diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 4f0c1f58bd2b..2e8dac324f75 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -189,6 +189,7 @@
 # Web Standards
 /lib/internal/bootstrap/web/* @nodejs/web-standards
 /lib/internal/navigator.js @nodejs/web-standards
+/lib/internal/webidl.js @nodejs/web-standards
 /test/fixtures/wpt/ @nodejs/web-standards
 /test/wpt/ @nodejs/web-standards
 
diff --git a/.github/workflows/author-ready-conflicts.yml b/.github/workflows/author-ready-conflicts.yml
new file mode 100644
index 000000000000..f447c6b80a2e
--- /dev/null
+++ b/.github/workflows/author-ready-conflicts.yml
@@ -0,0 +1,48 @@
+name: Unlabel not-ready pull requests
+
+on:
+  schedule:
+    - cron: 15 3 * * *
+
+permissions:
+  contents: read
+
+jobs:
+  remove-label:
+    name: Remove author ready
+    if: github.repository == 'nodejs/node'
+    runs-on: ubuntu-slim
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Remove the label and comment
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MESSAGE: >-
+            This pull request has conflicts with its base branch, removing the
+            `author ready` label.
+
+            Please
+            [rebase](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-5-rebase)
+            your branch onto the latest base branch, resolve the conflicts
+            locally, and force-push.
+
+            Afterwards the pull request needs a fresh collaborator approval,
+            and a collaborator will add the label back once it is
+            [author ready](https://github.com/nodejs/node/blob/HEAD/doc/contributing/collaborator-guide.md#author-ready-pull-requests)
+            again.
+        run: |
+          # Requesting the mergeable field makes GitHub compute the merge state,
+          # pull requests still reported as UNKNOWN are picked up by a later run.
+          gh pr list \
+            --repo "$GITHUB_REPOSITORY" \
+            --label 'author ready' \
+            --state open \
+            --limit 100 \
+            --json number,mergeable \
+            --jq '.[] | select(.mergeable == "CONFLICTING") | .number' |
+            while read -r number; do
+              gh pr edit "$number" --repo "$GITHUB_REPOSITORY" --remove-label 'author ready'
+              printf '%s\n' "$MESSAGE" |
+                gh pr comment "$number" --repo "$GITHUB_REPOSITORY" --body-file -
+            done
diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 271bcfc13fa8..8c01b0592c2e 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -51,7 +51,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 561f8d56813f..924feb42725e 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -69,16 +69,17 @@ jobs:
         include:
           - runner: ubuntu-24.04
             system: x86_64-linux
+            perfetto: true
           - runner: ubuntu-24.04-arm
             system: aarch64-linux
           - runner: macos-15-intel
             system: x86_64-darwin
           - runner: macos-latest
             system: aarch64-darwin
-    name: '${{ matrix.system }}: with shared libraries'
+    name: '${{ matrix.system }}: with shared libraries${{ matrix.perfetto && '' and perfetto'' || '''' }}'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: ${{ inputs.repo || github.repository }}
           ref: refs/pull/${{ inputs.pr_id }}/merge
@@ -92,7 +93,7 @@ jobs:
         env:
           EXPECTED_SHA: ${{ inputs.commit }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -105,7 +106,8 @@ jobs:
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
-            core.exportVariable('SCCACHE_GHA_VERSION', 'on');
+            core.exportVariable('SCCACHE_GHA_ENABLED', 'on');
+            core.exportVariable('SCCACHE_GHA_RW_MODE', 'READ_ONLY');
             core.exportVariable('ACTIONS_CACHE_SERVICE_V2', 'on');
             core.exportVariable('ACTIONS_RESULTS_URL', process.env.ACTIONS_RESULTS_URL || '');
             core.exportVariable('ACTIONS_RUNTIME_TOKEN', process.env.ACTIONS_RUNTIME_TOKEN || '');
@@ -115,14 +117,16 @@ jobs:
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
             --pure --keep TAR_DIR --keep FLAKY_TESTS \
-            --keep SCCACHE_GHA_ENABLED --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
+            --keep SCCACHE_GHA_ENABLED --keep SCCACHE_GHA_RW_MODE \
+            --keep ACTIONS_CACHE_SERVICE_V2 --keep ACTIONS_RESULTS_URL --keep ACTIONS_RUNTIME_TOKEN \
             --arg useSeparateDerivationForV8 true \
+            --arg withPerfetto ${{ matrix.perfetto || false }} \
             --arg loadJSBuiltinsDynamically false \
-            --arg ccache "${NIX_SCCACHE:-null}" \
+            --arg ccache '(import <nixpkgs> {}).sccache' \
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
-                make build-ci -j4 V=1
+              make build-ci -j4 V=1 && sccache --stop-server
             '
           mv out/Release/node base_node
 
@@ -130,19 +134,22 @@ jobs:
         run: git reset FETCH_HEAD --hard
 
       - name: Re-build Node.js on the merge commit
-        # ccache is disabled here to avoid polluting the cache. Local build outputs should make this build relatively quick anyway.
+        # Keep the compiler command unchanged for incremental builds, but never cache PR build outputs.
         run: |
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
-            --pure \
+            --pure --keep SCCACHE_LOCAL_RW_MODE \
             --arg useSeparateDerivationForV8 true \
+            --arg withPerfetto ${{ matrix.perfetto || false }} \
             --arg loadJSBuiltinsDynamically false \
-            --arg ccache 'null' \
+            --arg ccache '(import <nixpkgs> {}).sccache' \
             --arg devTools '[]' \
             --arg benchmarkTools '[]' \
             --run '
                 make build-ci -j4 V=1
             '
+        env:
+          SCCACHE_LOCAL_RW_MODE: READ_ONLY
 
       - name: Run benchmark
         run: |
@@ -195,7 +202,7 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -211,7 +218,7 @@ jobs:
           merge-multiple: true
           path: raw-results
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/build-shared.yml b/.github/workflows/build-shared.yml
index 908116021c27..6b0ef92c3df7 100644
--- a/.github/workflows/build-shared.yml
+++ b/.github/workflows/build-shared.yml
@@ -53,7 +53,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index 248e64bab776..e173d4a544e0 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -76,7 +76,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -104,7 +104,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/actions/install-clang
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 23084c68ac5e..0b83c888ecdc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -24,19 +24,19 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql-config.yml
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           category: /language:${{matrix.language}}
diff --git a/.github/workflows/commit-lint-problem-matcher.json b/.github/workflows/commit-lint-problem-matcher.json
deleted file mode 100644
index 72dd13b9e092..000000000000
--- a/.github/workflows/commit-lint-problem-matcher.json
+++ /dev/null
@@ -1,13 +0,0 @@
-{
-  "problemMatcher": [
-    {
-      "owner": "core-validate-commit",
-      "pattern": [
-        {
-          "regexp": "^not ok \\d+ (.*)$",
-          "message": 1
-        }
-      ]
-    }
-  ]
-}
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 896340ba3a82..037ea7e810e0 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -1,7 +1,7 @@
 name: First commit message adheres to guidelines
 
 on:
-  pull_request:
+  pull_request_target:
     branches:
       - main
 
@@ -9,27 +9,44 @@ env:
   NODE_VERSION: lts/*
 
 permissions:
-  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
 
 jobs:
   lint-commit-message:
+    name: lint-commit-message
     runs-on: ubuntu-slim
     steps:
-      - name: Compute number of commits in the PR
-        id: nb-of-commits
-        run: |
-          echo "plusOne=$((${{ github.event.pull_request.commits }} + 1))" >> $GITHUB_OUTPUT
-          echo "minusOne=$((${{ github.event.pull_request.commits }} - 1))" >> $GITHUB_OUTPUT
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          fetch-depth: ${{ steps.nb-of-commits.outputs.plusOne }}
-          persist-credentials: false
-      - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-      - name: Validate commit message
-        run: |
-          echo "::add-matcher::.github/workflows/commit-lint-problem-matcher.json"
-          git rev-parse HEAD~${{ steps.nb-of-commits.outputs.minusOne }} | xargs npx -q core-validate-commit --no-validate-metadata --tap
+      - name: Validate first commit message
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
+        with:
+          script: |
+            const { data: [commit] } = await github.rest.pulls.listCommits({
+              ...context.repo,
+              pull_number: context.issue.number,
+              per_page: 1,
+            });
+            if (!commit) {
+              throw new Error('No commits found in pull request');
+            }
+            const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [
+              '-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0',
+              '--no-validate-metadata', '--tap', '-',
+            ], {
+              cwd: process.env.RUNNER_TEMP,
+              input: Buffer.from(JSON.stringify([{ id: commit.sha, message: commit.commit.message }])),
+              silent: true,
+              ignoreReturnCode: true,
+            });
+            if (exitCode !== 0) {
+              core.setFailed(stdout + stderr || 'Commit message validation failed');
+            } else {
+              core.info('First commit message passes validation');
+            }
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 4deb0d72b133..600dadc17bc4 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -66,7 +66,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -180,7 +180,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
           PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.lacks_second_approval_prs }}
 
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: steps.get_mergeable_prs.outputs.numbers != ''
         with:
           # A personal token is required because pushing with GITHUB_TOKEN will
diff --git a/.github/workflows/contributor-guidance.yml b/.github/workflows/contributor-guidance.yml
new file mode 100644
index 000000000000..4035ea932077
--- /dev/null
+++ b/.github/workflows/contributor-guidance.yml
@@ -0,0 +1,141 @@
+# This action requires the following secrets to be set on the repository:
+#   GH_USER_TOKEN: GitHub user token, used because FIRST_TIMER and
+#                  FIRST_TIME_CONTRIBUTOR associations are only returned for
+#                  privileged API calls
+
+name: Contributor guidance
+
+on:
+  pull_request_target:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  contributor:
+    name: Resolve contributor status
+    # Avoid allocating a runner unless a welcome or scan is a plausible outcome.
+    if: >-
+      github.run_attempt == 1 &&
+      github.repository == 'nodejs/node' &&
+      github.event.pull_request.user.type != 'Bot' &&
+      (github.event.pull_request.author_association == 'CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'FIRST_TIMER' ||
+      github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
+      github.event.pull_request.author_association == 'NONE')
+    runs-on: ubuntu-slim
+    outputs:
+      is_first_time: ${{ steps.resolve.outputs.is_first_time }}
+      # The event association may not expose private organization membership,
+      # so gate the guidance job on the privileged API result.
+      should_scan: ${{ steps.resolve.outputs.should_scan }}
+    steps:
+      - name: Check author association
+        id: resolve
+        env:
+          EVENT_ASSOCIATION: ${{ github.event.pull_request.author_association }}
+          GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          api_association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
+            --jq '.author_association')
+          echo "API author association: $api_association"
+          echo "Event author association: $EVENT_ASSOCIATION"
+
+          case "$api_association" in
+            FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
+              echo 'is_first_time=true' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+              ;;
+            CONTRIBUTOR|NONE)
+              echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=true' >> "$GITHUB_OUTPUT"
+              ;;
+            COLLABORATOR|MANNEQUIN|MEMBER|OWNER)
+              echo 'is_first_time=false' >> "$GITHUB_OUTPUT"
+              echo 'should_scan=false' >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "Unexpected author association: $api_association" >&2
+              exit 1
+              ;;
+          esac
+
+  guidance:
+    name: Apply contributor guidance
+    needs: contributor
+    if: needs.contributor.outputs.should_scan == 'true'
+    runs-on: ubuntu-slim
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Scan contributor activity
+        id: agentscan
+        # The welcome should still be posted if this advisory scan fails.
+        continue-on-error: true
+        uses: MatteoGabriele/agentscan-action@8112fb79b33fafb8506159df20129a34209ac410  # v2.5.0
+        with:
+          github-token: ${{ github.token }}
+          mode: labels
+          scan-pull-requests: true
+          scan-issues: false
+          auto-close: false
+          honeypot: false
+          # The privileged association check skips trusted authors before this job,
+          # so `trusted-author-associations` would be redundant here.
+          # trusted-author-associations: collaborator,member,owner
+
+      - name: Comment with contributor guidance
+        if: env.IS_FIRST_TIME == 'true' || env.ADD_CAUTION == 'true'
+        env:
+          ADD_CAUTION: >-
+            ${{
+              steps.agentscan.outputs.classification == 'mixed' ||
+              steps.agentscan.outputs.classification == 'automation' ||
+              steps.agentscan.outputs['community-flagged'] == 'true'
+            }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          IS_FIRST_TIME: ${{ needs.contributor.outputs.is_first_time }}
+          NUMBER: ${{ github.event.pull_request.number }}
+          WELCOME_MESSAGE: >2-
+              Welcome to Node.js, and thank you for your first contribution!
+
+            Before review, please take a moment to read:
+
+              * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md)
+              * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md)
+              * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md)
+              * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md)
+              * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
+
+            Please make sure every commit is
+            [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit).
+            For a first pull request, GitHub Actions require collaborator
+            approval and Jenkins CI must be started by a collaborator or triager,
+            so an initial wait is normal.
+          CAUTION_MESSAGE: >-
+            > [!CAUTION]
+
+            > AgentScan found account activity patterns that may be consistent with
+            automation. This is a heuristic, not proof that this pull request was
+            opened by an agent or violates policy. AI-assisted contributions are
+            permitted, but automated tooling must not open pull requests without
+            advance approval, and contributors must personally understand, test,
+            verify, and take responsibility for every submitted change. See the
+            [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}),
+            [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md),
+            and
+            [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
+            for additional context.
+        run: |
+          if [[ "$IS_FIRST_TIME" == "true" && "$ADD_CAUTION" == "true" ]]; then
+            body="$WELCOME_MESSAGE"$'\n\n'"$CAUTION_MESSAGE"
+          elif [[ "$IS_FIRST_TIME" == "true" ]]; then
+            body="$WELCOME_MESSAGE"
+          else
+            body="$CAUTION_MESSAGE"
+          fi
+
+          printf '%s\n' "$body" |
+            gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 92c9f3b88217..7a73d69b70ec 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index e97b759bc6a4..79c6eaaebc91 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -50,7 +50,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
index d0236cd7d609..718c6a51ba24 100644
--- a/.github/workflows/coverage-windows.yml
+++ b/.github/workflows/coverage-windows.yml
@@ -62,7 +62,7 @@ concurrency:
 env:
   PYTHON_VERSION: '3.14'
   FLAKY_TESTS: keep_retrying
-  RUSTC_VERSION: '1.86'
+  RUSTC_VERSION: '1.88'
 
 permissions:
   contents: read
@@ -72,7 +72,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: windows-2025
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
index 883bb48b0df2..735b15ffd12f 100644
--- a/.github/workflows/create-release-proposal.yml
+++ b/.github/workflows/create-release-proposal.yml
@@ -33,14 +33,14 @@ jobs:
       RELEASE_LINE: ${{ inputs.release-line }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           ref: ${{ env.STAGING_BRANCH }}
           persist-credentials: false
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index 8dda0ff75d6e..043de271faa9 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -50,7 +50,7 @@ jobs:
         run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-arm64"))][0].version')" >> $GITHUB_ENV
       - name: Install Node.js
         id: setup-node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NIGHTLY || matrix.node-version }}
           check-latest: true
@@ -62,7 +62,7 @@ jobs:
           SHORT_SHA=$(node -p 'process.version.split(/-nightly\d{8}/)[1]')
           echo "NIGHTLY_REF=$(gh api /repos/nodejs/node/commits/$SHORT_SHA --jq '.sha')" >> $GITHUB_ENV
       - name: Checkout ${{ steps.setup-node.outputs.node-version }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ env.NIGHTLY_REF || steps.setup-node.outputs.node-version }}
@@ -78,7 +78,7 @@ jobs:
         run: rm -rf wpt
         working-directory: test/fixtures
       - name: Checkout epochs/daily WPT
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           repository: web-platform-tests/wpt
           persist-credentials: false
@@ -109,7 +109,7 @@ jobs:
       # version-specific checkout above overwrites .github/actions/
       - name: Checkout undici WPT actions
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           sparse-checkout: |
             .github/actions/undici-wpt-current
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index 6c4b2ec9a4be..b7a616e2df5d 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -16,11 +16,11 @@ jobs:
     if: github.repository == 'nodejs/node' || github.event_name == 'workflow_dispatch'
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build lto
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 6e5dfe732646..693d9ad3dd24 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -24,11 +24,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Build
diff --git a/.github/workflows/find-inactive-collaborators.yml b/.github/workflows/find-inactive-collaborators.yml
index e6e0c7f54f69..8c74fda22428 100644
--- a/.github/workflows/find-inactive-collaborators.yml
+++ b/.github/workflows/find-inactive-collaborators.yml
@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/find-inactive-tsc.yml b/.github/workflows/find-inactive-tsc.yml
index c1804b78d378..d59f26b73b2b 100644
--- a/.github/workflows/find-inactive-tsc.yml
+++ b/.github/workflows/find-inactive-tsc.yml
@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Clone nodejs/TSC repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           path: .tmp
@@ -34,7 +34,7 @@ jobs:
           repository: nodejs/TSC
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/first-time-contributor.yml b/.github/workflows/first-time-contributor.yml
deleted file mode 100644
index f825cd77dc05..000000000000
--- a/.github/workflows/first-time-contributor.yml
+++ /dev/null
@@ -1,147 +0,0 @@
-name: Welcome first-time contributors
-
-on:
-  pull_request_target:
-    types: [opened]
-
-permissions: {}
-
-jobs:
-  first_time_contributor:
-    name: Is first-time contributor
-    # GitHub can report first-time contributors as NONE in the event payload.
-    if: >-
-      github.run_attempt == 1 &&
-      github.repository == 'nodejs/node' &&
-      (github.event.pull_request.author_association == 'FIRST_TIMER' ||
-      github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
-      github.event.pull_request.author_association == 'NONE')
-    runs-on: ubuntu-slim
-    permissions:
-      pull-requests: read
-    outputs:
-      eligible: >-
-        ${{
-          github.event.pull_request.author_association != 'NONE' ||
-          steps.recheck.outputs.eligible == 'true'
-        }}
-    steps:
-      - name: Recheck contributor eligibility
-        id: recheck
-        if: github.event.pull_request.author_association == 'NONE'
-        env:
-          GH_TOKEN: ${{ github.token }}
-          NUMBER: ${{ github.event.pull_request.number }}
-        run: |
-          started_at=$SECONDS
-          for delay in 15 30 60 120; do
-            sleep "$delay"
-            association=$(gh api "/repos/$GITHUB_REPOSITORY/pulls/$NUMBER" \
-              --jq '.author_association')
-            elapsed=$((SECONDS - started_at))
-            echo "Author association after ${elapsed}s: $association"
-
-            case "$association" in
-              FIRST_TIMER|FIRST_TIME_CONTRIBUTOR)
-                echo 'eligible=true' >> "$GITHUB_OUTPUT"
-                exit 0
-                ;;
-              NONE)
-                ;;
-              *)
-                echo 'eligible=false' >> "$GITHUB_OUTPUT"
-                exit 0
-                ;;
-            esac
-          done
-
-          echo 'eligible=false' >> "$GITHUB_OUTPUT"
-
-  agentscan:
-    needs: first_time_contributor
-    if: needs.first_time_contributor.outputs.eligible == 'true'
-    runs-on: ubuntu-slim
-    permissions:
-      contents: read
-    outputs:
-      scan_outcome: ${{ steps.scan.outcome }}
-      classification: ${{ steps.scan.outputs.classification }}
-      community_flagged: ${{ steps.scan.outputs['community-flagged'] }}
-    steps:
-      - name: Scan contributor activity
-        id: scan
-        # The welcome should still be posted if this advisory scan fails.
-        continue-on-error: true
-        uses: MatteoGabriele/agentscan-action@98202262c925c508d4c1424b1dfbe17ee35b0c02  # v2.4.0
-        with:
-          github-token: ${{ github.token }}
-          mode: silent
-          scan-pull-requests: true
-          scan-issues: false
-          auto-close: false
-          honeypot: false
-
-  comment:
-    needs:
-      - first_time_contributor
-      - agentscan
-    if: needs.first_time_contributor.outputs.eligible == 'true'
-    runs-on: ubuntu-slim
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Welcome first-time contributor
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          NUMBER: ${{ github.event.pull_request.number }}
-          AGENTSCAN_OUTCOME: ${{ needs.agentscan.outputs.scan_outcome }}
-          AGENTSCAN_CLASSIFICATION: ${{ needs.agentscan.outputs.classification }}
-          AGENTSCAN_COMMUNITY_FLAGGED: ${{ needs.agentscan.outputs.community_flagged }}
-          WELCOME_MESSAGE: >2-
-              Welcome to Node.js, and thank you for your first contribution!
-
-            Before review, please take a moment to read:
-
-              * the [guide for first-time contributors](https://github.com/nodejs/node/blob/HEAD/doc/contributing/first-contributions.md)
-              * the [contribution and automation policies](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md)
-              * the [pull request guide](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md)
-              * the [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md)
-              * the [Code of Conduct](https://github.com/nodejs/admin/blob/HEAD/CODE_OF_CONDUCT.md)
-
-            Please make sure every commit is
-            [signed off](https://github.com/nodejs/node/blob/HEAD/doc/contributing/pull-requests.md#step-4-commit).
-            For a first pull request, GitHub Actions require collaborator
-            approval and Jenkins CI must be started by a collaborator or triager,
-            so an initial wait is normal.
-          CAUTION_MESSAGE: >-
-            > [!CAUTION]
-
-            > AgentScan found account activity patterns that may be consistent with
-            automation. This is a heuristic, not proof that this pull request was
-            opened by an agent or violates policy. AI-assisted contributions are
-            permitted, but automated tooling must not open pull requests without
-            advance approval, and contributors must personally understand, test,
-            verify, and take responsibility for every submitted change. See the
-            [AgentScan analysis](https://agentscan.tools/user/${{ github.event.pull_request.user.login }}),
-            [AI use policy](https://github.com/nodejs/node/blob/HEAD/doc/contributing/ai-guidelines.md),
-            and
-            [automation policy](https://github.com/nodejs/node/blob/HEAD/CONTRIBUTING.md#automation-and-bots)
-            for additional context.
-        run: |
-          add_caution=false
-          if [[ "$AGENTSCAN_OUTCOME" == "success" ]]; then
-            case "$AGENTSCAN_CLASSIFICATION" in
-              mixed|automation)
-                add_caution=true
-                ;;
-            esac
-            if [[ "$AGENTSCAN_COMMUNITY_FLAGGED" == "true" ]]; then
-              add_caution=true
-            fi
-          fi
-
-          if [[ "$add_caution" == "true" ]]; then
-            printf '%s\n\n%s\n' "$WELCOME_MESSAGE" "$CAUTION_MESSAGE"
-          else
-            printf '%s\n' "$WELCOME_MESSAGE"
-          fi | gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body-file -
diff --git a/.github/workflows/license-builder.yml b/.github/workflows/license-builder.yml
index a95ee13c45f4..3bdf3fc31dcc 100644
--- a/.github/workflows/license-builder.yml
+++ b/.github/workflows/license-builder.yml
@@ -17,7 +17,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - run: ./tools/license-builder.sh  # Run the license builder tool
diff --git a/.github/workflows/lint-release-proposal.yml b/.github/workflows/lint-release-proposal.yml
index e8ffab178458..027aee336ace 100644
--- a/.github/workflows/lint-release-proposal.yml
+++ b/.github/workflows/lint-release-proposal.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 2
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index 6917eb995c9e..848fffc117a1 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -25,11 +25,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint addon docs
@@ -38,7 +38,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -52,12 +52,12 @@ jobs:
     if: ${{ github.event.pull_request && github.event.pull_request.draft == false && github.base_ref == github.event.repository.default_branch }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Set up Python ${{ env.PYTHON_VERSION }}
@@ -89,11 +89,11 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Lint JavaScript files
@@ -137,7 +137,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -163,7 +163,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -186,7 +186,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
@@ -202,7 +202,7 @@ jobs:
     # cannot use ubuntu-24.04-arm here because the docker image is x86 only
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - uses: mszostok/codeowners-validator@7f3f5e28c6d7b8dfae5731e54ce2272ca384592f
@@ -212,7 +212,7 @@ jobs:
     if: ${{ github.event.pull_request }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -227,7 +227,7 @@ jobs:
   lint-readme:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: |
diff --git a/.github/workflows/nix-changes.yml b/.github/workflows/nix-changes.yml
index ed25798152e3..a56cea0936c4 100644
--- a/.github/workflows/nix-changes.yml
+++ b/.github/workflows/nix-changes.yml
@@ -45,7 +45,7 @@ jobs:
     name: '${{ matrix.system }}: dependencies diff'
     runs-on: ${{ matrix.runner }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 2
           persist-credentials: false
@@ -54,7 +54,7 @@ jobs:
             tools/nix/
           sparse-checkout-cone-mode: false
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
@@ -103,12 +103,12 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: '*.nix'
           sparse-checkout-cone-mode: false
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
       - name: Lint Nix files
         run: |
           nix-shell -I nixpkgs=./tools/nix/pkgs.nix -p 'nixfmt-tree' --run '
diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index e709df93a8d7..16bd91bccd2a 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -32,12 +32,15 @@ jobs:
           SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
 
   validateCommitMessage:
+    # If a commit is force-pushed out of the main branch, the `commits` array is
+    # empty and there are no checks to run.
+    if: github.event.commits[0]
     name: Notify on Push on `main` with invalid message
     # cannot use ubuntu-slim here because rtCamp/action-slack-notify is dockerized
     runs-on: ubuntu-24.04-arm
     steps:
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commits
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f84c91e1a381..5042342ca70c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,12 +36,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -76,6 +76,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81  # v4.37.3
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938  # v4.37.9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index 6f1e75813915..a33cf81eaed4 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -36,7 +36,7 @@ env:
   PYTHON_VERSION: '3.14'
   XCODE_VERSION: '16.4'
   CLANG_VERSION: '19'
-  RUSTC_VERSION: '1.86'
+  RUSTC_VERSION: '1.88'
 
 permissions:
   contents: read
@@ -54,7 +54,7 @@ jobs:
       SCCACHE_GHA_ENABLED: 'true'
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index dee3fa98d0dd..497d5156fec9 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -55,7 +55,7 @@ jobs:
     if: (github.event_name == 'schedule' && github.repository == 'nodejs/node') || (github.event.pull_request && github.event.pull_request.draft == false)
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Install Clang ${{ env.CLANG_VERSION }}
diff --git a/.github/workflows/test-linux-perfetto.yml b/.github/workflows/test-linux-perfetto.yml
new file mode 100644
index 000000000000..3dc533720d43
--- /dev/null
+++ b/.github/workflows/test-linux-perfetto.yml
@@ -0,0 +1,70 @@
+name: Test Linux (with Perfetto)
+
+on:
+  workflow_dispatch:
+  pull_request:
+    # Only targeting paths specific to the vendored version of Perfetto, `test-shared`
+    # is taking care of rest of the coverage.
+    paths:
+      - .github/workflows/test-linux-perfetto.yml
+      - common.gypi
+      - configure.py
+      - deps/perfetto/**
+      - node.gyp
+      - node.gypi
+      - tools/v8_gypfiles/v8.gyp
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+env:
+  PYTHON_VERSION: '3.14'
+  FLAKY_TESTS: keep_retrying
+  CLANG_VERSION: '19'
+  CC: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang-19
+  CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++-19
+  SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
+  SCCACHE_IDLE_TIMEOUT: '0'
+  RUSTC_VERSION: '1.88'
+
+permissions:
+  contents: read
+
+jobs:
+  test-perfetto:
+    if: github.event.pull_request.draft == false
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+          path: node
+      - name: Install Clang ${{ env.CLANG_VERSION }}
+        uses: ./node/.github/actions/install-clang
+        with:
+          clang-version: ${{ env.CLANG_VERSION }}
+      - name: Install Rust ${{ env.RUSTC_VERSION }}
+        run: |
+          rustup override set "$RUSTC_VERSION"
+          rustup --version
+      - name: Set up Python ${{ env.PYTHON_VERSION }}
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+          allow-prereleases: true
+      - name: Set up sccache
+        if: github.base_ref == 'main' || github.ref_name == 'main'
+        uses: Mozilla-Actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba  # v0.0.11
+        with:
+          version: v0.17.0
+      - name: Build
+        working-directory: node
+        run: make build-ci -j4 V=1 CONFIG_FLAGS="--error-on-warn --v8-enable-temporal-support --with-perfetto"
+      - name: Test
+        working-directory: node
+        run: make test-ci -j1 V=1 TEST_CI_ARGS="-p actions --measure-flakiness 9"
+      - name: Ensure running tests did not cause any change in the tree
+        working-directory: node
+        run: git add -A && git diff --name-only --exit-code --staged
diff --git a/.github/workflows/test-linux-quic.yml b/.github/workflows/test-linux-quic.yml
index e1a05cf91859..7c77d4668dc6 100644
--- a/.github/workflows/test-linux-quic.yml
+++ b/.github/workflows/test-linux-quic.yml
@@ -37,7 +37,7 @@ env:
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++-19
   SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
   SCCACHE_IDLE_TIMEOUT: '0'
-  RUSTC_VERSION: '1.86'
+  RUSTC_VERSION: '1.88'
 
 permissions:
   contents: read
@@ -47,7 +47,7 @@ jobs:
     if: github.event.pull_request.draft == false
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index 7681a176139d..acd1e04a04ab 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -46,7 +46,7 @@ env:
   CXX: ${{ (github.base_ref == 'main' || github.ref_name == 'main') && 'sccache' || '' }} clang++-19
   SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
   SCCACHE_IDLE_TIMEOUT: '0'
-  RUSTC_VERSION: '1.86'
+  RUSTC_VERSION: '1.88'
 
 permissions:
   contents: read
@@ -60,7 +60,7 @@ jobs:
       matrix:
         os: [ubuntu-24.04, ubuntu-24.04-arm]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index c53bcde2851c..c5638281e5ad 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -68,7 +68,7 @@ env:
   PYTHON_VERSION: '3.14'
   XCODE_VERSION: '16.4'
   FLAKY_TESTS: keep_retrying
-  RUSTC_VERSION: '1.86'
+  RUSTC_VERSION: '1.88'
 
 permissions:
   contents: read
@@ -85,7 +85,7 @@ jobs:
       SCCACHE_GHA_ENABLED: ${{ github.base_ref == 'main' || github.ref_name == 'main' }}
       SCCACHE_IDLE_TIMEOUT: '0'
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
           path: node
diff --git a/.github/workflows/test-shared.yml b/.github/workflows/test-shared.yml
index 8a04fe4d74fc..f7483103016f 100644
--- a/.github/workflows/test-shared.yml
+++ b/.github/workflows/test-shared.yml
@@ -29,10 +29,13 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -82,10 +85,13 @@ on:
       - deps/nghttp2/**
       - deps/ngtcp2/**
       - deps/openssl/*/**
+      - deps/perfetto/**
       - deps/simdjson/**
       - deps/sqlite/**
       - deps/uv/**
       - deps/uvwasi/**
+      - deps/v8/third_party/abseil-cpp/**
+      - deps/v8/third_party/highway/**
       - deps/zlib/**
       - deps/zstd/**
       - doc/**
@@ -117,7 +123,7 @@ jobs:
     name: ${{ github.event_name == 'workflow_dispatch' && 'Skipped job' || 'Build slim tarball' }}
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
@@ -184,7 +190,7 @@ jobs:
           tar xzf tarballs/*.tar.gz -C "$RUNNER_TEMP"
           echo "TAR_DIR=$RUNNER_TEMP/$(basename tarballs/*.tar.gz .tar.gz)" >> "$GITHUB_ENV"
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
         with:
           extra_nix_config: sandbox = true
 
diff --git a/.github/workflows/timezone-update.yml b/.github/workflows/timezone-update.yml
index 94961f8ae6ed..481c20da4e05 100644
--- a/.github/workflows/timezone-update.yml
+++ b/.github/workflows/timezone-update.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout nodejs/node
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Checkout unicode-org/icu-data
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           path: icu-data
           persist-credentials: false
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index e80b65315a4a..097902102685 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -316,7 +316,7 @@ jobs:
               tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
               rm temp-output
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         with:
           persist-credentials: false
@@ -330,7 +330,7 @@ jobs:
           allow-prereleases: true
       - name: Set up Nix
         if: matrix.id == 'nixpkgs-unstable' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342  # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24  # v31.11.1
       - run: ${{ matrix.run }}
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         env:
diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 49f0006526b0..10eb3289a1f7 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -15,7 +15,7 @@ jobs:
     # Cannot use ubuntu-slim here because the update script requires Docker
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Check and download new OpenSSL version
diff --git a/.github/workflows/update-v8.yml b/.github/workflows/update-v8.yml
index e365cf770174..8e71e563896b 100644
--- a/.github/workflows/update-v8.yml
+++ b/.github/workflows/update-v8.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
       - name: Cache node modules and update-v8
@@ -30,7 +30,7 @@ jobs:
             ~/.npm
           key: ${{ runner.os }}-build-${{ env.cache-name }}
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
diff --git a/.github/workflows/update-wpt.yml b/.github/workflows/update-wpt.yml
index 4f752cc18985..7b59a2f137f3 100644
--- a/.github/workflows/update-wpt.yml
+++ b/.github/workflows/update-wpt.yml
@@ -27,12 +27,12 @@ jobs:
         subsystem: ${{ fromJSON(github.event.inputs.subsystems || '["url", "urlpattern", "WebCryptoAPI"]') }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.gitignore b/.gitignore
index 2a7ce3337021..9277cdf090f0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -121,6 +121,7 @@ tools/*/*.i.tmp
 /*.xml
 /v8*-tap.json
 /node_trace.*.log
+/node_trace.*.pftrace
 # coverage related
 /gcovr
 /build
diff --git a/BUILDING.md b/BUILDING.md
index e477d46863f4..04006fbb990f 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -241,7 +241,7 @@ tarball and/or browse the git repository checked out at the relevant tag.
 
 ### Prerequisites
 
-* [A supported version of Python][Python versions] for building and testing.
+* [A supported version of Python][Python versions] (excludes pre-release versions) for building and testing.
 * A Rust toolchain if [building Node.js with Temporal support](#building-nodejs-with-temporal-support).
 * Memory: at least 8GB of RAM is typically required when compiling with 4 parallel jobs (e.g: `make -j4`).
 
@@ -1059,7 +1059,7 @@ Node.js supports the [Temporal](https://github.com/tc39/proposal-temporal) APIs,
 linking statically or dynamically with a version of [temporal\_rs](https://github.com/boa-dev/temporal).
 Building it requires a Rust toolchain:
 
-* rustc >= 1.86 (with LLVM >= 19)
+* rustc >= 1.88 (with LLVM >= 19)
 * cargo >= 1.86
 
 Refer to [Install Rust](https://rust-lang.org/tools/install/) for instructions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 72a9d331c098..b23a413ec223 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,7 +41,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V26.md#26.8.2">26.8.2</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V26.md#26.8.1">26.8.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.8.0">26.8.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.7.0">26.7.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V26.md#26.6.0">26.6.0</a><br/>
@@ -55,7 +56,8 @@ release.
 <a href="doc/changelogs/CHANGELOG_V26.md#26.0.0">26.0.0</a><br/>
   </td>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V24.md#24.20.0">24.20.0</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V24.md#24.21.0">24.21.0</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V24.md#24.20.0">24.20.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.19.0">24.19.0</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.18.1">24.18.1</a><br/>
 <a href="doc/changelogs/CHANGELOG_V24.md#24.18.0">24.18.0</a><br/>
diff --git a/Makefile b/Makefile
index ed049893a243..8dec67750f0c 100644
--- a/Makefile
+++ b/Makefile
@@ -2,6 +2,8 @@
 
 BUILDTYPE ?= Release
 PYTHON ?= python3
+RUFF ?= tools/pip/site-packages/bin/ruff
+YAMLLINT ?= tools/pip/site-packages/bin/yamllint
 DESTDIR ?=
 SIGN ?=
 PREFIX ?= /usr/local
@@ -96,7 +98,7 @@ BUILD_RELEASE_FLAGS ?= $(BUILD_DOWNLOAD_FLAGS) $(BUILD_INTL_FLAGS)
 
 # Default to quiet/pretty builds.
 # To do verbose builds, run `make V=1` or set the V environment variable.
-V ?= 0
+V ?=
 
 # Use -e to double check in case it's a broken link
 available-node = \
@@ -881,6 +883,11 @@ else ifeq ($(OSTYPE),os400)
 # TODO(@nodejs/web-infra): IBMi is currently hanging during HTML minification
 $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json:
 	@echo "Skipping $@ (not currently supported by $(OSTYPE) machines)"
+else ifeq ($(ARCHTYPE),riscv64)
+# Many riscv64 environments (except qemu) fail on the wasm steps here
+# https://github.com/nodejs/build/issues/4099#issuecomment-4038743335
+$(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json:
+	@echo "Skipping $@ (not currently supported by $(DESTCPU) machines)"
 else
 $(apidocs_html) $(apidocs_json) out/doc/api/all.html out/doc/api/all.json &: $(apidoc_sources) tools/doc/node_modules | out/doc/api
 	@if [ "$(shell $(node_use_openssl_and_icu))" != "true" ]; then \
@@ -1312,10 +1319,13 @@ ifeq ($(SKIP_SHARED_DEPS), 1)
 	$(RM) -r $(TARNAME)/deps/ngtcp2
 	find $(TARNAME)/deps/openssl -maxdepth 1 -type f ! -name 'nodejs-openssl.cnf' -exec $(RM) {} +
 	find $(TARNAME)/deps/openssl -mindepth 1 -maxdepth 1 -type d -exec $(RM) -r {} +
+	$(RM) -r $(TARNAME)/deps/perfetto
 	$(RM) -r $(TARNAME)/deps/simdjson
 	$(RM) -r $(TARNAME)/deps/sqlite
 	$(RM) -r $(TARNAME)/deps/uv
 	$(RM) -r $(TARNAME)/deps/uvwasi
+	$(RM) -r $(TARNAME)/deps/v8/third_party/abseil-cpp
+	$(RM) -r $(TARNAME)/deps/v8/third_party/highway
 	$(RM) -r $(TARNAME)/deps/zlib
 	$(RM) -r $(TARNAME)/deps/zstd
 else
@@ -1694,15 +1704,15 @@ lint-py-build: ## Build resources needed to lint python files.
 		$(PYTHON) -m pip install --upgrade --system --target tools/pip/site-packages ruff==0.13.1
 
 .PHONY: lint-py lint-py-fix lint-py-fix-unsafe
-ifneq ("","$(wildcard tools/pip/site-packages/ruff)")
+ifneq ("","$(wildcard $(RUFF))")
 # Lint the Python code with ruff.
 lint-py:
 	$(info Running Python linter...)
-	tools/pip/site-packages/bin/ruff check .
+	$(RUFF) check .
 lint-py-fix:
-	tools/pip/site-packages/bin/ruff check . --fix
+	$(RUFF) check . --fix
 lint-py-fix-unsafe:
-	tools/pip/site-packages/bin/ruff check . --fix --unsafe-fixes
+	$(RUFF) check . --fix --unsafe-fixes
 else
 lint-py lint-py-fix lint-py-fix-unsafe:
 	$(warning Python linting with ruff is not available)
@@ -1718,14 +1728,15 @@ lint-yaml-build: ## Build resources needed to lint YAML files.
 		$(PYTHON) -m pip install --upgrade --system -t tools/pip/site-packages yamllint
 
 .PHONY: lint-yaml
+ifneq ("","$(wildcard $(YAMLLINT))")
 lint-yaml: ## Lint the YAML files with yamllint.
-	@if [ -d "tools/pip/site-packages/yamllint" ]; then \
-			$(info Running YAML linter...) \
-			PYTHONPATH=tools/pip $(PYTHON) -m yamllint .; \
-	else \
-		echo 'YAML linting with yamllint is not available'; \
-		echo "Run 'make lint-yaml-build'"; \
-	fi
+	$(info Running YAML linter...)
+	PYTHONPATH=tools/pip $(YAMLLINT) .
+else
+lint-yaml:
+	$(warning YAML linting with yamllint is not available)
+	$(warning Run 'make lint-yaml-build')
+endif
 
 .PHONY: lint
 .PHONY: lint-ci
diff --git a/README.md b/README.md
index 3827556a44fb..24a76d872f2a 100644
--- a/README.md
+++ b/README.md
@@ -761,6 +761,8 @@ maintaining the Node.js project.
   **Wiyeong Seo** <<hbsps.dev@gmail.com>>
 * [iam-frankqiu](https://github.com/iam-frankqiu) -
   **Frank Qiu** <<iam.frankqiu@gmail.com>> (he/him)
+* [inoway46](https://github.com/inoway46) -
+  **Yuya Inoue** <<inoueyuya416@gmail.com>> (he/him)
 * [milesguicent](https://github.com/milesguicent) -
   **Miles Guicent** <<guicent@pm.me>> (he/him)
 * [preveen-stack](https://github.com/preveen-stack) -
@@ -800,7 +802,6 @@ that server.
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 5BE8A3F6C8A5C01D106C0AD820B1A390B168D356 # Antoine du Hamel
 gpg --keyserver hkps://keys.openpgp.org --recv-keys DD792F5973C6DE52C432CBDAC77ABFA00DDBF2B7 # Juan José Arboleda
 gpg --keyserver hkps://keys.openpgp.org --recv-keys CC68F5A3106FF448322E48ED27F5E38D5B0A215F # Marco Ippolito
-gpg --keyserver hkps://keys.openpgp.org --recv-keys 8FCCA13FEF1D0C2E91008E09770F7A9A5AE15600 # Michaël Zasso
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 890C08DB8579162FEE0DF9DB8BEAB4DFCF555EF4 # Rafael Gonzaga
 gpg --keyserver hkps://keys.openpgp.org --recv-keys C82FA3AE1CBEDC6BE46B9360C43CEC45C17AB93C # Richard Lau
 gpg --keyserver hkps://keys.openpgp.org --recv-keys 108F52B48DB57BB0CC439B2997B01419BD92F80A # Ruy Adorno
diff --git a/benchmark/README.md b/benchmark/README.md
index 8bccdb04d2a5..78a55fba453f 100644
--- a/benchmark/README.md
+++ b/benchmark/README.md
@@ -10,6 +10,7 @@ directory, see [the guide on benchmarks](../doc/contributing/writing-and-running
 ## Table of Contents
 
 * [File tree structure](#file-tree-structure)
+* [`node:bench` evaluation tools](#nodebench-evaluation-tools)
 * [Common API](#common-api)
 
 ## File tree structure
@@ -44,6 +45,8 @@ directories.
 * `common.js`: see [Common API](#common-api).
 * `compare.js`: command line tool for comparing performance between different
   Node.js binaries.
+* `compare-node-bench.js`: parallel comparison tool for explicit `node:bench`
+  files. It does not change or invoke `compare.js`.
 * `compare.R`: R script for statistically analyzing the output of
   `compare.js`
 * `run.js`: command line tool for running individual benchmark suite(s).
@@ -51,9 +54,83 @@ directories.
   between different parameters in benchmark configurations,
   for example to analyze the time complexity. Pass `--analyze` to
   summarize the results without R.
+* `scatter-node-bench.js`: parallel scatter-data tool for an explicit
+  `node:bench` file. It does not change or invoke `scatter.js`.
 * `scatter.R`: R script for visualizing the output of `scatter.js` with
   scatter plots.
 
+## `node:bench` evaluation tools
+
+The `compare-node-bench.js` and `scatter-node-bench.js` tools run explicit
+`node:bench` files without changing the existing benchmark framework or its
+tools. Each repeated observation for a benchmark identity is collected by a
+separate process invocation with one measured sample. Benchmarks declared in
+the same file still execute serially in that process and can share JIT, garbage
+collector, heap, and cache state. This differs from legacy configuration-level
+process isolation and must be considered when comparing the frameworks.
+
+Compare two binaries and analyze the compatible CSV using `compare.R`:
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > compare-node-bench.csv
+Rscript benchmark/compare.R < compare-node-bench.csv
+```
+
+Pass `--analyze` to run the same Welch analysis inline. `--max-regression N`
+implies `--analyze` and makes the command fail only when the Holm-Bonferroni
+adjusted one-sided p-value against the `N%` threshold is below 0.05 and the full
+95% confidence interval is worse than `-N%`. Requiring both conditions prevents
+a noisy point estimate from failing a regression gate.
+
+```console
+./node benchmark/compare-node-bench.js \
+  --old ./node-main --new ./node-pr --runs 30 \
+  --max-regression 5 -- benchmark/crypto/_create-hash.node-bench.js
+```
+
+Collect parameter data for the parallel buffer benchmark and plot it using
+`scatter.R`:
+
+```console
+./node benchmark/scatter-node-bench.js --node ./node --runs 30 -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js \
+  > scatter-node-bench.csv
+Rscript benchmark/scatter.R --xaxis size --category method \
+  --plot scatter-node-bench.png < scatter-node-bench.csv
+```
+
+Pass `--analyze` with an x-axis parameter to summarize the samples without R.
+The output includes mean and median confidence intervals, skew warnings, an
+optional bar chart, and Mann-Whitney U and Cliff's delta comparisons between
+consecutive x-axis values. Use `--category` for a second grouping parameter and
+`--no-chart` to omit the chart.
+
+Because configurations in one file share a process, inline analysis averages
+aggregated configurations into one value per outer process. Consecutive
+x-axis comparisons use alternating, disjoint process sets so the unpaired
+Mann-Whitney test does not treat correlated values as independent samples.
+
+```console
+./node benchmark/scatter-node-bench.js --runs 30 --analyze \
+  --xaxis size --category method -- \
+  benchmark/buffers/_buffer-compare-offset.node-bench.js
+```
+
+A file passed to `scatter-node-bench.js` must use one logical benchmark name.
+Parameter values distinguish its configurations. The tool rejects unstable
+identities and names or parameters that would merge unrelated CSV groups.
+
+The underscore-prefixed benchmark files are parallel ports used to compare the
+measurement frameworks. Legacy discovery ignores them, so the original files
+remain the source benchmarks for `run.js`, `compare.js`, and `scatter.js`. The
+ports use the platform-specific original relative filename as their benchmark
+name and preserve parameter column names to keep CSV grouping compatible. For
+a direct framework comparison, collect the same number of runs from an
+original benchmark with `scatter.js` and from its port with
+`scatter-node-bench.js`, then compare their rate distributions.
+
 ## Common API
 
 The common.js module is used by benchmarks for consistency across repeated
diff --git a/benchmark/_node-bench-analysis.js b/benchmark/_node-bench-analysis.js
new file mode 100644
index 000000000000..bf0f7402b791
--- /dev/null
+++ b/benchmark/_node-bench-analysis.js
@@ -0,0 +1,763 @@
+'use strict';
+
+const { createHistogram } = require('node:perf_hooks');
+const { inspect } = require('node:util');
+
+function createRateHistogram(rates, scale, figures) {
+  const histogram = createHistogram({ figures });
+  for (const rate of rates) {
+    const value = Math.max(1, Math.round(rate * scale));
+    if (!Number.isSafeInteger(value)) {
+      throw new RangeError('Benchmark rate is too large for the histogram scale');
+    }
+    histogram.record(value);
+  }
+  return histogram;
+}
+
+function holmAdjust(pValues) {
+  const order = pValues
+    .map((p, index) => ({ index, p }))
+    .sort((a, b) => a.p - b.p);
+  const adjusted = new Array(order.length);
+  let running = 0;
+  for (let index = 0; index < order.length; index++) {
+    running = Math.max(
+      running,
+      Math.min(1, (order.length - index) * order[index].p),
+    );
+    adjusted[order[index].index] = running;
+  }
+  return adjusted;
+}
+
+function thresholdPValue(oldRates, newHistogram, scale, maxRegression) {
+  const factor = 1 - maxRegression / 100;
+  if (factor <= 0) return 1;
+  const thresholdHistogram = createRateHistogram(
+    oldRates.map((rate) => rate * factor), scale, 3);
+  const result = thresholdHistogram.welchTest(newHistogram);
+  if (Number.isNaN(result.pValue)) return 1;
+  return result.tStatistic > 0 ?
+    result.pValue / 2 : 1 - result.pValue / 2;
+}
+
+function isRegressionFailure(row, maxRegression) {
+  return row.pThresholdAdjusted < 0.05 &&
+         row.improvement + row.ci95 < -maxRegression;
+}
+
+function analyzeCompare(samples, scale, maxRegression) {
+  const groups = new Map();
+  for (const sample of samples) {
+    let group = groups.get(sample.identity);
+    if (group === undefined) {
+      const suffix = sample.configuration === '' ?
+        '' : ` ${sample.configuration}`;
+      group = {
+        name: `${sample.name}${suffix}`,
+        new: [],
+        old: [],
+      };
+      groups.set(sample.identity, group);
+    }
+    group[sample.binary].push(sample.rate);
+  }
+
+  const rows = [];
+  let skipped = 0;
+  for (const { name, old: oldRates, new: newRates } of groups.values()) {
+    if (oldRates.length < 2 || newRates.length < 2) {
+      skipped++;
+      continue;
+    }
+
+    const oldHistogram = createRateHistogram(oldRates, scale, 3);
+    const newHistogram = createRateHistogram(newRates, scale, 3);
+    const oldMean = oldRates.reduce((sum, rate) => sum + rate, 0) /
+      oldRates.length;
+    const newMean = newRates.reduce((sum, rate) => sum + rate, 0) /
+      newRates.length;
+    const improvement = ((newMean - oldMean) / oldMean) * 100;
+    const w95 = oldHistogram.welchTest(newHistogram, { confidence: 0.95 });
+    const w99 = oldHistogram.welchTest(newHistogram, { confidence: 0.99 });
+    const w999 = oldHistogram.welchTest(newHistogram, { confidence: 0.999 });
+    let stars = '';
+    if (w95.pValue < 0.001) stars = '***';
+    else if (w95.pValue < 0.01) stars = ' **';
+    else if (w95.pValue < 0.05) stars = '  *';
+    const ciPercent = (result) => {
+      const half = (result.confidenceInterval.upper -
+                    result.confidenceInterval.lower) / 2;
+      return (half / (oldMean * scale)) * 100;
+    };
+    const row = {
+      ci95: ciPercent(w95),
+      ci99: ciPercent(w99),
+      ci999: ciPercent(w999),
+      improvement,
+      name,
+      pValue: Number.isNaN(w95.pValue) ? 1 : w95.pValue,
+      stars,
+    };
+    if (maxRegression !== undefined) {
+      row.pThreshold = thresholdPValue(
+        oldRates, newHistogram, scale, maxRegression);
+    }
+    rows.push(row);
+  }
+
+  const adjusted = holmAdjust(rows.map(({ pValue }) => pValue));
+  const thresholdAdjusted = maxRegression === undefined ? null :
+    holmAdjust(rows.map(({ pThreshold }) => pThreshold));
+  let underpowered = 0;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    row.pAdjusted = adjusted[index];
+    if (thresholdAdjusted !== null) {
+      row.pThresholdAdjusted = thresholdAdjusted[index];
+    }
+    row.inconclusive = maxRegression > 0 &&
+                       row.stars.trim() === '' &&
+                       row.ci95 > maxRegression;
+    if (row.inconclusive) underpowered++;
+  }
+
+  const output = [];
+  const maxNameLength = rows.reduce(
+    (maximum, { name }) => Math.max(maximum, name.length), 0);
+  const pad = (value, length) =>
+    value + ' '.repeat(Math.max(0, length - value.length));
+  const padStart = (value, length) =>
+    ' '.repeat(Math.max(0, length - value.length)) + value;
+  output.push(`${pad('', maxNameLength)}  confidence` +
+              '   improvement   accuracy (*)    (**)   (***)');
+  for (const row of rows) {
+    const improvement =
+      `${row.improvement >= 0 ? '+' : ''}${row.improvement.toFixed(2)} %`;
+    output.push(
+      `${pad(row.name, maxNameLength)}  ${pad(row.stars, 10)}` +
+      `  ${padStart(improvement, 11)}` +
+      `   ±${row.ci95.toFixed(2)}%` +
+      `  ±${row.ci99.toFixed(2)}%` +
+      `  ±${row.ci999.toFixed(2)}%` +
+      `${row.inconclusive ? '  (inconclusive)' : ''}`,
+    );
+  }
+
+  if (skipped > 0) {
+    output.push('');
+    output.push(
+      `Note: ${skipped} configuration${skipped === 1 ? ' was' : 's were'}` +
+      ' skipped because Welch\'s t-test requires at least 2 samples per' +
+      ' binary. Use --runs 2 or higher.',
+    );
+  }
+  printCompareChart(output, rows, maxNameLength);
+
+  output.push('');
+  output.push(
+    `Rates were scaled by ${scale}x into HdrHistogram (3 significant figures).`,
+    'Use --scale to adjust precision if needed.',
+    '',
+  );
+  const significant = rows.filter(({ pAdjusted }) => pAdjusted < 0.05).length;
+  output.push(
+    'The confidence markers above are per-benchmark and uncorrected. ' +
+    `After Holm-Bonferroni correction across ${rows.length} comparison` +
+    `${rows.length === 1 ? '' : 's'}, ${significant} remain` +
+    `${significant === 1 ? 's' : ''} significant at 5%.`,
+  );
+  if (maxRegression !== undefined) {
+    output.push(
+      `For --max-regression, one-sided p-values against the ` +
+      `${maxRegression}% threshold were corrected separately.`,
+    );
+  }
+
+  if (maxRegression > 0 && underpowered > 0) {
+    output.push('');
+    output.push(
+      `Note: ${underpowered} of ${rows.length} comparison` +
+      `${rows.length === 1 ? '' : 's'} could not resolve an effect as small ` +
+      `as ${maxRegression}% and are marked (inconclusive). Raise --runs to ` +
+      'narrow their confidence intervals.',
+    );
+  }
+
+  const failures = maxRegression !== undefined ?
+    rows.filter((row) => isRegressionFailure(row, maxRegression)) : [];
+  if (failures.length > 0) {
+    output.push('');
+    output.push(
+      `FAIL: ${failures.length} benchmark${failures.length === 1 ? '' : 's'}` +
+      ` regressed by more than ${maxRegression}% (the 95% interval excludes ` +
+      `the threshold and its one-sided test is family-wise corrected across ` +
+      `${rows.length} comparisons):`,
+    );
+    for (const failure of failures) {
+      output.push(
+        `  ${failure.name}  ${failure.improvement.toFixed(2)}% ` +
+        `(95% CI up to ${(failure.improvement + failure.ci95).toFixed(2)}%, ` +
+        `adjusted threshold p=` +
+        `${failure.pThresholdAdjusted.toExponential(2)})`,
+      );
+    }
+  }
+
+  return {
+    failed: failures.length > 0,
+    output: `${output.join('\n')}\n`,
+    rows,
+  };
+}
+
+function printCompareChart(output, rows, maxNameLength) {
+  if (rows.length === 0) return;
+  const width = 40;
+  const halfWidth = width / 2;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(maximum, Math.abs(row.improvement) + row.ci95);
+  }
+  if (maximum === 0) maximum = 1;
+  const left = `-${maximum.toFixed(1)}%`;
+  const right = `+${maximum.toFixed(1)}%`;
+  const centerLabel = '0%';
+  const labelPadding = maxNameLength + 5;
+  output.push('');
+  output.push(
+    ' '.repeat(labelPadding) + left +
+    ' '.repeat(Math.max(
+      0, halfWidth - left.length - Math.floor(centerLabel.length / 2))) +
+    centerLabel +
+    ' '.repeat(Math.max(
+      0, halfWidth - Math.ceil(centerLabel.length / 2) - right.length)) +
+    right,
+  );
+  for (const row of rows) {
+    const center = halfWidth;
+    const result = center + (row.improvement / maximum) * halfWidth;
+    const lower = center +
+      ((row.improvement - row.ci95) / maximum) * halfWidth;
+    const upper = center +
+      ((row.improvement + row.ci95) / maximum) * halfWidth;
+    let bar = '';
+    for (let index = 0; index < width; index++) {
+      const position = index + 0.5;
+      if (index === Math.floor(center)) {
+        bar += '|';
+      } else if ((row.improvement >= 0 &&
+                  position > center && position <= result) ||
+                 (row.improvement < 0 &&
+                  position < center && position >= result)) {
+        bar += row.stars === '' ? '▓' : '█';
+      } else if (position >= lower && position <= upper) {
+        bar += '░';
+      } else {
+        bar += ' ';
+      }
+    }
+    const label = `${row.improvement >= 0 ? '+' : ''}` +
+      `${row.improvement.toFixed(2)}%`;
+    output.push(
+      `${row.name.padEnd(maxNameLength)}  ${bar}  ${label} ${row.stars.trim()}`,
+    );
+  }
+}
+
+function histogramScale(rates) {
+  let minimum = Infinity;
+  let maximum = 0;
+  for (const rate of rates) {
+    if (rate > 0 && rate < minimum) minimum = rate;
+    if (rate > maximum) maximum = rate;
+  }
+  if (!Number.isFinite(minimum) || maximum === 0) return 1;
+  let scale = 1;
+  while (minimum * scale < 1e6 && maximum * scale < 1e15) scale *= 10;
+  return scale;
+}
+
+function validateScatterParameters(samples, xAxis, category) {
+  if (category !== undefined && category === xAxis) {
+    throw new Error('--xaxis and --category must name different parameters');
+  }
+  for (const key of [xAxis, category]) {
+    if (key === undefined) continue;
+    if (samples.some(({ params }) =>
+      !Object.hasOwn(params, key))) {
+      const available = [...new Set(samples.flatMap(
+        ({ params }) => Object.keys(params)))].sort();
+      throw new Error(
+        `The variable '${key}' is not present in every configuration. ` +
+        `Available variables: ${available.join(', ')}`,
+      );
+    }
+  }
+}
+
+function analyzeScatter(samples, xAxis, category, showChart) {
+  validateScatterParameters(samples, xAxis, category);
+
+  const parameterNames = [...new Set(samples.flatMap(
+    ({ params }) => Object.keys(params)))];
+  const aggregated = parameterNames.filter((name) => {
+    if (name === xAxis || name === category) return false;
+    const first = samples[0].params[name];
+    return samples.some(({ params }) => params[name] !== first);
+  });
+  const groups = new Map();
+  for (const sample of samples) {
+    const xValue = sample.params[xAxis];
+    const categoryValue = category === undefined ?
+      undefined : sample.params[category];
+    const key = valueKey([xValue, categoryValue]);
+    let group = groups.get(key);
+    if (group === undefined) {
+      group = {
+        categoryValue,
+        members: [],
+        observations: new Map(),
+        xValue,
+      };
+      groups.set(key, group);
+    }
+    group.members.push(sample);
+    let rates = group.observations.get(sample.observation);
+    if (rates === undefined) {
+      rates = [];
+      group.observations.set(sample.observation, rates);
+    }
+    rates.push(sample.rate);
+  }
+  for (const group of groups.values()) {
+    group.processRates = [...group.observations].map(([observation, rates]) => ({
+      observation,
+      rate: rates.reduce((sum, rate) => sum + rate, 0) / rates.length,
+    }));
+    group.rates = group.processRates.map(({ rate }) => rate);
+  }
+
+  const scale = histogramScale(samples.map(({ rate }) => rate));
+  const compareValues = (a, b) => {
+    if (typeof a === 'number' && typeof b === 'number') return a - b;
+    return String(a).localeCompare(String(b));
+  };
+  const rows = [...groups.values()]
+    .sort((a, b) => compareValues(a.xValue, b.xValue) ||
+                    compareValues(a.categoryValue, b.categoryValue))
+    .map((group) => {
+      const histogram = createRateHistogram(group.rates, scale, 5);
+      const count = group.rates.length;
+      const mean = group.rates.reduce((sum, rate) => sum + rate, 0) / count;
+      const meanInterval = histogram.meanCI();
+      const confidenceInterval = count > 1 ?
+        (meanInterval.upper - meanInterval.lower) / (2 * scale) : NaN;
+      const medianInterval = histogram.percentileCI(50);
+      const median = rawMedian(group.rates);
+      const skewed = count > 1 &&
+        (Math.abs(histogram.skewness) > 1 ||
+         Math.abs(median - mean) > confidenceInterval);
+      return {
+        ...group,
+        confidenceInterval,
+        count,
+        histogram,
+        mean,
+        median,
+        medianLower: medianInterval.lower / scale,
+        medianUpper: medianInterval.upper / scale,
+        skewed,
+      };
+    });
+
+  const legend = assignLabels(rows, 'xValue', 'xLabel');
+  if (category !== undefined) {
+    legend.push(...assignLabels(rows, 'categoryValue', 'categoryLabel'));
+  }
+  const output = [];
+  const contamination = new Map();
+  for (const variable of aggregated) {
+    const share = varianceShare([...groups.values()], variable);
+    contamination.set(variable, share);
+    const percent = share === 1 ?
+      '100' : (share >= 0.995 ? '>99' : (share * 100).toFixed(0));
+    const suffix = Number.isNaN(share) ?
+      '' : ` (explains ${percent}% of within-group variance)`;
+    output.push(`aggregating variable: ${variable}${suffix}`);
+  }
+  const dominant = aggregated.filter(
+    (variable) => contamination.get(variable) > 0.5);
+  if (dominant.length > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `${dominant.join(', ')} ${dominant.length === 1 ? 'explains' : 'explain'} ` +
+      'most of the spread within each group. Pin the parameter or use it as ' +
+      '--category; increasing --runs will not remove this source of variance.',
+    );
+  }
+  if (aggregated.length > 0) output.push('');
+  printScatterTable(output, rows, xAxis, category);
+  if (showChart) printScatterChart(output, rows, xAxis, category);
+  printScatterComparisons(output, rows, xAxis, category);
+  if (legend.length > 0) {
+    output.push('', 'Abbreviated values:');
+    for (const { full, label } of legend) {
+      output.push(`  ${label}`, `    = ${full}`);
+    }
+  }
+  const singleSample = rows.filter(({ count }) => count < 2).length;
+  if (singleSample > 0) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: ${singleSample} group${singleSample === 1 ? ' has' : 's have'} ` +
+      'only one sample, so no confidence interval could be estimated. Use ' +
+      '--runs 2 or higher.',
+    );
+  }
+  if (rows.some(({ skewed }) => skewed)) {
+    output.push('');
+    wrapOutput(
+      output,
+      '(!) marks groups where the median falls outside the mean confidence ' +
+      'interval or the sample is strongly skewed. The median and its interval ' +
+      'describe the typical run better for those groups.',
+    );
+  }
+  return `${output.join('\n')}\n`;
+}
+
+function rawMedian(rates) {
+  const sorted = [...rates].sort((a, b) => a - b);
+  const middle = Math.floor(sorted.length / 2);
+  return sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+}
+
+function valueKey(value) {
+  return JSON.stringify(value, (_, item) => {
+    if (typeof item === 'bigint') return { bigint: String(item) };
+    return item;
+  });
+}
+
+function varianceShare(groups, variable) {
+  let between = 0;
+  let total = 0;
+  for (const group of groups) {
+    if (group.members.length < 2) continue;
+    const mean = group.members.reduce(
+      (sum, sample) => sum + sample.rate, 0) / group.members.length;
+    const levels = new Map();
+    for (const sample of group.members) {
+      const key = valueKey(sample.params[variable]);
+      let level = levels.get(key);
+      if (level === undefined) {
+        level = { count: 0, sum: 0 };
+        levels.set(key, level);
+      }
+      level.count++;
+      level.sum += sample.rate;
+    }
+    for (const level of levels.values()) {
+      between += level.count * ((level.sum / level.count) - mean) ** 2;
+    }
+    for (const sample of group.members) total += (sample.rate - mean) ** 2;
+  }
+  return total === 0 ? NaN : Math.min(1, between / total);
+}
+
+function effectSizeLabel(delta) {
+  const absolute = Math.abs(delta);
+  if (absolute < 0.147) return 'negligible';
+  if (absolute < 0.33) return 'small';
+  if (absolute < 0.474) return 'medium';
+  return 'large';
+}
+
+const mannWhitneyFloors = new Map();
+function mannWhitneyFloor(firstCount, secondCount) {
+  const key = `${firstCount},${secondCount}`;
+  let floor = mannWhitneyFloors.get(key);
+  if (floor !== undefined) return floor;
+  const low = createHistogram({ figures: 5 });
+  const high = createHistogram({ figures: 5 });
+  for (let index = 0; index < firstCount; index++) low.record(10000 + index);
+  for (let index = 0; index < secondCount; index++) {
+    high.record(10000 + firstCount + index);
+  }
+  floor = high.mannWhitneyTest(low).pValue;
+  mannWhitneyFloors.set(key, floor);
+  return floor;
+}
+
+function printScatterComparisons(output, rows, xAxis, category) {
+  const usable = rows.filter(({ count }) => count > 1);
+  if (usable.length < 2) return;
+  const series = new Map();
+  for (const row of usable) {
+    const key = valueKey(row.categoryValue);
+    if (!series.has(key)) series.set(key, []);
+    series.get(key).push(row);
+  }
+  const sections = [];
+  let floor = 0;
+  for (const group of series.values()) {
+    if (group.length < 2) continue;
+    const entries = [];
+    for (let index = 1; index < group.length; index++) {
+      const previous = group[index - 1];
+      const current = group[index];
+      // Configurations in one file share a process. Split consecutive groups
+      // across disjoint outer-process sets so the unpaired test does not treat
+      // correlated observations as independent.
+      const parity = index % 2;
+      const previousRates = previous.processRates
+        .filter(({ observation }) => observation % 2 === parity)
+        .map(({ rate }) => rate);
+      const currentRates = current.processRates
+        .filter(({ observation }) => observation % 2 !== parity)
+        .map(({ rate }) => rate);
+      if (previousRates.length === 0 || currentRates.length === 0) continue;
+      const comparisonScale = histogramScale([
+        ...previousRates,
+        ...currentRates,
+      ]);
+      const previousHistogram =
+        createRateHistogram(previousRates, comparisonScale, 5);
+      const currentHistogram =
+        createRateHistogram(currentRates, comparisonScale, 5);
+      const { pValue } = currentHistogram.mannWhitneyTest(previousHistogram);
+      const delta = currentHistogram.cliffsD(previousHistogram);
+      const previousMean = previousRates.reduce(
+        (sum, rate) => sum + rate, 0) / previousRates.length;
+      const currentMean = currentRates.reduce(
+        (sum, rate) => sum + rate, 0) / currentRates.length;
+      const change = ((currentMean - previousMean) / previousMean) * 100;
+      floor = Math.max(
+        floor, mannWhitneyFloor(previousRates.length, currentRates.length));
+      let ratio = '';
+      let exponent = '';
+      if (typeof previous.xValue === 'number' &&
+          typeof current.xValue === 'number' &&
+          previous.xValue > 0 && current.xValue > 0 &&
+          previous.xValue !== current.xValue &&
+          previousMean > 0 && currentMean > 0) {
+        const xRatio = current.xValue / previous.xValue;
+        const value = Math.log(currentMean / previousMean) / Math.log(xRatio);
+        ratio = `${xRatio.toFixed(1)}x`;
+        exponent = `${value >= 0 ? '+' : ''}${value.toFixed(2)}`;
+      }
+      entries.push(
+        `    ${previous.xLabel} -> ${current.xLabel}` +
+        `  ${change >= 0 ? '+' : ''}${change.toFixed(2)}%` +
+        (exponent === '' ? '' : `  ${ratio}  exponent=${exponent}`) +
+        `  p=${pValue < 1e-4 ? pValue.toExponential(1) : pValue.toFixed(4)}` +
+        `  delta=${delta >= 0 ? '+' : ''}${delta.toFixed(3)}` +
+        ` (${effectSizeLabel(delta)})`,
+      );
+    }
+    if (entries.length > 0) {
+      sections.push({
+        entries,
+        heading: category === undefined ?
+          undefined : `${category}=${group[0].categoryLabel}`,
+      });
+    }
+  }
+  if (sections.length === 0) return;
+  output.push('', `Change between consecutive ${xAxis} values ` +
+                  `(Mann-Whitney U on disjoint process sets, Cliff's delta):`);
+  for (const section of sections) {
+    output.push('');
+    if (section.heading !== undefined) output.push(`  ${section.heading}`);
+    output.push(...section.entries);
+  }
+  if (floor >= 0.05) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Warning: at this sample size the smallest p-value this test can ` +
+      `produce is ${floor.toFixed(4)}, so no comparison above can reach ` +
+      'significance. Raise --runs.',
+    );
+  } else if (floor >= 0.005) {
+    output.push('');
+    wrapOutput(
+      output,
+      `Note: at this sample size the smallest p-value this test can produce ` +
+      `is ${floor.toFixed(4)}. Raise --runs to strengthen non-significant ` +
+      'results.',
+    );
+  }
+}
+
+function formatRate(rate) {
+  return rate.toLocaleString('en-US', {
+    maximumFractionDigits: 1,
+    minimumFractionDigits: 1,
+  });
+}
+
+function displayWidth(value) {
+  return [...value].length;
+}
+
+function pad(value, width, right) {
+  const padding = ' '.repeat(Math.max(0, width - displayWidth(value)));
+  return right ? padding + value : value + padding;
+}
+
+function truncateMiddle(value, maximum = 24) {
+  const characters = [...value];
+  if (characters.length <= maximum) return value;
+  const retained = maximum - 3;
+  const head = Math.ceil(retained / 2);
+  const tail = Math.floor(retained / 2);
+  return `${characters.slice(0, head).join('')}...` +
+         characters.slice(-tail).join('');
+}
+
+function assignLabels(rows, valueName, labelName) {
+  const assigned = new Map();
+  const used = new Map();
+  const legend = [];
+  for (const row of rows) {
+    const key = valueKey(row[valueName]);
+    let label = assigned.get(key);
+    if (label === undefined) {
+      const full = typeof row[valueName] === 'string' ?
+        inspect(row[valueName]) : String(row[valueName]);
+      const abbreviated = truncateMiddle(full);
+      const collisions = used.get(abbreviated) ?? 0;
+      used.set(abbreviated, collisions + 1);
+      label = collisions === 0 ?
+        abbreviated : `${abbreviated}~${collisions + 1}`;
+      assigned.set(key, label);
+      if (label !== full) legend.push({ full, label });
+    }
+    row[labelName] = label;
+  }
+  return legend;
+}
+
+function printScatterTable(output, rows, xAxis, category) {
+  const header = [xAxis];
+  if (category !== undefined) header.push(category);
+  header.push(
+    'samples', 'rate', 'confidence.interval', 'median', 'median.interval', '');
+  const body = rows.map((row) => {
+    const values = [row.xLabel];
+    if (category !== undefined) values.push(row.categoryLabel);
+    const medianInterval = row.count > 1 ?
+      `[${(((row.medianLower - row.median) / row.median) * 100).toFixed(2)}%, ` +
+      `+${(((row.medianUpper - row.median) / row.median) * 100).toFixed(2)}%]` :
+      'NA';
+    values.push(
+      String(row.count),
+      formatRate(row.mean),
+      Number.isNaN(row.confidenceInterval) ?
+        'NA' :
+        `${formatRate(row.confidenceInterval)} ` +
+        `(±${((row.confidenceInterval / row.mean) * 100).toFixed(2)}%)`,
+      formatRate(row.median),
+      medianInterval,
+      row.skewed ? '(!)' : '',
+    );
+    return values;
+  });
+  const widths = header.map((value, index) => Math.max(
+    displayWidth(value),
+    ...body.map((values) => displayWidth(values[index])),
+  ));
+  const right = [typeof rows[0].xValue === 'number'];
+  if (category !== undefined) {
+    right.push(typeof rows[0].categoryValue === 'number');
+  }
+  right.push(true, true, true, true, true, false);
+  const format = (values) => values.map(
+    (value, index) => pad(value, widths[index], right[index])).join('  ').trimEnd();
+  output.push(format(header));
+  for (const values of body) output.push(format(values));
+}
+
+function printScatterChart(output, rows, xAxis, category) {
+  if (rows.length === 0) return;
+  const width = 40;
+  let maximum = 0;
+  for (const row of rows) {
+    maximum = Math.max(
+      maximum,
+      row.mean + (Number.isNaN(row.confidenceInterval) ?
+        0 : row.confidenceInterval),
+    );
+  }
+  if (maximum === 0) return;
+  const labels = rows.map((row) => {
+    let label = `${xAxis}=${row.xLabel}`;
+    if (category !== undefined) label += ` ${category}=${row.categoryLabel}`;
+    return truncateMiddle(label, 44);
+  });
+  const labelWidth = Math.max(...labels.map(displayWidth));
+  const rateWidth = Math.max(...rows.map(({ mean }) =>
+    displayWidth(formatRate(mean))));
+  const axis = formatRate(maximum);
+  const indent = ' '.repeat(labelWidth + 2);
+  output.push(
+    '',
+    'Rate in operations/second; longer is faster. │ marks the mean and the',
+    'shaded band (░) is its 95% confidence interval.',
+    '',
+    `${indent}0${' '.repeat(Math.max(1, width - 1 - displayWidth(axis)))}${axis}`,
+    `${indent}+${'-'.repeat(width - 2)}+`,
+  );
+  let previous;
+  for (let index = 0; index < rows.length; index++) {
+    const row = rows[index];
+    if (previous !== undefined && previous !== row.xValue) output.push('');
+    previous = row.xValue;
+    const interval = Number.isNaN(row.confidenceInterval) ?
+      0 : row.confidenceInterval;
+    const end = (row.mean / maximum) * width;
+    const lower = ((row.mean - interval) / maximum) * width;
+    const upper = ((row.mean + interval) / maximum) * width;
+    const meanCell = Math.min(width - 1, Math.floor(end));
+    let bar = '';
+    for (let cell = 0; cell < width; cell++) {
+      const position = cell + 0.5;
+      if (cell === meanCell) bar += '│';
+      else if (position >= lower && position <= upper) bar += '░';
+      else if (position <= end) bar += '█';
+      else bar += ' ';
+    }
+    output.push(
+      `${pad(labels[index], labelWidth, false)}  ${bar}  ` +
+      pad(formatRate(row.mean), rateWidth, true),
+    );
+  }
+}
+
+function wrapOutput(output, text, width = 76) {
+  let line = '';
+  for (const word of text.split(/\s+/)) {
+    if (line === '') line = word;
+    else if (displayWidth(line) + displayWidth(word) + 1 <= width) {
+      line += ` ${word}`;
+    } else {
+      output.push(line);
+      line = word;
+    }
+  }
+  if (line !== '') output.push(line);
+}
+
+module.exports = {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+  validateScatterParameters,
+};
diff --git a/benchmark/_node-bench.js b/benchmark/_node-bench.js
new file mode 100644
index 000000000000..6c8d1acffdfa
--- /dev/null
+++ b/benchmark/_node-bench.js
@@ -0,0 +1,159 @@
+'use strict';
+
+const { spawn } = require('node:child_process');
+const path = require('node:path');
+const { inspect } = require('node:util');
+
+function parseInteger(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (!/^(?:0|[1-9]\d*)$/.test(value)) {
+    throw new TypeError(`${name} must be an integer`);
+  }
+  const number = Number(value);
+  if (!Number.isSafeInteger(number) || number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function parseNumber(value, defaultValue, name, minimum) {
+  if (value === undefined) return defaultValue;
+  if (value.trim() === '') throw new TypeError(`${name} must be a number`);
+  const number = Number(value);
+  if (!Number.isFinite(number)) throw new TypeError(`${name} must be a number`);
+  if (number < minimum) {
+    throw new RangeError(`${name} must be at least ${minimum}`);
+  }
+  return number;
+}
+
+function csvEncode(value) {
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return String(value);
+  }
+  const string = String(value);
+  return `"${string.replace(/"/g, '""')}"`;
+}
+
+function formatConfiguration(params) {
+  return Object.keys(params)
+    .map((key) => `${key}=${inspect(params[key])}`)
+    .join(' ');
+}
+
+function durationToSeconds(duration) {
+  if (!/^\d+$/.test(duration)) {
+    throw new TypeError(`Invalid benchmark duration '${duration}'`);
+  }
+  const padded = duration.padStart(10, '0');
+  return `${padded.slice(0, -9)}.${padded.slice(-9)}`;
+}
+
+function runBenchmark(binary, file, options) {
+  const args = [
+    ...options.nodeArgs,
+    '--no-warnings',
+    '--bench',
+    '--bench-reporter=json',
+    '--bench-samples=1',
+    `--bench-warmup=${options.warmup}`,
+  ];
+  if (options.namePattern !== undefined) {
+    args.push(`--bench-name-pattern=${options.namePattern}`);
+  }
+  args.push('--', path.resolve(file));
+
+  return new Promise((resolve, reject) => {
+    const child = spawn(binary, args, {
+      env: process.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (data) => { stdout += data; });
+    child.stderr.on('data', (data) => { stderr += data; });
+    child.once('error', reject);
+    child.once('close', (code, signal) => {
+      let records;
+      try {
+        records = stdout.trim().split('\n')
+          .filter((line) => line.length > 0)
+          .map((line) => JSON.parse(line));
+      } catch (error) {
+        reject(new Error(
+          `Could not parse benchmark output from '${binary}': ${error.message}`,
+          { cause: error },
+        ));
+        return;
+      }
+
+      const summary = records.findLast(
+        ({ type }) => type === 'bench:summary')?.data;
+      if (code !== 0 || signal !== null || summary?.success !== true) {
+        const diagnostics = records
+          .filter(({ type }) => type === 'bench:diagnostic')
+          .map(({ data }) => data.message)
+          .join('\n');
+        const status = signal === null ? `exit code ${code}` : `signal ${signal}`;
+        const details = stderr || diagnostics;
+        reject(new Error(
+          `Benchmark '${file}' failed with ${status}` +
+          (details ? `:\n${details}` : ''),
+        ));
+        return;
+      }
+
+      const samples = [];
+      for (const record of records) {
+        if (record.type !== 'bench:complete' ||
+            record.data.skip !== undefined) {
+          continue;
+        }
+        if (record.data.error !== undefined) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' failed: ` +
+            record.data.error.message,
+          ));
+          return;
+        }
+        if (record.data.samples.length !== 1) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' did not produce exactly one sample`,
+          ));
+          return;
+        }
+        const sample = record.data.samples[0];
+        if (!Number.isFinite(sample.rate)) {
+          reject(new Error(
+            `Benchmark '${record.data.name}' produced a non-finite rate`,
+          ));
+          return;
+        }
+        samples.push({
+          configuration: formatConfiguration(record.data.params),
+          duration: durationToSeconds(sample.duration_ns),
+          identity: record.data.benchId,
+          logicalIdentity: JSON.stringify([
+            record.data.file,
+            record.data.parentId,
+            record.data.name,
+          ]),
+          name: record.data.name,
+          params: record.data.params,
+          rate: sample.rate,
+        });
+      }
+      resolve(samples);
+    });
+  });
+}
+
+module.exports = {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+};
diff --git a/benchmark/buffers/_buffer-compare-offset.node-bench.js b/benchmark/buffers/_buffer-compare-offset.node-bench.js
new file mode 100644
index 000000000000..b16c3a3da7db
--- /dev/null
+++ b/benchmark/buffers/_buffer-compare-offset.node-bench.js
@@ -0,0 +1,37 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const path = require('node:path');
+
+const methods = ['offset', 'slice'];
+const sizes = [16, 512, 4096, 16386];
+const n = 1e6;
+const name = path.join('buffers', 'buffer-compare-offset.js');
+
+function compareUsingSlice(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    Buffer.compare(b0.slice(1, len), b1.slice(1, len));
+}
+
+function compareUsingOffset(b0, b1, len, iterations) {
+  for (let i = 0; i < iterations; i++)
+    b0.compare(b1, 1, len, 1, len);
+}
+
+for (const method of methods) {
+  for (const size of sizes) {
+    const compare = method === 'slice' ?
+      compareUsingSlice : compareUsingOffset;
+
+    bench(name, {
+      params: { method, n, size },
+    }, (b) => {
+      b.start();
+      compare(Buffer.alloc(size, 'a'),
+              Buffer.alloc(size, 'b'),
+              size >> 1,
+              n);
+      b.end(n);
+    });
+  }
+}
diff --git a/benchmark/compare-node-bench.js b/benchmark/compare-node-bench.js
new file mode 100644
index 000000000000..295f15f0fdc1
--- /dev/null
+++ b/benchmark/compare-node-bench.js
@@ -0,0 +1,118 @@
+'use strict';
+
+const path = require('node:path');
+const CLI = require('./_cli.js');
+const { analyzeCompare } = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  parseNumber,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node compare-node-bench.js [options] [--] <file> ...
+  Run explicit node:bench files repeatedly with two Node.js binaries. Each
+  observation runs in a fresh process. Output is compatible with compare.R,
+  or --analyze can summarize it directly.
+
+  --new          binary     new Node.js binary (required)
+  --old          binary     old Node.js binary (required)
+  --runs         30         observations per binary
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to both binaries (repeatable)
+  --analyze                 analyze with Welch's t-test instead of writing CSV
+  --scale        1000       rate multiplier used for histogram precision
+  --max-regression N        fail if a family-wise significant regression's
+                            95% confidence interval is entirely beyond N%
+                            (implies --analyze)
+`, { arrayArgs: ['node-arg'], boolArgs: ['analyze'] });
+
+if (!cli.optional.new || !cli.optional.old || cli.items.length === 0) {
+  cli.abort(cli.usage);
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const scale = parseInteger(cli.optional.scale, 1000, '--scale', 1);
+  const hasMaxRegression = cli.optional['max-regression'] !== undefined;
+  const maxRegression = parseNumber(
+    cli.optional['max-regression'], 0, '--max-regression', 0);
+  const analyze = !!cli.optional.analyze || hasMaxRegression;
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binaries = [
+    { label: 'old', path: cli.optional.old },
+    { label: 'new', path: cli.optional.new },
+  ];
+  const rows = [];
+  const counts = new Map();
+  const csvGroups = new Map();
+
+  for (const file of cli.items) {
+    const resolved = path.resolve(file);
+    for (let run = 0; run < runs; run++) {
+      const order = run % 2 === 0 ? binaries : [binaries[1], binaries[0]];
+      for (const binary of order) {
+        const samples = await runBenchmark(binary.path, resolved, options);
+        for (const sample of samples) {
+          const identity = JSON.stringify([resolved, sample.identity]);
+          const csvGroup = JSON.stringify([
+            sample.name,
+            sample.configuration,
+          ]);
+          const groupedIdentity = csvGroups.get(csvGroup);
+          if (groupedIdentity !== undefined && groupedIdentity !== identity) {
+            throw new Error(
+              `Distinct benchmarks would share the CSV group '${sample.name} ` +
+              `${sample.configuration}'`,
+            );
+          }
+          csvGroups.set(csvGroup, identity);
+          let count = counts.get(identity);
+          if (count === undefined) {
+            count = { name: sample.name, new: 0, old: 0 };
+            counts.set(identity, count);
+          }
+          count[binary.label]++;
+          rows.push({ binary: binary.label, ...sample });
+        }
+      }
+    }
+  }
+
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+  for (const count of counts.values()) {
+    if (count.old !== runs || count.new !== runs) {
+      throw new Error(
+        `Benchmark '${count.name}' was not reported by both binaries in every run`,
+      );
+    }
+  }
+
+  if (analyze) {
+    const result = analyzeCompare(
+      rows, scale, hasMaxRegression ? maxRegression : undefined);
+    process.stdout.write(result.output);
+    if (result.failed) process.exitCode = 1;
+    return;
+  }
+
+  const output = ['"binary","filename","configuration","rate","time"'];
+  for (const row of rows) {
+    output.push(`${csvEncode(row.binary)},${csvEncode(row.name)},` +
+                `${csvEncode(row.configuration)},${row.rate},${row.duration}`);
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/crypto/_create-hash.node-bench.js b/benchmark/crypto/_create-hash.node-bench.js
new file mode 100644
index 000000000000..4481bc6c6527
--- /dev/null
+++ b/benchmark/crypto/_create-hash.node-bench.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const assert = require('node:assert');
+const { bench } = require('node:bench');
+const { createHash } = require('node:crypto');
+const path = require('node:path');
+
+const n = 1e5;
+const name = path.join('crypto', 'create-hash.js');
+
+bench(name, { params: { n } }, (b) => {
+  const array = [];
+  for (let i = 0; i < n; ++i) array.push(null);
+  b.start();
+  for (let i = 0; i < n; ++i)
+    array[i] = createHash('sha1');
+  b.end(n);
+  assert.strictEqual(typeof array[n - 1], 'object');
+});
diff --git a/benchmark/crypto/create-keyobject.js b/benchmark/crypto/create-keyobject.js
index 7cd6db2d567a..df95ad393234 100644
--- a/benchmark/crypto/create-keyobject.js
+++ b/benchmark/crypto/create-keyobject.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 
diff --git a/benchmark/crypto/ec-jwk-export.js b/benchmark/crypto/ec-jwk-export.js
new file mode 100644
index 000000000000..0539fc6468a0
--- /dev/null
+++ b/benchmark/crypto/ec-jwk-export.js
@@ -0,0 +1,19 @@
+'use strict';
+
+const common = require('../common.js');
+const { generateKeyPairSync } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  namedCurve: ['prime256v1', 'secp384r1', 'secp521r1', 'secp256k1'],
+  type: ['public', 'private'],
+  n: [10000],
+});
+
+function main({ namedCurve, type, n }) {
+  const key = generateKeyPairSync('ec', { namedCurve })[`${type}Key`];
+  const options = { format: 'jwk' };
+  bench.start();
+  for (let index = 0; index < n; index++)
+    key.export(options);
+  bench.end(n);
+}
diff --git a/benchmark/crypto/ec-key-details.js b/benchmark/crypto/ec-key-details.js
new file mode 100644
index 000000000000..e7266e9ad19b
--- /dev/null
+++ b/benchmark/crypto/ec-key-details.js
@@ -0,0 +1,23 @@
+'use strict';
+
+const common = require('../common.js');
+const { KeyObject } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  namedCurve: ['P-256', 'P-384', 'P-521'],
+  type: ['public', 'private'],
+  n: [10000],
+});
+
+async function main({ namedCurve, type, n }) {
+  const pair = await crypto.subtle.generateKey({
+    name: 'ECDSA', namedCurve,
+  }, true, ['sign', 'verify']);
+  const cryptoKey = pair[`${type}Key`];
+  bench.start();
+  for (let index = 0; index < n; index++) {
+    if (!KeyObject.from(cryptoKey).asymmetricKeyDetails.namedCurve)
+      throw new Error('Missing named curve');
+  }
+  bench.end(n);
+}
diff --git a/benchmark/crypto/ec-raw-export.js b/benchmark/crypto/ec-raw-export.js
new file mode 100644
index 000000000000..15c1d9333bb4
--- /dev/null
+++ b/benchmark/crypto/ec-raw-export.js
@@ -0,0 +1,23 @@
+'use strict';
+
+const common = require('../common.js');
+const { generateKeyPairSync } = require('crypto');
+
+const bench = common.createBenchmark(main, {
+  namedCurve: ['prime256v1', 'secp384r1', 'secp521r1'],
+  format: ['raw-private', 'raw-public'],
+  type: ['uncompressed', 'compressed'],
+  n: [10000],
+}, {
+  combinationFilter: ({ format, type }) => format === 'raw-public' || type === 'uncompressed',
+});
+
+function main({ namedCurve, format, type, n }) {
+  const pair = generateKeyPairSync('ec', { namedCurve });
+  const key = format === 'raw-private' ? pair.privateKey : pair.publicKey;
+  const options = format === 'raw-public' ? { format, type } : { format };
+  bench.start();
+  for (let index = 0; index < n; index++)
+    key.export(options);
+  bench.end(n);
+}
diff --git a/benchmark/crypto/ecdh-compute-secret.js b/benchmark/crypto/ecdh-compute-secret.js
new file mode 100644
index 000000000000..3061c5b2cc36
--- /dev/null
+++ b/benchmark/crypto/ecdh-compute-secret.js
@@ -0,0 +1,117 @@
+'use strict';
+
+const common = require('../common.js');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+
+const kCurve = 'prime256v1';
+const kPeerPoolSize = 32;
+const scenarios = [
+  'first-after-generate',
+  'full-lifecycle',
+  'reused-local-same-peer',
+  'reused-local-peer-pool',
+];
+
+const bench = common.createBenchmark(main, {
+  scenario: scenarios,
+  n: [5_000],
+}, {
+  test: { scenario: 'first-after-generate', n: 1 },
+});
+
+function generateContext() {
+  const context = crypto.createECDH(kCurve);
+  context.generateKeys();
+  return context;
+}
+
+function verifySecret(secret, local, peer) {
+  assert.deepStrictEqual(secret, peer.computeSecret(local.getPublicKey()));
+}
+
+function firstAfterGenerate(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = Array.from({ length: n }, generateContext);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = locals[i].computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function fullLifecycle(n) {
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  const warmup = generateContext();
+  warmup.computeSecret(peerPublicKey);
+
+  const locals = new Array(n);
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    const local = locals[i] = generateContext();
+    secrets[i] = local.computeSecret(peerPublicKey);
+  }
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], locals[n - 1], peer);
+}
+
+function reusedLocalSamePeer(n) {
+  const local = generateContext();
+  const peer = generateContext();
+  const peerPublicKey = peer.getPublicKey();
+  local.computeSecret(peerPublicKey);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKey);
+  bench.end(n);
+
+  verifySecret(secrets[n - 1], local, peer);
+}
+
+function reusedLocalPeerPool(n) {
+  const local = generateContext();
+  const peers = Array.from(
+    { length: Math.min(n, kPeerPoolSize) },
+    generateContext);
+  const peerPublicKeys = peers.map((peer) => peer.getPublicKey());
+  local.computeSecret(peerPublicKeys[0]);
+
+  const secrets = new Array(n);
+
+  bench.start();
+  for (let i = 0; i < n; i++)
+    secrets[i] = local.computeSecret(peerPublicKeys[i % peers.length]);
+  bench.end(n);
+
+  const lastPeer = peers[(n - 1) % peers.length];
+  verifySecret(secrets[n - 1], local, lastPeer);
+}
+
+function main({ scenario, n }) {
+  switch (scenario) {
+    case 'first-after-generate':
+      return firstAfterGenerate(n);
+    case 'full-lifecycle':
+      return fullLifecycle(n);
+    case 'reused-local-same-peer':
+      return reusedLocalSamePeer(n);
+    case 'reused-local-peer-pool':
+      return reusedLocalPeerPool(n);
+    default:
+      throw new Error(`Unsupported scenario: ${scenario}`);
+  }
+}
diff --git a/benchmark/crypto/kem.js b/benchmark/crypto/kem.js
index a544fc2124af..a59a57b65956 100644
--- a/benchmark/crypto/kem.js
+++ b/benchmark/crypto/kem.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -24,7 +24,7 @@ if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-kem-512'] = readKeyPair('ml_kem_512_public', 'ml_kem_512_private');
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-kem-768'] = readKeyPair('ml_kem_768_public', 'ml_kem_768_private_seed_only');
   keyFixtures['ml-kem-1024'] = readKeyPair('ml_kem_1024_public', 'ml_kem_1024_private_seed_only');
 }
diff --git a/benchmark/crypto/mac.js b/benchmark/crypto/mac.js
index d1028fa414e6..ea9d3a56e59f 100644
--- a/benchmark/crypto/mac.js
+++ b/benchmark/crypto/mac.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const assert = require('node:assert');
 const {
   createHmac,
@@ -10,7 +10,7 @@ const {
 } = require('node:crypto');
 
 if (!hasOpenSSL(3) ||
-    process.features.openssl_is_boringssl ||
+    isBoringSSL ||
     typeof createMac !== 'function' ||
     typeof getMacs !== 'function') {
   console.log('Skipping: generic MAC API requires OpenSSL >= 3');
diff --git a/benchmark/crypto/oneshot-sign.js b/benchmark/crypto/oneshot-sign.js
index 72e3726d9a53..78f0b5574aef 100644
--- a/benchmark/crypto/oneshot-sign.js
+++ b/benchmark/crypto/oneshot-sign.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -19,7 +19,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKey('ml_dsa_44_private_seed_only');
 }
 
diff --git a/benchmark/crypto/oneshot-verify.js b/benchmark/crypto/oneshot-verify.js
index 8b397b02dbf2..9aac91692dfc 100644
--- a/benchmark/crypto/oneshot-verify.js
+++ b/benchmark/crypto/oneshot-verify.js
@@ -1,7 +1,7 @@
 'use strict';
 
 const common = require('../common.js');
-const { hasOpenSSL } = require('../../test/common/crypto.js');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
 const crypto = require('crypto');
 const fs = require('fs');
 const path = require('path');
@@ -26,7 +26,7 @@ const keyFixtures = {
 
 if (hasOpenSSL(3, 5)) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private');
-} else if (process.features.openssl_is_boringssl) {
+} else if (isBoringSSL) {
   keyFixtures['ml-dsa-44'] = readKeyPair('ml_dsa_44_public', 'ml_dsa_44_private_seed_only');
 }
 
diff --git a/benchmark/crypto/prepare-asymmetric-key.js b/benchmark/crypto/prepare-asymmetric-key.js
new file mode 100644
index 000000000000..dd536c3f451c
--- /dev/null
+++ b/benchmark/crypto/prepare-asymmetric-key.js
@@ -0,0 +1,178 @@
+'use strict';
+
+const common = require('../common.js');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+const { pathToFileURL } = require('node:url');
+const { hasOpenSSL, isBoringSSL } = require('../../test/common/crypto.js');
+
+const inputs = [
+  'public-keyobject', 'public-keyobject-wrapped', 'public-pem-buffer-wrapped',
+  'private-keyobject', 'private-keyobject-wrapped',
+  'private-pem-string', 'private-pem-buffer', 'private-pem-arraybuffer',
+  'private-pem-string-wrapped', 'private-pem-buffer-wrapped', 'private-pem-arraybuffer-wrapped',
+  'private-jwk',
+  'public-der-pkcs1-bytes', 'private-der-pkcs1-bytes', 'private-pem-pkcs8-bytes',
+  'private-der-pkcs8-bytes', 'private-der-pkcs8-base64', 'private-der-pkcs8-hex',
+  'public-der-spki-bytes', 'private-der-sec1-bytes',
+  'raw-public-ec-buffer', 'raw-public-ed25519-buffer',
+  'raw-private-ec-buffer', 'raw-private-ec-arraybuffer', 'raw-private-ed25519-buffer',
+  'pem-passphrase-absent', 'pem-passphrase-empty', 'pem-passphrase-string',
+  'pem-passphrase-base64', 'pem-passphrase-buffer', 'pem-passphrase-arraybuffer',
+  'file-passphrase-absent', 'file-passphrase-string', 'file-direct',
+  'provider-passphrase-absent', 'provider-passphrase-absent-properties',
+  'provider-passphrase-empty', 'provider-passphrase-string', 'provider-passphrase-base64',
+  'provider-passphrase-buffer', 'provider-passphrase-arraybuffer', 'provider-direct',
+];
+
+if (hasOpenSSL(3, 5) || isBoringSSL)
+  inputs.push('raw-seed-ml-dsa-44-buffer');
+
+const bench = common.createBenchmark(main, {
+  input: inputs,
+  context: ['consume-public', 'consume-private', 'create-public'],
+  n: [1e6],
+}, {
+  flags: ['--expose-internals'],
+  combinationFilter({ input, context }) {
+    if (input === 'private-keyobject' || input === 'private-keyobject-wrapped')
+      return true;
+    if (input.startsWith('public-') || input.startsWith('raw-public-'))
+      return context === 'consume-public';
+    return context === 'consume-private';
+  },
+});
+
+function main({ input, context, n }) {
+  const {
+    prepareAsymmetricKey,
+    kConsumePublic,
+    kConsumePrivate,
+    kCreatePublic,
+  } = require('internal/crypto/keys');
+  const ctx = {
+    'consume-public': kConsumePublic,
+    'consume-private': kConsumePrivate,
+    'create-public': kCreatePublic,
+  }[context];
+  const fixtureDir = path.resolve(__dirname, '../../test/fixtures/keys');
+  const privateKeyPath = path.join(fixtureDir, 'rsa_private_2048.pem');
+  const privateKey = crypto.createPrivateKey(fs.readFileSync(privateKeyPath));
+  const publicKey = crypto.createPublicKey(privateKey);
+  const pem = privateKey.export({ format: 'pem', type: 'pkcs8' });
+  const buffer = Buffer.from(pem);
+  const arraybuffer = Uint8Array.from(buffer).buffer;
+  const fileURL = pathToFileURL(privateKeyPath);
+  const providerURL = new URL('pkcs11:object=signing-key;type=private');
+  const passphrase = Buffer.from('password');
+
+  let key;
+  switch (input) {
+    case 'public-keyobject': key = publicKey; break;
+    case 'public-keyobject-wrapped': key = { key: publicKey }; break;
+    case 'public-pem-buffer-wrapped':
+      key = { key: Buffer.from(publicKey.export({ format: 'pem', type: 'spki' })) };
+      break;
+    case 'private-keyobject': key = privateKey; break;
+    case 'private-keyobject-wrapped': key = { key: privateKey }; break;
+    case 'private-pem-string': key = pem; break;
+    case 'private-pem-buffer': key = buffer; break;
+    case 'private-pem-arraybuffer': key = arraybuffer; break;
+    case 'private-pem-string-wrapped': key = { key: pem }; break;
+    case 'private-pem-buffer-wrapped': key = { key: buffer }; break;
+    case 'private-pem-arraybuffer-wrapped': key = { key: arraybuffer }; break;
+    case 'private-jwk': key = { key: privateKey.export({ format: 'jwk' }), format: 'jwk' }; break;
+    case 'public-der-pkcs1-bytes': key = { key: publicKey, format: 'der', type: 'pkcs1' }; break;
+    case 'private-der-pkcs1-bytes': key = { key: privateKey, format: 'der', type: 'pkcs1' }; break;
+    case 'private-pem-pkcs8-bytes': key = { key: privateKey, format: 'pem', type: 'pkcs8' }; break;
+    case 'private-der-pkcs8-bytes': key = { key: privateKey, format: 'der', type: 'pkcs8' }; break;
+    case 'private-der-pkcs8-base64':
+      key = { key: privateKey, format: 'der', type: 'pkcs8', encoding: 'base64' };
+      break;
+    case 'private-der-pkcs8-hex':
+      key = { key: privateKey, format: 'der', type: 'pkcs8', encoding: 'hex' };
+      break;
+    case 'public-der-spki-bytes': key = { key: publicKey, format: 'der', type: 'spki' }; break;
+    case 'private-der-sec1-bytes':
+      key = {
+        key: crypto.createPrivateKey(fs.readFileSync(path.join(fixtureDir, 'ec_p256_private.pem'))),
+        format: 'der', type: 'sec1',
+      };
+      break;
+    case 'raw-public-ec-buffer':
+    case 'raw-public-ed25519-buffer':
+    case 'raw-private-ec-buffer':
+    case 'raw-private-ec-arraybuffer':
+    case 'raw-private-ed25519-buffer': {
+      const asymmetricKeyType = input.includes('-ec-') ? 'ec' : 'ed25519';
+      const fixture = asymmetricKeyType === 'ec' ? 'ec_p256_private.pem' : 'ed25519_private.pem';
+      let rawKey = crypto.createPrivateKey(fs.readFileSync(path.join(fixtureDir, fixture)));
+      const format = input.startsWith('raw-public-') ? 'raw-public' : 'raw-private';
+      if (format === 'raw-public') rawKey = crypto.createPublicKey(rawKey);
+      const bytes = rawKey.export({ format });
+      key = {
+        key: input.endsWith('-arraybuffer') ? Uint8Array.from(bytes).buffer : bytes,
+        format,
+        asymmetricKeyType,
+        namedCurve: asymmetricKeyType === 'ec' ? 'prime256v1' : undefined,
+      };
+      break;
+    }
+    case 'raw-seed-ml-dsa-44-buffer': {
+      const seedKey = crypto.createPrivateKey(
+        fs.readFileSync(path.join(fixtureDir, 'ml_dsa_44_private_seed_only.pem')));
+      key = { key: seedKey.export({ format: 'raw-seed' }), format: 'raw-seed', asymmetricKeyType: 'ml-dsa-44' };
+      break;
+    }
+    case 'pem-passphrase-absent': key = { key: privateKey }; break;
+    case 'pem-passphrase-empty': key = { key: privateKey, passphrase: '' }; break;
+    case 'pem-passphrase-string': key = { key: privateKey, passphrase: 'password' }; break;
+    case 'pem-passphrase-base64':
+      key = { key: privateKey, passphrase: passphrase.toString('base64'), encoding: 'base64' };
+      break;
+    case 'pem-passphrase-buffer': key = { key: privateKey, passphrase }; break;
+    case 'pem-passphrase-arraybuffer':
+      key = { key: privateKey, passphrase: Uint8Array.from(passphrase).buffer };
+      break;
+    case 'file-passphrase-absent': key = { key: fileURL }; break;
+    case 'file-passphrase-string': key = { key: fileURL, passphrase: 'password' }; break;
+    case 'file-direct': key = fileURL; break;
+    case 'provider-passphrase-absent': key = { key: providerURL }; break;
+    case 'provider-passphrase-absent-properties': key = { key: providerURL, properties: 'provider=default' }; break;
+    case 'provider-passphrase-empty': key = { key: providerURL, passphrase: '' }; break;
+    case 'provider-passphrase-string': key = { key: providerURL, passphrase: 'password' }; break;
+    case 'provider-passphrase-base64':
+      key = { key: providerURL, passphrase: passphrase.toString('base64'), encoding: 'base64' };
+      break;
+    case 'provider-passphrase-buffer': key = { key: providerURL, passphrase }; break;
+    case 'provider-passphrase-arraybuffer':
+      key = { key: providerURL, passphrase: Uint8Array.from(passphrase).buffer };
+      break;
+    case 'provider-direct': key = providerURL; break;
+    default: throw new Error(`Unsupported input: ${input}`);
+  }
+
+  if (input.startsWith('pem-passphrase-')) {
+    const bytes = key.passphrase === undefined ? undefined :
+      typeof key.passphrase === 'string' ? Buffer.from(key.passphrase, key.encoding) :
+        Buffer.from(key.passphrase);
+    key = {
+      key: Buffer.from(privateKey.export({
+        format: 'pem', type: 'pkcs8',
+        ...(bytes === undefined ? {} : { cipher: 'aes-256-cbc', passphrase: bytes }),
+      })),
+      format: 'pem', type: 'pkcs8', passphrase: key.passphrase, encoding: key.encoding,
+    };
+  } else if (key.key instanceof crypto.KeyObject && key.format !== undefined) {
+    const bytes = Buffer.from(key.key.export({ format: key.format, type: key.type }));
+    key.key = key.encoding === undefined ? bytes : bytes.toString(key.encoding);
+  }
+
+  prepareAsymmetricKey(key, ctx);
+  bench.start();
+  for (let index = 0; index < n; index++) {
+    prepareAsymmetricKey(key, ctx);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-promise.js b/benchmark/diagnostics_channel/tracing-channel-promise.js
new file mode 100644
index 000000000000..594043d63fe4
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-promise.js
@@ -0,0 +1,53 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+const thenable = {
+  then(onResolve) {
+    onResolve(undefined);
+  },
+};
+
+function returnThenable() {
+  return thenable;
+}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.tracePromise(returnThenable, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/diagnostics_channel/tracing-channel-sync.js b/benchmark/diagnostics_channel/tracing-channel-sync.js
new file mode 100644
index 000000000000..bfd9dd939cc0
--- /dev/null
+++ b/benchmark/diagnostics_channel/tracing-channel-sync.js
@@ -0,0 +1,43 @@
+'use strict';
+
+const common = require('../common.js');
+const dc = require('node:diagnostics_channel');
+
+const bench = common.createBenchmark(main, {
+  n: [1e7],
+  context: ['omitted', 'undefined', 'provided'],
+  subscribers: [0, 1],
+});
+
+function noop() {}
+
+function main({ n, context, subscribers }) {
+  const channel = dc.tracingChannel('test');
+  const providedContext = { __proto__: null };
+
+  if (subscribers) {
+    channel.subscribe({ start: noop });
+  }
+
+  bench.start();
+  switch (context) {
+    case 'omitted':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop);
+      }
+      break;
+    case 'undefined':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, undefined);
+      }
+      break;
+    case 'provided':
+      for (let i = 0; i < n; i++) {
+        channel.traceSync(noop, providedContext);
+      }
+      break;
+    default:
+      throw new Error(`Unsupported context value: ${context}`);
+  }
+  bench.end(n);
+}
diff --git a/benchmark/fs/bench-cp.js b/benchmark/fs/bench-cp.js
new file mode 100644
index 000000000000..ffaeb87705f5
--- /dev/null
+++ b/benchmark/fs/bench-cp.js
@@ -0,0 +1,33 @@
+'use strict';
+
+// fs.promises.cp() of a directory tree.
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../../test/common/tmpdir');
+
+const bench = common.createBenchmark(main, {
+  files: [500],
+  n: [3],
+});
+
+function prepareSource(files) {
+  const src = tmpdir.resolve('cp-src');
+  for (let i = 0; i < files; i++) {
+    const dir = path.join(src, `dir-${i % 10}`, `sub-${i % 7}`);
+    fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(path.join(dir, `file-${i}.js`), 'x'.repeat(1024 + (i % 512)));
+  }
+  return src;
+}
+
+async function main({ files, n }) {
+  tmpdir.refresh();
+  const src = prepareSource(files);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    await fs.promises.cp(src, tmpdir.resolve(`cp-dest-${i}`), { recursive: true });
+  }
+  bench.end(n);
+}
diff --git a/benchmark/fs/bench-readdir-recursive.js b/benchmark/fs/bench-readdir-recursive.js
new file mode 100644
index 000000000000..6ed56995dcea
--- /dev/null
+++ b/benchmark/fs/bench-readdir-recursive.js
@@ -0,0 +1,47 @@
+'use strict';
+
+const common = require('../common');
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+const bench = common.createBenchmark(main, {
+  n: [10],
+  dir: ['lib', 'test/parallel', 'test'],
+  mode: ['sync', 'callback', 'promise'],
+  withFileTypes: ['true', 'false'],
+});
+
+async function main({ n, dir, mode, withFileTypes }) {
+  withFileTypes = withFileTypes === 'true';
+  const fullPath = path.resolve(__dirname, '../../', dir);
+  const options = { recursive: true, withFileTypes };
+  let entries;
+
+  bench.start();
+  switch (mode) {
+    case 'sync':
+      for (let i = 0; i < n; i++) {
+        entries = fs.readdirSync(fullPath, options);
+      }
+      break;
+    case 'callback':
+      for (let i = 0; i < n; i++) {
+        entries = await new Promise((resolve, reject) => {
+          fs.readdir(fullPath, options, (err, result) => {
+            if (err) reject(err);
+            else resolve(result);
+          });
+        });
+      }
+      break;
+    case 'promise':
+      for (let i = 0; i < n; i++) {
+        entries = await fs.promises.readdir(fullPath, options);
+      }
+      break;
+  }
+  bench.end(n);
+
+  assert.ok(entries.length > 0);
+}
diff --git a/benchmark/fs/bench-readdir.js b/benchmark/fs/bench-readdir.js
index e276653f4584..8fa0e7a3cbdc 100644
--- a/benchmark/fs/bench-readdir.js
+++ b/benchmark/fs/bench-readdir.js
@@ -8,18 +8,16 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   (function r(cntr) {
     if (cntr-- <= 0)
       return bench.end(n);
-    fs.readdir(fullPath, { withFileTypes, recursive }, () => {
+    fs.readdir(fullPath, { withFileTypes }, () => {
       r(cntr);
     });
   }(n));
diff --git a/benchmark/fs/bench-readdirSync.js b/benchmark/fs/bench-readdirSync.js
index ce34e083cb53..8ae1d061d1f1 100644
--- a/benchmark/fs/bench-readdirSync.js
+++ b/benchmark/fs/bench-readdirSync.js
@@ -8,17 +8,15 @@ const bench = common.createBenchmark(main, {
   n: [10],
   dir: [ 'lib', 'test/parallel'],
   withFileTypes: ['true', 'false'],
-  recursive: ['true', 'false'],
 });
 
 
-function main({ n, dir, withFileTypes, recursive }) {
+function main({ n, dir, withFileTypes }) {
   withFileTypes = withFileTypes === 'true';
-  recursive = recursive === 'true';
   const fullPath = path.resolve(__dirname, '../../', dir);
   bench.start();
   for (let i = 0; i < n; i++) {
-    fs.readdirSync(fullPath, { withFileTypes, recursive });
+    fs.readdirSync(fullPath, { withFileTypes });
   }
   bench.end(n);
 }
diff --git a/benchmark/module/module-require-source-map.js b/benchmark/module/module-require-source-map.js
new file mode 100644
index 000000000000..8353ab39fc82
--- /dev/null
+++ b/benchmark/module/module-require-source-map.js
@@ -0,0 +1,77 @@
+'use strict';
+
+// Loading modules that carry source maps, with source map support enabled.
+// This is the cost paid at startup by applications bundled or transpiled with
+// source maps; the maps are only consulted if a stack trace is generated.
+
+const fs = require('fs');
+const path = require('path');
+const common = require('../common.js');
+const tmpdir = require('../../test/common/tmpdir');
+const benchmarkDirectory = tmpdir.resolve('nodejs-benchmark-module-source-map');
+
+const bench = common.createBenchmark(main, {
+  sourceMap: ['none', 'inline', 'external'],
+  n: [1000],
+}, {
+  setup(configs) {
+    tmpdir.refresh();
+    const maxN = configs.reduce((max, c) => Math.max(max, c.n), 0);
+    createModules(maxN);
+  },
+});
+
+function moduleSource(i) {
+  const methods = [];
+  for (let m = 0; m < 40; m++) {
+    methods.push(`  method${m}(input) { return [].concat(input).map((item) => ({ item, m: ${m}, service: ${i} })); }`);
+  }
+  return `'use strict';
+class Service${i} {
+  constructor(options = {}) { this.options = { retries: 3, ...options }; }
+${methods.join('\n')}
+}
+function helper${i}(list) { return list.filter(Boolean).slice(0, ${i % 7}); }
+module.exports = { Service${i}, helper${i} };
+`;
+}
+
+function sourceMapFor(i, source) {
+  return JSON.stringify({
+    version: 3,
+    file: `${i}.js`,
+    sources: [`../src/${i}.ts`],
+    sourcesContent: [source],
+    names: [],
+    mappings: 'AAAA;' + 'AACA,MAAM;'.repeat(44),
+  });
+}
+
+function createModules(n) {
+  for (const kind of ['none', 'inline', 'external']) {
+    const dir = path.join(benchmarkDirectory, kind);
+    fs.mkdirSync(dir, { recursive: true });
+    for (let i = 0; i < n; i++) {
+      const source = moduleSource(i);
+      let trailer = '';
+      if (kind === 'inline') {
+        const data = Buffer.from(sourceMapFor(i, source)).toString('base64');
+        trailer = `//# sourceMappingURL=data:application/json;base64,${data}\n`;
+      } else if (kind === 'external') {
+        fs.writeFileSync(path.join(dir, `${i}.js.map`), sourceMapFor(i, source));
+        trailer = `//# sourceMappingURL=${i}.js.map\n`;
+      }
+      fs.writeFileSync(path.join(dir, `${i}.js`), source + trailer);
+    }
+  }
+}
+
+function main({ sourceMap, n }) {
+  process.setSourceMapsEnabled(true);
+  const dir = path.join(benchmarkDirectory, sourceMap);
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    require(path.join(dir, `${i}.js`));
+  }
+  bench.end(n);
+}
diff --git a/benchmark/net/tcp-raw-c2s.js b/benchmark/net/tcp-raw-c2s.js
index 5b174f50e81c..24e35906c925 100644
--- a/benchmark/net/tcp-raw-c2s.js
+++ b/benchmark/net/tcp-raw-c2s.js
@@ -23,7 +23,11 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   const serverHandle = new TCP(TCPConstants.SERVER);
@@ -55,9 +59,7 @@ function main({ dur, len, type }) {
       if (!buffer)
         fail('read');
 
-      // Don't slice the buffer. The point of this is to isolate, not
-      // simulate real traffic.
-      bytes += buffer.byteLength;
+      bytes += streamBaseState[kReadBytesOrError];
     };
 
     clientHandle.readStart();
diff --git a/benchmark/net/tcp-raw-pipe.js b/benchmark/net/tcp-raw-pipe.js
index fbaa21b5a309..36ddb822e04e 100644
--- a/benchmark/net/tcp-raw-pipe.js
+++ b/benchmark/net/tcp-raw-pipe.js
@@ -23,7 +23,12 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    kArrayBufferOffset,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   function fail(err, syscall) {
@@ -50,9 +55,11 @@ function main({ dur, len, type }) {
       if (!buffer)
         fail('read');
 
+      const nread = streamBaseState[kReadBytesOrError];
+      const offset = streamBaseState[kArrayBufferOffset];
       const writeReq = new WriteWrap();
       writeReq.async = false;
-      err = clientHandle.writeBuffer(writeReq, Buffer.from(buffer));
+      err = clientHandle.writeBuffer(writeReq, Buffer.from(buffer, offset, nread));
 
       if (err)
         fail(err, 'write');
@@ -94,7 +101,7 @@ function main({ dur, len, type }) {
     if (!buffer)
       fail('read');
 
-    bytes += buffer.byteLength;
+    bytes += streamBaseState[kReadBytesOrError];
   };
 
   connectReq.oncomplete = function(err) {
diff --git a/benchmark/net/tcp-raw-s2c.js b/benchmark/net/tcp-raw-s2c.js
index 3ca03529fcea..a847b8c28dcd 100644
--- a/benchmark/net/tcp-raw-s2c.js
+++ b/benchmark/net/tcp-raw-s2c.js
@@ -23,7 +23,11 @@ function main({ dur, len, type }) {
     TCPConnectWrap,
     constants: TCPConstants,
   } = common.binding('tcp_wrap');
-  const { WriteWrap } = common.binding('stream_wrap');
+  const {
+    WriteWrap,
+    kReadBytesOrError,
+    streamBaseState,
+  } = common.binding('stream_wrap');
   const PORT = common.PORT;
 
   const serverHandle = new TCP(TCPConstants.SERVER);
@@ -116,9 +120,7 @@ function main({ dur, len, type }) {
         if (!buffer)
           fail('read');
 
-        // Don't slice the buffer. The point of this is to isolate, not
-        // simulate real traffic.
-        bytes += buffer.byteLength;
+        bytes += streamBaseState[kReadBytesOrError];
       };
 
       clientHandle.readStart();
diff --git a/benchmark/scatter-node-bench.js b/benchmark/scatter-node-bench.js
new file mode 100644
index 000000000000..4527ecc6b8b4
--- /dev/null
+++ b/benchmark/scatter-node-bench.js
@@ -0,0 +1,131 @@
+'use strict';
+
+const CLI = require('./_cli.js');
+const {
+  analyzeScatter,
+  validateScatterParameters,
+} = require('./_node-bench-analysis.js');
+const {
+  csvEncode,
+  parseInteger,
+  runBenchmark,
+} = require('./_node-bench.js');
+
+const cli = new CLI(`usage: ./node scatter-node-bench.js [options] [--] <file>
+  Run an explicit node:bench file repeatedly and output each independent
+  observation with its benchmark parameters as CSV, or summarize the results
+  directly with --analyze.
+
+  --node         ./node     Node.js binary
+  --runs         30         number of observations
+  --warmup       0          warmup samples before each observation
+  --name-pattern pattern    only run matching benchmarks
+  --node-arg     argument   pass an argument to the binary (repeatable)
+  --analyze                 print a statistical summary instead of CSV
+  --xaxis        parameter  parameter to group by with --analyze (required)
+  --category     parameter  optional second grouping parameter
+  --no-chart                omit the analysis bar chart
+`, {
+  arrayArgs: ['node-arg'],
+  boolArgs: ['analyze', 'no-chart'],
+});
+
+if (cli.items.length !== 1) cli.abort(cli.usage);
+if (cli.optional.analyze && cli.optional.xaxis === undefined) {
+  cli.abort('--analyze requires --xaxis <parameter>');
+}
+
+async function main() {
+  const runs = parseInteger(cli.optional.runs, 30, '--runs', 1);
+  const warmup = parseInteger(cli.optional.warmup, 0, '--warmup', 0);
+  const options = {
+    namePattern: cli.optional['name-pattern'],
+    nodeArgs: cli.optional['node-arg'],
+    warmup,
+  };
+  const binary = cli.optional.node || process.execPath;
+  const rows = [];
+  const paramNames = new Set();
+  const csvGroups = new Map();
+  let expectedIdentities;
+  let logicalIdentity;
+
+  for (let run = 0; run < runs; run++) {
+    const samples = await runBenchmark(binary, cli.items[0], options);
+    if (run === 0 && cli.optional.analyze) {
+      validateScatterParameters(
+        samples, cli.optional.xaxis, cli.optional.category);
+    }
+    const identities = new Set();
+    for (const sample of samples) {
+      if (logicalIdentity !== undefined &&
+          logicalIdentity !== sample.logicalIdentity) {
+        throw new Error(
+          'scatter-node-bench.js requires one logical benchmark name per file',
+        );
+      }
+      logicalIdentity = sample.logicalIdentity;
+      if (identities.has(sample.identity)) {
+        throw new Error(`Benchmark '${sample.name}' was reported more than once`);
+      }
+      identities.add(sample.identity);
+      const csvGroup = JSON.stringify([sample.name, sample.params]);
+      const groupedIdentity = csvGroups.get(csvGroup);
+      if (groupedIdentity !== undefined &&
+          groupedIdentity !== sample.identity) {
+        throw new Error(
+          `Distinct benchmarks would share the CSV group '${sample.name}'`,
+        );
+      }
+      csvGroups.set(csvGroup, sample.identity);
+      rows.push({ ...sample, observation: run });
+      for (const name of Object.keys(sample.params)) paramNames.add(name);
+    }
+    if (expectedIdentities === undefined) {
+      expectedIdentities = identities;
+    } else if (identities.size !== expectedIdentities.size ||
+               ![...identities].every((id) => expectedIdentities.has(id))) {
+      throw new Error('The set of reported benchmarks changed between runs');
+    }
+  }
+  if (rows.length === 0) {
+    throw new Error('No benchmark samples were produced');
+  }
+
+  const params = [...paramNames].sort();
+  if (cli.optional.analyze) {
+    const output = analyzeScatter(
+      rows,
+      cli.optional.xaxis,
+      cli.optional.category,
+      !cli.optional['no-chart'],
+    );
+    process.stdout.write(output);
+    return;
+  }
+
+  for (const name of params) {
+    if (name === 'filename' || name === 'rate' || name === 'time') {
+      throw new Error(`Benchmark parameter '${name}' is reserved in scatter CSV`);
+    }
+  }
+  const header = ['filename', ...params, 'rate', 'time']
+    .map(csvEncode)
+    .join(',');
+  const output = [header];
+  for (const row of rows) {
+    const values = [
+      csvEncode(row.name),
+      ...params.map((name) => csvEncode(row.params[name] ?? '')),
+      row.rate,
+      row.duration,
+    ];
+    output.push(values.join(','));
+  }
+  process.stdout.write(`${output.join('\n')}\n`);
+}
+
+main().catch((error) => {
+  console.error(error.stack);
+  process.exitCode = 1;
+});
diff --git a/benchmark/streams/writable-buffered-drain.js b/benchmark/streams/writable-buffered-drain.js
new file mode 100644
index 000000000000..5ebed16624ea
--- /dev/null
+++ b/benchmark/streams/writable-buffered-drain.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common');
+const { Writable } = require('stream');
+
+const bench = common.createBenchmark(main, {
+  count: [1024, 16384, 65536],
+  n: [100],
+});
+
+function main({ count, n }) {
+  const chunk = {};
+  let callback;
+  const stream = new Writable({
+    objectMode: true,
+    write(chunk, encoding, cb) { callback = cb; },
+  });
+
+  bench.start();
+  for (let i = 0; i < n; i++) {
+    for (let j = 0; j < count; j++) stream.write(chunk);
+    for (let j = 0; j < count; j++) callback();
+  }
+  bench.end(n);
+}
diff --git a/benchmark/webstreams/adapters.js b/benchmark/webstreams/adapters.js
new file mode 100644
index 000000000000..ae97e4928f88
--- /dev/null
+++ b/benchmark/webstreams/adapters.js
@@ -0,0 +1,106 @@
+'use strict';
+const common = require('../common.js');
+const {
+  Readable,
+  Writable,
+} = require('node:stream');
+const {
+  ReadableStream,
+  WritableStream,
+} = require('node:stream/web');
+
+const bench = common.createBenchmark(main, {
+  n: [1e5],
+  kind: [
+    'readable-to-web',
+    'readable-from-web',
+    'writable-to-web',
+    'writable-from-web',
+  ],
+});
+
+async function readableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const streamReadable = new Readable({
+    read() {
+      if (i++ < n)
+        this.push(chunk);
+      else
+        this.push(null);
+    },
+  });
+  const reader = Readable.toWeb(streamReadable).getReader();
+  bench.start();
+  while (!(await reader.read()).done);
+  bench.end(n);
+}
+
+function readableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  let i = 0;
+  const readableStream = new ReadableStream({
+    pull(controller) {
+      if (i++ < n)
+        controller.enqueue(chunk);
+      else
+        controller.close();
+    },
+  });
+  const streamReadable = Readable.fromWeb(readableStream);
+  bench.start();
+  streamReadable.on('data', () => {});
+  streamReadable.on('end', () => bench.end(n));
+}
+
+async function writableToWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const streamWritable = new Writable({
+    write(chunk, encoding, callback) {
+      callback();
+    },
+  });
+  const writer = Writable.toWeb(streamWritable).getWriter();
+  bench.start();
+  for (let i = 0; i < n; i++)
+    await writer.write(chunk);
+  await writer.close();
+  bench.end(n);
+}
+
+function writableFromWeb(n) {
+  const chunk = Buffer.alloc(1024);
+  const writableStream = new WritableStream({
+    write() {},
+  });
+  const streamWritable = Writable.fromWeb(writableStream);
+  bench.start();
+  let i = 0;
+  function writeLoop() {
+    while (i++ < n) {
+      if (!streamWritable.write(chunk)) {
+        streamWritable.once('drain', writeLoop);
+        return;
+      }
+    }
+    streamWritable.end(() => bench.end(n));
+  }
+  writeLoop();
+}
+
+function main({ n, kind }) {
+  switch (kind) {
+    case 'readable-to-web':
+      readableToWeb(n);
+      break;
+    case 'readable-from-web':
+      readableFromWeb(n);
+      break;
+    case 'writable-to-web':
+      writableToWeb(n);
+      break;
+    case 'writable-from-web':
+      writableFromWeb(n);
+      break;
+  }
+}
diff --git a/common.gypi b/common.gypi
index a83523286a91..e6a17d3505a5 100644
--- a/common.gypi
+++ b/common.gypi
@@ -17,6 +17,7 @@
     'emulator%': [],
 
     'node_shared%': 'false',
+    'node_enable_v8debughelper%': 'false',
     'node_enable_experimentals%': 'false',
     'force_dynamic_crt%': 0,
     'node_use_v8_platform%': 'true',
@@ -42,7 +43,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.28',
+    'v8_embedder_string': '-node.32',
 
     ##### V8 defaults for Node.js #####
 
@@ -611,6 +612,10 @@
                 'cflags': [ '-m64', '-march=z14' ],
                 'ldflags': [ '-m64', '-march=z14' ],
               }],
+              [ 'host_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
           ['_toolset=="target"', {
@@ -636,6 +641,10 @@
                 'cflags': [ '-m64', '-march=z14' ],
                 'ldflags': [ '-m64', '-march=z14' ],
               }],
+              [ 'target_arch=="riscv64" and OS=="linux"', {
+                'cflags': [ '-march=rv64gc' ],
+                'ldflags': [ '-march=rv64gc' ],
+              }],
             ],
           }],
         ],
@@ -646,7 +655,9 @@
             'cflags!': [ '-pthread' ],
             'ldflags!': [ '-pthread' ],
           }],
-          [ 'node_shared=="true"', {
+          # The V8 static libraries get linked into libv8_debug_helper, so they
+          # have to be position independent too.
+          [ 'node_shared=="true" or node_enable_v8debughelper=="true"', {
             'cflags': [ '-fPIC' ],
             'ldflags': [ '-fPIC' ],
           }],
diff --git a/configure.py b/configure.py
index b11c4e3284d0..8b3332a461f4 100755
--- a/configure.py
+++ b/configure.py
@@ -282,6 +282,28 @@
     help='Use the specified path to system CA (PEM format) in addition to '
          'the OpenSSL supplied CA store or compiled-in Mozilla CA copy.')
 
