@mertushka/webrtc-node 0.1.0-alpha.0

package/scripts/check-wpt-results.js

@@ -0,0 +1,117 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const root = path.resolve(__dirname, "..");
+const args = process.argv.slice(2);
+const failOnRetries =
+  (args.includes("--fail-on-retries") || process.env.WPT_FAIL_ON_RETRIES === "1") &&
+  !args.includes("--allow-retries") &&
+  process.env.WPT_ALLOW_RETRIES !== "1";
+const explicitPathIndex = args.indexOf("--results");
+const expectedTotalIndex = args.indexOf("--expected-total");
+const resultsPath =
+  explicitPathIndex === -1
+    ? process.env.WPT_RESULTS || path.join(root, "wpt-results.json")
+    : args[explicitPathIndex + 1];
+const manifestPath = path.join(root, "wpt-manifest.json");
+const manifest = fs.existsSync(manifestPath)
+  ? JSON.parse(fs.readFileSync(manifestPath, "utf8"))
+  : {};
+const expectedTotal = process.env.WPT_EXPECTED_TOTAL
+  ? Number(process.env.WPT_EXPECTED_TOTAL)
+  : expectedTotalIndex === -1
+    ? (manifest.expectedSelectedSubtests ?? null)
+    : Number(args[expectedTotalIndex + 1]);
+
+function fail(message) {
+  console.error(`WPT result check failed: ${message}`);
+  process.exit(1);
+}
+
+if (explicitPathIndex !== -1 && !resultsPath) {
+  fail("--results requires a path");
+}
+if (expectedTotalIndex !== -1 && !args[expectedTotalIndex + 1]) {
+  fail("--expected-total requires a positive integer");
+}
+
+if (!fs.existsSync(resultsPath)) {
+  fail(`${resultsPath} does not exist`);
+}
+
+let summary;
+try {
+  summary = JSON.parse(fs.readFileSync(resultsPath, "utf8"));
+} catch (error) {
+  fail(`could not parse ${resultsPath}: ${error.message}`);
+}
+
+if (!Array.isArray(summary.results)) {
+  fail(`${resultsPath} is not a WPT run result artifact`);
+}
+
+if (!Number.isInteger(summary.total) || summary.total < 1) {
+  fail("total must be a positive integer");
+}
+
+if (!Number.isInteger(summary.pass) || summary.pass < 0) {
+  fail("pass must be a non-negative integer");
+}
+
+if (!Number.isInteger(summary.fail) || summary.fail < 0) {
+  fail("fail must be a non-negative integer");
+}
+
+if (summary.results.length !== summary.total) {
+  fail(`results length ${summary.results.length} does not match total ${summary.total}`);
+}
+
+const passCount = summary.results.filter((result) => result.status === "PASS").length;
+const failCount = summary.results.filter((result) => result.status === "FAIL").length;
+const unexpectedStatuses = summary.results.filter(
+  (result) => result.status !== "PASS" && result.status !== "FAIL",
+);
+const retried = summary.results.filter((result) => Number(result.retries) > 0);
+
+if (passCount !== summary.pass) {
+  fail(`pass count ${summary.pass} does not match ${passCount} PASS results`);
+}
+
+if (failCount !== summary.fail) {
+  fail(`fail count ${summary.fail} does not match ${failCount} FAIL results`);
+}
+
+if (unexpectedStatuses.length) {
+  fail(`unexpected result status ${unexpectedStatuses[0].status}`);
+}
+
+if (summary.fail !== 0 || passCount !== summary.total) {
+  const failures = summary.results
+    .filter((result) => result.status !== "PASS")
+    .slice(0, 5)
+    .map((result) => `${result.file} :: ${result.name}`)
+    .join("; ");
+  fail(`selected WPT suite did not pass: ${failures}`);
+}
+
+if (expectedTotal !== null) {
+  if (!Number.isInteger(expectedTotal) || expectedTotal < 1) {
+    fail("WPT_EXPECTED_TOTAL must be a positive integer");
+  }
+  if (summary.total !== expectedTotal) {
+    fail(`total ${summary.total} does not match expected selected subtests ${expectedTotal}`);
+  }
+}
+
+if (retried.length && failOnRetries) {
+  const details = retried
+    .slice(0, 5)
+    .map((result) => `${result.file} :: ${result.name} (${result.retries})`)
+    .join("; ");
+  fail(`worker retries were recorded: ${details}`);
+}
+
+const retrySuffix = retried.length ? `, retries=${retried.length}` : ", retries=0";
+console.log(`WPT results verified: ${summary.pass}/${summary.total} passed${retrySuffix}`);

