From cefffacb7fa7921f0ac6117aa36595a005e9fc39 Mon Sep 17 00:00:00 2001
From: Chris King <kingces95@gmail.com>
Date: Sun, 9 Aug 2026 14:36:34 -1000
Subject: [PATCH] net: add parent-owned pipe and socket endpoints

Signed-off-by: Chris King <kingces95@gmail.com>
---
 doc/api/child_process.md                      |  11 +-
 doc/api/net.md                                | 178 ++++++++++++-
 lib/internal/child_process.js                 |  98 ++++++++
 lib/internal/net.js                           |   3 +
 lib/net.js                                    |  44 ++++
 src/env_properties.h                          |   1 +
 src/pipe_wrap.cc                              |  46 ++++
 src/pipe_wrap.h                               |   1 +
 src/process_wrap.cc                           |   3 +-
 src/tcp_wrap.cc                               |  54 ++++
 src/tcp_wrap.h                                |   1 +
 test/common/net-create-pipe.js                |  60 +++++
 test/common/net-create-socket-pair.js         |  65 +++++
 .../test-child-process-leased-pipe-errors.js  | 237 ++++++++++++++++++
 .../test-child-process-leased-pipe-unit.js    | 180 +++++++++++++
 .../test-child-process-leased-pipe.js         |  76 ++++++
 .../test-child-process-send-socket-pair.js    |  71 ++++++
 ...-child-process-socket-pair-stdio-errors.js |  63 +++++
 .../test-child-process-validate-stdio.js      |  40 +++
 test/parallel/test-net-create-pipe-docs.js    |  77 ++++++
 test/parallel/test-net-create-pipe-finally.js |  45 ++++
 test/parallel/test-net-create-pipe.js         |  22 ++
 .../test-net-create-socket-pair-docs.js       |  93 +++++++
 test/parallel/test-net-create-socket-pair.js  |  43 ++++
 24 files changed, 1507 insertions(+), 5 deletions(-)
 create mode 100644 test/common/net-create-pipe.js
 create mode 100644 test/common/net-create-socket-pair.js
 create mode 100644 test/parallel/test-child-process-leased-pipe-errors.js
 create mode 100644 test/parallel/test-child-process-leased-pipe-unit.js
 create mode 100644 test/parallel/test-child-process-leased-pipe.js
 create mode 100644 test/parallel/test-child-process-send-socket-pair.js
 create mode 100644 test/parallel/test-child-process-socket-pair-stdio-errors.js
 create mode 100644 test/parallel/test-net-create-pipe-docs.js
 create mode 100644 test/parallel/test-net-create-pipe-finally.js
 create mode 100644 test/parallel/test-net-create-pipe.js
 create mode 100644 test/parallel/test-net-create-socket-pair-docs.js
 create mode 100644 test/parallel/test-net-create-socket-pair.js

diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index 913542c2dc06..ab4b42971f97 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -1055,7 +1055,9 @@ pipes between the parent and child. The value is one of the following:
    file descriptor is duplicated in the child process to the fd that
    corresponds to the index in the `stdio` array. The stream must have an
    underlying descriptor (file streams do not start until the `'open'` event has
-   occurred).
+   occurred). Pipe endpoints returned by [`net.createPipe()`][] may be passed
+   here. Readable endpoints returned by [`net.createPipe()`][] must not be
+   flowing when passed here.
    **NOTE:** While it is technically possible to pass `stdin` as a writable or
    `stdout`/`stderr` as readable, it is not recommended.
    Readable and writable streams are designed with distinct behaviors, and using
@@ -1441,6 +1443,12 @@ streams of a child process have been closed. This is distinct from the
 [`'exit'`][] event, since multiple processes might share the same stdio
 streams. The `'close'` event will always emit after [`'exit'`][] was
 already emitted, or [`'error'`][] if the child process failed to spawn.
+Readable stdio streams created by Node.js are resumed after the child process
+exits so they can be fully consumed and closed before the `'close'` event is
+emitted. Endpoints created by [`net.createPipe()`][] are an exception to this
+rule and are not resumed by the child process. Their stream lifecycle remains
+owned by the parent process, and consequently the child process `'close'` event
+does not wait for such streams to close.
 
 If the process exited, `code` is the final exit code of the process, otherwise
 `null`. If the process terminated due to receipt of a signal, `signal` is the
@@ -2374,6 +2382,7 @@ or [`child_process.fork()`][].
 [`maxBuffer` and Unicode]: #maxbuffer-and-unicode
 [`net.Server`]: net.md#class-netserver
 [`net.Socket`]: net.md#class-netsocket
+[`net.createPipe()`]: net.md#netcreatepipe
 [`options.detached`]: #optionsdetached
 [`process.disconnect()`]: process.md#processdisconnect
 [`process.env`]: process.md#processenv
diff --git a/doc/api/net.md b/doc/api/net.md
index 81a25eee0f1b..421c1e0c2015 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -8,9 +8,10 @@
 
 <!-- source_link=lib/net.js -->
 
-The `node:net` module provides an asynchronous network API for creating stream-based
-TCP or [IPC][] servers ([`net.createServer()`][]) and clients
-([`net.createConnection()`][]).
+The `node:net` module provides an asynchronous network API for creating
+stream-based TCP or [IPC][] servers ([`net.createServer()`][]) and clients
+([`net.createConnection()`][]), and operating system pipe pairs
+([`net.createPipe()`][]) and socket pairs ([`net.createSocketPair()`][]).
 
 It can be accessed using:
 
@@ -2382,6 +2383,170 @@ Use `nc` to connect to a Unix domain socket server:
 nc -U /tmp/echo.sock
 ```
 
+Endpoint pairs created by [`net.createPipe()`][] and
+[`net.createSocketPair()`][] are owned by the current process. Use normal
+stream idioms such as `end()` to finish writing and stream consumption to drain
+a readable endpoint. Use `resume()` when an unread readable endpoint should be
+drained without observing its data, and use `destroy()` when an endpoint is no
+longer needed without being naturally ended or drained.
+
+## `net.createSocketPair()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {net.Socket\[]}
+  * {net.Socket} The first socket.
+  * {net.Socket} The second socket.
+
+The `net.createSocketPair()` method creates a connected pair of operating
+system sockets. The returned [`net.Socket`][] instances are owned by the current
+process and may be used to exchange bytes in either direction without binding a
+server or connecting a client. Either socket may be passed to a Node.js child
+process over an IPC channel using [`subprocess.send()`][].
+
+```cjs
+const { spawn } = require('node:child_process');
+const { createSocketPair } = require('node:net');
+
+const [left, right] = createSocketPair();
+
+const child = spawn(process.execPath, ['-e', `
+  process.on('message', (message, socket) => {
+    socket.on('data', (chunk) => {
+      socket.write(chunk.toString().toUpperCase());
+    });
+    socket.resume();
+    process.send('ready');
+  });
+`], {
+  stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
+});
+
+child.once('message', () => {
+  left.write('hello');
+});
+
+left.once('data', (chunk) => {
+  console.log(chunk.toString()); // Prints: HELLO
+  left.destroy();
+  child.kill();
+});
+
+child.send('socket', right, { keepOpen: false });
+```
+
+```mjs
+import { spawn } from 'node:child_process';
+import { createSocketPair } from 'node:net';
+
+const [left, right] = createSocketPair();
+
+const child = spawn(process.execPath, ['-e', `
+  process.on('message', (message, socket) => {
+    socket.on('data', (chunk) => {
+      socket.write(chunk.toString().toUpperCase());
+    });
+    socket.resume();
+    process.send('ready');
+  });
+`], {
+  stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
+});
+
+child.once('message', () => {
+  left.write('hello');
+});
+
+left.once('data', (chunk) => {
+  console.log(chunk.toString()); // Prints: HELLO
+  left.destroy();
+  child.kill();
+});
+
+child.send('socket', right, { keepOpen: false });
+```
+
+## `net.createPipe()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Object}
+  * `readable` {net.Socket} The readable end of the pipe.
+  * `writable` {net.Socket} The writable end of the pipe.
+
+The `net.createPipe()` method creates an operating system pipe pair. The
+returned `readable` and `writable` streams are owned by the current process and
+may be passed to [`child_process.spawn()`][] using the [`stdio`][] option.
