@volter/tabnode 0.5.15 → 0.5.17

package/dist/node-lib/binding/fs.d.ts

@@ -3,6 +3,16 @@ import { Buffer as NodeBuffer } from '../buffer-module';
 /** The key the engine hangs a run's filesystem off its guest process. */
 export declare const kRunFilesystem: unique symbol;
 export declare function withFilesystem<T>(tree: VirtualFS, work: () => T): T;
+/**
+ * Where a child's output goes when its stdio names a descriptor of the
+ * parent's (`stdio: ['ignore', fd, fd]` with `fd` from `openSync`): the file
+ * that descriptor has open, as the child's own duplicate of it, so it keeps
+ * writing after the parent closes its copy. Appending descriptors append;
+ * others write on from the position the parent's copy had. A descriptor that
+ * is a stream (a socket, a pipe) is written as a stream. Anything else is
+ * not a sink, and the child's output there goes nowhere, as `ignore` does.
+ */
+export declare function descriptorWriter(fd: number): ((text: string) => void) | null;
 /** A request object `fs.js` hands an asynchronous call, answered on a tick. */
 interface FSReq {
     oncomplete?: (error: Error | null, ...rest: unknown[]) => void;

package/dist/node-lib/binding/zlib.d.ts

@@ -25,10 +25,23 @@ export declare class Zlib {
     /** Node asks a handle for these two after a `Z_STREAM_END`. */
     get ended(): boolean;
 }
+declare class BrotliDecoderHandle {
+    #private;
+    readonly mode: number;
+    onerror: ((message: string, errno: number, code?: string) => void) | null;
+    constructor(mode: number);
+    init(_params: Uint32Array, writeState: Uint32Array, processCallback: ProcessCallback): boolean;
+    write(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this;
+    writeSync(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this;
+    params(): void;
+    reset(): void;
+    close(): void;
+    getAvailableOutput(): number;
+}
 export declare const zlibBinding: {
     Zlib: typeof Zlib;
     BrotliEncoder: new (...args: unknown[]) => never;
-    BrotliDecoder: new (...args: unknown[]) => never;
+    BrotliDecoder: typeof BrotliDecoderHandle;
     ZstdCompress: new (...args: unknown[]) => never;
     ZstdDecompress: new (...args: unknown[]) => never;
     /** `zlib.crc32`, which is zlib's own table-driven one. */

package/dist/shims/perf_hooks.d.ts

@@ -1,7 +1,3 @@
-/**
- * perf_hooks shim - Performance measurement APIs
- * Wraps browser Performance API
- */
 export declare const performance: Performance;
 export declare class PerformanceObserver {
     private callback;

package/dist/shims/tls.d.ts

@@ -291,6 +291,7 @@ export declare function createTlsModule(require?: (name: string) => any): {
     };
     createSecureContext: (_options?: unknown) => {};
     getCiphers: () => string[];
+    getCACertificates: (type?: string) => string[];
     DEFAULT_ECDH_CURVE: string;
     DEFAULT_MAX_VERSION: string;
     DEFAULT_MIN_VERSION: string;
@@ -583,6 +584,7 @@ declare const tls: {
     };
     createSecureContext: (_options?: unknown) => {};
     getCiphers: () => string[];
+    getCACertificates: (type?: string) => string[];
     DEFAULT_ECDH_CURVE: string;
     DEFAULT_MAX_VERSION: string;
     DEFAULT_MIN_VERSION: string;
@@ -868,7 +870,7 @@ export declare const TLSSocket: {
     write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
     end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
     writable: boolean;
-}, createSecureContext: (_options?: unknown) => {}, getCiphers: () => string[], DEFAULT_ECDH_CURVE: string, DEFAULT_MAX_VERSION: string, DEFAULT_MIN_VERSION: string, rootCertificates: string[];
+}, createSecureContext: (_options?: unknown) => {}, getCiphers: () => string[], getCACertificates: (type?: string) => string[], DEFAULT_ECDH_CURVE: string, DEFAULT_MAX_VERSION: string, DEFAULT_MIN_VERSION: string, rootCertificates: string[];
 export type TLSSocket = InstanceType<typeof TLSSocket>;
 export type Server = InstanceType<typeof Server>;
 export default tls;