+shared_optgroup.add_argument('--shared-abseil',
+    action='store_true',
+    dest='shared_abseil',
+    default=None,
+    help='link to a shared Abseil DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-abseil-includes',
+    action='store',
+    dest='shared_abseil_includes',
+    help='directory containing Abseil header files')
+
+shared_optgroup.add_argument('--shared-abseil-libname',
+    action='store',
+    dest='shared_abseil_libname',
+    default=None,
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-abseil-libpath',
+    action='store',
+    dest='shared_abseil_libpath',
+    help='a directory to search for the shared Abseil DLL')
+
 shared_optgroup.add_argument('--shared-gtest',
     action='store_true',
     dest='shared_gtest',
@@ -326,6 +348,28 @@
     dest='shared_hdr_histogram_libpath',
     help='a directory to search for the shared HdrHistogram DLL')
 
+shared_optgroup.add_argument('--shared-highway',
+    action='store_true',
+    dest='shared_highway',
+    default=None,
+    help='link to a shared Highway (hwy) DLL instead of static linking')
+
+shared_optgroup.add_argument('--shared-highway-includes',
+    action='store',
+    dest='shared_highway_includes',
+    help='directory containing Highway header files')
+
+shared_optgroup.add_argument('--shared-highway-libname',
+    action='store',
+    dest='shared_highway_libname',
+    default='hwy',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-highway-libpath',
+    action='store',
+    dest='shared_highway_libpath',
+    help='a directory to search for the shared Highway DLL')
+
 shared_optgroup.add_argument('--shared-http-parser',
     action='store_true',
     dest='shared_http_parser',
@@ -502,6 +546,29 @@
     dest='shared_openssl_libpath',
     help='a directory to search for the shared OpenSSL DLLs')
 
+shared_optgroup.add_argument('--shared-perfetto',
+    action='store_true',
+    dest='shared_perfetto',
+    default=None,
+    help='link to a shared perfetto SDK instead of the one in deps/perfetto '
+         '(requires --with-perfetto)')
+
+shared_optgroup.add_argument('--shared-perfetto-includes',
+    action='store',
+    dest='shared_perfetto_includes',
+    help='directory containing perfetto header files')
+
+shared_optgroup.add_argument('--shared-perfetto-libname',
+    action='store',
+    dest='shared_perfetto_libname',
+    default='perfetto',
+    help='alternative lib name to link to [default: %(default)s]')
+
+shared_optgroup.add_argument('--shared-perfetto-libpath',
+    action='store',
+    dest='shared_perfetto_libpath',
+    help='a directory to search for the shared perfetto DLL')
+
 shared_optgroup.add_argument('--shared-uvwasi',
     action='store_true',
     dest='shared_uvwasi',
@@ -806,6 +873,13 @@
     default=None,
     help=argparse.SUPPRESS)  # Undocumented.
 
+parser.add_argument('--enable-v8debughelper',
+    action='store_true',
+    dest='enable_v8debughelper',
+    default=None,
+    help='Build V8\'s debug helper as a shared library, loadable by a debugger '
+         'extension.')
+
 parser.add_argument('--enable-trace-maps',
     action='store_true',
     dest='trace_maps',
@@ -828,7 +902,7 @@
     action='store_true',
     dest='pointer_compression_shared_cage',
     default=None,
-    help='[Experimental] Use V8 pointer compression with shared cage (requires --experimental-enable-pointer-compression)')
+    help='[Experimental] Use V8 pointer compression with a shared cage and enable the V8 sandbox (requires --experimental-enable-pointer-compression)')
 
 parser.add_argument('--v8-options',
     action='store',
@@ -1595,8 +1669,8 @@ def check_compiler(o):
   # cargo and rustc are needed for Temporal.
   if not options.v8_disable_temporal_support and not options.shared_temporal_capi:
     # Minimum cargo and rustc versions should match values in BUILDING.md.
-    min_cargo_ver_tuple = (1, 82)
-    min_rustc_ver_tuple = (1, 82)
+    min_cargo_ver_tuple = (1, 86)
+    min_rustc_ver_tuple = (1, 86)
     cargo = os.environ.get('CARGO', 'cargo')
     cargo_ver = get_cargo_version(cargo)
     print_verbose(f'Detected cargo (CARGO={cargo}): {cargo_ver}')
@@ -2170,16 +2244,10 @@ def configure_v8(o, configs):
                                          flavor not in ('aix', 'os400', 'zos') and
                                          o['variables']['target_arch'] in maglev_enabled_architectures)
   o['variables']['v8_enable_pointer_compression'] = 1 if options.enable_pointer_compression else 0
-  # Using the sandbox requires always allocating array buffer backing stores in the sandbox.
-  # We currently have many backing stores tied to pointers from C++ land that are not
-  # even necessarily dynamic (e.g. in static storage) for fast communication between JS and C++.
-  # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
-  # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
-  # so this can be broken at any time.
-  o['variables']['v8_enable_sandbox'] = 0
-  # We set v8_enable_pointer_compression_shared_cage to 0 always, even when
-  # pointer compression is enabled so that we don't accidentally enable shared
-  # cage mode when pointer compression is on.
+  # Like V8's own default, the sandbox goes with the shared pointer compression
+  # cage. Multi-cage builds give every IsolateGroup its own sandbox, which the
+  # array buffer allocator does not know about yet.
+  o['variables']['v8_enable_sandbox'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.pointer_compression_shared_cage else 0
   o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
@@ -2204,6 +2272,7 @@ def configure_v8(o, configs):
   o['variables']['force_dynamic_crt'] = 1 if options.shared else 0
   o['variables']['node_enable_d8'] = b(options.enable_d8)
   o['variables']['node_enable_v8windbg'] = b(options.enable_v8windbg)
+  o['variables']['node_enable_v8debughelper'] = b(options.enable_v8debughelper)
   if options.enable_d8:
     o['variables']['test_isolation_mode'] = 'noop'  # Needed by d8.gyp.
   if options.without_bundled_v8:
@@ -2211,6 +2280,8 @@ def configure_v8(o, configs):
       raise Exception('--enable-d8 is incompatible with --without-bundled-v8.')
     if options.enable_v8windbg:
       raise Exception('--enable-v8windbg is incompatible with --without-bundled-v8.')
+    if options.enable_v8debughelper:
+      raise Exception('--enable-v8debughelper is incompatible with --without-bundled-v8.')
     (pkg_libs, pkg_cflags, pkg_libpath, _) = pkg_config("v8")
     if pkg_libs and pkg_libpath:
       output['libraries'] += [pkg_libpath] + pkg_libs.split()
@@ -2318,6 +2389,15 @@ def configure_lief(o):
 
   configure_library('lief', o, pkgname='LIEF')
 
+def configure_perfetto(o):
+  if not options.with_perfetto:
+    if options.shared_perfetto:
+      error('--shared-perfetto requires --with-perfetto')
+    o['variables']['node_shared_perfetto'] = b(False)
+    return
+
+  configure_library('perfetto', o)
+
 def configure_sqlite(o):
   o['variables']['node_use_sqlite'] = b(not options.without_sqlite)
   if options.without_sqlite:
@@ -2814,6 +2894,71 @@ def make_bin_override():
 configure_library('zlib', output)
 configure_library('http_parser', output, pkgname='libllhttp')
 configure_library('libuv', output)
+configure_library('abseil', output, pkgname=[
+  'absl_absl_check',
+  'absl_absl_log',
+  'absl_absl_vlog_is_on',
+  'absl_algorithm_container',
+  'absl_algorithm',
+  'absl_any_invocable',
+  'absl_base',
+  'absl_bind_front',
+  'absl_bits',
+  'absl_btree',
+  'absl_charset',
+  'absl_cleanup',
+  'absl_config',
+  'absl_cord',
+  'absl_core_headers',
+  'absl_die_if_null',
+  'absl_dynamic_annotations',
+  'absl_failure_signal_handler',
+  'absl_fast_type_id',
+  'absl_fixed_array',
+  'absl_flat_hash_map',
+  'absl_flat_hash_set',
+  'absl_function_ref',
+  'absl_has_ostream_operator',
+  'absl_hash_container_defaults',
+  'absl_hash',
+  'absl_inlined_vector',
+  'absl_int128',
+  'absl_layout',
+  'absl_leak_check',
+  'absl_linked_hash_map',
+  'absl_linked_hash_set',
+  'absl_log_entry',
+  'absl_log_globals',
+  'absl_log_initialize',
+  'absl_log_severity',
+  'absl_log_sink_registry',
+  'absl_log_sink',
+  'absl_memory',
+  'absl_no_destructor',
+  'absl_node_hash_map',
+  'absl_node_hash_set',
+  'absl_nullability',
+  'absl_optional',
+  'absl_overload',
+  'absl_prefetch',
+  'absl_random_bit_gen_ref',
+  'absl_random_distributions',
+  'absl_random_random',
+  'absl_raw_logging_internal',
+  'absl_span',
+  'absl_stacktrace',
+  'absl_status',
+  'absl_statusor',
+  'absl_str_format',
+  'absl_string_view',
+  'absl_strings',
+  'absl_symbolize',
+  'absl_synchronization',
+  'absl_time',
+  'absl_type_traits',
+  'absl_utility',
+  'absl_variant',
+])
 configure_library('ada', output)
 configure_library('simdjson', output)
 configure_library('simdutf', output)
@@ -2821,12 +2966,14 @@ def make_bin_override():
 configure_library('cares', output, pkgname='libcares')
 configure_library('gtest', output)
 configure_library('hdr_histogram', output)
+configure_library('highway', output, pkgname='libhwy')
 configure_library('merve', output)
 configure_library('nbytes', output)
 configure_library('nghttp2', output, pkgname='libnghttp2')
 configure_library('nghttp3', output, pkgname='libnghttp3')
 configure_library('ngtcp2', output, pkgname='libngtcp2')
 configure_lief(output);
+configure_perfetto(output);
 configure_sqlite(output);
 configure_ffi(output);
 configure_library('temporal_capi', output)
diff --git a/deps/brotli/unofficial.gni b/deps/brotli/unofficial.gni
index 91001fa43ea4..0c6a7bd8c450 100644
--- a/deps/brotli/unofficial.gni
+++ b/deps/brotli/unofficial.gni
@@ -4,36 +4,49 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("brotli_gn_build") {
-  config("brotli_config") {
-    include_dirs = [ "c/include" ]
-  }
+import("../../node.gni")
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("brotli.gyp") ],
-                            "scope",
-                            [ "brotli.gyp" ])
-
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":brotli_config" ]
-    sources = gypi_values.brotli_sources
-    if (is_linux) {
-      defines = [ "OS_LINUX" ]
-    } else if (is_mac) {
-      defines = [ "OS_MACOSX" ]
-    } else if (target_os == "freebsd") {
-      defines = [ "OS_FREEBSD" ]
+template("brotli_gn_build") {
+  if (node_shared_brotli) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("brotli_config") {
+      packages = [ "libbrotlidec", "libbrotlienc" ]
     }
-    if (is_linux) {
-      libs = [ "m" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-      ]
+  } else {
+    config("brotli_config") {
+      include_dirs = [ "c/include" ]
+    }
+
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("brotli.gyp") ],
+                              "scope",
+                              [ "brotli.gyp" ])
+
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":brotli_config" ]
+      sources = gypi_values.brotli_sources
+      if (is_linux) {
+        defines = [ "OS_LINUX" ]
+      } else if (is_mac) {
+        defines = [ "OS_MACOSX" ]
+      } else if (target_os == "freebsd") {
+        defines = [ "OS_FREEBSD" ]
+      }
+      if (is_linux) {
+        libs = [ "m" ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+        ]
+      }
     }
   }
 }
diff --git a/deps/cares/unofficial.gni b/deps/cares/unofficial.gni
index e02d7f425194..364df1f312e2 100644
--- a/deps/cares/unofficial.gni
+++ b/deps/cares/unofficial.gni
@@ -4,78 +4,91 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("cares_gn_build") {
-  config("cares_config") {
-    include_dirs = [ "include" ]
-    if (!is_component_build) {
-      defines = [ "CARES_STATICLIB" ]
-    }
-  }
-
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("cares.gyp") ],
-                            "scope",
-                            [ "cares.gyp" ])
+import("../../node.gni")
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":cares_config" ]
-    if (is_component_build) {
-      defines = [ "CARES_BUILDING_LIBRARY" ]
-    } else {
-      defines = []
+template("cares_gn_build") {
+  if (node_shared_cares) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("cares_config") {
+      packages = [ "libcares" ]
     }
-    if (is_win) {
-      defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
     }
-    if (is_posix) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-        "_GNU_SOURCE",
-        "HAVE_CONFIG_H",
-      ]
+  } else {
+    config("cares_config") {
+      include_dirs = [ "include" ]
+      if (!is_component_build) {
+        defines = [ "CARES_STATICLIB" ]
+      }
     }
 
-    include_dirs = [
-      "src/lib",
-      "src/lib/include",
-    ]
-    if (is_win) {
-      include_dirs += [ "config/win32" ]
-    } else if (is_linux) {
-      include_dirs += [ "config/linux" ]
-    } else if (is_mac) {
-      include_dirs += [ "config/darwin" ]
-    }
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("cares.gyp") ],
+                              "scope",
+                              [ "cares.gyp" ])
 
-    if (is_win) {
-      libs = [
-        "ws2_32.lib",
-        "iphlpapi.lib",
-      ]
-    }
+    component(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":cares_config" ]
+      if (is_component_build) {
+        defines = [ "CARES_BUILDING_LIBRARY" ]
+      } else {
+        defines = []
+      }
+      if (is_win) {
+        defines += [ "CARES_PULL_WS2TCPIP_H=1" ]
+      }
+      if (is_posix) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+          "_GNU_SOURCE",
+          "HAVE_CONFIG_H",
+        ]
+      }
 
-    sources = gypi_values.cares_sources_common
-    if (is_linux) {
-      sources += [ "config/linux/ares_config.h" ]
-    }
-    if (is_mac) {
-      sources += gypi_values.cares_sources_mac
-    }
+      include_dirs = [
+        "src/lib",
+        "src/lib/include",
+      ]
+      if (is_win) {
+        include_dirs += [ "config/win32" ]
+      } else if (is_linux) {
+        include_dirs += [ "config/linux" ]
+      } else if (is_mac) {
+        include_dirs += [ "config/darwin" ]
+      }
 
-    if (is_clang) {
       if (is_win) {
-        cflags_c = [
-          "-Wno-macro-redefined",
-        ]
-      } else {
-        cflags_c = [
-          "-Wno-implicit-fallthrough",
-          "-Wno-unreachable-code",
+        libs = [
+          "ws2_32.lib",
+          "iphlpapi.lib",
         ]
       }
+
+      sources = gypi_values.cares_sources_common
+      if (is_linux) {
+        sources += [ "config/linux/ares_config.h" ]
+      }
+      if (is_mac) {
+        sources += gypi_values.cares_sources_mac
+      }
+
+      if (is_clang) {
+        if (is_win) {
+          cflags_c = [
+            "-Wno-macro-redefined",
+          ]
+        } else {
+          cflags_c = [
+            "-Wno-implicit-fallthrough",
+            "-Wno-unreachable-code",
+          ]
+        }
+      }
     }
   }
 }
diff --git a/deps/googletest/include/gtest/gtest-assertion-result.h b/deps/googletest/include/gtest/gtest-assertion-result.h
index a72ac939102e..882e9849353a 100644
--- a/deps/googletest/include/gtest/gtest-assertion-result.h
+++ b/deps/googletest/include/gtest/gtest-assertion-result.h
@@ -143,13 +143,9 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
   // Used in EXPECT_TRUE/FALSE(assertion_result).
   AssertionResult(const AssertionResult& other);
 
-// C4800 is a level 3 warning in Visual Studio 2015 and earlier.
-// This warning is not emitted in Visual Studio 2017.
-// This warning is off by default starting in Visual Studio 2019 but can be
-// enabled with command-line options.
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
+  // C4800 is off by default starting in Visual Studio 2019 but can be
+  // enabled with command-line options.
   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 /* forcing value to bool */)
-#endif
 
   // Used in the EXPECT_TRUE/FALSE(bool_expression).
   //
@@ -171,9 +167,7 @@ class GTEST_API_ [[nodiscard]] AssertionResult {
                              int> = 0>
   explicit AssertionResult(const T& success) : success_(success) {}
 
-#if defined(_MSC_VER) && (_MSC_VER < 1910 || _MSC_VER >= 1920)
   GTEST_DISABLE_MSC_WARNINGS_POP_()
-#endif
 
   // Assignment operator.
   AssertionResult& operator=(AssertionResult other) {
diff --git a/deps/googletest/include/gtest/gtest-matchers.h b/deps/googletest/include/gtest/gtest-matchers.h
index b5950425cc69..4d7a541d0f1f 100644
--- a/deps/googletest/include/gtest/gtest-matchers.h
+++ b/deps/googletest/include/gtest/gtest-matchers.h
@@ -52,16 +52,9 @@
 #include "gtest/internal/gtest-internal.h"
 #include "gtest/internal/gtest-port.h"
 
-// MSVC warning C5046 is new as of VS2017 version 15.8.
-#if defined(_MSC_VER) && _MSC_VER >= 1915
-#define GTEST_MAYBE_5046_ 5046
-#else
-#define GTEST_MAYBE_5046_
-#endif
-
 GTEST_DISABLE_MSC_WARNINGS_PUSH_(
-    4251 GTEST_MAYBE_5046_ /* class A needs to have dll-interface to be used by
-                              clients of class B */
+    // class A needs to have dll-interface to be used by clients of class B
+    4251 5046
     /* Symbol involving type with internal linkage not defined */)
 
 namespace testing {
diff --git a/deps/googletest/include/gtest/gtest-printers.h b/deps/googletest/include/gtest/gtest-printers.h
index f647ee691263..1288313b99ff 100644
--- a/deps/googletest/include/gtest/gtest-printers.h
+++ b/deps/googletest/include/gtest/gtest-printers.h
@@ -104,6 +104,8 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 #define GOOGLETEST_INCLUDE_GTEST_GTEST_PRINTERS_H_
 
+#include <stdint.h>
+
 #include <any>
 #include <functional>
 #include <memory>
@@ -279,15 +281,13 @@ struct ProtobufPrinter {
 
 struct ConvertibleToIntegerPrinter {
   // Since T has no << operator or PrintTo() but can be implicitly
-  // converted to BiggestInt, we print it as a BiggestInt.
+  // converted to intmax_t, we print it as an intmax_t.
   //
   // Most likely T is an enum type (either named or unnamed), in which
   // case printing it as an integer is the desired behavior.  In case
   // T is not an enum, printing it as an integer is the best we can do
   // given that it has no user-defined printer.
-  static void PrintValue(internal::BiggestInt value, ::std::ostream* os) {
-    *os << value;
-  }
+  static void PrintValue(intmax_t value, ::std::ostream* os) { *os << value; }
 };
 
 struct ConvertibleToStringViewPrinter {
@@ -347,7 +347,7 @@ struct FindFirstPrinter<
 //  - Print object pointers.
 //  - Print protocol buffers.
 //  - Use the stream operator, if available.
-//  - Print types convertible to BiggestInt.
+//  - Print types convertible to intmax_t.
 //  - Print types convertible to StringView, if available.
 //  - Fallback to printing the raw bytes of the object.
 template <typename T>
diff --git a/deps/googletest/include/gtest/gtest.h b/deps/googletest/include/gtest/gtest.h
index 9fe7fb44239e..7c003c5d60e3 100644
--- a/deps/googletest/include/gtest/gtest.h
+++ b/deps/googletest/include/gtest/gtest.h
@@ -1419,14 +1419,14 @@ class [[nodiscard]] EqHelper {
   }
 
   // With this overloaded version, we allow anonymous enums to be used
-  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous
-  // enums can be implicitly cast to BiggestInt.
+  // in {ASSERT|EXPECT}_EQ when compiled with gcc 4, as anonymous enums can be
+  // implicitly cast to intmax_t.
   //
   // Even though its body looks the same as the above version, we
   // cannot merge the two, as it will make anonymous enums unhappy.
   static AssertionResult Compare(const char* lhs_expression,
-                                 const char* rhs_expression, BiggestInt lhs,
-                                 BiggestInt rhs) {
+                                 const char* rhs_expression, intmax_t lhs,
+                                 intmax_t rhs) {
     return CmpHelperEQ(lhs_expression, rhs_expression, lhs, rhs);
   }
 
diff --git a/deps/googletest/include/gtest/internal/gtest-port.h b/deps/googletest/include/gtest/internal/gtest-port.h
index 94a56ce3dd9b..154be3c16029 100644
--- a/deps/googletest/include/gtest/internal/gtest-port.h
+++ b/deps/googletest/include/gtest/internal/gtest-port.h
@@ -236,7 +236,6 @@
 // Integer types:
 //   TypeWithSize   - maps an integer to a int type.
 //   TimeInMillis   - integers of known sizes.
-//   BiggestInt     - the biggest signed integer type.
 //
 // Command-line utilities:
 //   GetInjectableArgvs() - returns the command line as a vector of strings.
@@ -342,13 +341,6 @@
 #define GTEST_INIT_GOOGLE_TEST_NAME_ "testing::InitGoogleTest"
 #endif  // !defined(GTEST_INIT_GOOGLE_TEST_NAME_)
 
-// Determines the version of gcc that is used to compile this.
-#ifdef __GNUC__
-// 40302 means version 4.3.2.
-#define GTEST_GCC_VER_ \
-  (__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)
-#endif  // __GNUC__
-
 // Macros for disabling Microsoft Visual C++ warnings.
 //
 //   GTEST_DISABLE_MSC_WARNINGS_PUSH_(4800 4385)
@@ -456,14 +448,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #if defined(_MSC_VER) && defined(_CPPUNWIND)
 // MSVC defines _CPPUNWIND to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__BORLANDC__)
-// C++Builder's implementation of the STL uses the _HAS_EXCEPTIONS
-// macro to enable exceptions, so we'll do the same.
-// Assumes that exceptions are enabled by default.
-#ifndef _HAS_EXCEPTIONS
-#define _HAS_EXCEPTIONS 1
-#endif  // _HAS_EXCEPTIONS
-#define GTEST_HAS_EXCEPTIONS _HAS_EXCEPTIONS
 #elif defined(__clang__)
 // clang defines __EXCEPTIONS if and only if exceptions are enabled before clang
 // 220714, but if and only if cleanups are enabled after that. In Obj-C++ files,
@@ -481,23 +465,11 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #elif defined(__GNUC__) && defined(__EXCEPTIONS) && __EXCEPTIONS
 // gcc defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
 #define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__SUNPRO_CC)
-// Sun Pro CC supports exceptions.  However, there is no compile-time way of
-// detecting whether they are enabled or not.  Therefore, we assume that
-// they are enabled unless the user tells us otherwise.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__IBMCPP__) && defined(__EXCEPTIONS) && __EXCEPTIONS
-// xlC defines __EXCEPTIONS to 1 if and only if exceptions are enabled.
-#define GTEST_HAS_EXCEPTIONS 1
-#elif defined(__HP_aCC)
-// Exception handling is in effect by default in HP aCC compiler. It has to
-// be turned of by +noeh compiler option if desired.
-#define GTEST_HAS_EXCEPTIONS 1
 #else
 // For other compilers, we assume exceptions are disabled to be
 // conservative.
 #define GTEST_HAS_EXCEPTIONS 0
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER) && defined(_CPPUNWIND)
 #endif  // GTEST_HAS_EXCEPTIONS
 
 // MSVC either defines wchar_t as a typedef of unsigned short, or as a native
@@ -621,16 +593,6 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 #define GTEST_HAS_RTTI __has_feature(cxx_rtti)
 
-// Starting with version 9.0 IBM Visual Age defines __RTTI_ALL__ to 1 if
-// both the typeid and dynamic_cast features are present.
-#elif defined(__IBMCPP__) && (__IBMCPP__ >= 900)
-
-#ifdef __RTTI_ALL__
-#define GTEST_HAS_RTTI 1
-#else
-#define GTEST_HAS_RTTI 0
-#endif
-
 #else
 
 // For all other compilers, we assume RTTI is enabled.
@@ -752,8 +714,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 
 // Typed tests need <typeinfo> and variadic macros, which GCC, VC++ 8.0,
 // Sun Pro CC, IBM Visual Age, and HP aCC support.
-#if defined(__GNUC__) || defined(_MSC_VER) || defined(__SUNPRO_CC) || \
-    defined(__IBMCPP__) || defined(__HP_aCC)
+#if defined(__GNUC__) || defined(_MSC_VER)
 #define GTEST_HAS_TYPED_TEST 1
 #define GTEST_HAS_TYPED_TEST_P 1
 #endif
@@ -867,8 +828,7 @@ typedef struct _RTL_CRITICAL_SECTION GTEST_CRITICAL_SECTION;
 #ifndef GTEST_HAS_SEH
 // The user didn't tell us, so we need to figure it out.
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// These two compilers are known to support SEH.
+#ifdef _MSC_VER
 #define GTEST_HAS_SEH 1
 #else
 // Assume no SEH.
@@ -2146,12 +2106,6 @@ inline bool IsDir(const StatStruct& st) { return S_ISDIR(st.st_mode); }
 
 #ifdef GTEST_OS_WINDOWS
 
-#ifdef __BORLANDC__
-inline int DoIsATTY(int fd) { return isatty(fd); }
-inline int StrCaseCmp(const char* s1, const char* s2) {
-  return stricmp(s1, s2);
-}
-#else  // !__BORLANDC__
 #if defined(GTEST_OS_WINDOWS_MOBILE) || defined(GTEST_OS_ZOS) || \
     defined(GTEST_OS_IOS) || defined(GTEST_OS_WINDOWS_PHONE) ||  \
     defined(GTEST_OS_WINDOWS_RT) || defined(ESP_PLATFORM)
@@ -2162,7 +2116,6 @@ inline int DoIsATTY(int fd) { return _isatty(fd); }
 inline int StrCaseCmp(const char* s1, const char* s2) {
   return _stricmp(s1, s2);
 }
-#endif  // __BORLANDC__
 
 #else
 
@@ -2264,11 +2217,6 @@ inline const char* GetEnv(const char* name) {
   // We are on an embedded platform, which has no environment variables.
   static_cast<void>(name);  // To prevent 'unused argument' warning.
   return nullptr;
-#elif defined(__BORLANDC__) || defined(__SunOS_5_8) || defined(__SunOS_5_9)
-  // Environment variables which we programmatically clear will be set to the
-  // empty string rather than unset (NULL).  Handle that case.
-  const char* const env = getenv(name);
-  return (env != nullptr && env[0] != '\0') ? env : nullptr;
 #else
   return getenv(name);
 #endif
@@ -2303,14 +2251,6 @@ GTEST_DISABLE_DEPRECATED_POP_()
 #define GTEST_SNPRINTF_ snprintf
 #endif
 
-// The biggest signed integer type the compiler supports.
-//
-// long long is guaranteed to be at least 64-bits in C++11.
-using BiggestInt = long long;  // NOLINT
-
-// The maximum number a BiggestInt can represent.
-constexpr BiggestInt kMaxBiggestInt = (std::numeric_limits<BiggestInt>::max)();
-
 // This template class serves as a compile-time function from size to
 // type.  It maps a size in bytes to a primitive type with that
 // size. e.g.
diff --git a/deps/googletest/include/gtest/internal/gtest-string.h b/deps/googletest/include/gtest/internal/gtest-string.h
index 2363034fc0db..d0652c13c68e 100644
--- a/deps/googletest/include/gtest/internal/gtest-string.h
+++ b/deps/googletest/include/gtest/internal/gtest-string.h
@@ -43,11 +43,6 @@
 #ifndef GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 #define GOOGLETEST_INCLUDE_GTEST_INTERNAL_GTEST_STRING_H_
 
-#ifdef __BORLANDC__
-// string.h is not guaranteed to provide strcpy on C++ Builder.
-#include <mem.h>
-#endif
-
 #include <string.h>
 
 #include <cstdint>
diff --git a/deps/googletest/include/gtest/internal/gtest-type-util.h b/deps/googletest/include/gtest/internal/gtest-type-util.h
index 78da05316d6b..fb4d6823744e 100644
--- a/deps/googletest/include/gtest/internal/gtest-type-util.h
+++ b/deps/googletest/include/gtest/internal/gtest-type-util.h
@@ -47,8 +47,6 @@
 // libstdc++ (which is where cxxabi.h comes from).
 #if GTEST_HAS_CXXABI_H_
 #include <cxxabi.h>
-#elif defined(__HP_aCC)
-#include <acxx_demangle.h>
 #endif  // GTEST_HASH_CXXABI_H_
 
 namespace testing {
@@ -90,13 +88,11 @@ inline std::string CanonicalizeForStdLibVersioning(std::string s) {
 // GetTypeName(const std::type_info&) returns a human-readable name of type T.
 inline std::string GetTypeName(const std::type_info& type) {
   const char* const name = type.name();
-#if GTEST_HAS_CXXABI_H_ || defined(__HP_aCC)
+#if GTEST_HAS_CXXABI_H_
   int status = 0;
   // gcc's implementation of typeid(T).name() mangles the type name,
   // so we have to demangle it.
-#if GTEST_HAS_CXXABI_H_
   using abi::__cxa_demangle;
-#endif  // GTEST_HAS_CXXABI_H_
   char* const readable_name = __cxa_demangle(name, nullptr, nullptr, &status);
   const std::string name_str(status == 0 ? readable_name : name);
   free(readable_name);
@@ -117,7 +113,7 @@ inline std::string GetTypeName(const std::type_info& type) {
   return s;
 #else
   return name;
-#endif  // GTEST_HAS_CXXABI_H_ || __HP_aCC
+#endif  // GTEST_HAS_CXXABI_H_
 }
 #endif  // GTEST_HAS_RTTI
 
diff --git a/deps/googletest/src/gtest-port.cc b/deps/googletest/src/gtest-port.cc
index 5aa800305c7a..be5b16e76d3e 100644
--- a/deps/googletest/src/gtest-port.cc
+++ b/deps/googletest/src/gtest-port.cc
@@ -1242,14 +1242,14 @@ static std::string GetCapturedStream(CapturedStream** captured_stream) {
   return content;
 }
 
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-// MSVC and C++Builder do not provide a definition of STDERR_FILENO.
+#if defined(_MSC_VER)
+// MSVC does not provide a definition of STDERR_FILENO.
 const int kStdOutFileno = 1;
 const int kStdErrFileno = 2;
 #else
 const int kStdOutFileno = STDOUT_FILENO;
 const int kStdErrFileno = STDERR_FILENO;
-#endif  // defined(_MSC_VER) || defined(__BORLANDC__)
+#endif  // defined(_MSC_VER)
 
 // Starts capturing stdout.
 void CaptureStdout() {
diff --git a/deps/googletest/src/gtest.cc b/deps/googletest/src/gtest.cc
index 30a2bb7de0bc..47c60da22916 100644
--- a/deps/googletest/src/gtest.cc
+++ b/deps/googletest/src/gtest.cc
@@ -5289,17 +5289,8 @@ void TestEventListeners::SuppressEventForwarding(bool suppress) {
 // call this before main() starts, from which point on the return
 // value will never change.
 UnitTest* UnitTest::GetInstance() {
-  // CodeGear C++Builder insists on a public destructor for the
-  // default implementation.  Use this implementation to keep good OO
-  // design with private destructor.
-
-#if defined(__BORLANDC__)
-  static UnitTest* const instance = new UnitTest;
-  return instance;
-#else
   static UnitTest instance;
   return &instance;
-#endif  // defined(__BORLANDC__)
 }
 
 // Gets the number of successful test suites.
diff --git a/deps/histogram/unofficial.gni b/deps/histogram/unofficial.gni
index 1173ab298ae7..fd8c3a276bcb 100644
--- a/deps/histogram/unofficial.gni
+++ b/deps/histogram/unofficial.gni
@@ -4,29 +4,42 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("histogram_gn_build") {
-  config("histogram_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_hdr_histogram) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("histogram_config") {
+      packages = [ "hdr_histogram" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+    }
+  } else {
+    config("histogram_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("histogram.gyp") ],
-                            "scope",
-                            [ "histogram.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("histogram.gyp") ],
+                              "scope",
+                              [ "histogram.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":histogram_config" ]
-    sources = gypi_values.histogram_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-atomic-alignment",
-        "-Wno-incompatible-pointer-types",
-        "-Wno-unused-function",
-      ]
-    }
-    if (is_linux) {
-      libs = [ "atomic" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":histogram_config" ]
+      sources = gypi_values.histogram_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-atomic-alignment",
+          "-Wno-incompatible-pointer-types",
+          "-Wno-unused-function",
+        ]
+      }
+      if (is_linux) {
+        libs = [ "atomic" ]
+      }
     }
   }
 }
diff --git a/deps/llhttp/unofficial.gni b/deps/llhttp/unofficial.gni
index fdce32e59764..28257dcb33ae 100644
--- a/deps/llhttp/unofficial.gni
+++ b/deps/llhttp/unofficial.gni
@@ -4,26 +4,39 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("llhttp_gn_build") {
-  config("llhttp_config") {
-    include_dirs = [ "include" ]
-  }
+  if (node_shared_http_parser) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("llhttp_config") {
+      packages = [ "libllhttp" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+    }
+  } else {
+    config("llhttp_config") {
+      include_dirs = [ "include" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("llhttp.gyp") ],
-                            "scope",
-                            [ "llhttp.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("llhttp.gyp") ],
+                              "scope",
+                              [ "llhttp.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":llhttp_config" ]
-    include_dirs = [ "include" ]
-    sources = gypi_values.llhttp_sources
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        "-Wno-unreachable-code",
-      ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":llhttp_config" ]
+      include_dirs = [ "include" ]
+      sources = gypi_values.llhttp_sources
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          "-Wno-unreachable-code",
+        ]
+      }
     }
   }
 }
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index 59006ebf6a84..9c88d919e9ad 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -131,6 +131,31 @@ struct OpenSSLBufferDeleter {
 };
 using OpenSSLBufferPointer =
     std::unique_ptr<unsigned char, OpenSSLBufferDeleter>;
+
+struct RsaOtherPrimeParamNames {
+  const char* factor;
+  const char* exponent;
+  const char* coefficient;
+};
+
+#define RSA_OTHER_PRIME_PARAM_NAMES(prime, coefficient)                        \
+  {                                                                            \
+    OSSL_PKEY_PARAM_RSA_FACTOR #prime, OSSL_PKEY_PARAM_RSA_EXPONENT #prime,    \
+        OSSL_PKEY_PARAM_RSA_COEFFICIENT #coefficient                           \
+  }
+
+constexpr std::array<RsaOtherPrimeParamNames, 8> kRsaOtherPrimeParamNames = {{
+    RSA_OTHER_PRIME_PARAM_NAMES(3, 2),
+    RSA_OTHER_PRIME_PARAM_NAMES(4, 3),
+    RSA_OTHER_PRIME_PARAM_NAMES(5, 4),
+    RSA_OTHER_PRIME_PARAM_NAMES(6, 5),
+    RSA_OTHER_PRIME_PARAM_NAMES(7, 6),
+    RSA_OTHER_PRIME_PARAM_NAMES(8, 7),
+    RSA_OTHER_PRIME_PARAM_NAMES(9, 8),
+    RSA_OTHER_PRIME_PARAM_NAMES(10, 9),
+}};
+
+#undef RSA_OTHER_PRIME_PARAM_NAMES
 #endif
 
 static constexpr int kX509NameFlagsRFC2253WithinUtf8JSON =
@@ -3082,6 +3107,19 @@ EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
             bld.get(), OSSL_PKEY_PARAM_RSA_COEFFICIENT1, private_key.qi) != 1) {
       return {};
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (other_prime_infos.size() > kRsaOtherPrimeParamNames.size()) return {};
+    for (size_t i = 0; i < other_prime_infos.size(); i++) {
+      const auto& info = other_prime_infos[i];
+      const auto& names = kRsaOtherPrimeParamNames[i];
+      if (info.r == nullptr || info.d == nullptr || info.t == nullptr ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.factor, info.r) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.exponent, info.d) != 1 ||
+          OSSL_PARAM_BLD_push_BN(bld.get(), names.coefficient, info.t) != 1) {
+        return {};
+      }
+    }
     selection = EVP_PKEY_KEYPAIR;
   }
 
@@ -4092,11 +4130,7 @@ std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
 #endif
   } else if (id == EVP_PKEY_EC) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
-    Ec ec(get());
-    if (!ec) return std::nullopt;
-    const EC_GROUP* group = ec.getGroup();
-    if (group == nullptr) return std::nullopt;
-    bits = EC_GROUP_order_bits(group);
+    bits = EVP_PKEY_bits(get());
 #else
     const EC_KEY* ec_key = EVP_PKEY_get0_EC_KEY(get());
     if (ec_key == nullptr) return std::nullopt;
@@ -5310,6 +5344,24 @@ bool ECPointPointer::mul(const EC_GROUP* group, const BIGNUM* priv_key) {
 
 // ============================================================================
 
+bool ECKeyPointer::checkPrivateKey() const {
+  const auto group = getGroup();
+  const auto priv = getPrivateKey();
+  const auto pub = getPublicKey();
+  if (group == nullptr || priv == nullptr || pub == nullptr) return false;
+
+  auto order = BignumPointer::New();
+  if (!order || !EC_GROUP_get_order(group, order.get(), nullptr) ||
+      BN_is_zero(priv) || BN_is_negative(priv) ||
+      BN_cmp(priv, order.get()) >= 0) {
+    return false;
+  }
+
+  auto expected = ECPointPointer::New(group);
+  return expected && expected.mul(group, priv) &&
+         EC_POINT_cmp(group, expected.get(), pub, nullptr) == 0;
+}
+
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 ECKeyPointer::ECKeyPointer() : key_(nullptr) {}
 
@@ -6135,6 +6187,11 @@ DataPointer CipherImpl(const EVPKeyPointer& key,
 }
 }  // namespace
 
+Rsa::OtherPrimeInfoPointer::OtherPrimeInfoPointer(BignumPointer&& r,
+                                                  BignumPointer&& d,
+                                                  BignumPointer&& t)
+    : r(r.release()), d(d.release()), t(t.release()) {}
+
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
 namespace {
 int DigestAlgorithmIdentifierToNid(const unsigned char* data, size_t size) {
@@ -6363,6 +6420,19 @@ Rsa::Rsa(const EVP_PKEY* pkey) : Rsa() {
     return;
   }
 
+  for (const auto& names : kRsaOtherPrimeParamNames) {
+    OtherPrimeInfoPointer info;
+    if (!GetOptionalPKeyBnParam(pkey, names.factor, &info.r) ||
+        !GetOptionalPKeyBnParam(pkey, names.exponent, &info.d) ||
+        !GetOptionalPKeyBnParam(pkey, names.coefficient, &info.t)) {
+      return;
+    }
+
+    if (!info.r && !info.d && !info.t) break;
+    if (!info.r || !info.d || !info.t) return;
+    other_prime_infos_.push_back(std::move(info));
+  }
+
   if (type == EVP_PKEY_RSA_PSS) {
     MarkPopErrorOnReturn pop_errors;
     PssParams params;
@@ -6401,6 +6471,35 @@ const Rsa::PrivateKey Rsa::getPrivateKey() const {
 #endif
 }
 
+const Rsa::OtherPrimeInfos Rsa::getOtherPrimeInfos() const {
+  OtherPrimeInfos infos;
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  infos.reserve(other_prime_infos_.size());
+  for (const auto& info : other_prime_infos_) {
+    infos.push_back({info.r.get(), info.d.get(), info.t.get()});
+  }
+#elif NCRYPTO_USE_LEGACY_OPENSSL
+  if (rsa_ == nullptr) return infos;
+  const int count = RSA_get_multi_prime_extra_count(rsa_);
+  if (count <= 0) return infos;
+
+  std::vector<const BIGNUM*> factors(count);
+  std::vector<const BIGNUM*> exponents(count);
+  std::vector<const BIGNUM*> coefficients(count);
+  if (RSA_get0_multi_prime_factors(rsa_, factors.data()) != 1 ||
+      RSA_get0_multi_prime_crt_params(
+          rsa_, exponents.data(), coefficients.data()) != 1) {
+    return {};
+  }
+
+  infos.reserve(count);
+  for (int i = 0; i < count; i++) {
+    infos.push_back({factors[i], exponents[i], coefficients[i]});
+  }
+#endif
+  return infos;
+}
+
 const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   return pss_params_;
@@ -6502,15 +6601,20 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
                         BignumPointer&& p,
                         BignumPointer&& dp,
                         BignumPointer&& dq,
-                        BignumPointer&& qi) {
+                        BignumPointer&& qi,
+                        OtherPrimeInfoPointers&& other_prime_infos) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   if (!d || !q || !p || !dp || !dq || !qi) return false;
+  for (const auto& info : other_prime_infos) {
+    if (!info.r || !info.d || !info.t) return false;
+  }
   d_.reset(d.release());
   q_.reset(q.release());
   p_.reset(p.release());
   dp_.reset(dp.release());
   dq_.reset(dq.release());
   qi_.reset(qi.release());
+  other_prime_infos_ = std::move(other_prime_infos);
   rsa_ = n_ != nullptr && e_ != nullptr;
   return rsa_;
 #else
@@ -6532,6 +6636,37 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
   dp.release();
   dq.release();
   qi.release();
+
+#if NCRYPTO_USE_LEGACY_OPENSSL
+  if (!other_prime_infos.empty()) {
+    std::vector<BIGNUM*> factors;
+    std::vector<BIGNUM*> exponents;
+    std::vector<BIGNUM*> coefficients;
+    factors.reserve(other_prime_infos.size());
+    exponents.reserve(other_prime_infos.size());
+    coefficients.reserve(other_prime_infos.size());
+    for (const auto& info : other_prime_infos) {
+      if (!info.r || !info.d || !info.t) return false;
+      factors.push_back(info.r.get());
+      exponents.push_back(info.d.get());
+      coefficients.push_back(info.t.get());
+    }
+    if (RSA_set0_multi_prime_params(const_cast<RSA*>(rsa_),
+                                    factors.data(),
+                                    exponents.data(),
+                                    coefficients.data(),
+                                    static_cast<int>(factors.size())) != 1) {
+      return false;
+    }
+    for (auto& info : other_prime_infos) {
+      info.r.release();
+      info.d.release();
+      info.t.release();
+    }
+  }
+#else
+  if (!other_prime_infos.empty()) return false;
+#endif
   return true;
 #endif
 }
@@ -6794,6 +6929,128 @@ int Ec::getCurve() const {
   return EC_GROUP_get_curve_name(getGroup());
 }
 
+DataPointer Ec::TryExportPublic(const EVPKeyPointer& key,
+                                point_conversion_form_t form) {
+  if (form != POINT_CONVERSION_UNCOMPRESSED) return {};
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  {
+    MarkPopErrorOnReturn pop_errors;
+    size_t length = 0;
+    if (EVP_PKEY_get_octet_string_param(
+            key.get(), OSSL_PKEY_PARAM_PUB_KEY, nullptr, 0, &length) == 1) {
+      auto bytes = DataPointer::Alloc(length);
+      if (bytes && length != 0 &&
+          EVP_PKEY_get_octet_string_param(key.get(),
+                                          OSSL_PKEY_PARAM_PUB_KEY,
+                                          bytes.get<unsigned char>(),
+                                          length,
+                                          &length) == 1 &&
+          (bytes.get<unsigned char>()[0] & ~1) == form) {
+        return bytes.resize(length);
+      }
+    }
+  }
+#endif
+  return {};
+}
+
+DataPointer Ec::ExportPrivate(const EVPKeyPointer& key) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  {
+    MarkPopErrorOnReturn pop_errors;
+    BignumPointer priv;
+    BignumPointer order;
+    if (GetPKeyBnParam(key.get(), OSSL_PKEY_PARAM_PRIV_KEY, &priv) &&
+        GetPKeyBnParam(key.get(), OSSL_PKEY_PARAM_EC_ORDER, &order)) {
+      return priv.encodePadded(order.byteLength());
+    }
+  }
+#endif
+  ECKeyPointer ec(key);
+  if (!ec || ec.getPrivateKey() == nullptr) return {};
+  auto order = BignumPointer::New();
+  if (!order || !EC_GROUP_get_order(ec.getGroup(), order.get(), nullptr))
+    return {};
+  return BignumPointer::EncodePadded(ec.getPrivateKey(), order.byteLength());
+}
+
+bool Ec::GetKeyComponents(const EVPKeyPointer& key,
+                          BignumPointer* x,
+                          BignumPointer* y,
+                          BignumPointer* priv,
+                          int* degree) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  const int nid = GetCurveId(key);
+  switch (nid) {
+    case NID_X9_62_prime256v1:
+    case NID_secp256k1:
+      *degree = 256;
+      break;
+    case NID_secp384r1:
+      *degree = 384;
+      break;
+    case NID_secp521r1:
+      *degree = 521;
+      break;
+    default:
+      *degree = 0;
+  }
+  if (*degree != 0) {
+    MarkPopErrorOnReturn pop_errors;
+    unsigned char x_bytes[66]{};
+    unsigned char y_bytes[66]{};
+    const size_t width = (*degree + 7) / 8;
+    OSSL_PARAM params[] = {
+        OSSL_PARAM_construct_BN(OSSL_PKEY_PARAM_EC_PUB_X, x_bytes, width),
+        OSSL_PARAM_construct_BN(OSSL_PKEY_PARAM_EC_PUB_Y, y_bytes, width),
+        OSSL_PARAM_construct_end(),
+    };
+    if (EVP_PKEY_get_params(key.get(), params) == 1 &&
+        OSSL_PARAM_modified(&params[0]) && OSSL_PARAM_modified(&params[1])) {
+      x->reset(BN_native2bn(x_bytes, width, nullptr));
+      y->reset(BN_native2bn(y_bytes, width, nullptr));
+      return *x && *y &&
+             (priv == nullptr ||
+              GetPKeyBnParam(key.get(), OSSL_PKEY_PARAM_PRIV_KEY, priv));
+    }
+  }
+#endif
+  ECKeyPointer ec(key);
+  if (!ec || ec.getPublicKey() == nullptr) return false;
+  *degree = EC_GROUP_get_degree(ec.getGroup());
+  x->reset(BN_new());
+  y->reset(BN_new());
+  if (!*x || !*y ||
+      EC_POINT_get_affine_coordinates(
+          ec.getGroup(), ec.getPublicKey(), x->get(), y->get(), nullptr) != 1) {
+    return false;
+  }
+  if (priv != nullptr) {
+    if (ec.getPrivateKey() == nullptr) return false;
+    priv->reset(BN_dup(ec.getPrivateKey()));
+    if (!*priv) return false;
+  }
+  return true;
+}
+
+int Ec::GetCurveId(const EVPKeyPointer& key) {
+#if NCRYPTO_USE_OPENSSL3_PROVIDER
+  char name[80];
+  size_t length = 0;
+  if (EVP_PKEY_get_utf8_string_param(
+          key.get(), OSSL_PKEY_PARAM_GROUP_NAME, name, sizeof(name), &length) !=
+      1) {
+    return NID_undef;
+  }
+  return GetCurveIdFromName(name);
+#else
+  const EC_KEY* ec = key;
+  if (ec == nullptr) return NID_undef;
+  const EC_GROUP* group = EC_KEY_get0_group(ec);
+  return group == nullptr ? NID_undef : EC_GROUP_get_curve_name(group);
+#endif
+}
+
 int Ec::GetCurveIdFromName(const char* name) {
   int nid = EC_curve_nist2nid(name);
   if (nid == NID_undef) {
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 79f403788cf4..944c42490d6c 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -724,6 +724,23 @@ class Rsa final {
     const BIGNUM* dq;
     const BIGNUM* qi;
   };
+  struct OtherPrimeInfo {
+    const BIGNUM* r;
+    const BIGNUM* d;
+    const BIGNUM* t;
+  };
+  struct OtherPrimeInfoPointer {
+    OtherPrimeInfoPointer() = default;
+    OtherPrimeInfoPointer(BignumPointer&& r,
+                          BignumPointer&& d,
+                          BignumPointer&& t);
+
+    DeleteFnPtr<BIGNUM, BN_clear_free> r;
+    DeleteFnPtr<BIGNUM, BN_clear_free> d;
+    DeleteFnPtr<BIGNUM, BN_clear_free> t;
+  };
+  using OtherPrimeInfos = std::vector<OtherPrimeInfo>;
+  using OtherPrimeInfoPointers = std::vector<OtherPrimeInfoPointer>;
   struct PssParams {
     std::string_view digest = "sha1";
     std::optional<std::string_view> mgf1_digest = "sha1";
@@ -732,6 +749,7 @@ class Rsa final {
 
   const PublicKey getPublicKey() const;
   const PrivateKey getPrivateKey() const;
+  const OtherPrimeInfos getOtherPrimeInfos() const;
   const std::optional<PssParams> getPssParams() const;
 
   bool setPublicKey(BignumPointer&& n, BignumPointer&& e);
@@ -740,7 +758,8 @@ class Rsa final {
                      BignumPointer&& p,
                      BignumPointer&& dp,
                      BignumPointer&& dq,
-                     BignumPointer&& qi);
+                     BignumPointer&& qi,
+                     OtherPrimeInfoPointers&& other_prime_infos = {});
 
   using CipherParams = Cipher::CipherParams;
 
@@ -765,6 +784,7 @@ class Rsa final {
   DeleteFnPtr<BIGNUM, BN_clear_free> dp_;
   DeleteFnPtr<BIGNUM, BN_clear_free> dq_;
   DeleteFnPtr<BIGNUM, BN_clear_free> qi_;
+  OtherPrimeInfoPointers other_prime_infos_;
   std::optional<PssParams> pss_params_;
 #else
   OSSL3_CONST RSA* rsa_;
@@ -792,6 +812,15 @@ class Ec final {
 #endif
 
   static int GetCurveIdFromName(const char* name);
+  static int GetCurveId(const EVPKeyPointer& key);
+  static DataPointer TryExportPublic(const EVPKeyPointer& key,
+                                     point_conversion_form_t form);
+  static DataPointer ExportPrivate(const EVPKeyPointer& key);
+  static bool GetKeyComponents(const EVPKeyPointer& key,
+                               BignumPointer* x,
+                               BignumPointer* y,
+                               BignumPointer* priv,
+                               int* degree);
 
   using GetCurveCallback = std::function<bool(const char*)>;
   static bool GetCurves(GetCurveCallback callback);
@@ -1744,6 +1773,7 @@ class ECKeyPointer final {
   bool setPublicKeyRaw(const BignumPointer& x, const BignumPointer& y);
   bool generate();
   bool checkKey() const;
+  bool checkPrivateKey() const;
   DataPointer computeSecret(const ECPointPointer& peer) const;
 
   const EC_GROUP* getGroup() const;
diff --git a/deps/nghttp2/unofficial.gni b/deps/nghttp2/unofficial.gni
index 4558fbbf5e5f..d37754f59124 100644
--- a/deps/nghttp2/unofficial.gni
+++ b/deps/nghttp2/unofficial.gni
@@ -4,40 +4,53 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("nghttp2_gn_build") {
-  config("nghttp2_config") {
-    include_dirs = [ "lib/includes" ]
-    if (!is_component_build) {
-      defines = [ "NGHTTP2_STATICLIB" ]
+  if (node_shared_nghttp2) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("nghttp2_config") {
+      packages = [ "libnghttp2" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":nghttp2_config" ]
+    }
+  } else {
+    config("nghttp2_config") {
+      include_dirs = [ "lib/includes" ]
+      if (!is_component_build) {
+        defines = [ "NGHTTP2_STATICLIB" ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("nghttp2.gyp") ],
-                            "scope",
-                            [ "nghttp2.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("nghttp2.gyp") ],
+                              "scope",
+                              [ "nghttp2.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    public_configs = [ ":nghttp2_config" ]
-    defines = [
-      "_U_",
-      "HAVE_CONFIG_H"
-    ]
-    if (is_component_build) {
-      defines += [ "BUILDING_NGHTTP2" ]
-    }
+      public_configs = [ ":nghttp2_config" ]
+      defines = [
+        "_U_",
+        "HAVE_CONFIG_H"
+      ]
+      if (is_component_build) {
+        defines += [ "BUILDING_NGHTTP2" ]
+      }
 
-    sources = gypi_values.nghttp2_sources
+      sources = gypi_values.nghttp2_sources
 