+
+When a pipe endpoint is passed to [`child_process.spawn()`][], the child process
+leases the endpoint until the child process exits. A pipe endpoint may be leased
+to only one child process at a time. Pipe endpoints created by this module are
+not supported by synchronous child process APIs such as
+[`child_process.spawnSync()`][].
+
+Readable pipe endpoints must not be flowing when they are passed to
+[`child_process.spawn()`][]. The child process [`'close'`
+event][child-process-close] does not wait for leased endpoints to close and
+does not resume them after the child process exits.
+
+When a `readable` endpoint is passed as child stdin or as another child fd, the
+child leases a readable handle. When a `writable` endpoint is passed as child
+stdout, stderr, or another child fd, the child leases a writable handle. A
+`readable` endpoint may not be passed as child stdout or stderr, and a
+`writable` endpoint may not be passed as child stdin.
+
+```cjs
+const { spawn } = require('node:child_process');
+const { createPipe } = require('node:net');
+const { text } = require('node:stream/consumers');
+
+const { readable, writable } = createPipe();
+const child = spawn(process.execPath, ['-e', `
+  const fs = require('node:fs');
+  const buffer = Buffer.alloc(1);
+  const count = fs.readSync(0, buffer, 0, 1, null);
+  fs.writeSync(1, buffer.subarray(0, count));
+`], {
+  stdio: [readable, 'pipe', 'inherit'],
+});
+
+const output = text(child.stdout);
+writable.end('abc');
+
+child.on('close', async () => {
+  console.log(await output); // Prints: a
+  console.log(await text(readable)); // Prints: bc
+});
+```
+
+```mjs
+import { spawn } from 'node:child_process';
+import { createPipe } from 'node:net';
+import { text } from 'node:stream/consumers';
+
+const { readable, writable } = createPipe();
+const child = spawn(process.execPath, ['-e', `
+  const fs = require('node:fs');
+  const buffer = Buffer.alloc(1);
+  const count = fs.readSync(0, buffer, 0, 1, null);
+  fs.writeSync(1, buffer.subarray(0, count));
+`], {
+  stdio: [readable, 'pipe', 'inherit'],
+});
+
+const output = text(child.stdout);
+writable.end('abc');
+
+child.on('close', async () => {
+  console.log(await output); // Prints: a
+  console.log(await text(readable)); // Prints: bc
+});
+```
+
 ## `net.getDefaultAutoSelectFamily()`
 
 <!-- YAML
@@ -2585,6 +2750,8 @@ console.log('listening on', server.address().port);
 [`ERR_SOCKET_HANDLE_ADOPTED`]: errors.md#err_socket_handle_adopted
 [`EventEmitter`]: events.md#class-eventemitter
 [`child_process.fork()`]: child_process.md#child_processforkmodulepath-args-options
+[`child_process.spawn()`]: child_process.md#child_processspawncommand-args-options
+[`child_process.spawnSync()`]: child_process.md#child_processspawnsynccommand-args-options
 [`dns.lookup()`]: dns.md#dnslookuphostname-options-callback
 [`dns.lookup()` hints]: dns.md#supported-getaddrinfo-flags
 [`net.Server`]: #class-netserver
@@ -2597,7 +2764,9 @@ console.log('listening on', server.address().port);
 [`net.createConnection(options)`]: #netcreateconnectionoptions-connectlistener
 [`net.createConnection(path)`]: #netcreateconnectionpath-connectlistener
 [`net.createConnection(port, host)`]: #netcreateconnectionport-host-connectlistener
+[`net.createPipe()`]: #netcreatepipe
 [`net.createServer()`]: #netcreateserveroptions-connectionlistener
+[`net.createSocketPair()`]: #netcreatesocketpair
 [`net.getDefaultAutoSelectFamily()`]: #netgetdefaultautoselectfamily
 [`net.getDefaultAutoSelectFamilyAttemptTimeout()`]: #netgetdefaultautoselectfamilyattempttimeout
 [`netPromises.listen()`]: #netpromiseslistenoptions
@@ -2612,6 +2781,7 @@ console.log('listening on', server.address().port);
 [`server.listen(path)`]: #serverlistenpath-backlog-callback
 [`server.listen(port)`]: #serverlistenport-host-backlog-callback
 [`server.maxConnections`]: #servermaxconnections
+[`subprocess.send()`]: child_process.md#subprocesssendmessage-sendhandle-options-callback
 [`socket(7)`]: https://man7.org/linux/man-pages/man7/socket.7.html
 [`socket.connect()`]: #socketconnect
 [`socket.connect(options)`]: #socketconnectoptions-connectlistener
@@ -2630,6 +2800,7 @@ console.log('listening on', server.address().port);
 [`socket.setTimeout()`]: #socketsettimeouttimeout-callback
 [`socket.setTimeout(timeout)`]: #socketsettimeouttimeout-callback
 [`stream.getDefaultHighWaterMark()`]: stream.md#streamgetdefaulthighwatermarkobjectmode
+[`stdio`]: child_process.md#optionsstdio
 [`worker_threads`]: worker_threads.md
 [`writable.destroy()`]: stream.md#writabledestroyerror
 [`writable.destroyed`]: stream.md#writabledestroyed
@@ -2637,6 +2808,7 @@ console.log('listening on', server.address().port);
 [`writable.writableLength`]: stream.md#writablewritablelength
 [dot-decimal notation]: https://en.wikipedia.org/wiki/Dot-decimal_notation
 [half-closed]: https://tools.ietf.org/html/rfc1122
+[child-process-close]: child_process.md#event-close
 [stream_writable_write]: stream.md#writablewritechunk-encoding-callback
 [unspecified IPv4 address]: https://en.wikipedia.org/wiki/0.0.0.0
 [unspecified IPv6 address]: https://en.wikipedia.org/wiki/IPv6_address#Unspecified_address
diff --git a/lib/internal/child_process.js b/lib/internal/child_process.js
index a12b2954db81..67e323369e5c 100644
--- a/lib/internal/child_process.js
+++ b/lib/internal/child_process.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayIsArray,
+  ArrayPrototypeFilter,
   ArrayPrototypePush,
   ArrayPrototypeReduce,
   ArrayPrototypeSlice,
@@ -21,6 +22,7 @@ const {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
     ERR_INVALID_HANDLE_TYPE,
+    ERR_INVALID_STATE,
     ERR_INVALID_SYNC_FORK_INPUT,
     ERR_IPC_CHANNEL_CLOSED,
     ERR_IPC_DISCONNECTED,
@@ -75,6 +77,21 @@ const {
 } = internalBinding('uv');
 
 const { SocketListSend, SocketListReceive } = SocketList;
+const {
+  kReaderOfPair,
+  kSocketOfPair,
+  kWriterOfPair,
+} = require('internal/net');
+const kLeasedTo = Symbol('kLeasedTo');
+const kStreamLeaseInUseMessage =
+  'Stream is already in use by a child process';
+const kReadableStreamLeaseFlowingMessage =
+  'Readable stream must not be flowing';
+const kSyncLeasedStdioMessage =
+  'cannot be used with spawnSync() because parent-owned endpoint streams are ' +
+  'only supported by spawn()';
+const kSocketPairStdioMessage =
+  'socket pair endpoints cannot be used as child process stdio';
 
 // Lazy loaded for startup performance and to allow monkey patching of
 // internalBinding('http_parser').HTTPParser.