package/dist/shims/worker_threads.d.ts

@@ -44,6 +44,8 @@ export declare function receiveMessageOnPort(port: MessagePort): {
 } | undefined;
 export declare const SHARE_ENV: unique symbol;
 export declare function markAsUntransferable(object: unknown): void;
+export declare function markAsUncloneable(object: unknown): void;
+export declare function isMarkedAsUncloneable(object: unknown): boolean;
 export declare function getEnvironmentData(key: unknown): unknown;
 export declare function setEnvironmentData(key: unknown, value: unknown): void;
 declare const _default: {
@@ -59,6 +61,8 @@ declare const _default: {
     receiveMessageOnPort: typeof receiveMessageOnPort;
     SHARE_ENV: symbol;
     markAsUntransferable: typeof markAsUntransferable;
+    markAsUncloneable: typeof markAsUncloneable;
+    isMarkedAsUncloneable: typeof isMarkedAsUncloneable;
     getEnvironmentData: typeof getEnvironmentData;
     setEnvironmentData: typeof setEnvironmentData;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.15",
+  "version": "0.5.17",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",

package/src/code-transforms.ts

@@ -26,6 +26,14 @@ let __nodeLowering = false;
 const __cjsExports = () => __nodeLowering ? "$exports" : "exports";
 const __cjsModule = () => __nodeLowering ? "$module" : "module";
 const __cjsRequire = () => __nodeLowering ? "$require" : "require";
+// The realm's own `Object` and `Symbol`, by names a module cannot declare over.
+// Lowered code calls them before the module's own body has run -- its exports
+// are defined at the top -- and a module that imports a binding called `Object`
+// (typebox does, its object type) had the lowering's `Object.defineProperty`
+// read that import in its dead zone. The dev server's lowering of a browser
+// module keeps the plain names, which exist where that module runs.
+const __cjsObject = () => __nodeLowering ? "__browserRuntimeObject" : "Object";
+const __cjsSymbol = () => __nodeLowering ? "__browserRuntimeSymbol" : "Symbol";
 const __cjsDefault = (expression: string) => __nodeLowering ? "__browserRuntimeInteropDefault(" + expression + ")" : expression;
 // The helper lowered code calls by bare name. It is a name on the realm, so
 // it goes up when a guest first exists, not when this module is loaded.
@@ -33,8 +41,12 @@ forGuestRealm(() => {
   if ((globalThis as Record<string, unknown>).__browserRuntimeInteropDefault) return;
   takeFromHost(globalThis, '__browserRuntimeInteropDefault', (imported: any) => imported && imported.__esModule && "default" in imported ? imported.default : imported);
 });
+forGuestRealm(() => {
+  if (!(globalThis as Record<string, unknown>).__browserRuntimeObject) takeFromHost(globalThis, '__browserRuntimeObject', Object);
+  if (!(globalThis as Record<string, unknown>).__browserRuntimeSymbol) takeFromHost(globalThis, '__browserRuntimeSymbol', Symbol);
+});
 export const setNodeLowering = (value: boolean): void => { __nodeLowering = value; };
-export { __cjsExports };
+export { __cjsExports, __cjsObject };
 
