[rdlabo]

Changes

Expand Workers-compatible crypto, filesystem, compression and network behavior across the public package and native runtimes. This PR contains the accumulated 22 compatibility commits since main, including:

• Crypto hashing, KDFs, ciphers, Diffie-Hellman, random APIs, key generation/import/export and RSA error handling, with upstream fixtures and native Wasm implementations.
• Virtual filesystem operations, streams, FileHandle ownership and request lifetimes, plus public promise API types.
• Compression codecs and validation, with precise input/options/callback types and info-dependent result types for 11 codec APIs. Strict consumers compile against the installed package declarations.
• HTTP options, cookies, cancellation and upload byte snapshots; server completion and validation behavior; authenticated direct TLS and Android handshake/close handling.
• Shared Workers comparison contracts, independent package consumers and native lifecycle fixtures. Native page cases now release their Wasm instances between cases to avoid harness memory exhaustion.

Validation

Baseline: workerd 1.20261012.1, compatibility date 2026-10-17, nodejs_compat, source 5358e3d337336eaf696a48bc1563d808b10feba5.

• Unit tests: 1,042 passed across 78 files; typecheck and formatting passed.
• Public build matrix: 848 checks passed across Chromium/WebKit, Vite/esbuild and page/Worker. Subsequent targeted HTTP (56) and TLS (48) checks passed.
• Independently installed final tarball: strict fs/zlib consumers with skipLibCheck=false, public/configured entry checks and package acceptance passed.
• iOS simulator and Android emulator, both page and Worker: all 104 shared operation groups matched Workers; local boundary expectations and cold Wasm checks passed. HTTP/HTTPS matched all 23 cases, and cross-request filesystem lifetimes matched both cases.
• Additional native TLS comparisons: 17 of 23 cases matched on both platforms/modes. WSS send/receive, subprotocol and close cases matched.
• Manager and independent acceptance reviews have no outstanding required changes within the reviewed fixes. This is not whole-module acceptance.

Final tested tarball SHA-256: f03a64ce3e94bc9ff7e8525f78713b8488d57f1b71614d3c6627c5be1467a6d8. Public type changes are in 4912ee4; final runtime and harness changes are in 5a4d35c. Raw local evidence is retained in artifacts/validation/candidate-f03a64ce3e94/ (ignored artifacts, not included in this PR). Reproduction procedures are in the updated native and compatibility test READMEs.

Draft / remaining acceptance work

The full native comparison commands still exit 1. This PR is not ready to merge or release. Completed observations are not a passing acceptance gate.

• Six TLS comparisons differ: direct/upgrade handshake cancellation and STARTTLS early close, truncated FIN and reset behavior. The implementation waits for authentication and rejects unclean TLS termination; these remain strict comparison failures.
• WebSocket still lacks Workers-specific WebSocketPair, accept, attachment APIs and matching constructor/state/public-member behavior. Plain WS fails under Android WebView restrictions; iOS server-close event ordering differs. These are remaining implementation tasks, not declared impossible.
• Whole-module export/option/prototype coverage is incomplete. Existing process/util/sys/fs surface gaps remain documented; successful selected contracts do not certify complete compatibility.

Per CONTRIBUTING.md, keep this implementation in draft until the remaining module acceptance work is complete. No version bump or release is included.