@@ -278,6 +295,8 @@ function ChildProcess() {
       this.stdin.destroy();
     }
 
+    releaseStreamLeases(this, this._leasedStreams);
+
     this._handle.close();
     this._handle = null;
 
@@ -351,6 +370,50 @@ function closePendingHandle(target) {
   target._pendingMessage = null;
 }
 
+function releaseStreamLeases(target, entries) {
+  if (entries === undefined) return;
+
+  for (let i = 0; i < entries.length; i++) {
+    if (entries[i].type !== 'leased') continue;
+
+    const stream = entries[i].stream;
+
+    assert(stream !== undefined);
+
+    if (stream[kLeasedTo] === target)
+      stream[kLeasedTo] = undefined;
+  }
+
+  target._leasedStreams = undefined;
+}
+
+
+function acquireStreamLeases(target, stdio) {
+  assert(stdio !== undefined);
+
+  for (let i = 0; i < stdio.length; i++) {
+    if (stdio[i].type !== 'leased') continue;
+
+    const stream = stdio[i].stream;
+
+    assert(stream !== undefined);
+
+    if (stream[kLeasedTo]) {
+      releaseStreamLeases(target, stdio);
+      throw new ERR_INVALID_STATE(kStreamLeaseInUseMessage);
+    }
+
+    if (stream[kReaderOfPair] && stream.readableFlowing === true) {
+      releaseStreamLeases(target, stdio);
+      throw new ERR_INVALID_STATE(kReadableStreamLeaseFlowingMessage);
+    }
+
+    stream[kLeasedTo] = target;
+  }
+
+  return ArrayPrototypeFilter(stdio, (stream) => stream.type === 'leased');
+}
+
 
 ChildProcess.prototype.spawn = function spawn(options) {
   let i = 0;
@@ -405,6 +468,8 @@ ChildProcess.prototype.spawn = function spawn(options) {
   if (options.windowsVerbatimArguments)
     spawnFlags |= processConstants.kProcessFlagWindowsVerbatimArguments;
 
+  this._leasedStreams = acquireStreamLeases(this, stdio);
+
   const err = this._handle.spawn(
     options.file,
     options.args,
@@ -422,6 +487,8 @@ ChildProcess.prototype.spawn = function spawn(options) {
       err === UV_EMFILE ||
       err === UV_ENFILE ||
       err === UV_ENOENT) {
+    releaseStreamLeases(this, this._leasedStreams);
+
     if (childProcessSpawn.hasSubscribers) {
       childProcessSpawn.error.publish({
         process: this,
@@ -446,6 +513,7 @@ ChildProcess.prototype.spawn = function spawn(options) {
 
     this._handle.close();
     this._handle = null;
+    releaseStreamLeases(this, this._leasedStreams);
 
     if (childProcessSpawn.hasSubscribers) {
       childProcessSpawn.error.publish({
@@ -468,6 +536,7 @@ ChildProcess.prototype.spawn = function spawn(options) {
   for (i = 0; i < stdio.length; i++) {
     const stream = stdio[i];
     if (stream.type === 'ignore') continue;
+    if (stream.type === 'leased') continue;
 
     if (stream.ipc) {
       this._closesNeeded++;
@@ -1077,6 +1146,32 @@ function getValidStdio(stdio, sync) {
         type: 'fd',
         fd: typeof stdio === 'number' ? stdio : stdio.fd,
       });
+    } else if (stdio[kReaderOfPair] || stdio[kWriterOfPair]) {
+      if (sync) {
+        cleanup();
+        throw new ERR_INVALID_ARG_VALUE('stdio', stdio,
+                                        kSyncLeasedStdioMessage);
+      }
+
+      if (stdio.readable && !stdio.writable && (i === 1 || i === 2)) {
+        cleanup();
+        throw new ERR_INVALID_ARG_VALUE('stdio', stdio);
+      }
+
+      if (stdio.writable && !stdio.readable && i === 0) {
+        cleanup();
+        throw new ERR_INVALID_ARG_VALUE('stdio', stdio);
+      }
+
+      ArrayPrototypePush(acc, {
+        type: 'leased',
+        handle: stdio._handle,
+        stream: stdio,
+      });
+    } else if (stdio[kSocketOfPair]) {
+      cleanup();
+      throw new ERR_INVALID_ARG_VALUE('stdio', stdio,
+                                      kSocketPairStdioMessage);
     } else if (getHandleWrapType(stdio) || getHandleWrapType(stdio.handle) ||
                getHandleWrapType(stdio._handle)) {
       const handle = getHandleWrapType(stdio) ?
@@ -1152,6 +1247,9 @@ function spawnSync(options) {
 module.exports = {
   ChildProcess,
   kChannelHandle,
+  kReaderOfPair,
+  kSocketOfPair,
+  kWriterOfPair,
   setupChannel,
   getValidStdio,
   stdioStringToArray,
diff --git a/lib/internal/net.js b/lib/internal/net.js
index cea3dda23d61..bcc0bff67d7e 100644
--- a/lib/internal/net.js
+++ b/lib/internal/net.js
@@ -99,12 +99,15 @@ function isLoopback(host) {
 }
 
 module.exports = {
+  kReaderOfPair: Symbol('kReaderOfPair'),
   kReinitializeHandle: Symbol('kReinitializeHandle'),
   kSetNoDelay: Symbol('kSetNoDelay'),
   kSetKeepAlive: Symbol('kSetKeepAlive'),
   kSetKeepAliveInitialDelay: Symbol('kSetKeepAliveInitialDelay'),
   kSetKeepAliveInterval: Symbol('kSetKeepAliveInterval'),
   kSetKeepAliveCount: Symbol('kSetKeepAliveCount'),
+  kSocketOfPair: Symbol('kSocketOfPair'),
+  kWriterOfPair: Symbol('kWriterOfPair'),
   isIP,
   isIPv4,
   isIPv6,
diff --git a/lib/net.js b/lib/net.js
index 445a7d59f8cb..e305ee83e374 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -48,12 +48,15 @@ let debug = require('internal/util/debuglog').debuglog('net', (fn) => {
   debug = fn;
 });
 const {
+  kReaderOfPair,
   kReinitializeHandle,
   kSetNoDelay,
   kSetKeepAlive,
   kSetKeepAliveInitialDelay,
   kSetKeepAliveInterval,
   kSetKeepAliveCount,
+  kSocketOfPair,
+  kWriterOfPair,
   isIP,
   isIPv4,
   isIPv6,
@@ -76,11 +79,13 @@ const { ShutdownWrap } = internalBinding('stream_wrap');
 const {
   TCP,
   TCPConnectWrap,
+  pairSockets,
   constants: TCPConstants,
 } = internalBinding('tcp_wrap');
 const {
   Pipe,
   PipeConnectWrap,
+  pairPipes,
   constants: PipeConstants,
 } = internalBinding('pipe_wrap');
 const {
@@ -214,6 +219,43 @@ function createHandle(fd, is_server) {
   throw new ERR_INVALID_FD_TYPE(type);
 }
 
+function createPipe() {
+  const readHandle = new Pipe(PipeConstants.SOCKET);
+  const writeHandle = new Pipe(PipeConstants.SOCKET);
+  pairPipes(readHandle, writeHandle);
+
+  const readable = new Socket({
+    handle: readHandle,
+    pauseOnCreate: true,
+    readable: true,
+    writable: false,
+  });
+  const writable = new Socket({
+    handle: writeHandle,
+    readable: false,
+    writable: true,
+  });
+
+  readable[kReaderOfPair] = true;
+  writable[kWriterOfPair] = true;
+
+  return { readable, writable };
+}
+
+function createSocketPair() {
+  const handle1 = new TCP(TCPConstants.SOCKET);
+  const handle2 = new TCP(TCPConstants.SOCKET);
+  pairSockets(handle1, handle2);
+
+  const socket1 = new Socket({ handle: handle1 });
+  const socket2 = new Socket({ handle: handle2 });
+
+  socket1[kSocketOfPair] = true;
+  socket2[kSocketOfPair] = true;
+
+  return [socket1, socket2];
+}
+
 
 function getNewAsyncId(handle) {
   return (!handle || typeof handle.getAsyncId !== 'function') ?
@@ -2974,7 +3016,9 @@ module.exports = {
   BoundSocket,
   connect,
   createConnection: connect,
+  createPipe,
   createServer,
+  createSocketPair,
   get promises() {
     netPromises ??= require('internal/net/promises');
     return netPromises;
diff --git a/src/env_properties.h b/src/env_properties.h
index f54efa36b6df..9b9e020c29d4 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -297,6 +297,7 @@
   V(options_string, "options")                                                 \
   V(original_string, "original")                                               \
   V(output_string, "output")                                                   \
+  V(leased_string, "leased")                                                  \
   V(overlapped_string, "overlapped")                                           \
   V(p256_string, "P-256")                                                      \
   V(p384_string, "P-384")                                                      \
diff --git a/src/pipe_wrap.cc b/src/pipe_wrap.cc
index 48bd22e301d8..6faa3a8855f7 100644
--- a/src/pipe_wrap.cc
+++ b/src/pipe_wrap.cc
@@ -89,6 +89,7 @@ void PipeWrap::Initialize(Local<Object> target,
 
   SetConstructorFunction(context, target, "Pipe", t);
   env->set_pipe_constructor_template(t);
+  SetMethod(context, target, "pairPipes", Pair);
 
   // Create FunctionTemplate for PipeConnectWrap.