 /**
  * Whether a module is ESM is a fact of its syntax, not of its text. Asking
@@ -175,7 +187,7 @@ function __substrateLiveImportBindings(code: any) {
       // or in what it imports; an importer waits for it, as a module graph
       // evaluates in order. The marker becomes `await` when the loader runs
       // this body as an async function, and reads nothing otherwise.
-      parts.push("/*__substrate_await__*/(" + namespace + " && " + namespace + "[Symbol.for(\"substrate.pending\")]);");
+      parts.push("/*__substrate_await__*/(" + namespace + " && " + namespace + "[" + __cjsSymbol() + ".for(\"substrate.pending\")]);");
     }
     for (const imported of declaration.specifiers) {
       const read = imported.type === "ImportDefaultSpecifier" ? __cjsDefault(namespace)
@@ -210,7 +222,10 @@ function __substrateLiveImportBindings(code: any) {
     if (typeof node.type !== "string") return;
     switch (node.type) {
       case "ImportDeclaration": case "ImportSpecifier": case "ImportDefaultSpecifier":
-      case "ImportNamespaceSpecifier": case "ExportSpecifier": case "MetaProperty":
+      // `export * as X from "…"` holds a name and a source, no reference: an
+      // imported binding also called X was rewritten into the exported name,
+      // and typebox's `export * as Guard` became `__substrateImport1`.
+      case "ImportNamespaceSpecifier": case "ExportSpecifier": case "ExportAllDeclaration": case "MetaProperty":
       case "BreakStatement": case "ContinueStatement": case "PrivateIdentifier":
         return;
       case "Identifier":
@@ -368,7 +383,7 @@ function transformEsmToCjsAst(code: string): string {
         // for any import (the marker becomes `await` in an async body).
         sideEffectImports += 1;
         const namespace = `__substrateImportSide${sideEffectImports}`;
-        replacements.push([node.start, node.end, `const ${namespace} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${namespace} && ${namespace}[Symbol.for("substrate.pending")]);`]);
+        replacements.push([node.start, node.end, `const ${namespace} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${namespace} && ${namespace}[${__cjsSymbol()}.for("substrate.pending")]);`]);
       } else {
         const defaultSpec = specs.find((s: any) => s.type === 'ImportDefaultSpecifier');
         const nsSpec = specs.find((s: any) => s.type === 'ImportNamespaceSpecifier');
@@ -404,7 +419,7 @@ function transformEsmToCjsAst(code: string): string {
       // `module.exports = X`, which threw away every named export defined
       // before it (readdirp exports `readdirp` by name and as the default;
       // chokidar imports the name and found the module was the function).
-      const defineDefault = (value: string): string => `Object.defineProperty(${__cjsExports()}, "default", { enumerable: true, configurable: true, get: function () { return ${value}; } });`;
+      const defineDefault = (value: string): string => `${__cjsObject()}.defineProperty(${__cjsExports()}, "default", { enumerable: true, configurable: true, get: function () { return ${value}; } });`;
       if (decl.type === 'FunctionDeclaration') {
         const funcCode = code.slice(decl.start, node.end);
         replacements.push([node.start, node.end, decl.id ? `${funcCode}\n${defineDefault(decl.id.name)}` : `${defineDefault(`(${funcCode})`)}`]);
@@ -423,11 +438,11 @@ function transformEsmToCjsAst(code: string): string {
           const name = decl.id.name;
           const funcCode = code.slice(decl.start, node.end);
           replacements.push([node.start, node.end, funcCode]);
-          hoisted.push(`Object.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
+          hoisted.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
         } else if (decl.type === 'ClassDeclaration') {
           const name = decl.id.name;
           const classCode = code.slice(decl.start, node.end);
-          replacements.push([node.start, node.end, `${classCode}\nObject.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`]);
+          replacements.push([node.start, node.end, `${classCode}\n${__cjsObject()}.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`]);
         } else if (decl.type === 'VariableDeclaration') {
           // The declaration stays as written, so the module keeps a binding of
           // its own; what follows is an export that reads that binding when
@@ -446,7 +461,7 @@ function transformEsmToCjsAst(code: string): string {
             else if (pattern.type === 'RestElement') collect(pattern.argument);
           };
           for (const declarator of decl.declarations) collect(declarator.id);
-          for (const name of names) parts.push(`Object.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
+          for (const name of names) parts.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
           replacements.push([node.start, node.end, parts.join('\n')]);
         }
       } else if (node.source) {
@@ -462,9 +477,9 @@ function transformEsmToCjsAst(code: string): string {
         const tmpVar = `__reexport_${node.start}`;
         parts.push(`const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)})`);
         // The re-exported module may still be settling; wait for it as for an import.
-        parts.push(`/*__substrate_await__*/(${tmpVar} && ${tmpVar}[Symbol.for("substrate.pending")])`);
+        parts.push(`/*__substrate_await__*/(${tmpVar} && ${tmpVar}[${__cjsSymbol()}.for("substrate.pending")])`);
         for (const spec of node.specifiers) {
-          parts.push(`Object.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${tmpVar}.${spec.local.name}; } })`);
+          parts.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${tmpVar}.${spec.local.name}; } })`);
         }
         replacements.push([node.start, node.end, parts.join(';\n')]);
       } else {
@@ -472,7 +487,7 @@ function transformEsmToCjsAst(code: string): string {
         // an explicit export that replaces a star's getter of the same name.
         const parts: string[] = [];
         for (const spec of node.specifiers) {
-          parts.push(`Object.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${spec.local.name}; } })`);
+          parts.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${spec.local.name}; } })`);
         }
         replacements.push([node.start, node.end, parts.join(';\n')]);
       }
@@ -485,7 +500,7 @@ function transformEsmToCjsAst(code: string): string {
       const source = node.source.value;
       const name = node.exported.type === 'Identifier' ? node.exported.name : node.exported.value;
       const tmpVar = `__reexport_${node.start}`;
-      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[Symbol.for("substrate.pending")]); Object.defineProperty(${__cjsExports()}, ${JSON.stringify(name)}, { enumerable: true, configurable: true, get: function () { return ${tmpVar}; } })`]);
+      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[${__cjsSymbol()}.for("substrate.pending")]); ${__cjsObject()}.defineProperty(${__cjsExports()}, ${JSON.stringify(name)}, { enumerable: true, configurable: true, get: function () { return ${tmpVar}; } })`]);
     } else if (node.type === 'ExportAllDeclaration') {
       // export * from './helpers'
       const source = node.source.value;
@@ -498,7 +513,7 @@ function transformEsmToCjsAst(code: string): string {
       // module does not already export; a local export shadows a star's, as the
       // language says.
       const tmpVar = `__reexport_${node.start}`;
-      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[Symbol.for("substrate.pending")]); (function (__from, __into) { for (const __key of Object.keys(__from)) { if (__key === "default" || __key === "__esModule" || Object.prototype.hasOwnProperty.call(__into, __key)) continue; Object.defineProperty(__into, __key, { enumerable: true, configurable: true, get: function () { return __from[__key]; } }); } })(${tmpVar}, ${__cjsExports()})`]);
+      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[${__cjsSymbol()}.for("substrate.pending")]); (function (__from, __into) { for (const __key of ${__cjsObject()}.keys(__from)) { if (__key === "default" || __key === "__esModule" || ${__cjsObject()}.prototype.hasOwnProperty.call(__into, __key)) continue; ${__cjsObject()}.defineProperty(__into, __key, { enumerable: true, configurable: true, get: function () { return __from[__key]; } }); } })(${tmpVar}, ${__cjsExports()})`]);
     }
   }
 

