@volter/tabnode 0.5.16 → 0.5.17

package/dist/node-lib/binding/zlib.d.ts

@@ -25,10 +25,23 @@ export declare class Zlib {
     /** Node asks a handle for these two after a `Z_STREAM_END`. */
     get ended(): boolean;
 }
+declare class BrotliDecoderHandle {
+    #private;
+    readonly mode: number;
+    onerror: ((message: string, errno: number, code?: string) => void) | null;
+    constructor(mode: number);
+    init(_params: Uint32Array, writeState: Uint32Array, processCallback: ProcessCallback): boolean;
+    write(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this;
+    writeSync(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this;
+    params(): void;
+    reset(): void;
+    close(): void;
+    getAvailableOutput(): number;
+}
 export declare const zlibBinding: {
     Zlib: typeof Zlib;
     BrotliEncoder: new (...args: unknown[]) => never;
-    BrotliDecoder: new (...args: unknown[]) => never;
+    BrotliDecoder: typeof BrotliDecoderHandle;
     ZstdCompress: new (...args: unknown[]) => never;
     ZstdDecompress: new (...args: unknown[]) => never;
     /** `zlib.crc32`, which is zlib's own table-driven one. */

package/dist/shims/perf_hooks.d.ts

@@ -1,7 +1,3 @@
-/**
- * perf_hooks shim - Performance measurement APIs
- * Wraps browser Performance API
- */
 export declare const performance: Performance;
 export declare class PerformanceObserver {
     private callback;

package/dist/shims/tls.d.ts

@@ -291,6 +291,7 @@ export declare function createTlsModule(require?: (name: string) => any): {
     };
     createSecureContext: (_options?: unknown) => {};
     getCiphers: () => string[];
+    getCACertificates: (type?: string) => string[];
     DEFAULT_ECDH_CURVE: string;
     DEFAULT_MAX_VERSION: string;
     DEFAULT_MIN_VERSION: string;
@@ -583,6 +584,7 @@ declare const tls: {
     };
     createSecureContext: (_options?: unknown) => {};
     getCiphers: () => string[];
+    getCACertificates: (type?: string) => string[];
     DEFAULT_ECDH_CURVE: string;
     DEFAULT_MAX_VERSION: string;
     DEFAULT_MIN_VERSION: string;
@@ -868,7 +870,7 @@ export declare const TLSSocket: {
     write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean;
     end(chunk?: unknown, encoding?: unknown, callback?: unknown): /*elided*/ any;
     writable: boolean;
-}, createSecureContext: (_options?: unknown) => {}, getCiphers: () => string[], DEFAULT_ECDH_CURVE: string, DEFAULT_MAX_VERSION: string, DEFAULT_MIN_VERSION: string, rootCertificates: string[];
+}, createSecureContext: (_options?: unknown) => {}, getCiphers: () => string[], getCACertificates: (type?: string) => string[], DEFAULT_ECDH_CURVE: string, DEFAULT_MAX_VERSION: string, DEFAULT_MIN_VERSION: string, rootCertificates: string[];
 export type TLSSocket = InstanceType<typeof TLSSocket>;
 export type Server = InstanceType<typeof Server>;
 export default tls;

package/dist/shims/worker_threads.d.ts

@@ -44,6 +44,8 @@ export declare function receiveMessageOnPort(port: MessagePort): {
 } | undefined;
 export declare const SHARE_ENV: unique symbol;
 export declare function markAsUntransferable(object: unknown): void;
+export declare function markAsUncloneable(object: unknown): void;
+export declare function isMarkedAsUncloneable(object: unknown): boolean;
 export declare function getEnvironmentData(key: unknown): unknown;
 export declare function setEnvironmentData(key: unknown, value: unknown): void;
 declare const _default: {
@@ -59,6 +61,8 @@ declare const _default: {
     receiveMessageOnPort: typeof receiveMessageOnPort;
     SHARE_ENV: symbol;
     markAsUntransferable: typeof markAsUntransferable;
+    markAsUncloneable: typeof markAsUncloneable;
+    isMarkedAsUncloneable: typeof isMarkedAsUncloneable;
     getEnvironmentData: typeof getEnvironmentData;
     setEnvironmentData: typeof setEnvironmentData;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/tabnode",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Node's own library, in a browser tab.",
   "type": "module",
   "license": "MIT",

