sandboxedjs 0.1.80 → 0.1.83

package/dist/index.js

@@ -17,6 +17,7 @@ import timersModule from 'timers-browserify';
 import legacyUrl from 'url/url.js';
 import { sha1 as sha1$1, md5 } from '@noble/hashes/legacy';
 import { hmac } from '@noble/hashes/hmac';
+import { pbkdf2 } from '@noble/hashes/pbkdf2';
 
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -20220,7 +20221,7 @@ var wheels_default = {
 
 // package.json
 var package_default = {
-  version: "0.1.80"};
+  version: "0.1.83"};
 
 // src/python/config.ts
 function runtimeModuleUrl() {
@@ -25198,7 +25199,21 @@ function makeNpmAlias(name, path) {
         exec: ["exec", ...rest],
         list: ["ls", ...rest],
         why: ["ls", ...rest],
-        dlx: ["exec", ...rest]
+        dlx: ["exec", ...rest],
+        /* Verbs of the package manager itself, never script names. Tools ask
+         * them in passing — Next resolves its download registry with
+         * `yarn config get registry` whenever yarn is on PATH — and running
+         * them as scripts failed with "could not read package.json". */
+        config: ["config", ...rest],
+        cache: ["cache", ...rest],
+        root: ["root", ...rest],
+        prefix: ["prefix", ...rest],
+        ping: ["ping", ...rest],
+        whoami: ["whoami", ...rest],
+        init: ["init", ...rest],
+        create: ["create", ...rest],
+        uninstall: ["uninstall", ...rest],
+        rm: ["uninstall", ...rest]
       };
       if (subcommand === void 0) return npm.run({ ...ctx, args: ["install"], argv: [name, "install"] });
       if (subcommand === "-v" || subcommand === "--version") {
@@ -25810,6 +25825,49 @@ var CommonJsEngine = class {
     this.globals = { ...options.globals };
     this.aliases = { ...options.aliases };
     this.overrides = { ...options.overrides };
+    const engine = this;
+    this.moduleApi = function Module(id = "", parent = null) {
+      Object.assign(this, { id, filename: id, exports: {}, loaded: false, parent, children: [] });
+    };
+    Object.assign(this.moduleApi, this.builtins.module);
+    this.moduleApi.Module = this.moduleApi;
+    this.moduleApi._extensions = {
+      ".js": (module, filename) => this.evaluate(module, this.readText(filename)),
+      ".json": (module, filename) => {
+        module.exports = JSON.parse(this.readText(filename));
+      },
+      ".node": (_module, filename) => {
+        throw dlopenFailed(filename);
+      }
+    };
+    this.moduleApi._cache = new Proxy(/* @__PURE__ */ Object.create(null), {
+      get: (_target, key) => typeof key === "string" ? this.cache.get(key) : void 0,
+      set: (_target, key, value) => {
+        this.cache.set(String(key), value);
+        return true;
+      },
+      deleteProperty: (_target, key) => this.cache.delete(String(key)),
+      ownKeys: () => [...this.cache.keys()],
+      getOwnPropertyDescriptor: (_target, key) => this.cache.has(String(key)) ? { enumerable: true, configurable: true, writable: true, value: this.cache.get(String(key)) } : void 0
+    });
+    this.moduleApi._resolveFilename = (request, parent) => this.resolve(request, parent?.filename || join(this.cwd, "__entry__.js"));
+    this.moduleApi.prototype.require = function(request) {
+      const filename = engine.moduleApi._resolveFilename(request, this);
+      const builtin = engine.builtin(filename, this);
+      if (builtin.found) return builtin.value;
+      const target = engine.load(filename, this, false);
+      if (target.pending) throw requireOfAsyncModule(request);
+      return target.exports;
+    };
+    this.moduleApi.prototype._compile = function(source, filename) {
+      this.filename = filename;
+      engine.evaluate(this, source);
+    };
+    this.moduleApi.createRequire = (filename) => {
+      const path = String(filename).startsWith("file:") ? pathFromFileUrl(String(filename)) : String(filename);
+      if (!path.startsWith("/")) throw new TypeError("createRequire requires an absolute path or file URL");
+      return this.makeRequire(Object.assign(new this.moduleApi(path), { filename: path }));
+    };
   }
   volume;
   cache = /* @__PURE__ */ new Map();
@@ -25822,6 +25880,7 @@ var CommonJsEngine = class {
   /** `package.json` per directory; resolution reads them constantly. */
   manifests = /* @__PURE__ */ new Map();
   evaluationDepth = 0;
+  moduleApi;
   /**
    * Is a module body running synchronously right now?