package/scripts/check-wpt-selection.js

@@ -0,0 +1,72 @@
+"use strict";
+
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const root = path.resolve(__dirname, "..");
+const manifestPath = path.join(root, "wpt-manifest.json");
+const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+const expectedTotal = manifest.expectedSelectedSubtests;
+
+function fail(message) {
+  console.error(`WPT selection check failed: ${message}`);
+  process.exit(1);
+}
+
+if (!Number.isInteger(expectedTotal) || expectedTotal < 1) {
+  fail("wpt-manifest.json expectedSelectedSubtests must be a positive integer");
+}
+
+const resultsPath = path.join(
+  os.tmpdir(),
+  `webrtc-node-wpt-selection-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}.json`,
+);
+
+try {
+  const child = spawnSync(process.execPath, [path.join("scripts", "run-wpt-subset.js")], {
+    cwd: root,
+    env: {
+      ...process.env,
+      WPT_LIST_TESTS: "1",
+      WPT_WORKER_RESULTS: resultsPath,
+    },
+    encoding: "utf8",
+    maxBuffer: 20 * 1024 * 1024,
+    timeout: Number(process.env.WPT_SELECTION_TIMEOUT_MS || 300000),
+  });
+
+  if (child.error) fail(child.error.message);
+  if (child.status !== 0 || child.signal) {
+    const output = [child.stderr, child.stdout].filter(Boolean).join("\n").trim();
+    fail(
+      output ||
+        (child.signal
+          ? `list worker terminated by ${child.signal}`
+          : `list worker exited with status ${child.status}`),
+    );
+  }
+  if (!fs.existsSync(resultsPath)) {
+    fail("list mode did not write a result artifact");
+  }
+
+  const payload = JSON.parse(fs.readFileSync(resultsPath, "utf8"));
+  if (!Array.isArray(payload.tests)) {
+    fail("list mode artifact does not contain a tests array");
+  }
+  if (!payload.tests.every((test) => typeof test === "string" && test.length > 0)) {
+    fail("list mode artifact contains an invalid test name");
+  }
+  if (payload.tests.length !== expectedTotal) {
+    fail(`selected ${payload.tests.length} subtests, expected ${expectedTotal}`);
+  }
+
+  console.log(`WPT selection verified: ${payload.tests.length} selected subtests`);
+} finally {
+  try {
+    fs.unlinkSync(resultsPath);
+  } catch {
+    // Best-effort temp cleanup.
+  }
+}