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-implicit-fallthrough",
-        # Ref https://github.com/nghttp2/nghttp2/pull/2258
-        # This can be removed when the above PR is ingested.
-        "-Wno-extra-semi",
-      ]
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-implicit-fallthrough",
+          # Ref https://github.com/nghttp2/nghttp2/pull/2258
+          # This can be removed when the above PR is ingested.
+          "-Wno-extra-semi",
+        ]
+      }
     }
   }
 }
diff --git a/deps/npm/docs/content/commands/npm-ls.md b/deps/npm/docs/content/commands/npm-ls.md
index 24746c173b7c..b38603c203fc 100644
--- a/deps/npm/docs/content/commands/npm-ls.md
+++ b/deps/npm/docs/content/commands/npm-ls.md
@@ -23,7 +23,7 @@ Note that nested packages will *also* show the paths to the specified packages.
 For example, running `npm ls promzard` in npm's source tree will show:
 
 ```bash
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 ```
diff --git a/deps/npm/docs/content/commands/npm.md b/deps/npm/docs/content/commands/npm.md
index 769bb262064e..75157bd7b598 100644
--- a/deps/npm/docs/content/commands/npm.md
+++ b/deps/npm/docs/content/commands/npm.md
@@ -14,7 +14,7 @@ Note: This command is unaware of workspaces.
 
 ### Version
 
-11.19.0
+11.19.1
 
 ### Description
 
diff --git a/deps/npm/docs/output/commands/npm-access.html b/deps/npm/docs/output/commands/npm-access.html
index 2a044ef5ed59..ac6df64b960b 100644
--- a/deps/npm/docs/output/commands/npm-access.html
+++ b/deps/npm/docs/output/commands/npm-access.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-access----11190">
+<h1 id="----npm-access----11191">
     <span>npm-access</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set access level on published packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-adduser.html b/deps/npm/docs/output/commands/npm-adduser.html
index c59e21d94298..29aec6314e96 100644
--- a/deps/npm/docs/output/commands/npm-adduser.html
+++ b/deps/npm/docs/output/commands/npm-adduser.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-adduser----11190">
+<h1 id="----npm-adduser----11191">
     <span>npm-adduser</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Add a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-approve-scripts.html b/deps/npm/docs/output/commands/npm-approve-scripts.html
index 55c9db2b2a2b..3d61cc8ea23a 100644
--- a/deps/npm/docs/output/commands/npm-approve-scripts.html
+++ b/deps/npm/docs/output/commands/npm-approve-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-approve-scripts----11190">
+<h1 id="----npm-approve-scripts----11191">
     <span>npm-approve-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Approve install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-audit.html b/deps/npm/docs/output/commands/npm-audit.html
index 438891b03cbc..9117faa9bed5 100644
--- a/deps/npm/docs/output/commands/npm-audit.html
+++ b/deps/npm/docs/output/commands/npm-audit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-audit----11190">
+<h1 id="----npm-audit----11191">
     <span>npm-audit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a security audit</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-bugs.html b/deps/npm/docs/output/commands/npm-bugs.html
index eb7a91c9457f..63f4c29210a2 100644
--- a/deps/npm/docs/output/commands/npm-bugs.html
+++ b/deps/npm/docs/output/commands/npm-bugs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-bugs----11190">
+<h1 id="----npm-bugs----11191">
     <span>npm-bugs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Report bugs for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-cache.html b/deps/npm/docs/output/commands/npm-cache.html
index 374878c8d04e..3377b00cc56c 100644
--- a/deps/npm/docs/output/commands/npm-cache.html
+++ b/deps/npm/docs/output/commands/npm-cache.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-cache----11190">
+<h1 id="----npm-cache----11191">
     <span>npm-cache</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manipulates packages cache</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ci.html b/deps/npm/docs/output/commands/npm-ci.html
index 0a91d5159b12..edde5bbdef66 100644
--- a/deps/npm/docs/output/commands/npm-ci.html
+++ b/deps/npm/docs/output/commands/npm-ci.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ci----11190">
+<h1 id="----npm-ci----11191">
     <span>npm-ci</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Clean install a project</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-completion.html b/deps/npm/docs/output/commands/npm-completion.html
index dc927a82868a..b5a6f445d451 100644
--- a/deps/npm/docs/output/commands/npm-completion.html
+++ b/deps/npm/docs/output/commands/npm-completion.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-completion----11190">
+<h1 id="----npm-completion----11191">
     <span>npm-completion</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Tab Completion for npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-config.html b/deps/npm/docs/output/commands/npm-config.html
index 5b4e3e1204bc..c9ea9080cf78 100644
--- a/deps/npm/docs/output/commands/npm-config.html
+++ b/deps/npm/docs/output/commands/npm-config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-config----11190">
+<h1 id="----npm-config----11191">
     <span>npm-config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage the npm configuration files</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dedupe.html b/deps/npm/docs/output/commands/npm-dedupe.html
index 0f08ae285737..abe4a229e77c 100644
--- a/deps/npm/docs/output/commands/npm-dedupe.html
+++ b/deps/npm/docs/output/commands/npm-dedupe.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dedupe----11190">
+<h1 id="----npm-dedupe----11191">
     <span>npm-dedupe</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Reduce duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deny-scripts.html b/deps/npm/docs/output/commands/npm-deny-scripts.html
index 8b82b3684feb..3a56f32dc977 100644
--- a/deps/npm/docs/output/commands/npm-deny-scripts.html
+++ b/deps/npm/docs/output/commands/npm-deny-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deny-scripts----11190">
+<h1 id="----npm-deny-scripts----11191">
     <span>npm-deny-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deny install scripts for specific dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-deprecate.html b/deps/npm/docs/output/commands/npm-deprecate.html
index 489345c280bc..90f45466cad9 100644
--- a/deps/npm/docs/output/commands/npm-deprecate.html
+++ b/deps/npm/docs/output/commands/npm-deprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-deprecate----11190">
+<h1 id="----npm-deprecate----11191">
     <span>npm-deprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Deprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-diff.html b/deps/npm/docs/output/commands/npm-diff.html
index 3bb3d244a198..fba245e3b33a 100644
--- a/deps/npm/docs/output/commands/npm-diff.html
+++ b/deps/npm/docs/output/commands/npm-diff.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-diff----11190">
+<h1 id="----npm-diff----11191">
     <span>npm-diff</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The registry diff command</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-dist-tag.html b/deps/npm/docs/output/commands/npm-dist-tag.html
index 9f3aafdf4314..2d42ee8e3e84 100644
--- a/deps/npm/docs/output/commands/npm-dist-tag.html
+++ b/deps/npm/docs/output/commands/npm-dist-tag.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-dist-tag----11190">
+<h1 id="----npm-dist-tag----11191">
     <span>npm-dist-tag</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Modify package distribution tags</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-docs.html b/deps/npm/docs/output/commands/npm-docs.html
index fbdd0ad2b626..98295c7943e0 100644
--- a/deps/npm/docs/output/commands/npm-docs.html
+++ b/deps/npm/docs/output/commands/npm-docs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-docs----11190">
+<h1 id="----npm-docs----11191">
     <span>npm-docs</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open documentation for a package in a web browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-doctor.html b/deps/npm/docs/output/commands/npm-doctor.html
index b7dc5d2caf84..096f12bf3b80 100644
--- a/deps/npm/docs/output/commands/npm-doctor.html
+++ b/deps/npm/docs/output/commands/npm-doctor.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-doctor----11190">
+<h1 id="----npm-doctor----11191">
     <span>npm-doctor</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check the health of your npm environment</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-edit.html b/deps/npm/docs/output/commands/npm-edit.html
index 3aed53c2677a..7a555a8f39a4 100644
--- a/deps/npm/docs/output/commands/npm-edit.html
+++ b/deps/npm/docs/output/commands/npm-edit.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-edit----11190">
+<h1 id="----npm-edit----11191">
     <span>npm-edit</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Edit an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-exec.html b/deps/npm/docs/output/commands/npm-exec.html
index a5ea0d54c343..94e8e68c05f1 100644
--- a/deps/npm/docs/output/commands/npm-exec.html
+++ b/deps/npm/docs/output/commands/npm-exec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-exec----11190">
+<h1 id="----npm-exec----11191">
     <span>npm-exec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explain.html b/deps/npm/docs/output/commands/npm-explain.html
index bce1694bcf08..ccf68b227121 100644
--- a/deps/npm/docs/output/commands/npm-explain.html
+++ b/deps/npm/docs/output/commands/npm-explain.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explain----11190">
+<h1 id="----npm-explain----11191">
     <span>npm-explain</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Explain installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-explore.html b/deps/npm/docs/output/commands/npm-explore.html
index 872892c9f1d5..7b4d6a2ed2c4 100644
--- a/deps/npm/docs/output/commands/npm-explore.html
+++ b/deps/npm/docs/output/commands/npm-explore.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-explore----11190">
+<h1 id="----npm-explore----11191">
     <span>npm-explore</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Browse an installed package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-find-dupes.html b/deps/npm/docs/output/commands/npm-find-dupes.html
index b71cbeb015db..19b5ae4ffcfa 100644
--- a/deps/npm/docs/output/commands/npm-find-dupes.html
+++ b/deps/npm/docs/output/commands/npm-find-dupes.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-find-dupes----11190">
+<h1 id="----npm-find-dupes----11191">
     <span>npm-find-dupes</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Find duplication in the package tree</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-fund.html b/deps/npm/docs/output/commands/npm-fund.html
index 9f04fd7ea66b..c657d182afd3 100644
--- a/deps/npm/docs/output/commands/npm-fund.html
+++ b/deps/npm/docs/output/commands/npm-fund.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-fund----11190">
+<h1 id="----npm-fund----11191">
     <span>npm-fund</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Retrieve funding information</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-get.html b/deps/npm/docs/output/commands/npm-get.html
index 94a56fd4a81b..59eaf5e577cb 100644
--- a/deps/npm/docs/output/commands/npm-get.html
+++ b/deps/npm/docs/output/commands/npm-get.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-get----11190">
+<h1 id="----npm-get----11191">
     <span>npm-get</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get a value from the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help-search.html b/deps/npm/docs/output/commands/npm-help-search.html
index d3666992d1e9..d4abfb29c360 100644
--- a/deps/npm/docs/output/commands/npm-help-search.html
+++ b/deps/npm/docs/output/commands/npm-help-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help-search----11190">
+<h1 id="----npm-help-search----11191">
     <span>npm-help-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search npm help documentation</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-help.html b/deps/npm/docs/output/commands/npm-help.html
index e7fa1b32e601..d4fe535e8bd0 100644
--- a/deps/npm/docs/output/commands/npm-help.html
+++ b/deps/npm/docs/output/commands/npm-help.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-help----11190">
+<h1 id="----npm-help----11191">
     <span>npm-help</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Get help on npm</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-init.html b/deps/npm/docs/output/commands/npm-init.html
index 265ee78ad2cf..af686f90a7ac 100644
--- a/deps/npm/docs/output/commands/npm-init.html
+++ b/deps/npm/docs/output/commands/npm-init.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-init----11190">
+<h1 id="----npm-init----11191">
     <span>npm-init</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a package.json file</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-ci-test.html b/deps/npm/docs/output/commands/npm-install-ci-test.html
index 94d4e4a663b8..bdf779e2eef8 100644
--- a/deps/npm/docs/output/commands/npm-install-ci-test.html
+++ b/deps/npm/docs/output/commands/npm-install-ci-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-ci-test----11190">
+<h1 id="----npm-install-ci-test----11191">
     <span>npm-install-ci-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a project with a clean slate and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-scripts.html b/deps/npm/docs/output/commands/npm-install-scripts.html
index d78f5efc1653..8174e90a5094 100644
--- a/deps/npm/docs/output/commands/npm-install-scripts.html
+++ b/deps/npm/docs/output/commands/npm-install-scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-scripts----11190">
+<h1 id="----npm-install-scripts----11191">
     <span>npm-install-scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage install-script approvals for dependencies</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install-test.html b/deps/npm/docs/output/commands/npm-install-test.html
index c55b06547a9d..e75fb52d3239 100644
--- a/deps/npm/docs/output/commands/npm-install-test.html
+++ b/deps/npm/docs/output/commands/npm-install-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install-test----11190">
+<h1 id="----npm-install-test----11191">
     <span>npm-install-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install package(s) and run tests</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-install.html b/deps/npm/docs/output/commands/npm-install.html
index 80af90cc3db9..ed78f6576bb7 100644
--- a/deps/npm/docs/output/commands/npm-install.html
+++ b/deps/npm/docs/output/commands/npm-install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-install----11190">
+<h1 id="----npm-install----11191">
     <span>npm-install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Install a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-link.html b/deps/npm/docs/output/commands/npm-link.html
index 3a5795b866f5..aa01ff7a259a 100644
--- a/deps/npm/docs/output/commands/npm-link.html
+++ b/deps/npm/docs/output/commands/npm-link.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-link----11190">
+<h1 id="----npm-link----11191">
     <span>npm-link</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Symlink a package folder</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ll.html b/deps/npm/docs/output/commands/npm-ll.html
index 601f99e91029..f8df2515bfa4 100644
--- a/deps/npm/docs/output/commands/npm-ll.html
+++ b/deps/npm/docs/output/commands/npm-ll.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ll----11190">
+<h1 id="----npm-ll----11191">
     <span>npm-ll</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-login.html b/deps/npm/docs/output/commands/npm-login.html
index 33d44e488838..1c6d938ec6c1 100644
--- a/deps/npm/docs/output/commands/npm-login.html
+++ b/deps/npm/docs/output/commands/npm-login.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-login----11190">
+<h1 id="----npm-login----11191">
     <span>npm-login</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Login to a registry user account</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-logout.html b/deps/npm/docs/output/commands/npm-logout.html
index 0be803c18ae7..cf319a086f89 100644
--- a/deps/npm/docs/output/commands/npm-logout.html
+++ b/deps/npm/docs/output/commands/npm-logout.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-logout----11190">
+<h1 id="----npm-logout----11191">
     <span>npm-logout</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Log out of the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ls.html b/deps/npm/docs/output/commands/npm-ls.html
index bda454a04c77..b733762be373 100644
--- a/deps/npm/docs/output/commands/npm-ls.html
+++ b/deps/npm/docs/output/commands/npm-ls.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ls----11190">
+<h1 id="----npm-ls----11191">
     <span>npm-ls</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">List installed packages</span>
 </header>
@@ -209,7 +209,7 @@ <h3 id="description">Description</h3>
 <p>Positional arguments are <code>name@version-range</code> identifiers, which will limit the results to only the paths to the packages named.
 Note that nested packages will <em>also</em> show the paths to the specified packages.
 For example, running <code>npm ls promzard</code> in npm's source tree will show:</p>
-<pre><code class="language-bash">npm@11.19.0 /path/to/npm
+<pre><code class="language-bash">npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 </code></pre>
diff --git a/deps/npm/docs/output/commands/npm-org.html b/deps/npm/docs/output/commands/npm-org.html
index 32df155d69ce..6a2c22951a60 100644
--- a/deps/npm/docs/output/commands/npm-org.html
+++ b/deps/npm/docs/output/commands/npm-org.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-org----11190">
+<h1 id="----npm-org----11191">
     <span>npm-org</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage orgs</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-outdated.html b/deps/npm/docs/output/commands/npm-outdated.html
index 5355d7dd09aa..b85880371cdf 100644
--- a/deps/npm/docs/output/commands/npm-outdated.html
+++ b/deps/npm/docs/output/commands/npm-outdated.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-outdated----11190">
+<h1 id="----npm-outdated----11191">
     <span>npm-outdated</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Check for outdated packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-owner.html b/deps/npm/docs/output/commands/npm-owner.html
index 7dc17627f50a..6b8afff7ba36 100644
--- a/deps/npm/docs/output/commands/npm-owner.html
+++ b/deps/npm/docs/output/commands/npm-owner.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-owner----11190">
+<h1 id="----npm-owner----11191">
     <span>npm-owner</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage package owners</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pack.html b/deps/npm/docs/output/commands/npm-pack.html
index 3f92c3ff7579..d7f148d92ed7 100644
--- a/deps/npm/docs/output/commands/npm-pack.html
+++ b/deps/npm/docs/output/commands/npm-pack.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pack----11190">
+<h1 id="----npm-pack----11191">
     <span>npm-pack</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Create a tarball from a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-ping.html b/deps/npm/docs/output/commands/npm-ping.html
index 84d634064212..3c49a0713166 100644
--- a/deps/npm/docs/output/commands/npm-ping.html
+++ b/deps/npm/docs/output/commands/npm-ping.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-ping----11190">
+<h1 id="----npm-ping----11191">
     <span>npm-ping</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Ping npm registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-pkg.html b/deps/npm/docs/output/commands/npm-pkg.html
index cf995cca7679..d80ac21f9af3 100644
--- a/deps/npm/docs/output/commands/npm-pkg.html
+++ b/deps/npm/docs/output/commands/npm-pkg.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-pkg----11190">
+<h1 id="----npm-pkg----11191">
     <span>npm-pkg</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manages your package.json</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prefix.html b/deps/npm/docs/output/commands/npm-prefix.html
index 0336ac659020..1592a1d3048d 100644
--- a/deps/npm/docs/output/commands/npm-prefix.html
+++ b/deps/npm/docs/output/commands/npm-prefix.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prefix----11190">
+<h1 id="----npm-prefix----11191">
     <span>npm-prefix</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display prefix</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-profile.html b/deps/npm/docs/output/commands/npm-profile.html
index 8c0d0a337c8c..24f5db6d7f37 100644
--- a/deps/npm/docs/output/commands/npm-profile.html
+++ b/deps/npm/docs/output/commands/npm-profile.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-profile----11190">
+<h1 id="----npm-profile----11191">
     <span>npm-profile</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Change settings on your registry profile</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-prune.html b/deps/npm/docs/output/commands/npm-prune.html
index d340e0fd84a6..736620c0a24a 100644
--- a/deps/npm/docs/output/commands/npm-prune.html
+++ b/deps/npm/docs/output/commands/npm-prune.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-prune----11190">
+<h1 id="----npm-prune----11191">
     <span>npm-prune</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove extraneous packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-publish.html b/deps/npm/docs/output/commands/npm-publish.html
index d1ee0efa5d16..a20d56b8d10e 100644
--- a/deps/npm/docs/output/commands/npm-publish.html
+++ b/deps/npm/docs/output/commands/npm-publish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-publish----11190">
+<h1 id="----npm-publish----11191">
     <span>npm-publish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Publish a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-query.html b/deps/npm/docs/output/commands/npm-query.html
index a8347390a34a..a74342cf2782 100644
--- a/deps/npm/docs/output/commands/npm-query.html
+++ b/deps/npm/docs/output/commands/npm-query.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-query----11190">
+<h1 id="----npm-query----11191">
     <span>npm-query</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency selector query</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-rebuild.html b/deps/npm/docs/output/commands/npm-rebuild.html
index 8c2277d8a914..39403a70941d 100644
--- a/deps/npm/docs/output/commands/npm-rebuild.html
+++ b/deps/npm/docs/output/commands/npm-rebuild.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-rebuild----11190">
+<h1 id="----npm-rebuild----11191">
     <span>npm-rebuild</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Rebuild a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-repo.html b/deps/npm/docs/output/commands/npm-repo.html
index b60cd8bc1ddd..5337679c8248 100644
--- a/deps/npm/docs/output/commands/npm-repo.html
+++ b/deps/npm/docs/output/commands/npm-repo.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-repo----11190">
+<h1 id="----npm-repo----11191">
     <span>npm-repo</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Open package repository page in the browser</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-restart.html b/deps/npm/docs/output/commands/npm-restart.html
index 960530ad2975..0786bdc34a54 100644
--- a/deps/npm/docs/output/commands/npm-restart.html
+++ b/deps/npm/docs/output/commands/npm-restart.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-restart----11190">
+<h1 id="----npm-restart----11191">
     <span>npm-restart</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Restart a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-root.html b/deps/npm/docs/output/commands/npm-root.html
index b5ad8c5c1389..165223c6fdb6 100644
--- a/deps/npm/docs/output/commands/npm-root.html
+++ b/deps/npm/docs/output/commands/npm-root.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-root----11190">
+<h1 id="----npm-root----11191">
     <span>npm-root</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm root</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-run.html b/deps/npm/docs/output/commands/npm-run.html
index 985df67fddef..15ca998eb8a8 100644
--- a/deps/npm/docs/output/commands/npm-run.html
+++ b/deps/npm/docs/output/commands/npm-run.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-run----11190">
+<h1 id="----npm-run----11191">
     <span>npm-run</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run arbitrary package scripts</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-sbom.html b/deps/npm/docs/output/commands/npm-sbom.html
index db72c21adc4f..fe84c36327a6 100644
--- a/deps/npm/docs/output/commands/npm-sbom.html
+++ b/deps/npm/docs/output/commands/npm-sbom.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-sbom----11190">
+<h1 id="----npm-sbom----11191">
     <span>npm-sbom</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Generate a Software Bill of Materials (SBOM)</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-search.html b/deps/npm/docs/output/commands/npm-search.html
index f4764833e25a..98006e7d2253 100644
--- a/deps/npm/docs/output/commands/npm-search.html
+++ b/deps/npm/docs/output/commands/npm-search.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-search----11190">
+<h1 id="----npm-search----11191">
     <span>npm-search</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Search for packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-set.html b/deps/npm/docs/output/commands/npm-set.html
index d0fe94ba7e98..6202cdf7b3cd 100644
--- a/deps/npm/docs/output/commands/npm-set.html
+++ b/deps/npm/docs/output/commands/npm-set.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-set----11190">
+<h1 id="----npm-set----11191">
     <span>npm-set</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Set a value in the npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-shrinkwrap.html b/deps/npm/docs/output/commands/npm-shrinkwrap.html
index 85fb2b99986f..abb9c216e6da 100644
--- a/deps/npm/docs/output/commands/npm-shrinkwrap.html
+++ b/deps/npm/docs/output/commands/npm-shrinkwrap.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrap----11190">
+<h1 id="----npm-shrinkwrap----11191">
     <span>npm-shrinkwrap</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Lock down dependency versions for publication</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stage.html b/deps/npm/docs/output/commands/npm-stage.html
index 225d4970fad3..74c4f7acddf0 100644
--- a/deps/npm/docs/output/commands/npm-stage.html
+++ b/deps/npm/docs/output/commands/npm-stage.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stage----11190">
+<h1 id="----npm-stage----11191">
     <span>npm-stage</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stage packages for publishing</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-star.html b/deps/npm/docs/output/commands/npm-star.html
index 5521c413462c..4ba2f61b1797 100644
--- a/deps/npm/docs/output/commands/npm-star.html
+++ b/deps/npm/docs/output/commands/npm-star.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-star----11190">
+<h1 id="----npm-star----11191">
     <span>npm-star</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Mark your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stars.html b/deps/npm/docs/output/commands/npm-stars.html
index 9f497020875d..a1c7c0a4fd9d 100644
--- a/deps/npm/docs/output/commands/npm-stars.html
+++ b/deps/npm/docs/output/commands/npm-stars.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stars----11190">
+<h1 id="----npm-stars----11191">
     <span>npm-stars</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View packages marked as favorites</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-start.html b/deps/npm/docs/output/commands/npm-start.html
index 4a6ec9e7e2c8..063ac6b3d809 100644
--- a/deps/npm/docs/output/commands/npm-start.html
+++ b/deps/npm/docs/output/commands/npm-start.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-start----11190">
+<h1 id="----npm-start----11191">
     <span>npm-start</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Start a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-stop.html b/deps/npm/docs/output/commands/npm-stop.html
index 243f702c961e..b4e84d2488de 100644
--- a/deps/npm/docs/output/commands/npm-stop.html
+++ b/deps/npm/docs/output/commands/npm-stop.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-stop----11190">
+<h1 id="----npm-stop----11191">
     <span>npm-stop</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Stop a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-team.html b/deps/npm/docs/output/commands/npm-team.html
index 0baf06db4b1a..c9a7504b91fa 100644
--- a/deps/npm/docs/output/commands/npm-team.html
+++ b/deps/npm/docs/output/commands/npm-team.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-team----11190">
+<h1 id="----npm-team----11191">
     <span>npm-team</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage organization teams and team memberships</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-test.html b/deps/npm/docs/output/commands/npm-test.html
index 2d46aafd0b14..bbb30678ba8c 100644
--- a/deps/npm/docs/output/commands/npm-test.html
+++ b/deps/npm/docs/output/commands/npm-test.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-test----11190">
+<h1 id="----npm-test----11191">
     <span>npm-test</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Test a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-token.html b/deps/npm/docs/output/commands/npm-token.html
index 58a528ce2180..680c2aa534f8 100644
--- a/deps/npm/docs/output/commands/npm-token.html
+++ b/deps/npm/docs/output/commands/npm-token.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-token----11190">
+<h1 id="----npm-token----11191">
     <span>npm-token</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage your authentication tokens</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-trust.html b/deps/npm/docs/output/commands/npm-trust.html
index 429e22957b18..6d531484035c 100644
--- a/deps/npm/docs/output/commands/npm-trust.html
+++ b/deps/npm/docs/output/commands/npm-trust.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-trust----11190">
+<h1 id="----npm-trust----11191">
     <span>npm-trust</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Manage trusted publishing relationships between packages and CI/CD providers</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-undeprecate.html b/deps/npm/docs/output/commands/npm-undeprecate.html
index 67b6d048c079..d5239ca0cac0 100644
--- a/deps/npm/docs/output/commands/npm-undeprecate.html
+++ b/deps/npm/docs/output/commands/npm-undeprecate.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-undeprecate----11190">
+<h1 id="----npm-undeprecate----11191">
     <span>npm-undeprecate</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Undeprecate a version of a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-uninstall.html b/deps/npm/docs/output/commands/npm-uninstall.html
index 8197d3646c62..26991d034bd4 100644
--- a/deps/npm/docs/output/commands/npm-uninstall.html
+++ b/deps/npm/docs/output/commands/npm-uninstall.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-uninstall----11190">
+<h1 id="----npm-uninstall----11191">
     <span>npm-uninstall</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unpublish.html b/deps/npm/docs/output/commands/npm-unpublish.html
index 21b698cad72e..4fda332a9615 100644
--- a/deps/npm/docs/output/commands/npm-unpublish.html
+++ b/deps/npm/docs/output/commands/npm-unpublish.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unpublish----11190">
+<h1 id="----npm-unpublish----11191">
     <span>npm-unpublish</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove a package from the registry</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-unstar.html b/deps/npm/docs/output/commands/npm-unstar.html
index 2564643c7435..25db54715ddb 100644
--- a/deps/npm/docs/output/commands/npm-unstar.html
+++ b/deps/npm/docs/output/commands/npm-unstar.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-unstar----11190">
+<h1 id="----npm-unstar----11191">
     <span>npm-unstar</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Remove an item from your favorite packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-update.html b/deps/npm/docs/output/commands/npm-update.html
index c89bc400aa3c..fff2f70073cd 100644
--- a/deps/npm/docs/output/commands/npm-update.html
+++ b/deps/npm/docs/output/commands/npm-update.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-update----11190">
+<h1 id="----npm-update----11191">
     <span>npm-update</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Update packages</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-version.html b/deps/npm/docs/output/commands/npm-version.html
index 2cb36d263256..310abe5db903 100644
--- a/deps/npm/docs/output/commands/npm-version.html
+++ b/deps/npm/docs/output/commands/npm-version.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-version----11190">
+<h1 id="----npm-version----11191">
     <span>npm-version</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Bump a package version</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-view.html b/deps/npm/docs/output/commands/npm-view.html
index 2356b4e79166..18f28fe17077 100644
--- a/deps/npm/docs/output/commands/npm-view.html
+++ b/deps/npm/docs/output/commands/npm-view.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-view----11190">
+<h1 id="----npm-view----11191">
     <span>npm-view</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">View registry info</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm-whoami.html b/deps/npm/docs/output/commands/npm-whoami.html
index bd768a237695..91a7d6e2288d 100644
--- a/deps/npm/docs/output/commands/npm-whoami.html
+++ b/deps/npm/docs/output/commands/npm-whoami.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-whoami----11190">
+<h1 id="----npm-whoami----11191">
     <span>npm-whoami</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Display npm username</span>
 </header>
diff --git a/deps/npm/docs/output/commands/npm.html b/deps/npm/docs/output/commands/npm.html
index cc749dc6e59a..99674e1362df 100644
--- a/deps/npm/docs/output/commands/npm.html
+++ b/deps/npm/docs/output/commands/npm.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm----11190">
+<h1 id="----npm----11191">
     <span>npm</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">javascript package manager</span>
 </header>
@@ -203,7 +203,7 @@ <h2 id="table-of-contents">Table of contents</h2>
 </code></pre>
 <p>Note: This command is unaware of workspaces.</p>
 <h3 id="version">Version</h3>
-<p>11.19.0</p>
+<p>11.19.1</p>
 <h3 id="description">Description</h3>
 <p>npm is the package manager for the Node JavaScript platform.
 It puts modules in place so that node can find them, and manages dependency conflicts intelligently.</p>
diff --git a/deps/npm/docs/output/commands/npx.html b/deps/npm/docs/output/commands/npx.html
index 8abb0349d715..d3cb1e00cc5b 100644
--- a/deps/npm/docs/output/commands/npx.html
+++ b/deps/npm/docs/output/commands/npx.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npx----11190">
+<h1 id="----npx----11191">
     <span>npx</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Run a command from a local or remote npm package</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/folders.html b/deps/npm/docs/output/configuring-npm/folders.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/folders.html
+++ b/deps/npm/docs/output/configuring-npm/folders.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/install.html b/deps/npm/docs/output/configuring-npm/install.html
index d607ef84697b..610fc057a134 100644
--- a/deps/npm/docs/output/configuring-npm/install.html
+++ b/deps/npm/docs/output/configuring-npm/install.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----install----11190">
+<h1 id="----install----11191">
     <span>Install</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Download and install node and npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-global.html b/deps/npm/docs/output/configuring-npm/npm-global.html
index 7b04e59dbed2..3e86bf9a9ee5 100644
--- a/deps/npm/docs/output/configuring-npm/npm-global.html
+++ b/deps/npm/docs/output/configuring-npm/npm-global.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----folders----11190">
+<h1 id="----folders----11191">
     <span>Folders</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Folder structures used by npm</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-json.html b/deps/npm/docs/output/configuring-npm/npm-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/npm-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
index f26ba837f409..134524b16af6 100644
--- a/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
+++ b/deps/npm/docs/output/configuring-npm/npm-shrinkwrap-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npm-shrinkwrapjson----11190">
+<h1 id="----npm-shrinkwrapjson----11191">
     <span>npm-shrinkwrap.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A publishable lockfile</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/npmrc.html b/deps/npm/docs/output/configuring-npm/npmrc.html
index 6e88197b3fbf..a5eb291b57ca 100644
--- a/deps/npm/docs/output/configuring-npm/npmrc.html
+++ b/deps/npm/docs/output/configuring-npm/npmrc.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----npmrc----11190">
+<h1 id="----npmrc----11191">
     <span>.npmrc</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The npm config files</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-json.html b/deps/npm/docs/output/configuring-npm/package-json.html
index 0cdb967a8c34..97a03a6d6175 100644
--- a/deps/npm/docs/output/configuring-npm/package-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----packagejson----11190">
+<h1 id="----packagejson----11191">
     <span>package.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Specifics of npm's package.json handling</span>
 </header>
diff --git a/deps/npm/docs/output/configuring-npm/package-lock-json.html b/deps/npm/docs/output/configuring-npm/package-lock-json.html
index 68476b2f14e4..9a4f1631b337 100644
--- a/deps/npm/docs/output/configuring-npm/package-lock-json.html
+++ b/deps/npm/docs/output/configuring-npm/package-lock-json.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-lockjson----11190">
+<h1 id="----package-lockjson----11191">
     <span>package-lock.json</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">A manifestation of the manifest</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/config.html b/deps/npm/docs/output/using-npm/config.html
index 9d288a3a2e86..ac5829fba75d 100644
--- a/deps/npm/docs/output/using-npm/config.html
+++ b/deps/npm/docs/output/using-npm/config.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----config----11190">
+<h1 id="----config----11191">
     <span>Config</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">About npm configuration</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/dependency-selectors.html b/deps/npm/docs/output/using-npm/dependency-selectors.html
index 80acfdd6ea80..c56b5e6c4027 100644
--- a/deps/npm/docs/output/using-npm/dependency-selectors.html
+++ b/deps/npm/docs/output/using-npm/dependency-selectors.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----dependency-selectors----11190">
+<h1 id="----dependency-selectors----11191">
     <span>Dependency Selectors</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Dependency Selector Syntax &amp; Querying</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/developers.html b/deps/npm/docs/output/using-npm/developers.html
index 5457f4a7943b..984f28bfe7b2 100644
--- a/deps/npm/docs/output/using-npm/developers.html
+++ b/deps/npm/docs/output/using-npm/developers.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----developers----11190">
+<h1 id="----developers----11191">
     <span>Developers</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Developer guide</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/logging.html b/deps/npm/docs/output/using-npm/logging.html
index 62b819e82646..f6f6dd742f12 100644
--- a/deps/npm/docs/output/using-npm/logging.html
+++ b/deps/npm/docs/output/using-npm/logging.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----logging----11190">
+<h1 id="----logging----11191">
     <span>Logging</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Why, What &amp; How we Log</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/orgs.html b/deps/npm/docs/output/using-npm/orgs.html
index 39559c361b78..f579fcbbac1f 100644
--- a/deps/npm/docs/output/using-npm/orgs.html
+++ b/deps/npm/docs/output/using-npm/orgs.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----organizations----11190">
+<h1 id="----organizations----11191">
     <span>Organizations</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with teams &amp; organizations</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/package-spec.html b/deps/npm/docs/output/using-npm/package-spec.html
index 82b8d1d9ad2e..620f470d109b 100644
--- a/deps/npm/docs/output/using-npm/package-spec.html
+++ b/deps/npm/docs/output/using-npm/package-spec.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----package-spec----11190">
+<h1 id="----package-spec----11191">
     <span>Package spec</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Package name specifier</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/registry.html b/deps/npm/docs/output/using-npm/registry.html
index b3d34df82033..e61715c22e4b 100644
--- a/deps/npm/docs/output/using-npm/registry.html
+++ b/deps/npm/docs/output/using-npm/registry.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----registry----11190">
+<h1 id="----registry----11191">
     <span>Registry</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">The JavaScript Package Registry</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/removal.html b/deps/npm/docs/output/using-npm/removal.html
index b85ee02590cc..07ee6c06bc40 100644
--- a/deps/npm/docs/output/using-npm/removal.html
+++ b/deps/npm/docs/output/using-npm/removal.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----removal----11190">
+<h1 id="----removal----11191">
     <span>Removal</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Cleaning the slate</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scope.html b/deps/npm/docs/output/using-npm/scope.html
index f2e733bc9ebf..a08571ebfda3 100644
--- a/deps/npm/docs/output/using-npm/scope.html
+++ b/deps/npm/docs/output/using-npm/scope.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scope----11190">
+<h1 id="----scope----11191">
     <span>Scope</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Scoped packages</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/scripts.html b/deps/npm/docs/output/using-npm/scripts.html
index c2a9641f62d2..4e852304a114 100644
--- a/deps/npm/docs/output/using-npm/scripts.html
+++ b/deps/npm/docs/output/using-npm/scripts.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----scripts----11190">
+<h1 id="----scripts----11191">
     <span>Scripts</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">How npm handles the "scripts" field</span>
 </header>
diff --git a/deps/npm/docs/output/using-npm/workspaces.html b/deps/npm/docs/output/using-npm/workspaces.html
index 3a9986755339..ec3d3abed055 100644
--- a/deps/npm/docs/output/using-npm/workspaces.html
+++ b/deps/npm/docs/output/using-npm/workspaces.html
@@ -186,9 +186,9 @@
 
 <section id="content">
 <header class="title">
-<h1 id="----workspaces----11190">
+<h1 id="----workspaces----11191">
     <span>Workspaces</span>
-    <span class="version">@11.19.0</span>
+    <span class="version">@11.19.1</span>
 </h1>
 <span class="description">Working with workspaces</span>
 </header>
diff --git a/deps/npm/lib/commands/pack.js b/deps/npm/lib/commands/pack.js
index be4a1b240bea..9c4b59657f4a 100644
--- a/deps/npm/lib/commands/pack.js
+++ b/deps/npm/lib/commands/pack.js
@@ -45,6 +45,7 @@ class Pack extends BaseCommand {
       ) ? { ...this.npm.flatOptions, before: null } : this.npm.flatOptions
       const manifest = await pacote.manifest(spec, {
         ...options,
+        ...(spec.type === 'directory' && { allowDirectory: 'all' }),
         Arborist,
         preferOnline: true,
         _isRoot: true,
diff --git a/deps/npm/man/man1/npm-access.1 b/deps/npm/man/man1/npm-access.1
index 3b7d77d8962f..435819623db2 100644
--- a/deps/npm/man/man1/npm-access.1
+++ b/deps/npm/man/man1/npm-access.1
@@ -1,4 +1,4 @@
-.TH "NPM-ACCESS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ACCESS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-access\fR - Set access level on published packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-adduser.1 b/deps/npm/man/man1/npm-adduser.1
index 53ed267a0aa4..5cc628784241 100644
--- a/deps/npm/man/man1/npm-adduser.1
+++ b/deps/npm/man/man1/npm-adduser.1
@@ -1,4 +1,4 @@
-.TH "NPM-ADDUSER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ADDUSER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-adduser\fR - Add a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-approve-scripts.1 b/deps/npm/man/man1/npm-approve-scripts.1
index 943459b20562..f874e752ab97 100644
--- a/deps/npm/man/man1/npm-approve-scripts.1
+++ b/deps/npm/man/man1/npm-approve-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-APPROVE-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-APPROVE-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-approve-scripts\fR - Approve install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-audit.1 b/deps/npm/man/man1/npm-audit.1
index 77fbcbe595ef..8c9815292aee 100644
--- a/deps/npm/man/man1/npm-audit.1
+++ b/deps/npm/man/man1/npm-audit.1
@@ -1,4 +1,4 @@
-.TH "NPM-AUDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-AUDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-audit\fR - Run a security audit
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-bugs.1 b/deps/npm/man/man1/npm-bugs.1
index 05a37e504c7e..0113cf310fdb 100644
--- a/deps/npm/man/man1/npm-bugs.1
+++ b/deps/npm/man/man1/npm-bugs.1
@@ -1,4 +1,4 @@
-.TH "NPM-BUGS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-BUGS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-bugs\fR - Report bugs for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-cache.1 b/deps/npm/man/man1/npm-cache.1
index fd725dd57fe2..71eaeccf613d 100644
--- a/deps/npm/man/man1/npm-cache.1
+++ b/deps/npm/man/man1/npm-cache.1
@@ -1,4 +1,4 @@
-.TH "NPM-CACHE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CACHE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-cache\fR - Manipulates packages cache
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ci.1 b/deps/npm/man/man1/npm-ci.1
index bbae51d8e983..2e544d6dfa80 100644
--- a/deps/npm/man/man1/npm-ci.1
+++ b/deps/npm/man/man1/npm-ci.1
@@ -1,4 +1,4 @@
-.TH "NPM-CI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ci\fR - Clean install a project
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-completion.1 b/deps/npm/man/man1/npm-completion.1
index d01c54ab63af..d5cefe61d0c7 100644
--- a/deps/npm/man/man1/npm-completion.1
+++ b/deps/npm/man/man1/npm-completion.1
@@ -1,4 +1,4 @@
-.TH "NPM-COMPLETION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-COMPLETION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-completion\fR - Tab Completion for npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-config.1 b/deps/npm/man/man1/npm-config.1
index 34b79e9d1c57..b0ef989fe726 100644
--- a/deps/npm/man/man1/npm-config.1
+++ b/deps/npm/man/man1/npm-config.1
@@ -1,4 +1,4 @@
-.TH "NPM-CONFIG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-CONFIG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-config\fR - Manage the npm configuration files
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dedupe.1 b/deps/npm/man/man1/npm-dedupe.1
index 0b11deb4d467..1fa8e34027fb 100644
--- a/deps/npm/man/man1/npm-dedupe.1
+++ b/deps/npm/man/man1/npm-dedupe.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEDUPE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEDUPE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dedupe\fR - Reduce duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deny-scripts.1 b/deps/npm/man/man1/npm-deny-scripts.1
index d8a41f57479e..70fb96d6fcd2 100644
--- a/deps/npm/man/man1/npm-deny-scripts.1
+++ b/deps/npm/man/man1/npm-deny-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-DENY-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DENY-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deny-scripts\fR - Deny install scripts for specific dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-deprecate.1 b/deps/npm/man/man1/npm-deprecate.1
index c45dd75584ec..e07bd5829ef7 100644
--- a/deps/npm/man/man1/npm-deprecate.1
+++ b/deps/npm/man/man1/npm-deprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-DEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-deprecate\fR - Deprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-diff.1 b/deps/npm/man/man1/npm-diff.1
index 45efb60c236c..42c3903bd468 100644
--- a/deps/npm/man/man1/npm-diff.1
+++ b/deps/npm/man/man1/npm-diff.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIFF" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIFF" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-diff\fR - The registry diff command
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-dist-tag.1 b/deps/npm/man/man1/npm-dist-tag.1
index 989a2c64d307..8ebc625273cc 100644
--- a/deps/npm/man/man1/npm-dist-tag.1
+++ b/deps/npm/man/man1/npm-dist-tag.1
@@ -1,4 +1,4 @@
-.TH "NPM-DIST-TAG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DIST-TAG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-dist-tag\fR - Modify package distribution tags
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-docs.1 b/deps/npm/man/man1/npm-docs.1
index ee614b710885..26fa80d54d5d 100644
--- a/deps/npm/man/man1/npm-docs.1
+++ b/deps/npm/man/man1/npm-docs.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-docs\fR - Open documentation for a package in a web browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-doctor.1 b/deps/npm/man/man1/npm-doctor.1
index 5344645b17ed..f5b750fd6a3b 100644
--- a/deps/npm/man/man1/npm-doctor.1
+++ b/deps/npm/man/man1/npm-doctor.1
@@ -1,4 +1,4 @@
-.TH "NPM-DOCTOR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-DOCTOR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-doctor\fR - Check the health of your npm environment
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-edit.1 b/deps/npm/man/man1/npm-edit.1
index bca15e054f60..5055e6feaa5d 100644
--- a/deps/npm/man/man1/npm-edit.1
+++ b/deps/npm/man/man1/npm-edit.1
@@ -1,4 +1,4 @@
-.TH "NPM-EDIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EDIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-edit\fR - Edit an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-exec.1 b/deps/npm/man/man1/npm-exec.1
index 4b580f484bc1..5ae0a77e2880 100644
--- a/deps/npm/man/man1/npm-exec.1
+++ b/deps/npm/man/man1/npm-exec.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXEC" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXEC" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-exec\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explain.1 b/deps/npm/man/man1/npm-explain.1
index 20374a8fbb37..7869082b6c6f 100644
--- a/deps/npm/man/man1/npm-explain.1
+++ b/deps/npm/man/man1/npm-explain.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLAIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLAIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explain\fR - Explain installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-explore.1 b/deps/npm/man/man1/npm-explore.1
index bee110155bd5..df1fd2dc6517 100644
--- a/deps/npm/man/man1/npm-explore.1
+++ b/deps/npm/man/man1/npm-explore.1
@@ -1,4 +1,4 @@
-.TH "NPM-EXPLORE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-EXPLORE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-explore\fR - Browse an installed package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-find-dupes.1 b/deps/npm/man/man1/npm-find-dupes.1
index a1cfc3abd0d2..f1f3970dd1d7 100644
--- a/deps/npm/man/man1/npm-find-dupes.1
+++ b/deps/npm/man/man1/npm-find-dupes.1
@@ -1,4 +1,4 @@
-.TH "NPM-FIND-DUPES" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FIND-DUPES" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-find-dupes\fR - Find duplication in the package tree
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-fund.1 b/deps/npm/man/man1/npm-fund.1
index ec516b28396d..88bfe299c31f 100644
--- a/deps/npm/man/man1/npm-fund.1
+++ b/deps/npm/man/man1/npm-fund.1
@@ -1,4 +1,4 @@
-.TH "NPM-FUND" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-FUND" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-fund\fR - Retrieve funding information
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-get.1 b/deps/npm/man/man1/npm-get.1
index d4763eb28c8c..7982d28e324a 100644
--- a/deps/npm/man/man1/npm-get.1
+++ b/deps/npm/man/man1/npm-get.1
@@ -1,4 +1,4 @@
-.TH "NPM-GET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-GET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-get\fR - Get a value from the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help-search.1 b/deps/npm/man/man1/npm-help-search.1
index 63213fa4188a..e7c7d97ebcea 100644
--- a/deps/npm/man/man1/npm-help-search.1
+++ b/deps/npm/man/man1/npm-help-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help-search\fR - Search npm help documentation
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-help.1 b/deps/npm/man/man1/npm-help.1
index 59f2f1df9436..7725a82d09c1 100644
--- a/deps/npm/man/man1/npm-help.1
+++ b/deps/npm/man/man1/npm-help.1
@@ -1,4 +1,4 @@
-.TH "NPM-HELP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-HELP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-help\fR - Get help on npm
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-init.1 b/deps/npm/man/man1/npm-init.1
index cf4c37761d14..bd984db7d203 100644
--- a/deps/npm/man/man1/npm-init.1
+++ b/deps/npm/man/man1/npm-init.1
@@ -1,4 +1,4 @@
-.TH "NPM-INIT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INIT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-init\fR - Create a package.json file
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-ci-test.1 b/deps/npm/man/man1/npm-install-ci-test.1
index e30140015a1c..b477b4a8b0eb 100644
--- a/deps/npm/man/man1/npm-install-ci-test.1
+++ b/deps/npm/man/man1/npm-install-ci-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-CI-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-CI-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-ci-test\fR - Install a project with a clean slate and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-scripts.1 b/deps/npm/man/man1/npm-install-scripts.1
index 907b48c50ff5..b634903e3ecc 100644
--- a/deps/npm/man/man1/npm-install-scripts.1
+++ b/deps/npm/man/man1/npm-install-scripts.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-SCRIPTS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-SCRIPTS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-scripts\fR - Manage install-script approvals for dependencies
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install-test.1 b/deps/npm/man/man1/npm-install-test.1
index 88e0ed187377..d6774940ea2f 100644
--- a/deps/npm/man/man1/npm-install-test.1
+++ b/deps/npm/man/man1/npm-install-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install-test\fR - Install package(s) and run tests
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-install.1 b/deps/npm/man/man1/npm-install.1
index b1ccd245238d..c6ca10ab642c 100644
--- a/deps/npm/man/man1/npm-install.1
+++ b/deps/npm/man/man1/npm-install.1
@@ -1,4 +1,4 @@
-.TH "NPM-INSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-INSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-install\fR - Install a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-link.1 b/deps/npm/man/man1/npm-link.1
index d124bcf66a33..ea482b872b86 100644
--- a/deps/npm/man/man1/npm-link.1
+++ b/deps/npm/man/man1/npm-link.1
@@ -1,4 +1,4 @@
-.TH "NPM-LINK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LINK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-link\fR - Symlink a package folder
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ll.1 b/deps/npm/man/man1/npm-ll.1
index 982d8ee3a6c7..136777491e0f 100644
--- a/deps/npm/man/man1/npm-ll.1
+++ b/deps/npm/man/man1/npm-ll.1
@@ -1,4 +1,4 @@
-.TH "NPM-LL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ll\fR - List installed packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-login.1 b/deps/npm/man/man1/npm-login.1
index 392c5b25d84d..ecc47d745dee 100644
--- a/deps/npm/man/man1/npm-login.1
+++ b/deps/npm/man/man1/npm-login.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGIN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGIN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-login\fR - Login to a registry user account
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-logout.1 b/deps/npm/man/man1/npm-logout.1
index 7ca6be27366c..22d86e96586e 100644
--- a/deps/npm/man/man1/npm-logout.1
+++ b/deps/npm/man/man1/npm-logout.1
@@ -1,4 +1,4 @@
-.TH "NPM-LOGOUT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LOGOUT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-logout\fR - Log out of the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ls.1 b/deps/npm/man/man1/npm-ls.1
index 6fe6245988fe..52224d908c20 100644
--- a/deps/npm/man/man1/npm-ls.1
+++ b/deps/npm/man/man1/npm-ls.1
@@ -1,4 +1,4 @@
-.TH "NPM-LS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-LS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ls\fR - List installed packages
 .SS "Synopsis"
@@ -20,7 +20,7 @@ Positional arguments are \fBname@version-range\fR identifiers, which will limit
 .P
 .RS 2
 .nf
-npm@11.19.0 /path/to/npm
+npm@11.19.1 /path/to/npm
 └─┬ init-package-json@0.0.4
   └── promzard@0.1.5
 .fi
diff --git a/deps/npm/man/man1/npm-org.1 b/deps/npm/man/man1/npm-org.1
index 50e94a589d49..4b7592722da4 100644
--- a/deps/npm/man/man1/npm-org.1
+++ b/deps/npm/man/man1/npm-org.1
@@ -1,4 +1,4 @@
-.TH "NPM-ORG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ORG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-org\fR - Manage orgs
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-outdated.1 b/deps/npm/man/man1/npm-outdated.1
index a2ecbcc50b5c..f83acac0d642 100644
--- a/deps/npm/man/man1/npm-outdated.1
+++ b/deps/npm/man/man1/npm-outdated.1
@@ -1,4 +1,4 @@
-.TH "NPM-OUTDATED" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OUTDATED" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-outdated\fR - Check for outdated packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-owner.1 b/deps/npm/man/man1/npm-owner.1
index 3815d60d8b2b..68a98e734ef5 100644
--- a/deps/npm/man/man1/npm-owner.1
+++ b/deps/npm/man/man1/npm-owner.1
@@ -1,4 +1,4 @@
-.TH "NPM-OWNER" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-OWNER" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-owner\fR - Manage package owners
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pack.1 b/deps/npm/man/man1/npm-pack.1
index f5f159779bdc..58b82df26634 100644
--- a/deps/npm/man/man1/npm-pack.1
+++ b/deps/npm/man/man1/npm-pack.1
@@ -1,4 +1,4 @@
-.TH "NPM-PACK" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PACK" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pack\fR - Create a tarball from a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-ping.1 b/deps/npm/man/man1/npm-ping.1
index e44d02e67e88..4df93fbd993a 100644
--- a/deps/npm/man/man1/npm-ping.1
+++ b/deps/npm/man/man1/npm-ping.1
@@ -1,4 +1,4 @@
-.TH "NPM-PING" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PING" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-ping\fR - Ping npm registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-pkg.1 b/deps/npm/man/man1/npm-pkg.1
index ad4adfa8c654..ad11f73873aa 100644
--- a/deps/npm/man/man1/npm-pkg.1
+++ b/deps/npm/man/man1/npm-pkg.1
@@ -1,4 +1,4 @@
-.TH "NPM-PKG" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PKG" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-pkg\fR - Manages your package.json
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prefix.1 b/deps/npm/man/man1/npm-prefix.1
index a810bc8c0140..6c990176088b 100644
--- a/deps/npm/man/man1/npm-prefix.1
+++ b/deps/npm/man/man1/npm-prefix.1
@@ -1,4 +1,4 @@
-.TH "NPM-PREFIX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PREFIX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prefix\fR - Display prefix
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-profile.1 b/deps/npm/man/man1/npm-profile.1
index 0593fa483958..0d5d54620f73 100644
--- a/deps/npm/man/man1/npm-profile.1
+++ b/deps/npm/man/man1/npm-profile.1
@@ -1,4 +1,4 @@
-.TH "NPM-PROFILE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PROFILE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-profile\fR - Change settings on your registry profile
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-prune.1 b/deps/npm/man/man1/npm-prune.1
index c62e7d6bd395..8f67ca9384f8 100644
--- a/deps/npm/man/man1/npm-prune.1
+++ b/deps/npm/man/man1/npm-prune.1
@@ -1,4 +1,4 @@
-.TH "NPM-PRUNE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PRUNE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-prune\fR - Remove extraneous packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-publish.1 b/deps/npm/man/man1/npm-publish.1
index 62676301d5ab..4e738ab0bbd7 100644
--- a/deps/npm/man/man1/npm-publish.1
+++ b/deps/npm/man/man1/npm-publish.1
@@ -1,4 +1,4 @@
-.TH "NPM-PUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-PUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-publish\fR - Publish a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-query.1 b/deps/npm/man/man1/npm-query.1
index 3ca4eb1b659f..334fc20660e4 100644
--- a/deps/npm/man/man1/npm-query.1
+++ b/deps/npm/man/man1/npm-query.1
@@ -1,4 +1,4 @@
-.TH "NPM-QUERY" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-QUERY" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-query\fR - Dependency selector query
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-rebuild.1 b/deps/npm/man/man1/npm-rebuild.1
index b0710049573e..6a09726529b4 100644
--- a/deps/npm/man/man1/npm-rebuild.1
+++ b/deps/npm/man/man1/npm-rebuild.1
@@ -1,4 +1,4 @@
-.TH "NPM-REBUILD" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REBUILD" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-rebuild\fR - Rebuild a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-repo.1 b/deps/npm/man/man1/npm-repo.1
index 46fdc0cb111e..5ff08e9eeb4d 100644
--- a/deps/npm/man/man1/npm-repo.1
+++ b/deps/npm/man/man1/npm-repo.1
@@ -1,4 +1,4 @@
-.TH "NPM-REPO" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-REPO" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-repo\fR - Open package repository page in the browser
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-restart.1 b/deps/npm/man/man1/npm-restart.1
index b552a5e2a86a..d4f5f0d3df1f 100644
--- a/deps/npm/man/man1/npm-restart.1
+++ b/deps/npm/man/man1/npm-restart.1
@@ -1,4 +1,4 @@
-.TH "NPM-RESTART" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RESTART" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-restart\fR - Restart a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-root.1 b/deps/npm/man/man1/npm-root.1
index 9d701e336bff..ecd0c64ef6bb 100644
--- a/deps/npm/man/man1/npm-root.1
+++ b/deps/npm/man/man1/npm-root.1
@@ -1,4 +1,4 @@
-.TH "NPM-ROOT" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-ROOT" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-root\fR - Display npm root
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-run.1 b/deps/npm/man/man1/npm-run.1
index 185111dbafbb..8aadcceff7c1 100644
--- a/deps/npm/man/man1/npm-run.1
+++ b/deps/npm/man/man1/npm-run.1
@@ -1,4 +1,4 @@
-.TH "NPM-RUN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-RUN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-run\fR - Run arbitrary package scripts
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-sbom.1 b/deps/npm/man/man1/npm-sbom.1
index a8a74f9e02c6..f694d642f9ad 100644
--- a/deps/npm/man/man1/npm-sbom.1
+++ b/deps/npm/man/man1/npm-sbom.1
@@ -1,4 +1,4 @@
-.TH "NPM-SBOM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SBOM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-sbom\fR - Generate a Software Bill of Materials (SBOM)
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-search.1 b/deps/npm/man/man1/npm-search.1
index 2a0fbbc58709..969d0e784902 100644
--- a/deps/npm/man/man1/npm-search.1
+++ b/deps/npm/man/man1/npm-search.1
@@ -1,4 +1,4 @@
-.TH "NPM-SEARCH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SEARCH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-search\fR - Search for packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-set.1 b/deps/npm/man/man1/npm-set.1
index 4333006b47ff..4deaf8e01aca 100644
--- a/deps/npm/man/man1/npm-set.1
+++ b/deps/npm/man/man1/npm-set.1
@@ -1,4 +1,4 @@
-.TH "NPM-SET" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SET" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-set\fR - Set a value in the npm configuration
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-shrinkwrap.1 b/deps/npm/man/man1/npm-shrinkwrap.1
index 0fc20a6ccaeb..35caa20c3dc0 100644
--- a/deps/npm/man/man1/npm-shrinkwrap.1
+++ b/deps/npm/man/man1/npm-shrinkwrap.1
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap\fR - Lock down dependency versions for publication
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stage.1 b/deps/npm/man/man1/npm-stage.1
index 9a677ba6b03e..8c2016052130 100644
--- a/deps/npm/man/man1/npm-stage.1
+++ b/deps/npm/man/man1/npm-stage.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAGE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAGE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stage\fR - Stage packages for publishing
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-star.1 b/deps/npm/man/man1/npm-star.1
index dbabe90b0bd6..a2191c120e35 100644
--- a/deps/npm/man/man1/npm-star.1
+++ b/deps/npm/man/man1/npm-star.1
@@ -1,4 +1,4 @@
-.TH "NPM-STAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-star\fR - Mark your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stars.1 b/deps/npm/man/man1/npm-stars.1
index 2999dd8abbf0..aca98ed914a5 100644
--- a/deps/npm/man/man1/npm-stars.1
+++ b/deps/npm/man/man1/npm-stars.1
@@ -1,4 +1,4 @@
-.TH "NPM-STARS" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STARS" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stars\fR - View packages marked as favorites
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-start.1 b/deps/npm/man/man1/npm-start.1
index c8966bd38a68..d2f3b4d87cc8 100644
--- a/deps/npm/man/man1/npm-start.1
+++ b/deps/npm/man/man1/npm-start.1
@@ -1,4 +1,4 @@
-.TH "NPM-START" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-START" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-start\fR - Start a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-stop.1 b/deps/npm/man/man1/npm-stop.1
index c900d58437f5..7896dd6acd17 100644
--- a/deps/npm/man/man1/npm-stop.1
+++ b/deps/npm/man/man1/npm-stop.1
@@ -1,4 +1,4 @@
-.TH "NPM-STOP" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-STOP" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-stop\fR - Stop a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-team.1 b/deps/npm/man/man1/npm-team.1
index 4de50f8c6b06..21ccc530ad81 100644
--- a/deps/npm/man/man1/npm-team.1
+++ b/deps/npm/man/man1/npm-team.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEAM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEAM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-team\fR - Manage organization teams and team memberships
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-test.1 b/deps/npm/man/man1/npm-test.1
index 311ba399498b..8cae879d8291 100644
--- a/deps/npm/man/man1/npm-test.1
+++ b/deps/npm/man/man1/npm-test.1
@@ -1,4 +1,4 @@
-.TH "NPM-TEST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TEST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-test\fR - Test a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-token.1 b/deps/npm/man/man1/npm-token.1
index 4b1cbae98b24..fc82daf8d0cf 100644
--- a/deps/npm/man/man1/npm-token.1
+++ b/deps/npm/man/man1/npm-token.1
@@ -1,4 +1,4 @@
-.TH "NPM-TOKEN" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TOKEN" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-token\fR - Manage your authentication tokens
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-trust.1 b/deps/npm/man/man1/npm-trust.1
index f8de6022c0f0..fce69eb33b75 100644
--- a/deps/npm/man/man1/npm-trust.1
+++ b/deps/npm/man/man1/npm-trust.1
@@ -1,4 +1,4 @@
-.TH "NPM-TRUST" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-TRUST" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-trust\fR - Manage trusted publishing relationships between packages and CI/CD providers
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-undeprecate.1 b/deps/npm/man/man1/npm-undeprecate.1
index 1a26688b4530..11f91ee9b913 100644
--- a/deps/npm/man/man1/npm-undeprecate.1
+++ b/deps/npm/man/man1/npm-undeprecate.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNDEPRECATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNDEPRECATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-undeprecate\fR - Undeprecate a version of a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-uninstall.1 b/deps/npm/man/man1/npm-uninstall.1
index 39791e588e7e..b9ff997229dc 100644
--- a/deps/npm/man/man1/npm-uninstall.1
+++ b/deps/npm/man/man1/npm-uninstall.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNINSTALL" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNINSTALL" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-uninstall\fR - Remove a package
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unpublish.1 b/deps/npm/man/man1/npm-unpublish.1
index f839376efe0f..5bbb86e8c8f3 100644
--- a/deps/npm/man/man1/npm-unpublish.1
+++ b/deps/npm/man/man1/npm-unpublish.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNPUBLISH" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNPUBLISH" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unpublish\fR - Remove a package from the registry
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-unstar.1 b/deps/npm/man/man1/npm-unstar.1
index 555868c3fb68..0d0e2f2c9e6a 100644
--- a/deps/npm/man/man1/npm-unstar.1
+++ b/deps/npm/man/man1/npm-unstar.1
@@ -1,4 +1,4 @@
-.TH "NPM-UNSTAR" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UNSTAR" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-unstar\fR - Remove an item from your favorite packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-update.1 b/deps/npm/man/man1/npm-update.1
index 55b4191e801b..4f5e015b20d7 100644
--- a/deps/npm/man/man1/npm-update.1
+++ b/deps/npm/man/man1/npm-update.1
@@ -1,4 +1,4 @@
-.TH "NPM-UPDATE" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-UPDATE" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-update\fR - Update packages
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-version.1 b/deps/npm/man/man1/npm-version.1
index fd261b5cd42a..c15a0d19acfa 100644
--- a/deps/npm/man/man1/npm-version.1
+++ b/deps/npm/man/man1/npm-version.1
@@ -1,4 +1,4 @@
-.TH "NPM-VERSION" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VERSION" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-version\fR - Bump a package version
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-view.1 b/deps/npm/man/man1/npm-view.1
index a150ce2d979d..b9210c424cd2 100644
--- a/deps/npm/man/man1/npm-view.1
+++ b/deps/npm/man/man1/npm-view.1
@@ -1,4 +1,4 @@
-.TH "NPM-VIEW" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-VIEW" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-view\fR - View registry info
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm-whoami.1 b/deps/npm/man/man1/npm-whoami.1
index 920d19146bd3..5d44c35a7f48 100644
--- a/deps/npm/man/man1/npm-whoami.1
+++ b/deps/npm/man/man1/npm-whoami.1
@@ -1,4 +1,4 @@
-.TH "NPM-WHOAMI" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-WHOAMI" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-whoami\fR - Display npm username
 .SS "Synopsis"
diff --git a/deps/npm/man/man1/npm.1 b/deps/npm/man/man1/npm.1
index 9791f5f274f5..25a9e19288c9 100644
--- a/deps/npm/man/man1/npm.1
+++ b/deps/npm/man/man1/npm.1
@@ -1,4 +1,4 @@
-.TH "NPM" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPM" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm\fR - javascript package manager
 .SS "Synopsis"
@@ -12,7 +12,7 @@ npm
 Note: This command is unaware of workspaces.
 .SS "Version"
 .P
-11.19.0
+11.19.1
 .SS "Description"
 .P
 npm is the package manager for the Node JavaScript platform. It puts modules in place so that node can find them, and manages dependency conflicts intelligently.
diff --git a/deps/npm/man/man1/npx.1 b/deps/npm/man/man1/npx.1
index 3c4afb8aec51..39fcb358f7ce 100644
--- a/deps/npm/man/man1/npx.1
+++ b/deps/npm/man/man1/npx.1
@@ -1,4 +1,4 @@
-.TH "NPX" "1" "July 2026" "NPM@11.19.0" ""
+.TH "NPX" "1" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpx\fR - Run a command from a local or remote npm package
 .SS "Synopsis"
diff --git a/deps/npm/man/man5/folders.5 b/deps/npm/man/man5/folders.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/folders.5
+++ b/deps/npm/man/man5/folders.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/install.5 b/deps/npm/man/man5/install.5
index 200dcc3dfd3a..b54f427c5da9 100644
--- a/deps/npm/man/man5/install.5
+++ b/deps/npm/man/man5/install.5
@@ -1,4 +1,4 @@
-.TH "INSTALL" "5" "July 2026" "NPM@11.19.0" ""
+.TH "INSTALL" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBInstall\fR - Download and install node and npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-global.5 b/deps/npm/man/man5/npm-global.5
index 0717f575c47f..7ec714295100 100644
--- a/deps/npm/man/man5/npm-global.5
+++ b/deps/npm/man/man5/npm-global.5
@@ -1,4 +1,4 @@
-.TH "FOLDERS" "5" "July 2026" "NPM@11.19.0" ""
+.TH "FOLDERS" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBFolders\fR - Folder structures used by npm
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-json.5 b/deps/npm/man/man5/npm-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/npm-json.5
+++ b/deps/npm/man/man5/npm-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/npm-shrinkwrap-json.5 b/deps/npm/man/man5/npm-shrinkwrap-json.5
index 9f3d7597d161..1af7bf467c03 100644
--- a/deps/npm/man/man5/npm-shrinkwrap-json.5
+++ b/deps/npm/man/man5/npm-shrinkwrap-json.5
@@ -1,4 +1,4 @@
-.TH "NPM-SHRINKWRAP.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "NPM-SHRINKWRAP.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBnpm-shrinkwrap.json\fR - A publishable lockfile
 .SS "Description"
diff --git a/deps/npm/man/man5/npmrc.5 b/deps/npm/man/man5/npmrc.5
index 83578c624089..9d2361126088 100644
--- a/deps/npm/man/man5/npmrc.5
+++ b/deps/npm/man/man5/npmrc.5
@@ -1,4 +1,4 @@
-.TH ".NPMRC" "5" "July 2026" "NPM@11.19.0" ""
+.TH ".NPMRC" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fB.npmrc\fR - The npm config files
 .SS "Description"
diff --git a/deps/npm/man/man5/package-json.5 b/deps/npm/man/man5/package-json.5
index 4d4a9084ac7a..4a79f2788851 100644
--- a/deps/npm/man/man5/package-json.5
+++ b/deps/npm/man/man5/package-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage.json\fR - Specifics of npm's package.json handling
 .SS "Description"
diff --git a/deps/npm/man/man5/package-lock-json.5 b/deps/npm/man/man5/package-lock-json.5
index 7bc632269f50..ace3d4d69594 100644
--- a/deps/npm/man/man5/package-lock-json.5
+++ b/deps/npm/man/man5/package-lock-json.5
@@ -1,4 +1,4 @@
-.TH "PACKAGE-LOCK.JSON" "5" "July 2026" "NPM@11.19.0" ""
+.TH "PACKAGE-LOCK.JSON" "5" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBpackage-lock.json\fR - A manifestation of the manifest
 .SS "Description"
diff --git a/deps/npm/man/man7/config.7 b/deps/npm/man/man7/config.7
index b68980abc38f..684663e33757 100644
--- a/deps/npm/man/man7/config.7
+++ b/deps/npm/man/man7/config.7
@@ -1,4 +1,4 @@
-.TH "CONFIG" "7" "July 2026" "NPM@11.19.0" ""
+.TH "CONFIG" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBConfig\fR - About npm configuration
 .SS "Description"
diff --git a/deps/npm/man/man7/dependency-selectors.7 b/deps/npm/man/man7/dependency-selectors.7
index 4d242ab6e6c4..ec08ce0750b3 100644
--- a/deps/npm/man/man7/dependency-selectors.7
+++ b/deps/npm/man/man7/dependency-selectors.7
@@ -1,4 +1,4 @@
-.TH "SELECTORS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SELECTORS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBSelectors\fR - Dependency Selector Syntax & Querying
 .SS "Description"
diff --git a/deps/npm/man/man7/developers.7 b/deps/npm/man/man7/developers.7
index 201aedc081dd..aebb1f99a74a 100644
--- a/deps/npm/man/man7/developers.7
+++ b/deps/npm/man/man7/developers.7
@@ -1,4 +1,4 @@
-.TH "DEVELOPERS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "DEVELOPERS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBDevelopers\fR - Developer guide
 .SS "Description"
diff --git a/deps/npm/man/man7/logging.7 b/deps/npm/man/man7/logging.7
index be1e6ea6fffa..7fab6e089256 100644
--- a/deps/npm/man/man7/logging.7
+++ b/deps/npm/man/man7/logging.7
@@ -1,4 +1,4 @@
-.TH "LOGGING" "7" "July 2026" "NPM@11.19.0" ""
+.TH "LOGGING" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBLogging\fR - Why, What & How we Log
 .SS "Description"
diff --git a/deps/npm/man/man7/orgs.7 b/deps/npm/man/man7/orgs.7
index 43732ecdb5cb..975eded22dfc 100644
--- a/deps/npm/man/man7/orgs.7
+++ b/deps/npm/man/man7/orgs.7
@@ -1,4 +1,4 @@
-.TH "ORGANIZATIONS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "ORGANIZATIONS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBOrganizations\fR - Working with teams & organizations
 .SS "Description"
diff --git a/deps/npm/man/man7/package-spec.7 b/deps/npm/man/man7/package-spec.7
index d76da151b48e..a68e9b8f7e74 100644
--- a/deps/npm/man/man7/package-spec.7
+++ b/deps/npm/man/man7/package-spec.7
@@ -1,4 +1,4 @@
-.TH "SPEC" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SPEC" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBspec\fR - Package name specifier
 .SS "Description"
diff --git a/deps/npm/man/man7/registry.7 b/deps/npm/man/man7/registry.7
index 16e295f6ac11..a91c60c14565 100644
--- a/deps/npm/man/man7/registry.7
+++ b/deps/npm/man/man7/registry.7
@@ -1,4 +1,4 @@
-.TH "REGISTRY" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REGISTRY" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRegistry\fR - The JavaScript Package Registry
 .SS "Description"
diff --git a/deps/npm/man/man7/removal.7 b/deps/npm/man/man7/removal.7
index 1e0a0ddd0cf3..bb4d7a8d4365 100644
--- a/deps/npm/man/man7/removal.7
+++ b/deps/npm/man/man7/removal.7
@@ -1,4 +1,4 @@
-.TH "REMOVAL" "7" "July 2026" "NPM@11.19.0" ""
+.TH "REMOVAL" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBRemoval\fR - Cleaning the slate
 .SS "Synopsis"
diff --git a/deps/npm/man/man7/scope.7 b/deps/npm/man/man7/scope.7
index 6bb685d20984..f2744feb1343 100644
--- a/deps/npm/man/man7/scope.7
+++ b/deps/npm/man/man7/scope.7
@@ -1,4 +1,4 @@
-.TH "SCOPE" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCOPE" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScope\fR - Scoped packages
 .SS "Description"
diff --git a/deps/npm/man/man7/scripts.7 b/deps/npm/man/man7/scripts.7
index 797e70b65138..4af3522042ba 100644
--- a/deps/npm/man/man7/scripts.7
+++ b/deps/npm/man/man7/scripts.7
@@ -1,4 +1,4 @@
-.TH "SCRIPTS" "7" "July 2026" "NPM@11.19.0" ""
+.TH "SCRIPTS" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBScripts\fR - How npm handles the "scripts" field
 .SS "Description"
diff --git a/deps/npm/man/man7/workspaces.7 b/deps/npm/man/man7/workspaces.7
index fb9807cdfe4c..b31d897d2f3d 100644
--- a/deps/npm/man/man7/workspaces.7
+++ b/deps/npm/man/man7/workspaces.7
@@ -1,4 +1,4 @@
-.TH "WORKSPACES" "7" "July 2026" "NPM@11.19.0" ""
+.TH "WORKSPACES" "7" "August 2026" "NPM@11.19.1" ""
 .SH "NAME"
 \fBWorkspaces\fR - Working with workspaces
 .SS "Description"
diff --git a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
index e4e5bd87666d..869a6bee2380 100644
--- a/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/commonjs/index.js
@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXPANSION_MAX = void 0;
+exports.EXPANSION_MAX_LENGTH = exports.EXPANSION_MAX = void 0;
 exports.expand = expand;
 const balanced_match_1 = require("balanced-match");
 const escSlash = '\0SLASH' + Math.random() + '\0';
@@ -19,6 +19,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 exports.EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+exports.EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -68,7 +79,7 @@ function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = exports.EXPANSION_MAX } = options;
+    const { max = exports.EXPANSION_MAX, maxLength = exports.EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -78,7 +89,7 @@ function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -92,25 +103,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = (0, balanced_match_1.balanced)('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -123,89 +225,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/dist/esm/index.js b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
index b2d2aa91bb1c..fd68f5702920 100644
--- a/deps/npm/node_modules/brace-expansion/dist/esm/index.js
+++ b/deps/npm/node_modules/brace-expansion/dist/esm/index.js
@@ -15,6 +15,17 @@ const closePattern = /\\}/g;
 const commaPattern = /\\,/g;
 const periodPattern = /\\\./g;
 export const EXPANSION_MAX = 100_000;
+// `EXPANSION_MAX` caps the *number* of expansions, but not their length. An
+// input like `'{a,b}'.repeat(1500)` stays under that count - its output is
+// truncated to 100k results - while making every result ~1500 characters
+// long. The result set, and the intermediate arrays built while combining
+// brace sets, then grow large enough to exhaust memory and crash the process
+// (CVE-2026-14257). `EXPANSION_MAX_LENGTH` bounds the total number of
+// characters the accumulator may hold at any point, so memory stays flat no
+// matter how many brace groups are chained. The limit sits well above any
+// realistic expansion (100k results hitting `EXPANSION_MAX` measure ~1M
+// characters) so legitimate input is unaffected.
+export const EXPANSION_MAX_LENGTH = 4_000_000;
 function numeric(str) {
     return !isNaN(str) ? parseInt(str, 10) : str.charCodeAt(0);
 }
@@ -64,7 +75,7 @@ export function expand(str, options = {}) {
     if (!str) {
         return [];
     }
-    const { max = EXPANSION_MAX } = options;
+    const { max = EXPANSION_MAX, maxLength = EXPANSION_MAX_LENGTH } = options;
     // I don't know why Bash 4.3 does this, but it does.
     // Anything starting with {} will have the first two bytes preserved
     // but *only* at the top level, so {},a}b will not expand to anything,
@@ -74,7 +85,7 @@ export function expand(str, options = {}) {
     if (str.slice(0, 2) === '{}') {
         str = '\\{\\}' + str.slice(2);
     }
-    return expand_(escapeBraces(str), max, true).map(unescapeBraces);
+    return expand_(escapeBraces(str), max, maxLength, true).map(unescapeBraces);
 }
 function embrace(str) {
     return '{' + str + '}';
@@ -88,25 +99,116 @@ function lte(i, y) {
 function gte(i, y) {
     return i >= y;
 }
-function expand_(str, max, isTop) {
-    /** @type {string[]} */
-    const expansions = [];
-    // The `{a},b}` rewrite below restarts expansion on a rewritten string with
-    // the same `max` and `isTop = true`. Loop instead of recursing so a long run
-    // of non-expanding `{}` groups can't exhaust the call stack.
+// Build `{ acc[a] + pre + values[v] }` for every combination, capping the
+// number of results at `max` and the total number of characters at `maxLength`.
+// This is the one place output grows, so bounding it here keeps the single
+// accumulator - and therefore memory - flat regardless of how many brace groups
+// are combined (CVE-2026-14257).
+function combine(acc, pre, values, max, maxLength, dropEmpties) {
+    const out = [];
+    let length = 0;
+    for (let a = 0; a < acc.length; a++) {
+        for (let v = 0; v < values.length; v++) {
+            if (out.length >= max)
+                return out;
+            const expansion = acc[a] + pre + values[v];
+            // Bash drops empty results at the top level. Skip them before they count
+            // against `max`, so `max` bounds the number of *kept* results.
+            if (dropEmpties && !expansion)
+                continue;
+            if (length + expansion.length > maxLength)
+                return out;
+            out.push(expansion);
+            length += expansion.length;
+        }
+    }
+    return out;
+}
+// The expansion values of a single numeric (`1..5`) or alphabetic (`a..e..2`)
+// sequence body.
+function expandSequence(body, isAlphaSequence, max, maxLength) {
+    const n = body.split(/\.\./);
+    const N = [];
+    // A sequence body always splits into two or three parts, but the compiler
+    // can't know that.
+    /* c8 ignore start */
+    if (n[0] === undefined || n[1] === undefined) {
+        return N;
+    }
+    /* c8 ignore stop */
+    const x = numeric(n[0]);
+    const y = numeric(n[1]);
+    const width = Math.max(n[0].length, n[1].length);
+    let incr = n.length === 3 && n[2] !== undefined ?
+        Math.max(Math.abs(numeric(n[2])), 1)
+        : 1;
+    let test = lte;
+    const reverse = y < x;
+    if (reverse) {
+        incr *= -1;
+        test = gte;
+    }
+    const pad = n.some(isPadded);
+    let length = 0;
+    for (let i = x; test(i, y) && N.length < max; i += incr) {
+        let c;
+        if (isAlphaSequence) {
+            c = String.fromCharCode(i);
+            if (c === '\\') {
+                c = '';
+            }
+        }
+        else {
+            c = String(i);
+            if (pad) {
+                const need = width - c.length;
+                if (need > 0) {
+                    const z = new Array(need + 1).join('0');
+                    if (i < 0) {
+                        c = '-' + z + c.slice(1);
+                    }
+                    else {
+                        c = z + c;
+                    }
+                }
+            }
+        }
+        if (length + c.length > maxLength)
+            break;
+        N.push(c);
+        length += c.length;
+    }
+    return N;
+}
+function expand_(str, max, maxLength, isTop) {
+    // Consume the string's top-level brace groups left to right, threading a
+    // running set of combined prefixes (`acc`). Expanding the tail iteratively -
+    // rather than recursing on `m.post` once per group - keeps the native stack
+    // depth constant, so deeply chained input (`'{a,b}'.repeat(3000)`) can no
+    // longer overflow the stack, and leaves a single accumulator whose size
+    // `maxLength` bounds directly (CVE-2026-14257).
+    let acc = [''];
+    // Bash drops empty results, but only when the *first* top-level group is a
+    // comma set - a sequence like `{a..\}` may legitimately yield ''. The drop
+    // is on the final strings, so it is applied to whichever `combine` produces
+    // them (the one with no brace set left in the tail).
+    let dropEmpties = false;
+    let firstGroup = true;
     for (;;) {
         const m = balanced('{', '}', str);
-        if (!m)
-            return [str];
+        // No brace set left: the rest of the string is literal.
+        if (!m) {
+            return combine(acc, str, [''], max, maxLength, dropEmpties);
+        }
         // no need to expand pre, since it is guaranteed to be free of brace-sets
         const pre = m.pre;
-        if (/\$$/.test(m.pre)) {
-            const post = m.post.length ? expand_(m.post, max, false) : [''];
-            for (let k = 0; k < post.length && k < max; k++) {
-                const expansion = pre + '{' + m.body + '}' + post[k];
-                expansions.push(expansion);
-            }
-            return expansions;
+        if (/\$$/.test(pre)) {
+            acc = combine(acc, pre + '{' + m.body + '}', [''], max, maxLength, dropEmpties && !m.post.length);
+            firstGroup = false;
+            if (!m.post.length)
+                break;
+            str = m.post;
+            continue;
         }
         const isNumericSequence = /^-?\d+\.\.-?\d+(?:\.\.-?\d+)?$/.test(m.body);
         const isAlphaSequence = /^[a-zA-Z]\.\.[a-zA-Z](?:\.\.-?\d+)?$/.test(m.body);
@@ -119,89 +221,65 @@ function expand_(str, max, isTop) {
                 isTop = true;
                 continue;
             }
-            return [str];
+            // Nothing here expands, so the whole remaining string is literal.
+            return combine(acc, pre + '{' + m.body + '}' + m.post, [''], max, maxLength, dropEmpties);
+        }
+        if (firstGroup) {
+            dropEmpties = isTop && !isSequence;
+            firstGroup = false;
         }
-        // Only expand post once we know this brace set actually expands. Computing
-        // it before the early returns above expanded post a second time on every
-        // non-expanding `{}`, which is what made inputs like `a{},{},{}...` blow up
-        // exponentially.
-        const post = m.post.length ? expand_(m.post, max, false) : [''];
-        let n;
+        let values;
         if (isSequence) {
-            n = m.body.split(/\.\./);
+            values = expandSequence(m.body, isAlphaSequence, max, maxLength);
         }
         else {
-            n = parseCommaParts(m.body);
+            let n = parseCommaParts(m.body);
             if (n.length === 1 && n[0] !== undefined) {
                 // x{{a,b}}y ==> x{a}y x{b}y
-                n = expand_(n[0], max, false).map(embrace);
+                n = expand_(n[0], max, maxLength, false).map(embrace);
                 //XXX is this necessary? Can't seem to hit it in tests.
                 /* c8 ignore start */
                 if (n.length === 1) {
-                    return post.map(p => m.pre + n[0] + p);
+                    acc = combine(acc, pre + n[0], [''], max, maxLength, dropEmpties && !m.post.length);
+                    if (!m.post.length)
+                        break;
+                    str = m.post;
+                    continue;
                 }
                 /* c8 ignore stop */
             }
-        }
-        // at this point, n is the parts, and we know it's not a comma set
-        // with a single entry.
-        let N;
-        if (isSequence && n[0] !== undefined && n[1] !== undefined) {
-            const x = numeric(n[0]);
-            const y = numeric(n[1]);
-            const width = Math.max(n[0].length, n[1].length);
-            let incr = n.length === 3 && n[2] !== undefined ?
-                Math.max(Math.abs(numeric(n[2])), 1)
-                : 1;
-            let test = lte;
-            const reverse = y < x;
-            if (reverse) {
-                incr *= -1;
-                test = gte;
-            }
-            const pad = n.some(isPadded);
-            N = [];
-            for (let i = x; test(i, y) && N.length < max; i += incr) {
-                let c;
-                if (isAlphaSequence) {
-                    c = String.fromCharCode(i);
-                    if (c === '\\') {
-                        c = '';
-                    }
+            // Values that `combine` is going to drop as empty produce no result, so
+            // they must not count against `max` - otherwise `{a,,b}` with `max: 2`
+            // would stop at `['a', '']` and yield one result instead of two. Skipping
+            // them outright keeps `values` bounded while leaving `max` a bound on
+            // *kept* results.
+            let dropsEmpties = dropEmpties && !m.post.length && !pre;
+            for (let d = 0; dropsEmpties && d < acc.length; d++) {
+                if (acc[d]) {
+                    dropsEmpties = false;
                 }
-                else {
-                    c = String(i);
-                    if (pad) {
-                        const need = width - c.length;
-                        if (need > 0) {
-                            const z = new Array(need + 1).join('0');
-                            if (i < 0) {
-                                c = '-' + z + c.slice(1);
-                            }
-                            else {
-                                c = z + c;
-                            }
-                        }
-                    }
-                }
-                N.push(c);
             }
-        }
-        else {
-            N = [];
-            for (let j = 0; j < n.length; j++) {
-                N.push.apply(N, expand_(n[j], max, false));
-            }
-        }
-        for (let j = 0; j < N.length; j++) {
-            for (let k = 0; k < post.length && expansions.length < max; k++) {
-                const expansion = pre + N[j] + post[k];
-                if (!isTop || isSequence || expansion) {
-                    expansions.push(expansion);
+            values = [];
+            let valuesLength = 0;
+            outer: for (let j = 0; j < n.length; j++) {
+                const expanded = expand_(n[j], max, maxLength, false);
+                for (let k = 0; k < expanded.length; k++) {
+                    const v = expanded[k];
+                    if (dropsEmpties && !v)
+                        continue;
+                    if (values.length >= max || valuesLength + v.length > maxLength) {
+                        break outer;
+                    }
+                    values.push(v);
+                    valuesLength += v.length;
                 }
             }
         }
-        return expansions;
+        acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
+        if (!m.post.length)
+            break;
+        str = m.post;
     }
+    return acc;
 }
 //# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/brace-expansion/package.json b/deps/npm/node_modules/brace-expansion/package.json
index a5142f2787b6..4376400796c9 100644
--- a/deps/npm/node_modules/brace-expansion/package.json
+++ b/deps/npm/node_modules/brace-expansion/package.json
@@ -1,7 +1,7 @@
 {
   "name": "brace-expansion",
   "description": "Brace expansion as known from sh/bash",
-  "version": "5.0.7",
+  "version": "5.0.9",
   "files": [
     "dist"
   ],
@@ -46,7 +46,7 @@
   },
   "license": "MIT",
   "engines": {
-    "node": "18 || 20 || >=22"
+    "node": "20 || >=22"
   },
   "tshy": {
     "exports": {
diff --git a/deps/npm/node_modules/ip-address/dist/common.js b/deps/npm/node_modules/ip-address/dist/common.js
index 6b76e051b44e..0c15d21e3a39 100644
--- a/deps/npm/node_modules/ip-address/dist/common.js
+++ b/deps/npm/node_modules/ip-address/dist/common.js
@@ -1,23 +1,47 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isInSubnet = isInSubnet;
+exports.isHostInSubnet = isHostInSubnet;
 exports.isCorrect = isCorrect;
 exports.prefixLengthFromMask = prefixLengthFromMask;
+exports.assertByteArray = assertByteArray;
 exports.numberToPaddedHex = numberToPaddedHex;
 exports.stringToPaddedHex = stringToPaddedHex;
 exports.testBit = testBit;
 const address_error_1 = require("./address-error");
+/**
+ * Returns whether this address's *network* is contained within `address`,
+ * i.e. whether every address this one can represent also falls inside
+ * `address`. A network wider than `address` is not contained in it, so
+ * `10.0.0.0/8` is not in `10.0.0.0/16`.
+ *
+ * To ask whether the address itself falls inside a range, ignoring any CIDR
+ * suffix it was written with, use {@link isHostInSubnet} instead. That is the
+ * question the special-use classifiers ask.
+ */
 function isInSubnet(address) {
     if (this.subnetMask < address.subnetMask) {
         return false;
     }
-    if (this.mask(address.subnetMask) === address.mask()) {
-        return true;
-    }
-    return false;
+    return isHostInSubnet.call(this, address);
+}
+/**
+ * Returns whether this address's host bits fall inside `address`, ignoring
+ * this address's own subnet mask.
+ *
+ * This is the primitive the special-use classifiers (`isLoopback`,
+ * `isPrivate`, `isLinkLocal`, `getType`, …) are built on: they answer a
+ * question about the address, so the answer must not change with the CIDR
+ * suffix the caller happened to write. Use this rather than
+ * {@link isInSubnet} when classifying a single address — notably when the
+ * address came from untrusted input and the result backs a trust-boundary
+ * decision such as an SSRF allow/deny filter.
+ */
+function isHostInSubnet(address) {
+    return this.mask(address.subnetMask) === address.mask();
 }
 function isCorrect(defaultBits) {
-    return function () {
+    return function isCorrectForm() {
         if (this.addressMinusSuffix !== this.correctForm()) {
             return false;
         }
@@ -46,6 +70,21 @@ function prefixLengthFromMask(value, totalBits) {
     }
     return firstZero;
 }
+/**
+ * Throws `AddressError` unless `bytes` holds exactly `byteCount` integers,
+ * each from `minimum` to 255. Pass a `minimum` of `-128` where signed bytes
+ * are accepted and folded to unsigned, and `0` where they are not.
+ */
+function assertByteArray(bytes, byteCount, family, minimum) {
+    if (bytes.length !== byteCount) {
+        throw new address_error_1.AddressError(`${family} addresses require exactly ${byteCount} bytes`);
+    }
+    for (let i = 0; i < bytes.length; i++) {
+        if (!Number.isInteger(bytes[i]) || bytes[i] < minimum || bytes[i] > 255) {
+            throw new address_error_1.AddressError(`All bytes must be integers between ${minimum} and 255`);
+        }
+    }
+}
 function numberToPaddedHex(number) {
     return number.toString(16).padStart(2, '0');
 }
diff --git a/deps/npm/node_modules/ip-address/dist/ipv4.js b/deps/npm/node_modules/ip-address/dist/ipv4.js
index 2c0fd182086d..1360e1836a0d 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv4.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv4.js
@@ -35,6 +35,7 @@ const isCorrect4 = common.isCorrect(constants.BITS);
  */
 class Address4 {
     constructor(address) {
+        this.addressMinusSuffix = '';
         this.groups = constants.GROUPS;
         this.parsedAddress = [];
         this.parsedSubnet = '';
@@ -51,6 +52,15 @@ class Address4 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         this.address = address;
         const subnet = constants.RE_SUBNET_STRING.exec(address);
         if (subnet) {
@@ -78,7 +88,7 @@ class Address4 {
             new Address4(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -90,6 +100,11 @@ class Address4 {
      */
     parse(address) {
         const groups = address.split('.');
+        // Checked before the general match so the error names the actual problem.
+        // Address6 rejects the same notation on its v4-in-v6 path.
+        if (groups.some((group) => /^0\d/.test(group))) {
+            throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.");
+        }
         if (!address.match(constants.RE_ADDRESS)) {
             throw new address_error_1.AddressError('Invalid IPv4 address.');
         }
@@ -128,7 +143,6 @@ class Address4 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address4(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants.BITS);
         return new Address4(`${address}/${bits}`);
@@ -328,32 +342,32 @@ class Address4 {
      * @returns {Address4}
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > 0xffffffffn) {
+        if (bigInt < BigInt(0) || bigInt > BigInt(0xffffffff)) {
             throw new address_error_1.AddressError('IPv4 BigInt must be in the range 0 to 2**32 - 1');
         }
         return Address4.fromHex(bigInt.toString(16).padStart(8, '0'));
     }
     /**
-     * Convert a byte array to an Address4 object.
+     * Convert a byte array to an Address4 object. Throws `AddressError` unless
+     * given exactly 4 integers from 0 to 255. Signed bytes are rejected, so
+     * this differs from `Address6.fromByteArray`, which folds them; the two
+     * contracts converge on this stricter form in the next major version.
      *
      * To convert from a Node.js `Buffer`, spread it: `Address4.fromByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 bytes (0-255)
      * @returns {Address4}
      */
     static fromByteArray(bytes) {
-        if (bytes.length !== 4) {
-            throw new address_error_1.AddressError('IPv4 addresses require exactly 4 bytes');
-        }
-        // Validate that all bytes are within valid range (0-255)
-        for (let i = 0; i < bytes.length; i++) {
-            if (!Number.isInteger(bytes[i]) || bytes[i] < 0 || bytes[i] > 255) {
-                throw new address_error_1.AddressError('All bytes must be integers between 0 and 255');
-            }
-        }
+        common.assertByteArray(bytes, 4, 'IPv4', 0);
         return this.fromUnsignedByteArray(bytes);
     }
     /**
-     * Convert an unsigned byte array to an Address4 object
+     * Convert an unsigned byte array to an Address4 object. Throws
+     * `AddressError` unless given exactly 4 bytes, and rejects values outside
+     * 0 to 255 when parsing the resulting address.
+     *
+     * To convert from a Node.js `Buffer`, spread it:
+     * `Address4.fromUnsignedByteArray([...buf])`.
      * @param {Array<number>} bytes - an array of 4 unsigned bytes (0-255)
      * @returns {Address4}
      */
@@ -383,7 +397,8 @@ class Address4 {
         return this.binaryZeroPad().slice(start, end);
     }
     /**
-     * Return the reversed ip6.arpa form of the address
+     * Return the reversed in-addr.arpa form of the address, e.g.
+     * `42.2.0.192.in-addr.arpa.` for `192.0.2.42`.
      * @param {Object} options
      * @param {boolean} options.omitSuffix - omit the "in-addr.arpa" suffix
      * @returns {String}
@@ -403,49 +418,49 @@ class Address4 {
      * @returns {boolean}
      */
     isMulticast() {
-        return this.isInSubnet(MULTICAST_V4);
+        return this.isHostInSubnet(MULTICAST_V4);
     }
     /**
      * Returns true if the address is in one of the [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private address ranges (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).
      * @returns {boolean}
      */
     isPrivate() {
-        return PRIVATE_V4.some((subnet) => this.isInSubnet(subnet));
+        return PRIVATE_V4.some((subnet) => this.isHostInSubnet(subnet));
     }
     /**
      * Returns true if the address is in the loopback range `127.0.0.0/8` ([RFC 1122](https://datatracker.ietf.org/doc/html/rfc1122)).
      * @returns {boolean}
      */
     isLoopback() {
-        return this.isInSubnet(LOOPBACK_V4);
+        return this.isHostInSubnet(LOOPBACK_V4);
     }
     /**
      * Returns true if the address is in the link-local range `169.254.0.0/16` ([RFC 3927](https://datatracker.ietf.org/doc/html/rfc3927)).
      * @returns {boolean}
      */
     isLinkLocal() {
-        return this.isInSubnet(LINK_LOCAL_V4);
+        return this.isHostInSubnet(LINK_LOCAL_V4);
     }
     /**
      * Returns true if the address is the unspecified address `0.0.0.0`.
      * @returns {boolean}
      */
     isUnspecified() {
-        return this.isInSubnet(UNSPECIFIED_V4);
+        return this.isHostInSubnet(UNSPECIFIED_V4);
     }
     /**
      * Returns true if the address is the limited broadcast address `255.255.255.255` ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)).
      * @returns {boolean}
      */
     isBroadcast() {
-        return this.isInSubnet(BROADCAST_V4);
+        return this.isHostInSubnet(BROADCAST_V4);
     }
     /**
      * Returns true if the address is in the carrier-grade NAT range `100.64.0.0/10` ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)).
      * @returns {boolean}
      */
     isCGNAT() {
-        return this.isInSubnet(CGNAT_V4);
+        return this.isHostInSubnet(CGNAT_V4);
     }
     /**
      * Returns a zero-padded base-2 string representation of the address
@@ -458,12 +473,17 @@ class Address4 {
         return this._binaryZeroPad;
     }
     /**
-     * Groups an IPv4 address for inclusion at the end of an IPv6 address
+     * Groups an IPv4 address for inclusion at the end of an IPv6 address.
+     *
+     * Returns an HTML fragment: each half of the address is wrapped in a
+     * `<span>` carrying the group classes an address-inspector UI hovers on.
+     * The address content is HTML-escaped; anything you concatenate around it
+     * is your responsibility.
      * @returns {String}
      */
     groupForV6() {
         const segments = this.parsedAddress;
-        return this.address.replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
+        return this.correctForm().replace(constants.RE_ADDRESS, `<span class="hover-group group-v4 group-6">${segments
             .slice(0, 2)
             .join('.')}</span>.<span class="hover-group group-v4 group-7">${segments
             .slice(2, 4)
diff --git a/deps/npm/node_modules/ip-address/dist/ipv6.js b/deps/npm/node_modules/ip-address/dist/ipv6.js
index a78020ee7886..d5f4fdb9c87a 100644
--- a/deps/npm/node_modules/ip-address/dist/ipv6.js
+++ b/deps/npm/node_modules/ip-address/dist/ipv6.js
@@ -73,7 +73,6 @@ function paddedHex(octet) {
     return parseInt(octet, 16).toString(16).padStart(4, '0');
 }
 function unsignByte(b) {
-    // eslint-disable-next-line no-bitwise
     return b & 0xff;
 }
 /**
@@ -97,6 +96,15 @@ class Address6 {
          * @returns {boolean}
          */
         this.isInSubnet = common.isInSubnet;
+        /**
+         * Returns true if this address's host bits fall inside the given subnet,
+         * ignoring this address's own subnet mask. Prefer this over `isInSubnet`
+         * when classifying a single address, so the answer doesn't change with the
+         * CIDR suffix the caller happened to write — notably when the address came
+         * from untrusted input and the result backs a trust-boundary decision.
+         * @returns {boolean}
+         */
+        this.isHostInSubnet = common.isHostInSubnet;
         /**
          * Returns true if the address is correct, false otherwise
          * @returns {boolean}
@@ -121,7 +129,10 @@ class Address6 {
             }
             address = address.replace(constants6.RE_SUBNET_STRING, '');
         }
-        else if (/\//.test(address)) {
+        // RE_SUBNET_STRING anchors on the end of the address, so it strips only
+        // the trailing suffix. A second one left behind (`::/0/1`) is malformed
+        // and must be rejected rather than parsed as an address group.
+        if (/\//.test(address)) {
             throw new address_error_1.AddressError('Invalid subnet mask.');
         }
         const zone = constants6.RE_ZONE_STRING.exec(address);
@@ -145,7 +156,7 @@ class Address6 {
             new Address6(address);
             return true;
         }
-        catch (e) {
+        catch {
             return false;
         }
     }
@@ -160,7 +171,7 @@ class Address6 {
      * address.correctForm(); // '::e8:d4a5:1000'
      */
     static fromBigInt(bigInt) {
-        if (bigInt < 0n || bigInt > (1n << BigInt(constants6.BITS)) - 1n) {
+        if (bigInt < BigInt(0) || bigInt > (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1)) {
             throw new address_error_1.AddressError('IPv6 BigInt must be in the range 0 to 2**128 - 1');
         }
         const hex = bigInt.toString(16).padStart(32, '0');
@@ -181,46 +192,36 @@ class Address6 {
      * addressAndPort.port; // 8080
      */
     static fromURL(url) {
+        var _a;
         let host;
         let port = null;
         let result;
+        let error;
+        // Remove the protocol prefix, if any
+        const stripped = url.replace(/^[a-z][a-z0-9+.-]*:\/\//i, '');
         // If we have brackets parse them and find a port
-        if (url.indexOf('[') !== -1 && url.indexOf(']:') !== -1) {
-            result = constants6.RE_URL_WITH_PORT.exec(url);
+        if (stripped.indexOf('[') !== -1 && stripped.indexOf(']:') !== -1) {
+            error = 'failed to parse address with port';
+            result = constants6.RE_URL_WITH_PORT.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address with port',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
             host = result[1];
             port = result[2];
-            // If there's a URL extract the address
         }
-        else if (url.indexOf('/') !== -1) {
-            // Remove the protocol prefix
-            url = url.replace(/^[a-z0-9]+:\/\//, '');
-            // Parse the address
-            result = constants6.RE_URL.exec(url);
+        else {
+            error = 'failed to parse address from URL';
+            result = constants6.RE_URL.exec(stripped);
             if (result === null) {
-                return {
-                    error: 'failed to parse address from URL',
-                    address: null,
-                    port: null,
-                };
+                return { error, address: null, port: null };
             }
-            host = result[1];
-            // Otherwise just assign the URL to the host and let the library parse it
-        }
-        else {
-            host = url;
+            host = (_a = result[1]) !== null && _a !== void 0 ? _a : result[2];
         }
         // If there's a port convert it to an integer
         if (port) {
             port = parseInt(port, 10);
-            // squelch out of range ports
-            if (port < 0 || port > 65536) {
+            // squelch out of range ports (valid ports are 0-65535)
+            if (port < 0 || port > 65535) {
                 port = null;
             }
         }
@@ -228,10 +229,17 @@ class Address6 {
             // Standardize `undefined` to `null`
             port = null;
         }
-        return {
-            address: new Address6(host),
-            port,
-        };
+        // The URL character class is a superset of valid IPv6, so a host the
+        // regex accepted (an IPv4 literal, bare punctuation, too many groups)
+        // can still be rejected by the parser
+        let address;
+        try {
+            address = new Address6(host);
+        }
+        catch {
+            return { error, address: null, port: null };
+        }
+        return { address, port };
     }
     /**
      * Construct an `Address6` from an address and a hex subnet mask given as
@@ -258,7 +266,6 @@ class Address6 {
     static fromAddressAndWildcardMask(address, wildcardMask) {
         const wildcard = new Address6(wildcardMask).bigInt();
         const allOnes = (BigInt(1) << BigInt(constants6.BITS)) - BigInt(1);
-        // eslint-disable-next-line no-bitwise
         const mask = wildcard ^ allOnes;
         const bits = common.prefixLengthFromMask(mask, constants6.BITS);
         return new Address6(`${address}/${bits}`);
@@ -493,7 +500,7 @@ class Address6 {
     getType() {
         for (let i = 0; i < TYPE_SUBNETS.length; i++) {
             const entry = TYPE_SUBNETS[i];
-            if (this.isInSubnet(entry[0])) {
+            if (this.isHostInSubnet(entry[0])) {
                 return entry[1];
             }
         }
@@ -635,20 +642,27 @@ class Address6 {
         }
         const groups = address.split(':');
         const lastGroup = groups.slice(-1)[0];
+        // RE_ADDRESS rejects octets with a leading zero, so a dotted-quad tail is
+        // matched permissively first: that way this notation still gets its own
+        // message with the offending octet highlighted, rather than falling
+        // through as an unrecognized group.
+        const v4Octets = lastGroup.split('.');
+        if (v4Octets.length === constants4.GROUPS &&
+            v4Octets.every((octet) => /^\d{1,3}$/.test(octet))) {
+            if (v4Octets.some((octet) => /^0\d/.test(octet))) {
+                // The prefix groups haven't been through the bad-character check
+                // yet, so escape them before including in the error HTML.
+                const highlighted = v4Octets.map(spanLeadingZeroes4).join('.');
+                const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
+                const separator = groups.length > 1 ? ':' : '';
+                throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
+            }
+        }
         const address4 = lastGroup.match(constants4.RE_ADDRESS);
         if (address4) {
             this.parsedAddress4 = address4[0];
-            this.address4 = new ipv4_1.Address4(this.parsedAddress4);
-            for (let i = 0; i < this.address4.groups; i++) {
-                if (/^0[0-9]+/.test(this.address4.parsedAddress[i])) {
-                    // The prefix groups haven't been through the bad-character check
-                    // yet, so escape them before including in the error HTML.
-                    const highlighted = this.address4.parsedAddress.map(spanLeadingZeroes4).join('.');
-                    const prefix = groups.slice(0, -1).map(helpers.escapeHtml).join(':');
-                    const separator = groups.length > 1 ? ':' : '';
-                    throw new address_error_1.AddressError("IPv4 addresses can't have leading zeroes.", `${prefix}${separator}${highlighted}`);
-                }
-            }
+            const v4Suffix = this.subnetMask >= 96 ? `/${this.subnetMask - 96}` : '';
+            this.address4 = new ipv4_1.Address4(`${this.parsedAddress4}${v4Suffix}`);
             this.v4 = true;
             groups[groups.length - 1] = this.address4.toGroup6();
             address = groups.join(':');
@@ -734,7 +748,11 @@ class Address6 {
         return BigInt(`0x${this.parsedAddress.map(paddedHex).join('')}`);
     }
     /**
-     * Return the last two groups of this address as an IPv4 address string
+     * Return the last two groups of this address as an IPv4 address string.
+     * If this address carries a CIDR prefix that covers the trailing 32 bits
+     * (i.e. `subnetMask >= 96`), the resulting `Address4` inherits the
+     * corresponding v4 prefix (`subnetMask - 96`); otherwise it defaults to
+     * `/32`.
      * @returns {Address4}
      * @example
      * var address = new Address6('2001:4860:4001::1825:bf11');
@@ -742,7 +760,18 @@ class Address6 {
      */
     to4() {
         const binary = this.binaryZeroPad().split('');
-        return ipv4_1.Address4.fromHex(BigInt(`0b${binary.slice(96, 128).join('')}`).toString(16).padStart(8, '0'));
+        const hex = BigInt(`0b${binary.slice(96, 128).join('')}`)
+            .toString(16)
+            .padStart(8, '0');
+        if (this.subnetMask >= 96) {
+            const v4Mask = this.subnetMask - 96;
+            const groups = [];
+            for (let i = 0; i < 8; i += 2) {
+                groups.push(parseInt(hex.slice(i, i + 2), 16));
+            }
+            return new ipv4_1.Address4(`${groups.join('.')}/${v4Mask}`);
+        }
+        return ipv4_1.Address4.fromHex(hex);
     }
     /**
      * Return the v4-in-v6 form of the address
@@ -756,7 +785,7 @@ class Address6 {
         if (!/:$/.test(correct)) {
             infix = ':';
         }
-        return correct + infix + address4.address;
+        return correct + infix + address4.correctForm();
     }
     /**
      * Decodes the Teredo tunneling fields embedded in this address. Returns the
@@ -788,11 +817,9 @@ class Address6 {
         */
         const prefix = this.getBitsBase16(0, 32);
         const bitsForUdpPort = this.getBits(80, 96);
-        // eslint-disable-next-line no-bitwise
         const udpPort = (bitsForUdpPort ^ BigInt('0xffff')).toString();
         const server4 = ipv4_1.Address4.fromHex(this.getBitsBase16(32, 64));
         const bitsForClient4 = this.getBits(96, 128);
-        // eslint-disable-next-line no-bitwise