    *
@@ -25858,7 +25917,7 @@ var CommonJsEngine = class {
       specifier = pathFromFileUrl(specifier);
     }
     const builtin = this.builtin(specifier);
-    if (builtin.found) return specifier.replace(/^node:/, "");
+    if (builtin.found) return specifier;
     if (specifier.startsWith("#")) {
       const found = this.resolveImports(specifier, importer, kind);
       if (found) return found;
@@ -25891,17 +25950,14 @@ var CommonJsEngine = class {
       parent,
       children: []
     };
+    Object.setPrototypeOf(module, this.moduleApi.prototype);
     this.cache.set(filename, module);
     parent?.children.push(module);
     if (isMain) this.main = module;
     try {
-      if (filename.endsWith(".node")) {
-        throw dlopenFailed(filename);
-      } else if (filename.endsWith(".json")) {
-        module.exports = JSON.parse(this.readText(filename));
-      } else {
-        this.evaluate(module, this.readText(filename));
-      }
+      const extension = extname(filename);
+      const loader = this.moduleApi._extensions[extension] ?? this.moduleApi._extensions[".js"];
+      loader(module, filename);
       module.loaded = true;
       return module;
     } catch (error) {
@@ -25954,15 +26010,12 @@ ${code}
   /** The `require` a module sees, complete with `resolve`, `cache` and `main`. */
   makeRequire(module) {
     const localRequire = ((specifier) => {
-      const builtin = this.builtin(specifier, module);
-      if (builtin.found) return builtin.value;
-      const target = this.load(this.resolve(specifier, module.filename, "require"), module, false);
-      if (target.pending) throw requireOfAsyncModule(specifier);
-      return target.exports;
+      return this.moduleApi.prototype.require.call(module, specifier);
     });
-    localRequire.resolve = (specifier) => this.resolve(specifier, module.filename, "require");
+    localRequire.resolve = (specifier) => this.moduleApi._resolveFilename(specifier, module);
     Object.defineProperty(localRequire, "main", { get: () => this.main });
-    localRequire.cache = Object.fromEntries(this.cache);
+    localRequire.cache = this.moduleApi._cache;
+    localRequire.extensions = this.moduleApi._extensions;
     return localRequire;
   }
   /**
@@ -26137,12 +26190,7 @@ ${code}
     if (prefixOnly || !Object.prototype.hasOwnProperty.call(this.builtins, name)) {
       return Object.prototype.hasOwnProperty.call(this.overrides, specifier) ? { found: true, value: this.overrides[specifier] } : { found: false, value: void 0 };
     }
-    if (name === "module" && importer) {
-      return {
-        found: true,
-        value: { ...this.builtins.module, createRequire: () => this.makeRequire(importer) }
-      };
-    }
+    if (name === "module") return { found: true, value: this.moduleApi };
     return { found: true, value: this.builtins[name] };
   }
   exists(path) {
@@ -26250,6 +26298,108 @@ function splitSpecifier(specifier) {
   return { name: parts.slice(0, size).join("/"), subpath: parts.slice(size).join("/") };
 }
 
+// src/node/diagnostics-channel.ts
+function createDiagnosticsChannel() {
+  const channels2 = /* @__PURE__ */ new Map();
+  class Channel {
+    constructor(name) {
+      this.name = name;
+    }
+    name;
+    listeners = /* @__PURE__ */ new Set();
+    get hasSubscribers() {
+      return this.listeners.size > 0;
+    }
+    subscribe(fn) {
+      if (typeof fn !== "function") throw new TypeError("subscriber must be a function");
+      this.listeners.add(fn);
+    }
+    unsubscribe(fn) {
+      return this.listeners.delete(fn);
+    }
+    publish(message) {
+      for (const fn of [...this.listeners]) {
+        try {
+          fn(message, this.name);
+        } catch (error) {
+          queueMicrotask(() => {
+            throw error;
+          });
+        }
+      }
+    }
+  }
+  const channel = (name) => {
+    if (typeof name !== "string" && typeof name !== "symbol") throw new TypeError("channel name must be a string or symbol");
+    let result = channels2.get(name);
+    if (!result) {
+      result = new Channel(name);
+      channels2.set(name, result);
+    }
+    return result;
+  };
+  return {
+    Channel,
+    channel,
+    hasSubscribers: (name) => channels2.get(name)?.hasSubscribers ?? false,
+    subscribe: (name, fn) => channel(name).subscribe(fn),
+    unsubscribe: (name, fn) => channels2.get(name)?.unsubscribe(fn) ?? false
+  };
+}
+
+// src/node/ipc-channel.ts
+var IPC_CHANNEL_ENV = "SANDBOXEDJS_IPC_CHANNEL";
+var channels = /* @__PURE__ */ new Map();
+var closedChannels = /* @__PURE__ */ new Set();
+function newIpcChannelId() {
+  const random = typeof crypto !== "undefined" && "randomUUID" in crypto ? crypto.randomUUID() : Math.random().toString(36).slice(2);
+  return `ipc-${random}`;
+}
+var hostIpcTransport = {
+  attach(id, side, onMessage, onDisconnect) {
+    let channel = channels.get(id);
+    if (!channel && !closedChannels.has(id)) {
+      channel = { parent: { backlog: [] }, child: { backlog: [] }, closed: false };
+      channels.set(id, channel);
+    }
+    if (!channel || channel.closed) {
+      queueMicrotask(onDisconnect);
+      return { send: () => {
+      }, disconnect: () => {
+      } };
+    }
+    const own = channel[side];
+    const other = channel[side === "parent" ? "child" : "parent"];
+    own.deliver = onMessage;
+    own.disconnected = onDisconnect;
+    for (const message of own.backlog.splice(0)) queueMicrotask(() => onMessage(message));
+    return {
+      send(message) {
+        if (channel.closed) return;