package/scripts/ensure-wpt.js

@@ -0,0 +1,118 @@
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+
+const root = path.resolve(__dirname, "..");
+const manifest = require("../wpt-manifest.json");
+
+const wptDir = path.resolve(process.env.WPT_DIR || path.join(root, "wpt"));
+const wptRepository = process.env.WPT_REPOSITORY || "https://github.com/web-platform-tests/wpt.git";
+const wptCommit = process.env.WPT_COMMIT || manifest.wptCommit;
+const sparsePaths = ["common", "resources", "webrtc"];
+
+function runGit(args, options = {}) {
+  const result = spawnSync("git", args, {
+    cwd: options.cwd || root,
+    encoding: "utf8",
+    stdio: options.stdio || "pipe",
+  });
+  if (result.status !== 0) {
+    const stderr = result.stderr ? result.stderr.trim() : "";
+    const stdout = result.stdout ? result.stdout.trim() : "";
+    const detail = stderr || stdout || `git exited with status ${result.status}`;
+    throw new Error(`git ${args.join(" ")} failed: ${detail}`);
+  }
+  return (result.stdout || "").trim();
+}
+
+function hasWptFiles() {
+  return (
+    fs.existsSync(path.join(wptDir, "resources", "testharness.js")) &&
+    fs.existsSync(path.join(wptDir, "common", "gc.js")) &&
+    fs.existsSync(path.join(wptDir, "webrtc"))
+  );
+}
+
+function currentWptCommit() {
+  if (!fs.existsSync(path.join(wptDir, ".git"))) return null;
+  try {
+    return runGit(["rev-parse", "HEAD"], { cwd: wptDir });
+  } catch {
+    return null;
+  }
+}
+
+function ensureCleanCheckout() {
+  const status = runGit(["status", "--porcelain"], { cwd: wptDir });
+  if (status) {
+    throw new Error(
+      `wpt checkout at ${wptDir} has local changes. ` +
+        "Commit, stash, or remove them before changing the pinned WPT checkout.",
+    );
+  }
+}
+
+function checkoutPinnedCommit() {
+  runGit(["sparse-checkout", "init", "--cone"], { cwd: wptDir });
+  runGit(["sparse-checkout", "set", ...sparsePaths], { cwd: wptDir });
+  runGit(["fetch", "--depth", "1", "origin", wptCommit], { cwd: wptDir, stdio: "inherit" });
+  runGit(["checkout", "--detach", "FETCH_HEAD"], { cwd: wptDir, stdio: "inherit" });
+}
+
+function clonePinnedWpt() {
+  fs.mkdirSync(wptDir, { recursive: true });
+  runGit(["init"], { cwd: wptDir });
+  runGit(["remote", "add", "origin", wptRepository], { cwd: wptDir });
+  checkoutPinnedCommit();
+}
+
+function ensureWpt(options = {}) {
+  const quiet = Boolean(options.quiet);
+  if (!wptCommit) throw new Error("wptCommit is missing from wpt-manifest.json");
+
+  if (!fs.existsSync(wptDir)) {
+    if (!quiet) console.log(`Fetching WPT ${wptCommit} into ${wptDir}`);
+    clonePinnedWpt();
+  } else {
+    const actualCommit = currentWptCommit();
+    if (actualCommit === wptCommit && hasWptFiles()) {
+      if (!quiet) console.log(`WPT checkout is pinned at ${wptCommit}`);
+      return;
+    }
+
+    if (actualCommit === null) {
+      if (hasWptFiles()) {
+        if (!quiet) {
+          console.warn(
+            `Using existing non-git WPT tree at ${wptDir}; commit pin cannot be verified.`,
+          );
+        }
+        return;
+      }
+      throw new Error(`WPT directory exists at ${wptDir}, but it is not a usable git checkout.`);
+    }
+
+    ensureCleanCheckout();
+    if (!quiet) console.log(`Updating WPT from ${actualCommit} to ${wptCommit}`);
+    checkoutPinnedCommit();
+  }
+
+  const actualCommit = currentWptCommit();
+  if (actualCommit !== wptCommit) {
+    throw new Error(`WPT checkout is ${actualCommit || "unknown"}, expected ${wptCommit}`);
+  }
+  if (!hasWptFiles()) {
+    throw new Error(`WPT checkout at ${wptDir} is missing required common/resources/webrtc files.`);
+  }
+}
+
+if (require.main === module) {
+  try {
+    ensureWpt();
+  } catch (error) {
+    console.error(error.message);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { ensureWpt };