package/src/code-transforms.ts

@@ -26,6 +26,14 @@ let __nodeLowering = false;
 const __cjsExports = () => __nodeLowering ? "$exports" : "exports";
 const __cjsModule = () => __nodeLowering ? "$module" : "module";
 const __cjsRequire = () => __nodeLowering ? "$require" : "require";
+// The realm's own `Object` and `Symbol`, by names a module cannot declare over.
+// Lowered code calls them before the module's own body has run -- its exports
+// are defined at the top -- and a module that imports a binding called `Object`
+// (typebox does, its object type) had the lowering's `Object.defineProperty`
+// read that import in its dead zone. The dev server's lowering of a browser
+// module keeps the plain names, which exist where that module runs.
+const __cjsObject = () => __nodeLowering ? "__browserRuntimeObject" : "Object";
+const __cjsSymbol = () => __nodeLowering ? "__browserRuntimeSymbol" : "Symbol";
 const __cjsDefault = (expression: string) => __nodeLowering ? "__browserRuntimeInteropDefault(" + expression + ")" : expression;
 // The helper lowered code calls by bare name. It is a name on the realm, so
 // it goes up when a guest first exists, not when this module is loaded.
@@ -33,8 +41,12 @@ forGuestRealm(() => {
   if ((globalThis as Record<string, unknown>).__browserRuntimeInteropDefault) return;
   takeFromHost(globalThis, '__browserRuntimeInteropDefault', (imported: any) => imported && imported.__esModule && "default" in imported ? imported.default : imported);
 });
+forGuestRealm(() => {
+  if (!(globalThis as Record<string, unknown>).__browserRuntimeObject) takeFromHost(globalThis, '__browserRuntimeObject', Object);
+  if (!(globalThis as Record<string, unknown>).__browserRuntimeSymbol) takeFromHost(globalThis, '__browserRuntimeSymbol', Symbol);
+});
 export const setNodeLowering = (value: boolean): void => { __nodeLowering = value; };
-export { __cjsExports };
+export { __cjsExports, __cjsObject };
 