   auto cwt = AsyncWrap::MakeLazilyInitializedJSTemplate(env);
@@ -106,6 +107,7 @@ void PipeWrap::Initialize(Local<Object> target,
 
 void PipeWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(New);
+  registry->Register(Pair);
   registry->Register(Bind);
   registry->Register(Listen);
   registry->Register(Connect);
@@ -149,6 +151,50 @@ void PipeWrap::New(const FunctionCallbackInfo<Value>& args) {
   new PipeWrap(env, args.This(), provider, ipc);
 }
 
+void PipeWrap::Pair(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  uv_fs_t req;
+  uv_file fds[2];
+  PipeWrap* read_wrap;
+  PipeWrap* write_wrap;
+  int err;
+
+  CHECK(args[0]->IsObject());
+  CHECK(args[1]->IsObject());
+  ASSIGN_OR_RETURN_UNWRAP(&read_wrap, args[0].As<Object>());
+  ASSIGN_OR_RETURN_UNWRAP(&write_wrap, args[1].As<Object>());
+
+  err = uv_pipe(fds, UV_NONBLOCK_PIPE, UV_NONBLOCK_PIPE);
+  if (err) {
+    env->ThrowUVException(err, "uv_pipe");
+    return;
+  }
+
+  err = uv_pipe_open(&read_wrap->handle_, fds[0]);
+  if (err)
+    goto error_close_fds;
+  read_wrap->set_fd(fds[0]);
+
+  err = uv_pipe_open(&write_wrap->handle_, fds[1]);
+  if (err)
+    goto error_close_read_wrap;
+  write_wrap->set_fd(fds[1]);
+  return;
+
+error_close_read_wrap:
+  read_wrap->Close();
+  goto error_close_write_fd;
+
+error_close_fds:
+  uv_fs_close(nullptr, &req, fds[0], nullptr);
+  uv_fs_req_cleanup(&req);
+
+error_close_write_fd:
+  uv_fs_close(nullptr, &req, fds[1], nullptr);
+  uv_fs_req_cleanup(&req);
+  env->ThrowUVException(err, "uv_pipe_open");
+}
+
 PipeWrap::PipeWrap(Environment* env,
                    Local<Object> object,
                    ProviderType provider,
diff --git a/src/pipe_wrap.h b/src/pipe_wrap.h
index c0722b63d853..ef46be47ce29 100644
--- a/src/pipe_wrap.h
+++ b/src/pipe_wrap.h
@@ -60,6 +60,7 @@ class PipeWrap : public ConnectionWrap<PipeWrap, uv_pipe_t> {
            bool ipc);
 
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Pair(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Bind(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Listen(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Connect(const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/src/process_wrap.cc b/src/process_wrap.cc
index 21ccb2a9989b..cd16493a2253 100644
--- a/src/process_wrap.cc
+++ b/src/process_wrap.cc
@@ -170,7 +170,8 @@ class ProcessWrap : public HandleWrap {
         if (!StreamForWrap(env, stdio).To(&(*options_stdio)[i].data.stream)) {
           return Nothing<void>();
         }
-      } else if (type->StrictEquals(env->wrap_string())) {
+      } else if (type->StrictEquals(env->wrap_string()) ||
+                 type->StrictEquals(env->leased_string())) {
         (*options_stdio)[i].flags = UV_INHERIT_STREAM;
         if (!StreamForWrap(env, stdio).To(&(*options_stdio)[i].data.stream)) {
           return Nothing<void>();
diff --git a/src/tcp_wrap.cc b/src/tcp_wrap.cc
index 9bb742fb3edc..7b60ca50c0ce 100644
--- a/src/tcp_wrap.cc
+++ b/src/tcp_wrap.cc
@@ -118,6 +118,7 @@ void TCPWrap::Initialize(Local<Object> target,
   SetProtoMethod(isolate, t, "setTypeOfService", SetTypeOfService);
   SetProtoMethod(isolate, t, "getTypeOfService", GetTypeOfService);
   SetProtoMethod(isolate, t, "reset", Reset);
+  SetMethod(context, target, "pairSockets", Pair);
 
 #ifdef _WIN32
   SetProtoMethod(isolate, t, "setSimultaneousAccepts", SetSimultaneousAccepts);
@@ -154,6 +155,7 @@ void TCPWrap::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(SetKeepAlive);
   registry->Register(SetTypeOfService);
   registry->Register(GetTypeOfService);
+  registry->Register(Pair);
   registry->Register(Reset);
 #ifdef _WIN32
   registry->Register(SetSimultaneousAccepts);
@@ -221,6 +223,58 @@ void TCPWrap::SetKeepAlive(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(err);
 }
 
+static void CloseSocket(uv_os_sock_t socket) {
+#ifdef _WIN32
+  closesocket(socket);
+#else
+  close(socket);
+#endif
+}
+
+void TCPWrap::Pair(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  uv_os_sock_t fds[2];
+  TCPWrap* wrap0;
+  TCPWrap* wrap1;
+  int err;
+
+  CHECK(args[0]->IsObject());
+  CHECK(args[1]->IsObject());
+  ASSIGN_OR_RETURN_UNWRAP(&wrap0, args[0].As<Object>());
+  ASSIGN_OR_RETURN_UNWRAP(&wrap1, args[1].As<Object>());
+
+  err = uv_socketpair(SOCK_STREAM,
+                      0,
+                      fds,
+                      UV_NONBLOCK_PIPE,
+                      UV_NONBLOCK_PIPE);
+  if (err) {
+    env->ThrowUVException(err, "uv_socketpair");
+    return;
+  }
+
+  err = uv_tcp_open(&wrap0->handle_, fds[0]);
+  if (err)
+    goto error_close_fds;
+
+  err = uv_tcp_open(&wrap1->handle_, fds[1]);
+  if (err)
+    goto error_close_wrap0;
+
+  return;
+
+error_close_wrap0:
+  wrap0->Close();
+  goto error_close_fd1;
+
+error_close_fds:
+  CloseSocket(fds[0]);
+
+error_close_fd1:
+  CloseSocket(fds[1]);
+  env->ThrowUVException(err, "uv_tcp_open");
+}
+
 // TODO(amyssnippet): This implementation uses raw setsockopt/getsockopt calls
 // as a temporary measure. Upstream support is tracked in
 // https://github.com/libuv/libuv/issues/5011.