package/scripts/install-native.js

@@ -0,0 +1,116 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const { spawnSync } = require("node:child_process");
+const libc = require("detect-libc");
+const tar = require("tar");
+
+const root = path.resolve(__dirname, "..");
+const packageJson = require("../package.json");
+const moduleName = "webrtc_node.node";
+const releaseBaseUrl = "https://github.com/mertushka/webrtc-node/releases/download";
+
+function envFlag(name) {
+  return /^(1|true|yes)$/i.test(String(process.env[name] || ""));
+}
+
+function isSourceCheckout() {
+  return fs.existsSync(path.join(root, ".git")) && !root.split(path.sep).includes("node_modules");
+}
+
+function hasNativeAddon() {
+  try {
+    require("../lib/load-native");
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function linuxLibcTag() {
+  if (process.platform !== "linux") return null;
+  const family = libc.familySync();
+  if (family === libc.MUSL) return "musl";
+  if (family === libc.GLIBC) return "glibc";
+  return null;
+}
+
+function targetTuple() {
+  return [process.platform, process.arch, linuxLibcTag()].filter(Boolean).join("-");
+}
+
+function releaseTag() {
+  return process.env.WEBRTC_NODE_PREBUILD_TAG || `v${packageJson.version}`;
+}
+
+function prebuildAssetName() {
+  return `webrtc-node-${releaseTag()}-napi-v8-${targetTuple()}.tar.gz`;
+}
+
+function prebuildUrl() {
+  return `${releaseBaseUrl}/${releaseTag()}/${prebuildAssetName()}`;
+}
+
+async function downloadPrebuild() {
+  const response = await fetch(prebuildUrl(), {
+    headers: { "user-agent": "webrtc-node-install" },
+  });
+  if (!response.ok) {
+    throw new Error(`HTTP ${response.status} ${response.statusText}`);
+  }
+
+  const outputDir = path.join(root, "build", "Release");
+  const archivePath = path.join(outputDir, prebuildAssetName());
+  fs.mkdirSync(outputDir, { recursive: true });
+  const buffer = Buffer.from(await response.arrayBuffer());
+  fs.writeFileSync(archivePath, buffer);
+  await tar.x({ file: archivePath, cwd: outputDir });
+  fs.unlinkSync(archivePath);
+}
+
+function runBuild() {
+  const npm = process.env.npm_execpath
+    ? process.execPath
+    : process.platform === "win32"
+      ? "npm.cmd"
+      : "npm";
+  const args = process.env.npm_execpath
+    ? [process.env.npm_execpath, "run", "build"]
+    : ["run", "build"];
+  const result = spawnSync(npm, args, {
+    cwd: root,
+    stdio: "inherit",
+  });
+  return result.status === 0 && !result.signal;
+}
+
+async function main() {
+  const buildFromSource = envFlag("npm_config_build_from_source");
+  if (!buildFromSource && hasNativeAddon()) return;
+
+  if (isSourceCheckout() && !buildFromSource) {
+    console.log("Skipping native install in source checkout. Run npm run build explicitly.");
+    return;
+  }
+
+  if (!buildFromSource) {
+    try {
+      await downloadPrebuild();
+      if (hasNativeAddon()) return;
+      throw new Error(`downloaded archive did not provide ${moduleName}`);