 /**
  * Whether a module is ESM is a fact of its syntax, not of its text. Asking
@@ -175,7 +187,7 @@ function __substrateLiveImportBindings(code: any) {
       // or in what it imports; an importer waits for it, as a module graph
       // evaluates in order. The marker becomes `await` when the loader runs
       // this body as an async function, and reads nothing otherwise.
-      parts.push("/*__substrate_await__*/(" + namespace + " && " + namespace + "[Symbol.for(\"substrate.pending\")]);");
+      parts.push("/*__substrate_await__*/(" + namespace + " && " + namespace + "[" + __cjsSymbol() + ".for(\"substrate.pending\")]);");
     }
     for (const imported of declaration.specifiers) {
       const read = imported.type === "ImportDefaultSpecifier" ? __cjsDefault(namespace)
@@ -210,7 +222,10 @@ function __substrateLiveImportBindings(code: any) {
     if (typeof node.type !== "string") return;
     switch (node.type) {
       case "ImportDeclaration": case "ImportSpecifier": case "ImportDefaultSpecifier":
-      case "ImportNamespaceSpecifier": case "ExportSpecifier": case "MetaProperty":
+      // `export * as X from "…"` holds a name and a source, no reference: an
+      // imported binding also called X was rewritten into the exported name,
+      // and typebox's `export * as Guard` became `__substrateImport1`.
+      case "ImportNamespaceSpecifier": case "ExportSpecifier": case "ExportAllDeclaration": case "MetaProperty":
       case "BreakStatement": case "ContinueStatement": case "PrivateIdentifier":
         return;
       case "Identifier":
@@ -368,7 +383,7 @@ function transformEsmToCjsAst(code: string): string {
         // for any import (the marker becomes `await` in an async body).
         sideEffectImports += 1;
         const namespace = `__substrateImportSide${sideEffectImports}`;
-        replacements.push([node.start, node.end, `const ${namespace} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${namespace} && ${namespace}[Symbol.for("substrate.pending")]);`]);
+        replacements.push([node.start, node.end, `const ${namespace} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${namespace} && ${namespace}[${__cjsSymbol()}.for("substrate.pending")]);`]);
       } else {
         const defaultSpec = specs.find((s: any) => s.type === 'ImportDefaultSpecifier');
         const nsSpec = specs.find((s: any) => s.type === 'ImportNamespaceSpecifier');
@@ -404,7 +419,7 @@ function transformEsmToCjsAst(code: string): string {
       // `module.exports = X`, which threw away every named export defined
       // before it (readdirp exports `readdirp` by name and as the default;
       // chokidar imports the name and found the module was the function).
-      const defineDefault = (value: string): string => `Object.defineProperty(${__cjsExports()}, "default", { enumerable: true, configurable: true, get: function () { return ${value}; } });`;
+      const defineDefault = (value: string): string => `${__cjsObject()}.defineProperty(${__cjsExports()}, "default", { enumerable: true, configurable: true, get: function () { return ${value}; } });`;
       if (decl.type === 'FunctionDeclaration') {
         const funcCode = code.slice(decl.start, node.end);
         replacements.push([node.start, node.end, decl.id ? `${funcCode}\n${defineDefault(decl.id.name)}` : `${defineDefault(`(${funcCode})`)}`]);
@@ -423,11 +438,11 @@ function transformEsmToCjsAst(code: string): string {
           const name = decl.id.name;
           const funcCode = code.slice(decl.start, node.end);
           replacements.push([node.start, node.end, funcCode]);
-          hoisted.push(`Object.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
+          hoisted.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
         } else if (decl.type === 'ClassDeclaration') {
           const name = decl.id.name;
           const classCode = code.slice(decl.start, node.end);
-          replacements.push([node.start, node.end, `${classCode}\nObject.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`]);
+          replacements.push([node.start, node.end, `${classCode}\n${__cjsObject()}.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`]);
         } else if (decl.type === 'VariableDeclaration') {
           // The declaration stays as written, so the module keeps a binding of
           // its own; what follows is an export that reads that binding when
@@ -446,7 +461,7 @@ function transformEsmToCjsAst(code: string): string {
             else if (pattern.type === 'RestElement') collect(pattern.argument);
           };
           for (const declarator of decl.declarations) collect(declarator.id);
-          for (const name of names) parts.push(`Object.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
+          for (const name of names) parts.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${name}", { enumerable: true, get: function () { return ${name}; } });`);
           replacements.push([node.start, node.end, parts.join('\n')]);
         }
       } else if (node.source) {
@@ -462,9 +477,9 @@ function transformEsmToCjsAst(code: string): string {
         const tmpVar = `__reexport_${node.start}`;
         parts.push(`const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)})`);
         // The re-exported module may still be settling; wait for it as for an import.
-        parts.push(`/*__substrate_await__*/(${tmpVar} && ${tmpVar}[Symbol.for("substrate.pending")])`);
+        parts.push(`/*__substrate_await__*/(${tmpVar} && ${tmpVar}[${__cjsSymbol()}.for("substrate.pending")])`);
         for (const spec of node.specifiers) {
-          parts.push(`Object.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${tmpVar}.${spec.local.name}; } })`);
+          parts.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${tmpVar}.${spec.local.name}; } })`);
         }
         replacements.push([node.start, node.end, parts.join(';\n')]);
       } else {
@@ -472,7 +487,7 @@ function transformEsmToCjsAst(code: string): string {
         // an explicit export that replaces a star's getter of the same name.
         const parts: string[] = [];
         for (const spec of node.specifiers) {
-          parts.push(`Object.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${spec.local.name}; } })`);
+          parts.push(`${__cjsObject()}.defineProperty(${__cjsExports()}, "${spec.exported.name}", { enumerable: true, configurable: true, get: function () { return ${spec.local.name}; } })`);
         }
         replacements.push([node.start, node.end, parts.join(';\n')]);
       }
@@ -485,7 +500,7 @@ function transformEsmToCjsAst(code: string): string {
       const source = node.source.value;
       const name = node.exported.type === 'Identifier' ? node.exported.name : node.exported.value;
       const tmpVar = `__reexport_${node.start}`;
-      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[Symbol.for("substrate.pending")]); Object.defineProperty(${__cjsExports()}, ${JSON.stringify(name)}, { enumerable: true, configurable: true, get: function () { return ${tmpVar}; } })`]);
+      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[${__cjsSymbol()}.for("substrate.pending")]); ${__cjsObject()}.defineProperty(${__cjsExports()}, ${JSON.stringify(name)}, { enumerable: true, configurable: true, get: function () { return ${tmpVar}; } })`]);
     } else if (node.type === 'ExportAllDeclaration') {
       // export * from './helpers'
       const source = node.source.value;
@@ -498,7 +513,7 @@ function transformEsmToCjsAst(code: string): string {
       // module does not already export; a local export shadows a star's, as the
       // language says.
       const tmpVar = `__reexport_${node.start}`;
-      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[Symbol.for("substrate.pending")]); (function (__from, __into) { for (const __key of Object.keys(__from)) { if (__key === "default" || __key === "__esModule" || Object.prototype.hasOwnProperty.call(__into, __key)) continue; Object.defineProperty(__into, __key, { enumerable: true, configurable: true, get: function () { return __from[__key]; } }); } })(${tmpVar}, ${__cjsExports()})`]);
+      replacements.push([node.start, node.end, `const ${tmpVar} = ${__cjsRequire()}(${JSON.stringify(source)}); /*__substrate_await__*/(${tmpVar} && ${tmpVar}[${__cjsSymbol()}.for("substrate.pending")]); (function (__from, __into) { for (const __key of ${__cjsObject()}.keys(__from)) { if (__key === "default" || __key === "__esModule" || ${__cjsObject()}.prototype.hasOwnProperty.call(__into, __key)) continue; ${__cjsObject()}.defineProperty(__into, __key, { enumerable: true, configurable: true, get: function () { return __from[__key]; } }); } })(${tmpVar}, ${__cjsExports()})`]);
     }
   }
 

