMessage, .{ .name = "TCPSocketPrototype__getTLSFinishedMessage" });
+            @export(TCPSocket.getTLSPeerFinishedMessage, .{ .name = "TCPSocketPrototype__getTLSPeerFinishedMessage" });
+            @export(TCPSocket.getTLSTicket, .{ .name = "TCPSocketPrototype__getTLSTicket" });
+            @export(TCPSocket.getTLSVersion, .{ .name = "TCPSocketPrototype__getTLSVersion" });
             @export(TCPSocket.hasPendingActivity, .{ .name = "TCPSocket__hasPendingActivity" });
             @export(TCPSocket.ref, .{ .name = "TCPSocketPrototype__ref" });
             @export(TCPSocket.reload, .{ .name = "TCPSocketPrototype__reload" });
             @export(TCPSocket.setData, .{ .name = "TCPSocketPrototype__setData" });
+            @export(TCPSocket.setMaxSendFragment, .{ .name = "TCPSocketPrototype__setMaxSendFragment" });
             @export(TCPSocket.setServername, .{ .name = "TCPSocketPrototype__setServername" });
+            @export(TCPSocket.setSession, .{ .name = "TCPSocketPrototype__setSession" });
             @export(TCPSocket.shutdown, .{ .name = "TCPSocketPrototype__shutdown" });
             @export(TCPSocket.timeout, .{ .name = "TCPSocketPrototype__timeout" });
             @export(TCPSocket.unref, .{ .name = "TCPSocketPrototype__unref" });
@@ -4623,10 +4662,32 @@ pub const JSTLSSocket = struct {
             @compileLog("Expected TLSSocket.setData to be a setter");
         if (@TypeOf(TLSSocket.end) != CallbackType)
             @compileLog("Expected TLSSocket.end to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.end)));
+        if (@TypeOf(TLSSocket.exportKeyingMaterial) != CallbackType)
+            @compileLog("Expected TLSSocket.exportKeyingMaterial to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.exportKeyingMaterial)));
         if (@TypeOf(TLSSocket.flush) != CallbackType)
             @compileLog("Expected TLSSocket.flush to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.flush)));
         if (@TypeOf(TLSSocket.getAuthorizationError) != CallbackType)
             @compileLog("Expected TLSSocket.getAuthorizationError to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getAuthorizationError)));
+        if (@TypeOf(TLSSocket.getCertificate) != CallbackType)
+            @compileLog("Expected TLSSocket.getCertificate to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getCertificate)));
+        if (@TypeOf(TLSSocket.getCipher) != CallbackType)
+            @compileLog("Expected TLSSocket.getCipher to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getCipher)));
+        if (@TypeOf(TLSSocket.getEphemeralKeyInfo) != CallbackType)
+            @compileLog("Expected TLSSocket.getEphemeralKeyInfo to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getEphemeralKeyInfo)));
+        if (@TypeOf(TLSSocket.getPeerCertificate) != CallbackType)
+            @compileLog("Expected TLSSocket.getPeerCertificate to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getPeerCertificate)));
+        if (@TypeOf(TLSSocket.getSession) != CallbackType)
+            @compileLog("Expected TLSSocket.getSession to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getSession)));
+        if (@TypeOf(TLSSocket.getSharedSigalgs) != CallbackType)
+            @compileLog("Expected TLSSocket.getSharedSigalgs to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getSharedSigalgs)));
+        if (@TypeOf(TLSSocket.getTLSFinishedMessage) != CallbackType)
+            @compileLog("Expected TLSSocket.getTLSFinishedMessage to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getTLSFinishedMessage)));