+    } catch (error) {
+      console.warn(`Prebuilt binary unavailable for ${targetTuple()}: ${error.message}`);
+    }
+  }
+
+  if (!runBuild()) {
+    console.error("No compatible prebuilt binary was found and the cmake-js source build failed.");
+    process.exit(1);
+  }
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exit(1);
+});

package/scripts/package-prebuild.js

@@ -0,0 +1,69 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+const libc = require("detect-libc");
+const tar = require("tar");
+
+const root = path.resolve(__dirname, "..");
+const packageJson = require("../package.json");
+const moduleName = "webrtc_node.node";
+
+function option(name, defaultValue = undefined) {
+  const prefix = `--${name}=`;
+  const arg = process.argv.slice(2).find((value) => value.startsWith(prefix));
+  return arg
+    ? arg.slice(prefix.length)
+    : process.env[`PREBUILD_${name.toUpperCase()}`] || defaultValue;
+}
+
+function fail(message) {
+  console.error(`Prebuild package failed: ${message}`);
+  process.exit(1);
+}
+
+function detectLibcTag(platform) {
+  if (platform !== "linux") return null;
+  const family = libc.familySync();
+  if (family === libc.MUSL) return "musl";
+  if (family === libc.GLIBC) return "glibc";
+  return option("libc", null);
+}
+
+const platform = option("platform", process.platform);
+const arch = option("arch", process.arch);
+const libcTag = option("libc", detectLibcTag(platform));
+const source = path.resolve(option("source", path.join(root, "build", "Release", moduleName)));
+const releaseTag = option("tag", `v${packageJson.version}`);
+
+async function main() {
+  if (!fs.existsSync(source)) fail(`native addon not found at ${source}`);
+
+  const tuple = [platform, arch, libcTag].filter(Boolean).join("-");
+  const artifactDir = path.join(root, "prebuild-artifacts");
+  const stagingDir = path.join(artifactDir, tuple);
+  const archiveName = `webrtc-node-${releaseTag}-napi-v8-${tuple}.tar.gz`;
+  const archivePath = path.join(artifactDir, archiveName);
+
+  fs.rmSync(stagingDir, { recursive: true, force: true });
+  fs.mkdirSync(stagingDir, { recursive: true });
+  fs.copyFileSync(source, path.join(stagingDir, moduleName));
+
+  const extraFiles = String(option("extra", process.env.PREBUILD_EXTRA_FILES || "") || "")
+    .split(";")
+    .map((file) => file.trim())
+    .filter(Boolean);
+
+  for (const extraFile of extraFiles) {
+    const resolved = path.resolve(extraFile);
+    if (!fs.existsSync(resolved)) fail(`extra file not found at ${resolved}`);
+    fs.copyFileSync(resolved, path.join(stagingDir, path.basename(resolved)));
+  }
+
+  await tar.c({ gzip: true, file: archivePath, cwd: stagingDir }, fs.readdirSync(stagingDir));
+  fs.rmSync(stagingDir, { recursive: true, force: true });
+
+  console.log(`Packaged ${path.relative(root, archivePath).replace(/\\/g, "/")}`);
+}
+
+main().catch((error) => fail(error.message || String(error)));