diff --git a/src/tcp_wrap.h b/src/tcp_wrap.h
index 4802b62727a2..f540d2635072 100644
--- a/src/tcp_wrap.h
+++ b/src/tcp_wrap.h
@@ -104,6 +104,7 @@ class TCPWrap : public ConnectionWrap<TCPWrap, uv_tcp_t> {
   static void SetKeepAlive(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetTypeOfService(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetTypeOfService(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void Pair(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Bind(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Bind6(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Listen(const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/test/common/net-create-pipe.js b/test/common/net-create-pipe.js
new file mode 100644
index 000000000000..50e3728d177e
--- /dev/null
+++ b/test/common/net-create-pipe.js
@@ -0,0 +1,60 @@
+'use strict';
+
+const common = require('./');
+const { once } = require('node:events');
+const { createPipe } = require('node:net');
+const { test } = require('node:test');
+
+const kPipeCloseTimeout = common.platformTimeout(10_000);
+
+function isClosed(stream) {
+  return stream.closed || stream.destroyed;
+}
+
+function waitForClose(stream) {
+  if (isClosed(stream))
+    return Promise.resolve();
+
+  return once(stream, 'close');
+}
+
+async function assertPipeCloses(readable, writable) {
+  const timeout = new Promise((_, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error('pipe endpoints did not close'));
+    }, kPipeCloseTimeout);
+    timer.unref();
+  });
+
+  await Promise.race([
+    Promise.all([
+      waitForClose(readable),
+      waitForClose(writable),
+    ]),
+    timeout,
+  ]);
+}
+
+async function withCreatePipe(fn) {
+  const pipe = createPipe();
+
+  try {
+    const result = await fn(pipe);
+    await assertPipeCloses(pipe.readable, pipe.writable);
+    return result;
+  } finally {
+    pipe.readable.destroy();
+    pipe.writable.destroy();
+  }
+}
+
+function testCreatePipe(name, fn) {
+  test(name, (t) => withCreatePipe(({ readable, writable }) => {
+    return fn(readable, writable, t);
+  }));
+}
+
+module.exports = {
+  testCreatePipe,
+  withCreatePipe,
+};
diff --git a/test/common/net-create-socket-pair.js b/test/common/net-create-socket-pair.js
new file mode 100644
index 000000000000..319f3d8c5674
--- /dev/null
+++ b/test/common/net-create-socket-pair.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const common = require('./');
+const { once } = require('node:events');
+const { createSocketPair } = require('node:net');
+const { test } = require('node:test');
+
+const kSocketPairCloseTimeout = common.platformTimeout(10_000);
+
+function isClosed(stream) {
+  return stream.closed || stream.destroyed;
+}
+
+function waitForClose(stream) {
+  if (isClosed(stream))
+    return Promise.resolve();
+
+  return once(stream, 'close');
+}
+
+async function assertSocketPairCloses(left, right) {
+  const timeout = new Promise((_, reject) => {
+    const timer = setTimeout(() => {
+      reject(new Error('socket pair endpoints did not close'));
+    }, kSocketPairCloseTimeout);
+    timer.unref();
+  });
+
+  await Promise.race([
+    Promise.all([
+      waitForClose(left),
+      waitForClose(right),
+    ]),
+    timeout,
+  ]);
+}
+
+async function withCreateSocketPair(fn) {
+  const [left, right] = createSocketPair();
+
+  try {
+    const result = await fn({ left, right });
+    await assertSocketPairCloses(left, right);
+    return result;
+  } finally {
+    left.destroy();
+    right.destroy();
+  }
+}
+
+function testCreateSocketPair(name, options, fn) {
+  if (fn === undefined) {
+    fn = options;
+    options = undefined;
+  }
+
+  test(name, options, (t) => withCreateSocketPair(({ left, right }) => {
+    return fn(left, right, t);
+  }));
+}
+
+module.exports = {
+  testCreateSocketPair,
+  withCreateSocketPair,
+};
diff --git a/test/parallel/test-child-process-leased-pipe-errors.js b/test/parallel/test-child-process-leased-pipe-errors.js
new file mode 100644
index 000000000000..f98005cb79c4
--- /dev/null
+++ b/test/parallel/test-child-process-leased-pipe-errors.js
@@ -0,0 +1,237 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn, spawnSync } = require('node:child_process');
+const { once } = require('node:events');
+const { test } = require('node:test');
+const { text } = require('node:stream/consumers');
+const {
+  testCreatePipe,
+  withCreatePipe,
+} = require('../common/net-create-pipe');
+
+const holdOpen = `
+  process.send('ready');
+  process.on('message', (message) => {
+    if (message === 'close') process.exit(0);
+  });
+`;
+
+const holdStdinOpen = `
+  process.stdin.resume();
+  process.send('ready');
+`;
+
+function trySpawn(...args) {
+  try {
+    return { child: spawn(...args) };
+  } catch (error) {
+    return { error };
+  }
+}
+
+testCreatePipe('spawn failure leaves parent-owned endpoints usable',
+  async (readable, writable) => {
+    const child = spawn('program-that-had-better-not-exist', [], {
+      stdio: [readable, 'ignore', 'ignore'],
+    });
+
+    const close = new Promise((resolve) => child.on('close', resolve));
+    const [[err]] = await Promise.all([
+      once(child, 'error'),
+      close,
+    ]);
+    assert.strictEqual(err.code, 'ENOENT');
+    assert.strictEqual(readable.destroyed, false);
+    assert.strictEqual(writable.destroyed, false);
+
+    const output = text(readable);
+    writable.end('abc');
+    assert.strictEqual(await output, 'abc');
+  });
+
+testCreatePipe('spawnSync rejects parent-owned pipe streams',
+  (readable, writable) => {
+    assert.throws(() => {
+      spawnSync(process.execPath, ['-e', ''], {
+        stdio: [readable, 'ignore', 'ignore'],
+      });
+    }, {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /parent-owned endpoint streams are only supported by spawn\(\)/,
+    });
+
+    readable.resume();
+    writable.end();
+  });
+
+testCreatePipe('writable endpoint is rejected as child stdin',
+  (readable, writable) => {
+    assert.throws(() => {
+      spawn(process.execPath, ['-e', ''], {
+        stdio: [writable, 'ignore', 'ignore'],
+      });
+    }, {
+      code: 'ERR_INVALID_ARG_VALUE',
+    });
+
+    readable.resume();
+    writable.end();
+  });
+
+testCreatePipe('readable endpoint is rejected as child stdout',
+  (readable, writable) => {
+    assert.throws(() => {
+      spawn(process.execPath, ['-e', ''], {
+        stdio: ['ignore', readable, 'ignore'],
+      });
+    }, {
+      code: 'ERR_INVALID_ARG_VALUE',
+    });
+
+    readable.resume();
+    writable.end();
+  });
+
+testCreatePipe('readable endpoint is rejected as child stderr',
+  (readable, writable) => {
+    assert.throws(() => {
+      spawn(process.execPath, ['-e', ''], {
+        stdio: ['ignore', 'ignore', readable],
+      });
+    }, {
+      code: 'ERR_INVALID_ARG_VALUE',
+    });
+
+    readable.resume();
+    writable.end();
+  });
+
+testCreatePipe('readable cannot be leased by two children concurrently',
+  async (readable, writable) => {
+    const child = spawn(process.execPath, ['-e', holdStdinOpen], {
+      stdio: [readable, 'ignore', 'inherit', 'ipc'],
+    });
+    await once(child, 'message');
+
+    const result = trySpawn(process.execPath, ['-e', holdStdinOpen], {
+      stdio: [readable, 'ignore', 'inherit', 'ipc'],
+    });
+
+    const childClose = once(child, 'close');
+    const resultClose = result.child != null ? once(result.child, 'close') :
+      null;
+    if (result.child != null)
+      result.child.kill();
+
+    writable.end();
+    await childClose;
+    if (resultClose != null)
+      await resultClose;
+    readable.resume();
+
+    assert.strictEqual(result.error?.code, 'ERR_INVALID_STATE');
+  });
+
+testCreatePipe('readable cannot be leased twice by the same child',
+  (readable, writable) => {
+    assert.throws(() => {
+      spawn(process.execPath, ['-e', ''], {
+        stdio: [readable, 'ignore', 'inherit', readable],
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+    });