+        const copy = message === void 0 ? void 0 : JSON.parse(JSON.stringify(message));
+        if (other.deliver) {
+          const deliver = other.deliver;
+          setTimeout(() => {
+            if (!channel.closed) deliver(copy);
+          }, 0);
+        } else {
+          other.backlog.push(copy);
+        }
+      },
+      disconnect() {
+        if (channel.closed) return;
+        channel.closed = true;
+        channels.delete(id);
+        closedChannels.add(id);
+        for (const end of [channel.parent, channel.child]) {
+          const notify = end.disconnected;
+          if (notify) setTimeout(notify, 0);
+        }
+      }
+    };
+  }
+};
+
 // src/node/readable-from.ts
 function createReadableFrom(Readable) {
   return function from(source, options = {}) {
@@ -26299,6 +26449,132 @@ function installReadableFrom(streamModule5) {
   streamModule5.Readable.from = createReadableFrom(streamModule5.Readable);
 }
 
+// src/node/parse-args.ts
+function argError(code, message) {
+  return Object.assign(new TypeError(message), { code });
+}
+function parseArgs2(config2 = {}) {
+  const args = config2.args ?? globalThis.process?.argv?.slice(2) ?? [];
+  const options = config2.options ?? {};
+  const strict = config2.strict ?? true;
+  const allowPositionals = config2.allowPositionals ?? !strict;
+  const allowNegative = config2.allowNegative ?? false;
+  const byShort = /* @__PURE__ */ new Map();
+  for (const [name, option] of Object.entries(options)) {
+    if (option.type !== "string" && option.type !== "boolean") {
+      throw argError("ERR_INVALID_ARG_VALUE", `The property 'options.${name}.type' must be one of: 'string', 'boolean'`);
+    }
+    if (option.short !== void 0) {
+      if (option.short.length !== 1) {
+        throw argError("ERR_INVALID_ARG_VALUE", `The property 'options.${name}.short' must be a single character`);
+      }
+      byShort.set(option.short, name);
+    }
+  }
+  const tokens = [];
+  const takesValue = (name) => options[name]?.type === "string";
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index];
+    if (arg === "--") {
+      tokens.push({ kind: "option-terminator", index });
+      for (let rest = index + 1; rest < args.length; rest++) tokens.push({ kind: "positional", index: rest, value: args[rest] });
+      break;
+    }
+    if (arg.startsWith("--") && arg.length > 2) {
+      const equals = arg.indexOf("=");
+      if (equals !== -1) {
+        tokens.push({ kind: "option", name: arg.slice(2, equals), rawName: arg.slice(0, equals), index, value: arg.slice(equals + 1), inlineValue: true });
+        continue;
+      }
+      const name = arg.slice(2);
+      if (takesValue(name) && index + 1 < args.length) {
+        tokens.push({ kind: "option", name, rawName: arg, index, value: args[index + 1], inlineValue: false });
+        index++;
+      } else {
+        tokens.push({ kind: "option", name, rawName: arg, index, value: void 0, inlineValue: void 0 });
+      }
+      continue;
+    }
+    if (arg.startsWith("-") && arg.length > 1) {
+      for (let at = 1; at < arg.length; at++) {
+        const short = arg[at];
+        const name = byShort.get(short) ?? short;
+        if (takesValue(name)) {
+          if (at + 1 < arg.length) {
+            tokens.push({ kind: "option", name, rawName: `-${short}`, index, value: arg.slice(at + 1), inlineValue: true });
+          } else if (index + 1 < args.length) {
+            tokens.push({ kind: "option", name, rawName: `-${short}`, index, value: args[index + 1], inlineValue: false });
+            index++;
+          } else {
+            tokens.push({ kind: "option", name, rawName: `-${short}`, index, value: void 0, inlineValue: void 0 });
+          }
+          break;
+        }
+        tokens.push({ kind: "option", name, rawName: `-${short}`, index, value: void 0, inlineValue: void 0 });
+      }
+      continue;
+    }
+    tokens.push({ kind: "positional", index, value: arg });
+  }
+  const values = /* @__PURE__ */ Object.create(null);
+  const positionals = [];
+  const store = (name, value) => {
+    if (options[name]?.multiple) {
+      const list = values[name] ?? [];
+      list.push(value);
+      values[name] = list;
+    } else {
+      values[name] = value;
+    }
+  };
+  for (const token of tokens) {
+    if (token.kind === "option-terminator") continue;
+    if (token.kind === "positional") {
+      if (!allowPositionals) {
+        throw argError("ERR_PARSE_ARGS_UNEXPECTED_POSITIONAL", `Unexpected argument '${token.value}'. This command does not take positional arguments`);
+      }
+      positionals.push(token.value);
+      continue;
+    }
+    let name = token.name;
+    let negated = false;
+    if (allowNegative && name.startsWith("no-") && token.rawName.startsWith("--") && options[name.slice(3)]?.type === "boolean") {
+      name = name.slice(3);
+      negated = true;
+    }
+    const option = options[name];
+    if (!option) {
+      if (strict) {
+        throw argError(
+          "ERR_PARSE_ARGS_UNKNOWN_OPTION",
+          `Unknown option '${token.rawName}'${allowPositionals ? `. To specify a positional argument starting with a '-', place it at the end of the command after '--', as in '-- ${JSON.stringify(token.rawName)}'` : ""}`
+        );
+      }
+      store(name, token.value ?? true);
+      continue;
+    }
+    if (option.type === "string") {
+      if (token.value === void 0) {
+        if (strict) throw argError("ERR_PARSE_ARGS_INVALID_OPTION_VALUE", `Option '${token.rawName} <value>' argument missing`);
+        store(name, true);
+        continue;
+      }