package/src/node-lib/binding/zlib.ts

@@ -28,6 +28,9 @@
  * which this product does not do. The row in BUILTINS.md says the same.
  */
 import { zstream, inflateModule, deflateModule, zlibConstants } from './zlib-pako';
+// @ts-expect-error `brotli` ships no types; its decoder takes and returns bytes.
+import brotliDecompressUntyped from 'brotli/decompress';
+const brotliDecompress = brotliDecompressUntyped as (input: Uint8Array) => Uint8Array;
 
 /** Node's `zlib` modes, by the numbers `zlib.js` passes. */
 const DEFLATE = 1;
@@ -236,9 +239,83 @@ function absentCodec(name: string, reason: string): new (...args: unknown[]) =>
   } as unknown as new (...args: unknown[]) => never;
 }
 
+/**
+ * `BrotliDecoder`, over the engine's own Brotli decoder (`brotli`'s, pure
+ * JavaScript). That decoder takes a whole stream, so this handle collects
+ * the input it is given and decodes when `zlib.js` sends the finishing
+ * flush, then hands the output back as the caller's buffers take it: a
+ * stream is inflated, it is not inflated incrementally. A server reading a
+ * pre-compressed file through `createBrotliDecompress` is the case it serves.
+ */
+const BROTLI_OPERATION_FINISH = 2;
+class BrotliDecoderHandle {
+  #writeState: Uint32Array | null = null;
+  #callback: ProcessCallback | null = null;
+  #input: Uint8Array[] = [];
+  #output: Uint8Array | null = null;
+  #outputAt = 0;
+  onerror: ((message: string, errno: number, code?: string) => void) | null = null;
+
+  constructor(public readonly mode: number) {}
+
+  init(_params: Uint32Array, writeState: Uint32Array, processCallback: ProcessCallback): boolean {
+    this.#writeState = writeState;
+    this.#callback = processCallback;
+    return true;
+  }
+
+  #run(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): void {
+    if (inBuf && inLen > 0) this.#input.push(inBuf.slice(inOff, inOff + inLen));
+    if (flush === BROTLI_OPERATION_FINISH && this.#output === null) {
+      const total = this.#input.reduce((sum, part) => sum + part.byteLength, 0);
+      const whole = new Uint8Array(total);
+      let at = 0;
+      for (const part of this.#input) { whole.set(part, at); at += part.byteLength; }
+      this.#input = [];
+      try {
+        this.#output = brotliDecompress(whole);
+      } catch (error) {
+        this.onerror?.(`Decompression failed: ${error instanceof Error ? error.message : String(error)}`, -1, 'ERR_BROTLI_DECOMPRESSION_FAILED');
+        return;
+      }
+      this.#outputAt = 0;
+    }
+    let written = 0;
+    if (this.#output) {
+      written = Math.min(outLen, this.#output.byteLength - this.#outputAt);
+      outBuf.set(this.#output.subarray(this.#outputAt, this.#outputAt + written), outOff);
+      this.#outputAt += written;
+    }
+    if (this.#writeState) {
+      this.#writeState[0] = outLen - written;
+      this.#writeState[1] = 0;
+    }
+  }
+
+  write(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this {
+    const tick = (globalThis as { process?: { nextTick?: (fn: () => void) => void } }).process?.nextTick
+      ?? ((fn: () => void) => { queueMicrotask(fn); });
+    tick(() => {
+      this.#run(flush, inBuf, inOff, inLen, outBuf, outOff, outLen);
+      this.#callback?.();
+    });
+    return this;
+  }
+
+  writeSync(flush: number, inBuf: Uint8Array | null, inOff: number, inLen: number, outBuf: Uint8Array, outOff: number, outLen: number): this {
+    this.#run(flush, inBuf, inOff, inLen, outBuf, outOff, outLen);
+    return this;
+  }
+
+  params(): void {}
+  reset(): void { this.#input = []; this.#output = null; this.#outputAt = 0; }
+  close(): void { this.reset(); this.#callback = null; }
+  getAvailableOutput(): number { return this.#output ? this.#output.byteLength - this.#outputAt : 0; }
+}
+
 const BROTLI_REASON =
-  'Brotli is a codec of its own, not zlib; the engine has a wasm build of it as a dependency ' +
-  'but no binding for Node\'s Brotli handle yet. `zlib.gzip`, `deflate` and `inflate` are Node\'s own here.';
+  'Brotli is a codec of its own, not zlib; the engine decodes it (`brotli`, pure JavaScript) but has no ' +
+  'encoder for Node\'s Brotli handle yet. `zlib.gzip`, `deflate` and `inflate` are Node\'s own here.';
 const ZSTD_REASON =
   'Zstandard is a codec of its own and this engine has no implementation of it at all. ' +
   '`zlib.gzip`, `deflate` and `inflate` are Node\'s own here.';
@@ -246,7 +323,7 @@ const ZSTD_REASON =
 export const zlibBinding = {
   Zlib,
   BrotliEncoder: absentCodec('Brotli compression', BROTLI_REASON),
-  BrotliDecoder: absentCodec('Brotli decompression', BROTLI_REASON),
+  BrotliDecoder: BrotliDecoderHandle,
   ZstdCompress: absentCodec('Zstandard compression', ZSTD_REASON),
   ZstdDecompress: absentCodec('Zstandard decompression', ZSTD_REASON),
   /** `zlib.crc32`, which is zlib's own table-driven one. */