+
+    readable.resume();
+    writable.end();
+  });
+
+testCreatePipe('writable cannot be leased by two children concurrently',
+  async (readable, writable) => {
+    const child = spawn(process.execPath, ['-e', holdOpen], {
+      stdio: ['ignore', writable, 'inherit', 'ipc'],
+    });
+    await once(child, 'message');
+
+    const result = trySpawn(process.execPath, ['-e', holdOpen], {
+      stdio: ['ignore', writable, 'inherit', 'ipc'],
+    });
+
+    const childClose = once(child, 'close');
+    const resultClose = result.child != null ? once(result.child, 'close') :
+      null;
+    if (result.child != null)
+      result.child.kill();
+
+    child.send('close');
+    await childClose;
+    if (resultClose != null)
+      await resultClose;
+    readable.resume();
+    writable.end();
+
+    assert.strictEqual(result.error?.code, 'ERR_INVALID_STATE');
+  });
+
+testCreatePipe('writable cannot be leased twice by the same child',
+  (readable, writable) => {
+    assert.throws(() => {
+      spawn(process.execPath, ['-e', ''], {
+        stdio: ['ignore', writable, 'inherit', writable],
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+    });
+
+    readable.resume();
+    writable.end();
+  });
+
+test('failed lease releases earlier streams from the same attempt',
+  async () => {
+    await withCreatePipe(async (busy) => {
+      await withCreatePipe(async (free) => {
+        const childA = spawn(process.execPath, ['-e', holdStdinOpen], {
+          stdio: [busy.readable, 'ignore', 'inherit', 'ipc'],
+        });
+        await once(childA, 'message');
+
+        assert.throws(() => {
+          spawn(process.execPath, ['-e', holdStdinOpen], {
+            stdio: [free.readable, 'ignore', 'inherit', busy.readable],
+          });
+        }, {
+          code: 'ERR_INVALID_STATE',
+        });
+
+        const childC = spawn(process.execPath, ['-e', holdStdinOpen], {
+          stdio: [free.readable, 'ignore', 'inherit', 'ipc'],
+        });
+        await once(childC, 'message');
+
+        const childAClose = once(childA, 'close');
+        const childCClose = once(childC, 'close');
+        busy.writable.end();
+        free.writable.end();
+        await childAClose;
+        await childCClose;
+        busy.readable.resume();
+        free.readable.resume();
+      });
+    });
+  });
+
+testCreatePipe('flowing readable cannot be leased', (readable, writable) => {
+  readable.resume();
+
+  assert.throws(() => {
+    spawn(process.execPath, ['-e', holdStdinOpen], {
+      stdio: [readable, 'ignore', 'inherit'],
+    });
+  }, {
+    code: 'ERR_INVALID_STATE',
+    message: /Readable stream must not be flowing/,
+  });
+
+  writable.end();
+});
diff --git a/test/parallel/test-child-process-leased-pipe-unit.js b/test/parallel/test-child-process-leased-pipe-unit.js
new file mode 100644
index 000000000000..844a58abf1d2
--- /dev/null
+++ b/test/parallel/test-child-process-leased-pipe-unit.js
@@ -0,0 +1,180 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const { createPipe } = require('node:net');
+const { test } = require('node:test');
+const { text } = require('node:stream/consumers');
+
+const pipeStdinToStdout = `
+  process.stdin.pipe(process.stdout);
+`;
+
+const pipeFd3ToStdout = `
+  const fs = require('node:fs');
+  fs.createReadStream(null, { fd: 3 }).pipe(process.stdout);
+`;
+
+const writeStdout = `
+  process.stdout.write('hello stdout\\n');
+`;
+
+const writeStderr = `
+  process.stderr.write('hello stderr\\n');
+`;
+
+const writeFd3 = `
+  const fs = require('node:fs');
+  fs.writeSync(3, 'hello fd3\\n');
+`;
+
+async function waitForClose(child) {
+  const [code, signal] = await once(child, 'close');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+test('parent-owned streams do not appear as stdin', () => {
+  const { readable, writable } = createPipe();
+
+  const child = spawn(process.execPath, ['-e', pipeStdinToStdout], {
+    stdio: [readable, 'pipe', 'inherit'],
+  });
+  assert.strictEqual(child.stdin, null);
+
+  child.kill();
+  readable.destroy();
+  writable.destroy();
+});
+
+test('parent-owned streams do not appear as stdout', () => {
+  const { readable, writable } = createPipe();
+
+  const child = spawn(process.execPath, ['-e', pipeStdinToStdout], {
+    stdio: ['pipe', writable, 'inherit'],
+  });
+  assert.strictEqual(child.stdout, null);
+
+  child.kill();
+  readable.destroy();
+  writable.destroy();
+});
+
+test('parent-owned streams do not appear as stderr', () => {
+  const { readable, writable } = createPipe();
+
+  const child = spawn(process.execPath, ['-e', pipeStdinToStdout], {
+    stdio: ['pipe', 'pipe', writable],
+  });
+  assert.strictEqual(child.stderr, null);
+
+  child.kill();
+  readable.destroy();
+  writable.destroy();
+});
+
+test('child stdin leases readable end and pipes to stdout', async () => {
+  const { readable, writable } = createPipe();
+
+  const child = spawn(process.execPath, ['-e', pipeStdinToStdout], {
+    stdio: [readable, 'pipe', 'inherit'],
+  });
+  const output = text(child.stdout);
+
+  writable.end('abc');
+  await waitForClose(child);
+  assert.strictEqual(await output, 'abc');
+});
+
+test('fd 3 leases readable end and pipes to stdout', async () => {
+  const { readable, writable } = createPipe();
+
+  const child = spawn(process.execPath, ['-e', pipeFd3ToStdout], {
+    stdio: ['ignore', 'pipe', 'inherit', readable],
+  });
+  const output = text(child.stdout);
+
+  writable.end('abc');
+  await waitForClose(child);
+  assert.strictEqual(await output, 'abc');
+});
+
+test('child stdout leases writable end and parent reads output', async () => {
+  const { readable, writable } = createPipe();
+  const child = spawn(process.execPath, ['-e', writeStdout], {
+    stdio: ['ignore', writable, 'inherit'],
+  });
+
+  writable.destroy();
+  await waitForClose(child);
+
+  assert.strictEqual(await text(readable), 'hello stdout\n');
+});
+
+test('child stderr leases writable end and parent reads output', async () => {
+  const { readable, writable } = createPipe();
+  const child = spawn(process.execPath, ['-e', writeStderr], {
+    stdio: ['ignore', 'ignore', writable],
+  });
+
+  writable.destroy();
+
+  assert.strictEqual(await text(readable), 'hello stderr\n');
+  await waitForClose(child);
+});
+
+test('fd 3 leases writable end and parent reads output', async () => {
+  const { readable, writable } = createPipe();
+  const child = spawn(process.execPath, ['-e', writeFd3], {
+    stdio: ['ignore', 'ignore', 'inherit', writable],
+  });
+
+  writable.destroy();
+
+  assert.strictEqual(await text(readable), 'hello fd3\n');
+  await waitForClose(child);
+});
+
+test('parent-owned readable does not flow after child exits',
+  async () => {
+    const { readable, writable } = createPipe();
+    let flowed = '';
+    readable.on('data', (chunk) => {
+      flowed += chunk;
+    });
+    readable.pause();
+
+    const child = spawn(process.execPath, ['-e', writeStdout], {
+      stdio: ['ignore', writable, 'inherit'],
+    });
+
+    writable.destroy();
+    await waitForClose(child);
+
+    assert.strictEqual(flowed, '');
+    assert.strictEqual(readable.readableFlowing, false);
+    assert.strictEqual(await text(readable), 'hello stdout\n');
+  });
+
+test('parent-owned pipes must be explicitly closed in a pipeline', async () => {
+  const { readable, writable } = createPipe();
+  const producer = spawn(process.execPath, [
+    '-e',
+    "process.stdout.write('a')",
+  ], {
+    stdio: ['ignore', writable, 'inherit'],
+  });
+  const consumer = spawn(process.execPath, ['-e', pipeStdinToStdout], {
+    stdio: [readable, 'pipe', 'inherit'],
+  });
+  const output = text(consumer.stdout);
+
+  await waitForClose(producer);
+
+  // The parent owns the pipe endpoints. Close the writable endpoint so the
+  // consumer can observe EOF and close. This is a degenerate case. A 'pipe'
+  // should be used instead of a parent-owned pipe to form a pipeline.