+      store(name, token.value);
+    } else {
+      if (token.inlineValue && strict) {
+        throw argError("ERR_PARSE_ARGS_INVALID_OPTION_VALUE", `Option '${token.rawName}' does not take an argument`);
+      }
+      store(name, !negated);
+    }
+  }
+  for (const [name, option] of Object.entries(options)) {
+    if (option.default !== void 0 && values[name] === void 0) {
+      values[name] = Array.isArray(option.default) ? option.default.slice() : option.default;
+    }
+  }
+  return config2.tokens ? { values, positionals, tokens } : { values, positionals };
+}
+
 // src/node/util-module.ts
 var customInspect = /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom");
 var promisifyCustom = /* @__PURE__ */ Symbol.for("nodejs.util.promisify.custom");
@@ -26327,8 +26603,9 @@ function render(value, depth, seen, options) {
   if (value === null) return "null";
   const object = value;
   const custom = object[customInspect];
-  if (typeof custom === "function") {
-    return String(custom.call(object, depth, options));
+  if (options.customInspect !== false && typeof custom === "function") {
+    const result = custom.call(object, depth, options, inspect);
+    if (result !== object) return typeof result === "string" ? result : render(result, depth, seen, options);
   }
   if (seen.has(object)) return "[Circular *1]";
   if (depth < 0) return Array.isArray(object) ? "[Array]" : "[Object]";
@@ -26663,6 +26940,7 @@ var legacy = {
 inspect.custom = customInspect;
 var utilModule = {
   parseEnv,
+  parseArgs: parseArgs2,
   format,
   formatWithOptions,
   inspect,
@@ -28238,6 +28516,28 @@ function createCryptoModule() {
       };
       return api;
     },
+    pbkdf2Sync(password, salt, iterations, keylen, digest2) {
+      return pbkdf2Key(password, salt, iterations, keylen, digest2);
+    },
+    /* Node derives the key on the libuv thread pool and calls back from the poll
+     * phase. Here it is derived on the calling thread — the ordering a program
+     * observes is the same (the call returns first, the callback comes on a later
+     * turn), but the main thread is busy while it computes. Invalid arguments throw
+     * synchronously, as in Node. */
+    pbkdf2(password, salt, iterations, keylen, digest2, callback) {
+      if (typeof callback !== "function") {
+        throw Object.assign(new TypeError('The "callback" argument must be of type function'), { code: "ERR_INVALID_ARG_TYPE" });
+      }
+      hashFor(digest2);
+      let key;
+      let failure2 = null;
+      try {
+        key = pbkdf2Key(password, salt, iterations, keylen, digest2);
+      } catch (error) {
+        failure2 = error instanceof Error ? error : new Error(String(error));
+      }
+      setTimeout(() => failure2 ? callback(failure2) : callback(null, key), 0);
+    },
     randomBytes(size, callback) {
       const value = Buffer2.alloc(size);
       cryptoObject.getRandomValues(value);
@@ -28287,6 +28587,15 @@ function createCryptoModule() {
     constants: {}
   };
 }
+function pbkdf2Key(password, salt, iterations, keylen, digest2) {
+  if (!Number.isInteger(iterations) || iterations < 1) {
+    throw Object.assign(new RangeError(`The value of "iterations" is out of range. It must be >= 1. Received ${iterations}`), { code: "ERR_OUT_OF_RANGE" });
+  }
+  if (!Number.isInteger(keylen) || keylen < 0) {
+    throw Object.assign(new RangeError(`The value of "keylen" is out of range. It must be >= 0. Received ${keylen}`), { code: "ERR_OUT_OF_RANGE" });
+  }
+  return Buffer2.from(pbkdf2(hashFor(digest2), toBytes2(password), toBytes2(salt), { c: iterations, dkLen: keylen }));
+}
 function hashFor(algorithm) {
   const hash = hashes[algorithm.toLowerCase()];
   if (!hash) throw Object.assign(new Error(`Digest method not supported: ${algorithm}`), { code: "ERR_OSSL_EVP_UNSUPPORTED" });
@@ -28398,20 +28707,10 @@ function concat6(parts) {
   return joined;
 }
 var ChildProcess = class extends EventEmitter4 {
-  stdout = new streamModule4.PassThrough();
-  stderr = new streamModule4.PassThrough();
-  stdin;
-  stdio;
-  pid;
-  exitCode = null;
-  signalCode = null;
-  killed = false;
-  spawnfile;
-  spawnargs;
-  handle;
-  settled = false;
-  constructor(handle, file3, args) {
+  constructor(handle, file3, args, referenceChanged = () => {
+  }) {
     super();
+    this.referenceChanged = referenceChanged;
     this.handle = handle;
     this.pid = handle.pid;
     this.spawnfile = file3;
@@ -28436,31 +28735,90 @@ var ChildProcess = class extends EventEmitter4 {
     handle.on("stdout", (text2) => this.stdout.write(text2));
     handle.on("stderr", (text2) => this.stderr.write(text2));
     handle.on("exit", (code) => this.finish(code));
-    handle.exec();
+    referenceChanged(1);
+    try {
+      handle.exec();
+    } catch (error) {
+      this.unref();
+      throw error;
+    }
   }
+  referenceChanged;
+  stdout = new streamModule4.PassThrough();
+  stderr = new streamModule4.PassThrough();
+  stdin;
+  stdio;
+  pid;
+  exitCode = null;
+  signalCode = null;
+  killed = false;
+  spawnfile;
+  spawnargs;
+  handle;
+  settled = false;
+  referenced = true;
   kill(signal = "SIGTERM") {
     this.killed = true;
     this.handle.kill(typeof signal === "number" ? "SIGTERM" : signal);
     return true;
   }
   ref() {
+    if (!this.settled && !this.referenced) {
+      this.referenced = true;
+      this.referenceChanged(1);
+    }
     return this;
   }
   unref() {
+    if (this.referenced) {
+      this.referenced = false;
+      this.referenceChanged(-1);
+    }
     return this;
   }
-  disconnect() {