package/src/node-lib/binding/fs.ts

@@ -168,6 +168,40 @@ function fileFor(fd: number): OpenFile {
   return file;
 }
 
+/**
+ * Where a child's output goes when its stdio names a descriptor of the
+ * parent's (`stdio: ['ignore', fd, fd]` with `fd` from `openSync`): the file
+ * that descriptor has open, as the child's own duplicate of it, so it keeps
+ * writing after the parent closes its copy. Appending descriptors append;
+ * others write on from the position the parent's copy had. A descriptor that
+ * is a stream (a socket, a pipe) is written as a stream. Anything else is
+ * not a sink, and the child's output there goes nowhere, as `ignore` does.
+ */
+export function descriptorWriter(fd: number): ((text: string) => void) | null {
+  const stream = handleForFd(fd);
+  if (stream instanceof LibuvStreamWrap) {
+    return (text) => { try { stream.writeBuffer(new WriteWrap(), new TextEncoder().encode(text)); } catch { /* a closed stream drops the child's output, as a closed pipe does */ } };
+  }
+  const file = openFiles.get(fd);
+  if (!file || file.directory || (file.flags & 3) === 0) return null;
+  const { tree, path } = file;
+  const append = (file.flags & flagBits().append) !== 0;
+  let position = file.position;
+  return (text) => {
+    const bytes = new TextEncoder().encode(text);
+    // the parent's copy, while it is open, holds the file's bytes as it last wrote them
+    const shared = openFiles.get(fd) === file ? file : null;
+    const existing = shared?.cached ?? (tree.existsSync(path) ? tree.readFileSync(path) as Uint8Array : new Uint8Array(0));
+    const at = append ? existing.length : position;
+    const next = new Uint8Array(Math.max(existing.length, at + bytes.length));
+    next.set(existing, 0);
+    next.set(bytes, at);
+    tree.writeFileSync(path, next);
+    position = at + bytes.length;
+    if (shared) shared.cached = next;
+  };
+}
+
 /** Node's stat array: eighteen numbers, with each time a second and a nanosecond. */
 function statArray(stats: VfsStats, bigint: boolean, path?: string): Float64Array | BigInt64Array {
   const mtime = stats.mtime instanceof Date ? stats.mtime.getTime() : Number(stats.mtimeMs ?? 0);

package/src/node-lib/binding/process_wrap.ts

@@ -29,6 +29,7 @@ import {
 } from './handles';
 import { __runFor, mintPid, type ProcessToken } from '../../process-tokens';
 import { handleForFd } from './fds';
+import { descriptorWriter } from './fs';
 import { TTY, type TerminalState } from './tty_wrap';
 