+  writable.destroy();
+  await waitForClose(consumer);
+  assert.strictEqual(await output, 'a');
+});
diff --git a/test/parallel/test-child-process-leased-pipe.js b/test/parallel/test-child-process-leased-pipe.js
new file mode 100644
index 000000000000..2fe45af352ae
--- /dev/null
+++ b/test/parallel/test-child-process-leased-pipe.js
@@ -0,0 +1,76 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const { createPipe } = require('node:net');
+const { test } = require('node:test');
+const { text } = require('node:stream/consumers');
+
+const readOneByteFromStdin = `
+  const fs = require('node:fs');
+  const buffer = Buffer.alloc(1);
+  const count = fs.readSync(0, buffer, 0, 1, null);
+  fs.writeSync(1, buffer.subarray(0, count));
+`;
+
+const writeArgToStdout = `
+  process.stdout.write(process.argv[1]);
+`;
+
+async function waitForClose(child) {
+  const [code, signal] = await once(child, 'close');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+test('parent can lease readable to children sequentially then reclaim', 
+  async () => {
+    const { readable, writable } = createPipe();
+
+    writable.write('abc');
+
+    // child A consumes 'a'
+    const childA = spawn(process.execPath, ['-e', readOneByteFromStdin], {
+      stdio: [readable, 'pipe', 'inherit'],
+    });
+    const outputA = text(childA.stdout);
+
+    await waitForClose(childA);
+    assert.strictEqual(await outputA, 'a');
+
+    // child B consumes 'b'
+    const childB = spawn(process.execPath, ['-e', readOneByteFromStdin], {
+      stdio: [readable, 'pipe', 'inherit'],
+    });
+    const outputB = text(childB.stdout);
+
+    await waitForClose(childB);
+    assert.strictEqual(await outputB, 'b');
+
+    // parent consumes 'c'
+    writable.end();
+    assert.strictEqual(await text(readable), 'c');
+  });
+
+test('parent can lease writable to children sequentially then write',
+  async () => {
+    const { readable, writable } = createPipe();
+
+    // child A writes 'a'
+    const childA = spawn(process.execPath, ['-e', writeArgToStdout, 'a'], {
+      stdio: ['ignore', writable, 'inherit'],
+    });
+    await waitForClose(childA);
+
+    // child B writes 'b'
+    const childB = spawn(process.execPath, ['-e', writeArgToStdout, 'b'], {
+      stdio: ['ignore', writable, 'inherit'],
+    });
+    await waitForClose(childB);
+
+    // parent writes 'c'
+    const output = text(readable);
+    writable.end('c');
+    assert.strictEqual(await output, 'abc');
+  });
+
diff --git a/test/parallel/test-child-process-send-socket-pair.js b/test/parallel/test-child-process-send-socket-pair.js
new file mode 100644
index 000000000000..ba5ee110aba9
--- /dev/null
+++ b/test/parallel/test-child-process-send-socket-pair.js
@@ -0,0 +1,71 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const { createSocketPair } = require('node:net');
+const { test } = require('node:test');
+
+const echoUppercase = `
+  process.on('message', (message, socket) => {
+    if (message === 'done') {
+      process.exit(0);
+      return;
+    }
+
+    socket.once('data', (chunk) => {
+      socket.write(chunk.toString().toUpperCase());
+      process.send('wrote');
+    });
+    socket.resume();
+    process.send('ready');
+  });
+`;
+
+async function waitForClose(child) {
+  const [code, signal] = await once(child, 'close');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+function sendHandle(child, handle) {
+  return new Promise((resolve, reject) => {
+    child.send('socket', handle, { keepOpen: true }, (error) => {
+      if (error) reject(error);
+      else resolve();
+    });
+  });
+}
+
+function tick() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+test('socket pair endpoint can be sent to a child process', async () => {
+  const [left, right] = createSocketPair();
+  const child = spawn(process.execPath, ['-e', echoUppercase], {
+    stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
+  });
+
+  try {
+    left.on('error', (error) => {
+      assert.strictEqual(error.code, 'ECONNRESET');
+    });
+    const ready = once(child, 'message');
+    await sendHandle(child, right);
+    assert.deepStrictEqual(await ready, ['ready', undefined]);
+    await tick();
+    const data = once(left, 'data');
+    const wrote = once(child, 'message');
+    const close = waitForClose(child);
+    left.write('hello child');
+
+    assert.strictEqual((await data)[0].toString(), 'HELLO CHILD');
+    assert.deepStrictEqual(await wrote, ['wrote', undefined]);
+    child.send('done');
+    await close;
+  } finally {
+    child.kill();
+    left.destroy();
+    right.destroy();
+  }
+});
diff --git a/test/parallel/test-child-process-socket-pair-stdio-errors.js b/test/parallel/test-child-process-socket-pair-stdio-errors.js
new file mode 100644
index 000000000000..51caca4adce0
--- /dev/null
+++ b/test/parallel/test-child-process-socket-pair-stdio-errors.js
@@ -0,0 +1,63 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn, spawnSync } = require('node:child_process');
+const { testCreateSocketPair } = require('../common/net-create-socket-pair');
+
+const kSocketPairStdioMessage =
+  /socket pair endpoints cannot be used as child process stdio/;
+
+function assertSocketPairStdioThrows(stdio) {
+  assert.throws(() => {
+    spawn(process.execPath, ['-e', ''], { stdio });
+  }, {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: kSocketPairStdioMessage,
+  });
+}
+
+testCreateSocketPair('socket pair endpoint is rejected as child stdin',
+  (left, right) => {
+    assertSocketPairStdioThrows([right, 'ignore', 'inherit']);
+
+    left.end();
+    right.end();
+  });
+
+testCreateSocketPair('socket pair endpoint is rejected as child stdout',
+  (left, right) => {
+    assertSocketPairStdioThrows(['ignore', right, 'inherit']);
+
+    left.end();
+    right.end();
+  });
+
+testCreateSocketPair('socket pair endpoint is rejected as child stderr',
+  (left, right) => {
+    assertSocketPairStdioThrows(['ignore', 'ignore', right]);
+
+    left.end();
+    right.end();
+  });
+
+testCreateSocketPair('socket pair endpoint is rejected as fd 3',
+  (left, right) => {
+    assertSocketPairStdioThrows(['ignore', 'ignore', 'inherit', right]);
+
+    left.end();
+    right.end();
+  });
+
+testCreateSocketPair('spawnSync rejects socket pair endpoint',
+  (left, right) => {
+    assert.throws(() => {
+      spawnSync(process.execPath, ['-e', ''], {
+        stdio: ['ignore', 'ignore', 'inherit', right],
+      });
+    }, {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: kSocketPairStdioMessage,
+    });
+
+    left.end();
+    right.end();
+  });
diff --git a/test/parallel/test-child-process-validate-stdio.js b/test/parallel/test-child-process-validate-stdio.js
index 5ba6f0fd123c..6e99e0dd8632 100644
--- a/test/parallel/test-child-process-validate-stdio.js
+++ b/test/parallel/test-child-process-validate-stdio.js
@@ -3,6 +3,8 @@
 
 const common = require('../common');
 const assert = require('assert');
+const { createPipe } = require('node:net');
+const { PassThrough } = require('stream');
 const getValidStdio = require('internal/child_process').getValidStdio;
 
 const expectedError = { code: 'ERR_INVALID_ARG_VALUE', name: 'TypeError' };
@@ -43,6 +45,44 @@ assert.throws(() => getValidStdio(stdio2, true),
   assert.throws(() => getValidStdio(stdio), expectedError);
 }
 
+// Pure JavaScript streams do not have an OS handle that can be passed to a
+// child process as stdio.
+{
+  const stdio = [new PassThrough()];
+  assert.throws(() => getValidStdio(stdio), expectedError);
+}
+
+// Parent-owned endpoint streams are normalized to their own stdio type because
+// they lend only the OS handle to the child.
+{
+  const { readable, writable } = createPipe();
+  const result = getValidStdio([readable, writable, 'ignore']);
+
+  assert.strictEqual(result.stdio[0].type, 'leased');
+  assert.strictEqual(result.stdio[0].stream, readable);
+  assert.strictEqual(result.stdio[0].handle, readable._handle);
+  assert.strictEqual(result.stdio[1].type, 'leased');
+  assert.strictEqual(result.stdio[1].stream, writable);
+  assert.strictEqual(result.stdio[1].handle, writable._handle);
+
+  readable.destroy();
+  writable.destroy();
+}
+
+// Parent-owned endpoint streams cannot be used with spawnSync() because the sync
+// process runner only owns stdio pipes it creates internally.
+{
+  const { readable, writable } = createPipe();
+
+  assert.throws(() => getValidStdio([readable, 'ignore', 'ignore'], true), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: /parent-owned endpoint streams are only supported by spawn\(\)/,
+  });
+
+  readable.destroy();
+  writable.destroy();
+}
+
 const { isMainThread } = require('worker_threads');
 
 if (isMainThread) {
diff --git a/test/parallel/test-net-create-pipe-docs.js b/test/parallel/test-net-create-pipe-docs.js
new file mode 100644
index 000000000000..93e51fe9c008
--- /dev/null
+++ b/test/parallel/test-net-create-pipe-docs.js
@@ -0,0 +1,77 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const { test } = require('node:test');
+const { text } = require('node:stream/consumers');
+
+// Keep these examples in sync with the net.createPipe() examples in
+// doc/api/net.md.