-    this.emit("disconnect");
-  }
-  /** No IPC channel exists, and reporting that honestly beats a silent drop. */
-  send() {
-    return false;
+  channel;
+  channelOpen = false;
+  /** Open the parent's end of a `fork` channel. */
+  attachChannel(transport, id) {
+    this.channelOpen = true;
+    this.channel = transport.attach(
+      id,
+      "parent",
+      (message) => this.emit("message", message, void 0),
+      () => this.channelClosed()
+    );
   }
   get connected() {
-    return false;
+    return this.channelOpen;
+  }
+  /** `send(message[, sendHandle][, options][, callback])`, as Node spells it. */
+  send(message, ...rest) {
+    const callback = rest.find((value) => typeof value === "function");
+    if (!this.channel || !this.channelOpen) {
+      const error = Object.assign(new Error("Channel closed"), { code: "ERR_IPC_CHANNEL_CLOSED" });
+      if (callback) queueMicrotask(() => callback(error));
+      else queueMicrotask(() => this.emit("error", error));
+      return false;
+    }
+    this.channel.send(message);
+    if (callback) queueMicrotask(() => callback(null));
+    return true;
+  }
+  disconnect() {
+    if (!this.channelOpen) return;
+    this.channel?.disconnect();
+    this.channelClosed();
+  }
+  channelClosed() {
+    if (!this.channelOpen) return;
+    this.channelOpen = false;
+    this.emit("disconnect");
   }
   finish(code) {
     if (this.settled) return;
+    this.channel?.disconnect();
+    this.channelClosed();
+    this.unref();
     this.settled = true;
     this.exitCode = code;
     this.stdout.end();
@@ -28469,7 +28827,7 @@ var ChildProcess = class extends EventEmitter4 {
     queueMicrotask(() => this.emit("close", code, null));
   }
 };
-function createChildProcessModule(spawnChild, defaultCwd, syncSpawn, defaultEnv = () => ({})) {
+function createChildProcessModule(spawnChild, defaultCwd, syncSpawn, defaultEnv = () => ({}), lifecycle = {}) {
   const environmentFor = (options) => options.env ? { ...options.env } : defaultEnv();
   const throughShell = (command, options) => {
     const shell = typeof options.shell === "string" ? options.shell : "/bin/sh";
@@ -28480,16 +28838,24 @@ function createChildProcessModule(spawnChild, defaultCwd, syncSpawn, defaultEnv
     if (stdio === "ignore") return true;
     return Array.isArray(stdio) && stdio[0] === "ignore";
   };
+  const wantsChannel = (options) => Array.isArray(options.stdio) && options.stdio.includes("ipc");
   const start2 = (file3, args, options) => {
     const resolved = options.shell ? throughShell([file3, ...args].join(" "), options) : { file: file3, args };
+    const channelId = wantsChannel(options) && lifecycle.ipc ? newIpcChannelId() : void 0;
     const handle = spawnChild({
       command: resolved.file,
       args: resolved.args,
       cwd: options.cwd ?? defaultCwd(),
-      env: environmentFor(options),
+      env: channelId ? { ...environmentFor(options), [IPC_CHANNEL_ENV]: channelId } : environmentFor(options),
+      ...options.stdio === "inherit" || Array.isArray(options.stdio) && options.stdio[0] === "inherit" ? { inheritStdio: true } : {},
       ...stdinIgnored(options) ? { stdinIgnored: true } : {}
     });
-    return new ChildProcess(handle, resolved.file, resolved.args);
+    const child = new ChildProcess(handle, resolved.file, resolved.args, lifecycle.referenceChanged);
+    if (channelId && lifecycle.ipc) child.attachChannel(lifecycle.ipc, channelId);
+    const inherited = (index) => options.stdio === "inherit" || Array.isArray(options.stdio) && options.stdio[index] === "inherit";
+    if (inherited(1)) child.stdout.on("data", (chunk) => lifecycle.stdout?.(chunk.toString()));
+    if (inherited(2)) child.stderr.on("data", (chunk) => lifecycle.stderr?.(chunk.toString()));
+    return child;
   };
   const spawn = (file3, args = [], options = {}) => {
     if (!Array.isArray(args)) return start2(file3, [], args);
@@ -28532,7 +28898,13 @@ ${err.join("")}`),
     spawn,
     exec,
     execFile,
-    fork: (modulePath, args = [], options = {}) => spawn("node", [modulePath, ...args], options),
+    fork: (modulePath, args = [], options = {}) => {
+      const [list, opts] = Array.isArray(args) ? [args, options] : [[], args ?? {}];
+      const stdio = Array.isArray(opts.stdio) ? opts.stdio : typeof opts.stdio === "string" ? [opts.stdio, opts.stdio, opts.stdio] : opts.silent ? ["pipe", "pipe", "pipe"] : ["inherit", "inherit", "inherit"];
+      const withChannel = stdio.includes("ipc") ? stdio : [...stdio, "ipc"];
+      const execArgv = (opts.execArgv ?? []).filter((flag) => !/^--(inspect|debug)/.test(flag));
+      return start2("node", [...execArgv, modulePath, ...list], { ...opts, shell: false, stdio: withChannel });
+    },
     ...buildSyncFamily(syncSpawn, throughShell, defaultCwd, environmentFor),
     ChildProcess
   };
@@ -29158,11 +29530,14 @@ function createCoreModules(options) {
   });
   const stderrWrite = options.stderr ?? (() => {
   });
-  const timers = createTrackedTimers((error) => reportUncaught(error));
+  const timers = createTrackedTimers((error) => reportUncaught(error), () => runTicks());
   const processObject = Object.assign(new EventEmitter4(), processShim, {
     argv: options.argv?.slice() ?? ["/usr/bin/node"],
     argv0: "node",
     execPath: "/usr/bin/node",
+    /* `process/browser.js` has no `execArgv`; Node always has an array, and
+     * CLIs that fork copy it (`[...process.execArgv]`). */
+    execArgv: [],
     env: env2,
     platform: "linux",
     arch: "x64",
@@ -29201,13 +29576,14 @@ function createCoreModules(options) {