package/scripts/print-wpt-manifest.js

@@ -0,0 +1,7 @@
+const manifest = require("../wpt-manifest.json");
+
+for (const [group, tests] of Object.entries(manifest)) {
+  if (!Array.isArray(tests)) continue;
+  console.log(`${group}:`);
+  for (const test of tests) console.log(`  ${test}`);
+}

package/scripts/run-docker-linux-ci.ps1

@@ -0,0 +1,73 @@
+param(
+  [string]$NodeImage = "node:20-bookworm",
+  [string]$ArtifactsDir = "ci-artifacts/docker-linux-node20",
+  [switch]$SkipWpt,
+  [string[]]$WptSelector = @(),
+  [int]$WptExpectedTotal = 0
+)
+
+$ErrorActionPreference = "Stop"
+
+$root = Resolve-Path (Join-Path $PSScriptRoot "..")
+$artifactPath = Join-Path $root $ArtifactsDir
+New-Item -ItemType Directory -Force $artifactPath | Out-Null
+
+$rootForDocker = $root.Path -replace "\\", "/"
+$artifactForDocker = (Resolve-Path $artifactPath).Path -replace "\\", "/"
+$wptSelectorArgs = ($WptSelector | ForEach-Object {
+  if ($_.Contains("'")) {
+    throw "WPT selector cannot contain a single quote: $_"
+  }
+  "'$_'"
+}) -join " "
+$wptTestCommand = if ($WptSelector.Count -gt 0) {
+  "npm run wpt:test -- $wptSelectorArgs"
+} else {
+  "npm run wpt:test"
+}
+$wptCheckCommand = if ($WptSelector.Count -gt 0) {
+  $expectedTotal = if ($WptExpectedTotal -gt 0) { $WptExpectedTotal } else { $WptSelector.Count }
+  "WPT_EXPECTED_TOTAL=$expectedTotal npm run wpt:check:strict"
+} else {
+  "npm run wpt:check:strict"
+}
+$wptReportCommand = if ($WptSelector.Count -gt 0) {
+  "true"
+} else {
+  "npm run wpt:report -- --output /out/wpt-report.md && RUNNER_OS=Linux RUNNER_ARCH=X64 node scripts/write-ci-evidence.js --results /out/wpt-results.json --output /out/ci-evidence.json"
+}
+$wptCommand = if ($SkipWpt) {
+  "npm run wpt:selection:check"
+} else {
+  "npm run wpt:selection:check && WPT_TEST_TIMEOUT_MS=180000 WPT_WORKER_TIMEOUT_MS=600000 WPT_WORKER_DELAY_MS=2000 WPT_CLEANUP_DELAY_MS=3000 $wptTestCommand 2>&1 | tee /out/wpt-output.txt && cp wpt-results.json /out/wpt-results.json && $wptCheckCommand && $wptReportCommand"
+}
+
+docker run --rm `
+  -v "${rootForDocker}:/src:ro" `
+  -v "${artifactForDocker}:/out" `
+  $NodeImage `
+  bash -lc "set -euo pipefail; mkdir -p /tmp/webrtc-node; tar -C /src --exclude='./build' --exclude='./node_modules' --exclude='./.git' --exclude='./wpt-results.json' --exclude='./wpt-report.md' --exclude='./ci-artifacts' -cf - . | tar -C /tmp/webrtc-node -xf -; cd /tmp/webrtc-node; if [ -f /etc/apt/sources.list.d/debian.sources ]; then sed -i '0,/URIs: http:\/\/deb.debian.org\/debian$/s//URIs: http:\/\/snapshot.debian.org\/archive\/debian\/20260421T000000Z/' /etc/apt/sources.list.d/debian.sources; sed -i '0,/URIs: http:\/\/deb.debian.org\/debian-security$/s//URIs: http:\/\/snapshot.debian.org\/archive\/debian-security\/20260421T000000Z/' /etc/apt/sources.list.d/debian.sources; fi; for attempt in 1 2 3; do if apt-get -o Acquire::Check-Valid-Until=false update >/out/apt-update.txt 2>&1 && apt-get install -y cmake ninja-build libssl-dev >/out/apt-install.txt 2>&1; then break; fi; if [ ""`$attempt"" = 3 ]; then exit 1; fi; sleep `$((attempt * 10)); done; npm ci 2>&1 | tee /out/npm-ci.txt; npm run check; npm run native:check; npm run build 2>&1 | tee /out/build-output.txt; npm test; npm run api:check; npm run types:check; npm run wpt:ensure; set +e; ${wptCommand}; wpt_status=`$?; set -e; cp wpt-results.json /out/wpt-results.json 2>/dev/null || true; cp wpt-manifest.json /out/wpt-manifest.json; npm run wpt:manifest > /out/wpt-manifest.txt; exit `$wpt_status"
+
+$dockerExitCode = $LASTEXITCODE
+
+if (-not $SkipWpt) {
+  $resultsPath = Join-Path $artifactPath "wpt-results.json"
+  if (-not (Test-Path $resultsPath)) {
+    throw "Docker CI did not produce $resultsPath"
+  }
+
+  $results = Get-Content -Raw -Path $resultsPath | ConvertFrom-Json
+  if ([int]$results.fail -gt 0) {
+    throw "Docker CI WPT subset failed: $($results.pass)/$($results.total) passed"
+  }
+  $retried = @($results.results | Where-Object {
+    ($_.PSObject.Properties.Name -contains "retries") -and [int]$_.retries -gt 0
+  }).Count
+  if ($retried -gt 0) {
+    throw "Docker CI WPT subset required retries: $retried"
+  }
+}
+
+if ($dockerExitCode -ne 0) {
+  throw "Docker CI failed with exit code $dockerExitCode"
+}