+const createPipeCjsExample = `
+  const { spawn } = require('node:child_process');
+  const { createPipe } = require('node:net');
+  const { text } = require('node:stream/consumers');
+
+  const { readable, writable } = createPipe();
+  const child = spawn(process.execPath, ['-e', \`
+    const fs = require('node:fs');
+    const buffer = Buffer.alloc(1);
+    const count = fs.readSync(0, buffer, 0, 1, null);
+    fs.writeSync(1, buffer.subarray(0, count));
+  \`], {
+    stdio: [readable, 'pipe', 'inherit'],
+  });
+
+  const output = text(child.stdout);
+  writable.end('abc');
+
+  child.on('close', async () => {
+    console.log(await output);
+    console.log(await text(readable));
+  });
+`;
+
+const createPipeMjsExample = `
+  import { spawn } from 'node:child_process';
+  import { createPipe } from 'node:net';
+  import { text } from 'node:stream/consumers';
+
+  const { readable, writable } = createPipe();
+  const child = spawn(process.execPath, ['-e', \`
+    const fs = require('node:fs');
+    const buffer = Buffer.alloc(1);
+    const count = fs.readSync(0, buffer, 0, 1, null);
+    fs.writeSync(1, buffer.subarray(0, count));
+  \`], {
+    stdio: [readable, 'pipe', 'inherit'],
+  });
+
+  const output = text(child.stdout);
+  writable.end('abc');
+
+  child.on('close', async () => {
+    console.log(await output);
+    console.log(await text(readable));
+  });
+`;
+
+async function waitForClose(child) {
+  const [code, signal] = await once(child, 'close');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+async function runExample(args, code) {
+  const child = spawn(process.execPath, [...args, code], {
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const output = text(child.stdout);
+
+  await waitForClose(child);
+  assert.strictEqual(await output, 'a\nbc\n');
+}
+
+test('net.createPipe documentation examples', async () => {
+  await runExample(['-e'], createPipeCjsExample);
+  await runExample(['--input-type=module', '-e'], createPipeMjsExample);
+});
diff --git a/test/parallel/test-net-create-pipe-finally.js b/test/parallel/test-net-create-pipe-finally.js
new file mode 100644
index 000000000000..57b11b48d582
--- /dev/null
+++ b/test/parallel/test-net-create-pipe-finally.js
@@ -0,0 +1,45 @@
+'use strict';
+const assert = require('node:assert');
+const { once } = require('node:events');
+const { text } = require('node:stream/consumers');
+const { testCreatePipe } = require('../common/net-create-pipe');
+
+async function raceFinishBeforeRead(readable, writable) {
+  const finish = once(writable, 'finish').then(() => 'finish');
+  const tick = new Promise((resolve) => setImmediate(resolve, 'pending'));
+  writable.end('abc');
+  const result = await Promise.race([finish, tick]);
+
+  readable.resume();
+  await text(readable);
+  await finish;
+  return result;
+}
+
+if (process.platform !== 'win32') {
+  testCreatePipe('net pipe writer can finish before pipe reader consumes',
+    async (readable, writable) => {
+      assert.strictEqual(
+        await raceFinishBeforeRead(readable, writable),
+        'finish');
+    });
+}
+
+if (process.platform === 'win32') {
+  testCreatePipe('net pipe writer finish waits until pipe reader consumes',
+    async (readable, writable) => {
+      assert.strictEqual(
+        await raceFinishBeforeRead(readable, writable),
+        'pending');
+    });
+}
+
+// A possible hack to unify this behavior would be to bypass shutdown for
+// parent-owned net pipe writers would be to add the following to
+// Socket.prototype._final:
+//
+// if (this[kWriterOfPair]) {
+//   debug('_final: pipe pair writable, close handle');
+//   process.nextTick(() => this.destroy());
+//   return cb();
+// }
diff --git a/test/parallel/test-net-create-pipe.js b/test/parallel/test-net-create-pipe.js
new file mode 100644
index 000000000000..777da8689278
--- /dev/null
+++ b/test/parallel/test-net-create-pipe.js
@@ -0,0 +1,22 @@
+'use strict';
+const assert = require('node:assert');
+const { testCreatePipe } = require('../common/net-create-pipe');
+
+testCreatePipe('createPipe returns directional OS-backed streams',
+  (readable, writable) => {
+    assert.strictEqual(readable.readable, true);
+    assert.strictEqual(readable.writable, false);
+    assert.strictEqual(writable.readable, false);
+    assert.strictEqual(writable.writable, true);
+
+    readable.resume();
+    writable.end();
+  });
+
+testCreatePipe('readable starts paused so parent does not pre-consume bytes',
+  (readable, writable) => {
+    assert.strictEqual(readable.readableFlowing, false);
+
+    readable.resume();
+    writable.end();
+  });
diff --git a/test/parallel/test-net-create-socket-pair-docs.js b/test/parallel/test-net-create-socket-pair-docs.js
new file mode 100644
index 000000000000..6a0e7d553d6c
--- /dev/null
+++ b/test/parallel/test-net-create-socket-pair-docs.js
@@ -0,0 +1,93 @@
+'use strict';
+const assert = require('node:assert');
+const { spawn } = require('node:child_process');
+const { once } = require('node:events');
+const { test } = require('node:test');
+const { text } = require('node:stream/consumers');
+
+// Keep these examples in sync with the net.createSocketPair() examples in
+// doc/api/net.md.
+const createSocketPairCjsExample = `
+  const { spawn } = require('node:child_process');
+  const { createSocketPair } = require('node:net');
+
+  const [left, right] = createSocketPair();
+
+  const child = spawn(process.execPath, ['-e', \`
+    process.on('message', (message, socket) => {
+      socket.on('data', (chunk) => {
+        socket.write(chunk.toString().toUpperCase());
+      });
+      socket.resume();
+      process.send('ready');
+    });
+  \`], {
+    stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
+  });
+
+  child.once('message', () => {
+    left.write('hello');
+  });
+
+  left.once('data', (chunk) => {
+    console.log(chunk.toString()); // Prints: HELLO
+    left.destroy();
+    child.kill();
+  });
+
+  child.send('socket', right, { keepOpen: false });
+`;
+
+const createSocketPairMjsExample = `
+  import { spawn } from 'node:child_process';
+  import { createSocketPair } from 'node:net';
+
+  const [left, right] = createSocketPair();
+
+  const child = spawn(process.execPath, ['-e', \`
+    process.on('message', (message, socket) => {
+      socket.on('data', (chunk) => {
+        socket.write(chunk.toString().toUpperCase());
+      });
+      socket.resume();
+      process.send('ready');
+    });
+  \`], {
+    stdio: ['ignore', 'inherit', 'inherit', 'ipc'],
+  });
+
+  child.once('message', () => {
+    left.write('hello');
+  });
+
+  left.once('data', (chunk) => {
+    console.log(chunk.toString()); // Prints: HELLO
+    left.destroy();
+    child.kill();
+  });
+
+  child.send('socket', right, { keepOpen: false });
+`;
+
+async function waitForClose(child) {
+  const [code, signal] = await once(child, 'close');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+async function runExample(args, code, expected) {
+  const child = spawn(process.execPath, [...args, code], {
+    stdio: ['ignore', 'pipe', 'inherit'],
+  });
+  const output = text(child.stdout);
+
+  await waitForClose(child);
+  assert.strictEqual(await output, expected);
+}
+
+test('net.createSocketPair documentation examples', async () => {
+  await runExample(['-e'], createSocketPairCjsExample, 'HELLO\n');
+  await runExample(['--input-type=module', '-e'],
+                   createSocketPairMjsExample,
+                   'HELLO\n');
+});
diff --git a/test/parallel/test-net-create-socket-pair.js b/test/parallel/test-net-create-socket-pair.js
new file mode 100644
index 000000000000..82d7c2a709a3
--- /dev/null
+++ b/test/parallel/test-net-create-socket-pair.js
@@ -0,0 +1,43 @@
+'use strict';
+const assert = require('node:assert');
+const { once } = require('node:events');
+const { text } = require('node:stream/consumers');
+const { testCreateSocketPair } = require('../common/net-create-socket-pair');
+
+testCreateSocketPair('createSocketPair returns connected duplex sockets',
+  (left, right) => {
+    assert.strictEqual(left.readable, true);
+    assert.strictEqual(left.writable, true);
+    assert.strictEqual(right.readable, true);
+    assert.strictEqual(right.writable, true);
+
+    left.end();
+    right.end();
+  });
+
+testCreateSocketPair('socket pair endpoints exchange bytes in both directions',
+  async (left, right) => {
+    const leftData = once(left, 'data');
+    const rightData = once(right, 'data');
+
+    left.write('ping');
+    right.write('pong');
+
+    assert.strictEqual((await leftData)[0].toString(), 'pong');
+    assert.strictEqual((await rightData)[0].toString(), 'ping');
+
+    left.end();
+    right.end();
+  });
+
+testCreateSocketPair('one endpoint can finish before the other endpoint writes',
+  async (left, right) => {
+    const leftOutput = text(left);
+    const rightOutput = text(right);
+
+    left.end('from left');
+    right.end('from right');
+
+    assert.strictEqual(await leftOutput, 'from right');
+    assert.strictEqual(await rightOutput, 'from left');
+  });