       options.onExit?.(status);
     },
     nextTick: (fn, ...args) => {
-      queueMicrotask(() => {
-        try {
-          fn(...args);
-        } catch (error) {
-          reportUncaught(error);
-        }
-      });
+      if (typeof fn !== "function") {
+        throw Object.assign(new TypeError('The "callback" argument must be of type function'), { code: "ERR_INVALID_ARG_TYPE" });
+      }
+      tickQueue.push([fn, args]);
+      if (!tickDrainScheduled) {
+        tickDrainScheduled = true;
+        afterMicrotasks(runTicks);
+      }
     },
     kill: () => true
   });
@@ -29215,10 +29591,42 @@ function createCoreModules(options) {
     const implementation = EventEmitter4.prototype[method];
     if (typeof implementation === "function") processObject[method] = implementation;
   }
+  const hrtime = (previous) => {
+    const now = performance.timeOrigin + performance.now();
+    let seconds = Math.floor(now / 1e3);
+    let nanoseconds = Math.floor(now % 1e3 * 1e6);
+    if (previous) {
+      seconds -= previous[0];
+      nanoseconds -= previous[1];
+      if (nanoseconds < 0) {
+        seconds -= 1;
+        nanoseconds += 1e9;
+      }
+    }
+    return [seconds, nanoseconds];
+  };
+  hrtime.bigint = () => {
+    const [seconds, nanoseconds] = hrtime();
+    return BigInt(seconds) * 1000000000n + BigInt(nanoseconds);
+  };
+  processObject.hrtime = hrtime;
   const tty = options.tty === true;
   processObject.stdout = makeOutputStream(stdoutWrite, 1, tty);
   processObject.stderr = makeOutputStream(stderrWrite, 2, tty);
   let exiting = false;
+  const tickQueue = [];
+  let tickDrainScheduled = false;
+  const runTicks = () => {
+    tickDrainScheduled = false;
+    while (tickQueue.length && !exiting) {
+      const [fn, args] = tickQueue.shift();
+      try {
+        fn(...args);
+      } catch (error) {
+        reportUncaught(error);
+      }
+    }
+  };
   const emitExit = (status) => {
     if (exiting) return;
     exiting = true;
@@ -29286,13 +29694,16 @@ function createCoreModules(options) {
   const moduleBuiltin = {
     builtinModules: builtinNames2.flatMap((name) => [name, `node:${name}`]),
     isBuiltin: (name) => builtinNames2.includes(name.replace(/^node:/, "")),
+    findSourceMap: () => void 0,
     createRequire: () => {
       throw new Error("createRequire is only available inside a loaded module");
     }
   };
   let inFlightRequests = 0;
+  let requestsStarted = 0;
   const trackRequest = () => {
     inFlightRequests++;
+    requestsStarted += 1;
     return () => {
       inFlightRequests--;
     };
@@ -29306,7 +29717,86 @@ function createCoreModules(options) {
   };
   const http = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "http:") : createUnsupportedModule("http");
   const https = options.http ? createHttpModule(options.http.router, options.http.owner, httpOptions, "https:") : createUnsupportedModule("https");
-  const childProcess = options.spawnChild ? createChildProcessModule(options.spawnChild, () => cwd, options.syncSpawn, () => ({ ...processObject.env })) : createUnsupportedModule("child_process");
+  let referencedChildren = 0;
+  const childProcess = options.spawnChild ? createChildProcessModule(options.spawnChild, () => cwd, options.syncSpawn, () => ({ ...processObject.env }), {
+    referenceChanged: (delta) => {
+      referencedChildren += delta;
+    },
+    stdout: options.stdout,
+    stderr: options.stderr,
+    ...options.ipc ? { ipc: options.ipc } : {}
+  }) : createUnsupportedModule("child_process");
+  let channelReferenced = 0;
+  const channelId = env2[IPC_CHANNEL_ENV];
+  if (channelId && options.ipc) {
+    delete env2[IPC_CHANNEL_ENV];
+    let open = true;
+    let referenced = true;
+    channelReferenced = 1;
+    const close = () => {
+      if (!open) return;
+      open = false;
+      if (referenced) channelReferenced = 0;
+      processObject.connected = false;
+      delete processObject.send;
+      try {
+        processObject.emit("disconnect");
+      } catch (error) {
+        reportUncaught(error);
+      }
+      runTicks();
+    };
+    const endpoint = options.ipc.attach(
+      channelId,
+      "child",
+      (message) => {
+        try {
+          processObject.emit("message", message, void 0);
+        } catch (error) {
+          reportUncaught(error);
+        }
+        runTicks();
+      },
+      close
+    );
+    processObject.connected = true;
+    processObject.send = (message, ...rest) => {
+      const callback = rest.find((value) => typeof value === "function");
+      if (!open) {
+        const error = Object.assign(new Error("Channel closed"), { code: "ERR_IPC_CHANNEL_CLOSED" });
+        if (callback) defer(() => callback(error));
+        else defer(() => {
+          processObject.emit("error", error);
+        });
+        return false;
+      }
+      endpoint.send(message);
+      if (callback) defer(() => callback(null));
+      return true;
+    };
+    processObject.disconnect = () => {
+      if (open) {
+        endpoint.disconnect();
+        close();
+      }
+    };
+    processObject.channel = {
+      ref() {
+        if (open && !referenced) {
+          referenced = true;
+          channelReferenced = 1;
+        }
+        return this;
+      },
+      unref() {
+        if (referenced) {
+          referenced = false;
+          channelReferenced = 0;
+        }
+        return this;
+      }
+    };
+  }
   const readline = createReadlineModule(() => processObject.stdin, () => processObject.stdout);
   const dns = createDnsModule(defer);