         const client4 = ipv4_1.Address4.fromHex((bitsForClient4 ^ BigInt('0xffffffff')).toString(16).padStart(8, '0'));
         const flagsBase2 = this.getBitsBase2(64, 80);
         const coneNat = (0, common_1.testBit)(flagsBase2, 15);
@@ -874,12 +901,14 @@ class Address6 {
         }
         else {
             const beforeU = 64 - pl;
-            bits =
-                prefixBits.slice(0, pl) +
-                    v4Bits.slice(0, beforeU) +
-                    '00000000' +
-                    v4Bits.slice(beforeU) +
-                    '0'.repeat(128 - 72 - (32 - beforeU));
+            bits = [
+                prefixBits.slice(0, pl),
+                v4Bits.slice(0, beforeU),
+                // Bits 64 to 71 are the reserved u octet and are always zero.
+                '00000000',
+                v4Bits.slice(beforeU),
+                '0'.repeat(128 - 72 - (32 - beforeU)),
+            ].join('');
         }
         const hex = BigInt(`0b${bits}`).toString(16).padStart(32, '0');
         const groups = [];
@@ -902,7 +931,7 @@ class Address6 {
         if (pl !== 32 && pl !== 40 && pl !== 48 && pl !== 56 && pl !== 64 && pl !== 96) {
             throw new address_error_1.AddressError('NAT64 prefix length must be 32, 40, 48, 56, 64, or 96');
         }
-        if (!this.isInSubnet(prefix6)) {
+        if (!this.isHostInSubnet(prefix6)) {
             return null;
         }
         const bits = this.binaryZeroPad();
@@ -927,9 +956,9 @@ class Address6 {
      * @returns {Array}
      */
     toByteArray() {
-        const valueWithoutPadding = this.bigInt().toString(16);
-        const leadingPad = '0'.repeat(valueWithoutPadding.length % 2);
-        const value = `${leadingPad}${valueWithoutPadding}`;
+        const value = this.bigInt()
+            .toString(16)
+            .padStart(constants6.BITS / 4, '0');
         const bytes = [];
         for (let i = 0, length = value.length; i < length; i += 2) {
             bytes.push(parseInt(value.substring(i, i + 2), 16));
@@ -943,24 +972,39 @@ class Address6 {
      * @returns {Array}
      */
     toUnsignedByteArray() {
+        // toByteArray() emits 0 to 255, so unsigning it is an identity mapping and
+        // the two methods return equal arrays. 11.0.0 keeps one of them and makes
+        // this a deprecated alias; test/common-test.ts fails at that version.
         return this.toByteArray().map(unsignByte);
     }
     /**
      * Convert a byte array to an Address6 object.
      *
+     * Accepts unsigned bytes (0 to 255) or signed bytes (-128 to 127, as an
+     * `Int8Array` or a Java `byte[]` holds them), folding signed values to their
+     * unsigned equivalent. Throws `AddressError` unless given exactly 16
+     * integers from -128 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromByteArray(bytes) {
+        // Address4.fromByteArray takes unsigned bytes only. 11.0.0 aligns this
+        // method with it, at which point the -128 floor here, unsignByte, and the
+        // mapping below all go; test/common-test.ts fails at that version.
+        common.assertByteArray(bytes, 16, 'IPv6', -128);
         return this.fromUnsignedByteArray(bytes.map(unsignByte));
     }
     /**
      * Convert an unsigned byte array to an Address6 object.
      *
+     * Throws `AddressError` unless given exactly 16 integers from 0 to 255.
+     *
      * To convert from a Node.js `Buffer`, spread it: `Address6.fromUnsignedByteArray([...buf])`.
      * @returns {Address6}
      */
     static fromUnsignedByteArray(bytes) {
+        common.assertByteArray(bytes, 16, 'IPv6', 0);
         const BYTE_MAX = BigInt('256');
         let result = BigInt('0');
         let multiplier = BigInt('1');
@@ -982,7 +1026,11 @@ class Address6 {
      * @returns {boolean}
      */
     isLinkLocal() {
-        // Zeroes are required, i.e. we can't check isInSubnet with 'fe80::/10'
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLinkLocal();
+        }
+        // Zeroes are required, i.e. we can't check isHostInSubnet with 'fe80::/10'
         if (this.getBitsBase2(0, 64) ===
             '1111111010000000000000000000000000000000000000000000000000000000') {
             return true;
@@ -994,6 +1042,10 @@ class Address6 {
      * @returns {boolean}
      */
     isMulticast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isMulticast();
+        }
         const type = this.getType();
         return type === 'Multicast' || type.startsWith('Multicast ');
     }
@@ -1016,27 +1068,54 @@ class Address6 {
      * @returns {boolean}
      */
     isMapped4() {
-        return this.isInSubnet(IPV4_MAPPED_SUBNET);
+        return this.isHostInSubnet(IPV4_MAPPED_SUBNET);
+    }
+    /**
+     * If this address embeds a routable IPv4 address — i.e. it is IPv4-mapped
+     * (`::ffff:0:0/96`) or sits in the NAT64 well-known prefix (`64:ff9b::/96`,
+     * [RFC 6052](https://datatracker.ietf.org/doc/html/rfc6052)) — return that
+     * embedded address as an {@link Address4}; otherwise return null.
+     *
+     * The special-property checks (`isLoopback`, `isLinkLocal`, `isMulticast`,
+     * `isUnspecified`, `isPrivate`, `isCGNAT`, `isBroadcast`) call this first and
+     * delegate to the embedded {@link Address4} when present, so a literal such as
+     * `::ffff:127.0.0.1` is classified by what it actually reaches (loopback)
+     * rather than by its IPv6 wrapper (which `getType()` reports as IPv4-mapped).
+     * This matters wherever the checks back a trust-boundary decision (e.g. an
+     * SSRF allow/deny filter): without normalization, `::ffff:10.0.0.1`,
+     * `::ffff:169.254.169.254`, `64:ff9b::7f00:1`, etc. would all read as
+     * non-internal.
+     * @returns {Address4 | null}
+     */
+    embeddedIPv4() {
+        if (this.isMapped4() || this.isHostInSubnet(NAT64_WELL_KNOWN_SUBNET)) {
+            return this.to4();
+        }
+        return null;
     }
     /**
      * Returns true if the address is a Teredo address, false otherwise
      * @returns {boolean}
      */
     isTeredo() {
-        return this.isInSubnet(TEREDO_SUBNET);
+        return this.isHostInSubnet(TEREDO_SUBNET);
     }
     /**
      * Returns true if the address is a 6to4 address, false otherwise
      * @returns {boolean}
      */
     is6to4() {
-        return this.isInSubnet(SIX_TO_FOUR_SUBNET);
+        return this.isHostInSubnet(SIX_TO_FOUR_SUBNET);
     }
     /**
      * Returns true if the address is a loopback address, false otherwise
      * @returns {boolean}
      */
     isLoopback() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isLoopback();
+        }
         return this.getType() === 'Loopback';
     }
     /**
@@ -1044,13 +1123,64 @@ class Address6 {
      * @returns {boolean}
      */
     isULA() {
-        return this.isInSubnet(ULA_SUBNET);
+        return this.isHostInSubnet(ULA_SUBNET);
+    }
+    /**
+     * Returns true if the address is private, i.e. a Unique Local Address in
+     * `fc00::/7` ([RFC 4193](https://datatracker.ietf.org/doc/html/rfc4193)) or an
+     * IPv4-mapped / NAT64 address whose embedded IPv4 address is in one of the
+     * [RFC 1918](https://datatracker.ietf.org/doc/html/rfc1918) private ranges
+     * (e.g. `::ffff:10.0.0.1`). This is the IPv6 counterpart to
+     * {@link Address4.isPrivate}; use it instead of {@link isULA} when you need to
+     * catch mapped RFC 1918 addresses as well as native ULAs.
+     * @returns {boolean}
+     */
+    isPrivate() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isPrivate();
+        }
+        return this.isULA();
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is in the carrier-grade NAT range `100.64.0.0/10`
+     * ([RFC 6598](https://datatracker.ietf.org/doc/html/rfc6598)), false
+     * otherwise. There is no native IPv6 CGNAT range, so this only ever returns
+     * true for an embedded IPv4 address (e.g. `::ffff:100.64.0.1`).
+     * @returns {boolean}
+     */
+    isCGNAT() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isCGNAT();
+        }
+        return false;
+    }
+    /**
+     * Returns true if the address is an IPv4-mapped / NAT64 address whose embedded
+     * IPv4 address is the limited broadcast address `255.255.255.255`
+     * ([RFC 919](https://datatracker.ietf.org/doc/html/rfc919)), false otherwise.
+     * There is no IPv6 broadcast, so this only ever returns true for an embedded
+     * IPv4 address (e.g. `::ffff:255.255.255.255`).
+     * @returns {boolean}
+     */
+    isBroadcast() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isBroadcast();
+        }
+        return false;
     }
     /**
      * Returns true if the address is the unspecified address `::`.
      * @returns {boolean}
      */
     isUnspecified() {
+        const embedded = this.embeddedIPv4();
+        if (embedded) {
+            return embedded.isUnspecified();
+        }
         return this.getType() === 'Unspecified';
     }
     /**
@@ -1058,7 +1188,7 @@ class Address6 {
      * @returns {boolean}
      */
     isDocumentation() {
-        return this.isInSubnet(DOCUMENTATION_SUBNET);
+        return this.isHostInSubnet(DOCUMENTATION_SUBNET);
     }
     // #endregion
     // #region HTML
@@ -1111,7 +1241,12 @@ class Address6 {
         return `<a href="${safeHref}">${safeForm}</a>`;
     }
     /**
-     * Groups an address
+     * Groups an address.
+     *
+     * Returns an HTML fragment: each group is wrapped in a `<span>` carrying
+     * the group classes an address-inspector UI hovers on. The address content
+     * is HTML-escaped; anything you concatenate around it is your
+     * responsibility.
      * @returns {String}
      */
     group() {
@@ -1214,4 +1349,5 @@ const SIX_TO_FOUR_SUBNET = new Address6('2002::/16');
 const ULA_SUBNET = new Address6('fc00::/7');
 const DOCUMENTATION_SUBNET = new Address6('2001:db8::/32');
 const IPV4_MAPPED_SUBNET = new Address6('::ffff:0:0/96');
+const NAT64_WELL_KNOWN_SUBNET = new Address6('64:ff9b::/96');
 //# sourceMappingURL=ipv6.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v4/constants.js b/deps/npm/node_modules/ip-address/dist/v4/constants.js
index 6fa2518f9649..158288b7de65 100644
--- a/deps/npm/node_modules/ip-address/dist/v4/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v4/constants.js
@@ -3,6 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.RE_SUBNET_STRING = exports.RE_ADDRESS = exports.GROUPS = exports.BITS = void 0;
 exports.BITS = 32;
 exports.GROUPS = 4;
-exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/g;
+// Each octet is 0-255 written without a leading zero. A leading zero is
+// octal to the WHATWG URL parser, inet_aton, and getaddrinfo, but decimal to
+// parseInt(part, 10), so accepting the notation would make this library
+// disagree with the network stack about which host a string names.
+exports.RE_ADDRESS = /^(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])$/g;
 exports.RE_SUBNET_STRING = /\/\d{1,2}$/;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/dist/v6/constants.js b/deps/npm/node_modules/ip-address/dist/v6/constants.js
index 1a8cd1dd616e..4616cad66b6a 100644
--- a/deps/npm/node_modules/ip-address/dist/v6/constants.js
+++ b/deps/npm/node_modules/ip-address/dist/v6/constants.js
@@ -44,6 +44,7 @@ exports.TYPES = {
     'ff05::1:3/128': 'Multicast (All DHCP servers in this site)',
     '::/128': 'Unspecified',
     '::1/128': 'Loopback',
+    '::ffff:0:0/96': 'IPv4-mapped',
     'ff00::/8': 'Multicast',
     'fe80::/10': 'Link-local unicast',
     'fc00::/7': 'Unique local',
@@ -76,6 +77,6 @@ exports.RE_SUBNET_STRING = /\/\d{1,3}(?=%|$)/;
  * @static
  */
 exports.RE_ZONE_STRING = /%.*$/;
-exports.RE_URL = /^\[{0,1}([0-9a-f:]+)\]{0,1}/;
-exports.RE_URL_WITH_PORT = /\[([0-9a-f:]+)\]:([0-9]{1,5})/;
+exports.RE_URL = /^(?:\[([0-9a-f:.]+)\]|([0-9a-f:.]+))(?:[/?#].*)?$/i;
+exports.RE_URL_WITH_PORT = /^\[([0-9a-f:.]+)\]:([0-9]{1,5})(?:[/?#].*)?$/i;
 //# sourceMappingURL=constants.js.map
\ No newline at end of file
diff --git a/deps/npm/node_modules/ip-address/package.json b/deps/npm/node_modules/ip-address/package.json
index 47d109ec6f34..6ea2d24bd62b 100644
--- a/deps/npm/node_modules/ip-address/package.json
+++ b/deps/npm/node_modules/ip-address/package.json
@@ -16,7 +16,7 @@
     "bigint",
     "browser"
   ],
-  "version": "10.2.0",
+  "version": "10.5.0",
   "author": "Beau Gunderson <beau@beaugunderson.com> (https://beaugunderson.com/)",
   "license": "MIT",
   "main": "dist/ip-address.js",
@@ -25,6 +25,9 @@
     "docs": "tsx scripts/build-readme.ts",
     "build": "rm -rf dist; mkdir dist; tsc",
     "prepack": "npm run docs && npm run build",
+    "prepare": "git config core.hooksPath hooks || true",
+    "lint": "prettier --check . && eslint . --ext .ts,.js --max-warnings 0",
+    "lint:fix": "prettier --write . && eslint . --ext .ts,.js --max-warnings 0 --fix",
     "test-ci": "c8 --experimental-monocart mocha",
     "test": "mocha",
     "watch": "mocha --watch"
@@ -54,7 +57,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git://github.com/beaugunderson/ip-address.git"
+    "url": "https://github.com/beaugunderson/ip-address.git"
   },
   "overrides": {
     "diff": "^8.0.3",
@@ -70,11 +73,10 @@
     "chai": "^6.2.2",
     "eslint": "^8.57.1",
     "eslint_d": "^14.0.4",
-    "eslint-config-airbnb": "^19.0.4",
+    "eslint-config-airbnb-base": "^15.0.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-filenames": "^1.3.2",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-prettier": "^5.5.5",
     "eslint-plugin-sort-imports-es6-autofix": "^0.6.0",
     "mocha": "^11.7.5",
diff --git a/deps/npm/node_modules/libnpmpack/lib/index.js b/deps/npm/node_modules/libnpmpack/lib/index.js
index 6c8ee3fd6334..ce6707938bb3 100644
--- a/deps/npm/node_modules/libnpmpack/lib/index.js
+++ b/deps/npm/node_modules/libnpmpack/lib/index.js
@@ -12,6 +12,11 @@ async function pack (spec = 'file:.', opts = {}) {
   // gets spec
   spec = npa(spec)
 
+  // An explicit directory is the package being packed, not a dependency fetch.
+  if (spec.type === 'directory') {
+    opts = { ...opts, allowDirectory: 'all' }
+  }
+
   const manifest = await pacote.manifest(spec, { ...opts, Arborist, _isRoot: true })
 
   const stdio = opts.foregroundScripts ? 'inherit' : 'pipe'
diff --git a/deps/npm/node_modules/libnpmpack/package.json b/deps/npm/node_modules/libnpmpack/package.json
index 5741c8522c19..54c31fccd635 100644
--- a/deps/npm/node_modules/libnpmpack/package.json
+++ b/deps/npm/node_modules/libnpmpack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "libnpmpack",
-  "version": "9.1.12",
+  "version": "9.1.13",
   "description": "Programmatic API for the bits behind npm pack",
   "author": "GitHub Inc.",
   "main": "lib/index.js",
diff --git a/deps/npm/node_modules/tar/dist/commonjs/index.min.js b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
index 1a229a01e5a5..c1fe035f48f3 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/index.min.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/index.min.js
@@ -1,4 +1,4 @@
-"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),y=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[y]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[y])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[y])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[y]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[y]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[y])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[y]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==y&&this[y])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[y])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(y,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(y,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(y,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(y,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,E)=>{o=E,n=u,this.once(y,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(y,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(y,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[y])return e?this.emit("error",e):this.emit(y),this;this[y]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(y),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(b=>{"use strict";Object.defineProperty(b,"__esModule",{value:!0});b.dealias=b.isNoFile=b.isFile=b.isAsync=b.isSync=b.isAsyncNoFile=b.isSyncNoFile=b.isAsyncFile=b.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;b.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;b.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;b.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;b.isAsyncNoFile=Go;var Zo=s=>!!s.sync;b.isSync=Zo;var Yo=s=>!s.sync;b.isAsync=Yo;var Ko=s=>!!s.file;b.isFile=Ko;var Vo=s=>!s.file;b.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};b.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
+"use strict";var d=(s,e)=>()=>(e||s((e={exports:{}}).exports,e),e.exports);var We=d(F=>{"use strict";var Do=F&&F.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(F,"__esModule",{value:!0});F.Minipass=F.isWritable=F.isReadable=F.isStream=void 0;var kr=typeof process=="object"&&process?process:{stdout:null,stderr:null},ss=require("node:events"),qr=Do(require("node:stream")),Po=require("node:string_decoder"),No=s=>!!s&&typeof s=="object"&&(s instanceof Zt||s instanceof qr.default||(0,F.isReadable)(s)||(0,F.isWritable)(s));F.isStream=No;var Mo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.pipe=="function"&&s.pipe!==qr.default.Writable.prototype.pipe;F.isReadable=Mo;var Lo=s=>!!s&&typeof s=="object"&&s instanceof ss.EventEmitter&&typeof s.write=="function"&&typeof s.end=="function";F.isWritable=Lo;var ce=Symbol("EOF"),ue=Symbol("maybeEmitEnd"),we=Symbol("emittedEnd"),jt=Symbol("emittingEnd"),dt=Symbol("emittedError"),Ut=Symbol("closed"),xr=Symbol("read"),qt=Symbol("flush"),jr=Symbol("flushChunk"),K=Symbol("encoding"),Ue=Symbol("decoder"),R=Symbol("flowing"),mt=Symbol("paused"),qe=Symbol("resume"),O=Symbol("buffer"),I=Symbol("pipes"),v=Symbol("bufferLength"),Xi=Symbol("bufferPush"),Wt=Symbol("bufferShift"),N=Symbol("objectMode"),E=Symbol("destroyed"),Qi=Symbol("error"),Ji=Symbol("emitData"),Ur=Symbol("emitEnd"),es=Symbol("emitEnd2"),J=Symbol("async"),ts=Symbol("abort"),Ht=Symbol("aborted"),pt=Symbol("signal"),Ne=Symbol("dataListeners"),x=Symbol("discarded"),_t=s=>Promise.resolve().then(s),Ao=s=>s(),Io=s=>s==="end"||s==="finish"||s==="prefinish",Fo=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,Co=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Gt=class{src;dest;opts;ondrain;constructor(e,t,i){this.src=e,this.dest=t,this.opts=i,this.ondrain=()=>e[qe](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(e){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},is=class extends Gt{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(e,t,i){super(e,t,i),this.proxyErrors=r=>this.dest.emit("error",r),e.on("error",this.proxyErrors)}},Bo=s=>!!s.objectMode,zo=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",Zt=class extends ss.EventEmitter{[R]=!1;[mt]=!1;[I]=[];[O]=[];[N];[K];[J];[Ue];[ce]=!1;[we]=!1;[jt]=!1;[Ut]=!1;[dt]=null;[v]=0;[E]=!1;[pt];[Ht]=!1;[Ne]=0;[x]=!1;writable=!0;readable=!0;constructor(...e){let t=e[0]||{};if(super(),t.objectMode&&typeof t.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Bo(t)?(this[N]=!0,this[K]=null):zo(t)?(this[K]=t.encoding,this[N]=!1):(this[N]=!1,this[K]=null),this[J]=!!t.async,this[Ue]=this[K]?new Po.StringDecoder(this[K]):null,t&&t.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[O]}),t&&t.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[I]});let{signal:i}=t;i&&(this[pt]=i,i.aborted?this[ts]():i.addEventListener("abort",()=>this[ts]()))}get bufferLength(){return this[v]}get encoding(){return this[K]}set encoding(e){throw new Error("Encoding must be set at instantiation time")}setEncoding(e){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[N]}set objectMode(e){throw new Error("objectMode must be set at instantiation time")}get async(){return this[J]}set async(e){this[J]=this[J]||!!e}[ts](){this[Ht]=!0,this.emit("abort",this[pt]?.reason),this.destroy(this[pt]?.reason)}get aborted(){return this[Ht]}set aborted(e){}write(e,t,i){if(this[Ht])return!1;if(this[ce])throw new Error("write after end");if(this[E])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof t=="function"&&(i=t,t="utf8"),t||(t="utf8");let r=this[J]?_t:Ao;if(!this[N]&&!Buffer.isBuffer(e)){if(Co(e))e=Buffer.from(e.buffer,e.byteOffset,e.byteLength);else if(Fo(e))e=Buffer.from(e);else if(typeof e!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[N]?(this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):e.length?(typeof e=="string"&&!(t===this[K]&&!this[Ue]?.lastNeed)&&(e=Buffer.from(e,t)),Buffer.isBuffer(e)&&this[K]&&(e=this[Ue].write(e)),this[R]&&this[v]!==0&&this[qt](!0),this[R]?this.emit("data",e):this[Xi](e),this[v]!==0&&this.emit("readable"),i&&r(i),this[R]):(this[v]!==0&&this.emit("readable"),i&&r(i),this[R])}read(e){if(this[E])return null;if(this[x]=!1,this[v]===0||e===0||e&&e>this[v])return this[ue](),null;this[N]&&(e=null),this[O].length>1&&!this[N]&&(this[O]=[this[K]?this[O].join(""):Buffer.concat(this[O],this[v])]);let t=this[xr](e||null,this[O][0]);return this[ue](),t}[xr](e,t){if(this[N])this[Wt]();else{let i=t;e===i.length||e===null?this[Wt]():typeof i=="string"?(this[O][0]=i.slice(e),t=i.slice(0,e),this[v]-=e):(this[O][0]=i.subarray(e),t=i.subarray(0,e),this[v]-=e)}return this.emit("data",t),!this[O].length&&!this[ce]&&this.emit("drain"),t}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t="utf8"),e!==void 0&&this.write(e,t),i&&this.once("end",i),this[ce]=!0,this.writable=!1,(this[R]||!this[mt])&&this[ue](),this}[qe](){this[E]||(!this[Ne]&&!this[I].length&&(this[x]=!0),this[mt]=!1,this[R]=!0,this.emit("resume"),this[O].length?this[qt]():this[ce]?this[ue]():this.emit("drain"))}resume(){return this[qe]()}pause(){this[R]=!1,this[mt]=!0,this[x]=!1}get destroyed(){return this[E]}get flowing(){return this[R]}get paused(){return this[mt]}[Xi](e){this[N]?this[v]+=1:this[v]+=e.length,this[O].push(e)}[Wt](){return this[N]?this[v]-=1:this[v]-=this[O][0].length,this[O].shift()}[qt](e=!1){do;while(this[jr](this[Wt]())&&this[O].length);!e&&!this[O].length&&!this[ce]&&this.emit("drain")}[jr](e){return this.emit("data",e),this[R]}pipe(e,t){if(this[E])return e;this[x]=!1;let i=this[we];return t=t||{},e===kr.stdout||e===kr.stderr?t.end=!1:t.end=t.end!==!1,t.proxyErrors=!!t.proxyErrors,i?t.end&&e.end():(this[I].push(t.proxyErrors?new is(this,e,t):new Gt(this,e,t)),this[J]?_t(()=>this[qe]()):this[qe]()),e}unpipe(e){let t=this[I].find(i=>i.dest===e);t&&(this[I].length===1?(this[R]&&this[Ne]===0&&(this[R]=!1),this[I]=[]):this[I].splice(this[I].indexOf(t),1),t.unpipe())}addListener(e,t){return this.on(e,t)}on(e,t){let i=super.on(e,t);if(e==="data")this[x]=!1,this[Ne]++,!this[I].length&&!this[R]&&this[qe]();else if(e==="readable"&&this[v]!==0)super.emit("readable");else if(Io(e)&&this[we])super.emit(e),this.removeAllListeners(e);else if(e==="error"&&this[dt]){let r=t;this[J]?_t(()=>r.call(this,this[dt])):r.call(this,this[dt])}return i}removeListener(e,t){return this.off(e,t)}off(e,t){let i=super.off(e,t);return e==="data"&&(this[Ne]=this.listeners("data").length,this[Ne]===0&&!this[x]&&!this[I].length&&(this[R]=!1)),i}removeAllListeners(e){let t=super.removeAllListeners(e);return(e==="data"||e===void 0)&&(this[Ne]=0,!this[x]&&!this[I].length&&(this[R]=!1)),t}get emittedEnd(){return this[we]}[ue](){!this[jt]&&!this[we]&&!this[E]&&this[O].length===0&&this[ce]&&(this[jt]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ut]&&this.emit("close"),this[jt]=!1)}emit(e,...t){let i=t[0];if(e!=="error"&&e!=="close"&&e!==E&&this[E])return!1;if(e==="data")return!this[N]&&!i?!1:this[J]?(_t(()=>this[Ji](i)),!0):this[Ji](i);if(e==="end")return this[Ur]();if(e==="close"){if(this[Ut]=!0,!this[we]&&!this[E])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(e==="error"){this[dt]=i,super.emit(Qi,i);let n=!this[pt]||this.listeners("error").length?super.emit("error",i):!1;return this[ue](),n}else if(e==="resume"){let n=super.emit("resume");return this[ue](),n}else if(e==="finish"||e==="prefinish"){let n=super.emit(e);return this.removeAllListeners(e),n}let r=super.emit(e,...t);return this[ue](),r}[Ji](e){for(let i of this[I])i.dest.write(e)===!1&&this.pause();let t=this[x]?!1:super.emit("data",e);return this[ue](),t}[Ur](){return this[we]?!1:(this[we]=!0,this.readable=!1,this[J]?(_t(()=>this[es]()),!0):this[es]())}[es](){if(this[Ue]){let t=this[Ue].end();if(t){for(let i of this[I])i.dest.write(t);this[x]||super.emit("data",t)}}for(let t of this[I])t.end();let e=super.emit("end");return this.removeAllListeners("end"),e}async collect(){let e=Object.assign([],{dataLength:0});this[N]||(e.dataLength=0);let t=this.promise();return this.on("data",i=>{e.push(i),this[N]||(e.dataLength+=i.length)}),await t,e}async concat(){if(this[N])throw new Error("cannot concat in objectMode");let e=await this.collect();return this[K]?e.join(""):Buffer.concat(e,e.dataLength)}async promise(){return new Promise((e,t)=>{this.on(E,()=>t(new Error("stream destroyed"))),this.on("error",i=>t(i)),this.on("end",()=>e())})}[Symbol.asyncIterator](){this[x]=!1;let e=!1,t=async()=>(this.pause(),e=!0,{value:void 0,done:!0});return{next:()=>{if(e)return t();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[ce])return t();let n,o,a=u=>{this.off("data",h),this.off("end",l),this.off(E,c),t(),o(u)},h=u=>{this.off("error",a),this.off("end",l),this.off(E,c),this.pause(),n({value:u,done:!!this[ce]})},l=()=>{this.off("error",a),this.off("data",h),this.off(E,c),t(),n({done:!0,value:void 0})},c=()=>a(new Error("stream destroyed"));return new Promise((u,b)=>{o=b,n=u,this.once(E,c),this.once("error",a),this.once("end",l),this.once("data",h)})},throw:t,return:t,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[x]=!1;let e=!1,t=()=>(this.pause(),this.off(Qi,t),this.off(E,t),this.off("end",t),e=!0,{done:!0,value:void 0}),i=()=>{if(e)return t();let r=this.read();return r===null?t():{done:!1,value:r}};return this.once("end",t),this.once(Qi,t),this.once(E,t),{next:i,throw:t,return:t,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(e){if(this[E])return e?this.emit("error",e):this.emit(E),this;this[E]=!0,this[x]=!0,this[O].length=0,this[v]=0;let t=this;return typeof t.close=="function"&&!this[Ut]&&t.close(),e?this.emit("error",e):this.emit(E),this}static get isStream(){return F.isStream}};F.Minipass=Zt});var Ke=d(W=>{"use strict";var Wr=W&&W.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(W,"__esModule",{value:!0});W.WriteStreamSync=W.WriteStream=W.ReadStreamSync=W.ReadStream=void 0;var ko=Wr(require("events")),z=Wr(require("fs")),xo=We(),jo=z.default.writev,Ee=Symbol("_autoClose"),$=Symbol("_close"),wt=Symbol("_ended"),p=Symbol("_fd"),rs=Symbol("_finished"),de=Symbol("_flags"),ns=Symbol("_flush"),ls=Symbol("_handleChunk"),cs=Symbol("_makeBuf"),Et=Symbol("_mode"),Yt=Symbol("_needDrain"),Ze=Symbol("_onerror"),Ye=Symbol("_onopen"),os=Symbol("_onread"),He=Symbol("_onwrite"),be=Symbol("_open"),V=Symbol("_path"),ye=Symbol("_pos"),ee=Symbol("_queue"),Ge=Symbol("_read"),as=Symbol("_readSize"),fe=Symbol("_reading"),yt=Symbol("_remain"),hs=Symbol("_size"),Kt=Symbol("_write"),Me=Symbol("_writing"),Vt=Symbol("_defaultFlag"),Le=Symbol("_errored"),$t=class extends xo.Minipass{[Le]=!1;[p];[V];[as];[fe]=!1;[hs];[yt];[Ee];constructor(e,t){if(t=t||{},super(t),this.readable=!0,this.writable=!1,typeof e!="string")throw new TypeError("path must be a string");this[Le]=!1,this[p]=typeof t.fd=="number"?t.fd:void 0,this[V]=e,this[as]=t.readSize||16*1024*1024,this[fe]=!1,this[hs]=typeof t.size=="number"?t.size:1/0,this[yt]=this[hs],this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0,typeof this[p]=="number"?this[Ge]():this[be]()}get fd(){return this[p]}get path(){return this[V]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[be](){z.default.open(this[V],"r",(e,t)=>this[Ye](e,t))}[Ye](e,t){e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Ge]())}[cs](){return Buffer.allocUnsafe(Math.min(this[as],this[yt]))}[Ge](){if(!this[fe]){this[fe]=!0;let e=this[cs]();if(e.length===0)return process.nextTick(()=>this[os](null,0,e));z.default.read(this[p],e,0,e.length,null,(t,i,r)=>this[os](t,i,r))}}[os](e,t,i){this[fe]=!1,e?this[Ze](e):this[ls](t,i)&&this[Ge]()}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}[Ze](e){this[fe]=!0,this[$](),this.emit("error",e)}[ls](e,t){let i=!1;return this[yt]-=e,e>0&&(i=super.write(e<t.length?t.subarray(0,e):t)),(e===0||this[yt]<=0)&&(i=!1,this[$](),super.end()),i}emit(e,...t){switch(e){case"prefinish":case"finish":return!1;case"drain":return typeof this[p]=="number"&&this[Ge](),!1;case"error":return this[Le]?!1:(this[Le]=!0,super.emit(e,...t));default:return super.emit(e,...t)}}};W.ReadStream=$t;var us=class extends $t{[be](){let e=!0;try{this[Ye](null,z.default.openSync(this[V],"r")),e=!1}finally{e&&this[$]()}}[Ge](){let e=!0;try{if(!this[fe]){this[fe]=!0;do{let t=this[cs](),i=t.length===0?0:z.default.readSync(this[p],t,0,t.length,null);if(!this[ls](i,t))break}while(!0);this[fe]=!1}e=!1}finally{e&&this[$]()}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}};W.ReadStreamSync=us;var Xt=class extends ko.default{readable=!1;writable=!0;[Le]=!1;[Me]=!1;[wt]=!1;[ee]=[];[Yt]=!1;[V];[Et];[Ee];[p];[Vt];[de];[rs]=!1;[ye];constructor(e,t){t=t||{},super(t),this[V]=e,this[p]=typeof t.fd=="number"?t.fd:void 0,this[Et]=t.mode===void 0?438:t.mode,this[ye]=typeof t.start=="number"?t.start:void 0,this[Ee]=typeof t.autoClose=="boolean"?t.autoClose:!0;let i=this[ye]!==void 0?"r+":"w";this[Vt]=t.flags===void 0,this[de]=t.flags===void 0?i:t.flags,this[p]===void 0&&this[be]()}emit(e,...t){if(e==="error"){if(this[Le])return!1;this[Le]=!0}return super.emit(e,...t)}get fd(){return this[p]}get path(){return this[V]}[Ze](e){this[$](),this[Me]=!0,this.emit("error",e)}[be](){z.default.open(this[V],this[de],this[Et],(e,t)=>this[Ye](e,t))}[Ye](e,t){this[Vt]&&this[de]==="r+"&&e&&e.code==="ENOENT"?(this[de]="w",this[be]()):e?this[Ze](e):(this[p]=t,this.emit("open",t),this[Me]||this[ns]())}end(e,t){return e&&this.write(e,t),this[wt]=!0,!this[Me]&&!this[ee].length&&typeof this[p]=="number"&&this[He](null,0),this}write(e,t){return typeof e=="string"&&(e=Buffer.from(e,t)),this[wt]?(this.emit("error",new Error("write() after end()")),!1):this[p]===void 0||this[Me]||this[ee].length?(this[ee].push(e),this[Yt]=!0,!1):(this[Me]=!0,this[Kt](e),!0)}[Kt](e){z.default.write(this[p],e,0,e.length,this[ye],(t,i)=>this[He](t,i))}[He](e,t){e?this[Ze](e):(this[ye]!==void 0&&typeof t=="number"&&(this[ye]+=t),this[ee].length?this[ns]():(this[Me]=!1,this[wt]&&!this[rs]?(this[rs]=!0,this[$](),this.emit("finish")):this[Yt]&&(this[Yt]=!1,this.emit("drain"))))}[ns](){if(this[ee].length===0)this[wt]&&this[He](null,0);else if(this[ee].length===1)this[Kt](this[ee].pop());else{let e=this[ee];this[ee]=[],jo(this[p],e,this[ye],(t,i)=>this[He](t,i))}}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.close(e,t=>t?this.emit("error",t):this.emit("close"))}}};W.WriteStream=Xt;var fs=class extends Xt{[be](){let e;if(this[Vt]&&this[de]==="r+")try{e=z.default.openSync(this[V],this[de],this[Et])}catch(t){if(t?.code==="ENOENT")return this[de]="w",this[be]();throw t}else e=z.default.openSync(this[V],this[de],this[Et]);this[Ye](null,e)}[$](){if(this[Ee]&&typeof this[p]=="number"){let e=this[p];this[p]=void 0,z.default.closeSync(e),this.emit("close")}}[Kt](e){let t=!0;try{this[He](null,z.default.writeSync(this[p],e,0,e.length,this[ye])),t=!1}finally{if(t)try{this[$]()}catch{}}}};W.WriteStreamSync=fs});var Qt=d(S=>{"use strict";Object.defineProperty(S,"__esModule",{value:!0});S.dealias=S.isNoFile=S.isFile=S.isAsync=S.isSync=S.isAsyncNoFile=S.isSyncNoFile=S.isAsyncFile=S.isSyncFile=void 0;var Uo=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),qo=s=>!!s.sync&&!!s.file;S.isSyncFile=qo;var Wo=s=>!s.sync&&!!s.file;S.isAsyncFile=Wo;var Ho=s=>!!s.sync&&!s.file;S.isSyncNoFile=Ho;var Go=s=>!s.sync&&!s.file;S.isAsyncNoFile=Go;var Zo=s=>!!s.sync;S.isSync=Zo;var Yo=s=>!s.sync;S.isAsync=Yo;var Ko=s=>!!s.file;S.isFile=Ko;var Vo=s=>!s.file;S.isNoFile=Vo;var $o=s=>{let e=Uo.get(s);return e||s},Xo=(s={})=>{if(!s)return{};let e={};for(let[t,i]of Object.entries(s)){let r=$o(t);e[r]=i}return e.chmod===void 0&&e.noChmod===!1&&(e.chmod=!0),delete e.noChmod,e};S.dealias=Xo});var Ve=d(Jt=>{"use strict";Object.defineProperty(Jt,"__esModule",{value:!0});Jt.makeCommand=void 0;var bt=Qt(),Qo=(s,e,t,i,r)=>Object.assign((n=[],o,a)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(a=o,o=void 0),o=o?Array.from(o):[];let h=(0,bt.dealias)(n);if(r?.(h,o),(0,bt.isSyncFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return s(h,o)}else if((0,bt.isAsyncFile)(h)){let l=e(h,o);return a?l.then(()=>a(),a):l}else if((0,bt.isSyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback not supported for sync tar functions");return t(h,o)}else if((0,bt.isAsyncNoFile)(h)){if(typeof a=="function")throw new TypeError("callback only supported with file option");return i(h,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:e,syncNoFile:t,asyncNoFile:i,validate:r});Jt.makeCommand=Qo});var ds=d($e=>{"use strict";var Jo=$e&&$e.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty($e,"__esModule",{value:!0});$e.constants=void 0;var ea=Jo(require("zlib")),ta=ea.default.constants||{ZLIB_VERNUM:4736};$e.constants=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},ta))});var Ps=d(f=>{"use strict";var ia=f&&f.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),sa=f&&f.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),ra=f&&f.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ia(t,e,i[r]);return sa(t,e),t}})(),na=f&&f.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(f,"__esModule",{value:!0});f.ZstdDecompress=f.ZstdCompress=f.BrotliDecompress=f.BrotliCompress=f.Unzip=f.InflateRaw=f.DeflateRaw=f.Gunzip=f.Gzip=f.Inflate=f.Deflate=f.Zlib=f.ZlibError=f.constants=void 0;var _s=na(require("assert")),Ae=require("buffer"),oa=We(),Hr=ra(require("zlib")),te=ds(),aa=ds();Object.defineProperty(f,"constants",{enumerable:!0,get:function(){return aa.constants}});var ha=Ae.Buffer.concat,Gr=Object.getOwnPropertyDescriptor(Ae.Buffer,"concat"),la=s=>s,ms=Gr?.writable===!0||Gr?.set!==void 0?s=>{Ae.Buffer.concat=s?la:ha}:s=>{},Ie=Symbol("_superWrite"),Fe=class extends Error{code;errno;constructor(e,t){super("zlib: "+e.message,{cause:e}),this.code=e.code,this.errno=e.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+e.message,Error.captureStackTrace(this,t??this.constructor)}get name(){return"ZlibError"}};f.ZlibError=Fe;var ps=Symbol("flushFlag"),St=class extends oa.Minipass{#e=!1;#i=!1;#s;#n;#r;#t;#o;get sawError(){return this.#e}get handle(){return this.#t}get flushFlag(){return this.#s}constructor(e,t){if(!e||typeof e!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(e),this.#s=e.flush??0,this.#n=e.finishFlush??0,this.#r=e.fullFlushFlag??0,typeof Hr[t]!="function")throw new TypeError("Compression method not supported: "+t);try{this.#t=new Hr[t](e)}catch(i){throw new Fe(i,this.constructor)}this.#o=i=>{this.#e||(this.#e=!0,this.close(),this.emit("error",i))},this.#t?.on("error",i=>this.#o(new Fe(i))),this.once("end",()=>this.close)}close(){this.#t&&(this.#t.close(),this.#t=void 0,this.emit("close"))}reset(){if(!this.#e)return(0,_s.default)(this.#t,"zlib binding closed"),this.#t.reset?.()}flush(e){this.ended||(typeof e!="number"&&(e=this.#r),this.write(Object.assign(Ae.Buffer.alloc(0),{[ps]:e})))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&(t?this.write(e,t):this.write(e)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Ie](e){return super.write(e)}write(e,t,i){if(typeof t=="function"&&(i=t,t="utf8"),typeof e=="string"&&(e=Ae.Buffer.from(e,t)),this.#e)return;(0,_s.default)(this.#t,"zlib binding closed");let r=this.#t._handle,n=r.close;r.close=()=>{};let o=this.#t.close;this.#t.close=()=>{},ms(!0);let a;try{let l=typeof e[ps]=="number"?e[ps]:this.#s;a=this.#t._processChunk(e,l),ms(!1)}catch(l){ms(!1),this.#o(new Fe(l,this.write))}finally{this.#t&&(this.#t._handle=r,r.close=n,this.#t.close=o,this.#t.removeAllListeners("error"))}this.#t&&this.#t.on("error",l=>this.#o(new Fe(l,this.write)));let h;if(a)if(Array.isArray(a)&&a.length>0){let l=a[0];h=this[Ie](Ae.Buffer.from(l));for(let c=1;c<a.length;c++)h=this[Ie](a[c])}else h=this[Ie](Ae.Buffer.from(a));return i&&i(),h}},ie=class extends St{#e;#i;constructor(e,t){e=e||{},e.flush=e.flush||te.constants.Z_NO_FLUSH,e.finishFlush=e.finishFlush||te.constants.Z_FINISH,e.fullFlushFlag=te.constants.Z_FULL_FLUSH,super(e,t),this.#e=e.level,this.#i=e.strategy}params(e,t){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#e!==e||this.#i!==t){this.flush(te.constants.Z_SYNC_FLUSH),(0,_s.default)(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(e,t)}finally{this.handle.flush=i}this.handle&&(this.#e=e,this.#i=t)}}}};f.Zlib=ie;var ws=class extends ie{constructor(e){super(e,"Deflate")}};f.Deflate=ws;var ys=class extends ie{constructor(e){super(e,"Inflate")}};f.Inflate=ys;var Es=class extends ie{#e;constructor(e){super(e,"Gzip"),this.#e=e&&!!e.portable}[Ie](e){return this.#e?(this.#e=!1,e[9]=255,super[Ie](e)):super[Ie](e)}};f.Gzip=Es;var bs=class extends ie{constructor(e){super(e,"Gunzip")}};f.Gunzip=bs;var Ss=class extends ie{constructor(e){super(e,"DeflateRaw")}};f.DeflateRaw=Ss;var gs=class extends ie{constructor(e){super(e,"InflateRaw")}};f.InflateRaw=gs;var Rs=class extends ie{constructor(e){super(e,"Unzip")}};f.Unzip=Rs;var ei=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.BROTLI_OPERATION_PROCESS,e.finishFlush=e.finishFlush||te.constants.BROTLI_OPERATION_FINISH,e.fullFlushFlag=te.constants.BROTLI_OPERATION_FLUSH,super(e,t)}},Os=class extends ei{constructor(e){super(e,"BrotliCompress")}};f.BrotliCompress=Os;var vs=class extends ei{constructor(e){super(e,"BrotliDecompress")}};f.BrotliDecompress=vs;var ti=class extends St{constructor(e,t){e=e||{},e.flush=e.flush||te.constants.ZSTD_e_continue,e.finishFlush=e.finishFlush||te.constants.ZSTD_e_end,e.fullFlushFlag=te.constants.ZSTD_e_flush,super(e,t)}},Ts=class extends ti{constructor(e){super(e,"ZstdCompress")}};f.ZstdCompress=Ts;var Ds=class extends ti{constructor(e){super(e,"ZstdDecompress")}};f.ZstdDecompress=Ds});var Kr=d(Xe=>{"use strict";Object.defineProperty(Xe,"__esModule",{value:!0});Xe.parse=Xe.encode=void 0;var ca=(s,e)=>{if(Number.isSafeInteger(s))s<0?fa(s,e):ua(s,e);else throw Error("cannot encode number outside of javascript safe integer range");return e};Xe.encode=ca;var ua=(s,e)=>{e[0]=128;for(var t=e.length;t>1;t--)e[t-1]=s&255,s=Math.floor(s/256)},fa=(s,e)=>{e[0]=255;var t=!1;s=s*-1;for(var i=e.length;i>1;i--){var r=s&255;s=Math.floor(s/256),t?e[i-1]=Zr(r):r===0?e[i-1]=0:(t=!0,e[i-1]=Yr(r))}},da=s=>{let e=s[0],t=e===128?pa(s.subarray(1,s.length)):e===255?ma(s):null;if(t===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(t))throw Error("parsed number outside of javascript safe integer range");return t};Xe.parse=da;var ma=s=>{for(var e=s.length,t=0,i=!1,r=e-1;r>-1;r--){var n=Number(s[r]),o;i?o=Zr(n):n===0?o=n:(i=!0,o=Yr(n)),o!==0&&(t-=o*Math.pow(256,e-r-1))}return t},pa=s=>{for(var e=s.length,t=0,i=e-1;i>-1;i--){var r=Number(s[i]);r!==0&&(t+=r*Math.pow(256,e-i-1))}return t},Zr=s=>(255^s)&255,Yr=s=>(255^s)+1&255});var Ns=d(C=>{"use strict";Object.defineProperty(C,"__esModule",{value:!0});C.code=C.name=C.normalFsTypes=C.isName=C.isCode=void 0;var _a=s=>C.name.has(s);C.isCode=_a;var wa=s=>C.code.has(s);C.isName=wa;C.normalFsTypes=new Set(["0","","1","2","3","4","5","6","7","D"]);C.name=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]);C.code=new Map(Array.from(C.name).map(s=>[s[1],s[0]]))});var et=d(se=>{"use strict";var ya=se&&se.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ea=se&&se.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Vr=se&&se.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ya(t,e,i[r]);return Ea(t,e),t}})();Object.defineProperty(se,"__esModule",{value:!0});se.Header=void 0;var Qe=require("node:path"),$r=Vr(Kr()),Je=Vr(Ns()),ba=s=>s===void 0||s<0?void 0:s,As=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#e="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(e,t=0,i,r){Buffer.isBuffer(e)?this.decode(e,t||0,i,r):e&&this.#i(e)}decode(e,t,i,r){if(t||(t=0),!e||!(e.length>=t+512))throw new Error("need 512 bytes for header");let n=Ce(e,t+156,1),o=Je.normalFsTypes.has(n),a=o?i:void 0,h=o?r:void 0;if(this.path=a?.path??Ce(e,t,100),this.mode=a?.mode??h?.mode??Se(e,t+100,8),this.uid=a?.uid??h?.uid??Se(e,t+108,8),this.gid=a?.gid??h?.gid??Se(e,t+116,8),this.size=ba(a?.size??h?.size??Se(e,t+124,12)),this.mtime=a?.mtime??h?.mtime??Ms(e,t+136,12),this.cksum=Se(e,t+148,12),h&&this.#i(h,!0),a&&this.#i(a),Je.isCode(n)&&(this.#e=n||"0"),this.#e==="0"&&this.path.slice(-1)==="/"&&(this.#e="5"),this.#e==="5"&&(this.size=0),this.linkpath=Ce(e,t+157,100),e.subarray(t+257,t+265).toString()==="ustar\x0000")if(this.uname=a?.uname??h?.uname??Ce(e,t+265,32),this.gname=a?.gname??h?.gname??Ce(e,t+297,32),this.devmaj=a?.devmaj??h?.devmaj??Se(e,t+329,8)??0,this.devmin=a?.devmin??h?.devmin??Se(e,t+337,8)??0,e[t+475]!==0){let c=Ce(e,t+345,155);this.path=c+"/"+this.path}else{let c=Ce(e,t+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Ms(e,t+476,12),this.ctime=i?.ctime??r?.ctime??Ms(e,t+488,12)}let l=256;for(let c=t;c<t+148;c++)l+=e[c];for(let c=t+156;c<t+512;c++)l+=e[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(e,t=!1){Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&t||i==="linkpath"&&t||i==="global"))))}encode(e,t=0){if(e||(e=this.block=Buffer.alloc(512)),this.#e==="Unsupported"&&(this.#e="0"),!(e.length>=t+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=Sa(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Be(e,t,100,n)||this.needPax,this.needPax=ge(e,t+100,8,this.mode)||this.needPax,this.needPax=ge(e,t+108,8,this.uid)||this.needPax,this.needPax=ge(e,t+116,8,this.gid)||this.needPax,this.needPax=ge(e,t+124,12,this.size)||this.needPax,this.needPax=Ls(e,t+136,12,this.mtime)||this.needPax,e[t+156]=Number(this.#e.codePointAt(0)),this.needPax=Be(e,t+157,100,this.linkpath)||this.needPax,e.write("ustar\x0000",t+257,8),this.needPax=Be(e,t+265,32,this.uname)||this.needPax,this.needPax=Be(e,t+297,32,this.gname)||this.needPax,this.needPax=ge(e,t+329,8,this.devmaj)||this.needPax,this.needPax=ge(e,t+337,8,this.devmin)||this.needPax,this.needPax=Be(e,t+345,i,o)||this.needPax,e[t+475]!==0?this.needPax=Be(e,t+345,155,o)||this.needPax:(this.needPax=Be(e,t+345,130,o)||this.needPax,this.needPax=Ls(e,t+476,12,this.atime)||this.needPax,this.needPax=Ls(e,t+488,12,this.ctime)||this.needPax);let a=256;for(let h=t;h<t+148;h++)a+=e[h];for(let h=t+156;h<t+512;h++)a+=e[h];return this.cksum=a,ge(e,t+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#e==="Unsupported"?this.#e:Je.name.get(this.#e)}get typeKey(){return this.#e}set type(e){let t=String(Je.code.get(e));if(Je.isCode(t)||t==="Unsupported")this.#e=t;else if(Je.isCode(e))this.#e=e;else throw new TypeError("invalid entry type: "+e)}};se.Header=As;var Sa=(s,e)=>{let i=s,r="",n,o=Qe.posix.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Qe.posix.dirname(i),i=Qe.posix.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=e?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=e?n=[i.slice(0,99),r,!0]:(i=Qe.posix.join(Qe.posix.basename(r),i),r=Qe.posix.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},Ce=(s,e,t)=>s.subarray(e,e+t).toString("utf8").replace(/\0.*/,""),Ms=(s,e,t)=>ga(Se(s,e,t)),ga=s=>s===void 0?void 0:new Date(s*1e3),Se=(s,e,t)=>Number(s[e])&128?$r.parse(s.subarray(e,e+t)):Oa(s,e,t),Ra=s=>isNaN(s)?void 0:s,Oa=(s,e,t)=>Ra(parseInt(s.subarray(e,e+t).toString("utf8").replace(/\0.*$/,"").trim(),8)),va={12:8589934591,8:2097151},ge=(s,e,t,i)=>i===void 0?!1:i>va[t]||i<0?($r.encode(i,s.subarray(e,e+t)),!0):(Ta(s,e,t,i),!1),Ta=(s,e,t,i)=>s.write(Da(i,t),e,t,"ascii"),Da=(s,e)=>Pa(Math.floor(s).toString(8),e),Pa=(s,e)=>(s.length===e-1?s:new Array(e-s.length-1).join("0")+s+" ")+"\0",Ls=(s,e,t,i)=>i===void 0?!1:ge(s,e,t,i.getTime()/1e3),Na=new Array(156).join("\0"),Be=(s,e,t,i)=>i===void 0?!1:(s.write(i+Na,e,t,"utf8"),i.length!==Buffer.byteLength(i)||i.length>t)});var si=d(ii=>{"use strict";Object.defineProperty(ii,"__esModule",{value:!0});ii.Pax=void 0;var Ma=require("node:path"),La=et(),Is=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(e,t=!1){this.atime=e.atime,this.charset=e.charset,this.comment=e.comment,this.ctime=e.ctime,this.dev=e.dev,this.gid=e.gid,this.global=t,this.gname=e.gname,this.ino=e.ino,this.linkpath=e.linkpath,this.mtime=e.mtime,this.nlink=e.nlink,this.path=e.path,this.size=e.size,this.uid=e.uid,this.uname=e.uname}encode(){let e=this.encodeBody();if(e==="")return Buffer.allocUnsafe(0);let t=Buffer.byteLength(e),i=512*Math.ceil(1+t/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new La.Header({path:("PaxHeader/"+(0,Ma.basename)(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:t,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(e,512,t,"utf8");for(let n=t+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(e){if(this[e]===void 0)return"";let t=this[e],i=t instanceof Date?t.getTime()/1e3:t,r=" "+(e==="dev"||e==="ino"||e==="nlink"?"SCHILY.":"")+e+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(e,t,i=!1){return new s(Aa(Ia(e),t),i)}};ii.Pax=Is;var Aa=(s,e)=>e?Object.assign({},e,s):s,Ia=s=>s.replace(/\n$/,"").split(`
-`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),S=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[S];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){this[ne]||(this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1}))}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[S]===void 0||this.brotli===void 0&&this[S]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[S]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[S]=!1);let o=!1;if(this[S]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[S]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[S]===void 0||this[S]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[S]=this[S]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[S].on("data",c=>{this[nn](c)&&this[li](c)}),this[S].on("error",c=>{this[ne]||this.abort(c)}),this[S].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[S][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[S]?(this[Ot]+=e.length,this[S].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[S]?(e&&(this[Ot]+=e.length,this[S].write(e)),this[S].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(n=>[(0,Gs.stripTrailingSlashes)(n),!0])),i=s.filter,r=(n,o="")=>{let a=o||(0,on.parse)(n).root||".",h;if(n===a)h=!1;else{let l=t.get(n);h=l!==void 0?l:r((0,on.dirname)(n),a)}return t.set(n,h),h};s.filter=i?(n,o)=>i(n,o)&&r((0,Gs.stripTrailingSlashes)(n)):n=>r((0,Gs.stripTrailingSlashes)(n))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),E=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>E(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,E);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>E(null,w??void 0),E);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,E)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,E=>E?m.default.utimes(h,c,u,D=>o(D&&E)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,E=>E?m.default.chown(h,c,u,D=>o(D&&E)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),E=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,E);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,E)};q.default.read(n,u,0,512,l,E)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,E)=>{if(u)return q.default.close(c,()=>o(u));i(c,E.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
+`).reduce(Fa,Object.create(null)),Fa=(s,e)=>{let t=parseInt(e,10);if(t!==Buffer.byteLength(e)+1)return s;e=e.slice((t+" ").length);let i=e.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let a=+o;a>=0&&(s[n]=a);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s}});var tt=d(ri=>{"use strict";Object.defineProperty(ri,"__esModule",{value:!0});ri.normalizeWindowsPath=void 0;var Ca=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform;ri.normalizeWindowsPath=Ca!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/")});var Cs=d(oi=>{"use strict";Object.defineProperty(oi,"__esModule",{value:!0});oi.ReadEntry=void 0;var Ba=We(),ni=tt(),Fs=class extends Ba.Minipass{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(e,t,i){switch(super({}),this.pause(),this.extended=t,this.globalExtended=i,this.header=e,this.remain=e.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=e.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!e.path)throw new Error("no path provided for tar.ReadEntry");this.path=(0,ni.normalizeWindowsPath)(e.path),this.mode=e.mode,this.mode&&(this.mode=this.mode&4095),this.uid=e.uid,this.gid=e.gid,this.uname=e.uname,this.gname=e.gname,this.size=this.remain,this.mtime=e.mtime,this.atime=e.atime,this.ctime=e.ctime,this.linkpath=e.linkpath?(0,ni.normalizeWindowsPath)(e.linkpath):void 0,this.uname=e.uname,this.gname=e.gname,t&&this.#e(t),i&&this.#e(i,!0)}write(e){let t=e.length;if(t>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-t),this.blockRemain=Math.max(0,r-t),this.ignore?!0:i>=t?super.write(e):super.write(e.subarray(0,i))}#e(e,t=!1){e.path&&(e.path=(0,ni.normalizeWindowsPath)(e.path)),e.linkpath&&(e.linkpath=(0,ni.normalizeWindowsPath)(e.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(e).filter(([i,r])=>!(r==null||i==="path"&&t))))}};oi.ReadEntry=Fs});var hi=d(ai=>{"use strict";Object.defineProperty(ai,"__esModule",{value:!0});ai.warnMethod=void 0;var za=(s,e,t,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=t instanceof Error&&t.code||e,i.tarCode=e,!s.strict&&i.recoverable!==!1?(t instanceof Error&&(i=Object.assign(t,i),t=t.message),s.emit("warn",e,t,i)):t instanceof Error?s.emit("error",Object.assign(t,i)):s.emit("error",Object.assign(new Error(`${e}: ${t}`),i))};ai.warnMethod=za});var _i=d(pi=>{"use strict";Object.defineProperty(pi,"__esModule",{value:!0});pi.Parser=void 0;var ka=require("events"),Bs=Ps(),Xr=et(),Qr=si(),xa=Cs(),ja=hi(),Ua=1024*1024,qs=Buffer.from([31,139]),Ws=Buffer.from([40,181,47,253]),qa=Math.max(qs.length,Ws.length),H=Symbol("state"),ze=Symbol("writeEntry"),me=Symbol("readEntry"),zs=Symbol("nextEntry"),Jr=Symbol("processEntry"),re=Symbol("extendedHeader"),gt=Symbol("globalExtendedHeader"),Re=Symbol("meta"),en=Symbol("emitMeta"),_=Symbol("buffer"),pe=Symbol("queue"),Oe=Symbol("ended"),ks=Symbol("emittedEnd"),ke=Symbol("emit"),y=Symbol("unzip"),li=Symbol("consumeChunk"),ci=Symbol("consumeChunkSub"),xs=Symbol("consumeBody"),tn=Symbol("consumeMeta"),sn=Symbol("consumeHeader"),Rt=Symbol("consuming"),js=Symbol("bufferConcat"),ui=Symbol("maybeEnd"),it=Symbol("writing"),ne=Symbol("aborted"),fi=Symbol("onDone"),xe=Symbol("sawValidEntry"),di=Symbol("sawNullBlock"),mi=Symbol("sawEOF"),rn=Symbol("closeStream"),Wa=1e3,Ot=Symbol("compressedBytesRead"),Us=Symbol("decompressedBytesRead"),nn=Symbol("checkDecompressionRatio"),Ha=()=>!0,Hs=class extends ka.EventEmitter{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[pe]=[];[_];[me];[ze];[H]="begin";[Re]="";[re];[gt];[Oe]=!1;[y];[ne]=!1;[xe];[di]=!1;[mi]=!1;[it]=!1;[Rt]=!1;[ks]=!1;[Ot]=0;[Us]=0;constructor(e={}){super(),this.file=e.file||"",this.on(fi,()=>{(this[H]==="begin"||this[xe]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),e.ondone?this.on(fi,e.ondone):this.on(fi,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!e.strict,this.maxDecompressionRatio=typeof e.maxDecompressionRatio=="number"?e.maxDecompressionRatio:Wa,this.maxMetaEntrySize=e.maxMetaEntrySize||Ua,this.filter=typeof e.filter=="function"?e.filter:Ha;let t=e.file&&(e.file.endsWith(".tar.br")||e.file.endsWith(".tbr"));this.brotli=!(e.gzip||e.zstd)&&e.brotli!==void 0?e.brotli:t?void 0:!1;let i=e.file&&(e.file.endsWith(".tar.zst")||e.file.endsWith(".tzst"));this.zstd=!(e.gzip||e.brotli)&&e.zstd!==void 0?e.zstd:i?!0:void 0,this.on("end",()=>this[rn]()),typeof e.onwarn=="function"&&this.on("warn",e.onwarn),typeof e.onReadEntry=="function"&&this.on("entry",e.onReadEntry)}warn(e,t,i={}){(0,ja.warnMethod)(this,e,t,i)}[sn](e,t){this[xe]===void 0&&(this[xe]=!1);let i;try{i=new Xr.Header(e,t,this[re],this[gt])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[di]?(this[mi]=!0,this[H]==="begin"&&(this[H]="header"),this[ke]("eof")):(this[di]=!0,this[ke]("nullBlock"));else if(this[di]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[ze]=new xa.ReadEntry(i,this[re],this[gt]);if(!this[xe])if(n.remain){let o=()=>{n.invalid||(this[xe]=!0)};n.on("end",o)}else this[xe]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[ke]("ignoredEntry",n),this[H]="ignore",n.resume()):n.size>0&&(this[Re]="",n.on("data",o=>this[Re]+=o),this[H]="meta"):(this[re]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[ke]("ignoredEntry",n),this[H]=n.remain?"ignore":"header",n.resume()):(n.remain?this[H]="body":(this[H]="header",n.end()),this[me]?this[pe].push(n):(this[pe].push(n),this[zs]())))}}}[rn](){queueMicrotask(()=>this.emit("close"))}[Jr](e){let t=!0;if(!e)this[me]=void 0,t=!1;else if(Array.isArray(e)){let[i,...r]=e;this.emit(i,...r)}else this[me]=e,this.emit("entry",e),e.emittedEnd||(e.on("end",()=>this[zs]()),t=!1);return t}[zs](){do;while(this[Jr](this[pe].shift()));if(this[pe].length===0){let e=this[me];!e||e.flowing||e.size===e.remain?this[it]||this.emit("drain"):e.once("drain",()=>this.emit("drain"))}}[xs](e,t){let i=this[ze];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=e.length&&t===0?e:e.subarray(t,t+r);return i.write(n),i.blockRemain||(this[H]="header",this[ze]=void 0,i.end()),n.length}[tn](e,t){let i=this[ze],r=this[xs](e,t);return!this[ze]&&i&&this[en](i),r}[ke](e,t,i){this[pe].length===0&&!this[me]?this.emit(e,t,i):this[pe].push([e,t,i])}[en](e){switch(this[ke]("meta",this[Re]),e.type){case"ExtendedHeader":case"OldExtendedHeader":this[re]=Qr.Pax.parse(this[Re],this[re],!1);break;case"GlobalExtendedHeader":this[gt]=Qr.Pax.parse(this[Re],this[gt],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let t=this[re]??Object.create(null);this[re]=t,t.path=this[Re].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let t=this[re]||Object.create(null);this[re]=t,t.linkpath=this[Re].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+e.type)}}abort(e){if(!this[ne]){if(this[y]){let t=this[y];t.write=()=>!0,t.end=()=>t,t.emit=()=>!1,t.destroy?.()}this[ne]=!0,this.emit("abort",e),this.warn("TAR_ABORT",e,{recoverable:!1})}}[nn](e){this[Us]+=e.length;let t=this[Us]/this[Ot];return t>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${t.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this[ne])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&e){if(this[_]&&(e=Buffer.concat([this[_],e]),this[_]=void 0),e.length<qa)return this[_]=e,i?.(),!0;for(let h=0;this[y]===void 0&&h<qs.length;h++)e[h]!==qs[h]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let h=0;h<Ws.length;h++)if(e[h]!==Ws[h]){o=!1;break}}let a=this.brotli===void 0&&!o;if(this[y]===!1&&a)if(e.length<512)if(this[Oe])this.brotli=!0;else return this[_]=e,i?.(),!0;else try{new Xr.Header(e.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let h=this[Oe];this[Oe]=!1,this[y]=this[y]===void 0?new Bs.Unzip({}):o?new Bs.ZstdDecompress({}):new Bs.BrotliDecompress({}),this[y].on("data",c=>{this[nn](c)&&this[li](c)}),this[y].on("error",c=>{this[ne]||this.abort(c)}),this[y].on("end",()=>{this[Oe]=!0,this[li]()}),this[it]=!0,this[Ot]+=e.length;let l=!!this[y][h?"end":"write"](e);return this[it]=!1,i?.(),l}}this[it]=!0,this[y]?(this[Ot]+=e.length,this[y].write(e)):this[li](e),this[it]=!1;let n=this[pe].length>0?!1:this[me]?this[me].flowing:!0;return!n&&this[pe].length===0&&this[me]?.once("drain",()=>this.emit("drain")),i?.(),n}[js](e){e&&!this[ne]&&(this[_]=this[_]?Buffer.concat([this[_],e]):e)}[ui](){if(this[Oe]&&!this[ks]&&!this[ne]&&!this[Rt]){this[ks]=!0;let e=this[ze];if(e?.blockRemain){let t=this[_]?this[_].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${e.blockRemain} more bytes, only ${t} available)`,{entry:e}),this[_]&&e.write(this[_]),e.end()}this[ke](fi)}}[li](e){if(this[Rt]&&e)this[js](e);else if(!e&&!this[_])this[ui]();else if(e){if(this[Rt]=!0,this[_]){this[js](e);let t=this[_];this[_]=void 0,this[ci](t)}else this[ci](e);for(;this[_]&&this[_]?.length>=512&&!this[ne]&&!this[mi];){let t=this[_];this[_]=void 0,this[ci](t)}this[Rt]=!1}(!this[_]||this[Oe])&&this[ui]()}[ci](e){let t=0,i=e.length;for(;t+512<=i&&!this[ne]&&!this[mi];)switch(this[H]){case"begin":case"header":this[sn](e,t),t+=512;break;case"ignore":case"body":t+=this[xs](e,t);break;case"meta":t+=this[tn](e,t);break;default:throw new Error("invalid state: "+this[H])}t<i&&(this[_]=this[_]?Buffer.concat([e.subarray(t),this[_]]):e.subarray(t))}end(e,t,i){return typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t)),i&&this.once("finish",i),this[ne]||(this[y]?(e&&(this[Ot]+=e.length,this[y].write(e)),this[y].end()):(this[Oe]=!0,(this.brotli===void 0||this.zstd===void 0)&&(e=e||Buffer.alloc(0)),e&&this.write(e),this[ui]())),this}};pi.Parser=Hs});var yi=d(wi=>{"use strict";Object.defineProperty(wi,"__esModule",{value:!0});wi.stripTrailingSlashes=void 0;var Ga=s=>{let e=s.length-1,t=-1;for(;e>-1&&s.charAt(e)==="/";)t=e,e--;return t===-1?s:s.slice(0,t)};wi.stripTrailingSlashes=Ga});var rt=d(B=>{"use strict";var Za=B&&B.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Ya=B&&B.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Ka=B&&B.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Za(t,e,i[r]);return Ya(t,e),t}})(),Va=B&&B.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(B,"__esModule",{value:!0});B.list=B.filesFilter=void 0;var $a=Ka(Ke()),st=Va(require("node:fs")),on=require("path"),Xa=Ve(),Ei=_i(),Gs=yi(),Qa=s=>{let e=s.onReadEntry;s.onReadEntry=e?t=>{e(t),t.resume()}:t=>t.resume()},Ja=(s,e)=>{let t=new Map(e.map(o=>[(0,Gs.stripTrailingSlashes)(o),!0])),i=s.filter,r=100,n=(o,a="",h=0)=>{if(h>=r)return t.set(o,!1),!1;let l=a||(0,on.parse)(o).root||".",c;if(o===l)c=!1;else{let u=t.get(o);c=u!==void 0?u:n((0,on.dirname)(o),l,h+1)}return t.set(o,c),c};s.filter=i?(o,a)=>i(o,a)&&n((0,Gs.stripTrailingSlashes)(o)):o=>n((0,Gs.stripTrailingSlashes)(o))};B.filesFilter=Ja;var eh=s=>{let e=new Ei.Parser(s),t=s.file,i;try{i=st.default.openSync(t,"r");let r=st.default.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),a=st.default.readSync(i,o,0,r.size,0);e.end(a===o.byteLength?o:o.subarray(0,a))}else{let o=0,a=Buffer.allocUnsafe(n);for(;o<r.size;){let h=st.default.readSync(i,a,0,n,o);if(h===0)break;o+=h,e.write(a.subarray(0,h))}e.end()}}finally{if(typeof i=="number")try{st.default.closeSync(i)}catch{}}},th=(s,e)=>{let t=new Ei.Parser(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("end",o),st.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new $a.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};B.list=(0,Xa.makeCommand)(eh,th,s=>new Ei.Parser(s),s=>new Ei.Parser(s),(s,e)=>{e?.length&&(0,B.filesFilter)(s,e),s.noResume||Qa(s)})});var an=d(bi=>{"use strict";Object.defineProperty(bi,"__esModule",{value:!0});bi.modeFix=void 0;var ih=(s,e,t)=>(s&=4095,t&&(s=(s|384)&-19),e&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);bi.modeFix=ih});var Zs=d(Si=>{"use strict";Object.defineProperty(Si,"__esModule",{value:!0});Si.stripAbsolutePath=void 0;var sh=require("node:path"),{isAbsolute:rh,parse:hn}=sh.win32,nh=s=>{let e="",t=hn(s);for(;rh(s)||t.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":t.root;s=s.slice(i.length),e+=i,t=hn(s)}return[e,s]};Si.stripAbsolutePath=nh});var Ks=d(nt=>{"use strict";Object.defineProperty(nt,"__esModule",{value:!0});nt.decode=nt.encode=void 0;var gi=["|","<",">","?",":"],Ys=gi.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),oh=new Map(gi.map((s,e)=>[s,Ys[e]])),ah=new Map(Ys.map((s,e)=>[s,gi[e]])),hh=s=>gi.reduce((e,t)=>e.split(t).join(oh.get(t)),s);nt.encode=hh;var lh=s=>Ys.reduce((e,t)=>e.split(t).join(ah.get(t)),s);nt.decode=lh});var nr=d(M=>{"use strict";var ch=M&&M.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),uh=M&&M.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fh=M&&M.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ch(t,e,i[r]);return uh(t,e),t}})(),mn=M&&M.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(M,"__esModule",{value:!0});M.WriteEntryTar=M.WriteEntrySync=M.WriteEntry=void 0;var ae=mn(require("fs")),pn=We(),ln=mn(require("path")),_n=et(),wn=an(),oe=tt(),yn=Qt(),En=si(),bn=Zs(),dh=yi(),Sn=hi(),mh=fh(Ks()),gn=(s,e)=>e?(s=(0,oe.normalizeWindowsPath)(s).replace(/^\.(\/|$)/,""),(0,dh.stripTrailingSlashes)(e)+"/"+s):(0,oe.normalizeWindowsPath)(s),ph=16*1024*1024,cn=Symbol("process"),un=Symbol("file"),fn=Symbol("directory"),$s=Symbol("symlink"),dn=Symbol("hardlink"),vt=Symbol("header"),Ri=Symbol("read"),Xs=Symbol("lstat"),Oi=Symbol("onlstat"),Qs=Symbol("onread"),Js=Symbol("onreadlink"),er=Symbol("openfile"),tr=Symbol("onopenfile"),ve=Symbol("close"),vi=Symbol("mode"),ir=Symbol("awaitDrain"),Vs=Symbol("ondrain"),he=Symbol("prefix"),Ti=class extends pn.Minipass{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#e=!1;constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.path=(0,oe.normalizeWindowsPath)(e),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||ph,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=(0,oe.normalizeWindowsPath)(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?(0,oe.normalizeWindowsPath)(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,a]=(0,bn.stripAbsolutePath)(this.path);o&&typeof a=="string"&&(this.path=a,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=mh.decode(this.path.replaceAll(/\\/g,"/")),e=e.replaceAll(/\\/g,"/")),this.absolute=(0,oe.normalizeWindowsPath)(i.absolute||ln.default.resolve(this.cwd,e)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[Oi](n):this[Xs]()}warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}emit(e,...t){return e==="error"&&(this.#e=!0),super.emit(e,...t)}[Xs](){ae.default.lstat(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Oi](t)})}[Oi](e){this.statCache.set(this.absolute,e),this.stat=e,e.isFile()||(e.size=0),this.type=_h(e),this.emit("stat",e),this[cn]()}[cn](){switch(this.type){case"File":return this[un]();case"Directory":return this[fn]();case"SymbolicLink":return this[$s]();default:return this.end()}}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}[he](e){return gn(e,this.prefix)}[vt](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this[vi](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let e=this.header?.block;if(!e)throw new Error("failed to encode header");super.write(e)}[fn](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[vt](),this.end()}[$s](){ae.default.readlink(this.absolute,(e,t)=>{if(e)return this.emit("error",e);this[Js](t)})}[Js](e){this.linkpath=(0,oe.normalizeWindowsPath)(e),this[vt](),this.end()}[dn](e){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=(0,oe.normalizeWindowsPath)(ln.default.relative(this.cwd,e)),this.stat.size=0,this[vt](),this.end()}[un](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let e=`${this.stat.dev}:${this.stat.ino}`,t=this.linkCache.get(e);if(t?.indexOf(this.cwd)===0)return this[dn](t);this.linkCache.set(e,this.absolute)}if(this[vt](),this.stat.size===0)return this.end();this[er]()}[er](){ae.default.open(this.absolute,"r",(e,t)=>{if(e)return this.emit("error",e);this[tr](t)})}[tr](e){if(this.fd=e,this.#e)return this[ve]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let t=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(t),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[Ri]()}[Ri](){let{fd:e,buf:t,offset:i,length:r,pos:n}=this;if(e===void 0||t===void 0)throw new Error("cannot read file without first opening");ae.default.read(e,t,i,r,n,(o,a)=>{if(o)return this[ve](()=>this.emit("error",o));this[Qs](a)})}[ve](e=()=>{}){this.fd!==void 0&&ae.default.close(this.fd,e)}[Qs](e){if(e<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(e>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[ve](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(e===this.remain)for(let r=e;r<this.length&&e<this.blockRemain;r++)this.buf[r+this.offset]=0,e++,this.remain++;let t=this.offset===0&&e===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+e);this.write(t)?this[Vs]():this[ir](()=>this[Vs]())}[ir](e){this.once("drain",e)}write(e,t,i){if(typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8")),this.blockRemain<e.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=e.length,this.blockRemain-=e.length,this.pos+=e.length,this.offset+=e.length,super.write(e,null,i)}[Vs](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[ve](e=>e?this.emit("error",e):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[Ri]()}};M.WriteEntry=Ti;var sr=class extends Ti{sync=!0;[Xs](){this[Oi](ae.default.lstatSync(this.absolute))}[$s](){this[Js](ae.default.readlinkSync(this.absolute))}[er](){this[tr](ae.default.openSync(this.absolute,"r"))}[Ri](){let e=!0;try{let{fd:t,buf:i,offset:r,length:n,pos:o}=this;if(t===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let a=ae.default.readSync(t,i,r,n,o);this[Qs](a),e=!1}finally{if(e)try{this[ve](()=>{})}catch{}}}[ir](e){e()}[ve](e=()=>{}){this.fd!==void 0&&ae.default.closeSync(this.fd),e()}};M.WriteEntrySync=sr;var rr=class extends pn.Minipass{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(e,t,i={}){return(0,Sn.warnMethod)(this,e,t,i)}constructor(e,t={}){let i=(0,yn.dealias)(t);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=e;let{type:r}=e;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=(0,oe.normalizeWindowsPath)(e.path),this.mode=e.mode!==void 0?this[vi](e.mode):void 0,this.uid=this.portable?void 0:e.uid,this.gid=this.portable?void 0:e.gid,this.uname=this.portable?void 0:e.uname,this.gname=this.portable?void 0:e.gname,this.size=e.size,this.mtime=this.noMtime?void 0:i.mtime||e.mtime,this.atime=this.portable?void 0:e.atime,this.ctime=this.portable?void 0:e.ctime,this.linkpath=e.linkpath!==void 0?(0,oe.normalizeWindowsPath)(e.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[a,h]=(0,bn.stripAbsolutePath)(this.path);a&&typeof h=="string"&&(this.path=h,n=a)}this.remain=e.size,this.blockRemain=e.startBlockSize,this.onWriteEntry?.(this),this.header=new _n.Header({path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new En.Pax({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[he](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[he](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),e.pipe(this)}[he](e){return gn(e,this.prefix)}[vi](e){return(0,wn.modeFix)(e,this.type==="Directory",this.portable)}write(e,t,i){typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,typeof t=="string"?t:"utf8"));let r=e.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(e,i)}end(e,t,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof e=="function"&&(i=e,t=void 0,e=void 0),typeof t=="function"&&(i=t,t=void 0),typeof e=="string"&&(e=Buffer.from(e,t??"utf8")),i&&this.once("finish",i),e?super.end(e,i):super.end(i),this}};M.WriteEntryTar=rr;var _h=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported"});var Rn=d(at=>{"use strict";Object.defineProperty(at,"__esModule",{value:!0});at.Node=at.Yallist=void 0;var or=class s{tail;head;length=0;static create(e=[]){return new s(e)}constructor(e=[]){for(let t of e)this.push(t)}*[Symbol.iterator](){for(let e=this.head;e;e=e.next)yield e.value}removeNode(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");let t=e.next,i=e.prev;return t&&(t.prev=i),i&&(i.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=i),this.length--,e.next=void 0,e.prev=void 0,e.list=void 0,t}unshiftNode(e){if(e===this.head)return;e.list&&e.list.removeNode(e);let t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}pushNode(e){if(e===this.tail)return;e.list&&e.list.removeNode(e);let t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}push(...e){for(let t=0,i=e.length;t<i;t++)yh(this,e[t]);return this.length}unshift(...e){for(var t=0,i=e.length;t<i;t++)Eh(this,e[t]);return this.length}pop(){if(!this.tail)return;let e=this.tail.value,t=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,t.list=void 0,this.length--,e}shift(){if(!this.head)return;let e=this.head.value,t=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,t.list=void 0,this.length--,e}forEach(e,t){t=t||this;for(let i=this.head,r=0;i;r++)e.call(t,i.value,r,this),i=i.next}forEachReverse(e,t){t=t||this;for(let i=this.tail,r=this.length-1;i;r--)e.call(t,i.value,r,this),i=i.prev}get(e){let t=0,i=this.head;for(;i&&t<e;t++)i=i.next;if(t===e&&i)return i.value}getReverse(e){let t=0,i=this.tail;for(;i&&t<e;t++)i=i.prev;if(t===e&&i)return i.value}map(e,t){t=t||this;let i=new s;for(let r=this.head;r;)i.push(e.call(t,r.value,this)),r=r.next;return i}mapReverse(e,t){t=t||this;var i=new s;for(let r=this.tail;r;)i.push(e.call(t,r.value,this)),r=r.prev;return i}reduce(e,t){let i,r=this.head;if(arguments.length>1)i=t;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=e(i,r.value,n),r=r.next;return i}reduceReverse(e,t){let i,r=this.tail;if(arguments.length>1)i=t;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=e(i,r.value,n),r=r.prev;return i}toArray(){let e=new Array(this.length);for(let t=0,i=this.head;i;t++)e[t]=i.value,i=i.next;return e}toArrayReverse(){let e=new Array(this.length);for(let t=0,i=this.tail;i;t++)e[t]=i.value,i=i.prev;return e}slice(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.head,n=0;for(n=0;r&&n<e;n++)r=r.next;for(;r&&n<t;n++,r=r.next)i.push(r.value);return i}sliceReverse(e=0,t=this.length){t<0&&(t+=this.length),e<0&&(e+=this.length);let i=new s;if(t<e||t<0)return i;e<0&&(e=0),t>this.length&&(t=this.length);let r=this.length,n=this.tail;for(;n&&r>t;r--)n=n.prev;for(;n&&r>e;r--,n=n.prev)i.push(n.value);return i}splice(e,t=0,...i){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);let r=this.head;for(let o=0;r&&o<e;o++)r=r.next;let n=[];for(let o=0;r&&o<t;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=wh(this,r,o);return n}reverse(){let e=this.head,t=this.tail;for(let i=e;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=t,this.tail=e,this}};at.Yallist=or;function wh(s,e,t){let i=e,r=e?e.next:s.head,n=new ot(t,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function yh(s,e){s.tail=new ot(e,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Eh(s,e){s.head=new ot(e,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ot=class{list;next;prev;value;constructor(e,t,i,r){this.list=r,this.value=e,t?(t.next=this,this.prev=t):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};at.Node=ot});var Ci=d(L=>{"use strict";var bh=L&&L.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Sh=L&&L.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),gh=L&&L.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&bh(t,e,i[r]);return Sh(t,e),t}})(),Pn=L&&L.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(L,"__esModule",{value:!0});L.PackSync=L.Pack=L.PackJob=void 0;var Ii=Pn(require("fs")),fr=nr(),Nt=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(e,t){this.path=e||"./",this.absolute=t}};L.PackJob=Nt;var Rh=We(),ar=gh(Ps()),Oh=Rn(),vh=hi(),On=Buffer.alloc(1024),Pi=Symbol("onStat"),Tt=Symbol("ended"),X=Symbol("queue"),Dt=Symbol("pendingLinks"),Te=Symbol("current"),je=Symbol("process"),Pt=Symbol("processing"),Di=Symbol("processJob"),Q=Symbol("jobs"),hr=Symbol("jobDone"),Ni=Symbol("addFSEntry"),vn=Symbol("addTarEntry"),dr=Symbol("stat"),mr=Symbol("readdir"),Mi=Symbol("onreaddir"),Li=Symbol("pipe"),Tn=Symbol("entry"),lr=Symbol("entryOpt"),Ai=Symbol("writeEntryClass"),Nn=Symbol("write"),cr=Symbol("ondrain"),Dn=Pn(require("path")),ur=tt(),Fi=class extends Rh.Minipass{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[Ai];onWriteEntry;[X];[Dt]=new Map;[Q]=0;[Pt]=!1;[Tt]=!1;constructor(e={}){if(super(),this.opt=e,this.file=e.file||"",this.cwd=e.cwd||process.cwd(),this.maxReadSize=e.maxReadSize,this.preservePaths=!!e.preservePaths,this.strict=!!e.strict,this.noPax=!!e.noPax,this.prefix=(0,ur.normalizeWindowsPath)(e.prefix||""),this.linkCache=e.linkCache||new Map,this.statCache=e.statCache||new Map,this.readdirCache=e.readdirCache||new Map,this.onWriteEntry=e.onWriteEntry,this[Ai]=fr.WriteEntry,typeof e.onwarn=="function"&&this.on("warn",e.onwarn),this.portable=!!e.portable,e.gzip||e.brotli||e.zstd){if((e.gzip?1:0)+(e.brotli?1:0)+(e.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(e.gzip&&(typeof e.gzip!="object"&&(e.gzip={}),this.portable&&(e.gzip.portable=!0),this.zip=new ar.Gzip(e.gzip)),e.brotli&&(typeof e.brotli!="object"&&(e.brotli={}),this.zip=new ar.BrotliCompress(e.brotli)),e.zstd&&(typeof e.zstd!="object"&&(e.zstd={}),this.zip=new ar.ZstdCompress(e.zstd)),!this.zip)throw new Error("impossible");let t=this.zip;t.on("data",i=>super.write(i)),t.on("end",()=>super.end()),t.on("drain",()=>this[cr]()),this.on("resume",()=>t.resume())}else this.on("drain",this[cr]);this.noDirRecurse=!!e.noDirRecurse,this.follow=!!e.follow,this.noMtime=!!e.noMtime,e.mtime&&(this.mtime=e.mtime),this.filter=typeof e.filter=="function"?e.filter:()=>!0,this[X]=new Oh.Yallist,this[Q]=0,this.jobs=Number(e.jobs)||4,this[Pt]=!1,this[Tt]=!1}[Nn](e){return super.write(e)}add(e){return this.write(e),this}end(e,t,i){return typeof e=="function"&&(i=e,e=void 0),typeof t=="function"&&(i=t,t=void 0),e&&this.add(e),this[Tt]=!0,this[je](),i&&i(),this}write(e){if(this[Tt])throw new Error("write after end");return typeof e=="string"?this[Ni](e):this[vn](e),this.flowing}[vn](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e.path));if(!this.filter(e.path,e))e.resume();else{let i=new Nt(e.path,t);i.entry=new fr.WriteEntryTar(e,this[lr](i)),i.entry.on("end",()=>this[hr](i)),this[Q]+=1,this[X].push(i)}this[je]()}[Ni](e){let t=(0,ur.normalizeWindowsPath)(Dn.default.resolve(this.cwd,e));this[X].push(new Nt(e,t)),this[je]()}[dr](e){e.pending=!0,this[Q]+=1;let t=this.follow?"stat":"lstat";Ii.default[t](e.absolute,(i,r)=>{e.pending=!1,this[Q]-=1,i?this.emit("error",i):this[Pi](e,r)})}[Pi](e,t){if(this.statCache.set(e.absolute,t),e.stat=t,!this.filter(e.path,t))e.ignore=!0;else if(t.isFile()&&t.nlink>1&&!this.linkCache.get(`${t.dev}:${t.ino}`)&&!this.sync)if(e===this[Te])this[Di](e);else{let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);r?r.push(e):this[Dt].set(i,[e]),e.pendingLink=!0,e.pending=!0}this[je]()}[mr](e){e.pending=!0,this[Q]+=1,Ii.default.readdir(e.absolute,(t,i)=>{if(e.pending=!1,this[Q]-=1,t)return this.emit("error",t);this[Mi](e,i)})}[Mi](e,t){this.readdirCache.set(e.absolute,t),e.readdir=t,this[je]()}[je](){if(!this[Pt]){this[Pt]=!0;for(let e=this[X].head;e&&this[Q]<this.jobs;e=e.next)if(this[Di](e.value),e.value.ignore){let t=e.next;this[X].removeNode(e),e.next=t}this[Pt]=!1,this[Tt]&&this[X].length===0&&this[Q]===0&&(this.zip?this.zip.end(On):(super.write(On),super.end()))}}get[Te](){return this[X]&&this[X].head&&this[X].head.value}[hr](e){this[X].shift(),this[Q]-=1;let{stat:t}=e;if(t&&t.isFile()&&t.nlink>1){let i=`${t.dev}:${t.ino}`,r=this[Dt].get(i);if(r){this[Dt].delete(i);for(let n of r)n.pending=!1,this[Di](n)}}this[je]()}[Di](e){if(e.pending&&e.pendingLink&&e===this[Te]&&(e.pending=!1,e.pendingLink=!1),!e.pending){if(e.entry){e===this[Te]&&!e.piped&&this[Li](e);return}if(!e.stat){let t=this.statCache.get(e.absolute);t?this[Pi](e,t):this[dr](e)}if(e.stat&&!e.ignore){if(!this.noDirRecurse&&e.stat.isDirectory()&&!e.readdir){let t=this.readdirCache.get(e.absolute);if(t?this[Mi](e,t):this[mr](e),!e.readdir)return}if(e.entry=this[Tn](e),!e.entry){e.ignore=!0;return}e===this[Te]&&!e.piped&&this[Li](e)}}}[lr](e){return{onwarn:(t,i,r)=>this.warn(t,i,r),noPax:this.noPax,cwd:this.cwd,absolute:e.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[Tn](e){this[Q]+=1;try{return new this[Ai](e.path,this[lr](e)).on("end",()=>this[hr](e)).on("error",i=>this.emit("error",i))}catch(t){this.emit("error",t)}}[cr](){this[Te]&&this[Te].entry&&this[Te].entry.resume()}[Li](e){e.piped=!0,e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)});let t=e.entry,i=this.zip;if(!t)throw new Error("cannot pipe without source");i?t.on("data",r=>{i.write(r)||t.pause()}):t.on("data",r=>{super.write(r)||t.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(e,t,i={}){(0,vh.warnMethod)(this,e,t,i)}};L.Pack=Fi;var pr=class extends Fi{sync=!0;constructor(e){super(e),this[Ai]=fr.WriteEntrySync}pause(){}resume(){}[dr](e){let t=this.follow?"statSync":"lstatSync";this[Pi](e,Ii.default[t](e.absolute))}[mr](e){this[Mi](e,Ii.default.readdirSync(e.absolute))}[Li](e){let t=e.entry,i=this.zip;if(e.readdir&&e.readdir.forEach(r=>{let n=e.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[Ni](o+r)}),!t)throw new Error("Cannot pipe without source");i?t.on("data",r=>{i.write(r)}):t.on("data",r=>{super[Nn](r)})}};L.PackSync=pr});var _r=d(ht=>{"use strict";var Th=ht&&ht.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ht,"__esModule",{value:!0});ht.create=void 0;var Mn=Ke(),Ln=Th(require("node:path")),An=rt(),Dh=Ve(),Bi=Ci(),Ph=(s,e)=>{let t=new Bi.PackSync(s),i=new Mn.WriteStreamSync(s.file,{mode:s.mode||438});t.pipe(i),In(t,e)},Nh=(s,e)=>{let t=new Bi.Pack(s),i=new Mn.WriteStream(s.file,{mode:s.mode||438});t.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),t.on("error",o)});return Fn(t,e).catch(n=>t.emit("error",n)),r},In=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,An.list)({file:Ln.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},Fn=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,An.list)({file:Ln.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(t);s.end()},Mh=(s,e)=>{let t=new Bi.PackSync(s);return In(t,e),t},Lh=(s,e)=>{let t=new Bi.Pack(s);return Fn(t,e).catch(i=>t.emit("error",i)),t};ht.create=(0,Dh.makeCommand)(Ph,Nh,Mh,Lh,(s,e)=>{if(!e?.length)throw new TypeError("no paths specified to add to archive")})});var Wn=d(lt=>{"use strict";var Ah=lt&&lt.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(lt,"__esModule",{value:!0});lt.getWriteFlag=void 0;var zn=Ah(require("fs")),Ih=process.env.__FAKE_PLATFORM__||process.platform,kn=Ih==="win32",{O_CREAT:xn,O_NOFOLLOW:Cn,O_TRUNC:jn,O_WRONLY:Un}=zn.default.constants,qn=Number(process.env.__FAKE_FS_O_FILENAME__)||zn.default.constants.UV_FS_O_FILEMAP||0,Fh=kn&&!!qn,Ch=512*1024,Bh=qn|jn|xn|Un,Bn=!kn&&typeof Cn=="number"?Cn|jn|xn|Un:null;lt.getWriteFlag=Bn!==null?()=>Bn:Fh?s=>s<Ch?Bh:"w":()=>"w"});var Gn=d(le=>{"use strict";var Hn=le&&le.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(le,"__esModule",{value:!0});le.chownrSync=le.chownr=void 0;var ki=Hn(require("node:fs")),Mt=Hn(require("node:path")),wr=(s,e,t)=>{try{return ki.default.lchownSync(s,e,t)}catch(i){if(i?.code!=="ENOENT")throw i}},zi=(s,e,t,i)=>{ki.default.lchown(s,e,t,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},zh=(s,e,t,i,r)=>{if(e.isDirectory())(0,le.chownr)(Mt.default.resolve(s,e.name),t,i,n=>{if(n)return r(n);let o=Mt.default.resolve(s,e.name);zi(o,t,i,r)});else{let n=Mt.default.resolve(s,e.name);zi(n,t,i,r)}},kh=(s,e,t,i)=>{ki.default.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return zi(s,e,t,i);let o=n.length,a=null,h=l=>{if(!a){if(l)return i(a=l);if(--o===0)return zi(s,e,t,i)}};for(let l of n)zh(s,l,e,t,h)})};le.chownr=kh;var xh=(s,e,t,i)=>{e.isDirectory()&&(0,le.chownrSync)(Mt.default.resolve(s,e.name),t,i),wr(Mt.default.resolve(s,e.name),t,i)},jh=(s,e,t)=>{let i;try{i=ki.default.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return wr(s,e,t);throw n}for(let r of i)xh(s,r,e,t);return wr(s,e,t)};le.chownrSync=jh});var Zn=d(xi=>{"use strict";Object.defineProperty(xi,"__esModule",{value:!0});xi.CwdError=void 0;var yr=class extends Error{path;code;syscall="chdir";constructor(e,t){super(`${t}: Cannot cd into '${e}'`),this.path=e,this.code=t}get name(){return"CwdError"}};xi.CwdError=yr});var br=d(ji=>{"use strict";Object.defineProperty(ji,"__esModule",{value:!0});ji.SymlinkError=void 0;var Er=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(e,t){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=e,this.path=t}get name(){return"SymlinkError"}};ji.SymlinkError=Er});var Xn=d(De=>{"use strict";var gr=De&&De.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(De,"__esModule",{value:!0});De.mkdirSync=De.mkdir=void 0;var Yn=Gn(),j=gr(require("node:fs")),Uh=gr(require("node:fs/promises")),Ui=gr(require("node:path")),Kn=Zn(),_e=tt(),Vn=br(),qh=(s,e)=>{j.default.stat(s,(t,i)=>{(t||!i.isDirectory())&&(t=new Kn.CwdError(s,t?.code||"ENOTDIR")),e(t)})},Wh=(s,e,t)=>{s=(0,_e.normalizeWindowsPath)(s);let i=e.umask??18,r=e.mode|448,n=(r&i)!==0,o=e.uid,a=e.gid,h=typeof o=="number"&&typeof a=="number"&&(o!==e.processUid||a!==e.processGid),l=e.preserve,c=e.unlink,u=(0,_e.normalizeWindowsPath)(e.cwd),b=(w,P)=>{w?t(w):P&&h?(0,Yn.chownr)(P,o,a,xt=>b(xt)):n?j.default.chmod(s,r,t):t()};if(s===u)return qh(s,b);if(l)return Uh.default.mkdir(s,{mode:r,recursive:!0}).then(w=>b(null,w??void 0),b);let A=(0,_e.normalizeWindowsPath)(Ui.default.relative(u,s)).split("/");Sr(u,A,r,c,u,void 0,b)};De.mkdir=Wh;var Sr=(s,e,t,i,r,n,o)=>{if(e.length===0)return o(null,n);let a=e.shift(),h=(0,_e.normalizeWindowsPath)(Ui.default.resolve(s+"/"+a));j.default.mkdir(h,t,$n(h,e,t,i,r,n,o))},$n=(s,e,t,i,r,n,o)=>a=>{a?j.default.lstat(s,(h,l)=>{if(h)h.path=h.path&&(0,_e.normalizeWindowsPath)(h.path),o(h);else if(l.isDirectory())Sr(s,e,t,i,r,n,o);else if(i)j.default.unlink(s,c=>{if(c)return o(c);j.default.mkdir(s,t,$n(s,e,t,i,r,n,o))});else{if(l.isSymbolicLink())return o(new Vn.SymlinkError(s,s+"/"+e.join("/")));o(a)}}):(n=n||s,Sr(s,e,t,i,r,n,o))},Hh=s=>{let e=!1,t;try{e=j.default.statSync(s).isDirectory()}catch(i){t=i?.code}finally{if(!e)throw new Kn.CwdError(s,t??"ENOTDIR")}},Gh=(s,e)=>{s=(0,_e.normalizeWindowsPath)(s);let t=e.umask??18,i=e.mode|448,r=(i&t)!==0,n=e.uid,o=e.gid,a=typeof n=="number"&&typeof o=="number"&&(n!==e.processUid||o!==e.processGid),h=e.preserve,l=e.unlink,c=(0,_e.normalizeWindowsPath)(e.cwd),u=w=>{w&&a&&(0,Yn.chownrSync)(w,n,o),r&&j.default.chmodSync(s,i)};if(s===c)return Hh(c),u();if(h)return u(j.default.mkdirSync(s,{mode:i,recursive:!0})??void 0);let D=(0,_e.normalizeWindowsPath)(Ui.default.relative(c,s)).split("/"),A;for(let w=D.shift(),P=c;w&&(P+="/"+w);w=D.shift()){P=(0,_e.normalizeWindowsPath)(Ui.default.resolve(P));try{j.default.mkdirSync(P,i),A=A||P}catch{let xt=j.default.lstatSync(P);if(xt.isDirectory())continue;if(l){j.default.unlinkSync(P),j.default.mkdirSync(P,i),A=A||P;continue}else if(xt.isSymbolicLink())return new Vn.SymlinkError(P,P+"/"+D.join("/"))}}return u(A)};De.mkdirSync=Gh});var Jn=d(qi=>{"use strict";Object.defineProperty(qi,"__esModule",{value:!0});qi.normalizeUnicode=void 0;var Rr=Object.create(null),Qn=1e4,ct=new Set,Zh=s=>{ct.has(s)?ct.delete(s):Rr[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),ct.add(s);let e=Rr[s],t=ct.size-Qn;if(t>Qn/10){for(let i of ct)if(ct.delete(i),delete Rr[i],--t<=0)break}return e};qi.normalizeUnicode=Zh});var to=d(Wi=>{"use strict";Object.defineProperty(Wi,"__esModule",{value:!0});Wi.PathReservations=void 0;var eo=require("node:path"),Yh=Jn(),Kh=yi(),Vh=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,$h=Vh==="win32",Xh=s=>s.split("/").slice(0,-1).reduce((t,i)=>{let r=t.at(-1);return r!==void 0&&(i=(0,eo.join)(r,i)),t.push(i||"/"),t},[]),Or=class{#e=new Map;#i=new Map;#s=new Set;reserve(e,t){e=$h?["win32 parallelization disabled"]:e.map(r=>(0,Kh.stripTrailingSlashes)((0,eo.join)((0,Yh.normalizeUnicode)(r))));let i=new Set(e.map(r=>Xh(r)).reduce((r,n)=>r.concat(n)));this.#i.set(t,{dirs:i,paths:e});for(let r of e){let n=this.#e.get(r);n?n.push(t):this.#e.set(r,[t])}for(let r of i){let n=this.#e.get(r);if(!n)this.#e.set(r,[new Set([t])]);else{let o=n.at(-1);o instanceof Set?o.add(t):n.push(new Set([t]))}}return this.#r(t)}#n(e){let t=this.#i.get(e);if(!t)throw new Error("function does not have any path reservations");return{paths:t.paths.map(i=>this.#e.get(i)),dirs:[...t.dirs].map(i=>this.#e.get(i))}}check(e){let{paths:t,dirs:i}=this.#n(e);return t.every(r=>r&&r[0]===e)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(e))}#r(e){return this.#s.has(e)||!this.check(e)?!1:(this.#s.add(e),e(()=>this.#t(e)),!0)}#t(e){if(!this.#s.has(e))return!1;let t=this.#i.get(e);if(!t)throw new Error("invalid reservation");let{paths:i,dirs:r}=t,n=new Set;for(let o of i){let a=this.#e.get(o);if(!a||a?.[0]!==e)continue;let h=a[1];if(!h){this.#e.delete(o);continue}if(a.shift(),typeof h=="function")n.add(h);else for(let l of h)n.add(l)}for(let o of r){let a=this.#e.get(o),h=a?.[0];if(!(!a||!(h instanceof Set)))if(h.size===1&&a.length===1){this.#e.delete(o);continue}else if(h.size===1){a.shift();let l=a[0];typeof l=="function"&&n.add(l)}else h.delete(e)}return this.#s.delete(e),n.forEach(o=>this.#r(o)),!0}};Wi.PathReservations=Or});var io=d(Hi=>{"use strict";Object.defineProperty(Hi,"__esModule",{value:!0});Hi.umask=void 0;var Qh=()=>process.umask();Hi.umask=Qh});var Cr=d(k=>{"use strict";var Jh=k&&k.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),el=k&&k.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),fo=k&&k.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&Jh(t,e,i[r]);return el(t,e),t}})(),Fr=k&&k.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(k,"__esModule",{value:!0});k.UnpackSync=k.Unpack=void 0;var tl=fo(Ke()),il=Fr(require("node:assert")),mo=require("node:crypto"),m=Fr(require("node:fs")),g=Fr(require("node:path")),po=Wn(),_o=Xn(),U=tt(),sl=_i(),rl=Zs(),so=fo(Ks()),nl=to(),wo=br(),ol=io(),ro=Symbol("onEntry"),Pr=Symbol("checkFs"),no=Symbol("checkFs2"),Nr=Symbol("isReusable"),G=Symbol("makeFs"),Mr=Symbol("file"),Lr=Symbol("directory"),Zi=Symbol("link"),oo=Symbol("symlink"),ao=Symbol("hardlink"),At=Symbol("ensureNoSymlink"),ho=Symbol("unsupported"),lo=Symbol("checkPath"),vr=Symbol("stripAbsolutePath"),Pe=Symbol("mkdir"),T=Symbol("onError"),Gi=Symbol("pending"),co=Symbol("pend"),ut=Symbol("unpend"),Tr=Symbol("ended"),Dr=Symbol("maybeClose"),Ar=Symbol("skip"),It=Symbol("doChown"),Ft=Symbol("uid"),Ct=Symbol("gid"),Bt=Symbol("checkedCwd"),al=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,zt=al==="win32",hl=1024,ll=(s,e)=>{if(!zt)return m.default.unlink(s,e);let t=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.rename(s,t,i=>{if(i)return e(i);m.default.unlink(t,e)})},cl=s=>{if(!zt)return m.default.unlinkSync(s);let e=s+".DELETE."+(0,mo.randomBytes)(16).toString("hex");m.default.renameSync(s,e),m.default.unlinkSync(e)},uo=(s,e,t)=>s!==void 0&&s===s>>>0?s:e!==void 0&&e===e>>>0?e:t,Yi=class extends sl.Parser{[Tr]=!1;[Bt]=!1;[Gi]=0;reservations=new nl.PathReservations;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(e={}){if(e.ondone=()=>{this[Tr]=!0,this[Dr]()},super(e),this.transform=e.transform,this.chmod=!!e.chmod,typeof e.uid=="number"||typeof e.gid=="number"){if(typeof e.uid!="number"||typeof e.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(e.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=e.uid,this.gid=e.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=e.preserveOwner===void 0&&typeof e.uid!="number"?process.getuid?.()===0:!!e.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof e.maxDepth=="number"?e.maxDepth:hl,this.forceChown=e.forceChown===!0,this.win32=!!e.win32||zt,this.newer=!!e.newer,this.keep=!!e.keep,this.noMtime=!!e.noMtime,this.preservePaths=!!e.preservePaths,this.unlink=!!e.unlink,this.cwd=(0,U.normalizeWindowsPath)(g.default.resolve(e.cwd||process.cwd())),this.strip=Number(e.strip)||0,this.processUmask=this.chmod?typeof e.processUmask=="number"?e.processUmask:(0,ol.umask)():0,this.umask=typeof e.umask=="number"?e.umask:this.processUmask,this.dmode=e.dmode||511&~this.umask,this.fmode=e.fmode||438&~this.umask,this.on("entry",t=>this[ro](t))}warn(e,t,i={}){return(e==="TAR_BAD_ARCHIVE"||e==="TAR_ABORT")&&(i.recoverable=!1),super.warn(e,t,i)}[Dr](){this[Tr]&&this[Gi]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[vr](e,t){let i=e[t],{type:r}=e;if(!i||this.preservePaths)return!0;let[n,o]=(0,rl.stripAbsolutePath)(i),a=o.replaceAll(/\\/g,"/").split("/");if(a.includes("..")||zt&&/^[a-z]:\.\.$/i.test(a[0]??"")){if(t==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${t} contains '..'`,{entry:e,[t]:i}),!1;let h=g.default.posix.dirname(e.path),l=g.default.posix.normalize(g.default.posix.join(h,a.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${t} escapes extraction directory`,{entry:e,[t]:i}),!1}return n&&(e[t]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${t}`,{entry:e,[t]:i})),!0}[lo](e){let t=(0,U.normalizeWindowsPath)(e.path),i=t.split("/");if(this.strip){if(i.length<this.strip)return!1;if(e.type==="Link"){let r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");if(r.length>=this.strip)e.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),e.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:e,path:t,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[vr](e,"path")||!this[vr](e,"linkpath"))return!1;if(e.absolute=g.default.isAbsolute(e.path)?(0,U.normalizeWindowsPath)(g.default.resolve(e.path)):(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,e.path)),!this.preservePaths&&typeof e.absolute=="string"&&e.absolute.indexOf(this.cwd+"/")!==0&&e.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:e,path:(0,U.normalizeWindowsPath)(e.path),resolvedPath:e.absolute,cwd:this.cwd}),!1;if(e.absolute===this.cwd&&e.type!=="Directory"&&e.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=g.default.win32.parse(String(e.absolute));e.absolute=r+so.encode(String(e.absolute).slice(r.length));let{root:n}=g.default.win32.parse(e.path);e.path=n+so.encode(e.path.slice(n.length))}return!0}[ro](e){if(!this[lo](e))return e.resume();switch(il.default.equal(typeof e.absolute,"string"),e.type){case"Directory":case"GNUDumpDir":e.mode&&(e.mode=e.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[Pr](e);default:return this[ho](e)}}[T](e,t){e.name==="CwdError"?this.emit("error",e):(this.warn("TAR_ENTRY_ERROR",e,{entry:t}),this[ut](),t.resume())}[Pe](e,t,i){(0,_o.mkdir)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t},i)}[It](e){return this.forceChown||this.preserveOwner&&(typeof e.uid=="number"&&e.uid!==this.processUid||typeof e.gid=="number"&&e.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[Ft](e){return uo(this.uid,e.uid,this.processUid)}[Ct](e){return uo(this.gid,e.gid,this.processGid)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=new tl.WriteStream(String(e.absolute),{flags:(0,po.getWriteFlag)(e.size),mode:i,autoClose:!1});r.on("error",h=>{r.fd&&m.default.close(r.fd,()=>{}),r.write=()=>!0,this[T](h,e),t()});let n=1,o=h=>{if(h){r.fd&&m.default.close(r.fd,()=>{}),this[T](h,e),t();return}--n===0&&r.fd!==void 0&&m.default.close(r.fd,l=>{l?this[T](l,e):this[ut](),t()})};r.on("finish",()=>{let h=String(e.absolute),l=r.fd;if(typeof l=="number"&&e.mtime&&!this.noMtime){n++;let c=e.atime||new Date,u=e.mtime;m.default.futimes(l,c,u,b=>b?m.default.utimes(h,c,u,D=>o(D&&b)):o())}if(typeof l=="number"&&this[It](e)){n++;let c=this[Ft](e),u=this[Ct](e);typeof c=="number"&&typeof u=="number"&&m.default.fchown(l,c,u,b=>b?m.default.chown(h,c,u,D=>o(D&&b)):o())}o()});let a=this.transform&&this.transform(e)||e;a!==e&&(a.on("error",h=>{this[T](h,e),t()}),e.pipe(a)),a.pipe(r)}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode;this[Pe](String(e.absolute),i,r=>{if(r){this[T](r,e),t();return}let n=1,o=()=>{--n===0&&(t(),this[ut](),e.resume())};e.mtime&&!this.noMtime&&(n++,m.default.utimes(String(e.absolute),e.atime||new Date,e.mtime,o)),this[It](e)&&(n++,m.default.chown(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)),o)),o()})}[ho](e){e.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${e.type}`,{entry:e}),e.resume()}[oo](e,t){let i=(0,U.normalizeWindowsPath)(g.default.relative(this.cwd,g.default.resolve(g.default.dirname(String(e.absolute)),String(e.linkpath)))).split("/");this[At](e,this.cwd,i,()=>this[Zi](e,String(e.linkpath),"symlink",t),r=>{this[T](r,e),t()})}[ao](e,t){let i=(0,U.normalizeWindowsPath)(g.default.resolve(this.cwd,String(e.linkpath))),r=(0,U.normalizeWindowsPath)(String(e.linkpath)).split("/");this[At](e,this.cwd,r,()=>this[Zi](e,i,"link",t),n=>{this[T](n,e),t()})}[At](e,t,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let a=g.default.resolve(t,o);m.default.lstat(a,(h,l)=>{if(h)return r();if(l?.isSymbolicLink())return n(new wo.SymlinkError(a,g.default.resolve(a,i.join("/"))));this[At](e,a,i,r,n)})}[co](){this[Gi]++}[ut](){this[Gi]--,this[Dr]()}[Ar](e){this[ut](),e.resume()}[Nr](e,t){return e.type==="File"&&!this.unlink&&t.isFile()&&t.nlink<=1&&!zt}[Pr](e){this[co]();let t=[e.path];e.linkpath&&t.push(e.linkpath),this.reservations.reserve(t,i=>this[no](e,i))}[no](e,t){let i=a=>{t(a)},r=()=>{this[Pe](this.cwd,this.dmode,a=>{if(a){this[T](a,e),i();return}this[Bt]=!0,n()})},n=()=>{if(e.absolute!==this.cwd){let a=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(a!==this.cwd)return this[Pe](a,this.dmode,h=>{if(h){this[T](h,e),i();return}o()})}o()},o=()=>{m.default.lstat(String(e.absolute),(a,h)=>{if(h&&(this.keep||this.newer&&h.mtime>(e.mtime??h.mtime))){this[Ar](e),i();return}if(a||this[Nr](e,h))return this[G](null,e,i);if(h.isDirectory()){if(e.type==="Directory"){let l=this.chmod&&e.mode&&(h.mode&4095)!==e.mode,c=u=>this[G](u??null,e,i);return l?m.default.chmod(String(e.absolute),Number(e.mode),c):c()}if(e.absolute!==this.cwd)return m.default.rmdir(String(e.absolute),l=>this[G](l??null,e,i))}if(e.absolute===this.cwd)return this[G](null,e,i);ll(String(e.absolute),l=>this[G](l??null,e,i))})};this[Bt]?n():r()}[G](e,t,i){if(e){this[T](e,t),i();return}switch(t.type){case"File":case"OldFile":case"ContiguousFile":return this[Mr](t,i);case"Link":return this[ao](t,i);case"SymbolicLink":return this[oo](t,i);case"Directory":case"GNUDumpDir":return this[Lr](t,i)}}[Zi](e,t,i,r){m.default[i](t,String(e.absolute),n=>{n?this[T](n,e):(this[ut](),e.resume()),r()})}};k.Unpack=Yi;var Lt=s=>{try{return[null,s()]}catch(e){return[e,null]}},Ir=class extends Yi{sync=!0;[G](e,t){return super[G](e,t,()=>{})}[Pr](e){if(!this[Bt]){let n=this[Pe](this.cwd,this.dmode);if(n)return this[T](n,e);this[Bt]=!0}if(e.absolute!==this.cwd){let n=(0,U.normalizeWindowsPath)(g.default.dirname(String(e.absolute)));if(n!==this.cwd){let o=this[Pe](n,this.dmode);if(o)return this[T](o,e)}}let[t,i]=Lt(()=>m.default.lstatSync(String(e.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(e.mtime??i.mtime)))return this[Ar](e);if(t||this[Nr](e,i))return this[G](null,e);if(i.isDirectory()){if(e.type==="Directory"){let o=this.chmod&&e.mode&&(i.mode&4095)!==e.mode,[a]=o?Lt(()=>{m.default.chmodSync(String(e.absolute),Number(e.mode))}):[];return this[G](a,e)}let[n]=Lt(()=>m.default.rmdirSync(String(e.absolute)));this[G](n,e)}let[r]=e.absolute===this.cwd?[]:Lt(()=>cl(String(e.absolute)));this[G](r,e)}[Mr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.fmode,r=a=>{let h;try{m.default.closeSync(n)}catch(l){h=l}(a||h)&&this[T](a||h,e),t()},n;try{n=m.default.openSync(String(e.absolute),(0,po.getWriteFlag)(e.size),i)}catch(a){return r(a)}let o=this.transform&&this.transform(e)||e;o!==e&&(o.on("error",a=>this[T](a,e)),e.pipe(o)),o.on("data",a=>{try{m.default.writeSync(n,a,0,a.length)}catch(h){r(h)}}),o.on("end",()=>{let a=null;if(e.mtime&&!this.noMtime){let h=e.atime||new Date,l=e.mtime;try{m.default.futimesSync(n,h,l)}catch(c){try{m.default.utimesSync(String(e.absolute),h,l)}catch{a=c}}}if(this[It](e)){let h=this[Ft](e),l=this[Ct](e);try{m.default.fchownSync(n,Number(h),Number(l))}catch(c){try{m.default.chownSync(String(e.absolute),Number(h),Number(l))}catch{a=a||c}}}r(a)})}[Lr](e,t){let i=typeof e.mode=="number"?e.mode&4095:this.dmode,r=this[Pe](String(e.absolute),i);if(r){this[T](r,e),t();return}if(e.mtime&&!this.noMtime)try{m.default.utimesSync(String(e.absolute),e.atime||new Date,e.mtime)}catch{}if(this[It](e))try{m.default.chownSync(String(e.absolute),Number(this[Ft](e)),Number(this[Ct](e)))}catch{}t(),e.resume()}[Pe](e,t){try{return(0,_o.mkdirSync)((0,U.normalizeWindowsPath)(e),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:t})}catch(i){return i}}[At](e,t,i,r,n){if(this.preservePaths||i.length===0)return r();let o=t;for(let a of i){o=g.default.resolve(o,a);let[h,l]=Lt(()=>m.default.lstatSync(o));if(h)return r();if(l.isSymbolicLink())return n(new wo.SymlinkError(o,g.default.resolve(t,i.join("/"))))}r()}[Zi](e,t,i,r){let n=`${i}Sync`;try{m.default[n](t,String(e.absolute)),r(),e.resume()}catch(o){return this[T](o,e)}}};k.UnpackSync=Ir});var Br=d(Z=>{"use strict";var ul=Z&&Z.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),fl=Z&&Z.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),dl=Z&&Z.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&ul(t,e,i[r]);return fl(t,e),t}})(),ml=Z&&Z.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(Z,"__esModule",{value:!0});Z.extract=void 0;var yo=dl(Ke()),Eo=ml(require("node:fs")),pl=rt(),_l=Ve(),Ki=Cr(),wl=s=>{let e=new Ki.UnpackSync(s),t=s.file,i=Eo.default.statSync(t),r=s.maxReadSize||16*1024*1024;new yo.ReadStreamSync(t,{readSize:r,size:i.size}).pipe(e)},yl=(s,e)=>{let t=new Ki.Unpack(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,a)=>{t.on("error",a),t.on("close",o),Eo.default.stat(r,(h,l)=>{if(h)a(h);else{let c=new yo.ReadStream(r,{readSize:i,size:l.size});c.on("error",a),c.pipe(t)}})})};Z.extract=(0,_l.makeCommand)(wl,yl,s=>new Ki.UnpackSync(s),s=>new Ki.Unpack(s),(s,e)=>{e?.length&&(0,pl.filesFilter)(s,e)})});var Vi=d(ft=>{"use strict";var bo=ft&&ft.__importDefault||function(s){return s&&s.__esModule?s:{default:s}};Object.defineProperty(ft,"__esModule",{value:!0});ft.replace=void 0;var So=Ke(),q=bo(require("node:fs")),go=bo(require("node:path")),Ro=et(),Oo=rt(),El=Ve(),bl=Qt(),vo=Ci(),Sl=(s,e)=>{let t=new vo.PackSync(s),i=!0,r,n;try{try{r=q.default.openSync(s.file,"r+")}catch(h){if(h?.code==="ENOENT")r=q.default.openSync(s.file,"w+");else throw h}let o=q.default.fstatSync(r),a=Buffer.alloc(512);e:for(n=0;n<o.size;n+=512){for(let c=0,u=0;c<512;c+=u){if(u=q.default.readSync(r,a,c,a.length-c,n+c),n===0&&a[0]===31&&a[1]===139)throw new Error("cannot append to compressed archives");if(!u)break e}let h=new Ro.Header(a);if(!h.cksumValid)break;let l=512*Math.ceil((h.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&h.mtime&&s.mtimeCache.set(String(h.path),h.mtime)}i=!1,gl(s,t,n,r,e)}finally{if(i)try{q.default.closeSync(r)}catch{}}},gl=(s,e,t,i,r)=>{let n=new So.WriteStreamSync(s.file,{fd:i,start:t});e.pipe(n),Ol(e,r)},Rl=(s,e)=>{e=Array.from(e);let t=new vo.Pack(s),i=(n,o,a)=>{let h=(D,A)=>{D?q.default.close(n,w=>a(D)):a(null,A)},l=0;if(o===0)return h(null,0);let c=0,u=Buffer.alloc(512),b=(D,A)=>{if(D||A===void 0)return h(D);if(c+=A,c<512&&A)return q.default.read(n,u,c,u.length-c,l+c,b);if(l===0&&u[0]===31&&u[1]===139)return h(new Error("cannot append to compressed archives"));if(c<512)return h(null,l);let w=new Ro.Header(u);if(!w.cksumValid)return h(null,l);let P=512*Math.ceil((w.size??0)/512);if(l+P+512>o||(l+=P+512,l>=o))return h(null,l);s.mtimeCache&&w.mtime&&s.mtimeCache.set(String(w.path),w.mtime),c=0,q.default.read(n,u,0,512,l,b)};q.default.read(n,u,0,512,l,b)};return new Promise((n,o)=>{t.on("error",o);let a="r+",h=(l,c)=>{if(l&&l.code==="ENOENT"&&a==="r+")return a="w+",q.default.open(s.file,a,h);if(l||!c)return o(l);q.default.fstat(c,(u,b)=>{if(u)return q.default.close(c,()=>o(u));i(c,b.size,(D,A)=>{if(D)return o(D);let w=new So.WriteStream(s.file,{fd:c,start:A});t.pipe(w),w.on("error",o),w.on("close",n),vl(t,e)})})};q.default.open(s.file,a,h)})},Ol=(s,e)=>{e.forEach(t=>{t.charAt(0)==="@"?(0,Oo.list)({file:go.default.resolve(s.cwd,t.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t)}),s.end()},vl=async(s,e)=>{for(let t of e)t.charAt(0)==="@"?await(0,Oo.list)({file:go.default.resolve(String(s.cwd),t.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(t);s.end()};ft.replace=(0,El.makeCommand)(Sl,Rl,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,e)=>{if(!(0,bl.isFile)(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!e?.length)throw new TypeError("no paths specified to add/replace")})});var zr=d($i=>{"use strict";Object.defineProperty($i,"__esModule",{value:!0});$i.update=void 0;var Tl=Ve(),kt=Vi();$i.update=(0,Tl.makeCommand)(kt.replace.syncFile,kt.replace.asyncFile,kt.replace.syncNoFile,kt.replace.asyncNoFile,(s,e=[])=>{kt.replace.validate?.(s,e),Dl(s)});var Dl=s=>{let e=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=e?(t,i)=>e(t,i)&&!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0)):(t,i)=>!((s.mtimeCache?.get(t)??i.mtime??0)>(i.mtime??0))}});var To=exports&&exports.__createBinding||(Object.create?(function(s,e,t,i){i===void 0&&(i=t);var r=Object.getOwnPropertyDescriptor(e,t);(!r||("get"in r?!e.__esModule:r.writable||r.configurable))&&(r={enumerable:!0,get:function(){return e[t]}}),Object.defineProperty(s,i,r)}):(function(s,e,t,i){i===void 0&&(i=t),s[i]=e[t]})),Pl=exports&&exports.__setModuleDefault||(Object.create?(function(s,e){Object.defineProperty(s,"default",{enumerable:!0,value:e})}):function(s,e){s.default=e}),Y=exports&&exports.__exportStar||function(s,e){for(var t in s)t!=="default"&&!Object.prototype.hasOwnProperty.call(e,t)&&To(e,s,t)},Nl=exports&&exports.__importStar||(function(){var s=function(e){return s=Object.getOwnPropertyNames||function(t){var i=[];for(var r in t)Object.prototype.hasOwnProperty.call(t,r)&&(i[i.length]=r);return i},s(e)};return function(e){if(e&&e.__esModule)return e;var t={};if(e!=null)for(var i=s(e),r=0;r<i.length;r++)i[r]!=="default"&&To(t,e,i[r]);return Pl(t,e),t}})();Object.defineProperty(exports,"__esModule",{value:!0});exports.u=exports.types=exports.r=exports.t=exports.x=exports.c=void 0;Y(_r(),exports);var Ml=_r();Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Ml.create}});Y(Br(),exports);var Ll=Br();Object.defineProperty(exports,"x",{enumerable:!0,get:function(){return Ll.extract}});Y(et(),exports);Y(rt(),exports);var Al=rt();Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Al.list}});Y(Ci(),exports);Y(_i(),exports);Y(si(),exports);Y(Cs(),exports);Y(Vi(),exports);var Il=Vi();Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Il.replace}});exports.types=Nl(Ns());Y(Cr(),exports);Y(zr(),exports);var Fl=zr();Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return Fl.update}});Y(nr(),exports);
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/commonjs/list.js b/deps/npm/node_modules/tar/dist/commonjs/list.js
index 700030a0ac10..5dfdb985cd78 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/list.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/list.js
@@ -59,14 +59,22 @@ const onReadEntryFunction = (opt) => {
 const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [(0, strip_trailing_slashes_js_1.stripTrailingSlashes)(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || (0, path_1.parse)(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root);
+            ret = m !== undefined ? m : mapHas((0, path_1.dirname)(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/commonjs/parse.js b/deps/npm/node_modules/tar/dist/commonjs/parse.js
index 2968e861ee68..6ab1e333458c 100644
--- a/deps/npm/node_modules/tar/dist/commonjs/parse.js
+++ b/deps/npm/node_modules/tar/dist/commonjs/parse.js
@@ -376,6 +376,16 @@ class Parser extends events_1.EventEmitter {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/dist/esm/index.min.js b/deps/npm/node_modules/tar/dist/esm/index.min.js
index bf4036b4115e..9d9044ce85e3 100644
--- a/deps/npm/node_modules/tar/dist/esm/index.min.js
+++ b/deps/npm/node_modules/tar/dist/esm/index.min.js
@@ -1,4 +1,4 @@
-var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),w=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[w]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[w])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[w])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[w]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[w]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[w])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[w]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==w&&this[w])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[w])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(w,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(w,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(w,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(w,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,S)=>{o=S,n=d,this.once(w,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(w,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(w,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[w])return t?this.emit("error",t):this.emit(w),this;this[w]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(w),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),u=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[u];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[u]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[u]=="number"?this[zt]():this[at]()}get fd(){return this[u]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[u]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[u],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[u]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[u],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[u];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[u]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[u]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[u]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[u]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[u]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[u]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[u],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[u],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[u]=="number"){let t=this[u];this[u]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[u],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var mn=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=mn(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=un(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},un=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