+        if (@TypeOf(TLSSocket.getTLSPeerFinishedMessage) != CallbackType)
+            @compileLog("Expected TLSSocket.getTLSPeerFinishedMessage to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getTLSPeerFinishedMessage)));
+        if (@TypeOf(TLSSocket.getTLSTicket) != CallbackType)
+            @compileLog("Expected TLSSocket.getTLSTicket to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getTLSTicket)));
+        if (@TypeOf(TLSSocket.getTLSVersion) != CallbackType)
+            @compileLog("Expected TLSSocket.getTLSVersion to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.getTLSVersion)));
         if (@TypeOf(TLSSocket.getListener) != GetterType)
             @compileLog("Expected TLSSocket.getListener to be a getter");
 
@@ -4643,8 +4704,12 @@ pub const JSTLSSocket = struct {
         if (@TypeOf(TLSSocket.getRemoteAddress) != GetterType)
             @compileLog("Expected TLSSocket.getRemoteAddress to be a getter");
 
+        if (@TypeOf(TLSSocket.setMaxSendFragment) != CallbackType)
+            @compileLog("Expected TLSSocket.setMaxSendFragment to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.setMaxSendFragment)));
         if (@TypeOf(TLSSocket.setServername) != CallbackType)
             @compileLog("Expected TLSSocket.setServername to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.setServername)));
+        if (@TypeOf(TLSSocket.setSession) != CallbackType)
+            @compileLog("Expected TLSSocket.setSession to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.setSession)));
         if (@TypeOf(TLSSocket.shutdown) != CallbackType)
             @compileLog("Expected TLSSocket.shutdown to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.shutdown)));
         if (@TypeOf(TLSSocket.timeout) != CallbackType)
@@ -4657,21 +4722,34 @@ pub const JSTLSSocket = struct {
             @compileLog("Expected TLSSocket.write to be a callback but received " ++ @typeName(@TypeOf(TLSSocket.write)));
         if (!JSC.is_bindgen) {
             @export(TLSSocket.end, .{ .name = "TLSSocketPrototype__end" });
+            @export(TLSSocket.exportKeyingMaterial, .{ .name = "TLSSocketPrototype__exportKeyingMaterial" });
             @export(TLSSocket.finalize, .{ .name = "TLSSocketClass__finalize" });
             @export(TLSSocket.flush, .{ .name = "TLSSocketPrototype__flush" });
             @export(TLSSocket.getALPNProtocol, .{ .name = "TLSSocketPrototype__getALPNProtocol" });
             @export(TLSSocket.getAuthorizationError, .{ .name = "TLSSocketPrototype__getAuthorizationError" });
             @export(TLSSocket.getAuthorized, .{ .name = "TLSSocketPrototype__getAuthorized" });
+            @export(TLSSocket.getCertificate, .{ .name = "TLSSocketPrototype__getCertificate" });
+            @export(TLSSocket.getCipher, .{ .name = "TLSSocketPrototype__getCipher" });
             @export(TLSSocket.getData, .{ .name = "TLSSocketPrototype__getData" });
+            @export(TLSSocket.getEphemeralKeyInfo, .{ .name = "TLSSocketPrototype__getEphemeralKeyInfo" });
             @export(TLSSocket.getListener, .{ .name = "TLSSocketPrototype__getListener" });
             @export(TLSSocket.getLocalPort, .{ .name = "TLSSocketPrototype__getLocalPort" });
+            @export(TLSSocket.getPeerCertificate, .{ .name = "TLSSocketPrototype__getPeerCertificate" });
             @export(TLSSocket.getReadyState, .{ .name = "TLSSocketPrototype__getReadyState" });
             @export(TLSSocket.getRemoteAddress, .{ .name = "TLSSocketPrototype__getRemoteAddress" });
+            @export(TLSSocket.getSession, .{ .name = "TLSSocketPrototype__getSession" });