   const builtins = {
@@ -29318,6 +29808,7 @@ function createCoreModules(options) {
     console: consoleObject,
     constants: fs.constants,
     crypto: createCryptoModule(),
+    diagnostics_channel: createDiagnosticsChannel(),
     dns,
     "dns/promises": dns.promises,
     events: EventEmitter4,
@@ -29336,6 +29827,25 @@ function createCoreModules(options) {
     readline,
     "readline/promises": readline.promises,
     stream: streamModule4,
+    "stream/web": Object.fromEntries([
+      "ReadableStream",
+      "ReadableStreamDefaultReader",
+      "ReadableStreamBYOBReader",
+      "ReadableStreamDefaultController",
+      "ReadableByteStreamController",
+      "ReadableStreamBYOBRequest",
+      "WritableStream",
+      "WritableStreamDefaultWriter",
+      "WritableStreamDefaultController",
+      "TransformStream",
+      "TransformStreamDefaultController",
+      "ByteLengthQueuingStrategy",
+      "CountQueuingStrategy",
+      "TextEncoderStream",
+      "TextDecoderStream",
+      "CompressionStream",
+      "DecompressionStream"
+    ].filter((name) => name in globalThis).map((name) => [name, globalThis[name]])),
     "stream/promises": createStreamPromises(),
     string_decoder: stringDecoderModule,
     timers: { ...timersModule, ...timers.api },
@@ -29367,7 +29877,57 @@ function createCoreModules(options) {
     })
   };
   for (const name of stubNames) builtins[name] = createUnsupportedModule(name);
+  builtins.worker_threads = {
+    MessagePort: globalThis.MessagePort ?? class MessagePort {
+    },
+    markAsUncloneable: () => {
+    },
+    isMarkedAsUncloneable: () => false,
+    markAsUntransferable: () => {
+    },
+    isMarkedAsUntransferable: () => false
+  };
   builtins.net = createNetModule();
+  builtins.inspector = createUnsupportedModule("inspector", {
+    url: () => void 0,
+    close: () => {
+    },
+    waitForDebugger: () => {
+      throw Object.assign(new Error("Inspector is not active"), { code: "ERR_INSPECTOR_NOT_ACTIVE" });
+    },
+    console: consoleObject
+  });
+  builtins.v8 = createUnsupportedModule("v8", {
+    getHeapStatistics: () => {
+      const memory = performance.memory;
+      const limit = memory?.jsHeapSizeLimit ?? 4 * 1024 ** 3;
+      return {
+        total_heap_size: memory?.totalJSHeapSize ?? 0,
+        total_heap_size_executable: 0,
+        total_physical_size: memory?.totalJSHeapSize ?? 0,
+        total_available_size: limit - (memory?.usedJSHeapSize ?? 0),
+        used_heap_size: memory?.usedJSHeapSize ?? 0,
+        heap_size_limit: limit,
+        malloced_memory: 0,
+        peak_malloced_memory: 0,
+        does_zap_garbage: 0,
+        number_of_native_contexts: 1,
+        number_of_detached_contexts: 0,
+        total_global_handles_size: 0,
+        used_global_handles_size: 0,
+        external_memory: 0
+      };
+    },
+    getHeapSpaceStatistics: () => [],
+    getHeapCodeStatistics: () => ({ code_and_metadata_size: 0, bytecode_and_metadata_size: 0, external_script_source_size: 0, cpu_profiler_metadata_size: 0 }),
+    cachedDataVersionTag: () => 0,
+    setFlagsFromString: () => {
+    },
+    setHeapSnapshotNearHeapLimit: () => {
+    },
+    serialize: (value) => Buffer2.from(JSON.stringify(value) ?? "null"),
+    deserialize: (buffer) => JSON.parse(Buffer2.from(buffer).toString("utf8"))
+  });
   const globals = {
     Buffer: Buffer2,
     console: consoleObject,
@@ -29402,7 +29962,7 @@ function createCoreModules(options) {
     builtins,
     globals,
     process: processObject,
-    pendingHandles: timers.pending,
+    pendingHandles: () => timers.pending() + referencedChildren + channelReferenced,
     pendingUnrefed: timers.pendingUnrefed,
     /** Client requests sent but not yet read to completion. */
     pendingRequests: () => inFlightRequests,
@@ -29411,6 +29971,18 @@ function createCoreModules(options) {
     reportUnhandledRejection: (reason) => reportUncaught(reason, "unhandledRejection"),
     exitStatus: () => normalizeExitCode(processObject.exitCode),
     emitExit,
+    runTicks,
+    emitBeforeExit: (status) => {
+      if (exiting || processObject.listenerCount("beforeExit") === 0) return false;
+      try {
+        processObject.emit("beforeExit", status);
+      } catch (error) {
+        reportUncaught(error);
+      }
+      runTicks();
+      return true;
+    },
+    loopActivity: () => timers.scheduled() + requestsStarted,
     writeStdin: (data) => {
       if (options.interactiveStdin) stdin.write(data);
     },
@@ -29456,7 +30028,9 @@ var ASYNC_FS_METHODS = [
   "close",
   "read",
   "write",
-  "exists"
+  "exists",
+  "fsync",
+  "fdatasync"
 ];
 function createPathModule(cwd) {
   const resolve3 = (...segments2) => pathModule.resolve(cwd(), ...segments2);
@@ -29679,6 +30253,12 @@ function createFsModule(volume, cwd, stdinPath, defer = queueMicrotask) {
     unwatchFile: () => {
     }
   };
+  fs.fsyncSync = (fd) => {
+    requiredFd(fds, fd);
+  };
+  fs.fdatasyncSync = (fd) => {
+    requiredFd(fds, fd);
+  };
   fs.ftruncateSync = (fd, length) => fs.truncateSync(requiredFd(fds, fd).path, length);
   fs.fchmodSync = (fd, mode) => fs.chmodSync(requiredFd(fds, fd).path, mode);
   fs.fchownSync = (fd, uid, gid) => fs.chownSync(requiredFd(fds, fd).path, uid, gid);
@@ -29739,6 +30319,8 @@ function makeFileHandle(fs, fd) {
   return {
     fd,
     close: async () => fs.closeSync(fd),
+    sync: async () => fs.fsyncSync(fd),
+    datasync: async () => fs.fdatasyncSync(fd),
     stat: async () => fs.fstatSync(fd),
     truncate: async (length) => fs.ftruncateSync(fd, length),