package/src/node-lib/internals/runtime.ts

@@ -219,8 +219,9 @@ export const internalEventTarget = {
 };
 
 /**
- * `internal/options`: the command-line options Node's `net` reads. The engine
- * takes no command line of its own, so each is Node's own default.
+ * `internal/options`: the command-line options Node's `net`, `http` and
+ * `util` read. The engine takes no command line of its own, so each is
+ * Node's own default.
  */
 const optionValues: Record<string, unknown> = {
   '--network-family-autoselection': true,
@@ -231,6 +232,9 @@ const optionValues: Record<string, unknown> = {
   '--pending-deprecation': false,
   '--report-uncaught-exception': false,
   '--experimental-print-required-tla': false,
+  '--max-http-header-size': 16 * 1024,
+  '--insecure-http-parser': false,
+  '--enable-source-maps': false,
 };
 
 export const internalOptions = {

package/src/runtime.ts

@@ -66,7 +66,7 @@ import * as domainShim from './shims/domain';
 import { createWasiModule, type WasiHostFs, type WasiModule } from './shims/wasi';
 
 import { resolve as resolveExports, imports as resolveImports } from 'resolve.exports';
-import { transformEsmToCjsSimple, setNodeLowering, __cjsExports, __substrateHasEsmSyntax } from './code-transforms';
+import { transformEsmToCjsSimple, setNodeLowering, __cjsExports, __cjsObject, __substrateHasEsmSyntax } from './code-transforms';
 import { applySourceEdits } from './source-edits';
 import * as acorn from 'acorn';
 
@@ -263,7 +263,12 @@ function __substrateGuestGlobal(process: Process): Record<string, unknown> {
       if (key === "fetch") { fetch = value; return true; }
       if (key === "Buffer") { buffer = value; return true; }
       if (shadowed(target, key)) return Reflect.set(target, key, value, target);
-      return Reflect.set(host, key, value, host);
+      if (Reflect.set(host, key, value, host)) return true;
+      // A global the host holds read-only (a confined realm's \`WebSocket\`) is
+      // still the guest's to replace, as Node's globals are: undici's
+      // \`install()\` assigns \`globalThis.WebSocket\` and Pi died on the refusal.
+      // The value becomes the guest's own binding; the host's is untouched.
+      return Reflect.defineProperty(target, key, { value, writable: true, configurable: true, enumerable: true });
     },
     has(target, key) { return isLocalGlobal(key) ? Reflect.has(target, key) : key === "global" || shadowed(target, key) || key in host; },
     ownKeys(target) {
@@ -448,7 +453,7 @@ function transformEsmToCjsAst(code: string, filename: string): string {
     transformed = transformEsmToCjsSimple(transformed);
 
     if (hasExportDecl) {
-      transformed = `Object.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
+      transformed = `${__cjsObject()}.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
     }
   }
 
@@ -476,7 +481,7 @@ function transformEsmToCjsRegexFallback(code: string, filename: string): string
   if (hasImport || hasExport) {
     transformed = transformEsmToCjsSimple(transformed);
     if (hasExport) {
-      transformed = `Object.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
+      transformed = `${__cjsObject()}.defineProperty(${__cjsExports()}, "__esModule", { value: true });\n` + transformed;
     }
   }
 