+var zr=Object.defineProperty;var Ur=(s,t)=>{for(var e in t)zr(s,e,{get:t[e],enumerable:!0})};import Qr from"events";import I from"fs";import{EventEmitter as Di}from"node:events";import Cs from"node:stream";import{StringDecoder as Hr}from"node:string_decoder";var Ds=typeof process=="object"&&process?process:{stdout:null,stderr:null},Wr=s=>!!s&&typeof s=="object"&&(s instanceof A||s instanceof Cs||Gr(s)||Zr(s)),Gr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.pipe=="function"&&s.pipe!==Cs.Writable.prototype.pipe,Zr=s=>!!s&&typeof s=="object"&&s instanceof Di&&typeof s.write=="function"&&typeof s.end=="function",Q=Symbol("EOF"),J=Symbol("maybeEmitEnd"),nt=Symbol("emittedEnd"),De=Symbol("emittingEnd"),qt=Symbol("emittedError"),Ne=Symbol("closed"),Ns=Symbol("read"),Ae=Symbol("flush"),As=Symbol("flushChunk"),z=Symbol("encoding"),Mt=Symbol("decoder"),g=Symbol("flowing"),Qt=Symbol("paused"),Bt=Symbol("resume"),b=Symbol("buffer"),N=Symbol("pipes"),_=Symbol("bufferLength"),bi=Symbol("bufferPush"),Ie=Symbol("bufferShift"),L=Symbol("objectMode"),S=Symbol("destroyed"),_i=Symbol("error"),Oi=Symbol("emitData"),Is=Symbol("emitEnd"),Ti=Symbol("emitEnd2"),Z=Symbol("async"),xi=Symbol("abort"),Ce=Symbol("aborted"),Jt=Symbol("signal"),Rt=Symbol("dataListeners"),C=Symbol("discarded"),jt=s=>Promise.resolve().then(s),Yr=s=>s(),Kr=s=>s==="end"||s==="finish"||s==="prefinish",Vr=s=>s instanceof ArrayBuffer||!!s&&typeof s=="object"&&s.constructor&&s.constructor.name==="ArrayBuffer"&&s.byteLength>=0,$r=s=>!Buffer.isBuffer(s)&&ArrayBuffer.isView(s),Fe=class{src;dest;opts;ondrain;constructor(t,e,i){this.src=t,this.dest=e,this.opts=i,this.ondrain=()=>t[Bt](),this.dest.on("drain",this.ondrain)}unpipe(){this.dest.removeListener("drain",this.ondrain)}proxyErrors(t){}end(){this.unpipe(),this.opts.end&&this.dest.end()}},Li=class extends Fe{unpipe(){this.src.removeListener("error",this.proxyErrors),super.unpipe()}constructor(t,e,i){super(t,e,i),this.proxyErrors=r=>this.dest.emit("error",r),t.on("error",this.proxyErrors)}},Xr=s=>!!s.objectMode,qr=s=>!s.objectMode&&!!s.encoding&&s.encoding!=="buffer",A=class extends Di{[g]=!1;[Qt]=!1;[N]=[];[b]=[];[L];[z];[Z];[Mt];[Q]=!1;[nt]=!1;[De]=!1;[Ne]=!1;[qt]=null;[_]=0;[S]=!1;[Jt];[Ce]=!1;[Rt]=0;[C]=!1;writable=!0;readable=!0;constructor(...t){let e=t[0]||{};if(super(),e.objectMode&&typeof e.encoding=="string")throw new TypeError("Encoding and objectMode may not be used together");Xr(e)?(this[L]=!0,this[z]=null):qr(e)?(this[z]=e.encoding,this[L]=!1):(this[L]=!1,this[z]=null),this[Z]=!!e.async,this[Mt]=this[z]?new Hr(this[z]):null,e&&e.debugExposeBuffer===!0&&Object.defineProperty(this,"buffer",{get:()=>this[b]}),e&&e.debugExposePipes===!0&&Object.defineProperty(this,"pipes",{get:()=>this[N]});let{signal:i}=e;i&&(this[Jt]=i,i.aborted?this[xi]():i.addEventListener("abort",()=>this[xi]()))}get bufferLength(){return this[_]}get encoding(){return this[z]}set encoding(t){throw new Error("Encoding must be set at instantiation time")}setEncoding(t){throw new Error("Encoding must be set at instantiation time")}get objectMode(){return this[L]}set objectMode(t){throw new Error("objectMode must be set at instantiation time")}get async(){return this[Z]}set async(t){this[Z]=this[Z]||!!t}[xi](){this[Ce]=!0,this.emit("abort",this[Jt]?.reason),this.destroy(this[Jt]?.reason)}get aborted(){return this[Ce]}set aborted(t){}write(t,e,i){if(this[Ce])return!1;if(this[Q])throw new Error("write after end");if(this[S])return this.emit("error",Object.assign(new Error("Cannot call write after a stream was destroyed"),{code:"ERR_STREAM_DESTROYED"})),!0;typeof e=="function"&&(i=e,e="utf8"),e||(e="utf8");let r=this[Z]?jt:Yr;if(!this[L]&&!Buffer.isBuffer(t)){if($r(t))t=Buffer.from(t.buffer,t.byteOffset,t.byteLength);else if(Vr(t))t=Buffer.from(t);else if(typeof t!="string")throw new Error("Non-contiguous data written to non-objectMode stream")}return this[L]?(this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):t.length?(typeof t=="string"&&!(e===this[z]&&!this[Mt]?.lastNeed)&&(t=Buffer.from(t,e)),Buffer.isBuffer(t)&&this[z]&&(t=this[Mt].write(t)),this[g]&&this[_]!==0&&this[Ae](!0),this[g]?this.emit("data",t):this[bi](t),this[_]!==0&&this.emit("readable"),i&&r(i),this[g]):(this[_]!==0&&this.emit("readable"),i&&r(i),this[g])}read(t){if(this[S])return null;if(this[C]=!1,this[_]===0||t===0||t&&t>this[_])return this[J](),null;this[L]&&(t=null),this[b].length>1&&!this[L]&&(this[b]=[this[z]?this[b].join(""):Buffer.concat(this[b],this[_])]);let e=this[Ns](t||null,this[b][0]);return this[J](),e}[Ns](t,e){if(this[L])this[Ie]();else{let i=e;t===i.length||t===null?this[Ie]():typeof i=="string"?(this[b][0]=i.slice(t),e=i.slice(0,t),this[_]-=t):(this[b][0]=i.subarray(t),e=i.subarray(0,t),this[_]-=t)}return this.emit("data",e),!this[b].length&&!this[Q]&&this.emit("drain"),e}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e="utf8"),t!==void 0&&this.write(t,e),i&&this.once("end",i),this[Q]=!0,this.writable=!1,(this[g]||!this[Qt])&&this[J](),this}[Bt](){this[S]||(!this[Rt]&&!this[N].length&&(this[C]=!0),this[Qt]=!1,this[g]=!0,this.emit("resume"),this[b].length?this[Ae]():this[Q]?this[J]():this.emit("drain"))}resume(){return this[Bt]()}pause(){this[g]=!1,this[Qt]=!0,this[C]=!1}get destroyed(){return this[S]}get flowing(){return this[g]}get paused(){return this[Qt]}[bi](t){this[L]?this[_]+=1:this[_]+=t.length,this[b].push(t)}[Ie](){return this[L]?this[_]-=1:this[_]-=this[b][0].length,this[b].shift()}[Ae](t=!1){do;while(this[As](this[Ie]())&&this[b].length);!t&&!this[b].length&&!this[Q]&&this.emit("drain")}[As](t){return this.emit("data",t),this[g]}pipe(t,e){if(this[S])return t;this[C]=!1;let i=this[nt];return e=e||{},t===Ds.stdout||t===Ds.stderr?e.end=!1:e.end=e.end!==!1,e.proxyErrors=!!e.proxyErrors,i?e.end&&t.end():(this[N].push(e.proxyErrors?new Li(this,t,e):new Fe(this,t,e)),this[Z]?jt(()=>this[Bt]()):this[Bt]()),t}unpipe(t){let e=this[N].find(i=>i.dest===t);e&&(this[N].length===1?(this[g]&&this[Rt]===0&&(this[g]=!1),this[N]=[]):this[N].splice(this[N].indexOf(e),1),e.unpipe())}addListener(t,e){return this.on(t,e)}on(t,e){let i=super.on(t,e);if(t==="data")this[C]=!1,this[Rt]++,!this[N].length&&!this[g]&&this[Bt]();else if(t==="readable"&&this[_]!==0)super.emit("readable");else if(Kr(t)&&this[nt])super.emit(t),this.removeAllListeners(t);else if(t==="error"&&this[qt]){let r=e;this[Z]?jt(()=>r.call(this,this[qt])):r.call(this,this[qt])}return i}removeListener(t,e){return this.off(t,e)}off(t,e){let i=super.off(t,e);return t==="data"&&(this[Rt]=this.listeners("data").length,this[Rt]===0&&!this[C]&&!this[N].length&&(this[g]=!1)),i}removeAllListeners(t){let e=super.removeAllListeners(t);return(t==="data"||t===void 0)&&(this[Rt]=0,!this[C]&&!this[N].length&&(this[g]=!1)),e}get emittedEnd(){return this[nt]}[J](){!this[De]&&!this[nt]&&!this[S]&&this[b].length===0&&this[Q]&&(this[De]=!0,this.emit("end"),this.emit("prefinish"),this.emit("finish"),this[Ne]&&this.emit("close"),this[De]=!1)}emit(t,...e){let i=e[0];if(t!=="error"&&t!=="close"&&t!==S&&this[S])return!1;if(t==="data")return!this[L]&&!i?!1:this[Z]?(jt(()=>this[Oi](i)),!0):this[Oi](i);if(t==="end")return this[Is]();if(t==="close"){if(this[Ne]=!0,!this[nt]&&!this[S])return!1;let n=super.emit("close");return this.removeAllListeners("close"),n}else if(t==="error"){this[qt]=i,super.emit(_i,i);let n=!this[Jt]||this.listeners("error").length?super.emit("error",i):!1;return this[J](),n}else if(t==="resume"){let n=super.emit("resume");return this[J](),n}else if(t==="finish"||t==="prefinish"){let n=super.emit(t);return this.removeAllListeners(t),n}let r=super.emit(t,...e);return this[J](),r}[Oi](t){for(let i of this[N])i.dest.write(t)===!1&&this.pause();let e=this[C]?!1:super.emit("data",t);return this[J](),e}[Is](){return this[nt]?!1:(this[nt]=!0,this.readable=!1,this[Z]?(jt(()=>this[Ti]()),!0):this[Ti]())}[Ti](){if(this[Mt]){let e=this[Mt].end();if(e){for(let i of this[N])i.dest.write(e);this[C]||super.emit("data",e)}}for(let e of this[N])e.end();let t=super.emit("end");return this.removeAllListeners("end"),t}async collect(){let t=Object.assign([],{dataLength:0});this[L]||(t.dataLength=0);let e=this.promise();return this.on("data",i=>{t.push(i),this[L]||(t.dataLength+=i.length)}),await e,t}async concat(){if(this[L])throw new Error("cannot concat in objectMode");let t=await this.collect();return this[z]?t.join(""):Buffer.concat(t,t.dataLength)}async promise(){return new Promise((t,e)=>{this.on(S,()=>e(new Error("stream destroyed"))),this.on("error",i=>e(i)),this.on("end",()=>t())})}[Symbol.asyncIterator](){this[C]=!1;let t=!1,e=async()=>(this.pause(),t=!0,{value:void 0,done:!0});return{next:()=>{if(t)return e();let r=this.read();if(r!==null)return Promise.resolve({done:!1,value:r});if(this[Q])return e();let n,o,h=d=>{this.off("data",a),this.off("end",l),this.off(S,c),e(),o(d)},a=d=>{this.off("error",h),this.off("end",l),this.off(S,c),this.pause(),n({value:d,done:!!this[Q]})},l=()=>{this.off("error",h),this.off("data",a),this.off(S,c),e(),n({done:!0,value:void 0})},c=()=>h(new Error("stream destroyed"));return new Promise((d,y)=>{o=y,n=d,this.once(S,c),this.once("error",h),this.once("end",l),this.once("data",a)})},throw:e,return:e,[Symbol.asyncIterator](){return this},[Symbol.asyncDispose]:async()=>{}}}[Symbol.iterator](){this[C]=!1;let t=!1,e=()=>(this.pause(),this.off(_i,e),this.off(S,e),this.off("end",e),t=!0,{done:!0,value:void 0}),i=()=>{if(t)return e();let r=this.read();return r===null?e():{done:!1,value:r}};return this.once("end",e),this.once(_i,e),this.once(S,e),{next:i,throw:e,return:e,[Symbol.iterator](){return this},[Symbol.dispose]:()=>{}}}destroy(t){if(this[S])return t?this.emit("error",t):this.emit(S),this;this[S]=!0,this[C]=!0,this[b].length=0,this[_]=0;let e=this;return typeof e.close=="function"&&!this[Ne]&&e.close(),t?this.emit("error",t):this.emit(S),this}static get isStream(){return Wr}};var Jr=I.writev,ht=Symbol("_autoClose"),H=Symbol("_close"),te=Symbol("_ended"),m=Symbol("_fd"),Ni=Symbol("_finished"),tt=Symbol("_flags"),Ai=Symbol("_flush"),ki=Symbol("_handleChunk"),vi=Symbol("_makeBuf"),ie=Symbol("_mode"),ke=Symbol("_needDrain"),Ut=Symbol("_onerror"),Ht=Symbol("_onopen"),Ii=Symbol("_onread"),Pt=Symbol("_onwrite"),at=Symbol("_open"),U=Symbol("_path"),ot=Symbol("_pos"),Y=Symbol("_queue"),zt=Symbol("_read"),Ci=Symbol("_readSize"),j=Symbol("_reading"),ee=Symbol("_remain"),Fi=Symbol("_size"),ve=Symbol("_write"),gt=Symbol("_writing"),Me=Symbol("_defaultFlag"),bt=Symbol("_errored"),_t=class extends A{[bt]=!1;[m];[U];[Ci];[j]=!1;[Fi];[ee];[ht];constructor(t,e){if(e=e||{},super(e),this.readable=!0,this.writable=!1,typeof t!="string")throw new TypeError("path must be a string");this[bt]=!1,this[m]=typeof e.fd=="number"?e.fd:void 0,this[U]=t,this[Ci]=e.readSize||16*1024*1024,this[j]=!1,this[Fi]=typeof e.size=="number"?e.size:1/0,this[ee]=this[Fi],this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0,typeof this[m]=="number"?this[zt]():this[at]()}get fd(){return this[m]}get path(){return this[U]}write(){throw new TypeError("this is a readable stream")}end(){throw new TypeError("this is a readable stream")}[at](){I.open(this[U],"r",(t,e)=>this[Ht](t,e))}[Ht](t,e){t?this[Ut](t):(this[m]=e,this.emit("open",e),this[zt]())}[vi](){return Buffer.allocUnsafe(Math.min(this[Ci],this[ee]))}[zt](){if(!this[j]){this[j]=!0;let t=this[vi]();if(t.length===0)return process.nextTick(()=>this[Ii](null,0,t));I.read(this[m],t,0,t.length,null,(e,i,r)=>this[Ii](e,i,r))}}[Ii](t,e,i){this[j]=!1,t?this[Ut](t):this[ki](e,i)&&this[zt]()}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}[Ut](t){this[j]=!0,this[H](),this.emit("error",t)}[ki](t,e){let i=!1;return this[ee]-=t,t>0&&(i=super.write(t<e.length?e.subarray(0,t):e)),(t===0||this[ee]<=0)&&(i=!1,this[H](),super.end()),i}emit(t,...e){switch(t){case"prefinish":case"finish":return!1;case"drain":return typeof this[m]=="number"&&this[zt](),!1;case"error":return this[bt]?!1:(this[bt]=!0,super.emit(t,...e));default:return super.emit(t,...e)}}},Be=class extends _t{[at](){let t=!0;try{this[Ht](null,I.openSync(this[U],"r")),t=!1}finally{t&&this[H]()}}[zt](){let t=!0;try{if(!this[j]){this[j]=!0;do{let e=this[vi](),i=e.length===0?0:I.readSync(this[m],e,0,e.length,null);if(!this[ki](i,e))break}while(!0);this[j]=!1}t=!1}finally{t&&this[H]()}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}},et=class extends Qr{readable=!1;writable=!0;[bt]=!1;[gt]=!1;[te]=!1;[Y]=[];[ke]=!1;[U];[ie];[ht];[m];[Me];[tt];[Ni]=!1;[ot];constructor(t,e){e=e||{},super(e),this[U]=t,this[m]=typeof e.fd=="number"?e.fd:void 0,this[ie]=e.mode===void 0?438:e.mode,this[ot]=typeof e.start=="number"?e.start:void 0,this[ht]=typeof e.autoClose=="boolean"?e.autoClose:!0;let i=this[ot]!==void 0?"r+":"w";this[Me]=e.flags===void 0,this[tt]=e.flags===void 0?i:e.flags,this[m]===void 0&&this[at]()}emit(t,...e){if(t==="error"){if(this[bt])return!1;this[bt]=!0}return super.emit(t,...e)}get fd(){return this[m]}get path(){return this[U]}[Ut](t){this[H](),this[gt]=!0,this.emit("error",t)}[at](){I.open(this[U],this[tt],this[ie],(t,e)=>this[Ht](t,e))}[Ht](t,e){this[Me]&&this[tt]==="r+"&&t&&t.code==="ENOENT"?(this[tt]="w",this[at]()):t?this[Ut](t):(this[m]=e,this.emit("open",e),this[gt]||this[Ai]())}end(t,e){return t&&this.write(t,e),this[te]=!0,!this[gt]&&!this[Y].length&&typeof this[m]=="number"&&this[Pt](null,0),this}write(t,e){return typeof t=="string"&&(t=Buffer.from(t,e)),this[te]?(this.emit("error",new Error("write() after end()")),!1):this[m]===void 0||this[gt]||this[Y].length?(this[Y].push(t),this[ke]=!0,!1):(this[gt]=!0,this[ve](t),!0)}[ve](t){I.write(this[m],t,0,t.length,this[ot],(e,i)=>this[Pt](e,i))}[Pt](t,e){t?this[Ut](t):(this[ot]!==void 0&&typeof e=="number"&&(this[ot]+=e),this[Y].length?this[Ai]():(this[gt]=!1,this[te]&&!this[Ni]?(this[Ni]=!0,this[H](),this.emit("finish")):this[ke]&&(this[ke]=!1,this.emit("drain"))))}[Ai](){if(this[Y].length===0)this[te]&&this[Pt](null,0);else if(this[Y].length===1)this[ve](this[Y].pop());else{let t=this[Y];this[Y]=[],Jr(this[m],t,this[ot],(e,i)=>this[Pt](e,i))}}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.close(t,e=>e?this.emit("error",e):this.emit("close"))}}},Wt=class extends et{[at](){let t;if(this[Me]&&this[tt]==="r+")try{t=I.openSync(this[U],this[tt],this[ie])}catch(e){if(e?.code==="ENOENT")return this[tt]="w",this[at]();throw e}else t=I.openSync(this[U],this[tt],this[ie]);this[Ht](null,t)}[H](){if(this[ht]&&typeof this[m]=="number"){let t=this[m];this[m]=void 0,I.closeSync(t),this.emit("close")}}[ve](t){let e=!0;try{this[Pt](null,I.writeSync(this[m],t,0,t.length,this[ot])),e=!1}finally{if(e)try{this[H]()}catch{}}}};import cr from"node:path";import Kt from"node:fs";import{dirname as Fn,parse as kn}from"path";var jr=new Map([["C","cwd"],["f","file"],["z","gzip"],["P","preservePaths"],["U","unlink"],["strip-components","strip"],["stripComponents","strip"],["keep-newer","newer"],["keepNewer","newer"],["keep-newer-files","newer"],["keepNewerFiles","newer"],["k","keep"],["keep-existing","keep"],["keepExisting","keep"],["m","noMtime"],["no-mtime","noMtime"],["p","preserveOwner"],["L","follow"],["h","follow"],["onentry","onReadEntry"]]),Fs=s=>!!s.sync&&!!s.file,ks=s=>!s.sync&&!!s.file,vs=s=>!!s.sync&&!s.file,Ms=s=>!s.sync&&!s.file;var Bs=s=>!!s.file;var tn=s=>{let t=jr.get(s);return t||s},se=(s={})=>{if(!s)return{};let t={};for(let[e,i]of Object.entries(s)){let r=tn(e);t[r]=i}return t.chmod===void 0&&t.noChmod===!1&&(t.chmod=!0),delete t.noChmod,t};var K=(s,t,e,i,r)=>Object.assign((n=[],o,h)=>{Array.isArray(n)&&(o=n,n={}),typeof o=="function"&&(h=o,o=void 0),o=o?Array.from(o):[];let a=se(n);if(r?.(a,o),Fs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return s(a,o)}else if(ks(a)){let l=t(a,o);return h?l.then(()=>h(),h):l}else if(vs(a)){if(typeof h=="function")throw new TypeError("callback not supported for sync tar functions");return e(a,o)}else if(Ms(a)){if(typeof h=="function")throw new TypeError("callback only supported with file option");return i(a,o)}throw new Error("impossible options??")},{syncFile:s,asyncFile:t,syncNoFile:e,asyncNoFile:i,validate:r});import{EventEmitter as Dn}from"events";import zi from"assert";import{Buffer as Ot}from"buffer";import*as Ps from"zlib";import en from"zlib";var sn=en.constants||{ZLIB_VERNUM:4736},M=Object.freeze(Object.assign(Object.create(null),{Z_NO_FLUSH:0,Z_PARTIAL_FLUSH:1,Z_SYNC_FLUSH:2,Z_FULL_FLUSH:3,Z_FINISH:4,Z_BLOCK:5,Z_OK:0,Z_STREAM_END:1,Z_NEED_DICT:2,Z_ERRNO:-1,Z_STREAM_ERROR:-2,Z_DATA_ERROR:-3,Z_MEM_ERROR:-4,Z_BUF_ERROR:-5,Z_VERSION_ERROR:-6,Z_NO_COMPRESSION:0,Z_BEST_SPEED:1,Z_BEST_COMPRESSION:9,Z_DEFAULT_COMPRESSION:-1,Z_FILTERED:1,Z_HUFFMAN_ONLY:2,Z_RLE:3,Z_FIXED:4,Z_DEFAULT_STRATEGY:0,DEFLATE:1,INFLATE:2,GZIP:3,GUNZIP:4,DEFLATERAW:5,INFLATERAW:6,UNZIP:7,BROTLI_DECODE:8,BROTLI_ENCODE:9,Z_MIN_WINDOWBITS:8,Z_MAX_WINDOWBITS:15,Z_DEFAULT_WINDOWBITS:15,Z_MIN_CHUNK:64,Z_MAX_CHUNK:1/0,Z_DEFAULT_CHUNK:16384,Z_MIN_MEMLEVEL:1,Z_MAX_MEMLEVEL:9,Z_DEFAULT_MEMLEVEL:8,Z_MIN_LEVEL:-1,Z_MAX_LEVEL:9,Z_DEFAULT_LEVEL:-1,BROTLI_OPERATION_PROCESS:0,BROTLI_OPERATION_FLUSH:1,BROTLI_OPERATION_FINISH:2,BROTLI_OPERATION_EMIT_METADATA:3,BROTLI_MODE_GENERIC:0,BROTLI_MODE_TEXT:1,BROTLI_MODE_FONT:2,BROTLI_DEFAULT_MODE:0,BROTLI_MIN_QUALITY:0,BROTLI_MAX_QUALITY:11,BROTLI_DEFAULT_QUALITY:11,BROTLI_MIN_WINDOW_BITS:10,BROTLI_MAX_WINDOW_BITS:24,BROTLI_LARGE_MAX_WINDOW_BITS:30,BROTLI_DEFAULT_WINDOW:22,BROTLI_MIN_INPUT_BLOCK_BITS:16,BROTLI_MAX_INPUT_BLOCK_BITS:24,BROTLI_PARAM_MODE:0,BROTLI_PARAM_QUALITY:1,BROTLI_PARAM_LGWIN:2,BROTLI_PARAM_LGBLOCK:3,BROTLI_PARAM_DISABLE_LITERAL_CONTEXT_MODELING:4,BROTLI_PARAM_SIZE_HINT:5,BROTLI_PARAM_LARGE_WINDOW:6,BROTLI_PARAM_NPOSTFIX:7,BROTLI_PARAM_NDIRECT:8,BROTLI_DECODER_RESULT_ERROR:0,BROTLI_DECODER_RESULT_SUCCESS:1,BROTLI_DECODER_RESULT_NEEDS_MORE_INPUT:2,BROTLI_DECODER_RESULT_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_PARAM_DISABLE_RING_BUFFER_REALLOCATION:0,BROTLI_DECODER_PARAM_LARGE_WINDOW:1,BROTLI_DECODER_NO_ERROR:0,BROTLI_DECODER_SUCCESS:1,BROTLI_DECODER_NEEDS_MORE_INPUT:2,BROTLI_DECODER_NEEDS_MORE_OUTPUT:3,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_NIBBLE:-1,BROTLI_DECODER_ERROR_FORMAT_RESERVED:-2,BROTLI_DECODER_ERROR_FORMAT_EXUBERANT_META_NIBBLE:-3,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_ALPHABET:-4,BROTLI_DECODER_ERROR_FORMAT_SIMPLE_HUFFMAN_SAME:-5,BROTLI_DECODER_ERROR_FORMAT_CL_SPACE:-6,BROTLI_DECODER_ERROR_FORMAT_HUFFMAN_SPACE:-7,BROTLI_DECODER_ERROR_FORMAT_CONTEXT_MAP_REPEAT:-8,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_1:-9,BROTLI_DECODER_ERROR_FORMAT_BLOCK_LENGTH_2:-10,BROTLI_DECODER_ERROR_FORMAT_TRANSFORM:-11,BROTLI_DECODER_ERROR_FORMAT_DICTIONARY:-12,BROTLI_DECODER_ERROR_FORMAT_WINDOW_BITS:-13,BROTLI_DECODER_ERROR_FORMAT_PADDING_1:-14,BROTLI_DECODER_ERROR_FORMAT_PADDING_2:-15,BROTLI_DECODER_ERROR_FORMAT_DISTANCE:-16,BROTLI_DECODER_ERROR_DICTIONARY_NOT_SET:-19,BROTLI_DECODER_ERROR_INVALID_ARGUMENTS:-20,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MODES:-21,BROTLI_DECODER_ERROR_ALLOC_TREE_GROUPS:-22,BROTLI_DECODER_ERROR_ALLOC_CONTEXT_MAP:-25,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_1:-26,BROTLI_DECODER_ERROR_ALLOC_RING_BUFFER_2:-27,BROTLI_DECODER_ERROR_ALLOC_BLOCK_TYPE_TREES:-30,BROTLI_DECODER_ERROR_UNREACHABLE:-31},sn));var rn=Ot.concat,zs=Object.getOwnPropertyDescriptor(Ot,"concat"),nn=s=>s,Bi=zs?.writable===!0||zs?.set!==void 0?s=>{Ot.concat=s?nn:rn}:s=>{},Tt=Symbol("_superWrite"),Gt=class extends Error{code;errno;constructor(t,e){super("zlib: "+t.message,{cause:t}),this.code=t.code,this.errno=t.errno,this.code||(this.code="ZLIB_ERROR"),this.message="zlib: "+t.message,Error.captureStackTrace(this,e??this.constructor)}get name(){return"ZlibError"}},Pi=Symbol("flushFlag"),re=class extends A{#t=!1;#i=!1;#s;#n;#r;#e;#o;get sawError(){return this.#t}get handle(){return this.#e}get flushFlag(){return this.#s}constructor(t,e){if(!t||typeof t!="object")throw new TypeError("invalid options for ZlibBase constructor");if(super(t),this.#s=t.flush??0,this.#n=t.finishFlush??0,this.#r=t.fullFlushFlag??0,typeof Ps[e]!="function")throw new TypeError("Compression method not supported: "+e);try{this.#e=new Ps[e](t)}catch(i){throw new Gt(i,this.constructor)}this.#o=i=>{this.#t||(this.#t=!0,this.close(),this.emit("error",i))},this.#e?.on("error",i=>this.#o(new Gt(i))),this.once("end",()=>this.close)}close(){this.#e&&(this.#e.close(),this.#e=void 0,this.emit("close"))}reset(){if(!this.#t)return zi(this.#e,"zlib binding closed"),this.#e.reset?.()}flush(t){this.ended||(typeof t!="number"&&(t=this.#r),this.write(Object.assign(Ot.alloc(0),{[Pi]:t})))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&(e?this.write(t,e):this.write(t)),this.flush(this.#n),this.#i=!0,super.end(i)}get ended(){return this.#i}[Tt](t){return super.write(t)}write(t,e,i){if(typeof e=="function"&&(i=e,e="utf8"),typeof t=="string"&&(t=Ot.from(t,e)),this.#t)return;zi(this.#e,"zlib binding closed");let r=this.#e._handle,n=r.close;r.close=()=>{};let o=this.#e.close;this.#e.close=()=>{},Bi(!0);let h;try{let l=typeof t[Pi]=="number"?t[Pi]:this.#s;h=this.#e._processChunk(t,l),Bi(!1)}catch(l){Bi(!1),this.#o(new Gt(l,this.write))}finally{this.#e&&(this.#e._handle=r,r.close=n,this.#e.close=o,this.#e.removeAllListeners("error"))}this.#e&&this.#e.on("error",l=>this.#o(new Gt(l,this.write)));let a;if(h)if(Array.isArray(h)&&h.length>0){let l=h[0];a=this[Tt](Ot.from(l));for(let c=1;c<h.length;c++)a=this[Tt](h[c])}else a=this[Tt](Ot.from(h));return i&&i(),a}},Pe=class extends re{#t;#i;constructor(t,e){t=t||{},t.flush=t.flush||M.Z_NO_FLUSH,t.finishFlush=t.finishFlush||M.Z_FINISH,t.fullFlushFlag=M.Z_FULL_FLUSH,super(t,e),this.#t=t.level,this.#i=t.strategy}params(t,e){if(!this.sawError){if(!this.handle)throw new Error("cannot switch params when binding is closed");if(!this.handle.params)throw new Error("not supported in this implementation");if(this.#t!==t||this.#i!==e){this.flush(M.Z_SYNC_FLUSH),zi(this.handle,"zlib binding closed");let i=this.handle.flush;this.handle.flush=(r,n)=>{typeof r=="function"&&(n=r,r=this.flushFlag),this.flush(r),n?.()};try{this.handle.params(t,e)}finally{this.handle.flush=i}this.handle&&(this.#t=t,this.#i=e)}}}};var ze=class extends Pe{#t;constructor(t){super(t,"Gzip"),this.#t=t&&!!t.portable}[Tt](t){return this.#t?(this.#t=!1,t[9]=255,super[Tt](t)):super[Tt](t)}};var Ue=class extends Pe{constructor(t){super(t,"Unzip")}},He=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.BROTLI_OPERATION_PROCESS,t.finishFlush=t.finishFlush||M.BROTLI_OPERATION_FINISH,t.fullFlushFlag=M.BROTLI_OPERATION_FLUSH,super(t,e)}},We=class extends He{constructor(t){super(t,"BrotliCompress")}},Ge=class extends He{constructor(t){super(t,"BrotliDecompress")}},Ze=class extends re{constructor(t,e){t=t||{},t.flush=t.flush||M.ZSTD_e_continue,t.finishFlush=t.finishFlush||M.ZSTD_e_end,t.fullFlushFlag=M.ZSTD_e_flush,super(t,e)}},Ye=class extends Ze{constructor(t){super(t,"ZstdCompress")}},Ke=class extends Ze{constructor(t){super(t,"ZstdDecompress")}};import{posix as Zt}from"node:path";var Us=(s,t)=>{if(Number.isSafeInteger(s))s<0?an(s,t):hn(s,t);else throw Error("cannot encode number outside of javascript safe integer range");return t},hn=(s,t)=>{t[0]=128;for(var e=t.length;e>1;e--)t[e-1]=s&255,s=Math.floor(s/256)},an=(s,t)=>{t[0]=255;var e=!1;s=s*-1;for(var i=t.length;i>1;i--){var r=s&255;s=Math.floor(s/256),e?t[i-1]=Ws(r):r===0?t[i-1]=0:(e=!0,t[i-1]=Gs(r))}},Hs=s=>{let t=s[0],e=t===128?cn(s.subarray(1,s.length)):t===255?ln(s):null;if(e===null)throw Error("invalid base256 encoding");if(!Number.isSafeInteger(e))throw Error("parsed number outside of javascript safe integer range");return e},ln=s=>{for(var t=s.length,e=0,i=!1,r=t-1;r>-1;r--){var n=Number(s[r]),o;i?o=Ws(n):n===0?o=n:(i=!0,o=Gs(n)),o!==0&&(e-=o*Math.pow(256,t-r-1))}return e},cn=s=>{for(var t=s.length,e=0,i=t-1;i>-1;i--){var r=Number(s[i]);r!==0&&(e+=r*Math.pow(256,t-i-1))}return e},Ws=s=>(255^s)&255,Gs=s=>(255^s)+1&255;var Hi={};Ur(Hi,{code:()=>Ve,isCode:()=>ne,isName:()=>dn,name:()=>oe,normalFsTypes:()=>Ui});var ne=s=>oe.has(s),dn=s=>Ve.has(s),Ui=new Set(["0","","1","2","3","4","5","6","7","D"]),oe=new Map([["0","File"],["","OldFile"],["1","Link"],["2","SymbolicLink"],["3","CharacterDevice"],["4","BlockDevice"],["5","Directory"],["6","FIFO"],["7","ContiguousFile"],["g","GlobalExtendedHeader"],["x","ExtendedHeader"],["A","SolarisACL"],["D","GNUDumpDir"],["I","Inode"],["K","NextFileHasLongLinkpath"],["L","NextFileHasLongPath"],["M","ContinuationFile"],["N","OldGnuLongPath"],["S","SparseFile"],["V","TapeVolumeHeader"],["X","OldExtendedHeader"]]),Ve=new Map(Array.from(oe).map(s=>[s[1],s[0]]));var un=s=>s===void 0||s<0?void 0:s,F=class{cksumValid=!1;needPax=!1;nullBlock=!1;block;path;mode;uid;gid;size;cksum;#t="Unsupported";linkpath;uname;gname;devmaj=0;devmin=0;atime;ctime;mtime;charset;comment;constructor(t,e=0,i,r){Buffer.isBuffer(t)?this.decode(t,e||0,i,r):t&&this.#i(t)}decode(t,e,i,r){if(e||(e=0),!t||!(t.length>=e+512))throw new Error("need 512 bytes for header");let n=xt(t,e+156,1),o=Ui.has(n),h=o?i:void 0,a=o?r:void 0;if(this.path=h?.path??xt(t,e,100),this.mode=h?.mode??a?.mode??lt(t,e+100,8),this.uid=h?.uid??a?.uid??lt(t,e+108,8),this.gid=h?.gid??a?.gid??lt(t,e+116,8),this.size=un(h?.size??a?.size??lt(t,e+124,12)),this.mtime=h?.mtime??a?.mtime??Wi(t,e+136,12),this.cksum=lt(t,e+148,12),a&&this.#i(a,!0),h&&this.#i(h),ne(n)&&(this.#t=n||"0"),this.#t==="0"&&this.path.slice(-1)==="/"&&(this.#t="5"),this.#t==="5"&&(this.size=0),this.linkpath=xt(t,e+157,100),t.subarray(e+257,e+265).toString()==="ustar\x0000")if(this.uname=h?.uname??a?.uname??xt(t,e+265,32),this.gname=h?.gname??a?.gname??xt(t,e+297,32),this.devmaj=h?.devmaj??a?.devmaj??lt(t,e+329,8)??0,this.devmin=h?.devmin??a?.devmin??lt(t,e+337,8)??0,t[e+475]!==0){let c=xt(t,e+345,155);this.path=c+"/"+this.path}else{let c=xt(t,e+345,130);c&&(this.path=c+"/"+this.path),this.atime=i?.atime??r?.atime??Wi(t,e+476,12),this.ctime=i?.ctime??r?.ctime??Wi(t,e+488,12)}let l=256;for(let c=e;c<e+148;c++)l+=t[c];for(let c=e+156;c<e+512;c++)l+=t[c];this.cksumValid=l===this.cksum,this.cksum===void 0&&l===256&&(this.nullBlock=!0)}#i(t,e=!1){Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="size"&&Number(r)<0||i==="path"&&e||i==="linkpath"&&e||i==="global"))))}encode(t,e=0){if(t||(t=this.block=Buffer.alloc(512)),this.#t==="Unsupported"&&(this.#t="0"),!(t.length>=e+512))throw new Error("need 512 bytes for header");let i=this.ctime||this.atime?130:155,r=mn(this.path||"",i),n=r[0],o=r[1];this.needPax=!!r[2],this.needPax=Lt(t,e,100,n)||this.needPax,this.needPax=ct(t,e+100,8,this.mode)||this.needPax,this.needPax=ct(t,e+108,8,this.uid)||this.needPax,this.needPax=ct(t,e+116,8,this.gid)||this.needPax,this.needPax=ct(t,e+124,12,this.size)||this.needPax,this.needPax=Gi(t,e+136,12,this.mtime)||this.needPax,t[e+156]=Number(this.#t.codePointAt(0)),this.needPax=Lt(t,e+157,100,this.linkpath)||this.needPax,t.write("ustar\x0000",e+257,8),this.needPax=Lt(t,e+265,32,this.uname)||this.needPax,this.needPax=Lt(t,e+297,32,this.gname)||this.needPax,this.needPax=ct(t,e+329,8,this.devmaj)||this.needPax,this.needPax=ct(t,e+337,8,this.devmin)||this.needPax,this.needPax=Lt(t,e+345,i,o)||this.needPax,t[e+475]!==0?this.needPax=Lt(t,e+345,155,o)||this.needPax:(this.needPax=Lt(t,e+345,130,o)||this.needPax,this.needPax=Gi(t,e+476,12,this.atime)||this.needPax,this.needPax=Gi(t,e+488,12,this.ctime)||this.needPax);let h=256;for(let a=e;a<e+148;a++)h+=t[a];for(let a=e+156;a<e+512;a++)h+=t[a];return this.cksum=h,ct(t,e+148,8,this.cksum),this.cksumValid=!0,this.needPax}get type(){return this.#t==="Unsupported"?this.#t:oe.get(this.#t)}get typeKey(){return this.#t}set type(t){let e=String(Ve.get(t));if(ne(e)||e==="Unsupported")this.#t=e;else if(ne(t))this.#t=t;else throw new TypeError("invalid entry type: "+t)}},mn=(s,t)=>{let i=s,r="",n,o=Zt.parse(s).root||".";if(Buffer.byteLength(i)<100)n=[i,r,!1];else{r=Zt.dirname(i),i=Zt.basename(i);do Buffer.byteLength(i)<=100&&Buffer.byteLength(r)<=t?n=[i,r,!1]:Buffer.byteLength(i)>100&&Buffer.byteLength(r)<=t?n=[i.slice(0,99),r,!0]:(i=Zt.join(Zt.basename(r),i),r=Zt.dirname(r));while(r!==o&&n===void 0);n||(n=[s.slice(0,99),"",!0])}return n},xt=(s,t,e)=>s.subarray(t,t+e).toString("utf8").replace(/\0.*/,""),Wi=(s,t,e)=>pn(lt(s,t,e)),pn=s=>s===void 0?void 0:new Date(s*1e3),lt=(s,t,e)=>Number(s[t])&128?Hs(s.subarray(t,t+e)):wn(s,t,e),En=s=>isNaN(s)?void 0:s,wn=(s,t,e)=>En(parseInt(s.subarray(t,t+e).toString("utf8").replace(/\0.*$/,"").trim(),8)),Sn={12:8589934591,8:2097151},ct=(s,t,e,i)=>i===void 0?!1:i>Sn[e]||i<0?(Us(i,s.subarray(t,t+e)),!0):(yn(s,t,e,i),!1),yn=(s,t,e,i)=>s.write(Rn(i,e),t,e,"ascii"),Rn=(s,t)=>gn(Math.floor(s).toString(8),t),gn=(s,t)=>(s.length===t-1?s:new Array(t-s.length-1).join("0")+s+" ")+"\0",Gi=(s,t,e,i)=>i===void 0?!1:ct(s,t,e,i.getTime()/1e3),bn=new Array(156).join("\0"),Lt=(s,t,e,i)=>i===void 0?!1:(s.write(i+bn,t,e,"utf8"),i.length!==Buffer.byteLength(i)||i.length>e);import{basename as _n}from"node:path";var ft=class s{atime;mtime;ctime;charset;comment;gid;uid;gname;uname;linkpath;dev;ino;nlink;path;size;mode;global;constructor(t,e=!1){this.atime=t.atime,this.charset=t.charset,this.comment=t.comment,this.ctime=t.ctime,this.dev=t.dev,this.gid=t.gid,this.global=e,this.gname=t.gname,this.ino=t.ino,this.linkpath=t.linkpath,this.mtime=t.mtime,this.nlink=t.nlink,this.path=t.path,this.size=t.size,this.uid=t.uid,this.uname=t.uname}encode(){let t=this.encodeBody();if(t==="")return Buffer.allocUnsafe(0);let e=Buffer.byteLength(t),i=512*Math.ceil(1+e/512),r=Buffer.allocUnsafe(i);for(let n=0;n<512;n++)r[n]=0;new F({path:("PaxHeader/"+_n(this.path??"")).slice(0,99),mode:this.mode||420,uid:this.uid,gid:this.gid,size:e,mtime:this.mtime,type:this.global?"GlobalExtendedHeader":"ExtendedHeader",linkpath:"",uname:this.uname||"",gname:this.gname||"",devmaj:0,devmin:0,atime:this.atime,ctime:this.ctime}).encode(r),r.write(t,512,e,"utf8");for(let n=e+512;n<r.length;n++)r[n]=0;return r}encodeBody(){return this.encodeField("path")+this.encodeField("ctime")+this.encodeField("atime")+this.encodeField("dev")+this.encodeField("ino")+this.encodeField("nlink")+this.encodeField("charset")+this.encodeField("comment")+this.encodeField("gid")+this.encodeField("gname")+this.encodeField("linkpath")+this.encodeField("mtime")+this.encodeField("size")+this.encodeField("uid")+this.encodeField("uname")}encodeField(t){if(this[t]===void 0)return"";let e=this[t],i=e instanceof Date?e.getTime()/1e3:e,r=" "+(t==="dev"||t==="ino"||t==="nlink"?"SCHILY.":"")+t+"="+i+`
 `,n=Buffer.byteLength(r),o=Math.floor(Math.log(n)/Math.log(10))+1;return n+o>=Math.pow(10,o)&&(o+=1),o+n+r}static parse(t,e,i=!1){return new s(On(Tn(t),e),i)}},On=(s,t)=>t?Object.assign({},t,s):s,Tn=s=>s.replace(/\n$/,"").split(`
-`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),mt=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),y=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[mt]=!1;[y];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){this[$]||(this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1}))}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[y]===void 0||this.brotli===void 0&&this[y]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[y]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[y]=!1);let o=!1;if(this[y]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[y]===!1&&h)if(t.length<512)if(this[mt])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[y]===void 0||this[y]===!1&&(this.brotli||o)){let a=this[mt];this[mt]=!1,this[y]=this[y]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[y].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[y].on("error",c=>{this[$]||this.abort(c)}),this[y].on("end",()=>{this[mt]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[y][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[y]?(this[le]+=t.length,this[y].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[mt]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[mt])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[y]?(t&&(this[le]+=t.length,this[y].write(t)),this[y].end()):(this[mt]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var ut=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(n=>[ut(n),!0])),i=s.filter,r=(n,o="")=>{let h=o||kn(n).root||".",a;if(n===h)a=!1;else{let l=e.get(n);a=l!==void 0?l:r(Fn(n),h)}return e.set(n,a),a};s.filter=i?(n,o)=>i(n,o)&&r(ut(n)):n=>r(ut(n))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import ui from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),ut(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new me(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new me(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new me(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var me=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),ue=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),ms=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),mi=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[mi];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[ue]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[mi]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[ue]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[ue]=!0,this[Ft](),i&&i(),this}write(t){if(this[ue])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";ui[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[ms](t){t.pending=!0,this[G]+=1,ui.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[ue]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[ms](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[mi](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[mi]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,ui[e](t.absolute))}[ms](t){this[fi](t,ui.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import m from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:mr,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,ur=!Er&&typeof mr=="number"?mr|Sr|wr|yr:null,us=ur!==null?()=>ur:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),S=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>S(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,S);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>S(null,E??void 0),S);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,S)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>ut(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",mo=1024,uo=(s,t)=>{if(!Te)return m.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");m.rename(s,e,i=>{if(i)return t(i);m.unlink(e,t)})},po=s=>{if(!Te)return m.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");m.renameSync(s,t),m.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:mo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:us(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&m.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&m.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&m.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;m.futimes(l,c,d,S=>S?m.utimes(a,c,d,T=>o(T&&S)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&m.fchown(l,c,d,S=>S?m.chown(a,c,d,T=>o(T&&S)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,m.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,m.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);m.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{m.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?m.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return m.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);uo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){m[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>m.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{m.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>m.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{m.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=m.openSync(String(t.absolute),us(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{m.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{m.futimesSync(n,a,l)}catch(c){try{m.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{m.fchownSync(n,Number(a),Number(l))}catch(c){try{m.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{m.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{m.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>m.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{m[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),S=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,S);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,S)};v.read(n,d,0,512,l,S)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,S)=>{if(d)return v.close(c,()=>o(d));i(c,S.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
+`).reduce(xn,Object.create(null)),xn=(s,t)=>{let e=parseInt(t,10);if(e!==Buffer.byteLength(t)+1)return s;t=t.slice((e+" ").length);let i=t.split("="),r=i.shift();if(!r)return s;let n=r.replace(/^SCHILY\.(dev|ino|nlink)/,"$1"),o=i.join("=").replace(/\0.*/,"");switch(n){case"path":case"linkpath":case"type":case"charset":case"comment":case"gname":case"uname":s[n]=o;break;case"ctime":case"atime":case"mtime":s[n]=new Date(Number(o)*1e3);break;case"size":let h=+o;h>=0&&(s[n]=h);break;case"gid":case"uid":case"dev":case"ino":case"nlink":case"mode":s[n]=+o;break}return s};var Ln=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,f=Ln!=="win32"?s=>String(s):s=>String(s).replaceAll(/\\/g,"/");var $e=class extends A{extended;globalExtended;header;startBlockSize;blockRemain;remain;type;meta=!1;ignore=!1;path;mode;uid;gid;uname;gname;size=0;mtime;atime;ctime;linkpath;dev;ino;nlink;invalid=!1;absolute;unsupported=!1;constructor(t,e,i){switch(super({}),this.pause(),this.extended=e,this.globalExtended=i,this.header=t,this.remain=t.size??0,this.startBlockSize=512*Math.ceil(this.remain/512),this.blockRemain=this.startBlockSize,this.type=t.type,this.type){case"File":case"OldFile":case"Link":case"SymbolicLink":case"CharacterDevice":case"BlockDevice":case"Directory":case"FIFO":case"ContiguousFile":case"GNUDumpDir":break;case"NextFileHasLongLinkpath":case"NextFileHasLongPath":case"OldGnuLongPath":case"GlobalExtendedHeader":case"ExtendedHeader":case"OldExtendedHeader":this.meta=!0;break;default:this.ignore=!0}if(!t.path)throw new Error("no path provided for tar.ReadEntry");this.path=f(t.path),this.mode=t.mode,this.mode&&(this.mode=this.mode&4095),this.uid=t.uid,this.gid=t.gid,this.uname=t.uname,this.gname=t.gname,this.size=this.remain,this.mtime=t.mtime,this.atime=t.atime,this.ctime=t.ctime,this.linkpath=t.linkpath?f(t.linkpath):void 0,this.uname=t.uname,this.gname=t.gname,e&&this.#t(e),i&&this.#t(i,!0)}write(t){let e=t.length;if(e>this.blockRemain)throw new Error("writing more to entry than is appropriate");let i=this.remain,r=this.blockRemain;return this.remain=Math.max(0,i-e),this.blockRemain=Math.max(0,r-e),this.ignore?!0:i>=e?super.write(t):super.write(t.subarray(0,i))}#t(t,e=!1){t.path&&(t.path=f(t.path)),t.linkpath&&(t.linkpath=f(t.linkpath)),Object.assign(this,Object.fromEntries(Object.entries(t).filter(([i,r])=>!(r==null||i==="path"&&e))))}};var Dt=(s,t,e,i={})=>{s.file&&(i.file=s.file),s.cwd&&(i.cwd=s.cwd),i.code=e instanceof Error&&e.code||t,i.tarCode=t,!s.strict&&i.recoverable!==!1?(e instanceof Error&&(i=Object.assign(e,i),e=e.message),s.emit("warn",t,e,i)):e instanceof Error?s.emit("error",Object.assign(e,i)):s.emit("error",Object.assign(new Error(`${t}: ${e}`),i))};var Nn=1024*1024,Xi=Buffer.from([31,139]),qi=Buffer.from([40,181,47,253]),An=Math.max(Xi.length,qi.length),B=Symbol("state"),Nt=Symbol("writeEntry"),it=Symbol("readEntry"),Zi=Symbol("nextEntry"),Zs=Symbol("processEntry"),V=Symbol("extendedHeader"),he=Symbol("globalExtendedHeader"),dt=Symbol("meta"),Ys=Symbol("emitMeta"),p=Symbol("buffer"),st=Symbol("queue"),ut=Symbol("ended"),Yi=Symbol("emittedEnd"),At=Symbol("emit"),w=Symbol("unzip"),Xe=Symbol("consumeChunk"),qe=Symbol("consumeChunkSub"),Ki=Symbol("consumeBody"),Ks=Symbol("consumeMeta"),Vs=Symbol("consumeHeader"),ae=Symbol("consuming"),Vi=Symbol("bufferConcat"),Qe=Symbol("maybeEnd"),Yt=Symbol("writing"),$=Symbol("aborted"),Je=Symbol("onDone"),It=Symbol("sawValidEntry"),je=Symbol("sawNullBlock"),ti=Symbol("sawEOF"),$s=Symbol("closeStream"),In=1e3,le=Symbol("compressedBytesRead"),$i=Symbol("decompressedBytesRead"),Xs=Symbol("checkDecompressionRatio"),Cn=()=>!0,rt=class extends Dn{file;strict;maxMetaEntrySize;filter;brotli;zstd;maxDecompressionRatio;writable=!0;readable=!1;[st]=[];[p];[it];[Nt];[B]="begin";[dt]="";[V];[he];[ut]=!1;[w];[$]=!1;[It];[je]=!1;[ti]=!1;[Yt]=!1;[ae]=!1;[Yi]=!1;[le]=0;[$i]=0;constructor(t={}){super(),this.file=t.file||"",this.on(Je,()=>{(this[B]==="begin"||this[It]===!1)&&this.warn("TAR_BAD_ARCHIVE","Unrecognized archive format")}),t.ondone?this.on(Je,t.ondone):this.on(Je,()=>{this.emit("prefinish"),this.emit("finish"),this.emit("end")}),this.strict=!!t.strict,this.maxDecompressionRatio=typeof t.maxDecompressionRatio=="number"?t.maxDecompressionRatio:In,this.maxMetaEntrySize=t.maxMetaEntrySize||Nn,this.filter=typeof t.filter=="function"?t.filter:Cn;let e=t.file&&(t.file.endsWith(".tar.br")||t.file.endsWith(".tbr"));this.brotli=!(t.gzip||t.zstd)&&t.brotli!==void 0?t.brotli:e?void 0:!1;let i=t.file&&(t.file.endsWith(".tar.zst")||t.file.endsWith(".tzst"));this.zstd=!(t.gzip||t.brotli)&&t.zstd!==void 0?t.zstd:i?!0:void 0,this.on("end",()=>this[$s]()),typeof t.onwarn=="function"&&this.on("warn",t.onwarn),typeof t.onReadEntry=="function"&&this.on("entry",t.onReadEntry)}warn(t,e,i={}){Dt(this,t,e,i)}[Vs](t,e){this[It]===void 0&&(this[It]=!1);let i;try{i=new F(t,e,this[V],this[he])}catch(r){return this.warn("TAR_ENTRY_INVALID",r)}if(i.nullBlock)this[je]?(this[ti]=!0,this[B]==="begin"&&(this[B]="header"),this[At]("eof")):(this[je]=!0,this[At]("nullBlock"));else if(this[je]=!1,!i.cksumValid)this.warn("TAR_ENTRY_INVALID","checksum failure",{header:i});else if(!i.path)this.warn("TAR_ENTRY_INVALID","path is required",{header:i});else{let r=i.type;if(/^(Symbolic)?Link$/.test(r)&&!i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath required",{header:i});else if(!/^(Symbolic)?Link$/.test(r)&&!/^(Global)?ExtendedHeader$/.test(r)&&i.linkpath)this.warn("TAR_ENTRY_INVALID","linkpath forbidden",{header:i});else{let n=this[Nt]=new $e(i,this[V],this[he]);if(!this[It])if(n.remain){let o=()=>{n.invalid||(this[It]=!0)};n.on("end",o)}else this[It]=!0;n.meta?n.size>this.maxMetaEntrySize?(n.ignore=!0,this[At]("ignoredEntry",n),this[B]="ignore",n.resume()):n.size>0&&(this[dt]="",n.on("data",o=>this[dt]+=o),this[B]="meta"):(this[V]=void 0,n.ignore=n.ignore||!this.filter(n.path,n),n.ignore?(this[At]("ignoredEntry",n),this[B]=n.remain?"ignore":"header",n.resume()):(n.remain?this[B]="body":(this[B]="header",n.end()),this[it]?this[st].push(n):(this[st].push(n),this[Zi]())))}}}[$s](){queueMicrotask(()=>this.emit("close"))}[Zs](t){let e=!0;if(!t)this[it]=void 0,e=!1;else if(Array.isArray(t)){let[i,...r]=t;this.emit(i,...r)}else this[it]=t,this.emit("entry",t),t.emittedEnd||(t.on("end",()=>this[Zi]()),e=!1);return e}[Zi](){do;while(this[Zs](this[st].shift()));if(this[st].length===0){let t=this[it];!t||t.flowing||t.size===t.remain?this[Yt]||this.emit("drain"):t.once("drain",()=>this.emit("drain"))}}[Ki](t,e){let i=this[Nt];if(!i)throw new Error("attempt to consume body without entry??");let r=i.blockRemain??0,n=r>=t.length&&e===0?t:t.subarray(e,e+r);return i.write(n),i.blockRemain||(this[B]="header",this[Nt]=void 0,i.end()),n.length}[Ks](t,e){let i=this[Nt],r=this[Ki](t,e);return!this[Nt]&&i&&this[Ys](i),r}[At](t,e,i){this[st].length===0&&!this[it]?this.emit(t,e,i):this[st].push([t,e,i])}[Ys](t){switch(this[At]("meta",this[dt]),t.type){case"ExtendedHeader":case"OldExtendedHeader":this[V]=ft.parse(this[dt],this[V],!1);break;case"GlobalExtendedHeader":this[he]=ft.parse(this[dt],this[he],!0);break;case"NextFileHasLongPath":case"OldGnuLongPath":{let e=this[V]??Object.create(null);this[V]=e,e.path=this[dt].replace(/\0.*/,"");break}case"NextFileHasLongLinkpath":{let e=this[V]||Object.create(null);this[V]=e,e.linkpath=this[dt].replace(/\0.*/,"");break}default:throw new Error("unknown meta: "+t.type)}}abort(t){if(!this[$]){if(this[w]){let e=this[w];e.write=()=>!0,e.end=()=>e,e.emit=()=>!1,e.destroy?.()}this[$]=!0,this.emit("abort",t),this.warn("TAR_ABORT",t,{recoverable:!1})}}[Xs](t){this[$i]+=t.length;let e=this[$i]/this[le];return e>this.maxDecompressionRatio?(this.abort(new Error(`max decompression ratio exceeded: ${e.toFixed(2)} > ${this.maxDecompressionRatio}`)),!1):!0}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this[$])return i?.(),!1;if((this[w]===void 0||this.brotli===void 0&&this[w]===!1)&&t){if(this[p]&&(t=Buffer.concat([this[p],t]),this[p]=void 0),t.length<An)return this[p]=t,i?.(),!0;for(let a=0;this[w]===void 0&&a<Xi.length;a++)t[a]!==Xi[a]&&(this[w]=!1);let o=!1;if(this[w]===!1&&this.zstd!==!1){o=!0;for(let a=0;a<qi.length;a++)if(t[a]!==qi[a]){o=!1;break}}let h=this.brotli===void 0&&!o;if(this[w]===!1&&h)if(t.length<512)if(this[ut])this.brotli=!0;else return this[p]=t,i?.(),!0;else try{new F(t.subarray(0,512)),this.brotli=!1}catch{this.brotli=!0}if(this[w]===void 0||this[w]===!1&&(this.brotli||o)){let a=this[ut];this[ut]=!1,this[w]=this[w]===void 0?new Ue({}):o?new Ke({}):new Ge({}),this[w].on("data",c=>{this[Xs](c)&&this[Xe](c)}),this[w].on("error",c=>{this[$]||this.abort(c)}),this[w].on("end",()=>{this[ut]=!0,this[Xe]()}),this[Yt]=!0,this[le]+=t.length;let l=!!this[w][a?"end":"write"](t);return this[Yt]=!1,i?.(),l}}this[Yt]=!0,this[w]?(this[le]+=t.length,this[w].write(t)):this[Xe](t),this[Yt]=!1;let n=this[st].length>0?!1:this[it]?this[it].flowing:!0;return!n&&this[st].length===0&&this[it]?.once("drain",()=>this.emit("drain")),i?.(),n}[Vi](t){t&&!this[$]&&(this[p]=this[p]?Buffer.concat([this[p],t]):t)}[Qe](){if(this[ut]&&!this[Yi]&&!this[$]&&!this[ae]){this[Yi]=!0;let t=this[Nt];if(t?.blockRemain){let e=this[p]?this[p].length:0;this.warn("TAR_BAD_ARCHIVE",`Truncated input (needed ${t.blockRemain} more bytes, only ${e} available)`,{entry:t}),this[p]&&t.write(this[p]),t.end()}this[At](Je)}}[Xe](t){if(this[ae]&&t)this[Vi](t);else if(!t&&!this[p])this[Qe]();else if(t){if(this[ae]=!0,this[p]){this[Vi](t);let e=this[p];this[p]=void 0,this[qe](e)}else this[qe](t);for(;this[p]&&this[p]?.length>=512&&!this[$]&&!this[ti];){let e=this[p];this[p]=void 0,this[qe](e)}this[ae]=!1}(!this[p]||this[ut])&&this[Qe]()}[qe](t){let e=0,i=t.length;for(;e+512<=i&&!this[$]&&!this[ti];)switch(this[B]){case"begin":case"header":this[Vs](t,e),e+=512;break;case"ignore":case"body":e+=this[Ki](t,e);break;case"meta":e+=this[Ks](t,e);break;default:throw new Error("invalid state: "+this[B])}e<i&&(this[p]=this[p]?Buffer.concat([t.subarray(e),this[p]]):t.subarray(e))}end(t,e,i){return typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e)),i&&this.once("finish",i),this[$]||(this[w]?(t&&(this[le]+=t.length,this[w].write(t)),this[w].end()):(this[ut]=!0,(this.brotli===void 0||this.zstd===void 0)&&(t=t||Buffer.alloc(0)),t&&this.write(t),this[Qe]())),this}};var mt=s=>{let t=s.length-1,e=-1;for(;t>-1&&s.charAt(t)==="/";)e=t,t--;return e===-1?s:s.slice(0,e)};var vn=s=>{let t=s.onReadEntry;s.onReadEntry=t?e=>{t(e),e.resume()}:e=>e.resume()},Qi=(s,t)=>{let e=new Map(t.map(o=>[mt(o),!0])),i=s.filter,r=100,n=(o,h="",a=0)=>{if(a>=r)return e.set(o,!1),!1;let l=h||kn(o).root||".",c;if(o===l)c=!1;else{let d=e.get(o);c=d!==void 0?d:n(Fn(o),l,a+1)}return e.set(o,c),c};s.filter=i?(o,h)=>i(o,h)&&n(mt(o)):o=>n(mt(o))},Mn=s=>{let t=new rt(s),e=s.file,i;try{i=Kt.openSync(e,"r");let r=Kt.fstatSync(i),n=s.maxReadSize||16*1024*1024;if(r.size<n){let o=Buffer.allocUnsafe(r.size),h=Kt.readSync(i,o,0,r.size,0);t.end(h===o.byteLength?o:o.subarray(0,h))}else{let o=0,h=Buffer.allocUnsafe(n);for(;o<r.size;){let a=Kt.readSync(i,h,0,n,o);if(a===0)break;o+=a,t.write(h.subarray(0,a))}t.end()}}finally{if(typeof i=="number")try{Kt.closeSync(i)}catch{}}},Bn=(s,t)=>{let e=new rt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("end",o),Kt.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},Ct=K(Mn,Bn,s=>new rt(s),s=>new rt(s),(s,t)=>{t?.length&&Qi(s,t),s.noResume||vn(s)});import mi from"fs";import X from"fs";import js from"path";var Ji=(s,t,e)=>(s&=4095,e&&(s=(s|384)&-19),t&&(s&256&&(s|=64),s&32&&(s|=8),s&4&&(s|=1)),s);import{win32 as Pn}from"node:path";var{isAbsolute:zn,parse:qs}=Pn,ce=s=>{let t="",e=qs(s);for(;zn(s)||e.root;){let i=s.charAt(0)==="/"&&s.slice(0,4)!=="//?/"?"/":e.root;s=s.slice(i.length),t+=i,e=qs(s)}return[t,s]};var ei=["|","<",">","?",":"],ji=ei.map(s=>String.fromCodePoint(61440+Number(s.codePointAt(0)))),Un=new Map(ei.map((s,t)=>[s,ji[t]])),Hn=new Map(ji.map((s,t)=>[s,ei[t]])),ts=s=>ei.reduce((t,e)=>t.split(e).join(Un.get(e)),s),Qs=s=>ji.reduce((t,e)=>t.split(e).join(Hn.get(e)),s);var rr=(s,t)=>t?(s=f(s).replace(/^\.(\/|$)/,""),mt(t)+"/"+s):f(s),Wn=16*1024*1024,tr=Symbol("process"),er=Symbol("file"),ir=Symbol("directory"),is=Symbol("symlink"),sr=Symbol("hardlink"),fe=Symbol("header"),ii=Symbol("read"),ss=Symbol("lstat"),si=Symbol("onlstat"),rs=Symbol("onread"),ns=Symbol("onreadlink"),os=Symbol("openfile"),hs=Symbol("onopenfile"),pt=Symbol("close"),ri=Symbol("mode"),as=Symbol("awaitDrain"),es=Symbol("ondrain"),q=Symbol("prefix"),de=class extends A{path;portable;myuid=process.getuid&&process.getuid()||0;myuser=process.env.USER||"";maxReadSize;linkCache;statCache;preservePaths;cwd;strict;mtime;noPax;noMtime;prefix;fd;blockLen=0;blockRemain=0;buf;pos=0;remain=0;length=0;offset=0;win32;absolute;header;type;linkpath;stat;onWriteEntry;#t=!1;constructor(t,e={}){let i=se(e);super(),this.path=f(t),this.portable=!!i.portable,this.maxReadSize=i.maxReadSize||Wn,this.linkCache=i.linkCache||new Map,this.statCache=i.statCache||new Map,this.preservePaths=!!i.preservePaths,this.cwd=f(i.cwd||process.cwd()),this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.mtime=i.mtime,this.prefix=i.prefix?f(i.prefix):void 0,this.onWriteEntry=i.onWriteEntry,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let r=!1;if(!this.preservePaths){let[o,h]=ce(this.path);o&&typeof h=="string"&&(this.path=h,r=o)}this.win32=!!i.win32||process.platform==="win32",this.win32&&(this.path=Qs(this.path.replaceAll(/\\/g,"/")),t=t.replaceAll(/\\/g,"/")),this.absolute=f(i.absolute||js.resolve(this.cwd,t)),this.path===""&&(this.path="./"),r&&this.warn("TAR_ENTRY_INFO",`stripping ${r} from absolute path`,{entry:this,path:r+this.path});let n=this.statCache.get(this.absolute);n?this[si](n):this[ss]()}warn(t,e,i={}){return Dt(this,t,e,i)}emit(t,...e){return t==="error"&&(this.#t=!0),super.emit(t,...e)}[ss](){X.lstat(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[si](e)})}[si](t){this.statCache.set(this.absolute,t),this.stat=t,t.isFile()||(t.size=0),this.type=Gn(t),this.emit("stat",t),this[tr]()}[tr](){switch(this.type){case"File":return this[er]();case"Directory":return this[ir]();case"SymbolicLink":return this[is]();default:return this.end()}}[ri](t){return Ji(t,this.type==="Directory",this.portable)}[q](t){return rr(t,this.prefix)}[fe](){if(!this.stat)throw new Error("cannot write header before stat");this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this[ri](this.stat.mode),uid:this.portable?void 0:this.stat.uid,gid:this.portable?void 0:this.stat.gid,size:this.stat.size,mtime:this.noMtime?void 0:this.mtime||this.stat.mtime,type:this.type==="Unsupported"?void 0:this.type,uname:this.portable?void 0:this.stat.uid===this.myuid?this.myuser:"",atime:this.portable?void 0:this.stat.atime,ctime:this.portable?void 0:this.stat.ctime}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.header.atime,ctime:this.portable?void 0:this.header.ctime,gid:this.portable?void 0:this.header.gid,mtime:this.noMtime?void 0:this.mtime||this.header.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.header.size,uid:this.portable?void 0:this.header.uid,uname:this.portable?void 0:this.header.uname,dev:this.portable?void 0:this.stat.dev,ino:this.portable?void 0:this.stat.ino,nlink:this.portable?void 0:this.stat.nlink}).encode());let t=this.header?.block;if(!t)throw new Error("failed to encode header");super.write(t)}[ir](){if(!this.stat)throw new Error("cannot create directory entry without stat");this.path.slice(-1)!=="/"&&(this.path+="/"),this.stat.size=0,this[fe](),this.end()}[is](){X.readlink(this.absolute,(t,e)=>{if(t)return this.emit("error",t);this[ns](e)})}[ns](t){this.linkpath=f(t),this[fe](),this.end()}[sr](t){if(!this.stat)throw new Error("cannot create link entry without stat");this.type="Link",this.linkpath=f(js.relative(this.cwd,t)),this.stat.size=0,this[fe](),this.end()}[er](){if(!this.stat)throw new Error("cannot create file entry without stat");if(this.stat.nlink>1){let t=`${this.stat.dev}:${this.stat.ino}`,e=this.linkCache.get(t);if(e?.indexOf(this.cwd)===0)return this[sr](e);this.linkCache.set(t,this.absolute)}if(this[fe](),this.stat.size===0)return this.end();this[os]()}[os](){X.open(this.absolute,"r",(t,e)=>{if(t)return this.emit("error",t);this[hs](e)})}[hs](t){if(this.fd=t,this.#t)return this[pt]();if(!this.stat)throw new Error("should stat before calling onopenfile");this.blockLen=512*Math.ceil(this.stat.size/512),this.blockRemain=this.blockLen;let e=Math.min(this.blockLen,this.maxReadSize);this.buf=Buffer.allocUnsafe(e),this.offset=0,this.pos=0,this.remain=this.stat.size,this.length=this.buf.length,this[ii]()}[ii](){let{fd:t,buf:e,offset:i,length:r,pos:n}=this;if(t===void 0||e===void 0)throw new Error("cannot read file without first opening");X.read(t,e,i,r,n,(o,h)=>{if(o)return this[pt](()=>this.emit("error",o));this[rs](h)})}[pt](t=()=>{}){this.fd!==void 0&&X.close(this.fd,t)}[rs](t){if(t<=0&&this.remain>0){let r=Object.assign(new Error("encountered unexpected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(t>this.remain){let r=Object.assign(new Error("did not encounter expected EOF"),{path:this.absolute,syscall:"read",code:"EOF"});return this[pt](()=>this.emit("error",r))}if(!this.buf)throw new Error("should have created buffer prior to reading");if(t===this.remain)for(let r=t;r<this.length&&t<this.blockRemain;r++)this.buf[r+this.offset]=0,t++,this.remain++;let e=this.offset===0&&t===this.buf.length?this.buf:this.buf.subarray(this.offset,this.offset+t);this.write(e)?this[es]():this[as](()=>this[es]())}[as](t){this.once("drain",t)}write(t,e,i){if(typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8")),this.blockRemain<t.length){let r=Object.assign(new Error("writing more data than expected"),{path:this.absolute});return this.emit("error",r)}return this.remain-=t.length,this.blockRemain-=t.length,this.pos+=t.length,this.offset+=t.length,super.write(t,null,i)}[es](){if(!this.remain)return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),this[pt](t=>t?this.emit("error",t):this.end());if(!this.buf)throw new Error("buffer lost somehow in ONDRAIN");this.offset>=this.length&&(this.buf=Buffer.allocUnsafe(Math.min(this.blockRemain,this.buf.length)),this.offset=0),this.length=this.buf.length-this.offset,this[ii]()}},ni=class extends de{sync=!0;[ss](){this[si](X.lstatSync(this.absolute))}[is](){this[ns](X.readlinkSync(this.absolute))}[os](){this[hs](X.openSync(this.absolute,"r"))}[ii](){let t=!0;try{let{fd:e,buf:i,offset:r,length:n,pos:o}=this;if(e===void 0||i===void 0)throw new Error("fd and buf must be set in READ method");let h=X.readSync(e,i,r,n,o);this[rs](h),t=!1}finally{if(t)try{this[pt](()=>{})}catch{}}}[as](t){t()}[pt](t=()=>{}){this.fd!==void 0&&X.closeSync(this.fd),t()}},oi=class extends A{blockLen=0;blockRemain=0;buf=0;pos=0;remain=0;length=0;preservePaths;portable;strict;noPax;noMtime;readEntry;type;prefix;path;mode;uid;gid;uname;gname;header;mtime;atime;ctime;linkpath;size;onWriteEntry;warn(t,e,i={}){return Dt(this,t,e,i)}constructor(t,e={}){let i=se(e);super(),this.preservePaths=!!i.preservePaths,this.portable=!!i.portable,this.strict=!!i.strict,this.noPax=!!i.noPax,this.noMtime=!!i.noMtime,this.onWriteEntry=i.onWriteEntry,this.readEntry=t;let{type:r}=t;if(r==="Unsupported")throw new Error("writing entry that should be ignored");this.type=r,this.type==="Directory"&&this.portable&&(this.noMtime=!0),this.prefix=i.prefix,this.path=f(t.path),this.mode=t.mode!==void 0?this[ri](t.mode):void 0,this.uid=this.portable?void 0:t.uid,this.gid=this.portable?void 0:t.gid,this.uname=this.portable?void 0:t.uname,this.gname=this.portable?void 0:t.gname,this.size=t.size,this.mtime=this.noMtime?void 0:i.mtime||t.mtime,this.atime=this.portable?void 0:t.atime,this.ctime=this.portable?void 0:t.ctime,this.linkpath=t.linkpath!==void 0?f(t.linkpath):void 0,typeof i.onwarn=="function"&&this.on("warn",i.onwarn);let n=!1;if(!this.preservePaths){let[h,a]=ce(this.path);h&&typeof a=="string"&&(this.path=a,n=h)}this.remain=t.size,this.blockRemain=t.startBlockSize,this.onWriteEntry?.(this),this.header=new F({path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,mode:this.mode,uid:this.portable?void 0:this.uid,gid:this.portable?void 0:this.gid,size:this.size,mtime:this.noMtime?void 0:this.mtime,type:this.type,uname:this.portable?void 0:this.uname,atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime}),n&&this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute path`,{entry:this,path:n+this.path}),this.header.encode()&&!this.noPax&&super.write(new ft({atime:this.portable?void 0:this.atime,ctime:this.portable?void 0:this.ctime,gid:this.portable?void 0:this.gid,mtime:this.noMtime?void 0:this.mtime,path:this[q](this.path),linkpath:this.type==="Link"&&this.linkpath!==void 0?this[q](this.linkpath):this.linkpath,size:this.size,uid:this.portable?void 0:this.uid,uname:this.portable?void 0:this.uname,dev:this.portable?void 0:this.readEntry.dev,ino:this.portable?void 0:this.readEntry.ino,nlink:this.portable?void 0:this.readEntry.nlink}).encode());let o=this.header?.block;if(!o)throw new Error("failed to encode header");super.write(o),t.pipe(this)}[q](t){return rr(t,this.prefix)}[ri](t){return Ji(t,this.type==="Directory",this.portable)}write(t,e,i){typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,typeof e=="string"?e:"utf8"));let r=t.length;if(r>this.blockRemain)throw new Error("writing more to entry than is appropriate");return this.blockRemain-=r,super.write(t,i)}end(t,e,i){return this.blockRemain&&super.write(Buffer.alloc(this.blockRemain)),typeof t=="function"&&(i=t,e=void 0,t=void 0),typeof e=="function"&&(i=e,e=void 0),typeof t=="string"&&(t=Buffer.from(t,e??"utf8")),i&&this.once("finish",i),t?super.end(t,i):super.end(i),this}},Gn=s=>s.isFile()?"File":s.isDirectory()?"Directory":s.isSymbolicLink()?"SymbolicLink":"Unsupported";var hi=class s{tail;head;length=0;static create(t=[]){return new s(t)}constructor(t=[]){for(let e of t)this.push(e)}*[Symbol.iterator](){for(let t=this.head;t;t=t.next)yield t.value}removeNode(t){if(t.list!==this)throw new Error("removing node which does not belong to this list");let e=t.next,i=t.prev;return e&&(e.prev=i),i&&(i.next=e),t===this.head&&(this.head=e),t===this.tail&&(this.tail=i),this.length--,t.next=void 0,t.prev=void 0,t.list=void 0,e}unshiftNode(t){if(t===this.head)return;t.list&&t.list.removeNode(t);let e=this.head;t.list=this,t.next=e,e&&(e.prev=t),this.head=t,this.tail||(this.tail=t),this.length++}pushNode(t){if(t===this.tail)return;t.list&&t.list.removeNode(t);let e=this.tail;t.list=this,t.prev=e,e&&(e.next=t),this.tail=t,this.head||(this.head=t),this.length++}push(...t){for(let e=0,i=t.length;e<i;e++)Yn(this,t[e]);return this.length}unshift(...t){for(var e=0,i=t.length;e<i;e++)Kn(this,t[e]);return this.length}pop(){if(!this.tail)return;let t=this.tail.value,e=this.tail;return this.tail=this.tail.prev,this.tail?this.tail.next=void 0:this.head=void 0,e.list=void 0,this.length--,t}shift(){if(!this.head)return;let t=this.head.value,e=this.head;return this.head=this.head.next,this.head?this.head.prev=void 0:this.tail=void 0,e.list=void 0,this.length--,t}forEach(t,e){e=e||this;for(let i=this.head,r=0;i;r++)t.call(e,i.value,r,this),i=i.next}forEachReverse(t,e){e=e||this;for(let i=this.tail,r=this.length-1;i;r--)t.call(e,i.value,r,this),i=i.prev}get(t){let e=0,i=this.head;for(;i&&e<t;e++)i=i.next;if(e===t&&i)return i.value}getReverse(t){let e=0,i=this.tail;for(;i&&e<t;e++)i=i.prev;if(e===t&&i)return i.value}map(t,e){e=e||this;let i=new s;for(let r=this.head;r;)i.push(t.call(e,r.value,this)),r=r.next;return i}mapReverse(t,e){e=e||this;var i=new s;for(let r=this.tail;r;)i.push(t.call(e,r.value,this)),r=r.prev;return i}reduce(t,e){let i,r=this.head;if(arguments.length>1)i=e;else if(this.head)r=this.head.next,i=this.head.value;else throw new TypeError("Reduce of empty list with no initial value");for(var n=0;r;n++)i=t(i,r.value,n),r=r.next;return i}reduceReverse(t,e){let i,r=this.tail;if(arguments.length>1)i=e;else if(this.tail)r=this.tail.prev,i=this.tail.value;else throw new TypeError("Reduce of empty list with no initial value");for(let n=this.length-1;r;n--)i=t(i,r.value,n),r=r.prev;return i}toArray(){let t=new Array(this.length);for(let e=0,i=this.head;i;e++)t[e]=i.value,i=i.next;return t}toArrayReverse(){let t=new Array(this.length);for(let e=0,i=this.tail;i;e++)t[e]=i.value,i=i.prev;return t}slice(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.head,n=0;for(n=0;r&&n<t;n++)r=r.next;for(;r&&n<e;n++,r=r.next)i.push(r.value);return i}sliceReverse(t=0,e=this.length){e<0&&(e+=this.length),t<0&&(t+=this.length);let i=new s;if(e<t||e<0)return i;t<0&&(t=0),e>this.length&&(e=this.length);let r=this.length,n=this.tail;for(;n&&r>e;r--)n=n.prev;for(;n&&r>t;r--,n=n.prev)i.push(n.value);return i}splice(t,e=0,...i){t>this.length&&(t=this.length-1),t<0&&(t=this.length+t);let r=this.head;for(let o=0;r&&o<t;o++)r=r.next;let n=[];for(let o=0;r&&o<e;o++)n.push(r.value),r=this.removeNode(r);r?r!==this.tail&&(r=r.prev):r=this.tail;for(let o of i)r=Zn(this,r,o);return n}reverse(){let t=this.head,e=this.tail;for(let i=t;i;i=i.prev){let r=i.prev;i.prev=i.next,i.next=r}return this.head=e,this.tail=t,this}};function Zn(s,t,e){let i=t,r=t?t.next:s.head,n=new ue(e,i,r,s);return n.next===void 0&&(s.tail=n),n.prev===void 0&&(s.head=n),s.length++,n}function Yn(s,t){s.tail=new ue(t,s.tail,void 0,s),s.head||(s.head=s.tail),s.length++}function Kn(s,t){s.head=new ue(t,void 0,s.head,s),s.tail||(s.tail=s.head),s.length++}var ue=class{list;next;prev;value;constructor(t,e,i,r){this.list=r,this.value=t,e?(e.next=this,this.prev=e):this.prev=void 0,i?(i.prev=this,this.next=i):this.next=void 0}};import ar from"path";var pi=class{path;absolute;entry;stat;readdir;pending=!1;pendingLink=!1;ignore=!1;piped=!1;constructor(t,e){this.path=t||"./",this.absolute=e}},nr=Buffer.alloc(1024),li=Symbol("onStat"),me=Symbol("ended"),W=Symbol("queue"),pe=Symbol("pendingLinks"),Et=Symbol("current"),Ft=Symbol("process"),Ee=Symbol("processing"),ai=Symbol("processJob"),G=Symbol("jobs"),ls=Symbol("jobDone"),ci=Symbol("addFSEntry"),or=Symbol("addTarEntry"),ds=Symbol("stat"),us=Symbol("readdir"),fi=Symbol("onreaddir"),di=Symbol("pipe"),hr=Symbol("entry"),cs=Symbol("entryOpt"),ui=Symbol("writeEntryClass"),lr=Symbol("write"),fs=Symbol("ondrain"),wt=class extends A{sync=!1;opt;cwd;maxReadSize;preservePaths;strict;noPax;prefix;linkCache;statCache;file;portable;zip;readdirCache;noDirRecurse;follow;noMtime;mtime;filter;jobs;[ui];onWriteEntry;[W];[pe]=new Map;[G]=0;[Ee]=!1;[me]=!1;constructor(t={}){if(super(),this.opt=t,this.file=t.file||"",this.cwd=t.cwd||process.cwd(),this.maxReadSize=t.maxReadSize,this.preservePaths=!!t.preservePaths,this.strict=!!t.strict,this.noPax=!!t.noPax,this.prefix=f(t.prefix||""),this.linkCache=t.linkCache||new Map,this.statCache=t.statCache||new Map,this.readdirCache=t.readdirCache||new Map,this.onWriteEntry=t.onWriteEntry,this[ui]=de,typeof t.onwarn=="function"&&this.on("warn",t.onwarn),this.portable=!!t.portable,t.gzip||t.brotli||t.zstd){if((t.gzip?1:0)+(t.brotli?1:0)+(t.zstd?1:0)>1)throw new TypeError("gzip, brotli, zstd are mutually exclusive");if(t.gzip&&(typeof t.gzip!="object"&&(t.gzip={}),this.portable&&(t.gzip.portable=!0),this.zip=new ze(t.gzip)),t.brotli&&(typeof t.brotli!="object"&&(t.brotli={}),this.zip=new We(t.brotli)),t.zstd&&(typeof t.zstd!="object"&&(t.zstd={}),this.zip=new Ye(t.zstd)),!this.zip)throw new Error("impossible");let e=this.zip;e.on("data",i=>super.write(i)),e.on("end",()=>super.end()),e.on("drain",()=>this[fs]()),this.on("resume",()=>e.resume())}else this.on("drain",this[fs]);this.noDirRecurse=!!t.noDirRecurse,this.follow=!!t.follow,this.noMtime=!!t.noMtime,t.mtime&&(this.mtime=t.mtime),this.filter=typeof t.filter=="function"?t.filter:()=>!0,this[W]=new hi,this[G]=0,this.jobs=Number(t.jobs)||4,this[Ee]=!1,this[me]=!1}[lr](t){return super.write(t)}add(t){return this.write(t),this}end(t,e,i){return typeof t=="function"&&(i=t,t=void 0),typeof e=="function"&&(i=e,e=void 0),t&&this.add(t),this[me]=!0,this[Ft](),i&&i(),this}write(t){if(this[me])throw new Error("write after end");return typeof t=="string"?this[ci](t):this[or](t),this.flowing}[or](t){let e=f(ar.resolve(this.cwd,t.path));if(!this.filter(t.path,t))t.resume();else{let i=new pi(t.path,e);i.entry=new oi(t,this[cs](i)),i.entry.on("end",()=>this[ls](i)),this[G]+=1,this[W].push(i)}this[Ft]()}[ci](t){let e=f(ar.resolve(this.cwd,t));this[W].push(new pi(t,e)),this[Ft]()}[ds](t){t.pending=!0,this[G]+=1;let e=this.follow?"stat":"lstat";mi[e](t.absolute,(i,r)=>{t.pending=!1,this[G]-=1,i?this.emit("error",i):this[li](t,r)})}[li](t,e){if(this.statCache.set(t.absolute,e),t.stat=e,!this.filter(t.path,e))t.ignore=!0;else if(e.isFile()&&e.nlink>1&&!this.linkCache.get(`${e.dev}:${e.ino}`)&&!this.sync)if(t===this[Et])this[ai](t);else{let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);r?r.push(t):this[pe].set(i,[t]),t.pendingLink=!0,t.pending=!0}this[Ft]()}[us](t){t.pending=!0,this[G]+=1,mi.readdir(t.absolute,(e,i)=>{if(t.pending=!1,this[G]-=1,e)return this.emit("error",e);this[fi](t,i)})}[fi](t,e){this.readdirCache.set(t.absolute,e),t.readdir=e,this[Ft]()}[Ft](){if(!this[Ee]){this[Ee]=!0;for(let t=this[W].head;t&&this[G]<this.jobs;t=t.next)if(this[ai](t.value),t.value.ignore){let e=t.next;this[W].removeNode(t),t.next=e}this[Ee]=!1,this[me]&&this[W].length===0&&this[G]===0&&(this.zip?this.zip.end(nr):(super.write(nr),super.end()))}}get[Et](){return this[W]&&this[W].head&&this[W].head.value}[ls](t){this[W].shift(),this[G]-=1;let{stat:e}=t;if(e&&e.isFile()&&e.nlink>1){let i=`${e.dev}:${e.ino}`,r=this[pe].get(i);if(r){this[pe].delete(i);for(let n of r)n.pending=!1,this[ai](n)}}this[Ft]()}[ai](t){if(t.pending&&t.pendingLink&&t===this[Et]&&(t.pending=!1,t.pendingLink=!1),!t.pending){if(t.entry){t===this[Et]&&!t.piped&&this[di](t);return}if(!t.stat){let e=this.statCache.get(t.absolute);e?this[li](t,e):this[ds](t)}if(t.stat&&!t.ignore){if(!this.noDirRecurse&&t.stat.isDirectory()&&!t.readdir){let e=this.readdirCache.get(t.absolute);if(e?this[fi](t,e):this[us](t),!t.readdir)return}if(t.entry=this[hr](t),!t.entry){t.ignore=!0;return}t===this[Et]&&!t.piped&&this[di](t)}}}[cs](t){return{onwarn:(e,i,r)=>this.warn(e,i,r),noPax:this.noPax,cwd:this.cwd,absolute:t.absolute,preservePaths:this.preservePaths,maxReadSize:this.maxReadSize,strict:this.strict,portable:this.portable,linkCache:this.linkCache,statCache:this.statCache,noMtime:this.noMtime,mtime:this.mtime,prefix:this.prefix,onWriteEntry:this.onWriteEntry}}[hr](t){this[G]+=1;try{return new this[ui](t.path,this[cs](t)).on("end",()=>this[ls](t)).on("error",i=>this.emit("error",i))}catch(e){this.emit("error",e)}}[fs](){this[Et]&&this[Et].entry&&this[Et].entry.resume()}[di](t){t.piped=!0,t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)});let e=t.entry,i=this.zip;if(!e)throw new Error("cannot pipe without source");i?e.on("data",r=>{i.write(r)||e.pause()}):e.on("data",r=>{super.write(r)||e.pause()})}pause(){return this.zip&&this.zip.pause(),super.pause()}warn(t,e,i={}){Dt(this,t,e,i)}},kt=class extends wt{sync=!0;constructor(t){super(t),this[ui]=ni}pause(){}resume(){}[ds](t){let e=this.follow?"statSync":"lstatSync";this[li](t,mi[e](t.absolute))}[us](t){this[fi](t,mi.readdirSync(t.absolute))}[di](t){let e=t.entry,i=this.zip;if(t.readdir&&t.readdir.forEach(r=>{let n=t.path,o=n==="./"?"":n.replace(/\/*$/,"/");this[ci](o+r)}),!e)throw new Error("Cannot pipe without source");i?e.on("data",r=>{i.write(r)}):e.on("data",r=>{super[lr](r)})}};var Vn=(s,t)=>{let e=new kt(s),i=new Wt(s.file,{mode:s.mode||438});e.pipe(i),fr(e,t)},$n=(s,t)=>{let e=new wt(s),i=new et(s.file,{mode:s.mode||438});e.pipe(i);let r=new Promise((n,o)=>{i.on("error",o),i.on("close",n),e.on("error",o)});return dr(e,t).catch(n=>e.emit("error",n)),r},fr=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:cr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},dr=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:cr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>{s.add(i)}}):s.add(e);s.end()},Xn=(s,t)=>{let e=new kt(s);return fr(e,t),e},qn=(s,t)=>{let e=new wt(s);return dr(e,t).catch(i=>e.emit("error",i)),e},Qn=K(Vn,$n,Xn,qn,(s,t)=>{if(!t?.length)throw new TypeError("no paths specified to add to archive")});import Br from"node:fs";import co from"node:assert";import{randomBytes as Mr}from"node:crypto";import u from"node:fs";import R from"node:path";import pr from"fs";var Jn=process.env.__FAKE_PLATFORM__||process.platform,Er=Jn==="win32",{O_CREAT:wr,O_NOFOLLOW:ur,O_TRUNC:Sr,O_WRONLY:yr}=pr.constants,Rr=Number(process.env.__FAKE_FS_O_FILENAME__)||pr.constants.UV_FS_O_FILEMAP||0,jn=Er&&!!Rr,to=512*1024,eo=Rr|Sr|wr|yr,mr=!Er&&typeof ur=="number"?ur|Sr|wr|yr:null,ms=mr!==null?()=>mr:jn?s=>s<to?eo:"w":()=>"w";import wi from"node:fs";import we from"node:path";var ps=(s,t,e)=>{try{return wi.lchownSync(s,t,e)}catch(i){if(i?.code!=="ENOENT")throw i}},Ei=(s,t,e,i)=>{wi.lchown(s,t,e,r=>{i(r&&r?.code!=="ENOENT"?r:null)})},io=(s,t,e,i,r)=>{if(t.isDirectory())Es(we.resolve(s,t.name),e,i,n=>{if(n)return r(n);let o=we.resolve(s,t.name);Ei(o,e,i,r)});else{let n=we.resolve(s,t.name);Ei(n,e,i,r)}},Es=(s,t,e,i)=>{wi.readdir(s,{withFileTypes:!0},(r,n)=>{if(r){if(r.code==="ENOENT")return i();if(r.code!=="ENOTDIR"&&r.code!=="ENOTSUP")return i(r)}if(r||!n.length)return Ei(s,t,e,i);let o=n.length,h=null,a=l=>{if(!h){if(l)return i(h=l);if(--o===0)return Ei(s,t,e,i)}};for(let l of n)io(s,l,t,e,a)})},so=(s,t,e,i)=>{t.isDirectory()&&ws(we.resolve(s,t.name),e,i),ps(we.resolve(s,t.name),e,i)},ws=(s,t,e)=>{let i;try{i=wi.readdirSync(s,{withFileTypes:!0})}catch(r){let n=r;if(n?.code==="ENOENT")return;if(n?.code==="ENOTDIR"||n?.code==="ENOTSUP")return ps(s,t,e);throw n}for(let r of i)so(s,r,t,e);return ps(s,t,e)};import k from"node:fs";import ro from"node:fs/promises";import Si from"node:path";var Se=class extends Error{path;code;syscall="chdir";constructor(t,e){super(`${e}: Cannot cd into '${t}'`),this.path=t,this.code=e}get name(){return"CwdError"}};var St=class extends Error{path;symlink;syscall="symlink";code="TAR_SYMLINK_ERROR";constructor(t,e){super("TAR_SYMLINK_ERROR: Cannot extract through symbolic link"),this.symlink=t,this.path=e}get name(){return"SymlinkError"}};var no=(s,t)=>{k.stat(s,(e,i)=>{(e||!i.isDirectory())&&(e=new Se(s,e?.code||"ENOTDIR")),t(e)})},gr=(s,t,e)=>{s=f(s);let i=t.umask??18,r=t.mode|448,n=(r&i)!==0,o=t.uid,h=t.gid,a=typeof o=="number"&&typeof h=="number"&&(o!==t.processUid||h!==t.processGid),l=t.preserve,c=t.unlink,d=f(t.cwd),y=(E,x)=>{E?e(E):x&&a?Es(x,o,h,Le=>y(Le)):n?k.chmod(s,r,e):e()};if(s===d)return no(s,y);if(l)return ro.mkdir(s,{mode:r,recursive:!0}).then(E=>y(null,E??void 0),y);let D=f(Si.relative(d,s)).split("/");Ss(d,D,r,c,d,void 0,y)},Ss=(s,t,e,i,r,n,o)=>{if(t.length===0)return o(null,n);let h=t.shift(),a=f(Si.resolve(s+"/"+h));k.mkdir(a,e,br(a,t,e,i,r,n,o))},br=(s,t,e,i,r,n,o)=>h=>{h?k.lstat(s,(a,l)=>{if(a)a.path=a.path&&f(a.path),o(a);else if(l.isDirectory())Ss(s,t,e,i,r,n,o);else if(i)k.unlink(s,c=>{if(c)return o(c);k.mkdir(s,e,br(s,t,e,i,r,n,o))});else{if(l.isSymbolicLink())return o(new St(s,s+"/"+t.join("/")));o(h)}}):(n=n||s,Ss(s,t,e,i,r,n,o))},oo=s=>{let t=!1,e;try{t=k.statSync(s).isDirectory()}catch(i){e=i?.code}finally{if(!t)throw new Se(s,e??"ENOTDIR")}},_r=(s,t)=>{s=f(s);let e=t.umask??18,i=t.mode|448,r=(i&e)!==0,n=t.uid,o=t.gid,h=typeof n=="number"&&typeof o=="number"&&(n!==t.processUid||o!==t.processGid),a=t.preserve,l=t.unlink,c=f(t.cwd),d=E=>{E&&h&&ws(E,n,o),r&&k.chmodSync(s,i)};if(s===c)return oo(c),d();if(a)return d(k.mkdirSync(s,{mode:i,recursive:!0})??void 0);let T=f(Si.relative(c,s)).split("/"),D;for(let E=T.shift(),x=c;E&&(x+="/"+E);E=T.shift()){x=f(Si.resolve(x));try{k.mkdirSync(x,i),D=D||x}catch{let Le=k.lstatSync(x);if(Le.isDirectory())continue;if(l){k.unlinkSync(x),k.mkdirSync(x,i),D=D||x;continue}else if(Le.isSymbolicLink())return new St(x,x+"/"+T.join("/"))}}return d(D)};import{join as xr}from"node:path";var ys=Object.create(null),Or=1e4,Vt=new Set,Tr=s=>{Vt.has(s)?Vt.delete(s):ys[s]=s.normalize("NFD").toLocaleLowerCase("en").toLocaleUpperCase("en"),Vt.add(s);let t=ys[s],e=Vt.size-Or;if(e>Or/10){for(let i of Vt)if(Vt.delete(i),delete ys[i],--e<=0)break}return t};var ho=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,ao=ho==="win32",lo=s=>s.split("/").slice(0,-1).reduce((e,i)=>{let r=e.at(-1);return r!==void 0&&(i=xr(r,i)),e.push(i||"/"),e},[]),yi=class{#t=new Map;#i=new Map;#s=new Set;reserve(t,e){t=ao?["win32 parallelization disabled"]:t.map(r=>mt(xr(Tr(r))));let i=new Set(t.map(r=>lo(r)).reduce((r,n)=>r.concat(n)));this.#i.set(e,{dirs:i,paths:t});for(let r of t){let n=this.#t.get(r);n?n.push(e):this.#t.set(r,[e])}for(let r of i){let n=this.#t.get(r);if(!n)this.#t.set(r,[new Set([e])]);else{let o=n.at(-1);o instanceof Set?o.add(e):n.push(new Set([e]))}}return this.#r(e)}#n(t){let e=this.#i.get(t);if(!e)throw new Error("function does not have any path reservations");return{paths:e.paths.map(i=>this.#t.get(i)),dirs:[...e.dirs].map(i=>this.#t.get(i))}}check(t){let{paths:e,dirs:i}=this.#n(t);return e.every(r=>r&&r[0]===t)&&i.every(r=>r&&r[0]instanceof Set&&r[0].has(t))}#r(t){return this.#s.has(t)||!this.check(t)?!1:(this.#s.add(t),t(()=>this.#e(t)),!0)}#e(t){if(!this.#s.has(t))return!1;let e=this.#i.get(t);if(!e)throw new Error("invalid reservation");let{paths:i,dirs:r}=e,n=new Set;for(let o of i){let h=this.#t.get(o);if(!h||h?.[0]!==t)continue;let a=h[1];if(!a){this.#t.delete(o);continue}if(h.shift(),typeof a=="function")n.add(a);else for(let l of a)n.add(l)}for(let o of r){let h=this.#t.get(o),a=h?.[0];if(!(!h||!(a instanceof Set)))if(a.size===1&&h.length===1){this.#t.delete(o);continue}else if(a.size===1){h.shift();let l=h[0];typeof l=="function"&&n.add(l)}else a.delete(t)}return this.#s.delete(t),n.forEach(o=>this.#r(o)),!0}};var Lr=()=>process.umask();var Dr=Symbol("onEntry"),_s=Symbol("checkFs"),Nr=Symbol("checkFs2"),Os=Symbol("isReusable"),P=Symbol("makeFs"),Ts=Symbol("file"),xs=Symbol("directory"),gi=Symbol("link"),Ar=Symbol("symlink"),Ir=Symbol("hardlink"),Re=Symbol("ensureNoSymlink"),Cr=Symbol("unsupported"),Fr=Symbol("checkPath"),Rs=Symbol("stripAbsolutePath"),yt=Symbol("mkdir"),O=Symbol("onError"),Ri=Symbol("pending"),kr=Symbol("pend"),$t=Symbol("unpend"),gs=Symbol("ended"),bs=Symbol("maybeClose"),Ls=Symbol("skip"),ge=Symbol("doChown"),be=Symbol("uid"),_e=Symbol("gid"),Oe=Symbol("checkedCwd"),fo=process.env.TESTING_TAR_FAKE_PLATFORM||process.platform,Te=fo==="win32",uo=1024,mo=(s,t)=>{if(!Te)return u.unlink(s,t);let e=s+".DELETE."+Mr(16).toString("hex");u.rename(s,e,i=>{if(i)return t(i);u.unlink(e,t)})},po=s=>{if(!Te)return u.unlinkSync(s);let t=s+".DELETE."+Mr(16).toString("hex");u.renameSync(s,t),u.unlinkSync(t)},vr=(s,t,e)=>s!==void 0&&s===s>>>0?s:t!==void 0&&t===t>>>0?t:e,Xt=class extends rt{[gs]=!1;[Oe]=!1;[Ri]=0;reservations=new yi;transform;writable=!0;readable=!1;uid;gid;setOwner;preserveOwner;processGid;processUid;maxDepth;forceChown;win32;newer;keep;noMtime;preservePaths;unlink;cwd;strip;processUmask;umask;dmode;fmode;chmod;constructor(t={}){if(t.ondone=()=>{this[gs]=!0,this[bs]()},super(t),this.transform=t.transform,this.chmod=!!t.chmod,typeof t.uid=="number"||typeof t.gid=="number"){if(typeof t.uid!="number"||typeof t.gid!="number")throw new TypeError("cannot set owner without number uid and gid");if(t.preserveOwner)throw new TypeError("cannot preserve owner in archive and also set owner explicitly");this.uid=t.uid,this.gid=t.gid,this.setOwner=!0}else this.uid=void 0,this.gid=void 0,this.setOwner=!1;this.preserveOwner=t.preserveOwner===void 0&&typeof t.uid!="number"?process.getuid?.()===0:!!t.preserveOwner,this.processUid=(this.preserveOwner||this.setOwner)&&process.getuid?process.getuid():void 0,this.processGid=(this.preserveOwner||this.setOwner)&&process.getgid?process.getgid():void 0,this.maxDepth=typeof t.maxDepth=="number"?t.maxDepth:uo,this.forceChown=t.forceChown===!0,this.win32=!!t.win32||Te,this.newer=!!t.newer,this.keep=!!t.keep,this.noMtime=!!t.noMtime,this.preservePaths=!!t.preservePaths,this.unlink=!!t.unlink,this.cwd=f(R.resolve(t.cwd||process.cwd())),this.strip=Number(t.strip)||0,this.processUmask=this.chmod?typeof t.processUmask=="number"?t.processUmask:Lr():0,this.umask=typeof t.umask=="number"?t.umask:this.processUmask,this.dmode=t.dmode||511&~this.umask,this.fmode=t.fmode||438&~this.umask,this.on("entry",e=>this[Dr](e))}warn(t,e,i={}){return(t==="TAR_BAD_ARCHIVE"||t==="TAR_ABORT")&&(i.recoverable=!1),super.warn(t,e,i)}[bs](){this[gs]&&this[Ri]===0&&(this.emit("prefinish"),this.emit("finish"),this.emit("end"))}[Rs](t,e){let i=t[e],{type:r}=t;if(!i||this.preservePaths)return!0;let[n,o]=ce(i),h=o.replaceAll(/\\/g,"/").split("/");if(h.includes("..")||Te&&/^[a-z]:\.\.$/i.test(h[0]??"")){if(e==="path"||r==="Link")return this.warn("TAR_ENTRY_ERROR",`${e} contains '..'`,{entry:t,[e]:i}),!1;let a=R.posix.dirname(t.path),l=R.posix.normalize(R.posix.join(a,h.join("/")));if(l.startsWith("../")||l==="..")return this.warn("TAR_ENTRY_ERROR",`${e} escapes extraction directory`,{entry:t,[e]:i}),!1}return n&&(t[e]=String(o),this.warn("TAR_ENTRY_INFO",`stripping ${n} from absolute ${e}`,{entry:t,[e]:i})),!0}[Fr](t){let e=f(t.path),i=e.split("/");if(this.strip){if(i.length<this.strip)return!1;if(t.type==="Link"){let r=f(String(t.linkpath)).split("/");if(r.length>=this.strip)t.linkpath=r.slice(this.strip).join("/");else return!1}i.splice(0,this.strip),t.path=i.join("/")}if(isFinite(this.maxDepth)&&i.length>this.maxDepth)return this.warn("TAR_ENTRY_ERROR","path excessively deep",{entry:t,path:e,depth:i.length,maxDepth:this.maxDepth}),!1;if(!this[Rs](t,"path")||!this[Rs](t,"linkpath"))return!1;if(t.absolute=R.isAbsolute(t.path)?f(R.resolve(t.path)):f(R.resolve(this.cwd,t.path)),!this.preservePaths&&typeof t.absolute=="string"&&t.absolute.indexOf(this.cwd+"/")!==0&&t.absolute!==this.cwd)return this.warn("TAR_ENTRY_ERROR","path escaped extraction target",{entry:t,path:f(t.path),resolvedPath:t.absolute,cwd:this.cwd}),!1;if(t.absolute===this.cwd&&t.type!=="Directory"&&t.type!=="GNUDumpDir")return!1;if(this.win32){let{root:r}=R.win32.parse(String(t.absolute));t.absolute=r+ts(String(t.absolute).slice(r.length));let{root:n}=R.win32.parse(t.path);t.path=n+ts(t.path.slice(n.length))}return!0}[Dr](t){if(!this[Fr](t))return t.resume();switch(co.equal(typeof t.absolute,"string"),t.type){case"Directory":case"GNUDumpDir":t.mode&&(t.mode=t.mode|448);case"File":case"OldFile":case"ContiguousFile":case"Link":case"SymbolicLink":return this[_s](t);default:return this[Cr](t)}}[O](t,e){t.name==="CwdError"?this.emit("error",t):(this.warn("TAR_ENTRY_ERROR",t,{entry:e}),this[$t](),e.resume())}[yt](t,e,i){gr(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e},i)}[ge](t){return this.forceChown||this.preserveOwner&&(typeof t.uid=="number"&&t.uid!==this.processUid||typeof t.gid=="number"&&t.gid!==this.processGid)||typeof this.uid=="number"&&this.uid!==this.processUid||typeof this.gid=="number"&&this.gid!==this.processGid}[be](t){return vr(this.uid,t.uid,this.processUid)}[_e](t){return vr(this.gid,t.gid,this.processGid)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=new et(String(t.absolute),{flags:ms(t.size),mode:i,autoClose:!1});r.on("error",a=>{r.fd&&u.close(r.fd,()=>{}),r.write=()=>!0,this[O](a,t),e()});let n=1,o=a=>{if(a){r.fd&&u.close(r.fd,()=>{}),this[O](a,t),e();return}--n===0&&r.fd!==void 0&&u.close(r.fd,l=>{l?this[O](l,t):this[$t](),e()})};r.on("finish",()=>{let a=String(t.absolute),l=r.fd;if(typeof l=="number"&&t.mtime&&!this.noMtime){n++;let c=t.atime||new Date,d=t.mtime;u.futimes(l,c,d,y=>y?u.utimes(a,c,d,T=>o(T&&y)):o())}if(typeof l=="number"&&this[ge](t)){n++;let c=this[be](t),d=this[_e](t);typeof c=="number"&&typeof d=="number"&&u.fchown(l,c,d,y=>y?u.chown(a,c,d,T=>o(T&&y)):o())}o()});let h=this.transform&&this.transform(t)||t;h!==t&&(h.on("error",a=>{this[O](a,t),e()}),t.pipe(h)),h.pipe(r)}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode;this[yt](String(t.absolute),i,r=>{if(r){this[O](r,t),e();return}let n=1,o=()=>{--n===0&&(e(),this[$t](),t.resume())};t.mtime&&!this.noMtime&&(n++,u.utimes(String(t.absolute),t.atime||new Date,t.mtime,o)),this[ge](t)&&(n++,u.chown(String(t.absolute),Number(this[be](t)),Number(this[_e](t)),o)),o()})}[Cr](t){t.unsupported=!0,this.warn("TAR_ENTRY_UNSUPPORTED",`unsupported entry type: ${t.type}`,{entry:t}),t.resume()}[Ar](t,e){let i=f(R.relative(this.cwd,R.resolve(R.dirname(String(t.absolute)),String(t.linkpath)))).split("/");this[Re](t,this.cwd,i,()=>this[gi](t,String(t.linkpath),"symlink",e),r=>{this[O](r,t),e()})}[Ir](t,e){let i=f(R.resolve(this.cwd,String(t.linkpath))),r=f(String(t.linkpath)).split("/");this[Re](t,this.cwd,r,()=>this[gi](t,i,"link",e),n=>{this[O](n,t),e()})}[Re](t,e,i,r,n){let o=i.shift();if(this.preservePaths||o===void 0)return r();let h=R.resolve(e,o);u.lstat(h,(a,l)=>{if(a)return r();if(l?.isSymbolicLink())return n(new St(h,R.resolve(h,i.join("/"))));this[Re](t,h,i,r,n)})}[kr](){this[Ri]++}[$t](){this[Ri]--,this[bs]()}[Ls](t){this[$t](),t.resume()}[Os](t,e){return t.type==="File"&&!this.unlink&&e.isFile()&&e.nlink<=1&&!Te}[_s](t){this[kr]();let e=[t.path];t.linkpath&&e.push(t.linkpath),this.reservations.reserve(e,i=>this[Nr](t,i))}[Nr](t,e){let i=h=>{e(h)},r=()=>{this[yt](this.cwd,this.dmode,h=>{if(h){this[O](h,t),i();return}this[Oe]=!0,n()})},n=()=>{if(t.absolute!==this.cwd){let h=f(R.dirname(String(t.absolute)));if(h!==this.cwd)return this[yt](h,this.dmode,a=>{if(a){this[O](a,t),i();return}o()})}o()},o=()=>{u.lstat(String(t.absolute),(h,a)=>{if(a&&(this.keep||this.newer&&a.mtime>(t.mtime??a.mtime))){this[Ls](t),i();return}if(h||this[Os](t,a))return this[P](null,t,i);if(a.isDirectory()){if(t.type==="Directory"){let l=this.chmod&&t.mode&&(a.mode&4095)!==t.mode,c=d=>this[P](d??null,t,i);return l?u.chmod(String(t.absolute),Number(t.mode),c):c()}if(t.absolute!==this.cwd)return u.rmdir(String(t.absolute),l=>this[P](l??null,t,i))}if(t.absolute===this.cwd)return this[P](null,t,i);mo(String(t.absolute),l=>this[P](l??null,t,i))})};this[Oe]?n():r()}[P](t,e,i){if(t){this[O](t,e),i();return}switch(e.type){case"File":case"OldFile":case"ContiguousFile":return this[Ts](e,i);case"Link":return this[Ir](e,i);case"SymbolicLink":return this[Ar](e,i);case"Directory":case"GNUDumpDir":return this[xs](e,i)}}[gi](t,e,i,r){u[i](e,String(t.absolute),n=>{n?this[O](n,t):(this[$t](),t.resume()),r()})}},ye=s=>{try{return[null,s()]}catch(t){return[t,null]}},xe=class extends Xt{sync=!0;[P](t,e){return super[P](t,e,()=>{})}[_s](t){if(!this[Oe]){let n=this[yt](this.cwd,this.dmode);if(n)return this[O](n,t);this[Oe]=!0}if(t.absolute!==this.cwd){let n=f(R.dirname(String(t.absolute)));if(n!==this.cwd){let o=this[yt](n,this.dmode);if(o)return this[O](o,t)}}let[e,i]=ye(()=>u.lstatSync(String(t.absolute)));if(i&&(this.keep||this.newer&&i.mtime>(t.mtime??i.mtime)))return this[Ls](t);if(e||this[Os](t,i))return this[P](null,t);if(i.isDirectory()){if(t.type==="Directory"){let o=this.chmod&&t.mode&&(i.mode&4095)!==t.mode,[h]=o?ye(()=>{u.chmodSync(String(t.absolute),Number(t.mode))}):[];return this[P](h,t)}let[n]=ye(()=>u.rmdirSync(String(t.absolute)));this[P](n,t)}let[r]=t.absolute===this.cwd?[]:ye(()=>po(String(t.absolute)));this[P](r,t)}[Ts](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.fmode,r=h=>{let a;try{u.closeSync(n)}catch(l){a=l}(h||a)&&this[O](h||a,t),e()},n;try{n=u.openSync(String(t.absolute),ms(t.size),i)}catch(h){return r(h)}let o=this.transform&&this.transform(t)||t;o!==t&&(o.on("error",h=>this[O](h,t)),t.pipe(o)),o.on("data",h=>{try{u.writeSync(n,h,0,h.length)}catch(a){r(a)}}),o.on("end",()=>{let h=null;if(t.mtime&&!this.noMtime){let a=t.atime||new Date,l=t.mtime;try{u.futimesSync(n,a,l)}catch(c){try{u.utimesSync(String(t.absolute),a,l)}catch{h=c}}}if(this[ge](t)){let a=this[be](t),l=this[_e](t);try{u.fchownSync(n,Number(a),Number(l))}catch(c){try{u.chownSync(String(t.absolute),Number(a),Number(l))}catch{h=h||c}}}r(h)})}[xs](t,e){let i=typeof t.mode=="number"?t.mode&4095:this.dmode,r=this[yt](String(t.absolute),i);if(r){this[O](r,t),e();return}if(t.mtime&&!this.noMtime)try{u.utimesSync(String(t.absolute),t.atime||new Date,t.mtime)}catch{}if(this[ge](t))try{u.chownSync(String(t.absolute),Number(this[be](t)),Number(this[_e](t)))}catch{}e(),t.resume()}[yt](t,e){try{return _r(f(t),{uid:this.uid,gid:this.gid,processUid:this.processUid,processGid:this.processGid,umask:this.processUmask,preserve:this.preservePaths,unlink:this.unlink,cwd:this.cwd,mode:e})}catch(i){return i}}[Re](t,e,i,r,n){if(this.preservePaths||i.length===0)return r();let o=e;for(let h of i){o=R.resolve(o,h);let[a,l]=ye(()=>u.lstatSync(o));if(a)return r();if(l.isSymbolicLink())return n(new St(o,R.resolve(e,i.join("/"))))}r()}[gi](t,e,i,r){let n=`${i}Sync`;try{u[n](e,String(t.absolute)),r(),t.resume()}catch(o){return this[O](o,t)}}};var Eo=s=>{let t=new xe(s),e=s.file,i=Br.statSync(e),r=s.maxReadSize||16*1024*1024;new Be(e,{readSize:r,size:i.size}).pipe(t)},wo=(s,t)=>{let e=new Xt(s),i=s.maxReadSize||16*1024*1024,r=s.file;return new Promise((o,h)=>{e.on("error",h),e.on("close",o),Br.stat(r,(a,l)=>{if(a)h(a);else{let c=new _t(r,{readSize:i,size:l.size});c.on("error",h),c.pipe(e)}})})},So=K(Eo,wo,s=>new xe(s),s=>new Xt(s),(s,t)=>{t?.length&&Qi(s,t)});import v from"node:fs";import Pr from"node:path";var yo=(s,t)=>{let e=new kt(s),i=!0,r,n;try{try{r=v.openSync(s.file,"r+")}catch(a){if(a?.code==="ENOENT")r=v.openSync(s.file,"w+");else throw a}let o=v.fstatSync(r),h=Buffer.alloc(512);t:for(n=0;n<o.size;n+=512){for(let c=0,d=0;c<512;c+=d){if(d=v.readSync(r,h,c,h.length-c,n+c),n===0&&h[0]===31&&h[1]===139)throw new Error("cannot append to compressed archives");if(!d)break t}let a=new F(h);if(!a.cksumValid)break;let l=512*Math.ceil((a.size||0)/512);if(n+l+512>o.size)break;n+=l,s.mtimeCache&&a.mtime&&s.mtimeCache.set(String(a.path),a.mtime)}i=!1,Ro(s,e,n,r,t)}finally{if(i)try{v.closeSync(r)}catch{}}},Ro=(s,t,e,i,r)=>{let n=new Wt(s.file,{fd:i,start:e});t.pipe(n),bo(t,r)},go=(s,t)=>{t=Array.from(t);let e=new wt(s),i=(n,o,h)=>{let a=(T,D)=>{T?v.close(n,E=>h(T)):h(null,D)},l=0;if(o===0)return a(null,0);let c=0,d=Buffer.alloc(512),y=(T,D)=>{if(T||D===void 0)return a(T);if(c+=D,c<512&&D)return v.read(n,d,c,d.length-c,l+c,y);if(l===0&&d[0]===31&&d[1]===139)return a(new Error("cannot append to compressed archives"));if(c<512)return a(null,l);let E=new F(d);if(!E.cksumValid)return a(null,l);let x=512*Math.ceil((E.size??0)/512);if(l+x+512>o||(l+=x+512,l>=o))return a(null,l);s.mtimeCache&&E.mtime&&s.mtimeCache.set(String(E.path),E.mtime),c=0,v.read(n,d,0,512,l,y)};v.read(n,d,0,512,l,y)};return new Promise((n,o)=>{e.on("error",o);let h="r+",a=(l,c)=>{if(l&&l.code==="ENOENT"&&h==="r+")return h="w+",v.open(s.file,h,a);if(l||!c)return o(l);v.fstat(c,(d,y)=>{if(d)return v.close(c,()=>o(d));i(c,y.size,(T,D)=>{if(T)return o(T);let E=new et(s.file,{fd:c,start:D});e.pipe(E),E.on("error",o),E.on("close",n),_o(e,t)})})};v.open(s.file,h,a)})},bo=(s,t)=>{t.forEach(e=>{e.charAt(0)==="@"?Ct({file:Pr.resolve(s.cwd,e.slice(1)),sync:!0,noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e)}),s.end()},_o=async(s,t)=>{for(let e of t)e.charAt(0)==="@"?await Ct({file:Pr.resolve(String(s.cwd),e.slice(1)),noResume:!0,onReadEntry:i=>s.add(i)}):s.add(e);s.end()},vt=K(yo,go,()=>{throw new TypeError("file is required")},()=>{throw new TypeError("file is required")},(s,t)=>{if(!Bs(s))throw new TypeError("file is required");if(s.gzip||s.brotli||s.zstd||s.file.endsWith(".br")||s.file.endsWith(".tbr"))throw new TypeError("cannot append to compressed archives");if(!t?.length)throw new TypeError("no paths specified to add/replace")});var Oo=K(vt.syncFile,vt.asyncFile,vt.syncNoFile,vt.asyncNoFile,(s,t=[])=>{vt.validate?.(s,t),To(s)}),To=s=>{let t=s.filter;s.mtimeCache||(s.mtimeCache=new Map),s.filter=t?(e,i)=>t(e,i)&&!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0)):(e,i)=>!((s.mtimeCache?.get(e)??i.mtime??0)>(i.mtime??0))};export{F as Header,wt as Pack,pi as PackJob,kt as PackSync,rt as Parser,ft as Pax,$e as ReadEntry,Xt as Unpack,xe as UnpackSync,de as WriteEntry,ni as WriteEntrySync,oi as WriteEntryTar,Qn as c,Qn as create,So as extract,Qi as filesFilter,Ct as list,vt as r,vt as replace,Ct as t,Hi as types,Oo as u,Oo as update,So as x};
 //# sourceMappingURL=index.min.js.map
diff --git a/deps/npm/node_modules/tar/dist/esm/list.js b/deps/npm/node_modules/tar/dist/esm/list.js
index 4c3af58192ec..08bdbe4ad85c 100644
--- a/deps/npm/node_modules/tar/dist/esm/list.js
+++ b/deps/npm/node_modules/tar/dist/esm/list.js
@@ -20,14 +20,22 @@ const onReadEntryFunction = (opt) => {
 export const filesFilter = (opt, files) => {
     const map = new Map(files.map(f => [stripTrailingSlashes(f), true]));
     const filter = opt.filter;
-    const mapHas = (file, r = '') => {
+    // limit recursion to 100 levels
+    const MAX = 100;
+    const mapHas = (file, r = '', depth = 0) => {
+        /* c8 ignore start - excessive caution */
+        if (depth >= MAX) {
+            map.set(file, false);
+            return false;
+        }
+        /* c8 ignore stop */
         const root = r || parse(file).root || '.';
         let ret;
         if (file === root)
             ret = false;
         else {
             const m = map.get(file);
-            ret = m !== undefined ? m : mapHas(dirname(file), root);
+            ret = m !== undefined ? m : mapHas(dirname(file), root, depth + 1);
         }
         map.set(file, ret);
         return ret;
diff --git a/deps/npm/node_modules/tar/dist/esm/parse.js b/deps/npm/node_modules/tar/dist/esm/parse.js
index fb303a5171be..92add3a903fd 100644
--- a/deps/npm/node_modules/tar/dist/esm/parse.js
+++ b/deps/npm/node_modules/tar/dist/esm/parse.js
@@ -373,6 +373,16 @@ export class Parser extends EE {
         if (this[ABORTED]) {
             return;
         }
+        if (this[UNZIP]) {
+            // fully nerf the decompressor and close its underlying binding
+            const u = this[UNZIP];
+            /* c8 ignore start */
+            u.write = () => true;
+            u.end = () => u;
+            u.emit = () => false;
+            /* c8 ignore stop */
+            u.destroy?.();
+        }
         this[ABORTED] = true;
         this.emit('abort', error);
         // always throws, even in non-strict mode
diff --git a/deps/npm/node_modules/tar/package.json b/deps/npm/node_modules/tar/package.json
index 9d082e440494..f19ece377d9d 100644
--- a/deps/npm/node_modules/tar/package.json
+++ b/deps/npm/node_modules/tar/package.json
@@ -2,7 +2,7 @@
   "author": "Isaac Z. Schlueter",
   "name": "tar",
   "description": "tar for node",
-  "version": "7.5.19",
+  "version": "7.5.22",
   "repository": {
     "type": "git",
     "url": "https://github.com/isaacs/node-tar.git"
diff --git a/deps/npm/node_modules/undici/lib/core/request.js b/deps/npm/node_modules/undici/lib/core/request.js
index 4da60667ec29..8e7ecc73084b 100644
--- a/deps/npm/node_modules/undici/lib/core/request.js
+++ b/deps/npm/node_modules/undici/lib/core/request.js
@@ -350,7 +350,13 @@ function processHeader (request, key, val) {
       } else if (typeof val[i] === 'object') {
         throw new InvalidArgumentError(`invalid ${key} header`)
       } else {
-        arr.push(`${val[i]}`)
+        // Coerce primitives (and reject unsafe coercions such as functions
+        // with a crafted toString/Symbol.toPrimitive).
+        const str = `${val[i]}`
+        if (!isValidHeaderValue(str)) {
+          throw new InvalidArgumentError(`invalid ${key} header`)
+        }
+        arr.push(str)
       }
     }
     val = arr
@@ -361,7 +367,12 @@ function processHeader (request, key, val) {
   } else if (val === null) {
     val = ''
   } else {
+    // Coerce primitives (and reject unsafe coercions such as functions
+    // with a crafted toString/Symbol.toPrimitive).
     val = `${val}`
+    if (!isValidHeaderValue(val)) {
+      throw new InvalidArgumentError(`invalid ${key} header`)
+    }
   }
 
   if (headerName === 'host') {
diff --git a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
index 9455517a19b1..a801ecb36046 100644
--- a/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
+++ b/deps/npm/node_modules/undici/lib/dispatcher/client-h1.js
@@ -10,6 +10,7 @@ const {
   RequestContentLengthMismatchError,
   ResponseContentLengthMismatchError,
   RequestAbortedError,
+  InvalidArgumentError,
   HeadersTimeoutError,
   HeadersOverflowError,
   SocketError,
@@ -993,8 +994,16 @@ function writeH1 (client, request) {
     }
     body = bodyStream.stream
     contentLength = bodyStream.length
-  } else if (util.isBlobLike(body) && request.contentType == null && body.type) {
-    headers.push('content-type', body.type)
+  } else if (util.isBlobLike(body) && request.contentType == null) {
+    const contentType = body.type
+    if (contentType) {
+      const contentTypeValue = `${contentType}`
+      if (!util.isValidHeaderValue(contentTypeValue)) {
+        util.errorRequest(client, request, new InvalidArgumentError('invalid content-type header'))
+        return false
+      }
+      headers.push('content-type', contentTypeValue)
+    }
   }
 
   if (body && typeof body.read === 'function') {
diff --git a/deps/npm/node_modules/undici/lib/handler/retry-handler.js b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
index 5d1ccf005387..c62a2409f3ae 100644
--- a/deps/npm/node_modules/undici/lib/handler/retry-handler.js
+++ b/deps/npm/node_modules/undici/lib/handler/retry-handler.js
@@ -15,6 +15,28 @@ function calculateRetryAfterHeader (retryAfter) {
   return new Date(retryAfter).getTime() - current
 }
 
+function validatePartialResponseContentLength (headers, range, statusCode, retryCount) {
+  const contentLength = headers['content-length']
+  if (contentLength == null) {
+    return null
+  }
+
+  if (!Number.isFinite(range.start) || !Number.isFinite(range.end)) {
+    return null
+  }
+
+  const length = Number(contentLength)
+  const expectedLength = range.end - range.start + 1
+  if (!Number.isFinite(length) || length !== expectedLength) {
+    return new RequestRetryError('Content-Length mismatch', statusCode, {
+      headers,
+      data: { count: retryCount }
+    })
+  }
+
+  return null
+}
+
 class RetryHandler {
   constructor (opts, handlers) {
     const { retryOptions, ...dispatchOpts } = opts
@@ -229,6 +251,12 @@ class RetryHandler {
         return false
       }
 
+      const contentLengthError = validatePartialResponseContentLength(headers, contentRange, statusCode, this.retryCount)
+      if (contentLengthError != null) {
+        this.abort(contentLengthError)
+        return false
+      }
+
       const { start, size, end = size - 1 } = contentRange
 
       assert(this.start === start, 'content-range mismatch')
@@ -252,6 +280,12 @@ class RetryHandler {
           )
         }
 
+        const contentLengthError = validatePartialResponseContentLength(headers, range, statusCode, this.retryCount)
+        if (contentLengthError != null) {
+          this.abort(contentLengthError)
+          return false
+        }
+
         const { start, size, end = size - 1 } = range
         assert(
           start != null && Number.isFinite(start),
diff --git a/deps/npm/node_modules/undici/lib/web/cookies/util.js b/deps/npm/node_modules/undici/lib/web/cookies/util.js
index 254f5419e905..ca408e153abb 100644
--- a/deps/npm/node_modules/undici/lib/web/cookies/util.js
+++ b/deps/npm/node_modules/undici/lib/web/cookies/util.js
@@ -105,7 +105,7 @@ function validateCookiePath (path) {
 
     if (
       code < 0x20 || // exclude CTLs (0-31)
-      code === 0x7F || // DEL
+      code > 0x7E || // exclude DEL and non-ascii
       code === 0x3B // ;
     ) {
       throw new Error('Invalid cookie path')
@@ -114,16 +114,80 @@ function validateCookiePath (path) {
 }
 
 /**
- * I have no idea why these values aren't allowed to be honest,
- * but Deno tests these. - Khafra
+ * <let-dig> ::= <letter> | <digit>
+ *
+ * <letter> ::= any one of the 52 alphabetic characters A through Z in
+ * upper case and a through z in lower case
+ *
+ * <digit> ::= any one of the ten digits 0 through 9r
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @param {number} code
+ */
+function isLetterOrDigit (code) {
+  return (
+    (code >= 0x30 && code <= 0x39) || // 0-9
+    (code >= 0x41 && code <= 0x5A) || // A-Z
+    (code >= 0x61 && code <= 0x7A) // a-z
+  )
+}
+
+/**
+ * Validates a cookie domain against the "preferred name syntax".
+ *
+ * <domain>      ::= <subdomain> | " "
+ * <subdomain>   ::= <label> | <subdomain> "." <label>
+ * <label>       ::= <let-dig> [ [ <ldh-str> ] <let-dig> ]
+ * <ldh-str>     ::= <let-dig-hyp> | <let-dig-hyp> <ldh-str>
+ * <let-dig-hyp> ::= <let-dig> | "-"
+ *
+ * @see https://www.rfc-editor.org/rfc/rfc1034#section-3.5
+ * @see https://www.rfc-editor.org/rfc/rfc1123#section-2.1
+ * @see https://www.rfc-editor.org/rfc/rfc1035#section-2.3.4
  * @param {string} domain
  */
 function validateCookieDomain (domain) {
-  if (
-    domain.startsWith('-') ||
-    domain.endsWith('.') ||
-    domain.endsWith('-')
-  ) {
+  // <domain> ::= <subdomain> | " "
+  if (domain === ' ') {
+    return
+  }
+
+  if (domain.length > 255) {
+    throw new Error('Invalid cookie domain')
+  }
+
+  let labelLength = 0
+
+  for (let i = 0; i < domain.length; ++i) {
+    const code = domain.charCodeAt(i)
+
+    if (code === 0x2E) {
+      if (labelLength === 0) {
+        throw new Error('Invalid cookie domain')
+      }
+
+      if (domain.charCodeAt(i - 1) === 0x2D) { // "-"
+        throw new Error('Invalid cookie domain')
+      }
+
+      labelLength = 0
+      continue
+    }
+
+    if (labelLength === 0 && !isLetterOrDigit(code)) {
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (!isLetterOrDigit(code) && code !== 0x2D) { // "-"
+      throw new Error('Invalid cookie domain')
+    }
+
+    if (++labelLength > 63) {
+      throw new Error('Invalid cookie domain')
+    }
+  }
+
+  if (labelLength === 0 || domain.charCodeAt(domain.length - 1) === 0x2D) { // "-"
     throw new Error('Invalid cookie domain')
   }
 }
@@ -266,7 +330,13 @@ function stringify (cookie) {
 
     const [key, ...value] = part.split('=')
 
-    out.push(`${key.trim()}=${value.join('=')}`)
+    const trimmedKey = key.trim()
+    const joinedValue = value.join('=')
+
+    validateCookieName(trimmedKey)
+    validateCookieValue(joinedValue)
+
+    out.push(`${trimmedKey}=${joinedValue}`)
   }
 
   return out.join('; ')
diff --git a/deps/npm/node_modules/undici/package.json b/deps/npm/node_modules/undici/package.json
index 3c2001f391e3..cd46deca2448 100644
--- a/deps/npm/node_modules/undici/package.json
+++ b/deps/npm/node_modules/undici/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "6.27.0",
+  "version": "6.28.0",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
diff --git a/deps/npm/package.json b/deps/npm/package.json
index 5ce61281a2b0..a67f34569558 100644
--- a/deps/npm/package.json
+++ b/deps/npm/package.json
@@ -1,5 +1,5 @@
 {
-  "version": "11.19.0",
+  "version": "11.19.1",
   "name": "npm",
   "description": "a package manager for JavaScript",
   "workspaces": [
@@ -81,7 +81,7 @@
     "libnpmexec": "^10.3.2",
     "libnpmfund": "^7.0.26",
     "libnpmorg": "^8.0.1",
-    "libnpmpack": "^9.1.12",
+    "libnpmpack": "^9.1.13",
     "libnpmpublish": "^11.2.0",
     "libnpmsearch": "^9.0.1",
     "libnpmteam": "^8.0.2",
@@ -110,7 +110,7 @@
     "spdx-expression-parse": "^4.0.0",
     "ssri": "^13.0.1",
     "supports-color": "^10.2.2",
-    "tar": "^7.5.19",
+    "tar": "^7.5.22",
     "text-table": "~0.2.0",
     "tiny-relative-date": "^2.0.2",
     "treeverse": "^3.0.0",
diff --git a/deps/npm/test/lib/commands/pack.js b/deps/npm/test/lib/commands/pack.js
index 9805427de4f6..21d961ebef6e 100644
--- a/deps/npm/test/lib/commands/pack.js
+++ b/deps/npm/test/lib/commands/pack.js
@@ -113,6 +113,25 @@ t.test('dry run', async t => {
   t.throws(() => fs.statSync(path.resolve(npm.prefix, filename)))
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry run with allow-directory=${allowDirectory}`, async t => {
+    const { npm, outputs } = await loadMockNpm(t, {
+      prefixDir: {
+        'package.json': JSON.stringify({
+          name: 'test-package',
+          version: '1.0.0',
+        }),
+      },
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+      },
+    })
+    await npm.exec('pack', [])
+    t.strictSame(outputs, ['test-package-1.0.0.tgz'])
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { npm, outputs, logs } = await loadMockNpm(t, {
     prefixDir: {
diff --git a/deps/npm/test/lib/commands/publish.js b/deps/npm/test/lib/commands/publish.js
index b204f7452a65..98576b08ea30 100644
--- a/deps/npm/test/lib/commands/publish.js
+++ b/deps/npm/test/lib/commands/publish.js
@@ -151,6 +151,25 @@ t.test('dry-run', async t => {
   t.matchSnapshot(logs.notice)
 })
 
+for (const allowDirectory of ['none', 'root']) {
+  t.test(`dry-run with allow-directory=${allowDirectory}`, async t => {
+    const { joinedOutput, npm, registry } = await loadNpmWithRegistry(t, {
+      config: {
+        'allow-directory': allowDirectory,
+        'dry-run': true,
+        ...auth,
+      },
+      prefixDir: {
+        'package.json': JSON.stringify(pkgJson, null, 2),
+      },
+      authorization: token,
+    })
+    registry.publish(pkg, { noPut: true })
+    await npm.exec('publish', [])
+    t.equal(joinedOutput(), `+ ${pkg}@1.0.0`)
+  })
+}
+
 t.test('foreground-scripts defaults to true', async t => {
   const { outputs, npm, logs, registry } = await loadNpmWithRegistry(t, {
     config: {
diff --git a/deps/simdjson/simdjson.cpp b/deps/simdjson/simdjson.cpp
index 92d971fd448b..71f443b3d2bb 100644
--- a/deps/simdjson/simdjson.cpp
+++ b/deps/simdjson/simdjson.cpp
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.cpp:  */
 /* begin file simdjson.cpp */
 #define SIMDJSON_SRC_SIMDJSON_CPP
@@ -240,7 +240,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -10052,9 +10052,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -10065,6 +10070,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -13541,7 +13547,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -13575,7 +13588,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -13597,7 +13610,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -13976,11 +13989,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -14005,6 +14013,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -14021,7 +14035,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -16588,9 +16602,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -16601,6 +16620,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19936,7 +19956,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -19970,7 +19997,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -19992,7 +20019,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -20371,11 +20398,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -20400,6 +20422,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -20416,7 +20444,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -22979,9 +23007,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22992,6 +23025,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -26326,7 +26360,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -26360,7 +26401,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -26382,7 +26423,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -26761,11 +26802,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -26790,6 +26826,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -26806,7 +26848,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -29527,9 +29569,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -29540,6 +29587,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -32987,7 +33035,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -33021,7 +33076,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -33043,7 +33098,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -33422,11 +33477,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -33451,6 +33501,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -33467,7 +33523,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -36435,9 +36491,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36448,6 +36509,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -40210,7 +40272,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -40244,7 +40313,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -40266,7 +40335,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -40645,11 +40714,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -40674,6 +40738,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -40690,7 +40760,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -43189,9 +43259,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -43202,6 +43277,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -46464,7 +46540,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -46498,7 +46581,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -46520,7 +46603,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -46899,11 +46982,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -46928,6 +47006,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -46944,7 +47028,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -49380,9 +49464,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -49393,6 +49482,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -52622,7 +52712,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -52656,7 +52753,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -52678,7 +52775,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -53057,11 +53154,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -53086,6 +53178,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -53102,7 +53200,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -55559,9 +55657,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -55572,6 +55675,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -59199,7 +59303,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -59233,7 +59344,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -59255,7 +59366,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -59634,11 +59745,6 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
     ((error != SUCCESS) && (error != UNCLOSED_STRING)) // when partial we tolerate UNCLOSED_STRING
     : (error != SUCCESS); // if partial is false, we must have SUCCESS
   const bool have_unclosed_string = (error == UNCLOSED_STRING);
-  if (simdjson_unlikely(should_we_exit)) { return error; }
-
-  if (unescaped_chars_error) {
-    return UNESCAPED_CHARS;
-  }
   parser.n_structural_indexes = uint32_t(indexer.tail - parser.structural_indexes.get());
   /***
    * The On-Demand API requires special padding.
@@ -59663,6 +59769,12 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
   parser.structural_indexes[parser.n_structural_indexes + 1] = uint32_t(len);
   parser.structural_indexes[parser.n_structural_indexes + 2] = 0;
   parser.next_structural_index = 0;
+
+  // Bail out only once the count and sentinels above are set:
+  // document_stream::truncated_bytes() reads them even on error.
+  if (simdjson_unlikely(should_we_exit)) { return error; }
+  if (unescaped_chars_error) { return UNESCAPED_CHARS; }
+
   // a valid JSON file cannot have zero structural indexes - we should have found something
   if (simdjson_unlikely(parser.n_structural_indexes == 0u)) {
     return EMPTY;
@@ -59679,7 +59791,7 @@ simdjson_inline error_code json_structural_indexer::finish(dom_parser_implementa
       if (simdjson_unlikely(parser.n_structural_indexes == 0u)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !have_unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
@@ -61715,9 +61827,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -61728,6 +61845,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -63685,7 +63803,14 @@ namespace stage1 {
   * complete document, therefore the last json buffer location is the end of the
   * batch.
   */
-simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser) {
+simdjson_inline bool ends_with_partial_scalar(dom_parser_implementation &parser, size_t len) {
+  const uint8_t f = parser.buf[parser.structural_indexes[parser.n_structural_indexes - 1]];
+  const uint8_t e = parser.buf[len - 1];
+  return f != '{' && f != '[' && f != '}' && f != ']' && f != ':' && f != ',' && f != '"' &&
+         e != ' ' && e != '\t' && e != '\n' && e != '\r';
+}
+
+simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &parser, bool defer_last = false) {
   // Variant: do not count separately, just figure out depth
   if(parser.n_structural_indexes == 0) { return 0; }
   auto arr_cnt = 0;
@@ -63719,7 +63844,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
     }
     // Last document is complete, so the next document will appear after!
     if (!arr_cnt && !obj_cnt) {
-      return parser.n_structural_indexes;
+      return defer_last ? i : parser.n_structural_indexes;
     }
     // Last document is incomplete; mark the document at i + 1 as the next one
     return i;
@@ -63741,7 +63866,7 @@ simdjson_inline uint32_t find_next_document_index(dom_parser_implementation &par
   }
   if (!arr_cnt && !obj_cnt) {
     // We have a complete document.
-    return parser.n_structural_indexes;
+    return defer_last ? 0 : parser.n_structural_indexes;
   }
   return 0;
 }
@@ -64949,8 +65074,8 @@ simdjson_inline void validate_utf8_character() {
   // 2-byte
   if ((buf[idx] & 0x20) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+1 > len || !is_continuation(buf[idx+1]))) {
-      if (idx+1 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+1 >= len || !is_continuation(buf[idx+1]))) {
+      if (idx+1 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64964,8 +65089,8 @@ simdjson_inline void validate_utf8_character() {
   // 3-byte
   if ((buf[idx] & 0x10) == 0) {
     // missing continuation
-    if (simdjson_unlikely(idx+2 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
-      if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+    if (simdjson_unlikely(idx+2 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]))) {
+      if (idx+2 >= len && is_streaming(partial)) { idx = len; return; }
       error = UTF8_ERROR;
       idx++;
       return;
@@ -64980,8 +65105,8 @@ simdjson_inline void validate_utf8_character() {
 
   // 4-byte
   // missing continuation
-  if (simdjson_unlikely(idx+3 > len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
-    if (idx+2 > len && is_streaming(partial)) { idx = len; return; }
+  if (simdjson_unlikely(idx+3 >= len || !is_continuation(buf[idx+1]) || !is_continuation(buf[idx+2]) || !is_continuation(buf[idx+3]))) {
+    if (idx+3 >= len && is_streaming(partial)) { idx = len; return; }
     error = UTF8_ERROR;
     idx++;
     return;
@@ -65103,9 +65228,15 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       add_structural();
     // Primitive or invalid character (invalid characters will be checked in stage 2)
     } else {
-      // Anything else, add the structural and go until we find the next one
+      // Anything else, add the structural and go until we find the next one.
+      // We also stop on '"' so that an unclosed string still reaches
+      // validate_string(); a quote swallowed by the run would hide it. A
+      // quote cannot occur inside a valid primitive. We deliberately do not
+      // stop on every ESC_ASCII character: that also covers a backslash and the
+      // control characters, and ending the run there makes the fallback
+      // disagree with the SIMD kernels.
       add_structural();
-      while (idx+1<len && !char_is_space_or_operator(buf[idx+1])) {
+      while (idx+1<len && !char_is_space_or_operator(buf[idx+1]) && buf[idx+1] != '"') {
         idx++;
       };
     }
@@ -65125,7 +65256,7 @@ simdjson_warn_unused simdjson_inline error_code scan() {
       if (simdjson_unlikely(parser.n_structural_indexes == 0)) { return CAPACITY; }
     }
     // We truncate the input to the end of the last complete document (or zero).
-    auto new_structural_indexes = find_next_document_index(parser);
+    auto new_structural_indexes = find_next_document_index(parser, !unclosed_string && ends_with_partial_scalar(parser, len));
     if (new_structural_indexes == 0 && parser.n_structural_indexes > 0) {
       if(parser.structural_indexes[0] == 0) {
         // If the buffer is partial and we started at index 0 but the document is
diff --git a/deps/simdjson/simdjson.h b/deps/simdjson/simdjson.h
index 55346b59ef59..43fe09631c01 100644
--- a/deps/simdjson/simdjson.h
+++ b/deps/simdjson/simdjson.h
@@ -1,4 +1,4 @@
-/* auto-generated on 2026-08-24 17:10:01 -0400. version 4.6.9 Do not edit! */
+/* auto-generated on 2026-09-04 16:04:31 -0400. version 4.6.11 Do not edit! */
 /* including simdjson.h:  */
 /* begin file simdjson.h */
 #ifndef SIMDJSON_H
@@ -260,7 +260,7 @@ using std::size_t;
 #endif
 #elif defined(__PPC64__) || defined(_M_PPC64)
 #define SIMDJSON_IS_PPC64 1
-#if defined(__ALTIVEC__)
+#if defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #define SIMDJSON_IS_PPC64_VMX 1
 #endif // defined(__ALTIVEC__)
 #else
@@ -2538,7 +2538,7 @@ namespace std {
 #define SIMDJSON_SIMDJSON_VERSION_H
 
 /** The version of simdjson being used (major.minor.revision) */
-#define SIMDJSON_VERSION "4.6.9"
+#define SIMDJSON_VERSION "4.6.11"
 
 namespace simdjson {
 enum {
@@ -2553,7 +2553,7 @@ enum {
   /**
    * The revision (major.minor.REVISION) of simdjson being used.
    */
-  SIMDJSON_VERSION_REVISION = 9
+  SIMDJSON_VERSION_REVISION = 11
 };
 } // namespace simdjson
 
@@ -4734,6 +4734,7 @@ inline char *allocate_padded_buffer(size_t length) noexcept {
 inline padded_string::padded_string() noexcept = default;
 inline padded_string::padded_string(size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
+  if (data_ptr == nullptr) { viable_size = 0; }
 }
 inline padded_string::padded_string(const char *data, size_t length) noexcept
     : viable_size(length), data_ptr(internal::allocate_padded_buffer(length)) {
@@ -6351,6 +6352,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
   /**
@@ -9945,6 +9958,9 @@ simdjson_inline size_t document_stream::iterator::current_index() const noexcept
 
 simdjson_inline std::string_view document_stream::iterator::source() const noexcept {
   const char* start = reinterpret_cast<const char*>(stream->buf) + current_index();
+  if (stream->error) {
+    return std::string_view(start, stream->len - current_index());
+  }
   bool object_or_array = ((*start == '[') || (*start == '{'));
   if(object_or_array) {
     size_t next_doc_index = stream->batch_start + stream->parser->implementation->structural_indexes[stream->parser->implementation->next_structural_index - 1];
@@ -14993,9 +15009,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -15006,6 +15027,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -17206,9 +17228,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -17219,6 +17246,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -19906,9 +19934,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -19919,6 +19952,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -22606,9 +22640,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -22619,6 +22658,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -25421,9 +25461,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -25434,6 +25479,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -28553,9 +28599,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -28566,6 +28617,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -31185,9 +31237,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -31198,6 +31255,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -33795,9 +33853,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -33808,6 +33871,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -36422,9 +36486,14 @@ inline dom_parser_implementation &dom_parser_implementation::operator=(dom_parse
 
 // Leaving these here so they can be inlined if so desired
 inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(size_t capacity) noexcept {
-  if(capacity > SIMDJSON_MAXSIZE_BYTES) { return CAPACITY; }
+  if(capacity > SIMDJSON_MAXSIZE_BYTES || capacity > SIZE_MAX - 63) { return CAPACITY; }
   // Stage 1 index output
-  size_t max_structures = SIMDJSON_ROUNDUP_N(capacity, 64) + 2 + 7;
+  size_t rounded_capacity = SIMDJSON_ROUNDUP_N(capacity, 64);
+  if(rounded_capacity + 9 < rounded_capacity) {
+    return CAPACITY; // overflow, only happen on legacy 32-bit systems with very large capacity
+  }
+  size_t max_structures = rounded_capacity + 9;
+  if(max_structures > SIZE_MAX / sizeof(uint32_t)) { return CAPACITY; }
   structural_indexes.reset( new (std::nothrow) uint32_t[max_structures] );
   if (!structural_indexes) { _capacity = 0; return MEMALLOC; }
   structural_indexes[0] = 0;
@@ -36435,6 +36504,7 @@ inline simdjson_warn_unused error_code dom_parser_implementation::set_capacity(s
 }
 
 inline simdjson_warn_unused error_code dom_parser_implementation::set_max_depth(size_t max_depth) noexcept {
+  if(max_depth == 0 || max_depth > SIZE_MAX / sizeof(open_container)) { return CAPACITY; }
   // Stage 2 stacks
   open_containers.reset(new (std::nothrow) open_container[max_depth]);
   is_array.reset(new (std::nothrow) bool[max_depth]);
@@ -39845,7 +39915,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -41940,7 +42010,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -44522,7 +44592,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -47104,7 +47174,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -49801,7 +49871,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -52815,7 +52885,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -55303,7 +55373,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -57814,7 +57884,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -60329,7 +60399,7 @@ simdjson_warn_unused simdjson_result<std::string> extract_fractured_json(
 #define SIMDJSON_EXPERIMENTAL_HAS_RVV 1
 #endif
 #endif
-#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__)
+#if (defined(__PPC64__) || defined(_M_PPC64)) && defined(__ALTIVEC__) && defined(__POWER8_VECTOR__)
 #ifndef SIMDJSON_EXPERIMENTAL_HAS_PPC64
 #define SIMDJSON_EXPERIMENTAL_HAS_PPC64 1
 #endif
@@ -66951,6 +67021,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -70987,7 +71069,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -80330,6 +80412,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -84366,7 +84460,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -94196,6 +94290,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -98232,7 +98338,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -108062,6 +108168,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -112098,7 +112216,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -122043,6 +122161,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -126079,7 +126209,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -136341,6 +136471,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -140377,7 +140519,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -150113,6 +150255,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -154149,7 +154303,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -163908,6 +164062,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -167944,7 +168110,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
@@ -177707,6 +177873,18 @@ class document_stream {
    *   }
    *   size_t truncated = stream.truncated_bytes();
    *
+   * IMPORTANT: this value is only meaningful under the conditions below. It is
+   * computed from stage-1 bookkeeping, and outside these conditions it is not
+   * merely imprecise, it is arbitrary -- it can exceed size_in_bytes() or wrap
+   * around to a huge value. Check it only when both of the following hold:
+   *
+   *   - you iterated all the way to the end of the stream;
+   *   - no document reported an error. Iteration stops at the first failed
+   *     document, which can leave the bookkeeping from a mid-stream batch.
+   *
+   * If you need to know about a truncated tail outside those conditions, track
+   * it yourself from the last successful document (see iterator::current_index()
+   * and iterator::source()).
    */
   inline size_t truncated_bytes() const noexcept;
 
@@ -181743,7 +181921,7 @@ simdjson_inline std::string_view document_stream::iterator::source() const noexc
         // TODO: We could remove trailing whitespaces
         // This returns a string spanning from start of value to the beginning of the next document (excluded)
         {
-          auto next_index = stream->parser->implementation->structural_indexes[++cur_struct_index];
+          auto next_index = stream->batch_start + stream->parser->implementation->structural_indexes[++cur_struct_index];
           // normally the length would be next_index - current_index() - 1, except for the last document
           size_t svlen = next_index - current_index();
           const char *start = reinterpret_cast<const char*>(stream->buf) + current_index();
diff --git a/deps/sqlite/unofficial.gni b/deps/sqlite/unofficial.gni
index 0e62accfb699..a0957c5769d6 100644
--- a/deps/sqlite/unofficial.gni
+++ b/deps/sqlite/unofficial.gni
@@ -4,47 +4,67 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("sqlite_gn_build") {
-  config("sqlite_config") {
-    include_dirs = [ "." ]
-    defines = [
-      "SQLITE_ENABLE_COLUMN_METADATA",
-      "SQLITE_ENABLE_DBSTAT_VTAB",
-      "SQLITE_ENABLE_FTS3",
-      "SQLITE_ENABLE_FTS3_PARENTHESIS",
-      "SQLITE_ENABLE_FTS5",
-      "SQLITE_ENABLE_GEOPOLY",
-      "SQLITE_ENABLE_MATH_FUNCTIONS",
-      "SQLITE_ENABLE_PERCENTILE",
-      "SQLITE_ENABLE_PREUPDATE_HOOK",
-      "SQLITE_ENABLE_RBU",
-      "SQLITE_ENABLE_RTREE",
-      "SQLITE_ENABLE_SESSION",
-    ]
-  }
+  if (node_shared_sqlite) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("sqlite_config") {
+      packages = [ "sqlite3" ]
+    }
+    # sqlite3.h only declares the session extension when this is defined.
+    config("sqlite_defines") {
+      defines = [ "SQLITE_ENABLE_SESSION" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [
+        ":sqlite_config",
+        ":sqlite_defines",
+      ]
+    }
+  } else {
+    config("sqlite_config") {
+      include_dirs = [ "." ]
+      defines = [
+        "SQLITE_ENABLE_COLUMN_METADATA",
+        "SQLITE_ENABLE_DBSTAT_VTAB",
+        "SQLITE_ENABLE_FTS3",
+        "SQLITE_ENABLE_FTS3_PARENTHESIS",
+        "SQLITE_ENABLE_FTS5",
+        "SQLITE_ENABLE_GEOPOLY",
+        "SQLITE_ENABLE_MATH_FUNCTIONS",
+        "SQLITE_ENABLE_PERCENTILE",
+        "SQLITE_ENABLE_PREUPDATE_HOOK",
+        "SQLITE_ENABLE_RBU",
+        "SQLITE_ENABLE_RTREE",
+        "SQLITE_ENABLE_SESSION",
+      ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("sqlite.gyp") ],
-                            "scope",
-                            [ "sqlite.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("sqlite.gyp") ],
+                              "scope",
+                              [ "sqlite.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":sqlite_config" ]
-    sources = gypi_values.sqlite_sources
-    cflags_c = [
-      "-Wno-implicit-fallthrough",
-      "-Wno-unreachable-code-return",
-      "-Wno-unreachable-code-break",
-      "-Wno-unreachable-code",
-    ]
-    if (is_win) {
-      cflags_c += [
-        "-Wno-sign-compare",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-variable",
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":sqlite_config" ]
+      sources = gypi_values.sqlite_sources
+      cflags_c = [
+        "-Wno-implicit-fallthrough",
+        "-Wno-unreachable-code-return",
+        "-Wno-unreachable-code-break",
+        "-Wno-unreachable-code",
       ]
+      if (is_win) {
+        cflags_c += [
+          "-Wno-sign-compare",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-variable",
+        ]
+      }
     }
   }
 }
diff --git a/deps/undici/src/docs/docs/api/Client.md b/deps/undici/src/docs/docs/api/Client.md
index d48b2303f287..5f44ae42db86 100644
--- a/deps/undici/src/docs/docs/api/Client.md
+++ b/deps/undici/src/docs/docs/api/Client.md
@@ -147,6 +147,10 @@ added: v1.0.0
       WebSocket messages. Applied to uncompressed messages, compressed frame
       payloads, and decompressed (`permessage-deflate`) messages. Set to `0` to
       disable the limit. **Default:** `134217728`.
+  * `eventSource` {Object} (optional) EventSource-specific configuration.
+    * `maxEventSize` {number} The maximum allowed event size, in bytes, for
+      EventSource messages. Set to `0` to disable the limit.
+      **Default:** `buffer.kStringMaxLength`.
 * Returns: {Client}
 
 Instantiating a `Client` does not open a connection; the connection is
diff --git a/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md b/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
index 8a6b75a3d67b..f14b8760964e 100644
--- a/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
+++ b/deps/undici/src/docs/docs/api/EnvHttpProxyAgent.md
@@ -25,8 +25,9 @@ it is used only for HTTPS requests.
 proxied. Each entry may include a leading dot or `*.` wildcard (for example
 `.example.com`) to match subdomains, and an optional `:port` suffix to restrict
 the match to a specific port. A request bypasses the proxy when its host equals
-an entry or is a subdomain of one. Setting `no_proxy` to `*` bypasses the proxy
-for every request.
+an entry or is a subdomain of one. A trailing dot is ignored on both sides, so
+`example.com.` and `example.com` match each other. Setting `no_proxy` to `*`
+bypasses the proxy for every request.
 
 The uppercase variants `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` are also
 honored. When both the lowercase and uppercase forms of a variable are set, the
diff --git a/deps/undici/src/docs/docs/api/EventSource.md b/deps/undici/src/docs/docs/api/EventSource.md
index 938a7a8c6f2b..285a983379f7 100644
--- a/deps/undici/src/docs/docs/api/EventSource.md
+++ b/deps/undici/src/docs/docs/api/EventSource.md
@@ -66,6 +66,9 @@ added: v6.5.0
       wait before re-establishing a dropped connection. The server may override
       this value with a `retry` field. **Default:** `3000`.
 
+EventSource-specific limits can be configured on the dispatcher using the
+`eventSource` option. See [`Client`][] for details.
+
 Creates a new `EventSource` and immediately begins connecting to `url`. The
 request is sent with the `Accept: text/event-stream` header, a cache mode of
 `no-store`, and an initiator type of `other`.
@@ -349,6 +352,7 @@ eventSource.onerror = () => {
 ```
 