     chmod: async (mode) => fs.fchmodSync(fd, mode),
@@ -30021,8 +30603,28 @@ var ERRNO_CONSTANTS = {
   EWOULDBLOCK: 11,
   EXDEV: 18
 };
+var afterMicrotasks = (() => {
+  const host2 = globalThis.process;
+  if (typeof host2?.nextTick === "function" && host2.versions?.node) return (fn) => host2.nextTick(fn);
+  if (typeof MessageChannel === "function") {
+    const queue = [];
+    let channel = null;
+    return (fn) => {
+      if (!channel) {
+        channel = new MessageChannel();
+        channel.port1.onmessage = () => queue.shift()?.();
+      }
+      queue.push(fn);
+      channel.port2.postMessage(null);
+    };
+  }
+  return (fn) => {
+    setTimeout(fn, 0);
+  };
+})();
 function createTrackedTimers(onError = (error) => {
   throw error;
+}, afterCallback = () => {
 }) {
   const run2 = (fn, args) => {
     try {
@@ -30030,11 +30632,14 @@ function createTrackedTimers(onError = (error) => {
     } catch (error) {
       onError(error);
     }
+    afterCallback();
   };
+  let scheduled = 0;
   const live = /* @__PURE__ */ new Set();
   const unrefed = /* @__PURE__ */ new Set();
   const states = /* @__PURE__ */ new WeakMap();
   const track = (native) => {
+    scheduled += 1;
     const state = { native, active: true, referenced: true };
     const handle = {
       ref() {
@@ -30139,6 +30744,7 @@ function createTrackedTimers(onError = (error) => {
     },
     pending: () => live.size,
     pendingUnrefed: () => unrefed.size,
+    scheduled: () => scheduled,
     cancelAll
   };
 }
@@ -30308,7 +30914,7 @@ function formatUncaught(error) {
 Node.js v22.12.0
 `;
 }
-var stubNames = ["cluster", "dgram", "diagnostics_channel", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
+var stubNames = ["cluster", "dgram", "domain", "http2", "inspector", "net", "tls", "v8", "vm", "worker_threads"];
 var builtinNames2 = [
   "assert",
   "assert/strict",
@@ -30321,6 +30927,7 @@ var builtinNames2 = [
   "events",
   "fs",
   "fs/promises",
+  "diagnostics_channel",
   "dns",
   "dns/promises",
   "http",
@@ -30336,6 +30943,7 @@ var builtinNames2 = [
   "readline",
   "readline/promises",
   "stream",
+  "stream/web",
   "stream/promises",
   "string_decoder",
   "timers",
@@ -31724,6 +32332,7 @@ var LocalRuntimePod = class _LocalRuntimePod {
           ...this.networkPolicy ? { policy: this.networkPolicy } : {}
         },
         spawnChild: (config2) => this.processManager.spawn(config2),
+        ipc: hostIpcTransport,
         ...typeof options.stdinPath === "string" ? { stdinPath: options.stdinPath } : {},
         ...options.interactiveStdin ? { interactiveStdin: true } : {},
         ...options.tty ? { tty: true } : {},
@@ -31744,8 +32353,17 @@ var LocalRuntimePod = class _LocalRuntimePod {
         overrides: Object.fromEntries(Object.entries(this.modules).map(([key, value]) => [key, hostWork.wrap(value)]))
       });
       try {
-        await Promise.race([engine.run(script), proc.waitForKill()]);
-        await this.settle(owner, core.pendingHandles, core.readingStdin, () => core.pendingRequests() + hostWork.pending(), () => proc.isKilled());
+        const main = engine.run(script);
+        core.runTicks();
+        await Promise.race([main, proc.waitForKill()]);
+        const settle = () => this.settle(owner, core.pendingHandles, core.readingStdin, () => core.pendingRequests() + hostWork.pending(), () => proc.isKilled());
+        await settle();
+        while (!proc.isKilled()) {
+          const activity = core.loopActivity();
+          if (!core.emitBeforeExit(core.exitStatus())) break;
+          await settle();
+          if (core.loopActivity() === activity) break;
+        }
         const status = core.exitStatus();
         core.emitExit(status);
         return status;
@@ -32208,9 +32826,12 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
     const entry = { worker, server };
     this.live.add(entry);
     const ownedChildren = /* @__PURE__ */ new Set();
+    const channelEnds = /* @__PURE__ */ new Map();
     const process2 = new WorkerProcess(worker, () => {
       for (const child of ownedChildren) child.kill("SIGTERM");
       ownedChildren.clear();
+      for (const end of channelEnds.values()) end.disconnect();
+      channelEnds.clear();
       this.live.delete(entry);
       server.close();
       this.closeProxies(owner);
@@ -32275,6 +32896,30 @@ var WorkerRuntimePod = class _WorkerRuntimePod extends LocalRuntimePod {
         case "child-kill":
           children.get(message.id)?.kill(String(message.signal));
           return;
+        case "ipc-attach": {
+          const key = `${message.side}:${message.id}`;
+          if (channelEnds.has(key)) return;
+          channelEnds.set(key, hostIpcTransport.attach(
+            String(message.id),
+            message.side === "child" ? "child" : "parent",
+            (value) => worker.postMessage({ type: "ipc-message", id: message.id, side: message.side, value }),
+            () => {
+              channelEnds.delete(key);
+              worker.postMessage({ type: "ipc-disconnect", id: message.id, side: message.side });
+            }
+          ));
+          return;
+        }
+        case "ipc-send":
+          channelEnds.get(`${message.side}:${message.id}`)?.send(message.value);
+          return;
+        case "ipc-close": {
+          const key = `${message.side}:${message.id}`;
+          const end = channelEnds.get(key);
+          channelEnds.delete(key);
+          end?.disconnect();
+          return;
+        }
         default:
           return;
       }