@@ -2680,6 +2685,56 @@ forGuestRealm(() => {
   }
 });
 
+forGuestRealm(() => {
+  // Node's `stream.finished()` on a web stream waits on a promise Node's own
+  // web streams carry (`nodejs.webstream.isClosedPromise`), settled when the
+  // stream closes or errors, and undici's fetch finalizes every response that
+  // way. The worker's streams are the browser's and carry none, so a stream a
+  // guest constructs is given one, settled by its own controller. The
+  // constructor stays the browser's (a proxy of it), so a stream the platform
+  // made is still `instanceof ReadableStream`.
+  const kIsClosedPromise = Symbol.for('nodejs.webstream.isClosedPromise');
+  const Native = globalThis.ReadableStream;
+  if (typeof Native !== 'function' || (Native as unknown as { __substrateClosedPromise?: boolean }).__substrateClosedPromise) return;
+  type Source = { start?: (controller: unknown) => unknown; pull?: (controller: unknown) => unknown; cancel?: (reason: unknown) => unknown };
+  const Tracked: typeof ReadableStream = new Proxy(Native, {
+    construct(target, args, newTarget): object {
+      let resolve!: () => void;
+      let reject!: (error: unknown) => void;
+      const promise = new Promise<void>((yes, no) => { resolve = yes; reject = no; });
+      promise.then(undefined, () => {});
+      const source = args[0] as Source | null | undefined;
+      const track = (controller: { close?: (...rest: unknown[]) => unknown; error?: (...rest: unknown[]) => unknown }): void => {
+        const close = controller.close;
+        const error = controller.error;
+        if (typeof close === 'function') controller.close = function (this: unknown, ...rest: unknown[]) { const result = close.apply(this, rest); resolve(); return result; };
+        if (typeof error === 'function') controller.error = function (this: unknown, ...rest: unknown[]) { reject(rest[0]); return error.apply(this, rest); };
+      };
+      const failed = (cause: unknown): never => { reject(cause); throw cause; };
+      const wrapped: Source = Object.create(source ?? null);
+      wrapped.start = (controller) => {
+        track(controller as Parameters<typeof track>[0]);
+        try { return source?.start?.call(source, controller); } catch (cause) { return failed(cause); }
+      };
+      if (typeof source?.pull === 'function') {
+        const pull = source.pull;
+        wrapped.pull = (controller) => {
+          try { return Promise.resolve(pull.call(source, controller)).catch(failed); } catch (cause) { return failed(cause); }
+        };
+      }
+      wrapped.cancel = (reason) => {
+        resolve();
+        return source?.cancel?.call(source, reason);
+      };
+      const stream: object = Reflect.construct(target, [wrapped, ...args.slice(1)], newTarget === Tracked ? target : newTarget);
+      Object.defineProperty(stream, kIsClosedPromise, { value: { promise, resolve, reject }, configurable: true });
+      return stream;
+    },
+  });
+  Object.defineProperty(Tracked, '__substrateClosedPromise', { value: true });
+  takeFromHost(globalThis, 'ReadableStream', Tracked);
+});
+
 // Polyfill Error.captureStackTrace/prepareStackTrace for Safari/WebKit
 // (V8-specific API used by Express's depd and other npm packages)
 forGuestRealm(__substrateStackTracePolyfill);

package/src/shims/child_process.ts

@@ -936,8 +936,10 @@ export function initChildProcess(vfs: VirtualFS): void {
         // engine's own registries. A run that still holds a handle or a timer
         // is not that -- Node's loop runs while one is open, for as long as it
         // is open -- and cutting it at a minute ended a forked child that was
-        // a server, which is every extension host and every pty host.
-        if (!isLongRunning && !stillWorking() && Date.now() - startTime >= MAX_TOTAL_MS) break;
+        // a server, which is every extension host and every pty host. Work the
+        // host holds for it (a build, a pre-bundle) is seen work too: a dev
+        // server whose start passed a minute mid pre-bundle was cut with exit 0.
+        if (!isLongRunning && !stillWorking() && heldWork().count === 0 && Date.now() - startTime >= MAX_TOTAL_MS) break;
       }
 