 /** One entry of Node's `options.stdio`, as `getValidStdio` builds it. */
@@ -178,7 +179,8 @@ function spawningDirectory(token: ProcessToken | null): string | undefined {
 
 /** Where an `inherit` entry's bytes go: the spawning program's own stream. */
 function inheritedWriter(fd: number, token: ProcessToken | null): ((text: string) => void) | null {
-  if (fd !== 1 && fd !== 2) return null;
+  // a descriptor of the parent's own (a log file it opened) is written as the file
+  if (fd !== 1 && fd !== 2) return descriptorWriter(fd);
   // Inherit the descriptor's original sink, not a guest replacement of
   // process.stderr.write (a child commonly redirects its console over IPC).
   if (token !== null) {

package/src/node-lib/binding/zlib.ts

@@ -28,6 +28,9 @@
  * which this product does not do. The row in BUILTINS.md says the same.
  */
 import { zstream, inflateModule, deflateModule, zlibConstants } from './zlib-pako';
+// @ts-expect-error `brotli` ships no types; its decoder takes and returns bytes.
+import brotliDecompressUntyped from 'brotli/decompress';
+const brotliDecompress = brotliDecompressUntyped as (input: Uint8Array) => Uint8Array;
 
 /** Node's `zlib` modes, by the numbers `zlib.js` passes. */
 const DEFLATE = 1;
@@ -236,9 +239,83 @@ function absentCodec(name: string, reason: string): new (...args: unknown[]) =>
   } as unknown as new (...args: unknown[]) => never;
 }
 
+/**
+ * `BrotliDecoder`, over the engine's own Brotli decoder (`brotli`'s, pure
+ * JavaScript). That decoder takes a whole stream, so this handle collects
+ * the input it is given and decodes when `zlib.js` sends the finishing
+ * flush, then hands the output back as the caller's buffers take it: a
+ * stream is inflated, it is not inflated incrementally. A server reading a
+ * pre-compressed file through `createBrotliDecompress` is the case it serves.
+ */
+const BROTLI_OPERATION_FINISH = 2;
+class BrotliDecoderHandle {
+  #writeState: Uint32Array | null = null;
+  #callback: ProcessCallback | null = null;
+  #input: Uint8Array[] = [];
+  #output: Uint8Array | null = null;
+  #outputAt = 0;
+  onerror: ((message: string, errno: number, code?: string) => void) | null = null;
+
+  constructor(public readonly mode: number) {}
+
+  init(_params: Uint32Array, writeState: Uint32Array, processCallback: ProcessCallback): boolean {
+    this.#writeState = writeState;
+    this.#callback = processCallback;
+    return true;
+  }
+
+  #run(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): void {
+    if (inBuf && inLen > 0) this.#input.push(inBuf.slice(inOff, inOff + inLen));
+    if (flush === BROTLI_OPERATION_FINISH && this.#output === null) {
+      const total = this.#input.reduce((sum, part) => sum + part.byteLength, 0);
+      const whole = new Uint8Array(total);
+      let at = 0;
+      for (const part of this.#input) { whole.set(part, at); at += part.byteLength; }
+      this.#input = [];
+      try {
+        this.#output = brotliDecompress(whole);
+      } catch (error) {
+        this.onerror?.(`Decompression failed: ${error instanceof Error ? error.message : String(error)}`, -1, 'ERR_BROTLI_DECOMPRESSION_FAILED');
+        return;
+      }
+      this.#outputAt = 0;
+    }
+    let written = 0;
+    if (this.#output) {
+      written = Math.min(outLen, this.#output.byteLength - this.#outputAt);
+      outBuf.set(this.#output.subarray(this.#outputAt, this.#outputAt + written), outOff);
+      this.#outputAt += written;
+    }
+    if (this.#writeState) {
+      this.#writeState[0] = outLen - written;
+      this.#writeState[1] = 0;
+    }
+  }
+
+  write(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this {
+    const tick = (globalThis as { process?: { nextTick?: (fn: () => void) => void } }).process?.nextTick
+      ?? ((fn: () => void) => { queueMicrotask(fn); });
+    tick(() => {
+      this.#run(flush, inBuf, inOff, inLen, outBuf, outOff, outLen);
+      this.#callback?.();
+    });
+    return this;
+  }
+
+  writeSync(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this {
+    this.#run(flush, inBuf, inOff, inLen, outBuf, outOff, outLen);
+    return this;
+  }
+
+  params(): void {}
+  reset(): void { this.#input = []; this.#output = null; this.#outputAt = 0; }
+  close(): void { this.reset(); this.#callback = null; }
+  getAvailableOutput(): number { return this.#output ? this.#output.byteLength - this.#outputAt : 0; }
+}
+
 const BROTLI_REASON =
-  'Brotli is a codec of its own, not zlib; the engine has a wasm build of it as a dependency ' +
-  'but no binding for Node\'s Brotli handle yet. `zlib.gzip`, `deflate` and `inflate` are Node\'s own here.';
+  'Brotli is a codec of its own, not zlib; the engine decodes it (`brotli`, pure JavaScript) but has no ' +
+  'encoder for Node\'s Brotli handle yet. `zlib.gzip`, `deflate` and `inflate` are Node\'s own here.';
 const ZSTD_REASON =
   'Zstandard is a codec of its own and this engine has no implementation of it at all. ' +
   '`zlib.gzip`, `deflate` and `inflate` are Node\'s own here.';
@@ -246,7 +323,7 @@ const ZSTD_REASON =
 export const zlibBinding = {
   Zlib,
   BrotliEncoder: absentCodec('Brotli compression', BROTLI_REASON),
-  BrotliDecoder: absentCodec('Brotli decompression', BROTLI_REASON),
+  BrotliDecoder: BrotliDecoderHandle,
   ZstdCompress: absentCodec('Zstandard compression', ZSTD_REASON),
   ZstdDecompress: absentCodec('Zstandard decompression', ZSTD_REASON),
   /** `zlib.crc32`, which is zlib's own table-driven one. */