 [WHATWG-conformant]: https://html.spec.whatwg.org/multipage/server-sent-events.html#server-sent-events
+[`Client`]: Client.md#new-clienturl-options
 [`Dispatcher`]: Dispatcher.md#class-dispatcher
 [`addEventListener()`]: https://developer.mozilla.org/en-US/docs/Web/API/EventTarget/addEventListener
 [server-sent events]: https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events/Using_server-sent_events
diff --git a/deps/undici/src/docs/docs/api/Interceptors.md b/deps/undici/src/docs/docs/api/Interceptors.md
index c692442d7f04..856877c3e4ae 100644
--- a/deps/undici/src/docs/docs/api/Interceptors.md
+++ b/deps/undici/src/docs/docs/api/Interceptors.md
@@ -101,8 +101,8 @@ body yourself.
 
 * `opts` {Object} (optional)
   * `maxSize` {number} Maximum number of bytes to read and discard. Responses
-    whose `Content-Length` exceeds this value are aborted. **Default:**
-    `1_048_576` (1 MiB).
+    whose declared or received body size exceeds this value are aborted.
+    **Default:** `1_048_576` (1 MiB).
 
 Per-request override: set `dumpMaxSize` on the dispatch options to override
 the global `maxSize` for a specific request.
@@ -210,6 +210,9 @@ Automatically decompresses response bodies encoded with `gzip`, `x-gzip`,
     skipped. **Default:** `[204, 304]`.
   * `skipErrorResponses` {boolean} When `true`, responses with a status code
     >= 400 are not decompressed. **Default:** `true`.
+  * `maxSize` {number} Maximum decompressed response size in bytes. The request
+    fails with a `ResponseExceededMaxSizeError` if the decoded body exceeds
+    this limit. **Default:** `67108864` (64 MiB).
 
 **Returns:** {Dispatcher.DispatcherComposeInterceptor}
 
@@ -221,7 +224,8 @@ import { Agent, interceptors } from 'undici'
 const agent = new Agent().compose(
   interceptors.decompress({
     skipStatusCodes: [204, 304],
-    skipErrorResponses: false // decompress error bodies too
+    skipErrorResponses: false, // decompress error bodies too
+    maxSize: 16 * 1024 * 1024 // limit decoded bodies to 16 MiB
   })
 )
 ```
diff --git a/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md b/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
index 21fec19b141e..783424da5114 100644
--- a/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
+++ b/deps/undici/src/docs/docs/api/Socks5ProxyAgent.md
@@ -60,6 +60,11 @@ added: v7.23.0
     a password embedded in `proxyUrl`. **Default:** the URL password, if any.
   * `connect` {Function} Custom connector used to open the socket to the proxy.
     **Default:** a connector built from `proxyTls`.
+  * `connectTimeout` {number} Maximum time in milliseconds for each proxy
+    connection, SOCKS5 negotiation, and target TLS negotiation stage. A value of
+    `0` disables these stage timeouts. `proxyTls.timeout` and
+    `requestTls.timeout` override it for their respective TLS stages.
+    **Default:** `5000`.
   * `proxyTls` {BuildOptions} TLS options for the connection to the proxy itself
     (SOCKS5 over TLS). When set, the proxy connection is established over TLS and
     `servername` defaults to the proxy host name.
@@ -69,7 +74,8 @@ added: v7.23.0
     host name.
 
 Throws an `InvalidArgumentError` if `proxyUrl` is missing or does not use the
-`socks5:` or `socks:` protocol.
+`socks5:` or `socks:` protocol, or if `connectTimeout`, `proxyTls.timeout`, or
+`requestTls.timeout` is not a finite, non-negative number.
 
 ```mjs
 import { Socks5ProxyAgent } from 'undici'
diff --git a/deps/undici/src/lib/cache/memory-cache-store.js b/deps/undici/src/lib/cache/memory-cache-store.js
index 5ea0f7247dd7..07dba9c3988e 100644
--- a/deps/undici/src/lib/cache/memory-cache-store.js
+++ b/deps/undici/src/lib/cache/memory-cache-store.js
@@ -87,7 +87,7 @@ class MemoryCacheStore extends EventEmitter {
   }
 
   /**
-   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} req
+   * @param {import('../../types/cache-interceptor.d.ts').default.CacheKey} key
    * @returns {import('../../types/cache-interceptor.d.ts').default.GetResult | undefined}
    */
   get (key) {
@@ -179,7 +179,7 @@ class MemoryCacheStore extends EventEmitter {
 
           // Perform eviction
           for (const [key, entries] of store.#entries) {
-            for (const entry of entries.splice(0, entries.length / 2)) {
+            for (const entry of entries.splice(0, Math.ceil(entries.length / 2))) {
               store.#size -= entry.size
               store.#count -= 1
             }
diff --git a/deps/undici/src/lib/core/symbols.js b/deps/undici/src/lib/core/symbols.js
index badecb709086..5186052881bf 100644
--- a/deps/undici/src/lib/core/symbols.js
+++ b/deps/undici/src/lib/core/symbols.js
@@ -5,6 +5,8 @@ module.exports = {
   kDestroy: Symbol('destroy'),
   kDispatch: Symbol('dispatch'),
   kUrl: Symbol('url'),
+  kRequestOrigin: Symbol('request origin'),
+  kOriginless: Symbol('originless'),
   kWriting: Symbol('writing'),
   kResuming: Symbol('resuming'),
   kQueue: Symbol('queue'),
diff --git a/deps/undici/src/lib/dispatcher/agent.js b/deps/undici/src/lib/dispatcher/agent.js
index 1e670746e8e9..95c1b0923f08 100644
--- a/deps/undici/src/lib/dispatcher/agent.js
+++ b/deps/undici/src/lib/dispatcher/agent.js
@@ -1,7 +1,7 @@
 'use strict'
 
 const { InvalidArgumentError, MaxOriginsReachedError } = require('../core/errors')
-const { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
+const { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require('../core/symbols')
 const DispatcherBase = require('./dispatcher-base')
 const Pool = require('./pool')
 const Client = require('./client')
@@ -97,7 +97,12 @@ class Agent extends DispatcherBase {
           return
         }
 
-        if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+        // A GOAWAY detaches the HTTP/2 session before requeued requests are
+        // dispatched on a replacement connection. At that point the pool has
+        // no connected clients and is not busy, but it still has pending work.
+        // Closing it here lets the replacement Client finish those requests
+        // and then destroys that new connection with ClientDestroyedError.
+        if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
           return
         }
 
diff --git a/deps/undici/src/lib/dispatcher/balanced-pool.js b/deps/undici/src/lib/dispatcher/balanced-pool.js
index ca14bf6ed1d5..dbd9ebc8a552 100644
--- a/deps/undici/src/lib/dispatcher/balanced-pool.js
+++ b/deps/undici/src/lib/dispatcher/balanced-pool.js
@@ -13,7 +13,7 @@ const {
   kGetDispatcher
 } = require('./pool-base')
 const Pool = require('./pool')
-const { kUrl } = require('../core/symbols')
+const { kOriginless, kUrl } = require('../core/symbols')
 const util = require('../core/util')
 const kFactory = Symbol('factory')
 
@@ -49,14 +49,17 @@ function defaultFactory (origin, opts) {
 }
 
 class BalancedPool extends PoolBase {
-  constructor (upstreams = [], { factory = defaultFactory, ...opts } = {}) {
+  constructor (upstreams = [], { factory = defaultFactory, connect, tls, ...opts } = {}) {
     if (typeof factory !== 'function') {
       throw new InvalidArgumentError('factory must be a function.')
     }
 
-    super()
+    super(opts)
 
-    this[kOptions] = { ...util.deepClone(opts) }
+    this[kOriginless] = true
+    if (connect && typeof connect !== 'function') connect = { ...connect }
+    if (tls && typeof tls !== 'function') tls = { ...tls }
+    this[kOptions] = { ...util.deepClone(opts), connect, tls }
     this[kIndex] = -1
     this[kCurrentWeight] = 0
 
diff --git a/deps/undici/src/lib/dispatcher/client-h1.js b/deps/undici/src/lib/dispatcher/client-h1.js
index 9f6f17c1579b..f06ca74bfe53 100644
--- a/deps/undici/src/lib/dispatcher/client-h1.js
+++ b/deps/undici/src/lib/dispatcher/client-h1.js
@@ -1052,7 +1052,7 @@ function onSocketClose () {
 
 function clearIdleSocketValidation (socket) {
   if (socket[kIdleSocketValidationTimeout]) {
-    clearTimeout(socket[kIdleSocketValidationTimeout])
+    clearImmediate(socket[kIdleSocketValidationTimeout])
     socket[kIdleSocketValidationTimeout] = null
   }
 
@@ -1061,15 +1061,23 @@ function clearIdleSocketValidation (socket) {
 
 function scheduleIdleSocketValidation (client, socket) {
   socket[kIdleSocketValidation] = 1
-  socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+  // Yield to the check phase (after poll) so unsolicited bytes / FIN / RST
+  // already pending on this idle keep-alive socket are processed before the
+  // next request is written (GHSA-35p6-xmwp-9g52).
+  //
+  // setTimeout(0) pays Node's ~1ms timer floor on every sequential reuse
+  // (#5493). setImmediate avoids that, but an *unref'd* Immediate lets poll
+  // block for ~500ms when the event loop is otherwise idle (#5600 / #5606).
+  // A ref'd Immediate both keeps the pending request alive and makes poll
+  // return immediately — the hybrid those issues asked for.
+  socket[kIdleSocketValidationTimeout] = setImmediate(() => {
     socket[kIdleSocketValidationTimeout] = null
     socket[kIdleSocketValidation] = 2
 
     if (client[kSocket] === socket && !socket.destroyed) {
       client[kResume]()
     }
-  }, 0)
-  socket[kIdleSocketValidationTimeout].unref?.()
+  })
 }
 
 /**
diff --git a/deps/undici/src/lib/dispatcher/client-h2.js b/deps/undici/src/lib/dispatcher/client-h2.js
index bc401008f004..55179000ebaf 100644
--- a/deps/undici/src/lib/dispatcher/client-h2.js
+++ b/deps/undici/src/lib/dispatcher/client-h2.js
@@ -10,7 +10,8 @@ const {
   InformationalError,
   InvalidArgumentError,
   HeadersTimeoutError,
-  BodyTimeoutError
+  BodyTimeoutError,
+  ResponseExceededMaxSizeError
 } = require('../core/errors.js')
 const {
   kUrl,
@@ -39,7 +40,8 @@ const {
   kRemoteSettings,
   kHTTP2Stream,
   kHTTP2SessionState,
-  kHTTP2Options
+  kHTTP2Options,
+  kMaxResponseSize
 } = require('../core/symbols.js')
 const { channels } = require('../core/diagnostics.js')
 
@@ -1022,9 +1024,11 @@ function writeH2 (client, request) {
   const state = {
     abort: null,
     body: request.body,
+    bytesRead: 0,
     client,
     contentLength: null,
     expectsPayload: false,
+    maxResponseSize: client[kMaxResponseSize],
     request,
     headersTimeout,
     bodyTimeout,
@@ -1260,6 +1264,7 @@ function writeH2 (client, request) {
   // become unreachable once the stream closes, so plain `on` avoids the
   // per-listener `once` wrapper allocation.
   stream.on('response', onResponse)
+  stream.on('headers', onInterimResponse)
   stream.on('end', onEnd)
   stream.on('error', onError)
   stream.on('frameError', onFrameError)
@@ -1280,6 +1285,7 @@ function removeRequestStreamListeners (stream) {
   stream.off('error', noop)
   stream.off('continue', writeBodyH2)
   stream.off('response', onResponse)
+  stream.off('headers', onInterimResponse)
   stream.off('end', onEnd)
   stream.off('error', onError)
   stream.off('frameError', onFrameError)
@@ -1322,17 +1328,51 @@ function onData (chunk) {
     return
   }
 
-  const { request } = state
+  const { request, maxResponseSize } = state
 
   if (request.aborted || request.completed) {
     return
   }
 
+  if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+    // Unlike HTTP/1.1, which destroys the socket because it cannot abandon one
+    // response without losing framing, resetting the offending stream leaves
+    // the session usable for its siblings.
+    state.abort(new ResponseExceededMaxSizeError())
+    return
+  }
+
+  state.bytesRead += chunk.length
+
   if (request.onResponseData(chunk) === false) {
     stream.pause()
   }
 }
 
+function onInterimResponse (headers) {
+  const stream = this
+  const state = stream[kRequestStreamState]
+
+  if (state == null) {
+    return
+  }
+
+  const { request } = state
+
+  if (request.aborted || request.completed) {
+    return
+  }
+
+  // node http2 emits 'headers' for interim (1xx) informational responses,
+  // while the final response arrives via 'response'. Forward these to the
+  // handler so that onInfo is invoked, matching the HTTP/1 behaviour and the
+  // documented onInfo contract.
+  const statusCode = headers[HTTP2_HEADER_STATUS]
+  delete headers[HTTP2_HEADER_STATUS]
+
+  request.onResponseStart(Number(statusCode), headers, noop, '')
+}
+
 function onResponse (headers) {
   const stream = this
   const state = stream[kRequestStreamState]
diff --git a/deps/undici/src/lib/dispatcher/client.js b/deps/undici/src/lib/dispatcher/client.js
index d620e8310cfb..ec81541f9a59 100644
--- a/deps/undici/src/lib/dispatcher/client.js
+++ b/deps/undici/src/lib/dispatcher/client.js
@@ -137,7 +137,8 @@ class Client extends DispatcherBase {
     connectionWindowSize,
     pingInterval,
     webSocket,
-    h2Options
+    h2Options,
+    eventSource
   } = {}) {
     if (keepAlive !== undefined) {
       throw new InvalidArgumentError('unsupported keepAlive, use pipelining=0 instead')
@@ -276,7 +277,7 @@ class Client extends DispatcherBase {
       }
     }
 
-    super({ webSocket })
+    super({ webSocket, eventSource })
 
     if (typeof connect !== 'function') {
       connect = buildConnector({
diff --git a/deps/undici/src/lib/dispatcher/dispatcher-base.js b/deps/undici/src/lib/dispatcher/dispatcher-base.js
index 21b5e346acad..d9d15d6441a9 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher-base.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher-base.js
@@ -1,5 +1,6 @@
 'use strict'
 
+const buffer = require('node:buffer')
 const Dispatcher = require('./dispatcher')
 const {
   ClientDestroyedError,
@@ -11,6 +12,7 @@ const { kDestroy, kClose, kClosed, kDestroyed, kDispatch } = require('../core/sy
 const kOnDestroyed = Symbol('onDestroyed')
 const kOnClosed = Symbol('onClosed')
 const kWebSocketOptions = Symbol('webSocketOptions')
+const kEventSourceOptions = Symbol('eventSourceOptions')
 
 class DispatcherBase extends Dispatcher {
   /** @type {boolean} */
@@ -31,10 +33,11 @@ class DispatcherBase extends Dispatcher {
   constructor (opts) {
     super()
     this[kWebSocketOptions] = opts?.webSocket ?? {}
+    this[kEventSourceOptions] = opts?.eventSource ?? {}
   }
 
   /**
-   * @returns {import('../../types/dispatcher').WebSocketOptions}
+   * @returns {import('../../types/client').Client.WebSocketOptions}
    */
   get webSocketOptions () {
     return {
@@ -43,6 +46,15 @@ class DispatcherBase extends Dispatcher {
     }
   }
 
+  /**
+   * @returns {import('../../types/client').Client.EventSourceOptions}
+   */
+  get eventSourceOptions () {
+    return {
+      maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+    }
+  }
+
   /** @returns {boolean} */
   get destroyed () {
     return this[kDestroyed]
diff --git a/deps/undici/src/lib/dispatcher/dispatcher.js b/deps/undici/src/lib/dispatcher/dispatcher.js
index ecff2a9b1685..11a7ab2b4476 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher.js
@@ -1,5 +1,6 @@
 'use strict'
 const EventEmitter = require('node:events')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class Dispatcher extends EventEmitter {
   dispatch () {
@@ -17,6 +18,10 @@ class Dispatcher extends EventEmitter {
   compose (...args) {
     // So we handle [interceptor1, interceptor2] or interceptor1, interceptor2, ...
     const interceptors = Array.isArray(args[0]) ? args[0] : args
+    // null disables origin-dependent interceptors; undefined uses opts.origin.
+    const interceptorOrigin = this[kOriginless] === true
+      ? null
+      : this[kUrl]?.origin
     let dispatch = this.dispatch.bind(this)
 
     for (const interceptor of interceptors) {
@@ -28,13 +33,22 @@ class Dispatcher extends EventEmitter {
         throw new TypeError(`invalid interceptor, expected function received ${typeof interceptor}`)
       }
 
-      dispatch = interceptor(dispatch)
+      dispatch = interceptor(dispatch, interceptorOrigin)
 
       if (dispatch == null || typeof dispatch !== 'function' || dispatch.length !== 2) {
         throw new TypeError('invalid interceptor')
       }
     }
 
+    const originalDispatch = dispatch
+    const self = this
+    dispatch = function (opts, handler) {
+      if (opts && typeof opts === 'object' && !opts.origin && self[kUrl]) {
+        opts = Object.assign({}, opts, { origin: self[kUrl].origin })
+      }
+      return originalDispatch(opts, handler)
+    }
+
     return new Proxy(this, {
       get: (target, key) => key === 'dispatch' ? dispatch : target[key]
     })
diff --git a/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js b/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
index f5813288cb33..e206984d5a47 100644
--- a/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
+++ b/deps/undici/src/lib/dispatcher/dispatcher1-wrapper.js
@@ -3,6 +3,7 @@
 const Dispatcher = require('./dispatcher')
 const { InvalidArgumentError } = require('../core/errors')
 const { toRawHeaders } = require('../core/util')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class LegacyHandlerWrapper {
   #handler
@@ -71,6 +72,8 @@ class Dispatcher1Wrapper extends Dispatcher {
     }
 
     this.#dispatcher = dispatcher
+    this[kUrl] = dispatcher[kUrl]
+    this[kOriginless] = dispatcher[kOriginless]
   }
 
   static wrapHandler (handler) {
diff --git a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
index 51c50601714b..5d943dbd250e 100644
--- a/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/env-http-proxy-agent.js
@@ -16,7 +16,7 @@ class EnvHttpProxyAgent extends DispatcherBase {
   #opts = null
 
   constructor (opts = {}) {
-    super()
+    super(opts)
     this.#opts = opts
 
     const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts
@@ -69,6 +69,13 @@ class EnvHttpProxyAgent extends DispatcherBase {
     // brackets from IPv6 literals (e.g. "[::1]" -> "::1") so that the
     // result matches the unbracketed form stored by #parseNoProxy.
     hostname = hostname.replace(/:\d*$/, '').replace(/^\[(.+)\]$/, '$1').toLowerCase()
+    // Drop a trailing dot: it only marks the fully qualified form of a domain
+    // name ("example.com." and "example.com" are the same name, RFC 1034 root
+    // label). This runs on every dispatch, so it is a charCode check rather
+    // than a third regex. `length > 1` leaves the degenerate host "." alone.
+    if (hostname.length > 1 && hostname.charCodeAt(hostname.length - 1) === 46) {
+      hostname = hostname.slice(0, -1)
+    }
     port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0
     if (!this.#shouldProxy(hostname, port)) {
       return this[kNoProxyAgent]
@@ -143,8 +150,8 @@ class EnvHttpProxyAgent extends DispatcherBase {
       }
 
       noProxyEntries.push({
-        // strip leading dot or asterisk with dot
-        hostname: hostname.replace(/^\*?\./, '').toLowerCase(),
+        // strip leading dot or asterisk with dot, and any trailing dot
+        hostname: hostname.replace(/^\*?\./, '').replace(/^(.+)\.$/, '$1').toLowerCase(),
         port
       })
     }
diff --git a/deps/undici/src/lib/dispatcher/proxy-agent.js b/deps/undici/src/lib/dispatcher/proxy-agent.js
index 0b07b2fe8fe0..2b118581eec8 100644
--- a/deps/undici/src/lib/dispatcher/proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/proxy-agent.js
@@ -9,6 +9,7 @@ const buildConnector = require('../core/connect')
 const Client = require('./client')
 const { channels } = require('../core/diagnostics')
 const Socks5ProxyAgent = require('./socks5-proxy-agent')
+const { hasSafeIterator } = require('../core/util')
 
 const kAgent = Symbol('proxy agent')
 const kClient = Symbol('proxy client')
@@ -120,7 +121,7 @@ class ProxyAgent extends DispatcherBase {
 
     const { proxyTunnel, connectTimeout } = opts
 
-    super()
+    super(opts)
 
     const url = this.#getUrl(opts)
     const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url
@@ -161,6 +162,7 @@ class ProxyAgent extends DispatcherBase {
           factory: agentFactory,
           username: opts.username || username,
           password: opts.password || password,
+          connectTimeout,
           proxyTls: opts.proxyTls,
           requestTls: opts.requestTls
         })
@@ -344,6 +346,21 @@ function buildHeaders (headers) {
     return headersPair
   }
 
+  // Materialize iterable header containers (e.g. Map, Headers) into a record so
+  // that throwIfProxyAuthIsSent() can inspect their entries. Object.keys and
+  // for...in see nothing on a Map/Headers instance, so without this the
+  // Proxy-Authorization guard is bypassed and proxy credentials can reach the
+  // origin server (GHSA-6cv7-626c-qhqw).
+  if (headers && typeof headers === 'object' && hasSafeIterator(headers)) {
+    const headersPair = {}
+
+    for (const [key, value] of headers) {
+      headersPair[key] = value
+    }
+
+    return headersPair
+  }
+
   return headers
 }
 
diff --git a/deps/undici/src/lib/dispatcher/retry-agent.js b/deps/undici/src/lib/dispatcher/retry-agent.js
index 0c2120d6f26a..0b50f22a3181 100644
--- a/deps/undici/src/lib/dispatcher/retry-agent.js
+++ b/deps/undici/src/lib/dispatcher/retry-agent.js
@@ -2,6 +2,7 @@
 
 const Dispatcher = require('./dispatcher')
 const RetryHandler = require('../handler/retry-handler')
+const { kOriginless, kUrl } = require('../core/symbols')
 
 class RetryAgent extends Dispatcher {
   #agent = null
@@ -10,6 +11,8 @@ class RetryAgent extends Dispatcher {
     super(options)
     this.#agent = agent
     this.#options = options
+    this[kUrl] = agent[kUrl]
+    this[kOriginless] = agent[kOriginless]
   }
 
   dispatch (opts, handler) {
diff --git a/deps/undici/src/lib/dispatcher/round-robin-pool.js b/deps/undici/src/lib/dispatcher/round-robin-pool.js
index b1f4763530f5..1db82a9ccb3b 100644
--- a/deps/undici/src/lib/dispatcher/round-robin-pool.js
+++ b/deps/undici/src/lib/dispatcher/round-robin-pool.js
@@ -65,7 +65,7 @@ class RoundRobinPool extends PoolBase {
       })
     }
 
-    super()
+    super(options)
 
     this[kConnections] = connections || null
     this[kUrl] = util.parseOrigin(origin)
diff --git a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
index 909c7f502478..e380005ffb61 100644
--- a/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
+++ b/deps/undici/src/lib/dispatcher/socks5-proxy-agent.js
@@ -4,22 +4,33 @@ const { URL } = require('node:url')
 
 let tls // include tls conditionally since it is not always available
 const DispatcherBase = require('./dispatcher-base')
-const { InvalidArgumentError } = require('../core/errors')
+const { ConnectTimeoutError, InvalidArgumentError } = require('../core/errors')
 const { Socks5Client, STATES } = require('../core/socks5-client')
 const { kBusy, kConnected, kDispatch, kClose, kDestroy } = require('../core/symbols')
 const Pool = require('./pool')
 const buildConnector = require('../core/connect')
+const { setupConnectTimeout } = require('../core/util')
 const { debuglog } = require('node:util')
 
 const debug = debuglog('undici:socks5-proxy')
 
+const DEFAULT_SOCKS5_CONNECT_TIMEOUT = 5000
+
 const kProxyUrl = Symbol('proxy url')
 const kProxyHeaders = Symbol('proxy headers')
 const kProxyAuth = Symbol('proxy auth')
 const kProxyProtocol = Symbol('proxy protocol')
 const kPools = Symbol('pools')
 const kConnector = Symbol('connector')
+const kConnectTimeout = Symbol('connect timeout')
 const kRequestTls = Symbol('request tls settings')
+const kRequestTlsTimeout = Symbol('request tls timeout')
+
+function createConnectTimeoutError (hostname, port, timeout) {
+  return new ConnectTimeoutError(
+    `Connect Timeout Error (attempted address: ${hostname}:${port}, timeout: ${timeout}ms)`
+  )
+}
 
 // Static flag to ensure warning is only emitted once per process
 let experimentalWarningEmitted = false
@@ -29,7 +40,7 @@ let experimentalWarningEmitted = false
  */
 class Socks5ProxyAgent extends DispatcherBase {
   constructor (proxyUrl, options = {}) {
-    super()
+    super(options)
 
     // Emit experimental warning only once
     if (!experimentalWarningEmitted) {
@@ -54,7 +65,20 @@ class Socks5ProxyAgent extends DispatcherBase {
     this[kProxyUrl] = url
     this[kProxyHeaders] = options.headers || {}
     this[kProxyProtocol] = options.proxyTls ? 'https:' : 'http:'
-    this[kRequestTls] = options.requestTls
+
+    const connectTimeout = options.connectTimeout ?? DEFAULT_SOCKS5_CONNECT_TIMEOUT
+    if (!Number.isFinite(connectTimeout) || connectTimeout < 0) {
+      throw new InvalidArgumentError('invalid connectTimeout')
+    }
+    this[kConnectTimeout] = connectTimeout
+
+    const { timeout, ...requestTls } = options.requestTls || {}
+    const requestTlsTimeout = timeout ?? connectTimeout
+    if (!Number.isFinite(requestTlsTimeout) || requestTlsTimeout < 0) {
+      throw new InvalidArgumentError('invalid requestTls.timeout')
+    }
+    this[kRequestTls] = requestTls
+    this[kRequestTlsTimeout] = requestTlsTimeout
 
     // Extract auth from URL or options
     this[kProxyAuth] = {
@@ -63,8 +87,13 @@ class Socks5ProxyAgent extends DispatcherBase {
     }
 
     // Create connector for proxy connection
+    const proxyTlsTimeout = options.proxyTls?.timeout ?? connectTimeout
+    if (!Number.isFinite(proxyTlsTimeout) || proxyTlsTimeout < 0) {
+      throw new InvalidArgumentError('invalid proxyTls.timeout')
+    }
     this[kConnector] = options.connect || buildConnector({
       ...options.proxyTls,
+      timeout: proxyTlsTimeout,
       servername: options.proxyTls?.servername || url.hostname
     })
 
@@ -113,20 +142,29 @@ class Socks5ProxyAgent extends DispatcherBase {
 
     // Wait for authentication (if required)
     const authenticationReady = Promise.withResolvers()
-
-    const authenticationTimeout = setTimeout(() => {
-      authenticationReady.reject(new Error('SOCKS5 authentication timeout'))
-    }, 5000)
-
-    const onAuthenticated = () => {
+    const authenticationTimeout = this[kConnectTimeout] === 0
+      ? null
+      : setTimeout(() => {
+        cleanupAuthenticationListeners()
+        socks5Client.destroy()
+        authenticationReady.reject(
+          createConnectTimeoutError(proxyHost, proxyPort, this[kConnectTimeout])
+        )
+      }, this[kConnectTimeout])
+
+    const cleanupAuthenticationListeners = () => {
       clearTimeout(authenticationTimeout)
+      socks5Client.removeListener('authenticated', onAuthenticated)
       socks5Client.removeListener('error', onAuthenticationError)
+    }
+
+    const onAuthenticated = () => {
+      cleanupAuthenticationListeners()
       authenticationReady.resolve()
     }
 
     const onAuthenticationError = (err) => {
-      clearTimeout(authenticationTimeout)
-      socks5Client.removeListener('authenticated', onAuthenticated)
+      cleanupAuthenticationListeners()
       authenticationReady.reject(err)
     }
 
@@ -146,21 +184,30 @@ class Socks5ProxyAgent extends DispatcherBase {
 
     // Wait for connection
     const connectionReady = Promise.withResolvers()
-
-    const connectionTimeout = setTimeout(() => {
-      connectionReady.reject(new Error('SOCKS5 connection timeout'))
-    }, 5000)
+    const connectionTimeout = this[kConnectTimeout] === 0
+      ? null
+      : setTimeout(() => {
+        cleanupConnectionListeners()
+        socks5Client.destroy()
+        connectionReady.reject(
+          createConnectTimeoutError(targetHost, targetPort, this[kConnectTimeout])
+        )
+      }, this[kConnectTimeout])
+
+    const cleanupConnectionListeners = () => {
+      clearTimeout(connectionTimeout)
+      socks5Client.removeListener('connected', onConnected)
+      socks5Client.removeListener('error', onConnectionError)
+    }
 
     const onConnected = (info) => {
       debug('SOCKS5 tunnel established to', targetHost, targetPort, 'via', info)
-      clearTimeout(connectionTimeout)
-      socks5Client.removeListener('error', onConnectionError)
+      cleanupConnectionListeners()
       connectionReady.resolve()
     }
 
     const onConnectionError = (err) => {
-      clearTimeout(connectionTimeout)
-      socks5Client.removeListener('connected', onConnected)
+      cleanupConnectionListeners()
       connectionReady.reject(err)
     }
 
@@ -213,8 +260,31 @@ class Socks5ProxyAgent extends DispatcherBase {
                 })
 
                 const tlsReady = Promise.withResolvers()
-                finalSocket.once('secureConnect', tlsReady.resolve)
-                finalSocket.once('error', tlsReady.reject)
+
+                const cleanupTlsListeners = () => {
+                  queueMicrotask(clearTlsTimeout)
+                  finalSocket.removeListener('secureConnect', onSecureConnect)
+                  finalSocket.removeListener('error', onTlsError)
+                }
+
+                const onSecureConnect = () => {
+                  cleanupTlsListeners()
+                  tlsReady.resolve()
+                }
+
+                const onTlsError = (err) => {
+                  cleanupTlsListeners()
+                  tlsReady.reject(err)
+                }
+
+                const clearTlsTimeout = setupConnectTimeout(new WeakRef(finalSocket), {
+                  timeout: this[kRequestTlsTimeout],
+                  hostname: targetHost,
+                  port: targetPort
+                })
+
+                finalSocket.once('secureConnect', onSecureConnect)
+                finalSocket.once('error', onTlsError)
                 await tlsReady.promise
               }
 
diff --git a/deps/undici/src/lib/handler/cache-handler.js b/deps/undici/src/lib/handler/cache-handler.js
index bdfc0d94a433..2ec550b431ad 100644
--- a/deps/undici/src/lib/handler/cache-handler.js
+++ b/deps/undici/src/lib/handler/cache-handler.js
@@ -173,6 +173,14 @@ class CacheHandler {
     this.#handler.onRequestStart?.(controller, context)
   }
 
+  onBodySent (chunk) {
+    this.#handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.#handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (controller, statusCode, headers, socket) {
     this.#handler.onRequestUpgrade?.(controller, statusCode, headers, socket)
   }
@@ -210,6 +218,13 @@ class CacheHandler {
     }
 
     const cacheControlHeader = resHeaders['cache-control']
+    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
+
+    if (revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives)) {
+      deleteCachedValue(this.#store, this.#cacheKey)
+      return downstreamOnHeaders()
+    }
+
     const heuristicallyCacheable = resHeaders['last-modified'] && arrayIncludes(HEURISTICALLY_CACHEABLE_STATUS_CODES, statusCode)
     if (
       !cacheControlHeader &&
@@ -226,8 +241,7 @@ class CacheHandler {
       return downstreamOnHeaders()
     }
 
-    const cacheControlDirectives = cacheControlHeader ? parseCacheControlHeader(cacheControlHeader) : {}
-    if (!canCacheResponse(this.#cacheType, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
+    if (!canCacheResponse(this.#cacheType, this.#cacheKey.method, statusCode, resHeaders, cacheControlDirectives, this.#cacheKey.headers)) {
       if (statusCode === 304 && (cacheControlHeader || revalidationResponseDisallowsCachedReuse(this.#cacheType, resHeaders, cacheControlDirectives))) {
         deleteCachedValue(this.#store, this.#cacheKey)
       }
@@ -476,7 +490,10 @@ function deleteCachedValueIfNotModified (statusCode, store, cacheKey) {
  */
 function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheControlDirectives) {
   return cacheControlDirectives['no-store'] === true ||
-    (cacheType === 'shared' && cacheControlDirectives.private === true) ||
+    (cacheType === 'shared' && (
+      cacheControlDirectives.private === true ||
+      Object.hasOwn(resHeaders, 'set-cookie')
+    )) ||
     (resHeaders.vary ? isInvalidOrWildcardVaryHeader(resHeaders.vary) : false)
 }
 
@@ -484,12 +501,16 @@ function revalidationResponseDisallowsCachedReuse (cacheType, resHeaders, cacheC
  * @see https://www.rfc-editor.org/rfc/rfc9111.html#name-storing-responses-to-authen
  *
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheOptions['type']} cacheType
+ * @param {string} method
  * @param {number} statusCode
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} resHeaders
  * @param {import('../../types/cache-interceptor.d.ts').default.CacheControlDirectives} cacheControlDirectives
  * @param {import('../../types/header.d.ts').IncomingHttpHeaders} [reqHeaders]
  */
-function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+function canCacheResponse (cacheType, method, statusCode, resHeaders, cacheControlDirectives, reqHeaders) {
+  if (!arrayIncludes(util.safeHTTPMethods, method)) {
+    return false
+  }
   // Status code must be final and understood.
   if (statusCode < 200 || arrayIncludes(NOT_UNDERSTOOD_STATUS_CODES, statusCode)) {
     return false
@@ -510,7 +531,10 @@ function canCacheResponse (cacheType, statusCode, resHeaders, cacheControlDirect
     return false
   }
 
-  if (cacheType === 'shared' && cacheControlDirectives.private === true) {
+  if (cacheType === 'shared' && (
+    cacheControlDirectives.private === true ||
+    Object.hasOwn(resHeaders, 'set-cookie')
+  )) {
     return false
   }
 
diff --git a/deps/undici/src/lib/handler/decorator-handler.js b/deps/undici/src/lib/handler/decorator-handler.js
index 1b53c711324a..bc99893cda0b 100644
--- a/deps/undici/src/lib/handler/decorator-handler.js
+++ b/deps/undici/src/lib/handler/decorator-handler.js
@@ -62,5 +62,11 @@ module.exports = class DecoratorHandler {
   /**
    * @deprecated
    */
-  onBodySent () {}
+  onBodySent (...args) {
+    return this.#handler.onBodySent?.(...args)
+  }
+
+  onRequestSent (...args) {
+    return this.#handler.onRequestSent?.(...args)
+  }
 }
diff --git a/deps/undici/src/lib/handler/deduplication-handler.js b/deps/undici/src/lib/handler/deduplication-handler.js
index 537c4f70e974..4d85e9cde3bf 100644
--- a/deps/undici/src/lib/handler/deduplication-handler.js
+++ b/deps/undici/src/lib/handler/deduplication-handler.js
@@ -365,12 +365,22 @@ class DeduplicationHandler {
       get aborted () { return state.aborted },
       get reason () { return state.reason },
       abort: (reason) => {
+        if (state.aborted) {
+          return
+        }
+
         state.aborted = true
         state.reason = reason ?? null
         waitingHandler.done = true
         waitingHandler.pendingTrailers = null
         waitingHandler.bufferedChunks = []
         waitingHandler.bufferedBytes = 0
+
+        try {
+          handler.onResponseError?.(waitingHandler.controller, state.reason ?? new RequestAbortedError())
+        } catch {
+          // Ignore errors from waiting handlers
+        }
       }
     }
 
@@ -444,12 +454,8 @@ class DeduplicationHandler {
     waitingHandler.bufferedChunks = []
     waitingHandler.bufferedBytes = 0
 
-    try {
-      waitingHandler.controller.abort(err)
-      waitingHandler.handler.onResponseError?.(waitingHandler.controller, err)
-    } catch {
-      // Ignore errors from waiting handlers
-    }
+    // controller.abort(err) notifies the handler via onResponseError
+    waitingHandler.controller.abort(err)
   }
 
   #pruneDoneWaitingHandlers () {
diff --git a/deps/undici/src/lib/handler/redirect-handler.js b/deps/undici/src/lib/handler/redirect-handler.js
index 1b813dac98b9..a5d925086319 100644
--- a/deps/undici/src/lib/handler/redirect-handler.js
+++ b/deps/undici/src/lib/handler/redirect-handler.js
@@ -3,6 +3,7 @@
 const util = require('../core/util')
 const assert = require('node:assert')
 const { InvalidArgumentError } = require('../core/errors')
+const { kRequestOrigin } = require('../core/symbols')
 
 const redirectableStatusCodes = [300, 301, 302, 303, 307, 308]
 
@@ -43,6 +44,14 @@ class RedirectHandler {
     this.handler.onRequestStart?.(controller, { ...context, history: this.history })
   }
 
+  onBodySent (chunk) {
+    this.handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (controller, statusCode, headers, socket) {
     this.handler.onRequestUpgrade?.(controller, statusCode, headers, socket)
   }
@@ -81,8 +90,12 @@ class RedirectHandler {
       ? null
       : headers.location
 
-    if (this.opts.origin) {
-      this.history.push(new URL(this.opts.path, this.opts.origin))
+    const requestOrigin = this.opts[kRequestOrigin] === undefined
+      ? this.opts.origin
+      : this.opts[kRequestOrigin]
+
+    if (requestOrigin) {
+      this.history.push(new URL(this.opts.path, requestOrigin))
     }
 
     if (!this.location) {
@@ -90,7 +103,10 @@ class RedirectHandler {
       return
     }
 
-    const { origin, pathname, search } = util.parseURL(new URL(this.location, this.opts.origin && new URL(this.opts.path, this.opts.origin)))
+    const baseUrl = requestOrigin
+      ? new URL(this.opts.path, requestOrigin)
+      : undefined
+    const { origin, pathname, search } = util.parseURL(new URL(this.location, baseUrl))
     const path = search ? `${pathname}${search}` : pathname
 
     // Check for redirect loops by seeing if we've already visited this URL in our history
@@ -106,9 +122,10 @@ class RedirectHandler {
     // Remove headers referring to the original URL.
     // By default it is Host only. A 303 or a 301/302 POST-to-GET redirect also removes all Content-* headers.
     // https://tools.ietf.org/html/rfc7231#section-6.4
-    this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, this.opts.origin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect)
+    this.opts.headers = cleanRequestHeaders(this.opts.headers, removeContentHeaders, requestOrigin !== origin, this.stripHeadersOnRedirect, this.stripHeadersOnCrossOriginRedirect)
     this.opts.path = path
     this.opts.origin = origin
+    this.opts[kRequestOrigin] = origin
     this.opts.query = null
   }
 
diff --git a/deps/undici/src/lib/handler/retry-handler.js b/deps/undici/src/lib/handler/retry-handler.js
index c098b510c26c..5703f145d74c 100644
--- a/deps/undici/src/lib/handler/retry-handler.js
+++ b/deps/undici/src/lib/handler/retry-handler.js
@@ -2,7 +2,7 @@
 const assert = require('node:assert')
 
 const { kRetryHandlerDefaultRetry } = require('../core/symbols')
-const { RequestRetryError } = require('../core/errors')
+const { RequestRetryError, RequestAbortedError } = require('../core/errors')
 const {
   isDisturbed,
   parseRangeHeader,
@@ -41,19 +41,42 @@ function validatePartialResponseContentLength (headers, range, statusCode, retry
 // new one: backpressure pauses the new connection's controller, but the
 // consumer's resume() targets the old one, so the resumed body stalls forever.
 // The proxy always forwards to the controller of the currently active connection.
+// An abort is additionally reported to the handler so it can cancel a pending
+// retry backoff instead of letting the request hang until the backoff elapses.
+// The notification is a private callback the handler hands over on construction,
+// so nothing outside the handler can trigger it.
 class RetryController {
-  constructor () {
+  #onAbort
+
+  constructor (onAbort) {
+    this.#onAbort = onAbort
     this.target = null
   }
 
   pause () { this.target?.pause() }
   resume () { this.target?.resume() }
-  abort (reason) { this.target?.abort(reason) }
+
+  abort (reason) {
+    this.target?.abort(reason)
+    this.#onAbort(reason)
+  }
+
   get paused () { return this.target?.paused ?? false }
   get aborted () { return this.target?.aborted ?? false }
   get reason () { return this.target?.reason ?? null }
   get rawHeaders () { return this.target?.rawHeaders ?? null }
+  set rawHeaders (value) {
+    if (this.target) {
+      this.target.rawHeaders = value
+    }
+  }
+
   get rawTrailers () { return this.target?.rawTrailers ?? null }
+  set rawTrailers (value) {
+    if (this.target) {
+      this.target.rawTrailers = value
+    }
+  }
 }
 
 class RetryHandler {
@@ -112,15 +135,32 @@ class RetryHandler {
     this.etag = null
     this.statusCode = null
     this.headers = null
-    this.controllerProxy = new RetryController()
+    this.controllerProxy = new RetryController(reason => this.#onAbort(reason))
+    // A retry decision is in flight (the policy may be holding a backoff
+    // timer). While pending, a consumer abort cancels the wait.
+    this.retryPending = false
+    // Backoff timer returned by the retry policy, so #onAbort can cancel it.
+    // Null for custom policies that do not return their timer.
+    this.retryTimer = null
+    // Set once an abort during the backoff delivered the terminal error
+    // downstream; late policy callbacks and connection errors are then moot.
+    this.aborted = false
   }
 
   onResponseStartWithRetry (controller, statusCode, headers, statusMessage, err) {
     if (this.retryOpts.throwOnError) {
       // Preserve old behavior for status codes that are not eligible for retry
       if (this.retryOpts.statusCodes.includes(statusCode) === false) {
-        this.headersSent = true
-        this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        if (this.headersSent) {
+          // The downstream handler already received the response from an
+          // earlier attempt. Forwarding this response would replace the
+          // downstream body and leave the original body pending forever.
+          this.handler.onResponseError?.(this.controllerProxy, err)
+        } else {
+          this.headersSent = true
+          this.checkpointResponseEnd(headers)
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        }
       } else {
         this.error = err
       }
@@ -130,14 +170,30 @@ class RetryHandler {
 
     if (isDisturbed(this.opts.body)) {
       this.headersSent = true
+      this.checkpointResponseEnd(headers)
       this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
       return
     }
 
     function shouldRetry (passedErr) {
+      if (this.aborted) {
+        // Aborted while the policy was deciding; the decision is moot.
+        return
+      }
+      this.retryPending = false
+      this.retryTimer = null
+
       if (passedErr) {
-        this.headersSent = true
-        this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        if (this.headersSent) {
+          // The downstream handler already received the response from an
+          // earlier attempt. Forwarding this response would replace the
+          // downstream body and leave the original body pending forever.
+          this.handler.onResponseError?.(this.controllerProxy, passedErr)
+        } else {
+          this.headersSent = true
+          this.checkpointResponseEnd(headers)
+          this.handler.onResponseStart?.(this.controllerProxy, statusCode, headers, statusMessage)
+        }
         controller.resume()
         return
       }
@@ -154,14 +210,31 @@ class RetryHandler {
     // between, leaving this one paused forever -- the very stall the proxy exists
     // to prevent.
     controller.pause()
-    this.retryOpts.retry(
+    // The default policy returns its backoff timer so an abort can cancel it;
+    // a custom policy may return anything (or nothing), which is ignored.
+    this.retryPending = true
+    this.retryTimer = this.retryOpts.retry(
       err,
       {
         state: { counter: this.retryCount },
         opts: { retryOptions: this.retryOpts, ...this.opts }
       },
       shouldRetry.bind(this)
-    )
+    ) ?? null
+  }
+
+  checkpointResponseEnd (headers) {
+    if (this.end == null && this.opts.method !== 'HEAD') {
+      const contentLength = headers['content-length']
+      this.end = contentLength != null ? Number(contentLength) - 1 : null
+
+      assert(
+        this.end == null || Number.isFinite(this.end),
+        'invalid content-length'
+      )
+
+      this.resume = this.end != null
+    }
   }
 
   onRequestStart (controller, context) {
@@ -176,6 +249,14 @@ class RetryHandler {
     }
   }
 
+  onBodySent (chunk) {
+    this.handler.onBodySent?.(chunk)
+  }
+
+  onRequestSent () {
+    this.handler.onRequestSent?.()
+  }
+
   onRequestUpgrade (_controller, statusCode, headers, socket) {
     this.handler.onRequestUpgrade?.(this.controllerProxy, statusCode, headers, socket)
   }
@@ -190,7 +271,8 @@ class RetryHandler {
       timeoutFactor,
       statusCodes,
       errorCodes,
-      methods
+      methods,
+      retryAfter
     } = retryOptions
     const { counter } = state
 
@@ -222,7 +304,7 @@ class RetryHandler {
       return
     }
 
-    let retryAfterHeader = headers?.['retry-after']
+    let retryAfterHeader = retryAfter === false ? undefined : headers?.['retry-after']
     if (retryAfterHeader) {
       retryAfterHeader = Number(retryAfterHeader)
       retryAfterHeader = Number.isNaN(retryAfterHeader)
@@ -237,7 +319,9 @@ class RetryHandler {
           ? Math.min(retryAfterHeader, maxTimeout)
           : Math.min(minTimeout * timeoutFactor ** (counter - 1), maxTimeout)
 
-    setTimeout(() => cb(null), retryTimeout)
+    // Return the backoff timer so the handler can cancel it when the
+    // consumer aborts while the retry decision is pending.
+    return setTimeout(() => cb(null), retryTimeout)
   }
 
   onResponseStart (controller, statusCode, headers, statusMessage) {
@@ -251,18 +335,6 @@ class RetryHandler {
     this.statusCode = statusCode
     this.headers = headers
 
-    if (statusCode >= 300) {
-      const err = new RequestRetryError('Request failed', statusCode, {
-        headers,
-        data: {
-          count: this.retryCount
-        }
-      })
-
-      this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err)
-      return
-    }
-
     // Checkpoint for resume from where we left it
     if (this.headersSent) {
       // Only Partial Content 206 supposed to provide Content-Range,
@@ -299,12 +371,28 @@ class RetryHandler {
 
       const { start, size, end = size ? size - 1 : null } = contentRange
 
-      assert(this.start === start, 'content-range mismatch')
-      assert(this.end == null || this.end === end, 'content-range mismatch')
+      if (this.start !== start || (this.end != null && this.end !== end)) {
+        throw new RequestRetryError('Content-Range mismatch', statusCode, {
+          headers,
+          data: { count: this.retryCount }
+        })
+      }
 
       return
     }
 
+    if (statusCode >= 300) {
+      const err = new RequestRetryError('Request failed', statusCode, {
+        headers,
+        data: {
+          count: this.retryCount
+        }
+      })
+
+      this.onResponseStartWithRetry(controller, statusCode, headers, statusMessage, err)
+      return
+    }
+
     if (this.end == null) {
       if (statusCode === 206) {
         // First time we receive 206
@@ -435,14 +523,27 @@ class RetryHandler {
   }
 
   onResponseError (controller, err) {
+    if (this.aborted) {
+      // #onAbort already delivered the terminal error downstream; the late
+      // error of the torn-down connection must not be forwarded twice.
+      return
+    }
+
     // controller is THIS failed connection (not the proxy): we inspect whether
     // the consumer aborted it to decide retry-vs-propagate.
-    if (controller?.aborted || isDisturbed(this.opts.body)) {
+    if (controller?.aborted || isDisturbed(this.opts.body) || (this.headersSent && !this.resume)) {
       this.handler.onResponseError?.(this.controllerProxy, err)
       return
     }
 
     function shouldRetry (returnedErr) {
+      if (this.aborted) {
+        // Aborted while the policy was deciding; the decision is moot.
+        return
+      }
+      this.retryPending = false
+      this.retryTimer = null
+
       if (!returnedErr) {
         this.retry()
         return
@@ -462,14 +563,31 @@ class RetryHandler {
       this.retryCount += 1
     }
 
-    this.retryOpts.retry(
+    this.retryPending = true
+    this.retryTimer = this.retryOpts.retry(
       err,
       {
         state: { counter: this.retryCount },
         opts: { retryOptions: this.retryOpts, ...this.opts }
       },
       shouldRetry.bind(this)
-    )
+    ) ?? null
+  }
+
+  #onAbort (reason) {
+    // A consumer abort lands on the controller proxy. If the retry policy is
+    // still deciding (typically holding a backoff timer), cancel the wait and
+    // surface the abort immediately instead of letting the request hang until
+    // the backoff elapses.
+    if (!this.retryPending) {
+      return
+    }
+
+    this.aborted = true
+    this.retryPending = false
+    clearTimeout(this.retryTimer)
+    this.retryTimer = null
+    this.handler.onResponseError?.(this.controllerProxy, reason ?? new RequestAbortedError())
   }
 }
 
diff --git a/deps/undici/src/lib/interceptor/cache.js b/deps/undici/src/lib/interceptor/cache.js
index 2d7d01f130aa..0b8593f7ee6d 100644
--- a/deps/undici/src/lib/interceptor/cache.js
+++ b/deps/undici/src/lib/interceptor/cache.js
@@ -6,7 +6,16 @@ const util = require('../core/util')
 const CacheHandler = require('../handler/cache-handler')
 const MemoryCacheStore = require('../cache/memory-cache-store')
 const CacheRevalidationHandler = require('../handler/cache-revalidation-handler')
-const { assertCacheStore, assertCacheMethods, makeCacheKey, normalizeHeaders, parseCacheControlHeader, isInvalidOrWildcardVaryHeader } = require('../util/cache.js')
+const {
+  assertCacheStore,
+  assertCacheMethods,
+  getInterceptorOrigin,
+  makeCacheKey,
+  normalizeHeaders,
+  parseCacheControlHeader,
+  isInvalidOrWildcardVaryHeader,
+  parseVaryHeader
+} = require('../util/cache.js')
 const { AbortError } = require('../core/errors.js')
 const { parseHttpDate } = require('../util/date.js')
 
@@ -117,7 +126,10 @@ function staleResponseRequiresRevalidation (result, cacheType) {
  * @returns {boolean}
  */
 function revalidationResponseDisallowsCachedReuse (cacheType, headers) {
-  if (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) {
+  if (
+    (headers.vary && isInvalidOrWildcardVaryHeader(headers.vary)) ||
+    (cacheType === 'shared' && Object.hasOwn(headers, 'set-cookie'))
+  ) {
     return true
   }
 
@@ -135,6 +147,25 @@ function revalidationResponseUpdatesCacheControl (headers) {
   return headers['cache-control'] !== undefined
 }
 
+/**
+ * @param {import('../../types/cache-interceptor.d.ts').default.GetResult} result
+ * @param {Record<string, string | string[] | null> | undefined} varyDirectives
+ * @returns {boolean}
+ */
+function revalidationResponseAddsVary (result, varyDirectives) {
+  if (!varyDirectives) {
+    return false
+  }
+
+  for (const key in varyDirectives) {
+    if (result.vary == null || !Object.hasOwn(result.vary, key)) {
+      return true
+    }
+  }
+
+  return false
+}
+
 function deleteCachedValue (store, cacheKey) {
   try {
     store.delete(cacheKey)?.catch?.(nop)
@@ -389,6 +420,17 @@ function handleResult (
     return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl)
   }
 
+  // Shared stores may outlive the Undici version that wrote them. Do not
+  // re-serve a Set-Cookie header from an existing shared-cache entry.
+  if (globalOpts.type === 'shared' && Object.hasOwn(result.headers, 'set-cookie')) {
+    if (util.isStream(result.body)) {
+      result.body.on('error', nop).destroy()
+    }
+
+    deleteCachedValue(globalOpts.store, cacheKey)
+    return handleUncachedResponse(dispatch, globalOpts, cacheKey, handler, opts, reqCacheControl)
+  }
+
   const now = Date.now()
   if (now > result.deleteAt) {
     // Response is expired, cache store shouldn't have given this to us
@@ -471,6 +513,13 @@ function handleResult (
 
               if (revalidationResponseUpdatesCacheControl(headers)) {
                 deleteCachedValue(globalOpts.store, cacheKey)
+              } else if (revalidationResponseAddsVary(result, headers.vary ? parseVaryHeader(headers.vary, opts.headers) : undefined)) {
+                if (util.isStream(result.body)) {
+                  result.body.on('error', nop).destroy()
+                }
+
+                deleteCachedValue(globalOpts.store, cacheKey)
+                return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
               }
             }
 
@@ -538,29 +587,28 @@ module.exports = (opts = {}) => {
     }
   }
 
-  return dispatch => {
+  return (dispatch, interceptorOrigin) => {
     return (opts, handler) => {
-      if (arrayIncludes(safeMethodsToNotCache, opts.method)) {
-        // Not a method we want to cache, skip
+      const requestOrigin = getInterceptorOrigin(opts, interceptorOrigin)
+      if (!requestOrigin || arrayIncludes(safeMethodsToNotCache, opts.method)) {
+        // We cannot safely cache without an authoritative origin, or this is
+        // not a method we want to cache.
         return dispatch(opts, handler)
       }
 
       // Check if origin is in whitelist
       if (origins !== undefined) {
-        if (!opts.origin) {
-          return dispatch(opts, handler)
-        }
-        const requestOrigin = opts.origin.toString().toLowerCase()
+        const normalizedRequestOrigin = requestOrigin.toString().toLowerCase()
         let isAllowed = false
 
         for (let i = 0; i < origins.length; i++) {
           const allowed = origins[i]
           if (typeof allowed === 'string') {
-            if (allowed.toLowerCase() === requestOrigin) {
+            if (allowed.toLowerCase() === normalizedRequestOrigin) {
               isAllowed = true
               break
             }
-          } else if (allowed.test(requestOrigin)) {
+          } else if (allowed.test(normalizedRequestOrigin)) {
             isAllowed = true
             break
           }
@@ -589,7 +637,12 @@ module.exports = (opts = {}) => {
       /**
        * @type {import('../../types/cache-interceptor.d.ts').default.CacheKey}
        */
-      const cacheKey = makeCacheKey(opts)
+      const cacheKey = makeCacheKey(opts, requestOrigin)
+
+      if (!arrayIncludes(util.safeHTTPMethods, opts.method)) {
+        return dispatch(opts, new CacheHandler(globalOpts, cacheKey, handler))
+      }
+
       const result = store.get(cacheKey)
 
       if (result && typeof result.then === 'function') {
diff --git a/deps/undici/src/lib/interceptor/decompress.js b/deps/undici/src/lib/interceptor/decompress.js
index c675de4197c3..a0e77a37c8c4 100644
--- a/deps/undici/src/lib/interceptor/decompress.js
+++ b/deps/undici/src/lib/interceptor/decompress.js
@@ -1,7 +1,8 @@
 'use strict'
 
 const { createInflate, createGunzip, createBrotliDecompress, createZstdDecompress } = require('node:zlib')
-const { pipeline } = require('node:stream')
+const { pipeline, Transform: TransformStream } = require('node:stream')
+const { InvalidArgumentError, ResponseExceededMaxSizeError } = require('../core/errors')
 const DecoratorHandler = require('../handler/decorator-handler')
 
 /** @typedef {import('node:stream').Transform} Transform */
@@ -20,6 +21,31 @@ const supportedEncodings = {
 }
 
 const defaultSkipStatusCodes = /** @type {const} */ ([204, 304])
+const defaultMaxSize = 64 * 1024 * 1024
+
+/**
+ * Limits the output of one stage in a decompression chain.
+ * @param {number} maxSize - Maximum output size in bytes
+ * @returns {Transform}
+ */
+function createMaxSizeLimiter (maxSize) {
+  let size = 0
+
+  return new TransformStream({
+    transform (chunk, _encoding, callback) {
+      const decompressedSize = size + chunk.length
+      if (decompressedSize > maxSize) {
+        callback(new ResponseExceededMaxSizeError(
+          `Decompressed response size (${decompressedSize}) exceeded maxSize (${maxSize})`
+        ))
+        return
+      }
+
+      size = decompressedSize
+      callback(null, chunk)
+    }
+  })
+}
 
 let warningEmitted = /** @type {boolean} */ (false)
 
@@ -27,6 +53,7 @@ let warningEmitted = /** @type {boolean} */ (false)
  * @typedef {Object} DecompressHandlerOptions
  * @property {number[]|Readonly<number[]>} [skipStatusCodes=[204, 304]] - List of status codes to skip decompression for
  * @property {boolean} [skipErrorResponses] - Whether to skip decompression for error responses (status codes >= 400)
+ * @property {number} [maxSize=67108864] - Maximum decompressed response size in bytes
  */
 
 class DecompressHandler extends DecoratorHandler {
@@ -38,11 +65,24 @@ class DecompressHandler extends DecoratorHandler {
   #skipStatusCodes
   /** @type {boolean} */
   #skipErrorResponses
+  /** @type {number} */
+  #maxSize
+  /** @type {number} */
+  #decompressedSize = 0
+  /** @type {boolean} */
+  #terminated = false
+  /** @type {boolean} */
+  #inputEnded = false
+
+  constructor (handler, { skipStatusCodes = defaultSkipStatusCodes, skipErrorResponses = true, maxSize = defaultMaxSize } = {}) {
+    if (!Number.isSafeInteger(maxSize) || maxSize < 1) {
+      throw new InvalidArgumentError('maxSize must be a positive integer')
+    }
 
-  constructor (handler, { skipStatusCodes = defaultSkipStatusCodes, skipErrorResponses = true } = {}) {
     super(handler)
     this.#skipStatusCodes = skipStatusCodes
     this.#skipErrorResponses = skipErrorResponses
+    this.#maxSize = maxSize
   }
 
   /**
@@ -62,7 +102,7 @@ class DecompressHandler extends DecoratorHandler {
    * Creates a chain of decompressors for multiple content encodings
    *
    * @param {string} encodings - Comma-separated list of content encodings
-   * @returns {Array<DecompressorStream>} - Array of decompressor streams
+   * @returns {Array<Transform>} - Array of decompressor and limiting streams
    * @throws {Error} - If the number of content-encodings exceeds the maximum allowed
    */
   #createDecompressionChain (encodings) {
@@ -90,7 +130,40 @@ class DecompressHandler extends DecoratorHandler {
       decompressors.push(supportedEncodings[encoding]())
     }
 
-    return decompressors
+    if (decompressors.length < 2) {
+      return decompressors
+    }
+
+    /** @type {Transform[]} */
+    const streams = []
+    for (let i = 0; i < decompressors.length; i++) {
+      streams.push(decompressors[i])
+      if (i < decompressors.length - 1) {
+        streams.push(createMaxSizeLimiter(this.#maxSize))
+      }
+    }
+
+    return streams
+  }
+
+  /**
+   * Stops decompression and reports an error.
+   * @param {Controller} controller - The controller to coordinate with
+   * @param {Error} error - The decompression error
+   * @returns {void}
+   */
+  #fail (controller, error) {
+    if (this.#terminated) {
+      return
+    }
+
+    if (this.#inputEnded) {
+      // The request is already marked complete once the compressed input ends,
+      // so controller.abort() can no longer propagate decoder flush errors.
+      this.onResponseError(controller, error)
+    } else {
+      controller.abort(error)
+    }
   }
 
   /**
@@ -101,8 +174,21 @@ class DecompressHandler extends DecoratorHandler {
    */
   #setupDecompressorEvents (decompressor, controller) {
     decompressor.on('readable', () => {
+      if (this.#terminated) {
+        return
+      }
+
       let chunk
       while ((chunk = decompressor.read()) !== null) {
+        const decompressedSize = this.#decompressedSize + chunk.length
+        if (decompressedSize > this.#maxSize) {
+          this.#fail(controller, new ResponseExceededMaxSizeError(
+            `Decompressed response size (${decompressedSize}) exceeded maxSize (${this.#maxSize})`
+          ))
+          return
+        }
+
+        this.#decompressedSize = decompressedSize
         const result = super.onResponseData(controller, chunk)
         if (result === false) {
           break
@@ -111,7 +197,7 @@ class DecompressHandler extends DecoratorHandler {
     })
 
     decompressor.on('error', (error) => {
-      super.onResponseError(controller, error)
+      this.#fail(controller, error)
     })
   }
 
@@ -125,6 +211,12 @@ class DecompressHandler extends DecoratorHandler {
     this.#setupDecompressorEvents(decompressor, controller)
 
     decompressor.on('end', () => {
+      if (this.#terminated) {
+        return
+      }
+
+      this.#terminated = true
+      this.#cleanupDecompressors()
       super.onResponseEnd(controller, this.#trailers)
     })
   }
@@ -139,10 +231,17 @@ class DecompressHandler extends DecoratorHandler {
     this.#setupDecompressorEvents(lastDecompressor, controller)
 
     pipeline(this.#decompressors, (err) => {
+      if (this.#terminated) {
+        return
+      }
+
       if (err) {
-        super.onResponseError(controller, err)
+        this.#fail(controller, err)
         return
       }
+
+      this.#terminated = true
+      this.#cleanupDecompressors()
       super.onResponseEnd(controller, this.#trailers)
     })
   }
@@ -198,7 +297,7 @@ class DecompressHandler extends DecoratorHandler {
 
           filteredHeaders.push(rawHeaders[i], rawHeaders[i + 1])
         }
-        controller.rawHeaders = filteredHeaders
+        rawHeaders.splice(0, rawHeaders.length, ...filteredHeaders)
       } else if (typeof rawHeaders === 'object') {
         for (const name of Object.keys(rawHeaders)) {
           const lowerName = name.toLowerCase()
@@ -238,9 +337,9 @@ class DecompressHandler extends DecoratorHandler {
    */
   onResponseEnd (controller, trailers) {
     if (this.#decompressors.length > 0) {
+      this.#inputEnded = true
       this.#trailers = trailers
       this.#decompressors[0].end()
-      this.#cleanupDecompressors()
       return
     }
     super.onResponseEnd(controller, trailers)
@@ -252,12 +351,15 @@ class DecompressHandler extends DecoratorHandler {
    * @returns {void}
    */
   onResponseError (controller, err) {
-    if (this.#decompressors.length > 0) {
-      for (const decompressor of this.#decompressors) {
-        decompressor.destroy(err)
-      }
-      this.#cleanupDecompressors()
+    if (this.#terminated) {
+      return
+    }
+
+    this.#terminated = true
+    for (const decompressor of this.#decompressors) {
+      decompressor.destroy()
     }
+    this.#cleanupDecompressors()
     super.onResponseError(controller, err)
   }
 }
diff --git a/deps/undici/src/lib/interceptor/deduplicate.js b/deps/undici/src/lib/interceptor/deduplicate.js
index bacfeb3fb37e..12598130e8f9 100644
--- a/deps/undici/src/lib/interceptor/deduplicate.js
+++ b/deps/undici/src/lib/interceptor/deduplicate.js
@@ -3,7 +3,7 @@
 const diagnosticsChannel = require('node:diagnostics_channel')
 const util = require('../core/util')
 const DeduplicationHandler = require('../handler/deduplication-handler')
-const { normalizeHeaders, makeCacheKey, makeDeduplicationKey } = require('../util/cache.js')
+const { getInterceptorOrigin, normalizeHeaders, makeCacheKey, makeDeduplicationKey } = require('../util/cache.js')
 
 const pendingRequestsChannel = diagnosticsChannel.channel('undici:request:pending-requests')
 
@@ -57,9 +57,10 @@ module.exports = (opts = {}) => {
    */
   const pendingRequests = new Map()
 
-  return dispatch => {
+  return (dispatch, interceptorOrigin) => {
     return (opts, handler) => {
-      if (opts.upgrade || methods.includes(opts.method) === false) {
+      const requestOrigin = getInterceptorOrigin(opts, interceptorOrigin)
+      if (!requestOrigin || opts.upgrade || methods.includes(opts.method) === false) {
         return dispatch(opts, handler)
       }
 
@@ -77,7 +78,7 @@ module.exports = (opts = {}) => {
         }
       }
 
-      const cacheKey = makeCacheKey(opts)
+      const cacheKey = makeCacheKey(opts, requestOrigin)
       const dedupeKey = makeDeduplicationKey(cacheKey, excludeHeaderNamesSet)
 
       // Check if there's already a pending request for this key
diff --git a/deps/undici/src/lib/interceptor/dns.js b/deps/undici/src/lib/interceptor/dns.js
index ebc9a5383036..ecca6efeb660 100644
--- a/deps/undici/src/lib/interceptor/dns.js
+++ b/deps/undici/src/lib/interceptor/dns.js
@@ -3,6 +3,7 @@ const { isIP } = require('node:net')
 const { lookup } = require('node:dns')
 const DecoratorHandler = require('../handler/decorator-handler')
 const { InvalidArgumentError, InformationalError } = require('../core/errors')
+const { kRequestOrigin } = require('../core/symbols')
 const maxInt = Math.pow(2, 31) - 1
 
 function hasSafeIterator (headers) {
@@ -434,6 +435,9 @@ class DNSDispatchHandler extends DecoratorHandler {
             origin: `${this.#origin.protocol}//${
               ip.family === 6 ? `[${ip.address}]` : ip.address
             }${port}`,
+            [kRequestOrigin]: this.#opts[kRequestOrigin] === undefined
+              ? this.#origin
+              : this.#opts[kRequestOrigin],
             headers: withHostHeader(this.#origin.host, this.#opts.headers)
           }
           this.#dispatch(dispatchOpts, this)
@@ -557,6 +561,9 @@ module.exports = interceptorOpts => {
           ...origDispatchOpts,
           servername: origin.hostname, // For SNI on TLS
           origin: newOrigin.origin,
+          [kRequestOrigin]: origDispatchOpts[kRequestOrigin] === undefined
+            ? origin
+            : origDispatchOpts[kRequestOrigin],
           headers: withHostHeader(origin.host, origDispatchOpts.headers)
         }
 
diff --git a/deps/undici/src/lib/interceptor/dump.js b/deps/undici/src/lib/interceptor/dump.js
index 4810a09f3824..09b57f2163fb 100644
--- a/deps/undici/src/lib/interceptor/dump.js
+++ b/deps/undici/src/lib/interceptor/dump.js
@@ -7,7 +7,6 @@ class DumpHandler extends DecoratorHandler {
   #maxSize = 1024 * 1024
   #dumped = false
   #size = 0
-  #controller = null
   aborted = false
   reason = false
 
@@ -29,7 +28,6 @@ class DumpHandler extends DecoratorHandler {
 
   onRequestStart (controller, context) {
     controller.abort = this.#abort.bind(this)
-    this.#controller = controller
 
     return super.onRequestStart(controller, context)
   }
@@ -53,43 +51,32 @@ class DumpHandler extends DecoratorHandler {
   }
 
   onResponseError (controller, err) {
-    if (this.#dumped) {
-      return
-    }
-
-    // On network errors before connect, controller will be null
-    err = this.#controller?.reason ?? err
-
-    super.onResponseError(controller, err)
+    super.onResponseError(controller, this.aborted === true ? this.reason : err)
   }
 
   onResponseData (controller, chunk) {
     this.#size = this.#size + chunk.length
 
-    if (this.#size >= this.#maxSize) {
-      this.#dumped = true
+    if (this.#size > this.#maxSize) {
+      throw new RequestAbortedError(
+        `Response size (${this.#size}) larger than maxSize (${this.#maxSize})`
+      )
+    }
 
-      if (this.aborted === true) {
-        super.onResponseError(controller, this.reason)
-      } else {
-        super.onResponseEnd(controller, {})
-      }
+    if (this.#size === this.#maxSize) {
+      this.#dumped = true
     }
 
     return true
   }
 
   onResponseEnd (controller, trailers) {
-    if (this.#dumped) {
-      return
-    }
-
-    if (this.#controller.aborted === true) {
+    if (this.aborted === true) {
       super.onResponseError(controller, this.reason)
       return
     }
 
-    super.onResponseEnd(controller, trailers)
+    super.onResponseEnd(controller, this.#dumped ? {} : trailers)
   }
 }
 
diff --git a/deps/undici/src/lib/llhttp/wasm_build_env.txt b/deps/undici/src/lib/llhttp/wasm_build_env.txt
index 82569ca62dd1..9085bb4e260d 100644
--- a/deps/undici/src/lib/llhttp/wasm_build_env.txt
+++ b/deps/undici/src/lib/llhttp/wasm_build_env.txt
@@ -1,5 +1,5 @@
 
-> undici@8.10.0 build:wasm
+> undici@8.10.2 build:wasm
 > node build/wasm.js --docker
 
 > docker run --rm --platform=linux/x86_64  --user 1001:1001 --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/lib/llhttp,target=/home/node/build/lib/llhttp            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/build,target=/home/node/build/build            --mount type=bind,source=/home/runner/work/node/node/deps/undici/src/deps,target=/home/node/build/deps            -t ghcr.io/nodejs/wasm-builder@sha256:975f391d907e42a75b8c72eb77c782181e941608687d4d8694c3e9df415a0970 node build/wasm.js
diff --git a/deps/undici/src/lib/mock/mock-agent.js b/deps/undici/src/lib/mock/mock-agent.js
index 17a7b717c213..6051d5aab7c0 100644
--- a/deps/undici/src/lib/mock/mock-agent.js
+++ b/deps/undici/src/lib/mock/mock-agent.js
@@ -73,7 +73,7 @@ class MockAgent extends Dispatcher {
     opts.origin = normalizeOrigin(opts.origin)
 
     // Call MockAgent.get to perform additional setup before dispatching as normal
-    this.get(opts.origin)
+    const mockDispatcher = this.get(opts.origin)
 
     this[kMockAgentAddCallHistoryLog](opts)
 
@@ -81,6 +81,18 @@ class MockAgent extends Dispatcher {
 
     const dispatchOpts = { ...opts }
 
+    // Agent keeps HTTP/1.1-only dispatchers under a separate key. Legacy
+    // global dispatcher consumers use that path, so mirror the mock dispatches
+    // before delegating to the internal Agent.
+    if (dispatchOpts.allowH2 === false) {
+      const http1OnlyKey = `${dispatchOpts.origin}#http1-only`
+      if (!this[kClients].has(http1OnlyKey)) {
+        const http1OnlyDispatcher = this[kFactory](dispatchOpts.origin)
+        http1OnlyDispatcher[kDispatches] = mockDispatcher[kDispatches]
+        this[kMockAgentSet](http1OnlyKey, http1OnlyDispatcher)
+      }
+    }
+
     if (acceptNonStandardSearchParameters && dispatchOpts.path) {
       const [path, searchParams] = dispatchOpts.path.split('?')
       const normalizedSearchParams = normalizeSearchParams(searchParams, acceptNonStandardSearchParameters)
diff --git a/deps/undici/src/lib/mock/mock-utils.js b/deps/undici/src/lib/mock/mock-utils.js
index e43f7218d0b4..00c1a0bbe13c 100644
--- a/deps/undici/src/lib/mock/mock-utils.js
+++ b/deps/undici/src/lib/mock/mock-utils.js
@@ -333,8 +333,7 @@ function mockDispatch (opts, handler) {
             handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
             return
           }
-          mockDispatch.data = { ...responseDefaults, ...resolvedData }
-          dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
+          dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler, { ...responseDefaults, ...resolvedData })
         },
         (error) => {
           handler.onResponseError(null, error)
@@ -347,7 +346,7 @@ function mockDispatch (opts, handler) {
       throw new InvalidArgumentError('reply options callback must return an object')
     }
 
-    mockDispatch.data = { ...responseDefaults, ...callbackResult }
+    return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler, { ...responseDefaults, ...callbackResult })
   }
 
   return dispatchMockReply(mockDispatches, mockDispatch, key, opts, handler)
@@ -356,9 +355,13 @@ function mockDispatch (opts, handler) {
 /**
  * Replies to a request once the mock dispatch data is fully resolved
  */
-function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
-  // Parse mockDispatch data
-  const { data: response, delay } = mockDispatch
+function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler, resolvedResponse) {
+  // Parse mockDispatch data. When a reply callback has already been resolved
+  // in mockDispatch() (i.e. no body lifecycle hooks are involved), the resolved
+  // response is passed in here, leaving mockDispatch.data untouched so the
+  // callback can be re-invoked for persistent / times() replies.
+  const { data: responseData, delay } = mockDispatch
+  const response = resolvedResponse ?? responseData
 
   // If specified, trigger dispatch error
   if (response.error !== null) {
@@ -454,8 +457,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
               handler.onResponseError(null, new InvalidArgumentError('reply options callback must return an object'))
               return
             }
-            mockDispatch.data = { ...responseDefaults, ...resolvedData }
-            handleReply(dispatches, mockDispatch.data)
+            handleReply(dispatches, { ...responseDefaults, ...resolvedData })
           },
           (err) => {
             handler.onResponseError(null, err)
@@ -468,8 +470,7 @@ function dispatchMockReply (mockDispatches, mockDispatch, key, opts, handler) {
         throw new InvalidArgumentError('reply options callback must return an object')
       }
 
-      mockDispatch.data = { ...responseDefaults, ...callbackResult }
-      handleReply(dispatches, mockDispatch.data)
+      handleReply(dispatches, { ...responseDefaults, ...callbackResult })
       return
     }
 
diff --git a/deps/undici/src/lib/util/cache.js b/deps/undici/src/lib/util/cache.js
index 1fac28af5d97..ad2524fad3a4 100644
--- a/deps/undici/src/lib/util/cache.js
+++ b/deps/undici/src/lib/util/cache.js
@@ -8,6 +8,7 @@ const {
 } = require('../core/util')
 
 const { serializePathWithQuery } = require('../core/util')
+const { kRequestOrigin } = require('../core/symbols')
 
 const MAX_DELTA_SECONDS = 2147483647
 const RESTRICTIVE_DIRECTIVE_NAMES = ['no-store', 'private', 'no-cache']
@@ -147,8 +148,47 @@ function getMalformedRestrictiveDirectiveName (key) {
 /**
  * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
  */
-function makeCacheKey (opts) {
-  const origin = opts.origin ? opts.origin.toString() : ''
+function getRequestOrigin (opts) {
+  const origin = opts[kRequestOrigin] === undefined
+    ? opts.origin
+    : opts[kRequestOrigin]
+  return typeof origin === 'string' || origin instanceof URL
+    ? origin
+    : null
+}
+
+/**
+ * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
+ * @param {string|null|undefined} interceptorOrigin
+ */
+function getInterceptorOrigin (opts, interceptorOrigin) {
+  const requestOrigin = getRequestOrigin(opts)
+  if (interceptorOrigin === undefined) {
+    return requestOrigin
+  }
+  if (interceptorOrigin === null) {
+    return null
+  }
+  if (requestOrigin) {
+    try {
+      if (new URL(requestOrigin).origin !== interceptorOrigin) {
+        return null
+      }
+    } catch {
+      return interceptorOrigin
+    }
+  }
+  return interceptorOrigin
+}
+
+/**
+ * @param {import('../../types/dispatcher.d.ts').default.DispatchOptions} opts
+ * @param {string|URL|null} [origin]
+ */
+function makeCacheKey (opts, origin = getRequestOrigin(opts)) {
+  if (!origin) {
+    throw new Error('opts.origin is undefined')
+  }
 
   let fullPath = opts.path || '/'
 
@@ -157,7 +197,7 @@ function makeCacheKey (opts) {
   }
 
   return {
-    origin,
+    origin: origin.toString(),
     method: opts.method,
     path: fullPath,
     headers: opts.headers
@@ -700,6 +740,8 @@ function makeDeduplicationKey (cacheKey, excludeHeaders) {
 }
 
 module.exports = {
+  getInterceptorOrigin,
+  getRequestOrigin,
   makeCacheKey,
   normalizeHeaders,
   assertCacheKey,
diff --git a/deps/undici/src/lib/web/cookies/parse.js b/deps/undici/src/lib/web/cookies/parse.js
index 51854822a8b6..27606b230d1c 100644
--- a/deps/undici/src/lib/web/cookies/parse.js
+++ b/deps/undici/src/lib/web/cookies/parse.js
@@ -92,221 +92,224 @@ function parseSetCookie (header) {
  * @param {Object.<string, unknown>} [cookieAttributeList={}]
  */
 function parseUnparsedAttributes (unparsedAttributes, cookieAttributeList = {}) {
-  // 1. If the unparsed-attributes string is empty, skip the rest of
-  //    these steps.
-  if (unparsedAttributes.length === 0) {
-    return cookieAttributeList
-  }
+  while (true) {
+    // 1. If the unparsed-attributes string is empty, skip the rest of
+    //    these steps.
+    if (unparsedAttributes.length === 0) {
+      return cookieAttributeList
+    }
 
-  // 2. Discard the first character of the unparsed-attributes (which
-  //    will be a %x3B (";") character).
-  assert(unparsedAttributes[0] === ';')
-  unparsedAttributes = unparsedAttributes.slice(1)
+    // 2. Discard the first character of the unparsed-attributes (which
+    //    will be a %x3B (";") character).
+    assert(unparsedAttributes[0] === ';')
+    unparsedAttributes = unparsedAttributes.slice(1)
 
-  let cookieAv = ''
+    let cookieAv = ''
 
-  // 3. If the remaining unparsed-attributes contains a %x3B (";")
-  //    character:
-  if (unparsedAttributes.includes(';')) {
+    // 3. If the remaining unparsed-attributes contains a %x3B (";")
+    //    character:
+    if (unparsedAttributes.includes(';')) {
     // 1. Consume the characters of the unparsed-attributes up to, but
     //    not including, the first %x3B (";") character.
-    cookieAv = collectASequenceOfCodePointsFast(
-      ';',
-      unparsedAttributes,
-      { position: 0 }
-    )
-    unparsedAttributes = unparsedAttributes.slice(cookieAv.length)
-  } else {
+      cookieAv = collectASequenceOfCodePointsFast(
+        ';',
+        unparsedAttributes,
+        { position: 0 }
+      )
+      unparsedAttributes = unparsedAttributes.slice(cookieAv.length)
+    } else {
     // Otherwise:
 
-    // 1. Consume the remainder of the unparsed-attributes.
-    cookieAv = unparsedAttributes
-    unparsedAttributes = ''
-  }
+      // 1. Consume the remainder of the unparsed-attributes.
+      cookieAv = unparsedAttributes
+      unparsedAttributes = ''
+    }
 
-  // Let the cookie-av string be the characters consumed in this step.
+    // Let the cookie-av string be the characters consumed in this step.
 
-  let attributeName = ''
-  let attributeValue = ''
+    let attributeName = ''
+    let attributeValue = ''
 
-  // 4. If the cookie-av string contains a %x3D ("=") character:
-  if (cookieAv.includes('=')) {
+    // 4. If the cookie-av string contains a %x3D ("=") character:
+    if (cookieAv.includes('=')) {
     // 1. The (possibly empty) attribute-name string consists of the
     //    characters up to, but not including, the first %x3D ("=")
     //    character, and the (possibly empty) attribute-value string
     //    consists of the characters after the first %x3D ("=")
     //    character.
-    const position = { position: 0 }
-
-    attributeName = collectASequenceOfCodePointsFast(
-      '=',
-      cookieAv,
-      position
-    )
-    attributeValue = cookieAv.slice(position.position + 1)
-  } else {
+      const position = { position: 0 }
+
+      attributeName = collectASequenceOfCodePointsFast(
+        '=',
+        cookieAv,
+        position
+      )
+      attributeValue = cookieAv.slice(position.position + 1)
+    } else {
     // Otherwise:
 
-    // 1. The attribute-name string consists of the entire cookie-av
-    //    string, and the attribute-value string is empty.
-    attributeName = cookieAv
-  }
+      // 1. The attribute-name string consists of the entire cookie-av
+      //    string, and the attribute-value string is empty.
+      attributeName = cookieAv
+    }
 
-  // 5. Remove any leading or trailing WSP characters from the attribute-
-  //    name string and the attribute-value string.
-  attributeName = attributeName.trim()
-  attributeValue = attributeValue.trim()
+    // 5. Remove any leading or trailing WSP characters from the attribute-
+    //    name string and the attribute-value string.
+    attributeName = attributeName.trim()
+    attributeValue = attributeValue.trim()
 
-  // 6. If the attribute-value is longer than 1024 octets, ignore the
-  //    cookie-av string and return to Step 1 of this algorithm.
-  if (attributeValue.length > maxAttributeValueSize) {
-    return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-  }
+    // 6. If the attribute-value is longer than 1024 octets, ignore the
+    //    cookie-av string and return to Step 1 of this algorithm.
+    if (attributeValue.length > maxAttributeValueSize) {
+      continue
+    }
 
-  // 7. Process the attribute-name and attribute-value according to the
-  //    requirements in the following subsections.  (Notice that
-  //    attributes with unrecognized attribute-names are ignored.)
-  const attributeNameLowercase = attributeName.toLowerCase()
+    // 7. Process the attribute-name and attribute-value according to the
+    //    requirements in the following subsections.  (Notice that
+    //    attributes with unrecognized attribute-names are ignored.)
+    const attributeNameLowercase = attributeName.toLowerCase()
 
-  // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.1
-  // If the attribute-name case-insensitively matches the string
-  // "Expires", the user agent MUST process the cookie-av as follows.
-  if (attributeNameLowercase === 'expires') {
+    // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.1
+    // If the attribute-name case-insensitively matches the string
+    // "Expires", the user agent MUST process the cookie-av as follows.
+    if (attributeNameLowercase === 'expires') {
     // 1. Let the expiry-time be the result of parsing the attribute-value
     //    as cookie-date (see Section 5.1.1).
-    const expiryTime = new Date(attributeValue)
-
-    // 2. If the attribute-value failed to parse as a cookie date, ignore
-    //    the cookie-av.
-    if (!Number.isNaN(expiryTime.getTime())) {
-      cookieAttributeList.expires = expiryTime
-    }
-  } else if (attributeNameLowercase === 'max-age') {
+      const expiryTime = new Date(attributeValue)
+
+      // 2. If the attribute-value failed to parse as a cookie date, ignore
+      //    the cookie-av.
+      if (!Number.isNaN(expiryTime.getTime())) {
+        cookieAttributeList.expires = expiryTime
+      }
+    } else if (attributeNameLowercase === 'max-age') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.2
     // If the attribute-name case-insensitively matches the string "Max-
     // Age", the user agent MUST process the cookie-av as follows.
 
-    // 1. If the first character of the attribute-value is not a DIGIT or a
-    //    "-" character, ignore the cookie-av.
-    const charCode = attributeValue.charCodeAt(0)
-
-    if ((charCode < 48 || charCode > 57) && attributeValue[0] !== '-') {
-      return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-    }
-
-    // 2. If the remainder of attribute-value contains a non-DIGIT
-    //    character, ignore the cookie-av.
-    if (!/^\d+$/.test(attributeValue)) {
-      return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
-    }
-
-    // 3. Let delta-seconds be the attribute-value converted to an integer.
-    const deltaSeconds = Number(attributeValue)
-
-    // 4. Let cookie-age-limit be the maximum age of the cookie (which
-    //    SHOULD be 400 days or less, see Section 4.1.2.2).
-
-    // 5. Set delta-seconds to the smaller of its present value and cookie-
-    //    age-limit.
-    // deltaSeconds = Math.min(deltaSeconds * 1000, maxExpiresMs)
-
-    // 6. If delta-seconds is less than or equal to zero (0), let expiry-
-    //    time be the earliest representable date and time.  Otherwise, let
-    //    the expiry-time be the current date and time plus delta-seconds
-    //    seconds.
-    // const expiryTime = deltaSeconds <= 0 ? Date.now() : Date.now() + deltaSeconds
-
-    // 7. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Max-Age and an attribute-value of expiry-time.
-    cookieAttributeList.maxAge = deltaSeconds
-  } else if (attributeNameLowercase === 'domain') {
+      // 1. If the first character of the attribute-value is not a DIGIT or a
+      //    "-" character, ignore the cookie-av.
+      const charCode = attributeValue.charCodeAt(0)
+      const startsWithDigit = charCode >= 48 && charCode <= 57
+      const startsWithSignedDigit = attributeValue[0] === '-' && attributeValue.length > 1
+
+      if (!startsWithDigit && !startsWithSignedDigit) {
+        continue
+      }
+
+      // 2. If the remainder of attribute-value contains a non-DIGIT
+      //    character, ignore the cookie-av.
+      if (/[^\d]/.test(attributeValue.slice(1))) {
+        continue
+      }
+
+      // 3. Let delta-seconds be the attribute-value converted to an integer.
+      const deltaSeconds = Number(attributeValue)
+
+      // 4. Let cookie-age-limit be the maximum age of the cookie (which
+      //    SHOULD be 400 days or less, see Section 4.1.2.2).
+
+      // 5. Set delta-seconds to the smaller of its present value and cookie-
+      //    age-limit.
+      // deltaSeconds = Math.min(deltaSeconds * 1000, maxExpiresMs)
+
+      // 6. If delta-seconds is less than or equal to zero (0), let expiry-
+      //    time be the earliest representable date and time.  Otherwise, let
+      //    the expiry-time be the current date and time plus delta-seconds
+      //    seconds.
+      // const expiryTime = deltaSeconds <= 0 ? Date.now() : Date.now() + deltaSeconds
+
+      // 7. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Max-Age and an attribute-value of expiry-time.
+      cookieAttributeList.maxAge = deltaSeconds
+    } else if (attributeNameLowercase === 'domain') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.3
     // If the attribute-name case-insensitively matches the string "Domain",
     // the user agent MUST process the cookie-av as follows.
 
-    // 1. Let cookie-domain be the attribute-value.
-    let cookieDomain = attributeValue
+      // 1. Let cookie-domain be the attribute-value.
+      let cookieDomain = attributeValue
 
-    // 2. If cookie-domain starts with %x2E ("."), let cookie-domain be
-    //    cookie-domain without its leading %x2E (".").
-    if (cookieDomain[0] === '.') {
-      cookieDomain = cookieDomain.slice(1)
-    }
+      // 2. If cookie-domain starts with %x2E ("."), let cookie-domain be
+      //    cookie-domain without its leading %x2E (".").
+      if (cookieDomain[0] === '.') {
+        cookieDomain = cookieDomain.slice(1)
+      }
 
-    // 3. Convert the cookie-domain to lower case.
-    cookieDomain = cookieDomain.toLowerCase()
+      // 3. Convert the cookie-domain to lower case.
+      cookieDomain = cookieDomain.toLowerCase()
 
-    // 4. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Domain and an attribute-value of cookie-domain.
-    cookieAttributeList.domain = cookieDomain
-  } else if (attributeNameLowercase === 'path') {
+      // 4. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Domain and an attribute-value of cookie-domain.
+      cookieAttributeList.domain = cookieDomain
+    } else if (attributeNameLowercase === 'path') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.4
     // If the attribute-name case-insensitively matches the string "Path",
     // the user agent MUST process the cookie-av as follows.
 
-    // 1. If the attribute-value is empty or if the first character of the
-    //    attribute-value is not %x2F ("/"):
-    let cookiePath = ''
-    if (attributeValue.length === 0 || attributeValue[0] !== '/') {
+      // 1. If the attribute-value is empty or if the first character of the
+      //    attribute-value is not %x2F ("/"):
+      let cookiePath = ''
+      if (attributeValue.length === 0 || attributeValue[0] !== '/') {
       // 1. Let cookie-path be the default-path.
-      cookiePath = '/'
-    } else {
+        cookiePath = '/'
+      } else {
       // Otherwise:
 
-      // 1. Let cookie-path be the attribute-value.
-      cookiePath = attributeValue
-    }
+        // 1. Let cookie-path be the attribute-value.
+        cookiePath = attributeValue
+      }
 
-    // 2. Append an attribute to the cookie-attribute-list with an
-    //    attribute-name of Path and an attribute-value of cookie-path.
-    cookieAttributeList.path = cookiePath
-  } else if (attributeNameLowercase === 'secure') {
+      // 2. Append an attribute to the cookie-attribute-list with an
+      //    attribute-name of Path and an attribute-value of cookie-path.
+      cookieAttributeList.path = cookiePath
+    } else if (attributeNameLowercase === 'secure') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.5
     // If the attribute-name case-insensitively matches the string "Secure",
     // the user agent MUST append an attribute to the cookie-attribute-list
     // with an attribute-name of Secure and an empty attribute-value.
 
-    cookieAttributeList.secure = true
-  } else if (attributeNameLowercase === 'httponly') {
+      cookieAttributeList.secure = true
+    } else if (attributeNameLowercase === 'httponly') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.6
     // If the attribute-name case-insensitively matches the string
     // "HttpOnly", the user agent MUST append an attribute to the cookie-
     // attribute-list with an attribute-name of HttpOnly and an empty
     // attribute-value.
 