package/scripts/run-docker-linux-ci.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+node_image="node:20-bookworm"
+artifacts_dir="ci-artifacts/docker-linux-node20"
+skip_wpt=0
+wpt_expected_total=0
+wpt_selectors=()
+
+usage() {
+  cat <<'EOF'
+Usage: bash scripts/run-docker-linux-ci.sh [options]
+
+Options:
+  --node-image IMAGE          Node Docker image to use (default: node:20-bookworm)
+  --artifacts-dir DIR         Output directory for logs/artifacts
+  --skip-wpt                  Run build/unit/API/type/WPT-selection checks only
+  --wpt-selector SELECTOR     Run one WPT file or file#subtest selector; repeatable
+  --wpt-expected-total N      Expected selected subtest count for targeted WPT
+  -h, --help                  Show this help
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --node-image)
+      node_image="${2:?--node-image requires a value}"
+      shift 2
+      ;;
+    --artifacts-dir)
+      artifacts_dir="${2:?--artifacts-dir requires a value}"
+      shift 2
+      ;;
+    --skip-wpt)
+      skip_wpt=1
+      shift
+      ;;
+    --wpt-selector)
+      wpt_selectors+=("${2:?--wpt-selector requires a value}")
+      shift 2
+      ;;
+    --wpt-expected-total)
+      wpt_expected_total="${2:?--wpt-expected-total requires a value}"
+      shift 2
+      ;;
+    -h | --help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown option: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+root="$(cd -- "$script_dir/.." && pwd)"
+artifact_path="$root/$artifacts_dir"
+mkdir -p "$artifact_path"
+
+wpt_selector_args=""
+for selector in "${wpt_selectors[@]}"; do
+  if [[ "$selector" == *"'"* ]]; then
+    echo "WPT selector cannot contain a single quote: $selector" >&2
+    exit 2
+  fi
+  wpt_selector_args+=" '$selector'"
+done
+
+if [[ ${#wpt_selectors[@]} -gt 0 ]]; then
+  wpt_test_command="npm run wpt:test --$wpt_selector_args"
+  if [[ "$wpt_expected_total" -gt 0 ]]; then
+    expected_total="$wpt_expected_total"
+  else
+    expected_total="${#wpt_selectors[@]}"
+  fi
+  wpt_check_command="WPT_EXPECTED_TOTAL=$expected_total npm run wpt:check:strict"
+  wpt_report_command="true"
+else
+  wpt_test_command="npm run wpt:test"
+  wpt_check_command="npm run wpt:check:strict"
+  wpt_report_command="npm run wpt:report -- --output /out/wpt-report.md && RUNNER_OS=Linux RUNNER_ARCH=X64 node scripts/write-ci-evidence.js --results /out/wpt-results.json --output /out/ci-evidence.json"
+fi
+
+if [[ "$skip_wpt" -eq 1 ]]; then
+  wpt_command="npm run wpt:selection:check"
+else
+  wpt_command="npm run wpt:selection:check && WPT_TEST_TIMEOUT_MS=180000 WPT_WORKER_TIMEOUT_MS=600000 WPT_WORKER_DELAY_MS=2000 WPT_CLEANUP_DELAY_MS=3000 $wpt_test_command 2>&1 | tee /out/wpt-output.txt && cp wpt-results.json /out/wpt-results.json && $wpt_check_command && $wpt_report_command"
+fi
+
+docker run --rm \
+  -v "$root:/src:ro" \
+  -v "$artifact_path:/out" \
+  "$node_image" \
+  bash -lc "set -euo pipefail; mkdir -p /tmp/webrtc-node; tar -C /src --exclude='./build' --exclude='./node_modules' --exclude='./.git' --exclude='./wpt-results.json' --exclude='./wpt-report.md' --exclude='./ci-artifacts' -cf - . | tar -C /tmp/webrtc-node -xf -; cd /tmp/webrtc-node; if [ -f /etc/apt/sources.list.d/debian.sources ]; then sed -i '0,/URIs: http:\/\/deb.debian.org\/debian$/s//URIs: http:\/\/snapshot.debian.org\/archive\/debian\/20260421T000000Z/' /etc/apt/sources.list.d/debian.sources; sed -i '0,/URIs: http:\/\/deb.debian.org\/debian-security$/s//URIs: http:\/\/snapshot.debian.org\/archive\/debian-security\/20260421T000000Z/' /etc/apt/sources.list.d/debian.sources; fi; for attempt in 1 2 3; do if apt-get -o Acquire::Check-Valid-Until=false update >/out/apt-update.txt 2>&1 && apt-get install -y cmake ninja-build libssl-dev >/out/apt-install.txt 2>&1; then break; fi; if [ \"\$attempt\" = 3 ]; then exit 1; fi; sleep \$((attempt * 10)); done; npm ci 2>&1 | tee /out/npm-ci.txt; npm run check; npm run native:check; npm run build 2>&1 | tee /out/build-output.txt; npm test; npm run api:check; npm run types:check; npm run wpt:ensure; set +e; $wpt_command; wpt_status=\$?; set -e; cp wpt-results.json /out/wpt-results.json 2>/dev/null || true; cp wpt-manifest.json /out/wpt-manifest.json; npm run wpt:manifest > /out/wpt-manifest.txt; exit \$wpt_status"