package/src/node-lib/internals/runtime.ts

@@ -219,8 +219,9 @@ export const internalEventTarget = {
 };
 
 /**
- * `internal/options`: the command-line options Node's `net` reads. The engine
- * takes no command line of its own, so each is Node's own default.
+ * `internal/options`: the command-line options Node's `net`, `http` and
+ * `util` read. The engine takes no command line of its own, so each is
+ * Node's own default.
  */
 const optionValues: Record<string, unknown> = {
   '--network-family-autoselection': true,
@@ -231,6 +232,9 @@ const optionValues: Record<string, unknown> = {
   '--pending-deprecation': false,
   '--report-uncaught-exception': false,
   '--experimental-print-required-tla': false,
+  '--max-http-header-size': 16 * 1024,
+  '--insecure-http-parser': false,
+  '--enable-source-maps': false,
 };
 
 export const internalOptions = {

package/src/runtime.ts

@@ -66,7 +66,7 @@ import * as domainShim from './shims/domain';
 import { createWasiModule, type WasiHostFs, type WasiModule } from './shims/wasi';
 
 import { resolve as resolveExports, imports as resolveImports } from 'resolve.exports';
-import { transformEsmToCjsSimple, setNodeLowering, __cjsExports, __substrateHasEsmSyntax } from './code-transforms';
+import { transformEsmToCjsSimple, setNodeLowering, __cjsExports, __cjsObject, __substrateHasEsmSyntax } from './code-transforms';
 import { applySourceEdits } from './source-edits';
 import * as acorn from 'acorn';
 