+            @export(TLSSocket.getSharedSigalgs, .{ .name = "TLSSocketPrototype__getSharedSigalgs" });
+            @export(TLSSocket.getTLSFinishedMessage, .{ .name = "TLSSocketPrototype__getTLSFinishedMessage" });
+            @export(TLSSocket.getTLSPeerFinishedMessage, .{ .name = "TLSSocketPrototype__getTLSPeerFinishedMessage" });
+            @export(TLSSocket.getTLSTicket, .{ .name = "TLSSocketPrototype__getTLSTicket" });
+            @export(TLSSocket.getTLSVersion, .{ .name = "TLSSocketPrototype__getTLSVersion" });
             @export(TLSSocket.hasPendingActivity, .{ .name = "TLSSocket__hasPendingActivity" });
             @export(TLSSocket.ref, .{ .name = "TLSSocketPrototype__ref" });
             @export(TLSSocket.reload, .{ .name = "TLSSocketPrototype__reload" });
             @export(TLSSocket.setData, .{ .name = "TLSSocketPrototype__setData" });
+            @export(TLSSocket.setMaxSendFragment, .{ .name = "TLSSocketPrototype__setMaxSendFragment" });
             @export(TLSSocket.setServername, .{ .name = "TLSSocketPrototype__setServername" });
+            @export(TLSSocket.setSession, .{ .name = "TLSSocketPrototype__setSession" });
             @export(TLSSocket.shutdown, .{ .name = "TLSSocketPrototype__shutdown" });
             @export(TLSSocket.timeout, .{ .name = "TLSSocketPrototype__timeout" });
             @export(TLSSocket.unref, .{ .name = "TLSSocketPrototype__unref" });
diff --git a/src/bun.js/bindings/headers.h b/src/bun.js/bindings/headers.h
index 206a7e27c..9bc8cd793 100644
--- a/src/bun.js/bindings/headers.h
+++ b/src/bun.js/bindings/headers.h
@@ -383,6 +383,7 @@ CPP_DECL unsigned char JSC__JSValue__jsType(JSC__JSValue JSValue0);
 CPP_DECL JSC__JSValue JSC__JSValue__jsUndefined();
 CPP_DECL JSC__JSValue JSC__JSValue__makeWithNameAndPrototype(JSC__JSGlobalObject* arg0, void* arg1, void* arg2, const ZigString* arg3);
 CPP_DECL JSC__JSValue JSC__JSValue__parseJSON(JSC__JSValue JSValue0, JSC__JSGlobalObject* arg1);
+CPP_DECL void JSC__JSValue__push(JSC__JSValue JSValue0, JSC__JSGlobalObject* arg1, JSC__JSValue JSValue2);
 CPP_DECL void JSC__JSValue__put(JSC__JSValue JSValue0, JSC__JSGlobalObject* arg1, const ZigString* arg2, JSC__JSValue JSValue3);
 CPP_DECL void JSC__JSValue__putIndex(JSC__JSValue JSValue0, JSC__JSGlobalObject* arg1, uint32_t arg2, JSC__JSValue JSValue3);
 CPP_DECL void JSC__JSValue__putRecord(JSC__JSValue JSValue0, JSC__JSGlobalObject* arg1, ZigString* arg2, ZigString* arg3, size_t arg4);
diff --git a/src/bun.js/bindings/headers.zig b/src/bun.js/bindings/headers.zig
index 155b7cce4..dade6c8ae 100644
--- a/src/bun.js/bindings/headers.zig
+++ b/src/bun.js/bindings/headers.zig
@@ -283,6 +283,7 @@ pub extern fn JSC__JSValue__jsType(JSValue0: JSC__JSValue) u8;
 pub extern fn JSC__JSValue__jsUndefined(...) JSC__JSValue;
 pub extern fn JSC__JSValue__makeWithNameAndPrototype(arg0: *bindings.JSGlobalObject, arg1: ?*anyopaque, arg2: ?*anyopaque, arg3: [*c]const ZigString) JSC__JSValue;
 pub extern fn JSC__JSValue__parseJSON(JSValue0: JSC__JSValue, arg1: *bindings.JSGlobalObject) JSC__JSValue;
+pub extern fn JSC__JSValue__push(JSValue0: JSC__JSValue, arg1: *bindings.JSGlobalObject, JSValue2: JSC__JSValue) void;
 pub extern fn JSC__JSValue__put(JSValue0: JSC__JSValue, arg1: *bindings.JSGlobalObject, arg2: [*c]const ZigString, JSValue3: JSC__JSValue) void;
 pub extern fn JSC__JSValue__putIndex(JSValue0: JSC__JSValue, arg1: *bindings.JSGlobalObject, arg2: u32, JSValue3: JSC__JSValue) void;
 pub extern fn JSC__JSValue__putRecord(JSValue0: JSC__JSValue, arg1: *bindings.JSGlobalObject, arg2: [*c]ZigString, arg3: [*c]ZigString, arg4: usize) void;