-    cookieAttributeList.httpOnly = true
-  } else if (attributeNameLowercase === 'samesite') {
+      cookieAttributeList.httpOnly = true
+    } else if (attributeNameLowercase === 'samesite') {
     // https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis#section-5.4.7
     // If the attribute-name case-insensitively matches the string
     // "SameSite", the user agent MUST process the cookie-av as follows:
 
-    const attributeValueLowercase = attributeValue.toLowerCase()
+      const attributeValueLowercase = attributeValue.toLowerCase()
 
-    // 1. If cookie-av's attribute-value is a case-insensitive match for
-    //    "None", append an attribute to the cookie-attribute-list with an
-    //    attribute-name of "SameSite" and an attribute-value of "None".
-    if (attributeValueLowercase === 'none') {
-      cookieAttributeList.sameSite = 'None'
-    } else if (attributeValueLowercase === 'strict') {
+      // 1. If cookie-av's attribute-value is a case-insensitive match for
+      //    "None", append an attribute to the cookie-attribute-list with an
+      //    attribute-name of "SameSite" and an attribute-value of "None".
+      if (attributeValueLowercase === 'none') {
+        cookieAttributeList.sameSite = 'None'
+      } else if (attributeValueLowercase === 'strict') {
       // 2. If cookie-av's attribute-value is a case-insensitive match for
       //    "Strict", append an attribute to the cookie-attribute-list with
       //    an attribute-name of "SameSite" and an attribute-value of
       //    "Strict".
-      cookieAttributeList.sameSite = 'Strict'
-    } else if (attributeValueLowercase === 'lax') {
+        cookieAttributeList.sameSite = 'Strict'
+      } else if (attributeValueLowercase === 'lax') {
       // 3. If cookie-av's attribute-value is a case-insensitive match for
       //    "Lax", append an attribute to the cookie-attribute-list with an
       //    attribute-name of "SameSite" and an attribute-value of "Lax".
-      cookieAttributeList.sameSite = 'Lax'
-    }
-  } else {
-    cookieAttributeList.unparsed ??= []
+        cookieAttributeList.sameSite = 'Lax'
+      }
+    } else {
+      cookieAttributeList.unparsed ??= []
 
-    cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`)
-  }
+      cookieAttributeList.unparsed.push(`${attributeName}=${attributeValue}`)
+    }
 
   // 8. Return to Step 1 of this algorithm.
-  return parseUnparsedAttributes(unparsedAttributes, cookieAttributeList)
+  }
 }
 
 module.exports = {
diff --git a/deps/undici/src/lib/web/eventsource/eventsource-stream.js b/deps/undici/src/lib/web/eventsource/eventsource-stream.js
index 7b9e2f8cbba8..03000e67dd0f 100644
--- a/deps/undici/src/lib/web/eventsource/eventsource-stream.js
+++ b/deps/undici/src/lib/web/eventsource/eventsource-stream.js
@@ -1,4 +1,5 @@
 'use strict'
+const buffer = require('node:buffer')
 const { Transform } = require('node:stream')
 const { isASCIINumber, isValidLastEventId } = require('./util')
 
@@ -23,6 +24,8 @@ const COLON = 0x3A
  */
 const SPACE = 0x20
 
+const defaultMaxEventSize = buffer.kStringMaxLength
+
 const DATA = Buffer.from('data')
 const EVENT = Buffer.from('event')
 const ID = Buffer.from('id')
@@ -66,6 +69,12 @@ function isFieldName (line, length, field) {
   return true
 }
 
+function createMaxEventSizeExceededError () {
+  const error = new Error('EventSource message size exceeded')
+  error.aborted = false
+  return error
+}
+
 /**
  * @typedef {object} EventSourceStreamEvent
  * @type {object}
@@ -114,6 +123,8 @@ class EventSourceStream extends Transform {
   pos = 0
   lineChunkIndex = 0
   linePos = 0
+  eventDataSize = 0
+  maxEventSize
 
   event = {
     data: undefined,
@@ -125,6 +136,7 @@ class EventSourceStream extends Transform {
   /**
    * @param {object} options
    * @param {boolean} [options.readableObjectMode]
+   * @param {number} [options.maxEventSize]
    * @param {eventSourceSettings} [options.eventSourceSettings]
    * @param {(chunk: any, encoding?: BufferEncoding | undefined) => boolean} [options.push]
    */
@@ -136,6 +148,7 @@ class EventSourceStream extends Transform {
     super(options)
 
     this.state = options.eventSourceSettings || {}
+    this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize
     if (options.push) {
       this.push = options.push
     }
@@ -231,7 +244,12 @@ class EventSourceStream extends Transform {
 
         // In any case, we can process the line as we reached an
         // end-of-line character
-        this.parseLine(this.readLine(), this.event)
+        try {
+          this.parseLine(this.readLine(), this.event)
+        } catch (error) {
+          callback(error)
+          return
+        }
         this.consumeCurrentByte()
         // A line was processed and this could be the end of the event. We need
         // to check if the next line is empty to determine if the event is
@@ -282,6 +300,13 @@ class EventSourceStream extends Transform {
     }
 
     if (isFieldName(line, fieldLength, DATA)) {
+      const valueBytes = line.length - valueStart
+      const eventDataSize = this.eventDataSize + (event.data === undefined ? 0 : 1) + valueBytes
+
+      if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+        throw createMaxEventSizeExceededError()
+      }
+
       const value = line.toString('utf8', valueStart)
 
       if (event.data === undefined) {
@@ -289,6 +314,7 @@ class EventSourceStream extends Transform {
       } else {
         event.data += `\n${value}`
       }
+      this.eventDataSize = eventDataSize
       return
     }
 
@@ -345,6 +371,7 @@ class EventSourceStream extends Transform {
     this.event.event = undefined
     this.event.id = undefined
     this.event.retry = undefined
+    this.eventDataSize = 0
   }
 
   hasPendingEvent () {
diff --git a/deps/undici/src/lib/web/eventsource/eventsource.js b/deps/undici/src/lib/web/eventsource/eventsource.js
index 17a1de7b7ba6..657c0643ca88 100644
--- a/deps/undici/src/lib/web/eventsource/eventsource.js
+++ b/deps/undici/src/lib/web/eventsource/eventsource.js
@@ -7,9 +7,13 @@ const { EventSourceStream } = require('./eventsource-stream')
 const { parseMIMEType } = require('../fetch/data-url')
 const { createFastMessageEvent } = require('../websocket/events')
 const { isNetworkError } = require('../fetch/response')
-const { kEnumerableProperty } = require('../../core/util')
+const { isValidHeaderValue, kEnumerableProperty } = require('../../core/util')
 const { environmentSettingsObject } = require('../fetch/util')
 const { createPotentialCORSRequest } = require('./util')
+const { getGlobalDispatcher } = require('../../global')
+const { isomorphicDecode } = require('../infra')
+
+const textEncoder = new TextEncoder()
 
 let experimentalWarned = false
 
@@ -281,6 +285,7 @@ class EventSource extends EventTarget {
 
       const eventSourceStream = new EventSourceStream({
         eventSourceSettings: this.#state,
+        maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
         push: (event) => {
           this.dispatchEvent(createFastMessageEvent(
             event.type,
@@ -340,8 +345,12 @@ class EventSource extends EventTarget {
       //         string, encoded as UTF-8.
       //      2. Set (`Last-Event-ID`, lastEventIDValue) in request's header
       //         list.
+      this.#request.headersList.delete('last-event-id', true)
       if (this.#state.lastEventId.length) {
-        this.#request.headersList.set('last-event-id', this.#state.lastEventId, true)
+        const lastEventId = isomorphicDecode(textEncoder.encode(this.#state.lastEventId))
+        if (isValidHeaderValue(lastEventId)) {
+          this.#request.headersList.set('last-event-id', lastEventId, true)
+        }
       }
 
       //   4. Fetch request and process the response obtained in this fashion, if any, as described earlier in this section.
@@ -465,7 +474,8 @@ webidl.converters.EventSourceInitDict = webidl.dictionaryConverter([
   },
   {
     key: 'dispatcher', // undici only
-    converter: webidl.converters.any
+    converter: webidl.converters.any,
+    defaultValue: () => getGlobalDispatcher()
   },
   {
     key: 'node', // undici only
diff --git a/deps/undici/src/lib/web/fetch/index.js b/deps/undici/src/lib/web/fetch/index.js
index 935bc9d4c90e..4ac812ad6220 100644
--- a/deps/undici/src/lib/web/fetch/index.js
+++ b/deps/undici/src/lib/web/fetch/index.js
@@ -59,6 +59,7 @@ const {
 const EE = require('node:events')
 const { Readable, pipeline, finished, isErrored, isReadable } = require('node:stream')
 const { addAbortListener, bufferToLowerCasedHeaderName } = require('../../core/util')
+const { SocketError } = require('../../core/errors')
 const { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require('./data-url')
 const { getGlobalDispatcher } = require('../../global')
 const { webidl } = require('../webidl')
@@ -2396,6 +2397,11 @@ async function httpNetworkFetch (
             // We need to support 200 for websocket over h2 as per RFC-8441
             // Absence of session means H1
             if ((socket.session != null && status !== 200) || (socket.session == null && status !== 101)) {
+              if (socket.session != null) {
+                // The server refused the extended CONNECT, and nothing further
+                // will settle this request. Fail the opening handshake here.
+                controller.abort(new SocketError('bad upgrade', null))
+              }
               return false
             }
 
diff --git a/deps/undici/src/lib/web/fetch/request.js b/deps/undici/src/lib/web/fetch/request.js
index dbe809c289c7..56945ec02ee5 100644
--- a/deps/undici/src/lib/web/fetch/request.js
+++ b/deps/undici/src/lib/web/fetch/request.js
@@ -923,7 +923,7 @@ function makeRequest (init) {
     serviceWorkers: init.serviceWorkers ?? 'all',
     initiator: init.initiator ?? '',
     destination: init.destination ?? '',
-    priority: init.priority ?? null,
+    priority: init.priority ?? 'auto',
     origin: init.origin ?? 'client',
     policyContainer: init.policyContainer ?? 'client',
     referrer: init.referrer ?? 'client',
@@ -1129,8 +1129,7 @@ webidl.converters.RequestInit = webidl.dictionaryConverter([
   {
     key: 'priority',
     converter: webidl.converters.DOMString,
-    allowedValues: ['high', 'low', 'auto'],
-    defaultValue: () => 'auto'
+    allowedValues: ['high', 'low', 'auto']
   }
 ])
 
diff --git a/deps/undici/src/lib/web/fetch/util.js b/deps/undici/src/lib/web/fetch/util.js
index eb0ece355b7e..20cbb5c58f6c 100644
--- a/deps/undici/src/lib/web/fetch/util.js
+++ b/deps/undici/src/lib/web/fetch/util.js
@@ -227,14 +227,19 @@ function TAOCheck () {
   return 'success'
 }
 
+// https://w3c.github.io/webappsec-fetch-metadata/#abstract-opdef-append-the-fetch-metadata-headers-for-a-request
 function appendFetchMetadata (httpRequest) {
+  //  1. If r’s url is not a potentially trustworthy URL, return.
+  if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+    return
+  }
+
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-dest-header
   //  TODO
 
   //  https://w3c.github.io/webappsec-fetch-metadata/#sec-fetch-mode-header
 
   //  1. Assert: r’s url is a potentially trustworthy URL.
-  //  TODO
 
   //  2. Let header be a Structured Header whose value is a token.
   let header = null
diff --git a/deps/undici/src/lib/web/webidl/index.js b/deps/undici/src/lib/web/webidl/index.js
index 05a6a4bce580..ce81c1e323af 100644
--- a/deps/undici/src/lib/web/webidl/index.js
+++ b/deps/undici/src/lib/web/webidl/index.js
@@ -26,9 +26,9 @@ const webidl = {
 /**
  * @description Instantiate an error.
  *
- * @param {Object} opts
- * @param {string} opts.header
- * @param {string} opts.message
+ * @param {Object} message
+ * @param {string} message.header
+ * @param {string} message.message
  * @returns {TypeError}
  */
 webidl.errors.exception = function (message) {
diff --git a/deps/undici/src/lib/web/websocket/connection.js b/deps/undici/src/lib/web/websocket/connection.js
index 4ecc8a195fcd..cd95d2ca76ec 100644
--- a/deps/undici/src/lib/web/websocket/connection.js
+++ b/deps/undici/src/lib/web/websocket/connection.js
@@ -200,7 +200,7 @@ function establishWebSocketConnection (url, protocols, client, handler, options)
         // is specified, the server needs to include the same field and one of
         // the selected subprotocol values in its response for the connection to
         // be established.
-        if (!requestProtocols.includes(secProtocol)) {
+        if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
           failWebsocketConnection(handler, 1002, 'Protocol was not set in the opening handshake.')
           return
         }
diff --git a/deps/undici/src/lib/web/websocket/permessage-deflate.js b/deps/undici/src/lib/web/websocket/permessage-deflate.js
index 6a6e43899c5a..0b3d493db820 100644
--- a/deps/undici/src/lib/web/websocket/permessage-deflate.js
+++ b/deps/undici/src/lib/web/websocket/permessage-deflate.js
@@ -63,7 +63,12 @@ class PerMessageDeflate {
 
         if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
           callback(new MessageSizeExceededError())
+          // The inflater may still hold buffered input that can emit a late
+          // zlib error. Remove the data listener, then deterministically stop
+          // the stream so a subsequent 'error' cannot fire without a listener
+          // (which would terminate the process as an unhandled error event).
           this.#inflate.removeAllListeners()
+          this.#inflate.destroy()
           this.#inflate = null
           return
         }
diff --git a/deps/undici/src/lib/web/websocket/stream/websocketstream.js b/deps/undici/src/lib/web/websocket/stream/websocketstream.js
index 383fd0bf7aab..1c13a30677dc 100644
--- a/deps/undici/src/lib/web/websocket/stream/websocketstream.js
+++ b/deps/undici/src/lib/web/websocket/stream/websocketstream.js
@@ -34,9 +34,9 @@ class WebSocketStream {
   /** @type {ReadableStreamDefaultController} */
   #readableStreamController
 
-  // Each WebSocketStream object has an associated writable stream , which is a WritableStream .
-  /** @type {WritableStream} */
-  #writableStream
+  // Retain the controller so the writable stream can be errored while locked.
+  /** @type {WritableStreamDefaultController} */
+  #writableStreamController
 
   // Each WebSocketStream object has an associated boolean handshake aborted , which is initially false.
   #handshakeAborted = false
@@ -300,6 +300,9 @@ class WebSocketStream {
     // 12. Let writable be a new WritableStream .
     // 13. Set up writable with writeAlgorithm , closeAlgorithm , and abortAlgorithm .
     const writable = new WritableStream({
+      start: (controller) => {
+        this.#writableStreamController = controller
+      },
       write: (chunk) => this.#write(chunk),
       close: () => closeWebSocketConnection(this.#handler, null, null),
       abort: (reason) => this.#closeUsingReason(reason)
@@ -308,9 +311,6 @@ class WebSocketStream {
     // Set stream ’s readable stream to readable .
     this.#readableStream = readable
 
-    // Set stream ’s writable stream to writable .
-    this.#writableStream = writable
-
     // Resolve stream ’s opened promise with WebSocketOpenInfo «[ " extensions " → extensions , " protocol " → protocol , " readable " → readable , " writable " → writable ]».
     this.#openedPromise.resolve({
       extensions,
@@ -396,9 +396,7 @@ class WebSocketStream {
       readableStreamClose(this.#readableStreamController)
 
       // 6.2. Error stream ’s writable stream with an " InvalidStateError " DOMException indicating that a closed WebSocketStream cannot be written to.
-      if (!this.#writableStream.locked) {
-        this.#writableStream.abort(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
-      }
+      this.#writableStreamController.error(new DOMException('A closed WebSocketStream cannot be written to', 'InvalidStateError'))
 
       // 6.3. Resolve stream ’s closed promise with WebSocketCloseInfo «[ " closeCode " → code , " reason " → reason ]».
       this.#closedPromise.resolve({
@@ -415,7 +413,7 @@ class WebSocketStream {
       this.#readableStreamController?.error(error)
 
       // 7.3. Error stream ’s writable stream with error .
-      this.#writableStream?.abort(error)
+      this.#writableStreamController?.error(error)
 
       // 7.4. Reject stream ’s closed promise with error .
       this.#closedPromise.reject(error)
diff --git a/deps/undici/src/package-lock.json b/deps/undici/src/package-lock.json
index 28d9db8de52e..c0f6d19a83a8 100644
--- a/deps/undici/src/package-lock.json
+++ b/deps/undici/src/package-lock.json
@@ -1,15 +1,15 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "undici",
-      "version": "8.10.0",
+      "version": "8.10.2",
       "license": "MIT",
       "devDependencies": {
-        "@fastify/busboy": "3.2.0",
+        "@fastify/busboy": "3.2.2",
         "@matteo.collina/tspl": "^0.2.0",
         "@metcoder95/https-pem": "^1.0.0",
         "@sinonjs/fake-timers": "^12.0.0",
@@ -76,13 +76,13 @@
       "license": "MIT"
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -91,9 +91,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -101,21 +101,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -132,14 +132,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.8.tgz",
+      "integrity": "sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.8",
+        "@babel/types": "^7.29.8",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -149,14 +149,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -166,9 +166,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -176,29 +176,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -208,9 +208,9 @@
       }
     },
     "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.28.6.tgz",
-      "integrity": "sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.29.7.tgz",
+      "integrity": "sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -218,9 +218,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -228,9 +228,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -238,9 +238,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -248,27 +248,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.8.tgz",
+      "integrity": "sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.8"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -333,13 +333,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-import-attributes": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.28.6.tgz",
-      "integrity": "sha512-jiLC0ma9XkQT3TKJ9uYvlakm66Pamywo+qwL+oL8HJOvc6TWdZXVfhqJr8CCzbSGUAbDOzlGHJC1U+vRfLQDvw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-attributes/-/plugin-syntax-import-attributes-7.29.7.tgz",
+      "integrity": "sha512-zGYcYfq/WmZ4V+kBIXQon9dSSc8ircGZqw9ZaNhhGj9nZkeBu1jHLBDQqYYi5WA9uawvA2sIMbry2nCFhf5Djg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -375,13 +375,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-jsx": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.28.6.tgz",
-      "integrity": "sha512-wgEmr06G6sIpqr8YDwA2dSRTE3bJ+V0IfpzfSY3Lfgd7YWOaAdlykvJi13ZKBt8cZHfgH1IXN+CL656W3uUa4w==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-jsx/-/plugin-syntax-jsx-7.29.7.tgz",
+      "integrity": "sha512-TSu8+mHCoEaaCDEZ0I3+6mvTBYR4PCxQwf2z9/r5Tbztv6NaLR3B9thGTTxX2WGuGHJqRiAbKPeGTJ5XWXVg6A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -501,13 +501,13 @@
       }
     },
     "node_modules/@babel/plugin-syntax-typescript": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.28.6.tgz",
-      "integrity": "sha512-+nDNmQye7nlnuuHDboPbGm00Vqg3oO8niRRL27/4LYHUsHYh0zJ1xWOz0uRwNFmM1Avzk8wZbc6rdiYhomzv/A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-typescript/-/plugin-syntax-typescript-7.29.7.tgz",
+      "integrity": "sha512-ngr+82Sh0xMz25TPCZi+nC2iTzjfCdWS2ONXTp/PtSCHCgaCNBpdMqgvJ2ccdLlClVZ7sisIgB914j/JFe+RZA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-plugin-utils": "^7.28.6"
+        "@babel/helper-plugin-utils": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -517,33 +517,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.8.tgz",
+      "integrity": "sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.8",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.8",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.8",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -551,14 +551,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.8",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.8.tgz",
+      "integrity": "sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -623,9 +623,9 @@
       "license": "MIT"
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
-      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.2.tgz",
+      "integrity": "sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==",
       "cpu": [
         "ppc64"
       ],
@@ -640,9 +640,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
-      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.2.tgz",
+      "integrity": "sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==",
       "cpu": [
         "arm"
       ],
@@ -657,9 +657,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
-      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.2.tgz",
+      "integrity": "sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==",
       "cpu": [
         "arm64"
       ],
@@ -674,9 +674,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
-      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.2.tgz",
+      "integrity": "sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==",
       "cpu": [
         "x64"
       ],
@@ -691,9 +691,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
-      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.2.tgz",
+      "integrity": "sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==",
       "cpu": [
         "arm64"
       ],
@@ -708,9 +708,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
-      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.2.tgz",
+      "integrity": "sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==",
       "cpu": [
         "x64"
       ],
@@ -725,9 +725,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==",
       "cpu": [
         "arm64"
       ],
@@ -742,9 +742,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.2.tgz",
+      "integrity": "sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==",
       "cpu": [
         "x64"
       ],
@@ -759,9 +759,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
-      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.2.tgz",
+      "integrity": "sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==",
       "cpu": [
         "arm"
       ],
@@ -776,9 +776,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
-      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.2.tgz",
+      "integrity": "sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==",
       "cpu": [
         "arm64"
       ],
@@ -793,9 +793,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
-      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.2.tgz",
+      "integrity": "sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==",
       "cpu": [
         "ia32"
       ],
@@ -810,9 +810,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
-      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.2.tgz",
+      "integrity": "sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==",
       "cpu": [
         "loong64"
       ],
@@ -827,9 +827,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
-      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.2.tgz",
+      "integrity": "sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==",
       "cpu": [
         "mips64el"
       ],
@@ -844,9 +844,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
-      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.2.tgz",
+      "integrity": "sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==",
       "cpu": [
         "ppc64"
       ],
@@ -861,9 +861,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
-      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.2.tgz",
+      "integrity": "sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==",
       "cpu": [
         "riscv64"
       ],
@@ -878,9 +878,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
-      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.2.tgz",
+      "integrity": "sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==",
       "cpu": [
         "s390x"
       ],
@@ -895,9 +895,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
-      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.2.tgz",
+      "integrity": "sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==",
       "cpu": [
         "x64"
       ],
@@ -912,9 +912,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==",
       "cpu": [
         "arm64"
       ],
@@ -929,9 +929,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==",
       "cpu": [
         "x64"
       ],
@@ -946,9 +946,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
-      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.2.tgz",
+      "integrity": "sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==",
       "cpu": [
         "arm64"
       ],
@@ -963,9 +963,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
-      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.2.tgz",
+      "integrity": "sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==",
       "cpu": [
         "x64"
       ],
@@ -980,9 +980,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
-      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.2.tgz",
+      "integrity": "sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==",
       "cpu": [
         "arm64"
       ],
@@ -997,9 +997,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
-      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.2.tgz",
+      "integrity": "sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==",
       "cpu": [
         "x64"
       ],
@@ -1014,9 +1014,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
-      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.2.tgz",
+      "integrity": "sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==",
       "cpu": [
         "arm64"
       ],
@@ -1031,9 +1031,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
-      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.2.tgz",
+      "integrity": "sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==",
       "cpu": [
         "ia32"
       ],
@@ -1048,9 +1048,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
-      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.2.tgz",
+      "integrity": "sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==",
       "cpu": [
         "x64"
       ],
@@ -1209,36 +1209,50 @@
       }
     },
     "node_modules/@fastify/busboy": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.0.tgz",
-      "integrity": "sha512-m9FVDXU3GT2ITSe0UaMA5rU3QkfC/UXtCU8y0gSN/GugTqtVldOBWIB5V6V3sbmenVZUIpU6f+mPEO2+m5iTaA==",
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-3.2.2.tgz",
+      "integrity": "sha512-yXSS27qPExaXeuLvMRMXOLtpipzfQYNjG3FkunDWKGfMYjKuhFXko9CVzqxm8jcF+lmtS9Fd89QNdh9XDjnbNg==",
       "dev": true,
       "license": "MIT"
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/gitignore-to-minimatch": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/gitignore-to-minimatch/-/gitignore-to-minimatch-1.0.2.tgz",
@@ -1338,9 +1352,9 @@
       }
     },
     "node_modules/@istanbuljs/load-nyc-config/node_modules/js-yaml": {
-      "version": "3.14.2",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.14.2.tgz",
-      "integrity": "sha512-PMSmkqxr106Xa156c2M265Z+FTrPl+oxd/rgOQy2tijQeK5TxQ43psO1ZCwhVOSdnn+RzkzlRz/eY4BgJBYVpg==",
+      "version": "3.15.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-3.15.2.tgz",
+      "integrity": "sha512-6EuL879VkRA+1Cz578mKMiKvjPNEuk6+r1JaFzoSWejZmtf7xWbIyw1e3KkxlkzTIt9Taw6JBhEppG7utc1P+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1424,17 +1438,17 @@
       }
     },
     "node_modules/@jest/console": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.4.1.tgz",
-      "integrity": "sha512-v3bhyxUh9Hgmo5p6hAOXe14/R3ZxZDOsvHleh4B07z3m/x4/ngPUXEm9XwK4sF4u+f+P2ORb0Ge+MgpaqRMVDA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/console/-/console-30.5.0.tgz",
+      "integrity": "sha512-BI1DpOedrJqbrYVi9yNhDWGjqphR/+gsM4STmg2+VaeXm7851hvpBDyKOZGMXATTrGEnFuEseQvLCtrrRmG0GQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1442,18 +1456,18 @@
       }
     },
     "node_modules/@jest/core": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.4.2.tgz",
-      "integrity": "sha512-TZJA6cPJUFxoWhxaLo8t0VX/MZX2wPWr0uIDvLSHIvN4gu9h02vSzqI2kBADG1ExqQlC+cY09xKMSreivvrChQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/core/-/core-30.5.0.tgz",
+      "integrity": "sha512-DLjRME+NY//j+UDTSfWnjoP0srrdR3DrJRy7yFZktGIwzpN2iVy2vMo0jziZ5c2Ij7bOwlJRXKVWtxZusazOJg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/pattern": "30.4.0",
-        "@jest/reporters": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/pattern": "30.5.0",
+        "@jest/reporters": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "ansi-escapes": "^4.3.2",
         "chalk": "^4.1.2",
@@ -1461,20 +1475,20 @@
         "exit-x": "^0.2.2",
         "fast-json-stable-stringify": "^2.1.0",
         "graceful-fs": "^4.2.11",
-        "jest-changed-files": "30.4.1",
-        "jest-config": "30.4.2",
-        "jest-haste-map": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-resolve-dependencies": "30.4.2",
-        "jest-runner": "30.4.2",
-        "jest-runtime": "30.4.2",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
-        "jest-watcher": "30.4.1",
-        "pretty-format": "30.4.1",
+        "jest-changed-files": "30.5.0",
+        "jest-config": "30.5.0",
+        "jest-haste-map": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-resolve-dependencies": "30.5.0",
+        "jest-runner": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
+        "jest-watcher": "30.5.0",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1490,9 +1504,9 @@
       }
     },
     "node_modules/@jest/diff-sequences": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.4.0.tgz",
-      "integrity": "sha512-zOpzlfUs45l6u7jm39qr87JCHUDsaeCtvL+kQe/Vn9jSnRB4/5IPXISm0h9I1vZW/o00Kn4UTJ2MOlhnUGwv3g==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/diff-sequences/-/diff-sequences-30.5.0.tgz",
+      "integrity": "sha512-OsqBjHXCn8cadasoAZBP6nWYvMsRhpMzGXTpxJ5aO04NlbdhIz+FVe3q49l0AwVhsz/cEmIpBes6gAFl1/dWQg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1500,61 +1514,61 @@
       }
     },
     "node_modules/@jest/environment": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.4.1.tgz",
-      "integrity": "sha512-AK9yNRqgKxiabqMoe4oW+3/TSSeV8vkdC7BGaxZdU0AFXfOpofTLqdru2GXKZghP3sdgwE9XXpnVwfZ8JnFV4w==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/environment/-/environment-30.5.0.tgz",
+      "integrity": "sha512-HUaqexIauIh69IQ4NTuPDEUCB8g8T4TOPSIzQOS18mwI/KEHKQk1j013K2o6ra031szZE2t5jGmVx3xbzdjgKA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/fake-timers": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-mock": "30.4.1"
+        "jest-mock": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.4.1.tgz",
-      "integrity": "sha512-ginrj6TMgh2GshLUGCjO94Ptx9HhdZA/I6A9iUfyeLKFtdAjnKzHDgzgP9HYQgbxM1lbXScQ2eUBz2lGeVDPWA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect/-/expect-30.5.0.tgz",
+      "integrity": "sha512-jEmgmgJEobJ3zEhDOGp1VAJ6JkoVelpS8uZ1ae1Ul/5lP78UKJKmmU0lciJwd6JdnqOXHaaS/QCKwbf1dHI9MA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "expect": "30.4.1",
-        "jest-snapshot": "30.4.1"
+        "expect": "30.5.0",
+        "jest-snapshot": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/expect-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.4.1.tgz",
-      "integrity": "sha512-ZBn5CglH8fBsQsvs4VWNzD4aWfUYks+IdOOQU3MEK71ol/BcVm+P+rtb1KpiFBpSWSCE27uOahyyf1vfqOVbcQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/expect-utils/-/expect-utils-30.5.0.tgz",
+      "integrity": "sha512-5j0ztPxSy3McUJihjkDdCyCfjvT2hxykFTWsgEBZKB8qsw9ALdCiGTpTRH5gnf/d+qI4SflYUJ0dWNbzjQCWbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0"
+        "@jest/get-type": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/fake-timers": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.4.1.tgz",
-      "integrity": "sha512-iW5umdmfPeWzehrVhugFQZqCchSCud5S1l2YT0O9ZhjRR0ExclANDZkiSBwzqtnlOn0J1JXvO+HZ6rkuyOVOgQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/fake-timers/-/fake-timers-30.5.0.tgz",
+      "integrity": "sha512-sg8xIbYwe5GdB/vT3/0qrDIpO7Ov9mazHi++M95uynmDKEZ70G1r169AWct73H07VrTZhrz1SJEfLtjYv8tE3A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@sinonjs/fake-timers": "^15.4.0",
         "@types/node": "*",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1"
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -1571,9 +1585,9 @@
       }
     },
     "node_modules/@jest/get-type": {
-      "version": "30.1.0",
-      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.1.0.tgz",
-      "integrity": "sha512-eMbZE2hUnx1WV0pmURZY9XoXPkUYjpc55mb0CrhtdWLtzMQPFvu/rZkTLZFTsdaVQa+Tr4eWAteqcUzoawq/uA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/get-type/-/get-type-30.5.0.tgz",
+      "integrity": "sha512-9/2VUPitAjmBzbvDvqrxmvB7BzWsBW0WmkkojX1ODuxX1NLGxx9gfaZpHB0z8DtJ9uhGNmZG/VXBhf8uO0OV8Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -1581,62 +1595,78 @@
       }
     },
     "node_modules/@jest/globals": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.4.1.tgz",
-      "integrity": "sha512-ZbuY4cmXC8DkxYjfvT2DbcHWL2T6vmsMhXCDcmTB2T0y0gaezBI77ufq5ZAIdcRkYZ7NEQEDg1xFeKbxUJ5v5Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/globals/-/globals-30.5.0.tgz",
+      "integrity": "sha512-h7eJx534czwL8lQMYB0hwLT4/HquO8EX/RtYL7RNUHyUyWWVciYjoudN4Ns5JmNvn2/jh0Vm9UstZjEzJJ5EsQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/expect": "30.4.1",
-        "@jest/types": "30.4.1",
-        "jest-mock": "30.4.1"
+        "@jest/environment": "30.5.0",
+        "@jest/expect": "30.5.0",
+        "@jest/types": "30.5.0",
+        "jest-mock": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/@jest/pattern": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.4.0.tgz",
-      "integrity": "sha512-RAWn3+f9u8BsHijKJ71uHcFp6vmyEt6VvoWXkl6hKF3qVIuWNmudVjg12DlBPGup/frIl5UcUlH5HfEuvHpEXg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/pattern/-/pattern-30.5.0.tgz",
+      "integrity": "sha512-HdNQYSdRTEBNrginaqzQtTjG0HRMfrra/z6Ok7uL3S87vSlarIVohEsJsSj5edu3MiHoHjAkvPROz5ZjoKai+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
-        "jest-regex-util": "30.4.0"
+        "jest-regex-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/@jest/react-is-18": {
+      "name": "react-is",
+      "version": "18.3.1",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
+      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@jest/react-is-19": {
+      "name": "react-is",
+      "version": "19.2.8",
+      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.8.tgz",
+      "integrity": "sha512-s5un28nYxKJw5gvUHyW5PCC28CvBqLu9r3cWgzHT4Vo/5fqqkFcdRYsGcKf50WMPpjjFZS5d76fn3YCo2njKwQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@jest/reporters": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.4.1.tgz",
-      "integrity": "sha512-/SnkPCzEQpUaBH81kjdEdDdo2WZl5hxw+BmLDGWjRkm8o7XlhjwsU36cqwe5PGBE5WYpBvDzRSdXx9rbGuJtNA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/reporters/-/reporters-30.5.0.tgz",
+      "integrity": "sha512-FEAuusWm+PUOn9ydjaHhpOpyPmS6IbGE04HaKTuUI4zd8eqYZiXiNLoCsdCog/l2XnNj53E9pFy64UltcvfJKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@bcoe/v8-coverage": "^0.2.3",
-        "@jest/console": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@jest/console": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "collect-v8-coverage": "^1.0.2",
         "exit-x": "^0.2.2",
-        "glob": "^10.5.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
         "istanbul-lib-coverage": "^3.0.0",
         "istanbul-lib-instrument": "^6.0.0",
         "istanbul-lib-report": "^3.0.0",
         "istanbul-lib-source-maps": "^5.0.0",
         "istanbul-reports": "^3.1.3",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-worker": "30.4.1",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-worker": "30.5.0",
         "slash": "^3.0.0",
         "string-length": "^4.0.2",
         "v8-to-istanbul": "^9.0.1"
@@ -1660,10 +1690,94 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/@jest/reporters/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/@jest/reporters/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@jest/schemas": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.4.1.tgz",
-      "integrity": "sha512-i6b4qw5qnP8c5FEeBJg/uZQ4ddrkN6Ca8qISJh0pr7a5hfn3h3v5x60BEbOC7OYAGZNMs1LfFLwnW2CuK8F57Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-30.5.0.tgz",
+      "integrity": "sha512-/hunigyNpc4RCjC0VaW3f5RCUZVM2+WQ65qP7z083Gmvac7or2LI50XVNOtE4YPgBpV0yxYiAgorAPGniCoJmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1674,13 +1788,13 @@
       }
     },
     "node_modules/@jest/snapshot-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.4.1.tgz",
-      "integrity": "sha512-ObY4ljvQ95mt6iwKtVLetR/4yXiAgl3H4nJxhztr0MTjrN97TwDYrnCp/kF60Ec9HdhkWTHSu+Hg05aXfngpOA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/snapshot-utils/-/snapshot-utils-30.5.0.tgz",
+      "integrity": "sha512-iWQtIsi2dRsO2oWzVceOeynuRJiYTW8gsDVp5wFQ02ipHluQsNgBpasWSHiawVxukIlsGLdCtCSbIEK7fPtpvQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
         "natural-compare": "^1.4.0"
@@ -1690,14 +1804,15 @@
       }
     },
     "node_modules/@jest/source-map": {
-      "version": "30.0.1",
-      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.0.1.tgz",
-      "integrity": "sha512-MIRWMUUR3sdbP36oyNyhbThLHyJ2eEDClPCiHVbrYAe5g3CHRArIVpBw7cdSB5fr+ofSfIb2Tnsw8iEHL0PYQg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/source-map/-/source-map-30.5.0.tgz",
+      "integrity": "sha512-xWpTJP9D0bDFGbPGT8XuWSwwha/iHADyyKzUnMx4UbdgnHugxrDaQFO4RZ8x4ZsFzRP6pNii8uvlgKCDxCIuDg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jridgewell/trace-mapping": "^0.3.25",
+        "@jridgewell/trace-mapping": "^0.3.31",
         "callsites": "^3.1.0",
+        "convert-source-map": "^2.0.0",
         "graceful-fs": "^4.2.11"
       },
       "engines": {
@@ -1705,14 +1820,14 @@
       }
     },
     "node_modules/@jest/test-result": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.4.1.tgz",
-      "integrity": "sha512-/ZG7pgEiOmmWkN9TplKbOu4id2N5lh7FHwRwlkgBVAzGdRH+OkkQ8wX/kIxg4zmd3ZQvAL1RwL2yWsvNYYECTw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/test-result/-/test-result-30.5.0.tgz",
+      "integrity": "sha512-9IlPqUzUMkVDmoDqSSrVVLroVotgN3hTUPWPwq24XWXhh1Zpg915RXZ5pgRJ/7j4YE/kng5nqjSn4p3S68SZJA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "collect-v8-coverage": "^1.0.2"
       },
@@ -1721,15 +1836,15 @@
       }
     },
     "node_modules/@jest/test-sequencer": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.4.1.tgz",
-      "integrity": "sha512-PeYE+4td5rKjoRPxztObrXU+H8hsjZfxKMXOcmrr34JerSyB/ROOxbbicz8B7A5j9R9VayDnVPvBmedqCsFCdw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/test-sequencer/-/test-sequencer-30.5.0.tgz",
+      "integrity": "sha512-TXlvSDIVv482b83hD8A8WtxDJEmGF47f60W6jRXOQL0Isfs3hKtk4rZIm9R/jLzAibg8+c56y+Q00BQs8R7Xcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/test-result": "30.4.1",
+        "@jest/test-result": "30.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
+        "jest-haste-map": "30.5.0",
         "slash": "^3.0.0"
       },
       "engines": {
@@ -1737,23 +1852,23 @@
       }
     },
     "node_modules/@jest/transform": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.4.1.tgz",
-      "integrity": "sha512-Wz0LyktlTvRefoymh+n64hQ84KNXsRGcwdoZ8CSa0Ea+fgYcHZlnk+hDP7v2MS7il2bQ5uTEIxf4/NNfhMN4KQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/transform/-/transform-30.5.0.tgz",
+      "integrity": "sha512-n1cYhoByyULEIXi64wbT4Lq91qeT1E6bwpM//sprFXhw955qaiHTdAmy1c1rNFGB6fCf1J+nxDUSf3RGwgZP5A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.27.4",
-        "@jest/types": "30.4.1",
-        "@jridgewell/trace-mapping": "^0.3.25",
-        "babel-plugin-istanbul": "^7.0.1",
+        "@jest/types": "30.5.0",
+        "@jridgewell/trace-mapping": "^0.3.31",
+        "babel-plugin-istanbul": "^8.0.0",
         "chalk": "^4.1.2",
         "convert-source-map": "^2.0.0",
         "fast-json-stable-stringify": "^2.1.0",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-util": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-util": "30.5.0",
         "pirates": "^4.0.7",
         "slash": "^3.0.0",
         "write-file-atomic": "^5.0.1"
@@ -1763,14 +1878,14 @@
       }
     },
     "node_modules/@jest/types": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.4.1.tgz",
-      "integrity": "sha512-f1x/vJXIfjOlEmejYpbkbgw1gOqpPECwMvMEtBqe47j7H2Hg8h8w3o3ikhSXq3MI15kg+oQ0exWO0uCtTNJLoQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/@jest/types/-/types-30.5.0.tgz",
+      "integrity": "sha512-s1N+79S4Yp9ZgklCauZXi+YPJdCdtStNYQT32stuD6EeQaIBGHoUfyj2P0YWy8RmuQfaJboO+ulxEvEheR/POQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/pattern": "30.4.0",
-        "@jest/schemas": "30.4.1",
+        "@jest/pattern": "30.5.0",
+        "@jest/schemas": "30.5.0",
         "@types/istanbul-lib-coverage": "^2.0.6",
         "@types/istanbul-reports": "^3.0.4",
         "@types/node": "*",
@@ -1860,16 +1975,25 @@
       }
     },
     "node_modules/@napi-rs/wasm-runtime": {
-      "version": "0.2.12",
-      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-0.2.12.tgz",
-      "integrity": "sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==",
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/@napi-rs/wasm-runtime/-/wasm-runtime-1.2.3.tgz",
+      "integrity": "sha512-UMduMbqO5s5zF2NkNacMT/yK5Y5QiKvWr2+50bzIIxFDwVJ2h49b+oyjaCGPhJxd2/gC2x39EHv/gHVuu36x2Q==",
       "dev": true,
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@emnapi/core": "^1.4.3",
-        "@emnapi/runtime": "^1.4.3",
-        "@tybys/wasm-util": "^0.10.0"
+        "@tybys/wasm-util": "^0.10.3"
+      },
+      "engines": {
+        "node": "^20.19.0 || ^22.13.0 || >=23.5.0"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1 || ^2.0.0-alpha.4",
+        "@emnapi/runtime": "^1.7.1 || ^2.0.0-alpha.4"
       }
     },
     "node_modules/@nodelib/fs.scandir": {
@@ -1910,6 +2034,311 @@
         "node": ">= 8"
       }
     },
+    "node_modules/@parcel/watcher": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher/-/watcher-2.6.0.tgz",
+      "integrity": "sha512-7FNeNl8NCE7aINx7WXiKQrPYZWC/hvrTsmk6zmxbI7LTXE7hVek/n8AfVgpe2y82zl3w0HvCHN0bVKMBoJcC0w==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "detect-libc": "^2.0.3",
+        "is-glob": "^4.0.3",
+        "node-addon-api": "^7.0.0",
+        "picomatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      },
+      "optionalDependencies": {
+        "@parcel/watcher-android-arm64": "2.6.0",
+        "@parcel/watcher-darwin-arm64": "2.6.0",
+        "@parcel/watcher-darwin-x64": "2.6.0",
+        "@parcel/watcher-freebsd-x64": "2.6.0",
+        "@parcel/watcher-linux-arm-glibc": "2.6.0",
+        "@parcel/watcher-linux-arm-musl": "2.6.0",
+        "@parcel/watcher-linux-arm64-glibc": "2.6.0",
+        "@parcel/watcher-linux-arm64-musl": "2.6.0",
+        "@parcel/watcher-linux-x64-glibc": "2.6.0",
+        "@parcel/watcher-linux-x64-musl": "2.6.0",
+        "@parcel/watcher-win32-arm64": "2.6.0",
+        "@parcel/watcher-win32-x64": "2.6.0"
+      }
+    },
+    "node_modules/@parcel/watcher-android-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-android-arm64/-/watcher-android-arm64-2.6.0.tgz",
+      "integrity": "sha512-trgpLSCKRC/huFjXX/Smh+0sWe4+YtKfktIToiMl59ghz7z+qkH6kMvNnUbLyRs9N11t8l4svSCs1+5B3rOAhA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-arm64/-/watcher-darwin-arm64-2.6.0.tgz",
+      "integrity": "sha512-Y3QV0gl7Q1zbfueunkWIERICbEojQFCgpyG7YqOGNFLsckXyI1xu9mAIUpKY9QBYzBtSkN8dBPwd3yiAO9ovMw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-darwin-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-darwin-x64/-/watcher-darwin-x64-2.6.0.tgz",
+      "integrity": "sha512-Ohv6OpzhUfKYD7Beb8kDvG0jbIxORCYY1JRdZnaBtnjjkJxgD7ZVL0nw2sCYd0yTMKTvz3nnTnOF3cDifK+kvw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-freebsd-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-freebsd-x64/-/watcher-freebsd-x64-2.6.0.tgz",
+      "integrity": "sha512-5HmXvDgs8VK+74jF9y9/2FE3/OnlcKmc56tjmSrEuZjpSZOGL+fvAu+HKJBdPs9uwoP2hE6TlSUpXZ/C5jUFmQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-glibc/-/watcher-linux-arm-glibc-2.6.0.tgz",
+      "integrity": "sha512-Ps/hui3A+vMbjdqlqAowK2ZL8+BO8dBjxeWXj6npTBs3jx4wWmbPpaLuqwrQrSqIVMCnpWo238bJ1U37GhQOYg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm-musl/-/watcher-linux-arm-musl-2.6.0.tgz",
+      "integrity": "sha512-9c6AUHgHoG+IY88MRIHupztQiQnrbqHYQjkM2btA+Bf/wQnQMuiD0Wfk1EVv3TlNT3x41uU71rn6E4xh/+zvkw==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-glibc/-/watcher-linux-arm64-glibc-2.6.0.tgz",
+      "integrity": "sha512-yHRqS2owEXe6Hic9z6Mh1ECsCd+ODVOGvZDyciqRd21+v+o+DnXMOrw50DSpIG2sb8GPEaPPmfeCAWKPJdq46g==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-arm64-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-arm64-musl/-/watcher-linux-arm64-musl-2.6.0.tgz",
+      "integrity": "sha512-WhB2e/V7rqdHHWZusBSPuy5Ei8S6lSz6FE5TKKQz5h3a0O+C+mhY7vxU9b/stqvMb8beLnPY82ZrFTLKs+SrKA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-glibc": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-glibc/-/watcher-linux-x64-glibc-2.6.0.tgz",
+      "integrity": "sha512-ulGE6x6Oz6iAwg75T8YQSoguBWasniIbX+QWpaYPcCnDOpdWX3k+4xbEYPZVLxOuoJI+svJJPD3sEj8G7lrQ3A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-linux-x64-musl": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-linux-x64-musl/-/watcher-linux-x64-musl-2.6.0.tgz",
+      "integrity": "sha512-tkBYKt7YQrjIJWYDnto2YgO8MRkjlMTSNoRHzsXinBqbLdeOM3L32wPZJvIZxqaLMfSlS/4sUjH/6STVP/XDLw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-arm64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-arm64/-/watcher-win32-arm64-2.6.0.tgz",
+      "integrity": "sha512-gIZAP23jaHjGWasY/TY6yL7NHFClf0Ga7FN+iINvk+KN94rhm94lYZhFsbYFNcA04/onvGD9kKmiJLJB2HbNwQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
+    "node_modules/@parcel/watcher-win32-x64": {
+      "version": "2.6.0",
+      "resolved": "https://registry.npmjs.org/@parcel/watcher-win32-x64/-/watcher-win32-x64-2.6.0.tgz",
+      "integrity": "sha512-cA+/pXV2YkfxlIcXOQ5fSWqAzzPyD78/x5qbK/I0vUkrlYHA8TIz+MXjAbGouguKVSI4bOmkTSJ1/poVSsgt+A==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">= 10.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/@pkgjs/parseargs": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
@@ -1922,13 +2351,13 @@
       }
     },
     "node_modules/@pkgr/core": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.2.9.tgz",
-      "integrity": "sha512-QNqXyfVS2wm9hweSYD2O7F0G06uurj9kZ96TRQE5Y9hU7+tgdZwIkbAKc5Ocy1HxEY2kuDQa6cQ1WRs/O5LFKA==",
+      "version": "0.3.6",
+      "resolved": "https://registry.npmjs.org/@pkgr/core/-/core-0.3.6.tgz",
+      "integrity": "sha512-SEeaJLb3qBNF/OaXnaR1NmmBbFYk1zC0ZH/52fATcRPLFg/p791YrcyFFy44Bo9sLaGuSuLp5Q6axbb/O+v/RA==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": "^12.20.0 || ^14.18.0 || >=16.0.0"
+        "node": "^14.18.0 || >=16.0.0"
       },
       "funding": {
         "url": "https://opencollective.com/pkgr"
@@ -1953,9 +2382,9 @@
       "license": "MIT"
     },
     "node_modules/@sinclair/typebox": {
-      "version": "0.34.49",
-      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.49.tgz",
-      "integrity": "sha512-brySQQs7Jtn0joV8Xh9ZV/hZb9Ozb0pmazDIASBkYKCjXrXU3mpcFahmK/z4YDhGkQvP9mWJbVyahdtU5wQA+A==",
+      "version": "0.34.52",
+      "resolved": "https://registry.npmjs.org/@sinclair/typebox/-/typebox-0.34.52.tgz",
+      "integrity": "sha512-XiMQh7qqVlxZzcVD+kkGMNGMzcTrDMLWI7S4x7z1MkCkbDPrekpZXEUK0eZqZFMuHQg2a2DZOcDIh9o5v3Gonw==",
       "dev": true,
       "license": "MIT"
     },
@@ -2023,9 +2452,9 @@
       }
     },
     "node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.2.tgz",
-      "integrity": "sha512-RoBvJ2X0wuKlWFIjrwffGw1IqZHKQqzIchKaadZZfnNpsAYp2mM0h36JtPCjNDAHGgYez/15uMBpfGwchhiMgg==",
+      "version": "0.10.3",
+      "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.10.3.tgz",
+      "integrity": "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg==",
       "dev": true,
       "license": "MIT",
       "optional": true,
@@ -2377,16 +2806,16 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
@@ -2474,16 +2903,16 @@
       }
     },
     "node_modules/@ungap/structured-clone": {
-      "version": "1.3.1",
-      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.1.tgz",
-      "integrity": "sha512-mUFwbeTqrVgDQxFveS+df2yfap6iuP20NAKAsBt5jDEoOTDew+zwLAOilHCeQJOVSvmgCX4ogqIrA0mnyr08yQ==",
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.4.0.tgz",
+      "integrity": "sha512-1mEZtMKPM09vDmQt5y7YvmN2+DFTP7Tg0EWXdic8/C6VRnpb33e4ghisCIE3WZjsE2N8mf+QV1Zqh7ZFYLWInQ==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/@unrs/resolver-binding-android-arm-eabi": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.11.1.tgz",
-      "integrity": "sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm-eabi/-/resolver-binding-android-arm-eabi-1.12.2.tgz",
+      "integrity": "sha512-g5T90pqg1bo/7mytQx6F4iBNC0Wsh9cu+z9veDbFjc7HjpesJFWD7QMS0NGStXM075+7dJPPVvBbpZlnrdpi/w==",
       "cpu": [
         "arm"
       ],
@@ -2495,9 +2924,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-android-arm64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.11.1.tgz",
-      "integrity": "sha512-lCxkVtb4wp1v+EoN+HjIG9cIIzPkX5OtM03pQYkG+U5O/wL53LC4QbIeazgiKqluGeVEeBlZahHalCaBvU1a2g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-android-arm64/-/resolver-binding-android-arm64-1.12.2.tgz",
+      "integrity": "sha512-YGCRZv/9GLhwmz6mYDeTsm/92BAyR28l6c2ReweVW5pWgfsitWLY8upvfRlGdoyD8HjeTHSYJWyZGD4KJA/nFQ==",
       "cpu": [
         "arm64"
       ],
@@ -2509,9 +2938,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-darwin-arm64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.11.1.tgz",
-      "integrity": "sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-arm64/-/resolver-binding-darwin-arm64-1.12.2.tgz",
+      "integrity": "sha512-u9DiNT1auQMO20A9SyTuG3wUgQWB9Z7KjAg0uFuCDR1FsAY8A0CG2S6JpHS1xwm/w1G08bjXZDcyOCjv1WAm2w==",
       "cpu": [
         "arm64"
       ],
@@ -2523,9 +2952,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-darwin-x64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.11.1.tgz",
-      "integrity": "sha512-cFzP7rWKd3lZaCsDze07QX1SC24lO8mPty9vdP+YVa3MGdVgPmFc59317b2ioXtgCMKGiCLxJ4HQs62oz6GfRQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-darwin-x64/-/resolver-binding-darwin-x64-1.12.2.tgz",
+      "integrity": "sha512-f7rPLi/T1HVKZu/u6t87lroib16n8vrSzcyxI7lg4BGO9UF26KhQL44sd9eOUgrTYhvRXtWOIZT5PejdPyJfUA==",
       "cpu": [
         "x64"
       ],
@@ -2537,9 +2966,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-freebsd-x64": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.11.1.tgz",
-      "integrity": "sha512-fqtGgak3zX4DCB6PFpsH5+Kmt/8CIi4Bry4rb1ho6Av2QHTREM+47y282Uqiu3ZRF5IQioJQ5qWRV6jduA+iGw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-freebsd-x64/-/resolver-binding-freebsd-x64-1.12.2.tgz",
+      "integrity": "sha512-BpcOjWCJub6nRZUS2zA20pmLvjtqAtGejETaIyRLiZiQf++cbrjltLA5NN/xaXfqeOBOSlMFbemIl5/S5tljmg==",
       "cpu": [
         "x64"
       ],
@@ -2551,9 +2980,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm-gnueabihf": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.11.1.tgz",
-      "integrity": "sha512-u92mvlcYtp9MRKmP+ZvMmtPN34+/3lMHlyMj7wXJDeXxuM0Vgzz0+PPJNsro1m3IZPYChIkn944wW8TYgGKFHw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-gnueabihf/-/resolver-binding-linux-arm-gnueabihf-1.12.2.tgz",
+      "integrity": "sha512-vZTDvdSISZjJx66OzJqtsOhzifbqRjbmI1Mnu49fQDwog5GtDI4QidRiEAYbZCRj9C8YZEW+3ZjqsyS9GR4k2A==",
       "cpu": [
         "arm"
       ],
@@ -2565,9 +2994,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm-musleabihf": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.11.1.tgz",
-      "integrity": "sha512-cINaoY2z7LVCrfHkIcmvj7osTOtm6VVT16b5oQdS4beibX2SYBwgYLmqhBjA1t51CarSaBuX5YNsWLjsqfW5Cw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm-musleabihf/-/resolver-binding-linux-arm-musleabihf-1.12.2.tgz",
+      "integrity": "sha512-BiPI+IrIlwcW4nLLMM21+B1dFPzd55yAVgVGrdgDjNef+ch03GdxrcyaIz8X9SsQirh/kCQ7mviyWlMxdh2D7g==",
       "cpu": [
         "arm"
       ],
@@ -2579,13 +3008,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.11.1.tgz",
-      "integrity": "sha512-34gw7PjDGB9JgePJEmhEqBhWvCiiWCuXsL9hYphDF7crW7UgI05gyBAi6MF58uGcMOiOqSJ2ybEeCvHcq0BCmQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-gnu/-/resolver-binding-linux-arm64-gnu-1.12.2.tgz",
+      "integrity": "sha512-zJc0H99FEPoFfSrNpa91HYfxzfAJCr502oxNK1cfdC9hlaFI43RT+JFCann9JUgZmLzzntChHyn13Sgn9ljHNg==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2593,13 +3025,50 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-arm64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.11.1.tgz",
-      "integrity": "sha512-RyMIx6Uf53hhOtJDIamSbTskA99sPHS96wxVE/bJtePJJtpdKGXO1wY90oRdXuYOGOTuqjT8ACccMc4K6QmT3w==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-arm64-musl/-/resolver-binding-linux-arm64-musl-1.12.2.tgz",
+      "integrity": "sha512-KQ3Lki6l+Pz1k/eBipN41ES+YUK30beLGb9YqcB1O542cyLCNE6GaxrfcY3T6EezmGGk84wb5XyO9loTM9tkcA==",
       "cpu": [
         "arm64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-gnu": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-gnu/-/resolver-binding-linux-loong64-gnu-1.12.2.tgz",
+      "integrity": "sha512-3SJGEh1DborhG6pyxvhPzCT4bbSIVihsvgJc13P1bHG7KLdNDaF9T3gsTwFc7Jw/5Y5/iWOjkEx7Zy0NvCGX3Q==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "glibc"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@unrs/resolver-binding-linux-loong64-musl": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-loong64-musl/-/resolver-binding-linux-loong64-musl-1.12.2.tgz",
+      "integrity": "sha512-jiuG/Obbel7uw1PwHNFfrkiKhLAF6mnyZ6aWlOAVN9WqKm8v0OFGnciJIHu8+CMvXLQ8AD51LPzAoUfT21D5Ew==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2607,13 +3076,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-ppc64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.11.1.tgz",
-      "integrity": "sha512-D8Vae74A4/a+mZH0FbOkFJL9DSK2R6TFPC9M+jCWYia/q2einCubX10pecpDiTmkJVUH+y8K3BZClycD8nCShA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-ppc64-gnu/-/resolver-binding-linux-ppc64-gnu-1.12.2.tgz",
+      "integrity": "sha512-q7xRvVpmcfeL+LlZg8Pbbo6QaTZwDU5BaGZbwfhkEsXJn3Was8xYfE0RBH266xZt0rM6B7i8xAYIvjthuUIWHg==",
       "cpu": [
         "ppc64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2621,13 +3093,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-riscv64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.11.1.tgz",
-      "integrity": "sha512-frxL4OrzOWVVsOc96+V3aqTIQl1O2TjgExV4EKgRY09AJ9leZpEg8Ak9phadbuX0BA4k8U5qtvMSQQGGmaJqcQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-gnu/-/resolver-binding-linux-riscv64-gnu-1.12.2.tgz",
+      "integrity": "sha512-0CVdx6lcnT3Q9inOH8tsMIOJ6ImndllMjqJHg8RLVdB7Vq4SfkEXl9mCSsVNuNA4MCYycRicCUxPCabVHJRr6A==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2635,13 +3110,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-riscv64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.11.1.tgz",
-      "integrity": "sha512-mJ5vuDaIZ+l/acv01sHoXfpnyrNKOk/3aDoEdLO/Xtn9HuZlDD6jKxHlkN8ZhWyLJsRBxfv9GYM2utQ1SChKew==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-riscv64-musl/-/resolver-binding-linux-riscv64-musl-1.12.2.tgz",
+      "integrity": "sha512-iOwlRo9vnp6R6ohHQS11n0NnfdXx/omhkocmIfaPRpQhKZ+3BDMkkdRVh53qjkFkpPddf+FETA28NwGN7l5l+w==",
       "cpu": [
         "riscv64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2649,13 +3127,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-s390x-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.11.1.tgz",
-      "integrity": "sha512-kELo8ebBVtb9sA7rMe1Cph4QHreByhaZ2QEADd9NzIQsYNQpt9UkM9iqr2lhGr5afh885d/cB5QeTXSbZHTYPg==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-s390x-gnu/-/resolver-binding-linux-s390x-gnu-1.12.2.tgz",
+      "integrity": "sha512-HYJtLfXq94q8iZNFT1lknx258wlkkWhZeUXJRqzKBBUJ00CvZ+N33zgbCqimLjsyw5Va6uUxhVa12mI+kaveEw==",
       "cpu": [
         "s390x"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2663,13 +3144,16 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-x64-gnu": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.11.1.tgz",
-      "integrity": "sha512-C3ZAHugKgovV5YvAMsxhq0gtXuwESUKc5MhEtjBpLoHPLYM+iuwSj3lflFwK3DPm68660rZ7G8BMcwSro7hD5w==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-gnu/-/resolver-binding-linux-x64-gnu-1.12.2.tgz",
+      "integrity": "sha512-mPsUhunKKDih5O96Y6enDQyHc1SqBPlY1E/SfMWDM3EdJ95Z9CArPeCVwCCqbP45ljvivdEk8Fxn+SIb1rDAJQ==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "glibc"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -2677,23 +3161,40 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-linux-x64-musl": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.11.1.tgz",
-      "integrity": "sha512-rV0YSoyhK2nZ4vEswT/QwqzqQXw5I6CjoaYMOX0TqBlWhojUf8P94mvI7nuJTeaCkkds3QE4+zS8Ko+GdXuZtA==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-linux-x64-musl/-/resolver-binding-linux-x64-musl-1.12.2.tgz",
+      "integrity": "sha512-azrt6+5ydLd8Vt210AAFis/lZevSfPw93EJRIJG+xPu4WCJ8K0kppCTpMyLPcKT7H15M4Jnt2tMp5bOvCkRC6A==",
       "cpu": [
         "x64"
       ],
       "dev": true,
+      "libc": [
+        "musl"
+      ],
       "license": "MIT",
       "optional": true,
       "os": [
         "linux"
       ]
     },
+    "node_modules/@unrs/resolver-binding-openharmony-arm64": {
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-openharmony-arm64/-/resolver-binding-openharmony-arm64-1.12.2.tgz",
+      "integrity": "sha512-YZ9hP4O0X9PQb8eO980qmLNGH4zT3I9+SZTdt0Pr0YyuGQhYKoOZkV02VzrzyOZJ5xIJ3UFIenKkUkGg8GjgWQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
     "node_modules/@unrs/resolver-binding-wasm32-wasi": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.11.1.tgz",
-      "integrity": "sha512-5u4RkfxJm+Ng7IWgkzi3qrFOvLvQYnPBmjmZQ8+szTK/b31fQCnleNl1GgEt7nIsZRIf5PLhPwT0WM+q45x/UQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-wasm32-wasi/-/resolver-binding-wasm32-wasi-1.12.2.tgz",
+      "integrity": "sha512-tYFDIkMxSflfEc/h92ZWNsZlHSwgimbNHSO3PL2JWQHfCuC2q316jMyYU9TIWZsFK2bQwyK5VAdYgn8ygPj69A==",
       "cpu": [
         "wasm32"
       ],
@@ -2701,16 +3202,18 @@
       "license": "MIT",
       "optional": true,
       "dependencies": {
-        "@napi-rs/wasm-runtime": "^0.2.11"
+        "@emnapi/core": "1.10.0",
+        "@emnapi/runtime": "1.10.0",
+        "@napi-rs/wasm-runtime": "^1.1.4"
       },
       "engines": {
         "node": ">=14.0.0"
       }
     },
     "node_modules/@unrs/resolver-binding-win32-arm64-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.11.1.tgz",
-      "integrity": "sha512-nRcz5Il4ln0kMhfL8S3hLkxI85BXs3o8EYoattsJNdsX4YUU89iOkVn7g0VHSRxFuVMdM4Q1jEpIId1Ihim/Uw==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-arm64-msvc/-/resolver-binding-win32-arm64-msvc-1.12.2.tgz",
+      "integrity": "sha512-qzNyg3xL0VPQmCaUh+N5jSitce6k+uCBfMDesWRnlULOZaqUkaJ0ybdT+UqlAWJoQjuqfIU/0Ptx9bteN4D82g==",
       "cpu": [
         "arm64"
       ],
@@ -2722,9 +3225,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-win32-ia32-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.11.1.tgz",
-      "integrity": "sha512-DCEI6t5i1NmAZp6pFonpD5m7i6aFrpofcp4LA2i8IIq60Jyo28hamKBxNrZcyOwVOZkgsRp9O2sXWBWP8MnvIQ==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-ia32-msvc/-/resolver-binding-win32-ia32-msvc-1.12.2.tgz",
+      "integrity": "sha512-WD9sY00OfpHVGfsnHZoA8jVT+esS/Bg8z8jzxp5BnDCjjwsuKsPQrzswwpFy4J1AUJbXPRfkpcX0mXrzeXW79g==",
       "cpu": [
         "ia32"
       ],
@@ -2736,9 +3239,9 @@
       ]
     },
     "node_modules/@unrs/resolver-binding-win32-x64-msvc": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.11.1.tgz",
-      "integrity": "sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/@unrs/resolver-binding-win32-x64-msvc/-/resolver-binding-win32-x64-msvc-1.12.2.tgz",
+      "integrity": "sha512-nAB74NfSNKknqQ1RrYj6uz8FcXEomu/MATJZxh/x+BArzN2U3JbOYC0APYzUIGhVY3m5hRxA8VPNdPBoG8txlA==",
       "cpu": [
         "x64"
       ],
@@ -3180,16 +3683,16 @@
       }
     },
     "node_modules/babel-jest": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.4.1.tgz",
-      "integrity": "sha512-fATAbM8piYxkiXQp3RBXmZHxZVNJZAVXXfyeyCN2Tida3+qJ8ea9UxhiJ2y4fLO90ZImKt6k9FlcH2+rLkJGhw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-jest/-/babel-jest-30.5.0.tgz",
+      "integrity": "sha512-PrhPHlKC+MsLnuNzgIH/y1dkz1f6cSfKWaQeaG8WxLMuG44dYWQ8E9uRrsBbAGCU/3+BEFYPN4d6G3Zc5Y+waA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/transform": "30.4.1",
+        "@jest/transform": "30.5.0",
         "@types/babel__core": "^7.20.5",
-        "babel-plugin-istanbul": "^7.0.1",
-        "babel-preset-jest": "30.4.0",
+        "babel-plugin-istanbul": "^8.0.0",
+        "babel-preset-jest": "30.5.0",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
         "slash": "^3.0.0"
@@ -3202,9 +3705,9 @@
       }
     },
     "node_modules/babel-plugin-istanbul": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-7.0.1.tgz",
-      "integrity": "sha512-D8Z6Qm8jCvVXtIRkBnqNHX0zJ37rQcFJ9u8WOS6tkYOsRdHBzypCstaxWiu5ZIlqQtviRYbgnRLSoCEvjqcqbA==",
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-istanbul/-/babel-plugin-istanbul-8.0.0.tgz",
+      "integrity": "sha512-18wCskrN3DgbuBmp1gr7LBGT8xdz5xhQQqFvFhVxbkl8VBCrMKQ2YtqBWtUal1Zrc1HTuX0011+Brjw78TCFkg==",
       "dev": true,
       "license": "BSD-3-Clause",
       "workspaces": [
@@ -3215,53 +3718,70 @@
         "@istanbuljs/load-nyc-config": "^1.0.0",
         "@istanbuljs/schema": "^0.1.3",
         "istanbul-lib-instrument": "^6.0.2",
-        "test-exclude": "^6.0.0"
+        "test-exclude": "^7.0.1"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=18"
       }
     },
-    "node_modules/babel-plugin-istanbul/node_modules/glob": {
-      "version": "7.2.3",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
-      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+    "node_modules/babel-plugin-istanbul/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
-      "license": "ISC",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/babel-plugin-istanbul/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.1.1",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
+        "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "*"
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/babel-plugin-istanbul/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/babel-plugin-istanbul/node_modules/test-exclude": {
-      "version": "6.0.0",
-      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-6.0.0.tgz",
-      "integrity": "sha512-cAGWPIyOHU6zlmg88jwm7VRyXnMN7iV68OGAbYDk/Mh/xC/pzVPlQtY6ngoIH/5/tciuhGfvESU8GrHrcxD56w==",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/test-exclude/-/test-exclude-7.0.2.tgz",
+      "integrity": "sha512-u9E6A+ZDYdp7a4WnarkXPZOx8Ilz46+kby6p1yZ8zsGTz9gYa6FIS7lj2oezzNKmtdyyJNNmmXDppga5GB7kSw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
         "@istanbuljs/schema": "^0.1.2",
-        "glob": "^7.1.4",
-        "minimatch": "^3.0.4"
+        "glob": "^10.4.1",
+        "minimatch": "^10.2.2"
       },
       "engines": {
-        "node": ">=8"
+        "node": ">=18"
       }
     },
     "node_modules/babel-plugin-jest-hoist": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.4.0.tgz",
-      "integrity": "sha512-9EdtWM/sSfXLOGLwSn+GS6pIXyBnL07/8gyJlwFXjWy4DxMOyItqyUT29d4lQiS380EZwYlX7/At4PgBS+m2aA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-plugin-jest-hoist/-/babel-plugin-jest-hoist-30.5.0.tgz",
+      "integrity": "sha512-gtGo1B+u14jrZQv6TdSWIWkTqclboo7Qn+dFAGUOIuXLFuJKAdg3U5MIWzZnW4vfUb4dX9skmAMiby86e/SF4A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3299,20 +3819,20 @@
       }
     },
     "node_modules/babel-preset-jest": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.4.0.tgz",
-      "integrity": "sha512-lBY4jxsNmCnSiu7kquw8ZC9F4+XLMOKypT3RnNHPvU2Kpd4W0xaPuLr5ZkRyOsvLYAY4yaW1ZwTW4xB7NIiZzg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/babel-preset-jest/-/babel-preset-jest-30.5.0.tgz",
+      "integrity": "sha512-ZGPn5ClP4lBDpuOK8W1yQIOy359HmbnZv3suucAlIe+SEE9yDsxV4S2PjSbH2Vc97U+WmzYD7vw3kr8NsQ/i6w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "babel-plugin-jest-hoist": "30.4.0",
+        "babel-plugin-jest-hoist": "30.5.0",
         "babel-preset-current-node-syntax": "^1.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       },
       "peerDependencies": {
-        "@babel/core": "^7.11.0 || ^8.0.0-beta.1"
+        "@babel/core": "^7.11.0 || ^8.0.0-beta.1 || ^8.0.0"
       }
     },
     "node_modules/balanced-match": {
@@ -3323,9 +3843,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.29",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.29.tgz",
-      "integrity": "sha512-Asa2krT+XTPZINCS+2QcyS8WTkObE77RwkydwF7h6DmnKqbvlalz93m/dnphUyCa6SWSP51VgtEUf2FN+gelFQ==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -3367,16 +3887,16 @@
       }
     },
     "node_modules/borp/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/borp/node_modules/c8": {
@@ -3504,9 +4024,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.14",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.14.tgz",
-      "integrity": "sha512-MWPGfDxnyzKU7rNOW9SP/c50vi3xrmrua/+6hfPbCS2ABNWfx24vPidzvC7krjU/RTo235sV776ymlsMtGKj8g==",
+      "version": "1.1.18",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
+      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -3528,9 +4048,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "dev": true,
       "funding": [
         {
@@ -3548,11 +4068,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -3571,13 +4091,6 @@
         "node-int64": "^0.4.0"
       }
     },
-    "node_modules/buffer-from": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/c8": {
       "version": "12.0.0",
       "resolved": "https://registry.npmjs.org/c8/-/c8-12.0.0.tgz",
@@ -3859,9 +4372,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001792",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001792.tgz",
-      "integrity": "sha512-hVLMUZFgR4JJ6ACt1uEESvQN1/dBVqPAKY0hgrV70eN3391K6juAfTjKZLKvOMsx8PxA7gsY1/tLMMTcfFLLpw==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "dev": true,
       "funding": [
         {
@@ -3923,9 +4436,9 @@
       }
     },
     "node_modules/cjs-module-lexer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.0.tgz",
-      "integrity": "sha512-4bHTS2YuzUvtoLjdy+98ykbNB5jS0+07EvFNXerqZQJ89F7DI6ET7OQo/HJuW6K0aVsKA9hj9/RVb2kQVOrPDQ==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/cjs-module-lexer/-/cjs-module-lexer-2.2.1.tgz",
+      "integrity": "sha512-Ca8swihM+/4yKecYHY52kgJd300hi2lADU/a1RxNTRe+RJ9jvqQlESpbz9DnG9mowez8qwXHB8qYdIUw9e+F5Q==",
       "dev": true,
       "license": "MIT"
     },
@@ -4269,6 +4782,16 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/detect-libc": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
+      "integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/detect-newline": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/detect-newline/-/detect-newline-3.1.0.tgz",
@@ -4351,9 +4874,9 @@
       "license": "MIT"
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.354",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.354.tgz",
-      "integrity": "sha512-JaBHwWcfIdmSAfWM5l3uwjGd431j8YEMikZ+K/2nXVuBqJKyZ0f+2h4n4JY5AyNiZmnY9qQr2RU3v9DxDmHMNg==",
+      "version": "1.5.416",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.416.tgz",
+      "integrity": "sha512-K6bvB2BjnNrugtIih6ewlbBI9DXa976jIdiIlRLHhBoEI9a4JaQjjHyF+A1IQI543aQYR4LnmOrT/K5fZj0aPA==",
       "dev": true,
       "license": "ISC"
     },
@@ -4518,6 +5041,13 @@
         "node": ">= 0.4"
       }
     },
+    "node_modules/es-module-lexer": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.2.tgz",
+      "integrity": "sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/es-object-atoms": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
@@ -4579,9 +5109,9 @@
       }
     },
     "node_modules/esbuild": {
-      "version": "0.28.1",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
-      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
+      "version": "0.28.2",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.2.tgz",
+      "integrity": "sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -4592,32 +5122,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.28.1",
-        "@esbuild/android-arm": "0.28.1",
-        "@esbuild/android-arm64": "0.28.1",
-        "@esbuild/android-x64": "0.28.1",
-        "@esbuild/darwin-arm64": "0.28.1",
-        "@esbuild/darwin-x64": "0.28.1",
-        "@esbuild/freebsd-arm64": "0.28.1",
-        "@esbuild/freebsd-x64": "0.28.1",
-        "@esbuild/linux-arm": "0.28.1",
-        "@esbuild/linux-arm64": "0.28.1",
-        "@esbuild/linux-ia32": "0.28.1",
-        "@esbuild/linux-loong64": "0.28.1",
-        "@esbuild/linux-mips64el": "0.28.1",
-        "@esbuild/linux-ppc64": "0.28.1",
-        "@esbuild/linux-riscv64": "0.28.1",
-        "@esbuild/linux-s390x": "0.28.1",
-        "@esbuild/linux-x64": "0.28.1",
-        "@esbuild/netbsd-arm64": "0.28.1",
-        "@esbuild/netbsd-x64": "0.28.1",
-        "@esbuild/openbsd-arm64": "0.28.1",
-        "@esbuild/openbsd-x64": "0.28.1",
-        "@esbuild/openharmony-arm64": "0.28.1",
-        "@esbuild/sunos-x64": "0.28.1",
-        "@esbuild/win32-arm64": "0.28.1",
-        "@esbuild/win32-ia32": "0.28.1",
-        "@esbuild/win32-x64": "0.28.1"
+        "@esbuild/aix-ppc64": "0.28.2",
+        "@esbuild/android-arm": "0.28.2",
+        "@esbuild/android-arm64": "0.28.2",
+        "@esbuild/android-x64": "0.28.2",
+        "@esbuild/darwin-arm64": "0.28.2",
+        "@esbuild/darwin-x64": "0.28.2",
+        "@esbuild/freebsd-arm64": "0.28.2",
+        "@esbuild/freebsd-x64": "0.28.2",
+        "@esbuild/linux-arm": "0.28.2",
+        "@esbuild/linux-arm64": "0.28.2",
+        "@esbuild/linux-ia32": "0.28.2",
+        "@esbuild/linux-loong64": "0.28.2",
+        "@esbuild/linux-mips64el": "0.28.2",
+        "@esbuild/linux-ppc64": "0.28.2",
+        "@esbuild/linux-riscv64": "0.28.2",
+        "@esbuild/linux-s390x": "0.28.2",
+        "@esbuild/linux-x64": "0.28.2",
+        "@esbuild/netbsd-arm64": "0.28.2",
+        "@esbuild/netbsd-x64": "0.28.2",
+        "@esbuild/openbsd-arm64": "0.28.2",
+        "@esbuild/openbsd-x64": "0.28.2",
+        "@esbuild/openharmony-arm64": "0.28.2",
+        "@esbuild/sunos-x64": "0.28.2",
+        "@esbuild/win32-arm64": "0.28.2",
+        "@esbuild/win32-ia32": "0.28.2",
+        "@esbuild/win32-x64": "0.28.2"
       }
     },
     "node_modules/escalade": {
@@ -5149,18 +5679,18 @@
       }
     },
     "node_modules/expect": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/expect/-/expect-30.4.1.tgz",
-      "integrity": "sha512-PMARsyh/JtqC20HoGqlFcIlQAyqUtW4PlI1rup1uhYJtKuwAjbvWi3GQMAn+STdHum/dk8xrKfUM1+5SAwpolA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/expect/-/expect-30.5.0.tgz",
+      "integrity": "sha512-8fiMWcEjPU7B9nErC4FtFcCzf2tC6I75Qf7m8wzBAWC2taZmcno3yAFEjIQL34SwoGZNgPf63UDiJLyh4SMPaw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/expect-utils": "30.4.1",
-        "@jest/get-type": "30.1.0",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1"
+        "@jest/expect-utils": "30.5.0",
+        "@jest/get-type": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -5392,28 +5922,6 @@
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
-      "dev": true,
-      "license": "ISC"
-    },
-    "node_modules/fsevents": {
-      "version": "2.3.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
-      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
-      "dev": true,
-      "hasInstallScript": true,
-      "license": "MIT",
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
     "node_modules/function-bind": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
@@ -5631,9 +6139,9 @@
       }
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
+      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5971,25 +6479,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/internal-slot": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/internal-slot/-/internal-slot-1.1.0.tgz",
@@ -6515,9 +7004,9 @@
       }
     },
     "node_modules/istanbul-lib-instrument/node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -6606,16 +7095,16 @@
       }
     },
     "node_modules/jest": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest/-/jest-30.4.2.tgz",
-      "integrity": "sha512-Yi1jqNC/Oq0N4hBgNH/YvBpP1P57QqundgytzYqy3yqAa7NZPNjSoi4SGbRAXDMdBzNE6xBCi5U7RgfrvMEUVQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest/-/jest-30.5.0.tgz",
+      "integrity": "sha512-HeFeOUEKh5gjnp1rjuSCse8Dhj0Y3KA8lsZ3azr4Wnq1nCxwMBu35MDc9mp8iblZxmeAz6wV4P241tyUB7J2Ew==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/core": "30.4.2",
-        "@jest/types": "30.4.1",
+        "@jest/core": "30.5.0",
+        "@jest/types": "30.5.0",
         "import-local": "^3.2.0",
-        "jest-cli": "30.4.2"
+        "jest-cli": "30.5.0"
       },
       "bin": {
         "jest": "bin/jest.js"
@@ -6633,14 +7122,14 @@
       }
     },
     "node_modules/jest-changed-files": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.4.1.tgz",
-      "integrity": "sha512-IuctmYrxi21iOSOaIXpJWalHyPAsVv0GeBHKDn8C1CA4W5htHn7INL+wdnL4Bo0+olEndvAFkmb++tIQJG+vvg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-changed-files/-/jest-changed-files-30.5.0.tgz",
+      "integrity": "sha512-dq1x8JiEnHkJDxxOrF6UJDivBRAQMwAa5tzr+VX3um0SfyMFseUPQUbe51wLwggfoa5h/EmOtSpdJxxkzSlNRQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "execa": "^5.1.1",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "p-limit": "^3.1.0"
       },
       "engines": {
@@ -6738,29 +7227,29 @@
       }
     },
     "node_modules/jest-circus": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.4.2.tgz",
-      "integrity": "sha512-rvHH7VlY6LgbJXJTQ87GW62g1FntOtbhh0zT+v04kC+pgL6aBKyYINXxWukCpj3dcIBMw5/XUbtDS9dU9JTXeQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-circus/-/jest-circus-30.5.0.tgz",
+      "integrity": "sha512-T3v7uM4wwCu+RQicjsAWCgoL3CiyuX3THSKwv2uMb9N2bMUgb+HfwDWEUma85vOGbvQNQ/YfoCXF1OCZot0ZEw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/expect": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/expect": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "co": "^4.6.0",
         "dedent": "^1.6.0",
         "is-generator-fn": "^2.1.0",
-        "jest-each": "30.4.1",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-runtime": "30.4.2",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-each": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
         "p-limit": "^3.1.0",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "pure-rand": "^7.0.0",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
@@ -6787,21 +7276,21 @@
       "license": "MIT"
     },
     "node_modules/jest-cli": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.4.2.tgz",
-      "integrity": "sha512-jfA2ocvVHMXS2QijrJ0d31ektP+d/W0T5RpcTX2Pq+3sVqHlsXVCM2+FmwpL+bdY8OfHpIg9xMxLF17Zg0U49Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-cli/-/jest-cli-30.5.0.tgz",
+      "integrity": "sha512-QHZMiy32x2K+NzJ1AuuoCAVc1Y5co0VXib3R7kD9MWcWFflzsD1eJN0wR+mkNlM+ts7C+Bjz0oOoFE5IiHylCg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/core": "30.4.2",
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/core": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
         "exit-x": "^0.2.2",
         "import-local": "^3.2.0",
-        "jest-config": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-config": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "yargs": "^17.7.2"
       },
       "bin": {
@@ -6820,33 +7309,33 @@
       }
     },
     "node_modules/jest-config": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.4.2.tgz",
-      "integrity": "sha512-rNHAShJQqQwFNoL0hbf3BphSBOWnpOUAKvidLS/AjNVLPfoj5mSf4jQMfW3cYOs6hXeZC7nF7mDHaBnbxELOzg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-config/-/jest-config-30.5.0.tgz",
+      "integrity": "sha512-gYQl2FqYgiVpyuB7DutBIbJRWaq5VcHdzOXJJ51HNa8J5JrsZehIlzNFW0/9s5uvvcbzM5/LTUizYSbsFErv+w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/core": "^7.27.4",
-        "@jest/get-type": "30.1.0",
-        "@jest/pattern": "30.4.0",
-        "@jest/test-sequencer": "30.4.1",
-        "@jest/types": "30.4.1",
-        "babel-jest": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/pattern": "30.5.0",
+        "@jest/test-sequencer": "30.5.0",
+        "@jest/types": "30.5.0",
+        "babel-jest": "30.5.0",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
         "deepmerge": "^4.3.1",
-        "glob": "^10.5.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "jest-circus": "30.4.2",
-        "jest-docblock": "30.4.0",
-        "jest-environment-node": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-runner": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-circus": "30.5.0",
+        "jest-docblock": "30.5.0",
+        "jest-environment-node": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-runner": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "parse-json": "^5.2.0",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0",
         "strip-json-comments": "^3.1.1"
       },
@@ -6870,26 +7359,110 @@
         }
       }
     },
+    "node_modules/jest-config/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-config/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-config/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-config/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jest-diff": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz",
-      "integrity": "sha512-CRpFK0RtLriVDGcPPAnR6HMVI8bSR2jnUIgralhauzYQZIb4RH9AtEInTuQr65LmmGggGcRT6HIASxwqsVsmlA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.5.0.tgz",
+      "integrity": "sha512-QjCfDMwdPFvLxTQmS4/Dswx3PUCiqmSXVLGljMC3SU7YG1qHVoR6b86IH/O2G9k9OMyKXz2vS2Q60VnAozNDwA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/diff-sequences": "30.4.0",
-        "@jest/get-type": "30.1.0",
+        "@jest/diff-sequences": "30.5.0",
+        "@jest/get-type": "30.5.0",
         "chalk": "^4.1.2",
-        "pretty-format": "30.4.1"
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-docblock": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.4.0.tgz",
-      "integrity": "sha512-ZPMabUZCx5MpbZ2eBYSvZ0J8fvo3dR9oM+eeUpb3aKNQFuS2tu3Duw1TNlMoP8k3WQgKGJuhcMFvwcVuq6T7oA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-docblock/-/jest-docblock-30.5.0.tgz",
+      "integrity": "sha512-NwDqcxtoZi33RhuW+zJS/RVA3rmheQ8BnwpYZuc/Eruaz6seQb7+aoCeDZu/3X7W2XmD8DbSo9Pn72DbKsBFYw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6900,36 +7473,36 @@
       }
     },
     "node_modules/jest-each": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.4.1.tgz",
-      "integrity": "sha512-/8MJbH6fuj48TstjrMf+u/pd06Qezz5xOXvZA6442heNOWr8bdeoGZX2d9fCn028CoMgYmroH9//zky5GfyYmA==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-each/-/jest-each-30.5.0.tgz",
+      "integrity": "sha512-NiMFNhRygJEFqYNt8pnkxppUF6CR486GEpt9rSU6lPBf7KeccaOL0zbjxG8fgJgD//6e7zYdssnlt6j+1kI31A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "@jest/types": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/types": "30.5.0",
         "chalk": "^4.1.2",
-        "jest-util": "30.4.1",
-        "pretty-format": "30.4.1"
+        "jest-util": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-environment-node": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.4.1.tgz",
-      "integrity": "sha512-4FZYVOk85hz2AyT6BbarKy9u37g6DbrDyCdFhsnDdXqyrueYQvB+0zO4f/kqLCRD0BsPRXPMNJeQwihKZV8naw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-30.5.0.tgz",
+      "integrity": "sha512-bTc79ywKLz0ogbT3JIYuEhgWV4Ffd/cJe06co4v8CyRtlmju8x5gokMlGFR8ARWhmk5SnbDRxmf50XWnlZVhDg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/fake-timers": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-mock": "30.4.1",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1"
+        "jest-mock": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -6946,75 +7519,73 @@
       }
     },
     "node_modules/jest-haste-map": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.4.1.tgz",
-      "integrity": "sha512-rFrcONd8jeFsyw+Z9CrScJgglRf2+NFmNam8dKu7n+SoHqNYT47mn0DdEcVUZJpvh7Iz6/si7f7yUH7GJHVgnw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-haste-map/-/jest-haste-map-30.5.0.tgz",
+      "integrity": "sha512-0FStogBslBVOEqTOJr4oXMtFitmrWp9WscG6Gbns88i0YAuMXijCT2G5VMfg/HCR4QAnL+OF2C2ednag+HlDuA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
+        "@parcel/watcher": "^2.6.0",
         "@types/node": "*",
         "anymatch": "^3.1.3",
         "fb-watchman": "^2.0.2",
+        "fdir": "^6.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-regex-util": "30.4.0",
-        "jest-util": "30.4.1",
-        "jest-worker": "30.4.1",
-        "picomatch": "^4.0.3",
-        "walker": "^1.0.8"
+        "jest-regex-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-worker": "30.5.0",
+        "picomatch": "^4.0.3"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "^2.3.3"
       }
     },
     "node_modules/jest-leak-detector": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.4.1.tgz",
-      "integrity": "sha512-IpmyiioeHxiWDhesHnUFmOxcTzwCwKpgACgWajtAP+nYQXiY7DakTxB6Bx9JFiRMljr0AX1PvnQdaU1KFoz6NQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-leak-detector/-/jest-leak-detector-30.5.0.tgz",
+      "integrity": "sha512-Mq11ceAkNR250Iv45RoOwuG9fb4kYbJ02qoyL7A0nCI8FV5+aG/THmcEUx5uR2dNSa4KOtz+xBKrJ8cZPhPpuQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "pretty-format": "30.4.1"
+        "@jest/get-type": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-matcher-utils": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.4.1.tgz",
-      "integrity": "sha512-zvYfX5CaeEkFrrLS9suWe9rvJrm9J1Iv3ua8kIBv9GEPzcnsfBf0bob37la7s67fs0nlBC3EuvkOLnXQKxtx4A==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-matcher-utils/-/jest-matcher-utils-30.5.0.tgz",
+      "integrity": "sha512-EfaYMC9f9ds7fahB/LYFTgd1Z2RS9Vpm2e46gazij0onkpoQG7Daq+MLm8/gQVqWwRVjL/RNDggbFx9MsrJEmQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
+        "@jest/get-type": "30.5.0",
         "chalk": "^4.1.2",
-        "jest-diff": "30.4.1",
-        "pretty-format": "30.4.1"
+        "jest-diff": "30.5.0",
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-message-util": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.4.1.tgz",
-      "integrity": "sha512-kwCKIvq0MCW1HzLoGola9Te6JUdzgV0loyKJ3Qghrkz9i5/RRIHsL95BMQc2HBBhlBKC4j22K9p11TGHH8RBpQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-message-util/-/jest-message-util-30.5.0.tgz",
+      "integrity": "sha512-dBYMhplGfspKaCnVk9TUy1cZnknWubpuPNEputjz0YJk1G/92R45rn45BvbPMPMtC5LVcIdxJGPOaOSQTiuzJw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@babel/code-frame": "^7.27.1",
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/stack-utils": "^2.0.3",
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "picomatch": "^4.0.3",
-        "pretty-format": "30.4.1",
+        "pretty-format": "30.5.0",
         "slash": "^3.0.0",
         "stack-utils": "^2.0.6"
       },
@@ -7023,42 +7594,25 @@
       }
     },
     "node_modules/jest-mock": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.4.1.tgz",
-      "integrity": "sha512-/i8SVb8/NSB7RfNi8gfqu8gxLV23KaL5EpAttyb9iz8qWRIqXRLflycz/32wXsYkOnaUlx8NAKnJYtpsmXUmfw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-mock/-/jest-mock-30.5.0.tgz",
+      "integrity": "sha512-bP5MHZpkYrV7xpV+yvhl36DPcXoEmTR57Un5EACcdVpMY7mpkDefCBq+V4mhcjE/3rwUajT6OTrcJTN7EwN1BA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/expect-utils": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
-        "jest-util": "30.4.1"
+        "jest-util": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
-    "node_modules/jest-pnp-resolver": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.3.tgz",
-      "integrity": "sha512-+3NpwQEnRoIBtx4fyhblQDPgJI0H1IEIkX7ShLUjPGA7TtUTvI1oiKi3SR4oBR0hQhQR80l4WAe5RrXBwWMA8w==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=6"
-      },
-      "peerDependencies": {
-        "jest-resolve": "*"
-      },
-      "peerDependenciesMeta": {
-        "jest-resolve": {
-          "optional": true
-        }
-      }
-    },
     "node_modules/jest-regex-util": {
-      "version": "30.4.0",
-      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.4.0.tgz",
-      "integrity": "sha512-mWlvLviKIgIQ8VCuM1xRdD0TWp3zlzionlmDBjuXVBs+VkmXq6FgW9T4Emr7oGz/Rk6feDCGyiugolcQEyp3mg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-regex-util/-/jest-regex-util-30.5.0.tgz",
+      "integrity": "sha512-Mg0WK7A6xRHLSA1udJ8y9f3lM0uUhFTBnLKzwPmqB9AylvpleJ6BLemR8K9dK27DY+cesDryoA7yLZCAHsPG1A==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -7066,100 +7620,100 @@
       }
     },
     "node_modules/jest-resolve": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.4.1.tgz",
-      "integrity": "sha512-Zry8Yq/yJcNAZ7dJ5F2heic8AheXvbFZ7XI5V+h28nrYZ7Qoyy4dItq8OodjnYD270mvX+ZudmrNV9cysqhW5Q==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-resolve/-/jest-resolve-30.5.0.tgz",
+      "integrity": "sha512-NFvQWJ4G7e2kN5712iG+12Xr325NRFGAIhovrwLfgq5Oqd4bFHITw4CzcFkZGp1GTCqemC4v1l8/yZzedKZkjw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "chalk": "^4.1.2",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-pnp-resolver": "^1.2.3",
-        "jest-util": "30.4.1",
-        "jest-validate": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-validate": "30.5.0",
         "slash": "^3.0.0",
-        "unrs-resolver": "^1.7.11"
+        "unrs-resolver": "^1.12.1"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-resolve-dependencies": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.4.2.tgz",
-      "integrity": "sha512-gDiVh1I+GxYzz9oXlyw+1wv6VOYX1WYxMOfjsA3iGKePV2oxmbHhwxfkALxNxYy1ciw6APWwkW2zZONwP97aEQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-resolve-dependencies/-/jest-resolve-dependencies-30.5.0.tgz",
+      "integrity": "sha512-TnSBAp3wGOnqXBmLT3OXtJkugw6Vj2KU0IPde2EJmbGns/QMoNlkauJ7jZ8KYaxONSpx0o4pUvi+u1Q/LSk3Pg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "jest-regex-util": "30.4.0",
-        "jest-snapshot": "30.4.1"
+        "jest-regex-util": "30.5.0",
+        "jest-snapshot": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-runner": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.4.2.tgz",
-      "integrity": "sha512-2dw0PslVYXxffXGpLo+Ejad+KcI1Qkjn7f4X4619gf21oCUmL+SPfjqIa/losUem3yEOvfNZe/F1HWUcNpODcg==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-runner/-/jest-runner-30.5.0.tgz",
+      "integrity": "sha512-Q6Yt+1LvXvEstvru6sQLT7OQYC77VNl6dK0KEvBkeOHgThmXDqNp3Ox9TglDWFHU85pemqTNdKwxfnmO3vgrdA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/console": "30.4.1",
-        "@jest/environment": "30.4.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/console": "30.5.0",
+        "@jest/environment": "30.5.0",
+        "@jest/source-map": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "emittery": "^0.13.1",
         "exit-x": "^0.2.2",
         "graceful-fs": "^4.2.11",
-        "jest-docblock": "30.4.0",
-        "jest-environment-node": "30.4.1",
-        "jest-haste-map": "30.4.1",
-        "jest-leak-detector": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-resolve": "30.4.1",
-        "jest-runtime": "30.4.2",
-        "jest-util": "30.4.1",
-        "jest-watcher": "30.4.1",
-        "jest-worker": "30.4.1",
-        "p-limit": "^3.1.0",
-        "source-map-support": "0.5.13"
+        "jest-docblock": "30.5.0",
+        "jest-environment-node": "30.5.0",
+        "jest-haste-map": "30.5.0",
+        "jest-leak-detector": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-runtime": "30.5.0",
+        "jest-util": "30.5.0",
+        "jest-watcher": "30.5.0",
+        "jest-worker": "30.5.0",
+        "p-limit": "^3.1.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
     "node_modules/jest-runtime": {
-      "version": "30.4.2",
-      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.4.2.tgz",
-      "integrity": "sha512-3/5e8iPz2k/VLqlr8DgTftYyLUv8Su3FkCAO2/Od81UsUTpSxOrS6O5x5KkoQwyUjmpYyDJKeyAvg2T2nvpNkQ==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-runtime/-/jest-runtime-30.5.0.tgz",
+      "integrity": "sha512-VTRz0sRIw2EISeHigx1O+CMuwoG4+RKJjF8dp8okzFaDNQEcv5Mw0h5QW8VJXgb2CRF4gZIjSEBb2jdzXPagFQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/environment": "30.4.1",
-        "@jest/fake-timers": "30.4.1",
-        "@jest/globals": "30.4.1",
-        "@jest/source-map": "30.0.1",
-        "@jest/test-result": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/environment": "30.5.0",
+        "@jest/fake-timers": "30.5.0",
+        "@jest/globals": "30.5.0",
+        "@jest/source-map": "30.5.0",
+        "@jest/test-result": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
-        "cjs-module-lexer": "^2.1.0",
+        "cjs-module-lexer": "^2.2.0",
         "collect-v8-coverage": "^1.0.2",
-        "glob": "^10.5.0",
+        "es-module-lexer": "^2.1.0",
+        "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "jest-haste-map": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-mock": "30.4.1",
-        "jest-regex-util": "30.4.0",
-        "jest-resolve": "30.4.1",
-        "jest-snapshot": "30.4.1",
-        "jest-util": "30.4.1",
+        "jest-haste-map": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-mock": "30.5.0",
+        "jest-regex-util": "30.5.0",
+        "jest-resolve": "30.5.0",
+        "jest-snapshot": "30.5.0",
+        "jest-util": "30.5.0",
         "slash": "^3.0.0",
         "strip-bom": "^4.0.0"
       },
@@ -7167,10 +7721,94 @@
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
       }
     },
+    "node_modules/jest-runtime/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/brace-expansion": {
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/glob": {
+      "version": "13.0.6",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-13.0.6.tgz",
+      "integrity": "sha512-Wjlyrolmm8uDpm/ogGyXZXb1Z+Ca2B8NbJwqBVg0axK9GbBeoS7yGV6vjXnYdGm6X53iehEuxxbyiKp8QmN4Vw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "minimatch": "^10.2.2",
+        "minipass": "^7.1.3",
+        "path-scurry": "^2.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/lru-cache": {
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/minimatch": {
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "brace-expansion": "^5.0.8"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/jest-runtime/node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jest-snapshot": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.4.1.tgz",
-      "integrity": "sha512-tEOkkfOMppUyeiHwjZswOQ3lcnoTnws/q5FnGIaeIh/jmoU0ZlgMYRR8sTlTj+nNGCoJ0RDq6SfxGxCsyMTPmw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-30.5.0.tgz",
+      "integrity": "sha512-pZWETdcqmKve9MDTE/AX6RaeAbRhzKhhAXGozAW8Pg2FfOSdUrQ/7D+VdwE3fLQsqjpITXJVQvYVZoMEzrUl0Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7179,20 +7817,20 @@
         "@babel/plugin-syntax-jsx": "^7.27.1",
         "@babel/plugin-syntax-typescript": "^7.27.1",
         "@babel/types": "^7.27.3",
-        "@jest/expect-utils": "30.4.1",
-        "@jest/get-type": "30.1.0",
-        "@jest/snapshot-utils": "30.4.1",
-        "@jest/transform": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/expect-utils": "30.5.0",
+        "@jest/get-type": "30.5.0",
+        "@jest/snapshot-utils": "30.5.0",
+        "@jest/transform": "30.5.0",
+        "@jest/types": "30.5.0",
         "babel-preset-current-node-syntax": "^1.2.0",
         "chalk": "^4.1.2",
-        "expect": "30.4.1",
+        "expect": "30.5.0",
         "graceful-fs": "^4.2.11",
-        "jest-diff": "30.4.1",
-        "jest-matcher-utils": "30.4.1",
-        "jest-message-util": "30.4.1",
-        "jest-util": "30.4.1",
-        "pretty-format": "30.4.1",
+        "jest-diff": "30.5.0",
+        "jest-matcher-utils": "30.5.0",
+        "jest-message-util": "30.5.0",
+        "jest-util": "30.5.0",
+        "pretty-format": "30.5.0",
         "semver": "^7.7.2",
         "synckit": "^0.11.8"
       },
@@ -7201,9 +7839,9 @@
       }
     },
     "node_modules/jest-snapshot/node_modules/semver": {
-      "version": "7.8.0",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.0.tgz",
-      "integrity": "sha512-AcM7dV/5ul4EekoQ29Agm5vri8JNqRyj39o0qpX6vDF2GZrtutZl5RwgD1XnZjiTAfncsJhMI48QQH3sN87YNA==",
+      "version": "7.8.5",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.5.tgz",
+      "integrity": "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==",
       "dev": true,
       "license": "ISC",
       "bin": {
@@ -7214,13 +7852,13 @@
       }
     },
     "node_modules/jest-util": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.4.1.tgz",
-      "integrity": "sha512-vjQb1sACEiv13DKJMDToJpzVW0joCsIQrmbg0fi7CyOOt+g9jTuQl2A216pWRBYhOVt53XbL/2LbMKg1BECWOw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-util/-/jest-util-30.5.0.tgz",
+      "integrity": "sha512-lzU4aGUWaS+2X/B0CmgheDasfnsVlRfZh/rNQxB9b9s8cSYUq5BcqdQA95ld+KqJXBUVVt1sqnMQ2T3OxIalmg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/types": "30.4.1",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "chalk": "^4.1.2",
         "ci-info": "^4.2.0",
@@ -7232,18 +7870,18 @@
       }
     },
     "node_modules/jest-validate": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.4.1.tgz",
-      "integrity": "sha512-PDWi4SOwLnwqNDfHZjOcsEFyZ4fc/2W2gVL3DEoyqnB6jCQMLRtfBong8s6omIw3lI0HWOus12xfnFmQtjW3fw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-validate/-/jest-validate-30.5.0.tgz",
+      "integrity": "sha512-N/hsPYKgBSzBeVZ2RHCs3yvBbTZNPX7Be8q33zhyo/yeFneBL1swzly31LYU4LJ3zJM9e8TxSM8IYLo2SDJZYQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/get-type": "30.1.0",
-        "@jest/types": "30.4.1",
+        "@jest/get-type": "30.5.0",
+        "@jest/types": "30.5.0",
         "camelcase": "^6.3.0",
         "chalk": "^4.1.2",
         "leven": "^3.1.0",
-        "pretty-format": "30.4.1"
+        "pretty-format": "30.5.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -7263,19 +7901,19 @@
       }
     },
     "node_modules/jest-watcher": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.4.1.tgz",
-      "integrity": "sha512-/l9UonmvCwjHH7d2h3iAwIloLc1H0S8mJZ/LNK3i86hqwPAz8otUJjP9MfYtz9Tt77Su5FD2xGjZn8d31IZHlw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-watcher/-/jest-watcher-30.5.0.tgz",
+      "integrity": "sha512-ujjnEoL4Uu+Swu3WRwYenWMB9JMEiD2T3OypnveMJ64S/1r/5G8eC4OQ1wEOgYWQqMi+mT+buzccflCHr/XJ9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/test-result": "30.4.1",
-        "@jest/types": "30.4.1",
+        "@jest/test-result": "30.5.0",
+        "@jest/types": "30.5.0",
         "@types/node": "*",
         "ansi-escapes": "^4.3.2",
         "chalk": "^4.1.2",
         "emittery": "^0.13.1",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "string-length": "^4.0.2"
       },
       "engines": {
@@ -7283,15 +7921,15 @@
       }
     },
     "node_modules/jest-worker": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.4.1.tgz",
-      "integrity": "sha512-SHynN/q/QD++iNyvMdy+WMmbCGk8jIsNcRxycXbWubSOhvo6T+j2afcfUSl+3hYsiBebOTo0cT7c2H7CXugu1g==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/jest-worker/-/jest-worker-30.5.0.tgz",
+      "integrity": "sha512-7kFk/607EoynNHLJa20daivkElM+c9PrCLduYy6AlMkYrXbh5TmVtW1BLXE05Y8baAFsJHMoC3xs2QRRTotwLw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/node": "*",
         "@ungap/structured-clone": "^1.3.0",
-        "jest-util": "30.4.1",
+        "jest-util": "30.5.0",
         "merge-stream": "^2.0.0",
         "supports-color": "^8.1.1"
       },
@@ -7577,16 +8215,6 @@
         "node": ">=10"
       }
     },
-    "node_modules/makeerror": {
-      "version": "1.0.12",
-      "resolved": "https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz",
-      "integrity": "sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "tmpl": "1.0.5"
-      }
-    },
     "node_modules/map-obj": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/map-obj/-/map-obj-4.3.0.tgz",
@@ -7898,6 +8526,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/node-addon-api": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-7.1.1.tgz",
+      "integrity": "sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/node-exports-info": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/node-exports-info/-/node-exports-info-1.6.0.tgz",
@@ -7935,11 +8570,14 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.44",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.44.tgz",
-      "integrity": "sha512-5WUyunoPMsvvEhS8AxHtRzP+oA8UCkJ7YRxatWKjngndhDGLiqEVAQKWjFAiAiuL8zMRGzGSJxFnLetoa43qGQ==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/normalize-package-data": {
       "version": "3.0.3",
@@ -8131,16 +8769,6 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
     "node_modules/onetime": {
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
@@ -8326,16 +8954,6 @@
         "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
       }
     },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
     "node_modules/path-key": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
@@ -8544,16 +9162,16 @@
       }
     },
     "node_modules/pretty-format": {
-      "version": "30.4.1",
-      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.4.1.tgz",
-      "integrity": "sha512-K6KiKMHTL4jjX4u3Kir2EW07nRfcqVTXIImx50wbjHQTcZPgg+gjVeNTIT3l3L1Rd4UefxfogquC9J37SoFyyw==",
+      "version": "30.5.0",
+      "resolved": "https://registry.npmjs.org/pretty-format/-/pretty-format-30.5.0.tgz",
+      "integrity": "sha512-mzNzBErpHwM0zpmWS7ExOv62yhQhvd546nUuFqVR0dmnJB59tfrw9sjDF0DJknwsr59OXP0buwJ7PaKguczHSg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@jest/schemas": "30.4.1",
-        "ansi-styles": "^5.2.0",
-        "react-is-18": "npm:react-is@^18.3.1",
-        "react-is-19": "npm:react-is@^19.2.5"
+        "@jest/react-is-18": "npm:react-is@^18.3.1",
+        "@jest/react-is-19": "npm:react-is@^19.2.5",
+        "@jest/schemas": "30.5.0",
+        "ansi-styles": "^5.2.0"
       },
       "engines": {
         "node": "^18.14.0 || ^20.0.0 || ^22.0.0 || >=24.0.0"
@@ -8689,22 +9307,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/react-is-18": {
-      "name": "react-is",
-      "version": "18.3.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-18.3.1.tgz",
-      "integrity": "sha512-/LLMVyas0ljjAtoYiPqYiL8VWXzUUdThrmU5+n20DZv+a+ClRoevUzw5JxU+Ieh5/c87ytoTBV9G1FiKfNJdmg==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/react-is-19": {
-      "name": "react-is",
-      "version": "19.2.6",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-19.2.6.tgz",
-      "integrity": "sha512-XjBR15BhXuylgWGuslhDKqlSayuqvqBX91BP8pauG8kd1zY8kotkNWbXksTCNRarse4kuGbe2kIY05ARtwNIvw==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/read-pkg": {
       "version": "5.2.0",
       "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-5.2.0.tgz",
@@ -9296,27 +9898,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "dev": true,
-      "license": "BSD-3-Clause",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/source-map-support": {
-      "version": "0.5.13",
-      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.13.tgz",
-      "integrity": "sha512-SHSKFHadjVA5oR4PPqhtAVdcBWwRYVd6g6cAXnIbRiIwc2EhPrTuKUBdSLvlEKyIP3GCf89fltvcZiP9MMFA1w==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "buffer-from": "^1.0.0",
-        "source-map": "^0.6.0"
-      }
-    },
     "node_modules/spdx-correct": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
@@ -9726,13 +10307,13 @@
       }
     },
     "node_modules/synckit": {
-      "version": "0.11.12",
-      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.12.tgz",
-      "integrity": "sha512-Bh7QjT8/SuKUIfObSXNHNSK6WHo6J1tHCqJsuaFDP7gP0fkzSfTxI8y85JrppZ0h8l0maIgc2tfuZQ6/t3GtnQ==",
+      "version": "0.11.13",
+      "resolved": "https://registry.npmjs.org/synckit/-/synckit-0.11.13.tgz",
+      "integrity": "sha512-eNRKgb3z66Yp3D2CixVujOUvXLFUTij/zVnV8KRyvFdQwpz7I5DS8UfRkTeLzb64u+dkzDSdelE24izu+zSSUg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@pkgr/core": "^0.2.9"
+        "@pkgr/core": "^0.3.6"
       },
       "engines": {
         "node": "^14.18.0 || >=16.0.0"
@@ -9781,16 +10362,16 @@
       }
     },
     "node_modules/test-exclude/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       }
     },
     "node_modules/test-exclude/node_modules/glob": {
@@ -9871,13 +10452,6 @@
         "url": "https://github.com/sponsors/SuperchupuDev"
       }
     },
-    "node_modules/tmpl": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz",
-      "integrity": "sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==",
-      "dev": true,
-      "license": "BSD-3-Clause"
-    },
     "node_modules/to-regex-range": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
@@ -10223,9 +10797,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "6.28.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
+      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -10253,44 +10827,47 @@
       }
     },
     "node_modules/unrs-resolver": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.11.1.tgz",
-      "integrity": "sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==",
+      "version": "1.12.2",
+      "resolved": "https://registry.npmjs.org/unrs-resolver/-/unrs-resolver-1.12.2.tgz",
+      "integrity": "sha512-dmlRxBJJayXjqTwC+JtF1HhJmgf3ftQ3YejFcZrf4+KKtJv0qDsK1pjqaaVjG7wJ5NJ6UVP1OqRMQ71Z4C3rxQ==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
-        "napi-postinstall": "^0.3.0"
+        "napi-postinstall": "^0.3.4"
       },
       "funding": {
         "url": "https://opencollective.com/unrs-resolver"
       },
       "optionalDependencies": {
-        "@unrs/resolver-binding-android-arm-eabi": "1.11.1",
-        "@unrs/resolver-binding-android-arm64": "1.11.1",
-        "@unrs/resolver-binding-darwin-arm64": "1.11.1",
-        "@unrs/resolver-binding-darwin-x64": "1.11.1",
-        "@unrs/resolver-binding-freebsd-x64": "1.11.1",
-        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.11.1",
-        "@unrs/resolver-binding-linux-arm-musleabihf": "1.11.1",
-        "@unrs/resolver-binding-linux-arm64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-arm64-musl": "1.11.1",
-        "@unrs/resolver-binding-linux-ppc64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-riscv64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-riscv64-musl": "1.11.1",
-        "@unrs/resolver-binding-linux-s390x-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-x64-gnu": "1.11.1",
-        "@unrs/resolver-binding-linux-x64-musl": "1.11.1",
-        "@unrs/resolver-binding-wasm32-wasi": "1.11.1",
-        "@unrs/resolver-binding-win32-arm64-msvc": "1.11.1",
-        "@unrs/resolver-binding-win32-ia32-msvc": "1.11.1",
-        "@unrs/resolver-binding-win32-x64-msvc": "1.11.1"
+        "@unrs/resolver-binding-android-arm-eabi": "1.12.2",
+        "@unrs/resolver-binding-android-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-arm64": "1.12.2",
+        "@unrs/resolver-binding-darwin-x64": "1.12.2",
+        "@unrs/resolver-binding-freebsd-x64": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-gnueabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm-musleabihf": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-arm64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-loong64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-ppc64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-riscv64-musl": "1.12.2",
+        "@unrs/resolver-binding-linux-s390x-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-gnu": "1.12.2",
+        "@unrs/resolver-binding-linux-x64-musl": "1.12.2",
+        "@unrs/resolver-binding-openharmony-arm64": "1.12.2",
+        "@unrs/resolver-binding-wasm32-wasi": "1.12.2",
+        "@unrs/resolver-binding-win32-arm64-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-ia32-msvc": "1.12.2",
+        "@unrs/resolver-binding-win32-x64-msvc": "1.12.2"
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "dev": true,
       "funding": [
         {
@@ -10354,16 +10931,6 @@
         "spdx-expression-parse": "^3.0.0"
       }
     },
-    "node_modules/walker": {
-      "version": "1.0.8",
-      "resolved": "https://registry.npmjs.org/walker/-/walker-1.0.8.tgz",
-      "integrity": "sha512-ts/8E8l5b7kY0vlWLewOkDXMmPdLcVV4GmOQLyxuSswIJsweeFZtAsMF7k1Nszz+TYBQrlYRmzOnr398y1JemQ==",
-      "dev": true,
-      "license": "Apache-2.0",
-      "dependencies": {
-        "makeerror": "1.0.12"
-      }
-    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -10574,13 +11141,6 @@
         "url": "https://github.com/chalk/ansi-styles?sponsor=1"
       }
     },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
-      "license": "ISC"
-    },
     "node_modules/write-file-atomic": {
       "version": "5.0.1",
       "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-5.0.1.tgz",
@@ -10596,9 +11156,9 @@
       }
     },
     "node_modules/ws": {
-      "version": "8.21.1",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.1.tgz",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "version": "8.21.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.3.tgz",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/deps/undici/src/package.json b/deps/undici/src/package.json
index 270b572dfc89..bc78602fe5b9 100644
--- a/deps/undici/src/package.json
+++ b/deps/undici/src/package.json
@@ -1,6 +1,6 @@
 {
   "name": "undici",
-  "version": "8.10.0",
+  "version": "8.10.2",
   "description": "An HTTP/1.1 client, written from scratch for Node.js",
   "homepage": "https://undici.nodejs.org",
   "bugs": {
@@ -97,7 +97,7 @@
     "test:websocket:autobahn": "node test/autobahn/client.js",
     "test:websocket:autobahn:report": "node test/autobahn/report.js",
     "test:wpt:setup": "node test/web-platform-tests/wpt-runner.mjs setup",
-    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /websockets /serviceWorkers /eventsource",
+    "test:wpt": "npm run test:wpt:setup && node test/web-platform-tests/wpt-runner.mjs run /fetch /mimesniff /xhr /websockets /eventsource",
     "test:cache-tests": "node test/cache-interceptor/cache-tests.mjs --ci",
     "coverage": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report",
     "coverage:ci": "npm run coverage:clean && cross-env NODE_V8_COVERAGE=./coverage/tmp npm run test:javascript && npm run coverage:report:ci",
@@ -109,7 +109,7 @@
     "prepare": "husky && node ./scripts/platform-shell.js"
   },
   "devDependencies": {
-    "@fastify/busboy": "3.2.0",
+    "@fastify/busboy": "3.2.2",
     "@matteo.collina/tspl": "^0.2.0",
     "@metcoder95/https-pem": "^1.0.0",
     "@sinonjs/fake-timers": "^12.0.0",
diff --git a/deps/undici/src/types/client.d.ts b/deps/undici/src/types/client.d.ts
index 064d3d69f2c1..1edaeb05f1e0 100644
--- a/deps/undici/src/types/client.d.ts
+++ b/deps/undici/src/types/client.d.ts
@@ -80,6 +80,8 @@ export declare namespace Client {
     maxResponseSize?: number;
     /** WebSocket-specific options */
     webSocket?: Client.WebSocketOptions;
+    /** EventSource-specific options */
+    eventSource?: Client.EventSourceOptions;
     /** Enables a family autodetection algorithm that loosely implements section 5 of RFC 8305. */
     autoSelectFamily?: boolean;
     /** The amount of time in milliseconds to wait for a connection attempt to finish before trying the next address when using the `autoSelectFamily` option. */
@@ -169,6 +171,14 @@ export declare namespace Client {
      */
     settings?: Omit<SessionOptions['settings'], 'enablePush' | 'maxConcurrentStreams' | 'enableConnectProtocol'>
   }
+  export interface EventSourceOptions {
+    /**
+     * Maximum allowed event size in bytes for EventSource messages.
+     * Set to 0 to disable the limit.
+     * @default buffer.kStringMaxLength
+     */
+    maxEventSize?: number;
+  }
 }
 
 export default Client
diff --git a/deps/undici/src/types/interceptors.d.ts b/deps/undici/src/types/interceptors.d.ts
index d21d717cec51..c11d4017b11e 100644
--- a/deps/undici/src/types/interceptors.d.ts
+++ b/deps/undici/src/types/interceptors.d.ts
@@ -12,6 +12,8 @@ declare namespace Interceptors {
   export type DecompressInterceptorOpts = {
     skipErrorResponses?: boolean
     skipStatusCodes?: number[]
+    /** Maximum decompressed response size in bytes. @default 67108864 */
+    maxSize?: number
   }
 
   export type ResponseErrorInterceptorOpts = { throwOnError: boolean }
diff --git a/deps/undici/src/types/mock-agent.d.ts b/deps/undici/src/types/mock-agent.d.ts
index 330926be1919..c718df1a4334 100644
--- a/deps/undici/src/types/mock-agent.d.ts
+++ b/deps/undici/src/types/mock-agent.d.ts
@@ -6,10 +6,6 @@ import { MockCallHistory } from './mock-call-history'
 
 export default MockAgent
 
-interface PendingInterceptor extends MockDispatch {
-  origin: string;
-}
-
 /** A mocked Agent class that implements the Agent API. It allows one to intercept HTTP requests made through undici and return mocked responses instead. */
 declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.Options> extends Dispatcher {
   constructor (options?: TMockAgentOptions)
@@ -40,17 +36,22 @@ declare class MockAgent<TMockAgentOptions extends MockAgent.Options = MockAgent.
   enableCallHistory (): this
   /** Disable call history. Any subsequence calls will then not be registered. */
   disableCallHistory (): this
-  pendingInterceptors (): PendingInterceptor[]
+  pendingInterceptors (): MockAgent.PendingInterceptor[]
   assertNoPendingInterceptors (options?: {
-    pendingInterceptorsFormatter?: PendingInterceptorsFormatter;
+    pendingInterceptorsFormatter?: MockAgent.PendingInterceptorsFormatter;
   }): void
 }
 