@@ -263,7 +263,12 @@ function __substrateGuestGlobal(process: Process): Record<string, unknown> {
       if (key === "fetch") { fetch = value; return true; }
       if (key === "Buffer") { buffer = value; return true; }
       if (shadowed(target, key)) return Reflect.set(target, key, value, target);
-      return Reflect.set(host, key, value, host);
+      if (Reflect.set(host, key, value, host)) return true;
+      // A global the host holds read-only (a confined realm's \`WebSocket\`) is
+      // still the guest's to replace, as Node's globals are: undici's
+      // \`install()\` assigns \`globalThis.WebSocket\` and Pi died on the refusal.
+      // The value becomes the guest's own binding; the host's is untouched.
+      return Reflect.defineProperty(target, key, { value, writable: true, configurable: true, enumerable: true });
     },
     has(target, key) { return isLocalGlobal(key) ? Reflect.has(target, key) : key === "global" || shadowed(target, key) || key in host; },
     ownKeys(target) {
@@ -448,7 +453,7 @@ function transformEsmToCjsAst(code: string, filename: string): string {
     transformed = transformEsmToCjsSimple(transformed);
 
     if (hasExportDecl) {
-      transformed = `Object.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
+      transformed = `${__cjsObject()}.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
     }
   }
 
@@ -476,7 +481,7 @@ function transformEsmToCjsRegexFallback(code: string, filename: string): string
   if (hasImport || hasExport) {
     transformed = transformEsmToCjsSimple(transformed);
     if (hasExport) {
-      transformed = `Object.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
+      transformed = `${__cjsObject()}.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
     }
   }
 
@@ -2680,6 +2685,56 @@ forGuestRealm(() => {
   }
 });
 
+forGuestRealm(() => {
+  // Node's `stream.finished()` on a web stream waits on a promise Node's own
+  // web streams carry (`nodejs.webstream.isClosedPromise`), settled when the
+  // stream closes or errors, and undici's fetch finalizes every response that
+  // way. The worker's streams are the browser's and carry none, so a stream a
+  // guest constructs is given one, settled by its own controller. The
+  // constructor stays the browser's (a proxy of it), so a stream the platform
+  // made is still `instanceof ReadableStream`.
+  const kIsClosedPromise = Symbol.for('nodejs.webstream.isClosedPromise');
+  const Native = globalThis.ReadableStream;
+  if (typeof Native !== 'function' || (Native as unknown as { __substrateClosedPromise?: boolean }).__substrateClosedPromise) return;
+  type Source = { start?: (controller: unknown) => unknown; pull?: (controller: unknown) => unknown; cancel?: (reason: unknown) => unknown };
+  const Tracked: typeof ReadableStream = new Proxy(Native, {
+    construct(target, args, newTarget): object {
+      let resolve!: () => void;
+      let reject!: (error: unknown) => void;
+      const promise = new Promise<void>((yes, no) => { resolve = yes; reject = no; });
+      promise.then(undefined, () => {});
+      const source = args[0] as Source | null | undefined;
+      const track = (controller: { close?: (...rest: unknown[]) => unknown; error?: (...rest: unknown[]) => unknown }): void => {
+        const close = controller.close;
+        const error = controller.error;
+        if (typeof close === 'function') controller.close = function (this: unknown, ...rest: unknown[]) { const result = close.apply(this, rest); resolve(); return result; };
+        if (typeof error === 'function') controller.error = function (this: unknown, ...rest: unknown[]) { reject(rest[0]); return error.apply(this, rest); };
+      };
+      const failed = (cause: unknown): never => { reject(cause); throw cause; };
+      const wrapped: Source = Object.create(source ?? null);
+      wrapped.start = (controller) => {
+        track(controller as Parameters<typeof track>[0]);
+        try { return source?.start?.call(source, controller); } catch (cause) { return failed(cause); }
+      };
+      if (typeof source?.pull === 'function') {
+        const pull = source.pull;
+        wrapped.pull = (controller) => {
+          try { return Promise.resolve(pull.call(source, controller)).catch(failed); } catch (cause) { return failed(cause); }
+        };
+      }
+      wrapped.cancel = (reason) => {
+        resolve();
+        return source?.cancel?.call(source, reason);
+      };
+      const stream: object = Reflect.construct(target, [wrapped, ...args.slice(1)], newTarget === Tracked ? target : newTarget);
+      Object.defineProperty(stream, kIsClosedPromise, { value: { promise, resolve, reject }, configurable: true });
+      return stream;
+    },
+  });
+  Object.defineProperty(Tracked, '__substrateClosedPromise', { value: true });
+  takeFromHost(globalThis, 'ReadableStream', Tracked);
+});
+
 // Polyfill Error.captureStackTrace/prepareStackTrace for Safari/WebKit
 // (V8-specific API used by Express's depd and other npm packages)
 forGuestRealm(__substrateStackTracePolyfill);