       return { stdout, stderr, exitCode: exitCalled ? exitCode : (typeof proc !== 'undefined' && typeof proc.exitCode === 'number' ? proc.exitCode : 0) };
@@ -1755,6 +1757,15 @@ function startChildRun(request: RunRequest): StartedRun {
   const admittedNode = nodeProcessHostInstalled() && engineProgramFor(request.file, request.cwd) === 'node';
   const hostTerminal = request.terminal !== undefined && hostExecutor() !== null && !admittedNode;
   let wakeInput: (() => void) | undefined;
+  /**
+   * A piped fd 0 that stays open for a program the host runs (a program pack,
+   * not a builtin of the engine's shell): what the parent writes reaches it
+   * as it is written, through the same live stream a terminal gets. A
+   * builtin reads its input once, before it runs; a server that speaks
+   * JSON-RPC over stdio (`supercode harness serve`) read that one string,
+   * saw EOF and exited before its client's first request.
+   */
+  let liveInput = false;
   const hostInput: AsyncIterable<Uint8Array> = {
     async *[Symbol.asyncIterator]() {
       while (!finished && !controller.signal.aborted) {
@@ -1854,6 +1865,12 @@ function startChildRun(request: RunRequest): StartedRun {
   const begin = (): void => {
     if (started || finished) return;
     started = true;
+    const engineFirst = !hostTerminal && programExists(request.file, request.cwd, request.env);
+    liveInput = !hostTerminal && !admittedNode && request.stdinIsPipe && !engineFirst;
+    if (liveInput) {
+      pendingStdin.unshift(...initialStdin);
+      initialStdin.length = 0;
+    }
     const stdin = initialStdin.length > 0 ? Buffer.concat(initialStdin).toString('utf8') : undefined;
     void (async () => {
       let outcome: CommandOutcome;
@@ -1867,11 +1884,11 @@ function startChildRun(request: RunRequest): StartedRun {
           filesystem: currentVfs!, env, streams, ...(stdin !== undefined ? { stdin } : {}),
         }) : await enterRun(token, () => routeCommand({
           command: __substrateLineFor(request.file, request.args, request.cwd),
-          engineFirst: !hostTerminal && programExists(request.file, request.cwd, request.env),
+          engineFirst,
           cwd: request.cwd,
           env: { ...request.env, [PROCESS_TOKEN_ENV]: token },
           stdin,
-          ...(hostTerminal ? { stdinStream: hostInput, terminal: request.terminal } : {}),
+          ...(hostTerminal ? { stdinStream: hostInput, terminal: request.terminal } : liveInput ? { stdinStream: hostInput } : {}),
           signal: controller.signal,
           onStdout: streams.onStdout,
           onStderr: streams.onStderr,
@@ -1912,18 +1929,20 @@ function startChildRun(request: RunRequest): StartedRun {
       return 0;
     },
     writeStdin(bytes: Uint8Array): void | Promise<void> {
-      if (hostTerminal) { pendingStdin.push(bytes); wakeInput?.(); wakeInput = undefined; return; }
+      if (hostTerminal || liveInput) { pendingStdin.push(bytes); wakeInput?.(); wakeInput = undefined; return; }
       if (!started) { initialStdin.push(bytes); return; }
       pendingStdin.push(bytes);
       return flushStdin();
     },
     endStdin(): void {
-      if (hostTerminal) { pendingStdin.push(null); wakeInput?.(); wakeInput = undefined; return; }
+      if (hostTerminal || liveInput) { pendingStdin.push(null); wakeInput?.(); wakeInput = undefined; return; }
       if (!started) {
         // The writer closed before the command began: the run's fd 0 is the
         // string already collected and nothing more, so it is not held open.
         streams.stdinOpen = false;
         begin();
+        // A live pipe closed before it began still ends where it was closed.
+        if (liveInput) { pendingStdin.push(null); wakeInput?.(); wakeInput = undefined; }
         return;
       }
       pendingStdin.push(null);
@@ -1951,3 +1970,4 @@ export default {
   runCommand,
   sendStdin,
 };
+

package/src/shims/esbuild.ts

@@ -398,6 +398,16 @@ export interface EsbuildHost {
 }
 let currentHost: EsbuildHost | null = null;
 
+/**
+ * esbuild-wasm starts its compiler on a Worker unless told not to. A realm
+ * that runs guests may withhold `Worker` (the execution worker confines its
+ * guests that way), and there the compiler runs on the calling thread, which
+ * is esbuild's own `worker: false`.
+ */
+function realmCanStartWorker(): boolean {
+  return typeof (globalThis as { Worker?: unknown }).Worker === 'function';
+}
+
 let inlineEsbuild: Promise<typeof import('esbuild-wasm')> | null = null;
 function ownEsbuild(): Promise<typeof import('esbuild-wasm')> {
   // A build that brings plugins of its own, a bundler such as tsup does,
@@ -408,7 +418,7 @@ function ownEsbuild(): Promise<typeof import('esbuild-wasm')> {
     /* @vite-ignore */
     esbuildModuleURL
   ).then(async (esbuild) => {
-    await esbuild.initialize({ wasmURL });
+    await esbuild.initialize({ wasmURL, worker: realmCanStartWorker() });
     return esbuild;
   }).catch((cause) => {
     // A load that failed, a page whose server was away for a moment, is not kept: the next build tries again.
@@ -527,6 +537,7 @@ export async function initialize(options?: { wasmURL?: string }): Promise<void>
 
