## Summary

Third step of the Bun → Node.js migration (follows #967, #970). Replaces
all Bun-specific API calls in `src/` with Node.js equivalents.

### Changes

**File I/O** (18 files):
- `Bun.file(path).text()` → `readFile(path, "utf-8")` from
`node:fs/promises`
- `Bun.file(path).json()` → `JSON.parse(await readFile(path, "utf-8"))`
- `Bun.file(path).exists()` → `access(path).then(() => true, () =>
false)`
- `Bun.file(path).stat()` → `stat(path)` from `node:fs/promises`
- `Bun.write(path, content)` → `writeFile(path, content)` from
`node:fs/promises`
- `Bun.write(dest, Bun.file(src))` → `copyFile(src, dest)` from
`node:fs/promises`

**Process/System** (9 files + 1 new):
- `Bun.which()` → new `src/lib/which.ts` helper using `command -v`
(POSIX) / `where` (Windows)
- `Bun.spawn()` → `spawn()` from `node:child_process` with
Promise-wrapped exit code
- `Bun.spawnSync()` → `spawnSync()` from `node:child_process`
- `Bun.sleep()` → `setTimeout()` from `node:timers/promises`

**Utilities** (6 files):
- `Bun.Glob` → `picomatch` (already a devDependency)
- `Bun.randomUUIDv7()` → `uuidv7()` from `uuidv7` package
- `Bun.semver.order()` → `compare()` from `semver` package

### What's NOT in this PR (Group D — separate follow-up)

These Bun APIs in `bspatch.ts` and `upgrade.ts` require more careful
handling:
- `Bun.file().writer()` — streaming file writer (needs
`fs.createWriteStream`)
- `Bun.zstdCompress/DecompressSync` — zstd compression (needs
`node:zlib` 22.15+)
- `Bun.mmap()` — memory-mapped files (has existing fallback)
- `Bun.CryptoHasher` — streaming hash (needs `crypto.createHash`)

### Test results

All 7012 unit tests pass, 0 failures.

…writer) (#986)

## Summary

Fourth step of the Bun → Node.js migration (follows #967, #970, #984).
Replaces the remaining Bun-specific APIs in `src/` — the "Group D" items
that required more careful handling.

### Changes

**`src/lib/bspatch.ts`** (rewritten):
- `Bun.zstdDecompressSync()` → `zstdDecompressSync()` from `node:zlib`
- `DecompressionStream('zstd')` → `createZstdDecompress()` from
`node:zlib` piped through a Node Readable→Web ReadableStream bridge
- `Bun.mmap()` → removed entirely; uses `readFile()` for both paths
(copy-then-read and direct-read fallback)
- `Bun.CryptoHasher("sha256")` → `createHash("sha256")` from
`node:crypto`
- `Bun.file(destPath).writer()` → `createWriteStream(destPath)` from
`node:fs`

**`src/lib/upgrade.ts`**:
- `Bun.file(destPath).writer()` → `createWriteStream(destPath)` from
`node:fs`

**`src/lib/api/sourcemaps.ts`**:
- `Bun.zstdCompress(buf, { level: 3 })` → `zstdCompress()` from
`node:zlib`

**`src/lib/telemetry/zstd-transport.ts`**:
- Removed `globalThis.Bun.zstdCompress` dynamic access and `BunZstdHost`
type
- Replaced with direct `zstdCompress` from `node:zlib` (always available
in Node 22.15+)
- Removed belt-and-braces fallback (zstd can't disappear at runtime with
`node:zlib`)
- `hasZstdSupport()` now checks `typeof zstdCompressCb === "function"`
directly

**Tests updated** (`test/lib/telemetry/zstd-transport.test.ts`):
- Removed 4 tests for `globalThis.Bun.zstdCompress` fallback paths (no
longer applicable)
- Replaced `Bun.zstdDecompress` with `zstdDecompressSync` in assertions

### Result

**Zero non-comment `Bun.*` API calls remain in `src/`.** The only `bun:`
reference left is the `require("bun:sqlite")` fallback in `sqlite.ts`,
which will be removed when the test runner migrates to Vitest.

All 7014 tests pass, 0 failures.

Consolidates fixes for review comments across PRs #967, #970, #984, #986.