       await esbuild.initialize({
         wasmURL: options?.wasmURL || wasmURL,
+        worker: realmCanStartWorker(),
       });
 
       esbuildInstance = esbuild;

package/src/shims/perf_hooks.ts

@@ -2,6 +2,7 @@
  * perf_hooks shim - Performance measurement APIs
  * Wraps browser Performance API
  */
+import { forGuestRealm } from '../host-globals';
 
 export const performance = globalThis.performance || {
   now: () => Date.now(),
@@ -16,6 +17,23 @@ export const performance = globalThis.performance || {
   clearResourceTimings: () => {},
 };
 
+/**
+ * Node's `performance.markResourceTiming`, which a browser's `performance`
+ * does not have. undici's fetch reads it off the global `performance` at load
+ * and calls it after every response, so each fetch through an undici a
+ * program installed (Pi's does) threw once the body was read. Node records a
+ * PerformanceResourceTiming entry there; this engine keeps no resource
+ * timeline for a guest's own HTTP, so the call records nothing.
+ */
+forGuestRealm(() => {
+  const own = globalThis.performance as (Performance & { markResourceTiming?: unknown }) | undefined;
+  if (own && typeof own.markResourceTiming !== 'function') {
+    try {
+      Object.defineProperty(own, 'markResourceTiming', { value: () => undefined, writable: true, configurable: true, enumerable: false });
+    } catch { /* a performance object that refuses the name keeps its own shape */ }
+  }
+});
+
 export class PerformanceObserver {
   private callback: (list: PerformanceObserverEntryList) => void;
   private entryTypes: string[] = [];

package/src/shims/string_decoder.ts

@@ -308,6 +308,7 @@ function base64End(this: StringDecoder, buf?: unknown): string {
 // ---------------------------------------------------------------------------
 
 function simpleWrite(this: StringDecoder, buf: unknown): string {
+  if (typeof buf === 'string') return buf;
   return decoderInput(this, buf).toString(this.encoding as BufferEncoding);
 }
 
@@ -353,6 +354,10 @@ const decoderPrototype = StringDecoderImpl.prototype as unknown as StringDecoder
 
 decoderPrototype.write = function write(this: unknown, buffer: unknown): string {
   const self = assertDecoder(this);
+  // Node returns a string as it is given: readline decodes every chunk of its
+  // input, and an input stream with an encoding (`createReadStream(path,
+  // 'utf8')`) hands it strings.
+  if (typeof buffer === 'string') return buffer;
   const buf = decoderInput(self, buffer);
   if (buf.length === 0) return '';
   let r: string | undefined;

package/src/shims/tls.ts

@@ -102,6 +102,17 @@ const DEFAULT_MIN_VERSION = 'TLSv1.2';
 
 const rootCertificates: string[] = [];
 
+// Node's certificate-store door, read by callers that build their own agents
+// (VS Code's proxy agent, on every fetch it patches). The engine holds no
+// store: certificates are the browser's, so every kind answers the same empty
+// set `rootCertificates` does.
+const getCACertificates = (type: string = 'default'): string[] => {
+  if (!['default', 'system', 'bundled', 'extra'].includes(type)) {
+    throw Object.assign(new TypeError(`The argument 'type' must be one of: 'default', 'system', 'bundled', 'extra'. Received '${String(type)}'`), { code: 'ERR_INVALID_ARG_VALUE' });
+  }
+  return [];
+};
+
 return {
   TLSSocket,
   Server,
@@ -109,6 +120,7 @@ return {
   connect,
   createSecureContext,
   getCiphers,
+  getCACertificates,
   DEFAULT_ECDH_CURVE,
   DEFAULT_MAX_VERSION,
   DEFAULT_MIN_VERSION,
@@ -117,7 +129,7 @@ return {
 
 }
 const tls = createTlsModule();
-export const { TLSSocket, Server, createServer, connect, createSecureContext, getCiphers,
+export const { TLSSocket, Server, createServer, connect, createSecureContext, getCiphers, getCACertificates,
   DEFAULT_ECDH_CURVE, DEFAULT_MAX_VERSION, DEFAULT_MIN_VERSION, rootCertificates } = tls;
 export type TLSSocket = InstanceType<typeof TLSSocket>;
 export type Server = InstanceType<typeof Server>;