Changes:
- Bump engines.node from >=22.12 to >=22.15 (zstd APIs require 22.15+,
  Node 20 is EOL). Update dist/bin.cjs runtime version check to match.
- Simplify zstd imports: replace feature-detection dance with direct
  imports from node:zlib now that >=22.15 is guaranteed.
- Fix spawn error handling in upgrade.ts: propagate error object to catch
  block so ENOENT/EBUSY detection works (was silently resolving with 1).
- Fix sqlite.ts transaction(): wrap ROLLBACK in try/catch so original
  error is preserved if ROLLBACK itself fails.
- Guard semver.compare calls in delta-upgrade.ts with semver.valid() to
  avoid throwing on invalid version strings.
- Narrow catch in shell.ts addToGitHubPath to ENOENT only, re-throw
  other errors (EACCES, EPERM) instead of silently swallowing.
- Add WriteStream backpressure handling in upgrade.ts
  streamDecompressToFile: check write() return value, await drain.
- Add setup-node@v6 with Node 22 to E2E CI job.
- Fix whichSync Windows CRLF: split on /\r?\n/ instead of \n.

7014 tests pass, 0 failures.

Consolidates fixes for review comments across PRs #967, #970, #984, #986.

Changes:
- Bump engines.node from >=22.12 to >=22.15 (zstd APIs require 22.15+,
  Node 20 is EOL). Update dist/bin.cjs runtime version check to match.
- Simplify zstd imports: replace feature-detection dance with direct
  imports from node:zlib now that >=22.15 is guaranteed.
- Fix spawn error handling in upgrade.ts: propagate error object to catch
  block so ENOENT/EBUSY detection works (was silently resolving with 1).
- Fix sqlite.ts transaction(): wrap ROLLBACK in try/catch so original
  error is preserved if ROLLBACK itself fails.
- Guard semver.compare calls in delta-upgrade.ts with semver.valid() to
  avoid throwing on invalid version strings.
- Narrow catch in shell.ts addToGitHubPath to ENOENT only, re-throw
  other errors (EACCES, EPERM) instead of silently swallowing.
- Add WriteStream backpressure handling in upgrade.ts
  streamDecompressToFile: check write() return value, await drain.
- Add setup-node@v6 with Node 22 to E2E CI job.
- Fix whichSync Windows CRLF: split on /\r?\n/ instead of \n.

7014 tests pass, 0 failures.

Consolidates fixes for review comments across PRs #967, #970, #984, #986.

Changes:
- Bump engines.node from >=22.12 to >=22.15 (zstd APIs require 22.15+,
  Node 20 is EOL). Update dist/bin.cjs runtime version check to match.
- Simplify zstd imports: replace feature-detection dance with direct
  imports from node:zlib now that >=22.15 is guaranteed.
- Fix spawn error handling in upgrade.ts: propagate error object to catch
  block so ENOENT/EBUSY detection works (was silently resolving with 1).
- Fix sqlite.ts transaction(): wrap ROLLBACK in try/catch so original
  error is preserved if ROLLBACK itself fails.
- Guard semver.compare calls in delta-upgrade.ts with semver.valid() to
  avoid throwing on invalid version strings.
- Narrow catch in shell.ts addToGitHubPath to ENOENT only, re-throw
  other errors (EACCES, EPERM) instead of silently swallowing.
- Add WriteStream backpressure handling in upgrade.ts
  streamDecompressToFile: check write() return value, await drain.
- Add setup-node@v6 with Node 22 to E2E CI job.
- Fix whichSync Windows CRLF: split on /\r?\n/ instead of \n.

7014 tests pass, 0 failures.

## Summary

Consolidates fixes for review comments across PRs #967, #970, #984,
#986, superseding #988.

### Critical
- **Bump `engines.node` to `>=22.15`** — `node:zlib` zstd APIs require
22.15+. Node 20 is EOL. Updated `dist/bin.cjs` runtime version check to
match.
- **Simplify zstd imports** — replaced feature-detection dance with
direct `import { zstdCompress } from "node:zlib"` now that >=22.15 is
guaranteed.

### High
- **Fix spawn error handling in `upgrade.ts`** — `proc.on("error", () =>
resolve(1))` discarded the error object, making ENOENT/EBUSY detection
dead code. Now properly rejects with the error.

### Medium
- **Fix `sqlite.ts` ROLLBACK** — if ROLLBACK throws, the original
transaction error was lost. Now wrapped in try/catch.
- **Guard `semver.compare`** in `delta-upgrade.ts` with `semver.valid()`
to avoid throwing on invalid version strings.
- **Narrow catch in `shell.ts`** `addToGitHubPath` — only catch ENOENT,
re-throw EACCES/EPERM.
- **Add WriteStream backpressure** in `upgrade.ts`
`streamDecompressToFile` — check `write()` return value, await
`'drain'`.
- **Add `setup-node@v6`** with Node 22 to E2E CI job.

### Low
- **Fix `whichSync` Windows CRLF** — split on `/\r?\n/` instead of `\n`
to strip trailing `\r` from `where.exe` output.

### Test results
All 7014 tests pass, 0 failures.

---------

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>