-interface PendingInterceptorsFormatter {
-  format(pendingInterceptors: readonly PendingInterceptor[]): string;
-}
-
 declare namespace MockAgent {
+  /** An interceptor that was registered on a mock dispatcher and has not been consumed yet. */
+  export interface PendingInterceptor extends MockDispatch {
+    origin: string;
+  }
+
+  export interface PendingInterceptorsFormatter {
+    format(pendingInterceptors: readonly PendingInterceptor[]): string;
+  }
+
   /** MockAgent options. */
   export interface Options extends Agent.Options {
     /** A custom agent to be encapsulated by the MockAgent. */
diff --git a/deps/undici/src/types/socks5-proxy-agent.d.ts b/deps/undici/src/types/socks5-proxy-agent.d.ts
index 05e4331670e9..4eaeb11048f3 100644
--- a/deps/undici/src/types/socks5-proxy-agent.d.ts
+++ b/deps/undici/src/types/socks5-proxy-agent.d.ts
@@ -21,5 +21,7 @@ declare namespace Socks5ProxyAgent {
     connect?: buildConnector.connector;
     /** TLS options for the proxy connection (for SOCKS5 over TLS) */
     proxyTls?: buildConnector.BuildOptions;
+    /** TLS options for the end-to-end connection to the target */
+    requestTls?: buildConnector.BuildOptions;
   }
 }
diff --git a/deps/undici/undici.js b/deps/undici/undici.js
index bb398a0686ce..b67af93f3659 100644
--- a/deps/undici/undici.js
+++ b/deps/undici/undici.js
@@ -523,6 +523,8 @@ var require_symbols = __commonJS({
       kDestroy: /* @__PURE__ */ Symbol("destroy"),
       kDispatch: /* @__PURE__ */ Symbol("dispatch"),
       kUrl: /* @__PURE__ */ Symbol("url"),
+      kRequestOrigin: /* @__PURE__ */ Symbol("request origin"),
+      kOriginless: /* @__PURE__ */ Symbol("originless"),
       kWriting: /* @__PURE__ */ Symbol("writing"),
       kResuming: /* @__PURE__ */ Symbol("resuming"),
       kQueue: /* @__PURE__ */ Symbol("queue"),
@@ -601,6 +603,7 @@ var require_dispatcher = __commonJS({
   "lib/dispatcher/dispatcher.js"(exports2, module2) {
     "use strict";
     var EventEmitter = require("node:events");
+    var { kOriginless, kUrl } = require_symbols();
     var Dispatcher2 = class extends EventEmitter {
       static {
         __name(this, "Dispatcher");
@@ -616,6 +619,7 @@ var require_dispatcher = __commonJS({
       }
       compose(...args) {
         const interceptors = Array.isArray(args[0]) ? args[0] : args;
+        const interceptorOrigin = this[kOriginless] === true ? null : this[kUrl]?.origin;
         let dispatch = this.dispatch.bind(this);
         for (const interceptor of interceptors) {
           if (interceptor == null) {
@@ -624,11 +628,19 @@ var require_dispatcher = __commonJS({
           if (typeof interceptor !== "function") {
             throw new TypeError(`invalid interceptor, expected function received ${typeof interceptor}`);
           }
-          dispatch = interceptor(dispatch);
+          dispatch = interceptor(dispatch, interceptorOrigin);
           if (dispatch == null || typeof dispatch !== "function" || dispatch.length !== 2) {
             throw new TypeError("invalid interceptor");
           }
         }
+        const originalDispatch = dispatch;
+        const self = this;
+        dispatch = /* @__PURE__ */ __name(function(opts, handler) {
+          if (opts && typeof opts === "object" && !opts.origin && self[kUrl]) {
+            opts = Object.assign({}, opts, { origin: self[kUrl].origin });
+          }
+          return originalDispatch(opts, handler);
+        }, "dispatch");
         return new Proxy(this, {
           get: /* @__PURE__ */ __name((target, key) => key === "dispatch" ? dispatch : target[key], "get")
         });
@@ -642,6 +654,7 @@ var require_dispatcher = __commonJS({
 var require_dispatcher_base = __commonJS({
   "lib/dispatcher/dispatcher-base.js"(exports2, module2) {
     "use strict";
+    var buffer = require("node:buffer");
     var Dispatcher2 = require_dispatcher();
     var {
       ClientDestroyedError,
@@ -652,6 +665,7 @@ var require_dispatcher_base = __commonJS({
     var kOnDestroyed = /* @__PURE__ */ Symbol("onDestroyed");
     var kOnClosed = /* @__PURE__ */ Symbol("onClosed");
     var kWebSocketOptions = /* @__PURE__ */ Symbol("webSocketOptions");
+    var kEventSourceOptions = /* @__PURE__ */ Symbol("eventSourceOptions");
     var DispatcherBase = class extends Dispatcher2 {
       static {
         __name(this, "DispatcherBase");
@@ -670,9 +684,10 @@ var require_dispatcher_base = __commonJS({
       constructor(opts) {
         super();
         this[kWebSocketOptions] = opts?.webSocket ?? {};
+        this[kEventSourceOptions] = opts?.eventSource ?? {};
       }
       /**
-       * @returns {import('../../types/dispatcher').WebSocketOptions}
+       * @returns {import('../../types/client').Client.WebSocketOptions}
        */
       get webSocketOptions() {
         return {
@@ -681,6 +696,14 @@ var require_dispatcher_base = __commonJS({
           // 128 MB default
         };
       }
+      /**
+       * @returns {import('../../types/client').Client.EventSourceOptions}
+       */
+      get eventSourceOptions() {
+        return {
+          maxEventSize: this[kEventSourceOptions].maxEventSize ?? buffer.kStringMaxLength
+        };
+      }
       /** @returns {boolean} */
       get destroyed() {
         return this[kDestroyed];
@@ -5425,6 +5448,9 @@ var require_util2 = __commonJS({
     }
     __name(TAOCheck, "TAOCheck");
     function appendFetchMetadata(httpRequest) {
+      if (!isURLPotentiallyTrustworthy(requestCurrentURL(httpRequest))) {
+        return;
+      }
       let header = null;
       header = httpRequest.mode;
       httpRequest.headersList.set("sec-fetch-mode", header, true);
@@ -7856,7 +7882,7 @@ var require_client_h1 = __commonJS({
     __name(onSocketClose, "onSocketClose");
     function clearIdleSocketValidation(socket) {
       if (socket[kIdleSocketValidationTimeout]) {
-        clearTimeout(socket[kIdleSocketValidationTimeout]);
+        clearImmediate(socket[kIdleSocketValidationTimeout]);
         socket[kIdleSocketValidationTimeout] = null;
       }
       socket[kIdleSocketValidation] = 0;
@@ -7864,14 +7890,13 @@ var require_client_h1 = __commonJS({
     __name(clearIdleSocketValidation, "clearIdleSocketValidation");
     function scheduleIdleSocketValidation(client, socket) {
       socket[kIdleSocketValidation] = 1;
-      socket[kIdleSocketValidationTimeout] = setTimeout(() => {
+      socket[kIdleSocketValidationTimeout] = setImmediate(() => {
         socket[kIdleSocketValidationTimeout] = null;
         socket[kIdleSocketValidation] = 2;
         if (client[kSocket] === socket && !socket.destroyed) {
           client[kResume]();
         }
-      }, 0);
-      socket[kIdleSocketValidationTimeout].unref?.();
+      });
     }
     __name(scheduleIdleSocketValidation, "scheduleIdleSocketValidation");
     function resumeH1(client) {
@@ -8391,7 +8416,8 @@ var require_client_h2 = __commonJS({
       InformationalError,
       InvalidArgumentError,
       HeadersTimeoutError,
-      BodyTimeoutError
+      BodyTimeoutError,
+      ResponseExceededMaxSizeError
     } = require_errors();
     var {
       kUrl,
@@ -8420,7 +8446,8 @@ var require_client_h2 = __commonJS({
       kRemoteSettings,
       kHTTP2Stream,
       kHTTP2SessionState,
-      kHTTP2Options
+      kHTTP2Options,
+      kMaxResponseSize
     } = require_symbols();
     var { channels } = require_diagnostics();
     var kOpenStreams = /* @__PURE__ */ Symbol("open streams");
@@ -9175,9 +9202,11 @@ var require_client_h2 = __commonJS({
       const state = {
         abort: null,
         body: request.body,
+        bytesRead: 0,
         client,
         contentLength: null,
         expectsPayload: false,
+        maxResponseSize: client[kMaxResponseSize],
         request,
         headersTimeout,
         bodyTimeout,
@@ -9316,6 +9345,7 @@ var require_client_h2 = __commonJS({
         stream.once("continue", writeBodyH2);
       }
       stream.on("response", onResponse);
+      stream.on("headers", onInterimResponse);
       stream.on("end", onEnd);
       stream.on("error", onError);
       stream.on("frameError", onFrameError);
@@ -9334,6 +9364,7 @@ var require_client_h2 = __commonJS({
       stream.off("error", noop);
       stream.off("continue", writeBodyH2);
       stream.off("response", onResponse);
+      stream.off("headers", onInterimResponse);
       stream.off("end", onEnd);
       stream.off("error", onError);
       stream.off("frameError", onFrameError);
@@ -9367,15 +9398,35 @@ var require_client_h2 = __commonJS({
       if (state == null) {
         return;
       }
-      const { request } = state;
+      const { request, maxResponseSize } = state;
       if (request.aborted || request.completed) {
         return;
       }
+      if (maxResponseSize > -1 && state.bytesRead + chunk.length > maxResponseSize) {
+        state.abort(new ResponseExceededMaxSizeError());
+        return;
+      }
+      state.bytesRead += chunk.length;
       if (request.onResponseData(chunk) === false) {
         stream.pause();
       }
     }
     __name(onData, "onData");
+    function onInterimResponse(headers) {
+      const stream = this;
+      const state = stream[kRequestStreamState];
+      if (state == null) {
+        return;
+      }
+      const { request } = state;
+      if (request.aborted || request.completed) {
+        return;
+      }
+      const statusCode = headers[HTTP2_HEADER_STATUS];
+      delete headers[HTTP2_HEADER_STATUS];
+      request.onResponseStart(Number(statusCode), headers, noop, "");
+    }
+    __name(onInterimResponse, "onInterimResponse");
     function onResponse(headers) {
       const stream = this;
       const state = stream[kRequestStreamState];
@@ -9816,7 +9867,8 @@ var require_client = __commonJS({
         connectionWindowSize,
         pingInterval,
         webSocket,
-        h2Options
+        h2Options,
+        eventSource
       } = {}) {
         if (keepAlive !== void 0) {
           throw new InvalidArgumentError("unsupported keepAlive, use pipelining=0 instead");
@@ -9919,7 +9971,7 @@ var require_client = __commonJS({
             }
           }
         }
-        super({ webSocket });
+        super({ webSocket, eventSource });
         if (typeof connect2 !== "function") {
           connect2 = buildConnector({
             ...tls,
@@ -10420,7 +10472,7 @@ var require_agent = __commonJS({
   "lib/dispatcher/agent.js"(exports2, module2) {
     "use strict";
     var { InvalidArgumentError, MaxOriginsReachedError } = require_errors();
-    var { kBusy, kClients, kConnected, kRunning, kClose, kDestroy, kDispatch, kUrl } = require_symbols();
+    var { kBusy, kClients, kConnected, kRunning, kPending, kClose, kDestroy, kDispatch, kUrl } = require_symbols();
     var DispatcherBase = require_dispatcher_base();
     var Pool = require_pool();
     var Client = require_client();
@@ -10497,7 +10549,7 @@ var require_agent = __commonJS({
             if (this[kClients].get(key) !== dispatcher) {
               return;
             }
-            if (dispatcher[kConnected] > 0 || dispatcher[kBusy]) {
+            if (dispatcher[kConnected] > 0 || dispatcher[kBusy] || dispatcher[kPending] > 0) {
               return;
             }
             this[kClients].delete(key);
@@ -10564,6 +10616,7 @@ var require_dispatcher1_wrapper = __commonJS({
     var Dispatcher2 = require_dispatcher();
     var { InvalidArgumentError } = require_errors();
     var { toRawHeaders } = require_util();
+    var { kOriginless, kUrl } = require_symbols();
     var LegacyHandlerWrapper = class {
       static {
         __name(this, "LegacyHandlerWrapper");
@@ -10621,6 +10674,8 @@ var require_dispatcher1_wrapper = __commonJS({
           throw new InvalidArgumentError("Argument dispatcher must implement dispatch");
         }
         this.#dispatcher = dispatcher;
+        this[kUrl] = dispatcher[kUrl];
+        this[kOriginless] = dispatcher[kOriginless];
       }
       static wrapHandler(handler) {
         if (!handler || typeof handler !== "object") {
@@ -11230,27 +11285,37 @@ var require_socks5_proxy_agent = __commonJS({
     var { URL: URL2 } = require("node:url");
     var tls;
     var DispatcherBase = require_dispatcher_base();
-    var { InvalidArgumentError } = require_errors();
+    var { ConnectTimeoutError, InvalidArgumentError } = require_errors();
     var { Socks5Client, STATES } = require_socks5_client();
     var { kBusy, kConnected, kDispatch, kClose, kDestroy } = require_symbols();
     var Pool = require_pool();
     var buildConnector = require_connect();
+    var { setupConnectTimeout } = require_util();
     var { debuglog } = require("node:util");
     var debug = debuglog("undici:socks5-proxy");
+    var DEFAULT_SOCKS5_CONNECT_TIMEOUT = 5e3;
     var kProxyUrl = /* @__PURE__ */ Symbol("proxy url");
     var kProxyHeaders = /* @__PURE__ */ Symbol("proxy headers");
     var kProxyAuth = /* @__PURE__ */ Symbol("proxy auth");
     var kProxyProtocol = /* @__PURE__ */ Symbol("proxy protocol");
     var kPools = /* @__PURE__ */ Symbol("pools");
     var kConnector = /* @__PURE__ */ Symbol("connector");
+    var kConnectTimeout = /* @__PURE__ */ Symbol("connect timeout");
     var kRequestTls = /* @__PURE__ */ Symbol("request tls settings");
+    var kRequestTlsTimeout = /* @__PURE__ */ Symbol("request tls timeout");
+    function createConnectTimeoutError(hostname, port, timeout) {
+      return new ConnectTimeoutError(
+        `Connect Timeout Error (attempted address: ${hostname}:${port}, timeout: ${timeout}ms)`
+      );
+    }
+    __name(createConnectTimeoutError, "createConnectTimeoutError");
     var experimentalWarningEmitted = false;
     var Socks5ProxyAgent = class extends DispatcherBase {
       static {
         __name(this, "Socks5ProxyAgent");
       }
       constructor(proxyUrl, options = {}) {
-        super();
+        super(options);
         if (!experimentalWarningEmitted) {
           process.emitWarning(
             "SOCKS5 proxy support is experimental and subject to change",
@@ -11268,13 +11333,29 @@ var require_socks5_proxy_agent = __commonJS({
         this[kProxyUrl] = url;
         this[kProxyHeaders] = options.headers || {};
         this[kProxyProtocol] = options.proxyTls ? "https:" : "http:";
-        this[kRequestTls] = options.requestTls;
+        const connectTimeout = options.connectTimeout ?? DEFAULT_SOCKS5_CONNECT_TIMEOUT;
+        if (!Number.isFinite(connectTimeout) || connectTimeout < 0) {
+          throw new InvalidArgumentError("invalid connectTimeout");
+        }
+        this[kConnectTimeout] = connectTimeout;
+        const { timeout, ...requestTls } = options.requestTls || {};
+        const requestTlsTimeout = timeout ?? connectTimeout;
+        if (!Number.isFinite(requestTlsTimeout) || requestTlsTimeout < 0) {
+          throw new InvalidArgumentError("invalid requestTls.timeout");
+        }
+        this[kRequestTls] = requestTls;
+        this[kRequestTlsTimeout] = requestTlsTimeout;
         this[kProxyAuth] = {
           username: options.username || (url.username ? decodeURIComponent(url.username) : null),
           password: options.password || (url.password ? decodeURIComponent(url.password) : null)
         };
+        const proxyTlsTimeout = options.proxyTls?.timeout ?? connectTimeout;
+        if (!Number.isFinite(proxyTlsTimeout) || proxyTlsTimeout < 0) {
+          throw new InvalidArgumentError("invalid proxyTls.timeout");
+        }
         this[kConnector] = options.connect || buildConnector({
           ...options.proxyTls,
+          timeout: proxyTlsTimeout,
           servername: options.proxyTls?.servername || url.hostname
         });
         this[kPools] = /* @__PURE__ */ new Map();
@@ -11307,17 +11388,24 @@ var require_socks5_proxy_agent = __commonJS({
         });
         await socks5Client.handshake();
         const authenticationReady = Promise.withResolvers();
-        const authenticationTimeout = setTimeout(() => {
-          authenticationReady.reject(new Error("SOCKS5 authentication timeout"));
-        }, 5e3);
-        const onAuthenticated = /* @__PURE__ */ __name(() => {
+        const authenticationTimeout = this[kConnectTimeout] === 0 ? null : setTimeout(() => {
+          cleanupAuthenticationListeners();
+          socks5Client.destroy();
+          authenticationReady.reject(
+            createConnectTimeoutError(proxyHost, proxyPort, this[kConnectTimeout])
+          );
+        }, this[kConnectTimeout]);
+        const cleanupAuthenticationListeners = /* @__PURE__ */ __name(() => {
           clearTimeout(authenticationTimeout);
+          socks5Client.removeListener("authenticated", onAuthenticated);
           socks5Client.removeListener("error", onAuthenticationError);
+        }, "cleanupAuthenticationListeners");
+        const onAuthenticated = /* @__PURE__ */ __name(() => {
+          cleanupAuthenticationListeners();
           authenticationReady.resolve();
         }, "onAuthenticated");
         const onAuthenticationError = /* @__PURE__ */ __name((err) => {
-          clearTimeout(authenticationTimeout);
-          socks5Client.removeListener("authenticated", onAuthenticated);
+          cleanupAuthenticationListeners();
           authenticationReady.reject(err);
         }, "onAuthenticationError");
         if (socks5Client.state === STATES.AUTHENTICATED) {
@@ -11330,18 +11418,25 @@ var require_socks5_proxy_agent = __commonJS({
         await authenticationReady.promise;
         await socks5Client.connect(targetHost, targetPort);
         const connectionReady = Promise.withResolvers();
-        const connectionTimeout = setTimeout(() => {
-          connectionReady.reject(new Error("SOCKS5 connection timeout"));
-        }, 5e3);
-        const onConnected = /* @__PURE__ */ __name((info) => {
-          debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
+        const connectionTimeout = this[kConnectTimeout] === 0 ? null : setTimeout(() => {
+          cleanupConnectionListeners();
+          socks5Client.destroy();
+          connectionReady.reject(
+            createConnectTimeoutError(targetHost, targetPort, this[kConnectTimeout])
+          );
+        }, this[kConnectTimeout]);
+        const cleanupConnectionListeners = /* @__PURE__ */ __name(() => {
           clearTimeout(connectionTimeout);
+          socks5Client.removeListener("connected", onConnected);
           socks5Client.removeListener("error", onConnectionError);
+        }, "cleanupConnectionListeners");
+        const onConnected = /* @__PURE__ */ __name((info) => {
+          debug("SOCKS5 tunnel established to", targetHost, targetPort, "via", info);
+          cleanupConnectionListeners();
           connectionReady.resolve();
         }, "onConnected");
         const onConnectionError = /* @__PURE__ */ __name((err) => {
-          clearTimeout(connectionTimeout);
-          socks5Client.removeListener("connected", onConnected);
+          cleanupConnectionListeners();
           connectionReady.reject(err);
         }, "onConnectionError");
         socks5Client.once("connected", onConnected);
@@ -11381,8 +11476,26 @@ var require_socks5_proxy_agent = __commonJS({
                       servername: this[kRequestTls]?.servername || targetHost
                     });
                     const tlsReady = Promise.withResolvers();
-                    finalSocket.once("secureConnect", tlsReady.resolve);
-                    finalSocket.once("error", tlsReady.reject);
+                    const cleanupTlsListeners = /* @__PURE__ */ __name(() => {
+                      queueMicrotask(clearTlsTimeout);
+                      finalSocket.removeListener("secureConnect", onSecureConnect);
+                      finalSocket.removeListener("error", onTlsError);
+                    }, "cleanupTlsListeners");
+                    const onSecureConnect = /* @__PURE__ */ __name(() => {
+                      cleanupTlsListeners();
+                      tlsReady.resolve();
+                    }, "onSecureConnect");
+                    const onTlsError = /* @__PURE__ */ __name((err) => {
+                      cleanupTlsListeners();
+                      tlsReady.reject(err);
+                    }, "onTlsError");
+                    const clearTlsTimeout = setupConnectTimeout(new WeakRef(finalSocket), {
+                      timeout: this[kRequestTlsTimeout],
+                      hostname: targetHost,
+                      port: targetPort
+                    });
+                    finalSocket.once("secureConnect", onSecureConnect);
+                    finalSocket.once("error", onTlsError);
                     await tlsReady.promise;
                   }
                   callback(null, finalSocket);
@@ -11453,6 +11566,7 @@ var require_proxy_agent = __commonJS({
     var Client = require_client();
     var { channels } = require_diagnostics();
     var Socks5ProxyAgent = require_socks5_proxy_agent();
+    var { hasSafeIterator } = require_util();
     var kAgent = /* @__PURE__ */ Symbol("proxy agent");
     var kClient = /* @__PURE__ */ Symbol("proxy client");
     var kProxyHeaders = /* @__PURE__ */ Symbol("proxy headers");
@@ -11549,7 +11663,7 @@ var require_proxy_agent = __commonJS({
           throw new InvalidArgumentError("Proxy opts.clientFactory must be a function.");
         }
         const { proxyTunnel, connectTimeout } = opts;
-        super();
+        super(opts);
         const url = this.#getUrl(opts);
         const { href, origin, port, protocol, username, password, hostname: proxyHostname } = url;
         this[kProxy] = { uri: href, protocol };
@@ -11582,6 +11696,7 @@ var require_proxy_agent = __commonJS({
               factory: agentFactory,
               username: opts.username || username,
               password: opts.password || password,
+              connectTimeout,
               proxyTls: opts.proxyTls,
               requestTls: opts.requestTls
             });
@@ -11723,6 +11838,13 @@ var require_proxy_agent = __commonJS({
         }
         return headersPair;
       }
+      if (headers && typeof headers === "object" && hasSafeIterator(headers)) {
+        const headersPair = {};
+        for (const [key, value] of headers) {
+          headersPair[key] = value;
+        }
+        return headersPair;
+      }
       return headers;
     }
     __name(buildHeaders, "buildHeaders");
@@ -11766,7 +11888,7 @@ var require_env_http_proxy_agent = __commonJS({
       #noProxyEntries = null;
       #opts = null;
       constructor(opts = {}) {
-        super();
+        super(opts);
         this.#opts = opts;
         const { httpProxy, httpsProxy, noProxy, ...agentOpts } = opts;
         this[kNoProxyAgent] = new Agent(agentOpts);
@@ -11806,6 +11928,9 @@ var require_env_http_proxy_agent = __commonJS({
       #getProxyAgentForUrl(url) {
         let { protocol, host: hostname, port } = url;
         hostname = hostname.replace(/:\d*$/, "").replace(/^\[(.+)\]$/, "$1").toLowerCase();
+        if (hostname.length > 1 && hostname.charCodeAt(hostname.length - 1) === 46) {
+          hostname = hostname.slice(0, -1);
+        }
         port = Number.parseInt(port, 10) || DEFAULT_PORTS[protocol] || 0;
         if (!this.#shouldProxy(hostname, port)) {
           return this[kNoProxyAgent];
@@ -11861,8 +11986,8 @@ var require_env_http_proxy_agent = __commonJS({
             port = parsed ? Number.parseInt(parsed[2], 10) : 0;
           }
           noProxyEntries.push({
-            // strip leading dot or asterisk with dot
-            hostname: hostname.replace(/^\*?\./, "").toLowerCase(),
+            // strip leading dot or asterisk with dot, and any trailing dot
+            hostname: hostname.replace(/^\*?\./, "").replace(/^(.+)\.$/, "$1").toLowerCase(),
             port
           });
         }
@@ -13386,7 +13511,7 @@ var require_request2 = __commonJS({
         serviceWorkers: init.serviceWorkers ?? "all",
         initiator: init.initiator ?? "",
         destination: init.destination ?? "",
-        priority: init.priority ?? null,
+        priority: init.priority ?? "auto",
         origin: init.origin ?? "client",
         policyContainer: init.policyContainer ?? "client",
         referrer: init.referrer ?? "client",
@@ -13558,8 +13683,7 @@ var require_request2 = __commonJS({
       {
         key: "priority",
         converter: webidl.converters.DOMString,
-        allowedValues: ["high", "low", "auto"],
-        defaultValue: /* @__PURE__ */ __name(() => "auto", "defaultValue")
+        allowedValues: ["high", "low", "auto"]
       }
     ]);
     module2.exports = {
@@ -13777,6 +13901,7 @@ var require_fetch = __commonJS({
     var EE = require("node:events");
     var { Readable, pipeline, finished, isErrored, isReadable } = require("node:stream");
     var { addAbortListener, bufferToLowerCasedHeaderName } = require_util();
+    var { SocketError } = require_errors();
     var { dataURLProcessor, serializeAMimeType, minimizeSupportedMimeType } = require_data_url();
     var { getGlobalDispatcher: getGlobalDispatcher2 } = require_global2();
     var { webidl } = require_webidl();
@@ -14854,6 +14979,9 @@ var require_fetch = __commonJS({
               },
               onRequestUpgrade(controller, status, headers, socket) {
                 if (socket.session != null && status !== 200 || socket.session == null && status !== 101) {
+                  if (socket.session != null) {
+                    controller.abort(new SocketError("bad upgrade", null));
+                  }
                   return false;
                 }
                 const rawHeaders = controller?.rawHeaders ?? [];
@@ -15605,7 +15733,7 @@ var require_connection = __commonJS({
           const secProtocol = response.headersList.get("Sec-WebSocket-Protocol");
           if (secProtocol !== null) {
             const requestProtocols = getDecodeSplit("sec-websocket-protocol", request.headersList);
-            if (!requestProtocols.includes(secProtocol)) {
+            if (requestProtocols === null || !requestProtocols.includes(secProtocol)) {
               failWebsocketConnection(handler, 1002, "Protocol was not set in the opening handshake.");
               return;
             }
@@ -15729,6 +15857,7 @@ var require_permessage_deflate = __commonJS({
             if (this.#maxPayloadSize > 0 && this.#inflate[kLength] > this.#maxPayloadSize) {
               callback(new MessageSizeExceededError());
               this.#inflate.removeAllListeners();
+              this.#inflate.destroy();
               this.#inflate = null;
               return;
             }
@@ -16768,6 +16897,7 @@ var require_util4 = __commonJS({
 var require_eventsource_stream = __commonJS({
   "lib/web/eventsource/eventsource-stream.js"(exports2, module2) {
     "use strict";
+    var buffer = require("node:buffer");
     var { Transform } = require("node:stream");
     var { isASCIINumber, isValidLastEventId } = require_util4();
     var BOM = [239, 187, 191];
@@ -16775,25 +16905,26 @@ var require_eventsource_stream = __commonJS({
     var CR = 13;
     var COLON = 58;
     var SPACE = 32;
+    var defaultMaxEventSize = buffer.kStringMaxLength;
     var DATA = Buffer.from("data");
     var EVENT = Buffer.from("event");
     var ID = Buffer.from("id");
     var RETRY = Buffer.from("retry");
-    function isASCIINumberBytes(buffer, start) {
-      if (start >= buffer.length) {
+    function isASCIINumberBytes(buffer2, start) {
+      if (start >= buffer2.length) {
         return false;
       }
-      for (let i = start; i < buffer.length; i++) {
-        if (buffer[i] < 48 || buffer[i] > 57) {
+      for (let i = start; i < buffer2.length; i++) {
+        if (buffer2[i] < 48 || buffer2[i] > 57) {
           return false;
         }
       }
       return true;
     }
     __name(isASCIINumberBytes, "isASCIINumberBytes");
-    function isValidLastEventIdBytes(buffer, start) {
-      for (let i = start; i < buffer.length; i++) {
-        if (buffer[i] === 0) {
+    function isValidLastEventIdBytes(buffer2, start) {
+      for (let i = start; i < buffer2.length; i++) {
+        if (buffer2[i] === 0) {
           return false;
         }
       }
@@ -16812,6 +16943,12 @@ var require_eventsource_stream = __commonJS({
       return true;
     }
     __name(isFieldName, "isFieldName");
+    function createMaxEventSizeExceededError() {
+      const error = new Error("EventSource message size exceeded");
+      error.aborted = false;
+      return error;
+    }
+    __name(createMaxEventSizeExceededError, "createMaxEventSizeExceededError");
     var EventSourceStream = class extends Transform {
       static {
         __name(this, "EventSourceStream");
@@ -16841,6 +16978,8 @@ var require_eventsource_stream = __commonJS({
       pos = 0;
       lineChunkIndex = 0;
       linePos = 0;
+      eventDataSize = 0;
+      maxEventSize;
       event = {
         data: void 0,
         event: void 0,
@@ -16850,6 +16989,7 @@ var require_eventsource_stream = __commonJS({
       /**
        * @param {object} options
        * @param {boolean} [options.readableObjectMode]
+       * @param {number} [options.maxEventSize]
        * @param {eventSourceSettings} [options.eventSourceSettings]
        * @param {(chunk: any, encoding?: BufferEncoding | undefined) => boolean} [options.push]
        */
@@ -16857,6 +16997,7 @@ var require_eventsource_stream = __commonJS({
         options.readableObjectMode = true;
         super(options);
         this.state = options.eventSourceSettings || {};
+        this.maxEventSize = options.maxEventSize ?? defaultMaxEventSize;
         if (options.push) {
           this.push = options.push;
         }
@@ -16908,7 +17049,12 @@ var require_eventsource_stream = __commonJS({
             if (byte === CR) {
               this.crlfCheck = true;
             }
-            this.parseLine(this.readLine(), this.event);
+            try {
+              this.parseLine(this.readLine(), this.event);
+            } catch (error) {
+              callback(error);
+              return;
+            }
             this.consumeCurrentByte();
             this.eventEndCheck = true;
             continue;
@@ -16939,6 +17085,11 @@ var require_eventsource_stream = __commonJS({
           }
         }
         if (isFieldName(line, fieldLength, DATA)) {
+          const valueBytes = line.length - valueStart;
+          const eventDataSize = this.eventDataSize + (event.data === void 0 ? 0 : 1) + valueBytes;
+          if (this.maxEventSize > 0 && eventDataSize > this.maxEventSize) {
+            throw createMaxEventSizeExceededError();
+          }
           const value = line.toString("utf8", valueStart);
           if (event.data === void 0) {
             event.data = value;
@@ -16946,6 +17097,7 @@ var require_eventsource_stream = __commonJS({
             event.data += `
 ${value}`;
           }
+          this.eventDataSize = eventDataSize;
           return;
         }
         if (isFieldName(line, fieldLength, RETRY)) {
@@ -16993,6 +17145,7 @@ ${value}`;
         this.event.event = void 0;
         this.event.id = void 0;
         this.event.retry = void 0;
+        this.eventDataSize = 0;
       }
       hasPendingEvent() {
         return this.event.data !== void 0 || this.event.event !== void 0 || this.event.id !== void 0 || this.event.retry !== void 0;
@@ -17122,9 +17275,12 @@ var require_eventsource = __commonJS({
     var { parseMIMEType } = require_data_url();
     var { createFastMessageEvent: createFastMessageEvent2 } = require_events();
     var { isNetworkError } = require_response();
-    var { kEnumerableProperty } = require_util();
+    var { isValidHeaderValue, kEnumerableProperty } = require_util();
     var { environmentSettingsObject } = require_util2();
     var { createPotentialCORSRequest } = require_util4();
+    var { getGlobalDispatcher: getGlobalDispatcher2 } = require_global2();
+    var { isomorphicDecode } = require_infra();
+    var textEncoder = new TextEncoder();
     var experimentalWarned = false;
     var defaultReconnectionTime = 3e3;
     var CONNECTING = 0;
@@ -17261,6 +17417,7 @@ var require_eventsource = __commonJS({
           this.#state.origin = response.urlList[response.urlList.length - 1].origin;
           const eventSourceStream = new EventSourceStream({
             eventSourceSettings: this.#state,
+            maxEventSize: this.#dispatcher.eventSourceOptions?.maxEventSize,
             push: /* @__PURE__ */ __name((event) => {
               this.dispatchEvent(createFastMessageEvent2(
                 event.type,
@@ -17291,8 +17448,12 @@ var require_eventsource = __commonJS({
         this.dispatchEvent(new Event("error"));
         setTimeout(() => {
           if (this.#readyState !== CONNECTING) return;
+          this.#request.headersList.delete("last-event-id", true);
           if (this.#state.lastEventId.length) {
-            this.#request.headersList.set("last-event-id", this.#state.lastEventId, true);
+            const lastEventId = isomorphicDecode(textEncoder.encode(this.#state.lastEventId));
+            if (isValidHeaderValue(lastEventId)) {
+              this.#request.headersList.set("last-event-id", lastEventId, true);
+            }
           }
           this.#connect();
         }, this.#state.reconnectionTime)?.unref();
@@ -17397,7 +17558,8 @@ var require_eventsource = __commonJS({
       {
         key: "dispatcher",
         // undici only
-        converter: webidl.converters.any
+        converter: webidl.converters.any,
+        defaultValue: /* @__PURE__ */ __name(() => getGlobalDispatcher2(), "defaultValue")
       },
       {
         key: "node",
diff --git a/deps/uv/unofficial.gni b/deps/uv/unofficial.gni
index 0944d6ddd241..a2891887839b 100644
--- a/deps/uv/unofficial.gni
+++ b/deps/uv/unofficial.gni
@@ -4,113 +4,126 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
-template("uv_gn_build") {
-  config("uv_external_config") {
-    include_dirs = [ "include" ]
-    if (is_clang || !is_win) {
-      cflags_cc = [
-        "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
-      ]
-    }
-  }
-
-  config("uv_internal_config") {
-    include_dirs = [
-      "include",
-      "src",
-    ]
+import("../../node.gni")
 
-    defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
-    if (is_posix) {
-      defines += [
-        "_LARGEFILE_SOURCE",
-        "_FILE_OFFSET_BITS=64",
-      ]
+template("uv_gn_build") {
+  if (node_shared_libuv) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("uv_external_config") {
+      packages = [ "libuv" ]
     }
-    if (is_linux) {
-      defines += [
-        "_POSIX_C_SOURCE=200112",
-        "_GNU_SOURCE",
-      ]
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":uv_external_config" ]
     }
-    if (is_apple) {
-      defines += [
-        "_DARWIN_USE_64_BIT_INODE=1",
-        "_DARWIN_UNLIMITED_SELECT=1",
-      ]
+  } else {
+    config("uv_external_config") {
+      include_dirs = [ "include" ]
+      if (is_clang || !is_win) {
+        cflags_cc = [
+          "-Wno-deprecated-pragma",  # for using ENODATA in errno.h
+        ]
+      }
     }
-    if (is_clang || !is_win) {
-      cflags_c = [
-        "-Wno-deprecated-declarations",
-        "-Wno-extra-semi",
-        "-Wno-implicit-fallthrough",
-        "-Wno-missing-braces",
-        "-Wno-sign-compare",
-        "-Wno-string-conversion",
-        "-Wno-shadow",
-        "-Wno-unreachable-code",
-        "-Wno-unreachable-code-return",
-        "-Wno-unused-but-set-parameter",
-        "-Wno-unused-but-set-variable",
-        "-Wno-unused-function",
-        "-Wno-unused-result",
-        "-Wno-unused-variable",
+
+    config("uv_internal_config") {
+      include_dirs = [
+        "include",
+        "src",
       ]
+
+      defines = [ "BUILDING_UV_SHARED" ]  # always export symbols
+      if (is_posix) {
+        defines += [
+          "_LARGEFILE_SOURCE",
+          "_FILE_OFFSET_BITS=64",
+        ]
+      }
+      if (is_linux) {
+        defines += [
+          "_POSIX_C_SOURCE=200112",
+          "_GNU_SOURCE",
+        ]
+      }
+      if (is_apple) {
+        defines += [
+          "_DARWIN_USE_64_BIT_INODE=1",
+          "_DARWIN_UNLIMITED_SELECT=1",
+        ]
+      }
+      if (is_clang || !is_win) {
+        cflags_c = [
+          "-Wno-deprecated-declarations",
+          "-Wno-extra-semi",
+          "-Wno-implicit-fallthrough",
+          "-Wno-missing-braces",
+          "-Wno-sign-compare",
+          "-Wno-string-conversion",
+          "-Wno-shadow",
+          "-Wno-unreachable-code",
+          "-Wno-unreachable-code-return",
+          "-Wno-unused-but-set-parameter",
+          "-Wno-unused-but-set-variable",
+          "-Wno-unused-function",
+          "-Wno-unused-result",
+          "-Wno-unused-variable",
+        ]
+      }
     }
-  }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("uv.gyp") ],
-                            "scope",
-                            [ "uv.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("uv.gyp") ],
+                              "scope",
+                              [ "uv.gyp" ])
 
-  component(target_name) {
-    forward_variables_from(invoker, "*")
+    component(target_name) {
+      forward_variables_from(invoker, "*")
 
-    configs += [ ":uv_internal_config" ]
-    public_configs = [ ":uv_external_config" ]
+      configs += [ ":uv_internal_config" ]
+      public_configs = [ ":uv_external_config" ]
 
-    if (is_posix) {
-      configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
-      configs += [ "//build/config/gcc:symbol_visibility_default" ]
-    }
+      if (is_posix) {
+        configs -= [ "//build/config/gcc:symbol_visibility_hidden" ]
+        configs += [ "//build/config/gcc:symbol_visibility_default" ]
+      }
 
-    if (is_win) {
-      libs = [
-        "advapi32.lib",
-        "iphlpapi.lib",
-        "psapi.lib",
-        "shell32.lib",
-        "user32.lib",
-        "userenv.lib",
-        "ws2_32.lib",
-      ]
-    }
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
-    }
-    if (is_linux) {
-      libs = [
-        "m",
-        "dl",
-        "rt",
-      ]
-    }
+      if (is_win) {
+        libs = [
+          "advapi32.lib",
+          "iphlpapi.lib",
+          "psapi.lib",
+          "shell32.lib",
+          "user32.lib",
+          "userenv.lib",
+          "ws2_32.lib",
+        ]
+      }
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
+      if (is_linux) {
+        libs = [
+          "m",
+          "dl",
+          "rt",
+        ]
+      }
 
-    sources = gypi_values.uv_sources_common
-    if (is_win) {
-      sources += gypi_values.uv_sources_win
-    }
-    if (is_posix) {
-      sources += gypi_values.uv_sources_posix +
-                 [ "src/unix/proctitle.c" ]
-    }
-    if (is_linux) {
-      sources += gypi_values.uv_sources_linux
-    }
-    if (is_apple) {
-      sources += gypi_values.uv_sources_apple +
-                 gypi_values.uv_sources_bsd_common
+      sources = gypi_values.uv_sources_common
+      if (is_win) {
+        sources += gypi_values.uv_sources_win
+      }
+      if (is_posix) {
+        sources += gypi_values.uv_sources_posix +
+                   [ "src/unix/proctitle.c" ]
+      }
+      if (is_linux) {
+        sources += gypi_values.uv_sources_linux
+      }
+      if (is_apple) {
+        sources += gypi_values.uv_sources_apple +
+                   gypi_values.uv_sources_bsd_common
+      }
     }
   }
 }
diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
index fbd628370c0b..48da5b35b872 100644
--- a/deps/v8/src/api/api.cc
+++ b/deps/v8/src/api/api.cc
@@ -3741,14 +3741,6 @@ bool Value::IsTypedArray() const {
 TYPED_ARRAYS_BASE(VALUE_IS_TYPED_ARRAY)
 #undef VALUE_IS_TYPED_ARRAY
 
-bool Value::IsFloat16Array() const {
-  auto obj = *Utils::OpenDirectHandle(this);
-  return i::IsJSTypedArray(obj) &&
-         i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array &&
-         Utils::ApiCheck(i::v8_flags.js_float16array, "Value::IsFloat16Array",
-                         "Float16Array is not supported");
-}
-
 bool Value::IsDataView() const {
   auto obj = *Utils::OpenDirectHandle(this);
   return IsJSDataView(obj) || IsJSRabGsabDataView(obj);
@@ -4292,16 +4284,6 @@ void v8::TypedArray::CheckCast(Value* that) {
 TYPED_ARRAYS_BASE(CHECK_TYPED_ARRAY_CAST)
 #undef CHECK_TYPED_ARRAY_CAST
 
-void v8::Float16Array::CheckCast(Value* that) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::Cast",
-                  "Float16Array is not supported");
-  auto obj = *Utils::OpenDirectHandle(that);
-  Utils::ApiCheck(
-      i::IsJSTypedArray(obj) &&
-          i::Cast<i::JSTypedArray>(obj)->type() == i::kExternalFloat16Array,
-      "v8::Float16Array::Cast()", "Value is not a Float16Array");
-}
-
 void v8::DataView::CheckCast(Value* that) {
   auto obj = *Utils::OpenDirectHandle(that);
   Utils::ApiCheck(i::IsJSDataView(obj) || IsJSRabGsabDataView(obj),
@@ -9347,44 +9329,6 @@ static_assert(v8::TypedArray::kMaxByteLength == i::JSTypedArray::kMaxByteLength,
 TYPED_ARRAYS_BASE(TYPED_ARRAY_NEW)
 #undef TYPED_ARRAY_NEW
 
-Local<Float16Array> Float16Array::New(Local<ArrayBuffer> array_buffer,
-                                      size_t byte_offset, size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<ArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-Local<Float16Array> Float16Array::New(
-    Local<SharedArrayBuffer> shared_array_buffer, size_t byte_offset,
-    size_t length) {
-  Utils::ApiCheck(i::v8_flags.js_float16array, "v8::Float16Array::New",
-                  "Float16Array is not supported");
-  i::Isolate* i_isolate = i::Isolate::Current();
-  ApiRuntimeCallStatsScope rcs_scope(i_isolate, RCCId::kAPI_Float16Array_New);
-  EnterV8NoScriptNoExceptionScope api_scope(i_isolate);
-  if (!Utils::ApiCheck(
-          length <= kMaxLength,
-          "v8::Float16Array::New(Local<SharedArrayBuffer>, size_t, size_t)",
-          "length exceeds max allowed value")) {
-    return {};
-  }
-  auto buffer = Utils::OpenDirectHandle(*shared_array_buffer);
-  i::DirectHandle<i::JSTypedArray> obj = i_isolate->factory()->NewJSTypedArray(
-      i::kExternalFloat16Array, buffer, byte_offset, length);
-  return Utils::ToLocalFloat16Array(obj);
-}
-
 // TODO(v8:11111): Support creating length tracking DataViews via the API.
 Local<DataView> DataView::New(Local<ArrayBuffer> array_buffer,
                               size_t byte_offset, size_t byte_length) {
diff --git a/deps/v8/src/builtins/builtins.cc b/deps/v8/src/builtins/builtins.cc
index 34424db08dc0..0b6e43dde6ea 100644
--- a/deps/v8/src/builtins/builtins.cc
+++ b/deps/v8/src/builtins/builtins.cc
@@ -863,12 +863,6 @@ Builtins::JSBuiltinStateFlags Builtins::GetJSBuiltinState(Builtin builtin) {
       RETURN_FLAG_DEPENDENT_BUILTIN_STATE(
           v8_flags.js_explicit_resource_management);
 
-    // --js-float16array
-    case Builtin::kMathF16round:
-    case Builtin::kDataViewPrototypeGetFloat16:
-    case Builtin::kDataViewPrototypeSetFloat16:
-      RETURN_FLAG_DEPENDENT_BUILTIN_STATE(v8_flags.js_float16array);
-
     // --js-base-64
     case Builtin::kUint8ArrayFromBase64:
     case Builtin::kUint8ArrayFromHex:
diff --git a/deps/v8/src/deoptimizer/translated-state.cc b/deps/v8/src/deoptimizer/translated-state.cc
index a8c87dbd0242..6aa94999ac28 100644
--- a/deps/v8/src/deoptimizer/translated-state.cc
+++ b/deps/v8/src/deoptimizer/translated-state.cc
@@ -1889,6 +1889,31 @@ Address TranslatedState::DecompressIfNeeded(intptr_t value) {
   }
 }
 
+// static
+std::optional<Tagged<Object>> TranslatedState::TryResolveTaggedValue(
+    DeoptTranslationIterator* it, Address fp,
+    Tagged<DeoptimizationLiteralArray> literals) {
+  TranslationOpcode opcode = it->NextOpcode();
+  switch (opcode) {
+    case TranslationOpcode::LITERAL: {
+      int literal_index = it->NextOperand();
+      return literals->get(literal_index);
+    }
+    case TranslationOpcode::TAGGED_STACK_SLOT: {
+      int slot_offset =
+          OptimizedJSFrame::StackSlotOffsetRelativeToFp(it->NextOperand());
+      intptr_t value = *reinterpret_cast<intptr_t*>(fp + slot_offset);
+      return Tagged<Object>(DecompressIfNeeded(value));
+    }
+    default:
+      // Any other encoding (unboxed numerics, register-resident values,
+      // captured objects, etc.) requires the full TranslatedState path to
+      // materialize. Caller should fall back.
+      it->SkipOperands(TranslationOpcodeOperandCount(opcode));
+      return std::nullopt;
+  }
+}
+
 TranslatedState::TranslatedState(const JavaScriptFrame* frame)
     : purpose_(kFrameInspection) {
   int deopt_index = SafepointEntry::kNoDeoptIndex;
diff --git a/deps/v8/src/deoptimizer/translated-state.h b/deps/v8/src/deoptimizer/translated-state.h
index dfa5f11e8209..07daaf4be395 100644
--- a/deps/v8/src/deoptimizer/translated-state.h
+++ b/deps/v8/src/deoptimizer/translated-state.h
@@ -511,6 +511,17 @@ class TranslatedState {
   void VerifyMaterializedObjects();
   bool DoUpdateFeedback(DeoptimizeReason reason);
 
+  // Resolves one deopt translation value opcode to a raw Tagged<Object>,
+  // reading from the live frame if needed.  Only LITERAL and
+  // TAGGED_STACK_SLOT can be resolved cheaply; for any other opcode the
+  // iterator is left positioned just past the opcode and std::nullopt is
+  // returned so the caller can fall back to the full materialization path.
+  static std::optional<Tagged<Object>> TryResolveTaggedValue(
+      DeoptTranslationIterator* it, Address fp,
+      Tagged<DeoptimizationLiteralArray> literals);
+
+  static Address DecompressIfNeeded(intptr_t value);
+
  private:
   friend TranslatedValue;
 
@@ -529,7 +540,6 @@ class TranslatedState {
       int frame_index, DeoptTranslationIterator* iterator,
       const DeoptimizationLiteralProvider& literal_array, Address fp,
       RegisterValues* registers, FILE* trace_file);
-  Address DecompressIfNeeded(intptr_t value);
   void CreateArgumentsElementsTranslatedValues(int frame_index,
                                                Address input_frame_pointer,
                                                CreateArgumentsType type,
diff --git a/deps/v8/src/execution/frames.cc b/deps/v8/src/execution/frames.cc
index 110abb96f250..f587dd49e36d 100644
--- a/deps/v8/src/execution/frames.cc
+++ b/deps/v8/src/execution/frames.cc
@@ -3179,7 +3179,118 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
         "Missing deoptimization information for OptimizedJSFrame::Summarize.");
   }
 
-  // Prepare iteration over translation. We must not materialize values here
+  // Lightweight walk: iterate frame headers only, resolving just the
+  // function and receiver from the live frame via ResolveTaggedValue.
+  // This avoids the expensive TranslatedState::Init + Prepare path that
+  // would parse every value in every inlined frame.
+
+  Tagged<DeoptimizationLiteralArray> literal_array = data->LiteralArray();
+
+  // Lightweight walk: resolve function and receiver from live frame headers
+  // and build JavaScriptFrameSummary objects directly.
+  bool needs_full_walk = false;
+  {
+    DisallowGarbageCollection no_gc;
+    DeoptimizationFrameTranslation::Iterator it(
+        data->FrameTranslation(), data->TranslationIndex(deopt_index).value());
+    bool is_constructor = IsConstructor();
+    int remaining = it.EnterBeginOpcode().total_frame_count;
+
+    while (remaining > 0) {
+      TranslationOpcode opcode = it.SeekNextFrame();
+      remaining--;
+
+      if (opcode == TranslationOpcode::CONSTRUCT_CREATE_STUB_FRAME ||
+          opcode == TranslationOpcode::CONSTRUCT_INVOKE_STUB_FRAME) {
+        is_constructor = true;
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      if (!IsTranslationJsFrameOpcode(opcode)) {
+#if V8_ENABLE_WEBASSEMBLY
+        // Wasm-inlined-into-JS frames need the full TranslatedState
+        // machinery to produce WasmFrameSummary entries.
+        if (opcode == TranslationOpcode::WASM_INLINED_INTO_JS_FRAME) {
+          needs_full_walk = true;
+          break;
+        }
+#endif
+        it.SkipOperands(TranslationOpcodeOperandCount(opcode));
+        continue;
+      }
+
+      bool is_builtin_cont =
+          (opcode == TranslationOpcode::JAVASCRIPT_BUILTIN_CONTINUATION_FRAME ||
+           opcode == TranslationOpcode::
+                         JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH_FRAME);
+
+      int bytecode_offset = it.NextOperand();
+      int sfi_id = it.NextOperand();
+      Tagged<SharedFunctionInfo> sfi =
+          Cast<SharedFunctionInfo>(literal_array->get(sfi_id));
+
+      // Skip remaining header operands to reach the values.
+      it.SkipOperands(TranslationOpcodeOperandCount(opcode) - 2);
+
+      // Resolve closure and receiver from the live frame.  The closure is
+      // always tagged (LITERAL or TAGGED_STACK_SLOT), but the receiver is
+      // just parameter 0 of the (possibly inlined) frame and may be encoded
+      // in any representation the optimizer chose (e.g. DOUBLE_STACK_SLOT
+      // for an unboxed Float64). Fall back to the full materialization path
+      // in that case.
+      std::optional<Tagged<Object>> function_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      DCHECK(function_obj.has_value());
+      DCHECK(IsJSFunction(*function_obj));
+      std::optional<Tagged<Object>> receiver_obj =
+          TranslatedState::TryResolveTaggedValue(&it, fp(), literal_array);
+      if (!receiver_obj.has_value()) {
+        needs_full_walk = true;
+        break;
+      }
+
+      Tagged<AbstractCode> abstract_code;
+      int code_offset;
+      if (is_builtin_cont) {
+        code_offset = 0;
+        abstract_code = Cast<AbstractCode>(
+            isolate()->builtins()->code(Builtins::GetBuiltinFromBytecodeOffset(
+                BytecodeOffset(bytecode_offset))));
+      } else {
+        code_offset = bytecode_offset;
+        abstract_code = Cast<AbstractCode>(sfi->GetBytecodeArray(isolate()));
+      }
+
+      DirectHandle<FixedArray> params = GetParameters(never_allocate);
+      FrameSummary::JavaScriptFrameSummary summary(
+          isolate(), *receiver_obj, Cast<JSFunction>(*function_obj),
+          abstract_code, code_offset, is_constructor, *params);
+      summaries.frames.push_back(summary);
+      is_constructor = false;
+    }
+
+    if (!needs_full_walk && is_constructor) {
+      summaries.top_frame_is_construct_call = true;
+    }
+  }  // no_gc scope ends.
+
+  if (needs_full_walk) {
+    return SummarizeFull(data, deopt_index, never_allocate);
+  }
+
+  return summaries;
+}
+
+FrameSummaries OptimizedJSFrame::SummarizeFull(Tagged<DeoptimizationData> data,
+                                               int deopt_index,
+                                               bool never_allocate) const {
+  FrameSummaries summaries;
+
+  DCHECK_NE(deopt_index, SafepointEntry::kNoDeoptIndex);
+  DCHECK(!data.is_null());
+
+  // Prepare iteration over translation.  We must not materialize values here
   // because we do not deoptimize the function.
   TranslatedState translated(this);
   translated.Prepare(fp());
@@ -3204,7 +3315,21 @@ FrameSummaries OptimizedJSFrame::Summarize(bool never_allocate) const {
       // Get the correct receiver in the optimized frame.
       static_assert(TranslatedFrame::kReceiverIsFirstParameterInJSFrames);
       CHECK(!translated_values->IsMaterializedObject());
-      DirectHandle<Object> receiver = translated_values->GetValue();
+      // Check GetRawValue() against arguments_marker() first to see whether
+      // calling GetValue() allocates.
+      Tagged<Object> receiver_obj = translated_values->GetRawValue();
+      DirectHandle<Object> receiver;
+      if (receiver_obj == ReadOnlyRoots(isolate()).arguments_marker() &&
+          never_allocate) {
+        // Calling GetValue() would definitely trigger allocation but with
+        // `never_allocate` allocations are not allowed. Simply pick `undefined`
+        // as receiver instead even though it is off. `never_allocate` is
+        // currently only used for OOM stacks, where we don't even emit the
+        // receiver but want to see as many stack frames as possible.
+        receiver = isolate()->factory()->undefined_value();
+      } else {
+        receiver = translated_values->GetValue();
+      }
       translated_values++;
 
       // Determine the underlying code object and the position within it from
@@ -3311,24 +3436,20 @@ int TurbofanJSFrame::FindReturnPCForTrampoline(Tagged<Code> code,
   return safepoints.find_return_pc(trampoline_pc);
 }
 
-Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
-    Tagged<Code> code, int* deopt_index) const {
-  DCHECK(is_optimized());
-
-  Address pc = maybe_unauthenticated_pc();
-
-  DCHECK(code->contains(isolate(), pc));
+// static
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationDataForPC(
+    Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index) {
+  DCHECK(code->contains(isolate, pc));
   DCHECK(CodeKindCanDeoptimize(code->kind()));
-
   if (code->is_maglevved()) {
     MaglevSafepointEntry safepoint_entry =
-        code->GetMaglevSafepointEntry(isolate(), pc);
+        code->GetMaglevSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
     }
   } else {
-    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate(), pc);
+    SafepointEntry safepoint_entry = code->GetSafepointEntry(isolate, pc);
     if (safepoint_entry.has_deoptimization_index()) {
       *deopt_index = safepoint_entry.deoptimization_index();
       return code->deoptimization_data();
@@ -3338,6 +3459,14 @@ Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
   return {};
 }
 
+Tagged<DeoptimizationData> OptimizedJSFrame::GetDeoptimizationData(
+    Tagged<Code> code, int* deopt_index) const {
+  DCHECK(is_optimized());
+  Address pc = maybe_unauthenticated_pc();
+  DCHECK(code->contains(isolate(), pc));
+  return GetDeoptimizationDataForPC(isolate(), code, pc, deopt_index);
+}
+
 void OptimizedJSFrame::GetFunctions(
     std::vector<Tagged<SharedFunctionInfo>>* functions) const {
   DCHECK(functions->empty());
diff --git a/deps/v8/src/execution/frames.h b/deps/v8/src/execution/frames.h
index 017613a7305a..550fdde93671 100644
--- a/deps/v8/src/execution/frames.h
+++ b/deps/v8/src/execution/frames.h
@@ -1169,6 +1169,11 @@ class OptimizedJSFrame : public JavaScriptFrame {
   Tagged<DeoptimizationData> GetDeoptimizationData(Tagged<Code> code,
                                                    int* deopt_index) const;
 
+  // Like GetDeoptimizationData, but takes an explicit PC instead of reading
+  // it from the frame.  Can be used without a live frame.
+  static Tagged<DeoptimizationData> GetDeoptimizationDataForPC(
+      Isolate* isolate, Tagged<Code> code, Address pc, int* deopt_index);
+
   static int StackSlotOffsetRelativeToFp(int slot_index);
 
   // Lookup exception handler for current {pc}, returns -1 if none found.
@@ -1178,6 +1183,13 @@ class OptimizedJSFrame : public JavaScriptFrame {
   virtual int FindReturnPCForTrampoline(Tagged<Code> code,
                                         int trampoline_pc) const = 0;
 
+ private:
+  // Full TranslatedState-based walk, used as fallback when the lightweight
+  // path in Summarize() encounters frames it cannot handle (e.g.
+  // wasm-inlined-into-JS frames).
+  FrameSummaries SummarizeFull(Tagged<DeoptimizationData> data, int deopt_index,
+                               bool never_allocate) const;
+
  protected:
   inline explicit OptimizedJSFrame(StackFrameIteratorBase* iterator);
 };
diff --git a/deps/v8/src/execution/isolate.cc b/deps/v8/src/execution/isolate.cc
index 06fa14bf6b10..74762de5a9aa 100644
--- a/deps/v8/src/execution/isolate.cc
+++ b/deps/v8/src/execution/isolate.cc
@@ -878,18 +878,21 @@ class CallSiteBuilder {
     // framework and library code, and stack depth tends to be more than
     // a dozen frames, so we over-allocate a bit here to avoid growing
     // the elements array in the common case.
-    elements_ = isolate->factory()->NewFixedArray(std::min(64, limit));
+    elements_ = isolate->factory()->NewFixedArray(CallSiteInfo::Fields::kCount *
+                                                  std::min(64, limit));
   }
 
   void SetPrevFrameAsConstructCall() {
     if (skipped_prev_frame_) return;
     DCHECK_GT(index_, 0);
-    Tagged<CallSiteInfo> info =
-        Tagged<CallSiteInfo>::cast(elements_->get(index_ - 1));
+    int base_index = (index_ - 1) * CallSiteInfo::Fields::kCount;
+    int flags =
+        Smi::ToInt(elements_->get(base_index + CallSiteInfo::Fields::kFlags));
 #if V8_ENABLE_WEBASSEMBLY
-    if (info->IsWasm()) return;
+    if (flags & CallSiteInfo::kIsWasm) return;
 #endif
-    info->set_flags(info->flags() | CallSiteInfo::kIsConstructor);
+    elements_->set(base_index + CallSiteInfo::Fields::kFlags,
+                   Smi::FromInt(flags | CallSiteInfo::kIsConstructor));
   }
 
   bool Visit(FrameSummary const& summary) {
@@ -1051,7 +1054,8 @@ class CallSiteBuilder {
   bool Full() { return index_ >= limit_; }
 
   Handle<FixedArray> Build() {
-    return FixedArray::RightTrimOrEmpty(isolate_, elements_, index_);
+    return FixedArray::RightTrimOrEmpty(isolate_, elements_,
+                                        CallSiteInfo::Fields::kCount * index_);
   }
 
  private:
@@ -1114,19 +1118,70 @@ class CallSiteBuilder {
     return true;
   }
 
+ public:
+  // Store a deferred entry for a baseline frame.
+  // Stores the Code + raw PC offset; bytecode offset resolution
+  // happens lazily in ExpandDeferredFrames().
+  bool AppendDeferredFrame(JavaScriptFrame* frame, int deferred_flag) {
+    if (Full()) return false;
+    DirectHandle<JSFunction> function(frame->function(), isolate_);
+    if (!IsVisibleInStackTrace(function)) {
+      skipped_prev_frame_ = true;
+      return true;
+    }
+    int flags = deferred_flag;
+    if (IsStrictFrame(function)) flags |= CallSiteInfo::kIsStrict;
+    if (frame->IsConstructor()) flags |= CallSiteInfo::kIsConstructor;
+
+    Tagged<Code> code = frame->LookupCode();
+    int pc_offset = static_cast<int>(frame->pc() - code->instruction_start());
+
+    AppendFrame(Cast<UnionOf<JSAny, Hole>>(handle(frame->receiver(), isolate_)),
+                function, handle(code, isolate_), pc_offset, flags,
+                frame->GetParameters(/*never_allocate=*/false));
+    return true;
+  }
+
   void AppendFrame(DirectHandle<UnionOf<JSAny, Hole>> receiver_or_instance,
                    DirectHandle<UnionOf<Smi, JSFunction>> function,
-                   DirectHandle<HeapObject> code, int offset, int flags,
+                   DirectHandle<HeapObject> code_obj, int offset, int flags,
                    DirectHandle<FixedArray> parameters) {
     if (IsTheHole(*receiver_or_instance, isolate_)) {
       // TODO(jgruber): Fix all cases in which frames give us a hole value
       // (e.g. the receiver in RegExp constructor frames).
       receiver_or_instance = isolate_->factory()->undefined_value();
     }
-    auto info = isolate_->factory()->NewCallSiteInfo(
-        Cast<JSAny>(receiver_or_instance), function, code, offset, flags,
-        parameters);
-    elements_ = FixedArray::SetAndGrow(isolate_, elements_, index_++, info);
+
+    int base_index = index_ * CallSiteInfo::Fields::kCount;
+
+    // Set the last field first and grow the array if needed.
+    static_assert(CallSiteInfo::Fields::kFlags ==
+                  CallSiteInfo::Fields::kCount - 1);
+    elements_ = FixedArray::SetAndGrow(
+        isolate_, elements_, base_index + CallSiteInfo::Fields::kFlags,
+        Smi::FromInt(flags));
+
+    elements_->set(base_index + CallSiteInfo::Fields::kReceiver,
+                   *receiver_or_instance);
+    elements_->set(base_index + CallSiteInfo::Fields::kFunction, *function);
+
+    if (DirectHandle<Code> code; TryCast(code_obj, &code)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode, code->wrapper());
+    } else if (DirectHandle<BytecodeArray> bytecode;
+               TryCast(code_obj, &bytecode)) {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     bytecode->wrapper());
+    } else {
+      elements_->set(base_index + CallSiteInfo::Fields::kCode,
+                     *isolate_->factory()->undefined_value());
+    }
+
+    elements_->set(base_index + CallSiteInfo::Fields::kOffset,
+                   Smi::FromInt(offset));
+    elements_->set(base_index + CallSiteInfo::Fields::kParameters,
+                   *parameters);
+
+    index_++;
     skipped_prev_frame_ = false;
   }
 
@@ -1357,18 +1412,16 @@ void CaptureAsyncStackTrace(Isolate* isolate, CallSiteBuilder* builder) {
   }
 }
 
+// Summarize a single frame and pass each logical frame to the visitor.
 template <typename Visitor>
 void VisitStack(Isolate* isolate, Visitor* visitor,
                 StackTrace::StackTraceOptions options = StackTrace::kDetailed,
                 bool never_allocate = false) {
   DisallowJavascriptExecution no_js(isolate);
-  // Keep track if we visited a stack frame, but did not visit any summarized
-  // frames. Either because the stack frame didn't create any summarized frames
-  // or due to security origin.
-  bool skipped_last_frame = true;
   for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
     StackFrame* frame = it.frame();
     switch (frame->type()) {
+      case StackFrame::BASELINE:
       case StackFrame::API_CALLBACK_EXIT:
       case StackFrame::API_CONSTRUCT_EXIT:
       case StackFrame::BUILTIN_EXIT:
@@ -1377,7 +1430,6 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
       case StackFrame::TURBOFAN_JS:
       case StackFrame::MAGLEV:
       case StackFrame::INTERPRETED:
-      case StackFrame::BASELINE:
       case StackFrame::BUILTIN:
 #if V8_ENABLE_WEBASSEMBLY
       case StackFrame::STUB:
@@ -1392,14 +1444,73 @@ void VisitStack(Isolate* isolate, Visitor* visitor,
         // inlining).
         FrameSummaries summaries =
             CommonFrame::cast(frame)->Summarize(never_allocate);
+        for (auto& summary : base::Reversed(summaries.frames)) {
+          // Skip frames from other origins when asked to do so.
+          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
+              !summary.native_context()->HasSameSecurityTokenAs(
+                  isolate->context())) {
+            continue;
+          }
+          if (!visitor->Visit(summary)) return;
+        }
+        break;
+      }
+
+      default:
+        break;
+    }
+  }
+}
+
+// Specialized stack walk for CallSiteBuilder, handling deferred baseline
+// frames and the construct-call flag on the previous frame.
+void VisitStack_ForCallSiteBuilder(Isolate* isolate, CallSiteBuilder* visitor) {
+  DisallowJavascriptExecution no_js(isolate);
+  // Track whether the last physical frame produced any visited summarized
+  // frames. Used to correctly attribute construct-call flags.
+  bool skipped_last_frame = true;
+  for (StackFrameIterator it(isolate); !it.done(); it.Advance()) {
+    StackFrame* frame = it.frame();
+    switch (frame->type()) {
+      case StackFrame::BASELINE:
+        // Baseline frames are captured as deferred entries so they can be
+        // expanded later without blocking the stack capture path.
+        if (!visitor->AppendDeferredFrame(
+                JavaScriptFrame::cast(frame),
+                CallSiteInfo::kIsDeferredBaselineFrame)) {
+          return;
+        }
+        skipped_last_frame = true;
+        break;
+      case StackFrame::API_CALLBACK_EXIT:
+      case StackFrame::API_CONSTRUCT_EXIT:
+      case StackFrame::BUILTIN_EXIT:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION:
+      case StackFrame::JAVASCRIPT_BUILTIN_CONTINUATION_WITH_CATCH:
+      case StackFrame::TURBOFAN_JS:
+      case StackFrame::MAGLEV:
+      case StackFrame::INTERPRETED:
+      case StackFrame::BUILTIN:
+#if V8_ENABLE_WEBASSEMBLY
+      case StackFrame::STUB:
+      case StackFrame::WASM:
+      case StackFrame::WASM_SEGMENT_START:
+#if V8_ENABLE_DRUMBRAKE
+      case StackFrame::WASM_INTERPRETER_ENTRY:
+#endif  // V8_ENABLE_DRUMBRAKE
+#endif  // V8_ENABLE_WEBASSEMBLY
+      {
+        // A standard frame may include many summarized frames (due to
+        // inlining).
+        FrameSummaries summaries = CommonFrame::cast(frame)->Summarize();
         if (summaries.top_frame_is_construct_call && !skipped_last_frame) {
           visitor->SetPrevFrameAsConstructCall();
         }
         skipped_last_frame = true;
         for (auto& summary : base::Reversed(summaries.frames)) {
-          // Skip frames from other origins when asked to do so.
-          if (!(options & StackTrace::kExposeFramesAcrossSecurityOrigins) &&
-              !summary.native_context()->HasSameSecurityTokenAs(
+          // CaptureSimpleStackTrace uses kDetailed, which does not expose
+          // frames across security origins.
+          if (!summary.native_context()->HasSameSecurityTokenAs(
                   isolate->context())) {
             continue;
           }
@@ -1426,7 +1537,7 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 #endif  // V8_ENABLE_WEBASSEMBLY
 
   CallSiteBuilder builder(isolate, mode, limit, caller);
-  VisitStack(isolate, &builder);
+  VisitStack_ForCallSiteBuilder(isolate, &builder);
 
   // If --async-stack-traces are enabled and the "current microtask" is a
   // PromiseReactionJobTask, we try to enrich the stack trace with async
@@ -1442,13 +1553,21 @@ Handle<FixedArray> CaptureSimpleStackTrace(Isolate* isolate, int limit,
 }
 
 DirectHandle<StackTraceInfo> GetDetailedStackTraceFromCallSiteInfos(
-    Isolate* isolate, DirectHandle<FixedArray> call_site_infos, int limit) {
-  auto frames = isolate->factory()->NewFixedArray(
-      std::min(limit, call_site_infos->length()));
-  int index = 0;
-  for (int i = 0; i < call_site_infos->length() && index < limit; ++i) {
-    DirectHandle<CallSiteInfo> call_site_info(
-        Cast<CallSiteInfo>(call_site_infos->get(i)), isolate);
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos,
+    uint32_t limit) {
+  Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+      isolate, handle(*raw_data_for_call_site_infos, isolate));
+  raw_data_for_call_site_infos = expanded;
+  uint32_t call_site_infos_len =
+      raw_data_for_call_site_infos->length() /
+      CallSiteInfo::Fields::kCount;
+  auto frames =
+      isolate->factory()->NewFixedArray(std::min(limit, call_site_infos_len));
+  uint32_t index = 0;
+  for (uint32_t i = 0; i < call_site_infos_len && index < limit; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(isolate,
+                                           raw_data_for_call_site_infos, i);
     if (call_site_info->IsAsync()) {
       break;
     }
@@ -1519,14 +1638,19 @@ MaybeDirectHandle<JSObject> Isolate::CaptureAndSetErrorStack(
           stack_trace_for_uncaught_exceptions_frame_limit_,
           stack_trace_for_uncaught_exceptions_options_);
     } else {
-      auto call_site_infos =
+      auto raw_data_for_call_site_infos =
           Cast<FixedArray>(call_site_infos_or_formatted_stack);
       stack_trace = GetDetailedStackTraceFromCallSiteInfos(
-          this, call_site_infos,
-          stack_trace_for_uncaught_exceptions_frame_limit_);
-      if (stack_trace_limit < call_site_infos->length()) {
+          this, raw_data_for_call_site_infos,
+          static_cast<uint32_t>(
+              stack_trace_for_uncaught_exceptions_frame_limit_));
+      DCHECK_GE(stack_trace_limit, 0);
+      if (static_cast<int>(stack_trace_limit) *
+              CallSiteInfo::Fields::kCount <
+          raw_data_for_call_site_infos->length()) {
         call_site_infos_or_formatted_stack = FixedArray::RightTrimOrEmpty(
-            this, call_site_infos, stack_trace_limit);
+            this, raw_data_for_call_site_infos,
+            stack_trace_limit * CallSiteInfo::Fields::kCount);
       }
       // Notify the debugger.
       OnStackTraceCaptured(stack_trace);
@@ -1556,17 +1680,29 @@ Handle<FixedArray> Isolate::GetSimpleStackTrace(
   ErrorUtils::StackPropertyLookupResult lookup =
       ErrorUtils::GetErrorStackProperty(this, maybe_error_object);
 
+  Handle<FixedArray> raw_data;
   if (IsFixedArray(*lookup.error_stack)) {
-    return Cast<FixedArray>(lookup.error_stack);
-  }
-  if (!IsErrorStackData(*lookup.error_stack)) {
+    raw_data = Cast<FixedArray>(lookup.error_stack);
+  } else if (IsErrorStackData(*lookup.error_stack)) {
+    auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
+    if (!error_stack_data->HasRawDataForCallSiteInfos()) {
+      return factory()->empty_fixed_array();
+    }
+    raw_data = handle(error_stack_data->raw_data_for_call_site_infos(), this);
+  } else {
     return factory()->empty_fixed_array();
   }
-  auto error_stack_data = Cast<ErrorStackData>(lookup.error_stack);
-  if (!error_stack_data->HasCallSiteInfos()) {
-    return factory()->empty_fixed_array();
+
+  raw_data = CallSiteInfo::ExpandDeferredFrames(this, raw_data);
+
+  int frame_count = raw_data->length() / CallSiteInfo::Fields::kCount;
+  Handle<FixedArray> call_site_infos = factory()->NewFixedArray(frame_count);
+  for (int i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> call_site_info =
+        CallSiteInfo::ConstructFromRawData(this, raw_data, i);
+    call_site_infos->set(i, *call_site_info);
   }
-  return handle(error_stack_data->call_site_infos(), this);
+  return call_site_infos;
 }
 
 Address Isolate::GetAbstractPC(int* line, int* column) {
@@ -1616,10 +1752,6 @@ class StackFrameBuilder {
         index_(0),
         limit_(limit) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Check if we have enough capacity left.
     if (index_ >= limit_) return false;
@@ -1664,10 +1796,6 @@ class CurrentScriptNameStackVisitor {
   explicit CurrentScriptNameStackVisitor(Isolate* isolate)
       : isolate_(isolate) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1696,10 +1824,6 @@ class CurrentScriptNameStackVisitor {
 
 class CurrentScriptIdStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1729,10 +1853,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
     DCHECK_LT(0, frame_data.size());
   }
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (!summary.is_subject_to_debugging()) return true;
 
@@ -1778,10 +1898,6 @@ class CurrentScriptIdsAndContextsStackVisitor {
 
 class CurrentScriptStackVisitor {
  public:
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     // Skip frames that aren't subject to debugging. Keep this in sync with
     // StackFrameBuilder::Visit so both visitors visit the same frames.
@@ -1919,10 +2035,6 @@ class MinimalStackPrinter {
 
   explicit MinimalStackPrinter(size_t max_length) : max_length_(max_length) {}
 
-  void SetPrevFrameAsConstructCall() {
-    // Nothing to do.
-  }
-
   bool Visit(FrameSummary& summary) {
     if (summary.IsJavaScript()) {
       const FrameSummary::JavaScriptFrameSummary& js_summary =
@@ -3164,12 +3276,16 @@ Tagged<Object> Isolate::ThrowIllegalOperation() {
 void Isolate::PrintCurrentStackTrace(
     std::ostream& out,
     PrintCurrentStackTraceFilterCallback should_include_frame_callback) {
-  DirectHandle<FixedArray> frames = CaptureSimpleStackTrace(
+  Handle<FixedArray> frames = CaptureSimpleStackTrace(
       this, FixedArray::kMaxLength, SKIP_NONE, factory()->undefined_value());
+  frames = CallSiteInfo::ExpandDeferredFrames(this, frames);
 
   IncrementalStringBuilder builder(this);
-  for (int i = 0; i < frames->length(); ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)), this);
+  uint32_t frame_count =
+      frames->length() / CallSiteInfo::Fields::kCount;
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame =
+        CallSiteInfo::ConstructFromRawData(this, frames, i);
 
     if (should_include_frame_callback) {
       Tagged<Object> raw_script_name = frame->GetScriptNameOrSourceURL();
@@ -3193,7 +3309,7 @@ void Isolate::PrintCurrentStackTrace(
       SerializeCallSiteInfo(this, frame, &builder);
     }
 
-    if (i != frames->length() - 1) builder.AppendCharacter('\n');
+    if (i != frame_count - 1) builder.AppendCharacter('\n');
   }
 
   DirectHandle<String> stack_trace = builder.Finish().ToHandleChecked();
diff --git a/deps/v8/src/execution/messages.cc b/deps/v8/src/execution/messages.cc
index b24aafc1be43..64800baec261 100644
--- a/deps/v8/src/execution/messages.cc
+++ b/deps/v8/src/execution/messages.cc
@@ -24,6 +24,7 @@
 #include "src/parsing/parse-info.h"
 #include "src/parsing/parsing.h"
 #include "src/roots/roots.h"
+#include "src/sandbox/indirect-pointer-inl.h"
 #include "src/strings/string-builder-inl.h"
 
 namespace v8 {
@@ -202,15 +203,16 @@ namespace {
 
 // Convert the raw frames as written by Isolate::CaptureSimpleStackTrace into
 // a JSArray of JSCallSite objects.
-MaybeDirectHandle<JSArray> GetStackFrames(Isolate* isolate,
-                                          DirectHandle<FixedArray> frames) {
-  int frame_count = frames->length();
+MaybeDirectHandle<JSArray> GetStackFrames(
+    Isolate* isolate, DirectHandle<FixedArray> raw_data_for_call_site_infos) {
+  uint32_t frame_count = raw_data_for_call_site_infos->length() /
+                         CallSiteInfo::Fields::kCount;
   DirectHandle<JSFunction> constructor = isolate->callsite_function();
   DirectHandle<FixedArray> sites =
       isolate->factory()->NewFixedArray(frame_count);
-  for (int i = 0; i < frame_count; ++i) {
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(frames->get(i)),
-                                     isolate);
+  for (uint32_t i = 0; i < frame_count; ++i) {
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
     DirectHandle<JSObject> site;
     ASSIGN_RETURN_ON_EXCEPTION(isolate, site,
                                JSObject::New(constructor, constructor,
@@ -292,7 +294,7 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
     return isolate->factory()->empty_string();
   }
   DCHECK(IsFixedArray(*raw_stack));
-  auto elems = Cast<FixedArray>(raw_stack);
+  auto raw_data_for_call_site_infos = Cast<FixedArray>(raw_stack);
 
   const bool in_recursion = isolate->formatting_stack_trace();
   const bool has_overflowed = i::StackLimitCheck{isolate}.HasOverflowed();
@@ -303,8 +305,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
       PrepareStackTraceScope scope(isolate);
 
       DirectHandle<JSArray> sites;
-      ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                 GetStackFrames(isolate, elems));
+      ASSIGN_RETURN_ON_EXCEPTION(
+          isolate, sites,
+          GetStackFrames(isolate, raw_data_for_call_site_infos));
 
       DirectHandle<Object> result;
       ASSIGN_RETURN_ON_EXCEPTION(
@@ -329,8 +332,9 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
         isolate->CountUsage(v8::Isolate::kErrorPrepareStackTrace);
 
         DirectHandle<JSArray> sites;
-        ASSIGN_RETURN_ON_EXCEPTION(isolate, sites,
-                                   GetStackFrames(isolate, elems));
+        ASSIGN_RETURN_ON_EXCEPTION(
+            isolate, sites,
+            GetStackFrames(isolate, raw_data_for_call_site_infos));
 
         constexpr int argc = 2;
         std::array<DirectHandle<Object>, argc> args;
@@ -359,12 +363,16 @@ MaybeDirectHandle<Object> ErrorUtils::FormatStackTrace(
 
   RETURN_ON_EXCEPTION(isolate, AppendErrorString(isolate, error, &builder));
 
-  for (int i = 0; i < elems->length(); ++i) {
+  int elems_len = raw_data_for_call_site_infos->length() /
+                       CallSiteInfo::Fields::kCount;
+  for (int i = 0; i < elems_len; ++i) {
     builder.AppendCStringLiteral("\n    at ");
 
-    DirectHandle<CallSiteInfo> frame(Cast<CallSiteInfo>(elems->get(i)),
-                                     isolate);
+    DirectHandle<CallSiteInfo> frame = CallSiteInfo::ConstructFromRawData(
+        isolate, raw_data_for_call_site_infos, i);
 
+    // TODO(marja): Avoid CallSiteInfo creation since we serialize it right
+    // away.
     v8::TryCatch try_catch(reinterpret_cast<v8::Isolate*>(isolate));
     SerializeCallSiteInfo(isolate, frame, &builder);
 
@@ -1160,12 +1168,13 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
 
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate,
+        handle(error_stack_data->raw_data_for_call_site_infos(), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(
-            isolate, error_object,
-            direct_handle(error_stack_data->call_site_infos(), isolate)));
+        FormatStackTrace(isolate, error_object, expanded));
     error_stack_data->set_formatted_stack(*formatted_stack);
     return formatted_stack;
   }
@@ -1173,11 +1182,12 @@ MaybeDirectHandle<Object> ErrorUtils::GetFormattedStack(
   if (IsFixedArray(*lookup.error_stack)) {
     DirectHandle<JSObject> error_object =
         lookup.error_stack_symbol_holder.ToHandleChecked();
+    Handle<FixedArray> expanded = CallSiteInfo::ExpandDeferredFrames(
+        isolate, handle(Cast<FixedArray>(*lookup.error_stack), isolate));
     DirectHandle<Object> formatted_stack;
     ASSIGN_RETURN_ON_EXCEPTION(
         isolate, formatted_stack,
-        FormatStackTrace(isolate, error_object,
-                         Cast<FixedArray>(lookup.error_stack)));
+        FormatStackTrace(isolate, error_object, expanded));
     RETURN_ON_EXCEPTION(
         isolate, Object::SetProperty(isolate, error_object,
                                      isolate->factory()->error_stack_symbol(),
diff --git a/deps/v8/src/flags/flag-definitions.h b/deps/v8/src/flags/flag-definitions.h
index aab9435dbb53..15d4341ff84b 100644
--- a/deps/v8/src/flags/flag-definitions.h
+++ b/deps/v8/src/flags/flag-definitions.h
@@ -344,8 +344,6 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
   V(js_error_iserror, "Error.isError")                                       \
   V(js_regexp_escape, "RegExp.escape")                                       \
   V(js_explicit_resource_management, "explicit resource management")         \
-  V(js_float16array,                                                         \
-    "Float16Array, Math.f16round, DataView.getFloat16, DataView.setFloat16") \
   V(js_base_64, "Uint8Array to/from base64 and hex")                         \
   V(js_esm_ns_reexport,                                                      \
     "Support diamond-importing re-expored namespaces "                       \
diff --git a/deps/v8/src/heap/factory.cc b/deps/v8/src/heap/factory.cc
index 32b47dee39ff..2fc11e822292 100644
--- a/deps/v8/src/heap/factory.cc
+++ b/deps/v8/src/heap/factory.cc
@@ -1589,13 +1589,14 @@ DirectHandle<InterceptorInfo> Factory::NewInterceptorInfo(
 }
 
 DirectHandle<ErrorStackData> Factory::NewErrorStackData(
-    DirectHandle<UnionOf<JSAny, FixedArray>> call_site_infos_or_formatted_stack,
+    DirectHandle<UnionOf<JSAny, FixedArray>>
+        raw_data_for_call_site_infos_or_formatted_stack,
     DirectHandle<StackTraceInfo> stack_trace) {
   Tagged<ErrorStackData> error_stack_data = NewStructInternal<ErrorStackData>(
       ERROR_STACK_DATA_TYPE, AllocationType::kYoung);
   DisallowGarbageCollection no_gc;
-  error_stack_data->set_call_site_infos_or_formatted_stack(
-      *call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
+  error_stack_data->set_raw_data_for_call_site_infos_or_formatted_stack(
+      *raw_data_for_call_site_infos_or_formatted_stack, SKIP_WRITE_BARRIER);
   error_stack_data->set_stack_trace(*stack_trace, SKIP_WRITE_BARRIER);
   return direct_handle(error_stack_data, isolate());
 }
diff --git a/deps/v8/src/heap/factory.h b/deps/v8/src/heap/factory.h
index 67abd4458664..bba53c6a5872 100644
--- a/deps/v8/src/heap/factory.h
+++ b/deps/v8/src/heap/factory.h
@@ -472,7 +472,7 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
 
   DirectHandle<ErrorStackData> NewErrorStackData(
       DirectHandle<UnionOf<JSAny, FixedArray>>
-          call_site_infos_or_formatted_stack,
+          raw_data_for_call_site_infos_or_formatted_stack,
       DirectHandle<StackTraceInfo> stack_trace);
 
   Handle<Script> CloneScript(DirectHandle<Script> script,
diff --git a/deps/v8/src/init/bootstrapper.cc b/deps/v8/src/init/bootstrapper.cc
index ba75a3a17df2..dca2648b3a93 100644
--- a/deps/v8/src/init/bootstrapper.cc
+++ b/deps/v8/src/init/bootstrapper.cc
@@ -3483,6 +3483,8 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
     SimpleInstallFunction(isolate_, math, "exp", Builtin::kMathExp, 1, kAdapt);
     SimpleInstallFunction(isolate_, math, "floor", Builtin::kMathFloor, 1,
                           kAdapt);
+    SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
+                          kAdapt);
     SimpleInstallFunction(isolate_, math, "fround", Builtin::kMathFround, 1,
                           kAdapt);
     SimpleInstallFunction(isolate_, math, "hypot", Builtin::kMathHypot, 2,
@@ -4330,6 +4332,10 @@ void Genesis::InitializeGlobal(DirectHandle<JSGlobalObject> global_object,
                           Builtin::kDataViewPrototypeGetUint32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setUint32",
                           Builtin::kDataViewPrototypeSetUint32, 2, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "getFloat16",
+                          Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
+    SimpleInstallFunction(isolate_, prototype, "setFloat16",
+                          Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "getFloat32",
                           Builtin::kDataViewPrototypeGetFloat32, 1, kDontAdapt);
     SimpleInstallFunction(isolate_, prototype, "setFloat32",
@@ -5084,11 +5090,6 @@ DirectHandle<JSFunction> Genesis::InstallTypedArray(
           GetCorrespondingRabGsabElementsKind(elements_kind), 0);
   rab_gsab_initial_map->SetConstructor(*result);
 
-  if (rab_gsab_initial_map_index == Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX &&
-      v8_flags.js_float16array) {
-    LOG(isolate(), MapDetails(*rab_gsab_initial_map));
-  }
-
   native_context()->set(rab_gsab_initial_map_index, *rab_gsab_initial_map,
                         UPDATE_WRITE_BARRIER, kReleaseStore);
   Map::SetPrototype(isolate(), rab_gsab_initial_map, prototype);
@@ -5869,34 +5870,6 @@ void Genesis::InitializeGlobal_js_explicit_resource_management() {
       kAdapt);
 }
 
-void Genesis::InitializeGlobal_js_float16array() {
-  if (!v8_flags.js_float16array) return;
-
-  DirectHandle<JSGlobalObject> global(native_context()->global_object(),
-                                      isolate());
-  DirectHandle<JSObject> math = Cast<JSObject>(
-      JSReceiver::GetProperty(isolate(), global, "Math").ToHandleChecked());
-
-  SimpleInstallFunction(isolate_, math, "f16round", Builtin::kMathF16round, 1,
-                        kAdapt);
-
-  DirectHandle<JSObject> dataview_prototype(
-      Cast<JSObject>(native_context()->data_view_fun()->instance_prototype()),
-      isolate());
-
-  SimpleInstallFunction(isolate_, dataview_prototype, "getFloat16",
-                        Builtin::kDataViewPrototypeGetFloat16, 1, kDontAdapt);
-  SimpleInstallFunction(isolate_, dataview_prototype, "setFloat16",
-                        Builtin::kDataViewPrototypeSetFloat16, 2, kDontAdapt);
-
-  DirectHandle<JSFunction> fun = InstallTypedArray(
-      "Float16Array", FLOAT16_ELEMENTS, FLOAT16_TYPED_ARRAY_CONSTRUCTOR_TYPE,
-      Context::RAB_GSAB_FLOAT16_ARRAY_MAP_INDEX);
-
-  InstallWithIntrinsicDefaultProto(isolate_, fun,
-                                   Context::FLOAT16_ARRAY_FUN_INDEX);
-}
-
 void Genesis::InitializeGlobal_js_regexp_escape() {
   if (!v8_flags.js_regexp_escape) return;
 
diff --git a/deps/v8/src/objects/call-site-info.cc b/deps/v8/src/objects/call-site-info.cc
index f0a390cdf825..fa1a0f15a6b2 100644
--- a/deps/v8/src/objects/call-site-info.cc
+++ b/deps/v8/src/objects/call-site-info.cc
@@ -7,7 +7,9 @@
 #include <optional>
 
 #include "src/base/strings.h"
+#include "src/builtins/builtins.h"
 #include "src/objects/call-site-info-inl.h"
+#include "src/objects/code-inl.h"
 #include "src/objects/shared-function-info.h"
 #include "src/strings/string-builder-inl.h"
 
@@ -17,6 +19,73 @@
 
 namespace v8::internal {
 
+// static
+DirectHandle<CallSiteInfo> CallSiteInfo::ConstructFromRawData(
+    Isolate* isolate, DirectHandle<FixedArray> frames, int index) {
+  int base_index = index * Fields::kCount;
+  DirectHandle<Object> receiver(frames->get(base_index + Fields::kReceiver),
+                                isolate);
+  DirectHandle<Object> function(frames->get(base_index + Fields::kFunction),
+                                isolate);
+  DirectHandle<Object> code_obj(frames->get(base_index + Fields::kCode),
+                                isolate);
+  DirectHandle<Union<Code, BytecodeArray, Undefined>> resolved_code;
+  if (IsCodeWrapper(*code_obj)) {
+    resolved_code = handle(Cast<CodeWrapper>(code_obj)->code(isolate), isolate);
+  } else if (IsBytecodeWrapper(*code_obj)) {
+    resolved_code =
+        handle(Cast<BytecodeWrapper>(code_obj)->bytecode(isolate), isolate);
+  } else if (IsUndefined(*code_obj)) {
+    resolved_code = isolate->factory()->undefined_value();
+  } else {
+    UNREACHABLE();
+  }
+
+  int offset = Smi::ToInt(frames->get(base_index + Fields::kOffset));
+  DirectHandle<FixedArray> parameters(
+      Cast<FixedArray>(frames->get(base_index + Fields::kParameters)), isolate);
+  int flags = Smi::ToInt(frames->get(base_index + Fields::kFlags));
+
+  return isolate->factory()->NewCallSiteInfo(
+      Cast<JSAny>(receiver), Cast<UnionOf<Smi, JSFunction>>(function),
+      resolved_code, offset, flags, parameters);
+}
+
+// static
+Handle<FixedArray> CallSiteInfo::ExpandDeferredFrames(
+    Isolate* isolate, Handle<FixedArray> raw_data) {
+  int entry_count = raw_data->length() / Fields::kCount;
+
+  // Resolve deferred baseline frames in-place (PC offset → bytecode offset).
+  for (int i = 0; i < entry_count; i++) {
+    int base = i * Fields::kCount;
+    int flags = Smi::ToInt(raw_data->get(base + Fields::kFlags));
+
+    if (flags & kIsDeferredBaselineFrame) {
+      // Resolve the bytecode offset from the raw PC offset.
+      Tagged<Object> code_obj = raw_data->get(base + Fields::kCode);
+      CHECK(IsCodeWrapper(code_obj));
+      Tagged<Code> code = Cast<CodeWrapper>(code_obj)->code(isolate);
+      int pc_offset = Smi::ToInt(raw_data->get(base + Fields::kOffset));
+      Tagged<BytecodeArray> bytecode_array =
+          Cast<JSFunction>(raw_data->get(base + Fields::kFunction))
+              ->shared()
+              ->GetBytecodeArray(isolate);
+      int bytecode_offset = code->GetBytecodeOffsetForBaselinePC(
+          code->instruction_start() + pc_offset, bytecode_array);
+
+      raw_data->set(base + Fields::kCode, bytecode_array->wrapper());
+      raw_data->set(base + Fields::kOffset, Smi::FromInt(bytecode_offset));
+
+      // Strip deferred flags.
+      int clean_flags = flags & ~kDeferredFlagsMask;
+      raw_data->set(base + Fields::kFlags, Smi::FromInt(clean_flags));
+    }
+  }
+
+  return raw_data;
+}
+
 bool CallSiteInfo::IsPromiseAll() const {
   if (!IsAsync()) return false;
   Tagged<JSFunction> fun = Cast<JSFunction>(function());
diff --git a/deps/v8/src/objects/call-site-info.h b/deps/v8/src/objects/call-site-info.h
index cb4d8433f141..bea45215aeaa 100644
--- a/deps/v8/src/objects/call-site-info.h
+++ b/deps/v8/src/objects/call-site-info.h
@@ -80,6 +80,33 @@ V8_OBJECT class CallSiteInfo : public StructLayout {
   // Used to signal that the requested field is unknown.
   static constexpr int kUnknown = kNoSourcePosition;
 
+  // For delayed CallSiteInfo creation (storing the raw data for several
+  // CallSiteInfos in a FixedArray).
+  // kFlags must stay last (see CallSiteBuilder::AppendFrame).
+  enum Fields {
+    kCode = 0,
+    kReceiver,
+    kFunction,
+    kOffset,
+    kParameters,
+    kFlags,
+    kCount
+  };
+
+  // Deferred flags: defined in the Torque bitfield, but only meaningful in
+  // raw capture arrays.  Stripped before creating actual CallSiteInfo objects.
+  static constexpr int kDeferredFlagsMask = kIsDeferredBaselineFrame;
+
+  static DirectHandle<CallSiteInfo> ConstructFromRawData(
+      Isolate* isolate, DirectHandle<FixedArray> frames, int index);
+
+  // Expand a raw stack-capture array that may contain deferred entries
+  // (optimized/baseline frames that were not Summarize'd at capture time)
+  // into a fully-resolved raw array where every entry corresponds to one
+  // logical JS frame.  Non-deferred entries are copied as-is.
+  static Handle<FixedArray> ExpandDeferredFrames(Isolate* isolate,
+                                                 Handle<FixedArray> raw_data);
+
   V8_EXPORT_PRIVATE static int GetLineNumber(DirectHandle<CallSiteInfo> info);
   V8_EXPORT_PRIVATE static int GetColumnNumber(DirectHandle<CallSiteInfo> info);
 
diff --git a/deps/v8/src/objects/call-site-info.tq b/deps/v8/src/objects/call-site-info.tq
index f9585b2324a3..3df40cee3b3c 100644
--- a/deps/v8/src/objects/call-site-info.tq
+++ b/deps/v8/src/objects/call-site-info.tq
@@ -14,6 +14,11 @@ bitfield struct CallSiteInfoFlags extends uint31 {
 
   // whether offset_or_source_position contains the source position.
   is_source_position_computed: bool: 1 bit;
+
+  // Only meaningful in raw capture arrays, stripped before creating
+  // CallSiteInfo objects.  Indicates the entry stores a Code + raw PC offset
+  // that needs resolution to a BytecodeArray + bytecode offset.
+  is_deferred_baseline_frame: bool: 1 bit;
 }
 
 @cppObjectLayoutDefinition
diff --git a/deps/v8/src/objects/debug-objects-inl.h b/deps/v8/src/objects/debug-objects-inl.h
index 1b282108b96e..41a4dea1cd8a 100644
--- a/deps/v8/src/objects/debug-objects-inl.h
+++ b/deps/v8/src/objects/debug-objects-inl.h
@@ -84,18 +84,20 @@ TQ_OBJECT_CONSTRUCTORS_IMPL(StackTraceInfo)
 TQ_OBJECT_CONSTRUCTORS_IMPL(ErrorStackData)
 
 bool ErrorStackData::HasFormattedStack() const {
-  return !IsFixedArray(call_site_infos_or_formatted_stack());
+  return !IsFixedArray(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 ACCESSORS_RELAXED_CHECKED2(ErrorStackData, formatted_stack, Tagged<Object>,
-                           kCallSiteInfosOrFormattedStackOffset,
+                           kRawDataForCallSiteInfosOrFormattedStackOffset,
                            HasFormattedStack(), true)
 
-bool ErrorStackData::HasCallSiteInfos() const { return !HasFormattedStack(); }
+bool ErrorStackData::HasRawDataForCallSiteInfos() const {
+  return !HasFormattedStack();
+}
 
-DEF_GETTER(ErrorStackData, call_site_infos, Tagged<FixedArray>) {
-  DCHECK(HasCallSiteInfos());
-  return Cast<FixedArray>(call_site_infos_or_formatted_stack());
+DEF_GETTER(ErrorStackData, raw_data_for_call_site_infos, Tagged<FixedArray>) {
+  DCHECK(HasRawDataForCallSiteInfos());
+  return Cast<FixedArray>(raw_data_for_call_site_infos_or_formatted_stack());
 }
 
 }  // namespace internal
diff --git a/deps/v8/src/objects/debug-objects.h b/deps/v8/src/objects/debug-objects.h
index e4ffa7ecf174..2ae518dcc190 100644
--- a/deps/v8/src/objects/debug-objects.h
+++ b/deps/v8/src/objects/debug-objects.h
@@ -254,8 +254,8 @@ class ErrorStackData
  public:
   inline bool HasFormattedStack() const;
   DECL_ACCESSORS(formatted_stack, Tagged<Object>)
-  inline bool HasCallSiteInfos() const;
-  DECL_GETTER(call_site_infos, Tagged<FixedArray>)
+  inline bool HasRawDataForCallSiteInfos() const;
+  DECL_GETTER(raw_data_for_call_site_infos, Tagged<FixedArray>)
 
   DECL_VERIFIER(ErrorStackData)
 
diff --git a/deps/v8/src/objects/debug-objects.tq b/deps/v8/src/objects/debug-objects.tq
index 630a134971bb..607f2abf4418 100644
--- a/deps/v8/src/objects/debug-objects.tq
+++ b/deps/v8/src/objects/debug-objects.tq
@@ -102,10 +102,10 @@ extern class StackTraceInfo extends Struct {
 // (2) A valid JavaScript object and StackTraceInfo once
 //     error.stack was accessed.
 extern class ErrorStackData extends Struct {
-  // This holds either the FixedArray of CallSiteInfo instances or
-  // the formatted stack value (usually a string) that's returned
-  // from the error.stack property.
-  call_site_infos_or_formatted_stack: FixedArray|JSAny;
+  // This holds either the FixedArray of raw data for constructing the
+  // CallSiteInfo instances or the formatted stack value (usually a string)
+  // that's returned from the error.stack property.
+  raw_data_for_call_site_infos_or_formatted_stack: FixedArray|JSAny;
   // This holds the StackTraceInfo for inspector stack trace.
   stack_trace: StackTraceInfo;
 }
diff --git a/deps/v8/src/objects/elements-kind.h b/deps/v8/src/objects/elements-kind.h
index 7be923774f2c..2383a6a3a401 100644
--- a/deps/v8/src/objects/elements-kind.h
+++ b/deps/v8/src/objects/elements-kind.h
@@ -26,13 +26,10 @@ namespace internal {
   V(BigInt64, bigint64, BIGINT64, int64_t)               \
   V(Uint8Clamped, uint8_clamped, UINT8_CLAMPED, uint8_t) \
   V(Float32, float32, FLOAT32, float)                    \
-  V(Float64, float64, FLOAT64, double)
+  V(Float64, float64, FLOAT64, double)                   \
+  V(Float16, float16, FLOAT16, uint16_t)
 
-#define TYPED_ARRAYS_FLOAT16(V) V(Float16, float16, FLOAT16, uint16_t)
-
-#define TYPED_ARRAYS(V) \
-  TYPED_ARRAYS_BASE(V)  \
-  TYPED_ARRAYS_FLOAT16(V)
+#define TYPED_ARRAYS(V) TYPED_ARRAYS_BASE(V)
 
 #define RAB_GSAB_TYPED_ARRAYS_BASE(V)                                    \
   V(RabGsabUint8, rab_gsab_uint8, RAB_GSAB_UINT8, uint8_t)               \
@@ -46,14 +43,10 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, \
     uint8_t)                                                             \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)           \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)          \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
-#define RAB_GSAB_TYPED_ARRAYS(V) \
-  RAB_GSAB_TYPED_ARRAYS_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_FLOAT16(V)
+#define RAB_GSAB_TYPED_ARRAYS(V) RAB_GSAB_TYPED_ARRAYS_BASE(V)
 
 // The TypedArrays backed by RAB / GSAB are called Uint8Array, Uint16Array etc,
 // and not RabGsabUint8Array, RabGsabUint16Array etc. This macro is used for
@@ -69,14 +62,11 @@ namespace internal {
   V(BigInt64, rab_gsab_bigint64, RAB_GSAB_BIGINT64, int64_t)               \
   V(Uint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED, uint8_t) \
   V(Float32, rab_gsab_float32, RAB_GSAB_FLOAT32, float)                    \
-  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V) \
+  V(Float64, rab_gsab_float64, RAB_GSAB_FLOAT64, double)                   \
   V(Float16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_TYPED_ARRAY_TYPE_BASE(V)
 
 // Like RAB_GSAB_TYPED_ARRAYS but has an additional parameter for
 // for the corresponding non-RAB/GSAB ElementsKind.
@@ -93,14 +83,11 @@ namespace internal {
   V(RabGsabUint8Clamped, rab_gsab_uint8_clamped, RAB_GSAB_UINT8_CLAMPED,      \
     uint8_t, UINT8_CLAMPED)                                                   \
   V(RabGsabFloat32, rab_gsab_float32, RAB_GSAB_FLOAT32, float, FLOAT32)       \
-  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)
-
-#define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V) \
+  V(RabGsabFloat64, rab_gsab_float64, RAB_GSAB_FLOAT64, double, FLOAT64)      \
   V(RabGsabFloat16, rab_gsab_float16, RAB_GSAB_FLOAT16, uint16_t, FLOAT16)
 
 #define RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND(V) \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)  \
-  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_FLOAT16(V)
+  RAB_GSAB_TYPED_ARRAYS_WITH_NON_RAB_GSAB_ELEMENTS_KIND_BASE(V)
 
 enum ElementsKind : uint8_t {
   // The "fast" kind for elements that only contain SMI values. Must be first
diff --git a/deps/v8/src/objects/fixed-array.cc b/deps/v8/src/objects/fixed-array.cc
index 28eebb5acec0..88bbe5655c8f 100644
--- a/deps/v8/src/objects/fixed-array.cc
+++ b/deps/v8/src/objects/fixed-array.cc
@@ -21,10 +21,9 @@ bool FixedArrayBase::IsCowArray() const {
 template <template <typename> typename HandleType>
   requires(
       std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
-HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
-                                              HandleType<FixedArray> array,
-                                              int index,
-                                              DirectHandle<Object> value) {
+HandleType<FixedArray> FixedArray::Grow(Isolate* isolate,
+                                        HandleType<FixedArray> array,
+                                        int index) {
   int len = array->length();
   if (index >= len) {
     int new_capacity = FixedArray::NewCapacityForIndex(index, len);
@@ -33,7 +32,17 @@ HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
     // use `undefined` as a filler. Make this more explicit.
     array->FillWithHoles(len, new_capacity);
   }
+  return array;
+}
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              DirectHandle<Object> value) {
+  array = Grow(isolate, array, index);
   array->set(index, *value);
   return array;
 }
@@ -45,6 +54,25 @@ template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
     Isolate* isolate, IndirectHandle<FixedArray> array, int index,
     DirectHandle<Object> value);
 
+template <template <typename> typename HandleType>
+  requires(
+      std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+HandleType<FixedArray> FixedArray::SetAndGrow(Isolate* isolate,
+                                              HandleType<FixedArray> array,
+                                              int index,
+                                              Tagged<Smi> value) {
+  array = Grow(isolate, array, index);
+  array->set(index, value);
+  return array;
+}
+
+template DirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, DirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+template IndirectHandle<FixedArray> FixedArray::SetAndGrow(
+    Isolate* isolate, IndirectHandle<FixedArray> array, int index,
+    Tagged<Smi> value);
+
 void FixedArray::RightTrim(Isolate* isolate, int new_capacity) {
   DCHECK_NE(map(), ReadOnlyRoots{isolate}.fixed_cow_array_map());
   Super::RightTrim(isolate, new_capacity);
diff --git a/deps/v8/src/objects/fixed-array.h b/deps/v8/src/objects/fixed-array.h
index e634550ae8f9..a0adf5e49011 100644
--- a/deps/v8/src/objects/fixed-array.h
+++ b/deps/v8/src/objects/fixed-array.h
@@ -259,6 +259,12 @@ V8_OBJECT class FixedArray
   V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
       Isolate* isolate, HandleType<FixedArray> array, int index,
       DirectHandle<Object> value);
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  V8_EXPORT_PRIVATE static HandleType<FixedArray> SetAndGrow(
+      Isolate* isolate, HandleType<FixedArray> array, int index,
+      Tagged<Smi> value);
 
   // Right-trim the array.
   // Invariant: 0 < new_length <= length()
@@ -289,6 +295,13 @@ V8_OBJECT class FixedArray
   static constexpr int kMaxRegularLength = FixedArray::kMaxRegularCapacity;
 
  private:
+  template <template <typename> typename HandleType>
+    requires(
+        std::is_convertible_v<HandleType<FixedArray>, DirectHandle<FixedArray>>)
+  static HandleType<FixedArray> Grow(Isolate* isolate,
+                                     HandleType<FixedArray> array,
+                                     int index);
+
   inline static Handle<FixedArray> Resize(
       Isolate* isolate, DirectHandle<FixedArray> xs, int new_capacity,
       AllocationType allocation = AllocationType::kYoung,
diff --git a/deps/v8/src/objects/value-serializer.cc b/deps/v8/src/objects/value-serializer.cc
index def468a73920..1cbe14d654bd 100644
--- a/deps/v8/src/objects/value-serializer.cc
+++ b/deps/v8/src/objects/value-serializer.cc
@@ -2301,13 +2301,6 @@ MaybeDirectHandle<JSArrayBufferView> ValueDeserializer::ReadJSArrayBufferView(
     break;
       TYPED_ARRAYS_BASE(TYPED_ARRAY_CASE)
 #undef TYPED_ARRAY_CASE
-    case ArrayBufferViewTag::kFloat16Array: {
-      if (i::v8_flags.js_float16array) {
-        external_array_type = kExternalFloat16Array;
-        element_size = sizeof(uint16_t);
-      }
-      break;
-    }
   }
   if (element_size == 0 || byte_offset % element_size != 0 ||
       byte_length % element_size != 0) {
diff --git a/deps/v8/test/cctest/test-inobject-slack-tracking.cc b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
index ace7c1370ad0..a74b20fa8eb1 100644
--- a/deps/v8/test/cctest/test-inobject-slack-tracking.cc
+++ b/deps/v8/test/cctest/test-inobject-slack-tracking.cc
@@ -1100,7 +1100,6 @@ TEST(SubclassArrayBuiltinNoInlineNew) {
 
 
 TEST(SubclassTypedArrayBuiltin) {
-  v8_flags.js_float16array = true;
   CcTest::InitializeVM();
   v8::HandleScope scope(CcTest::isolate());
 
diff --git a/deps/v8/test/cctest/test-typedarrays.cc b/deps/v8/test/cctest/test-typedarrays.cc
index ce256fec8f0b..40d3cdde0fc4 100644
--- a/deps/v8/test/cctest/test-typedarrays.cc
+++ b/deps/v8/test/cctest/test-typedarrays.cc
@@ -115,20 +115,17 @@ void TestSpeciesProtector(char* code,
 }
 
 UNINITIALIZED_TEST(SpeciesConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "x.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesConstructorAccessor) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(x, 'constructor',{get() {return MyTypedArray;}})";
   TestSpeciesProtector(code);
 }
 
 UNINITIALIZED_TEST(SpeciesModified) {
-  v8_flags.js_float16array = true;
   char code[] =
       "Object.defineProperty(constructor, Symbol.species, "
       "{value:MyTypedArray})";
@@ -136,7 +133,6 @@ UNINITIALIZED_TEST(SpeciesModified) {
 }
 
 UNINITIALIZED_TEST(SpeciesParentConstructor) {
-  v8_flags.js_float16array = true;
   char code[] = "constructor.prototype.constructor = MyTypedArray";
   TestSpeciesProtector(code);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-499260582.js b/deps/v8/test/mjsunit/regress/regress-499260582.js
new file mode 100644
index 000000000000..08e4a2daf9b1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-499260582.js
@@ -0,0 +1,20 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --jit-fuzzing --single-threaded
+
+function f9(a10, a11) {
+    'use strict';
+    for (let v12 = 0; v12 < 5; v12++) {
+        const v15 = ({ maxByteLength: 1073741824 }).maxByteLength;
+        %OptimizeOsr();
+        function F16(a18, a19, a20) {
+            if (!new.target) { throw 'must be called with new'; }
+        }
+        try { F16.call(v15); } catch (e) {}
+    }
+    return f9;
+}
+%PrepareFunctionForOptimization(f9);
+f9(f9, f9);
diff --git a/deps/v8/test/test262/testcfg.py b/deps/v8/test/test262/testcfg.py
index aa93daaef0cd..07e03b07aaa9 100644
--- a/deps/v8/test/test262/testcfg.py
+++ b/deps/v8/test/test262/testcfg.py
@@ -59,7 +59,6 @@
     'import-attributes': '--harmony-import-attributes',
     'regexp-duplicate-named-groups': '--js-regexp-duplicate-named-groups',
     'regexp-modifiers': '--js-regexp-modifiers',
-    'Float16Array': '--js-float16array',
     'explicit-resource-management': '--js-explicit-resource-management',
     'decorators': '--js-decorators',
     'promise-try': '--js-promise-try',
diff --git a/deps/v8/test/unittests/objects/object-unittest.cc b/deps/v8/test/unittests/objects/object-unittest.cc
index 18032ea39fd9..d4421cd807d6 100644
--- a/deps/v8/test/unittests/objects/object-unittest.cc
+++ b/deps/v8/test/unittests/objects/object-unittest.cc
@@ -683,8 +683,6 @@ TEST_FUNCTION_KIND(IsStrictFunctionWithoutPrototype)
 #undef TEST_FUNCTION_KIND
 
 TEST_F(ObjectTest, ConstructorInstanceTypes) {
-  bool flag_was_enabled = i::v8_flags.js_float16array;
-  i::v8_flags.js_float16array = true;
   v8::HandleScope scope(isolate());
 
   DirectHandle<NativeContext> context = i_isolate()->native_context();
@@ -720,7 +718,6 @@ TEST_F(ObjectTest, ConstructorInstanceTypes) {
         break;
     }
   }
-  i::v8_flags.js_float16array = flag_was_enabled;
 }
 
 TEST_F(ObjectTest, AddDataPropertyNameCollision) {
diff --git a/deps/v8/test/unittests/objects/value-serializer-unittest.cc b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
index ee7e8acf26db..a6ce6cee63cc 100644
--- a/deps/v8/test/unittests/objects/value-serializer-unittest.cc
+++ b/deps/v8/test/unittests/objects/value-serializer-unittest.cc
@@ -48,7 +48,6 @@ class ValueSerializerTest : public TestWithIsolate {
 
  protected:
   ValueSerializerTest() {
-    FLAG_SCOPE(js_float16array);
     Local<Context> serialization_context = Context::New(isolate());
     Local<Context> deserialization_context = Context::New(isolate());
     serialization_context_.Reset(isolate(), serialization_context);
@@ -2083,7 +2082,6 @@ TEST_F(ValueSerializerTestWithArrayBufferTransfer,
 }
 
 TEST_F(ValueSerializerTest, RoundTripTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2133,7 +2131,6 @@ TEST_F(ValueSerializerTest, RoundTripTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
@@ -2158,7 +2155,6 @@ TEST_F(ValueSerializerTest, RoundTripRabBackedLengthTrackingTypedArray) {
 }
 
 TEST_F(ValueSerializerTest, RoundTripRabBackedNonLengthTrackingTypedArray) {
-  FLAG_SCOPE(js_float16array);
   // Check that the right type comes out the other side for every kind of typed
   // array.
   // TODO(v8:11111): Use API functions for testing is_length_tracking and
diff --git a/deps/zlib/crc32_simd.c b/deps/zlib/crc32_simd.c
index 20204e322ebe..f9d52a6311e9 100644
--- a/deps/zlib/crc32_simd.c
+++ b/deps/zlib/crc32_simd.c
@@ -22,7 +22,7 @@
 #include <immintrin.h>
 
 #if defined(__GNUC__) || defined(__clang__)
-__attribute__((__target__("avx512f,avx512vl,vpclmulqdq")))
+__attribute__((__target__("avx512f,pclmul,vpclmulqdq")))
 #endif
 uint32_t ZLIB_INTERNAL crc32_avx512_simd_(  /* AVX512+PCLMUL */
     const unsigned char *buf,
diff --git a/deps/zstd/unofficial.gni b/deps/zstd/unofficial.gni
index fe6c2b425eac..733ddb965684 100644
--- a/deps/zstd/unofficial.gni
+++ b/deps/zstd/unofficial.gni
@@ -4,25 +4,38 @@
 
 # The actual configurations are put inside a template in unofficial.gni to
 # prevent accidental edits from contributors.
+import("../../node.gni")
+
 template("zstd_gn_build") {
-  config("zstd_config") {
-    include_dirs = [ "./lib" ]
-  }
+  if (node_shared_zstd) {
+    import("//build/config/linux/pkg_config.gni")
+    pkg_config("zstd_config") {
+      packages = [ "libzstd" ]
+    }
+    group(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+    }
+  } else {
+    config("zstd_config") {
+      include_dirs = [ "./lib" ]
+    }
 
-  gypi_values = exec_script("../../tools/gypi_to_gn.py",
-                            [ rebase_path("zstd.gyp") ],
-                            "scope",
-                            [ "zstd.gyp" ])
+    gypi_values = exec_script("../../tools/gypi_to_gn.py",
+                              [ rebase_path("zstd.gyp") ],
+                              "scope",
+                              [ "zstd.gyp" ])
 
-  source_set(target_name) {
-    forward_variables_from(invoker, "*")
-    public_configs = [ ":zstd_config" ]
-    sources = gypi_values.zstd_sources
-    defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
-    cflags_c = [ "-Wno-unused-function" ]
+    source_set(target_name) {
+      forward_variables_from(invoker, "*")
+      public_configs = [ ":zstd_config" ]
+      sources = gypi_values.zstd_sources
+      defines = [ "XXH_NAMESPACE=ZSTD_", "ZSTD_MULTITHREAD", "ZSTD_DISABLE_ASM" ]
+      cflags_c = [ "-Wno-unused-function" ]
 
-    if (is_posix) {
-      ldflags = [ "-pthread" ]
+      if (is_posix) {
+        ldflags = [ "-pthread" ]
+      }
     }
   }
 }
diff --git a/doc/api/bench.md b/doc/api/bench.md
new file mode 100644
index 000000000000..b25503830f2c
--- /dev/null
+++ b/doc/api/bench.md
@@ -0,0 +1,849 @@
+# Benchmark runner
+
+<!--introduced_in=REPLACEME-->
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early Development
+
+<!-- source_link=lib/bench.js -->
+
+The `node:bench` module supports defining and running JavaScript benchmarks in
+the current process, and running one benchmark file in a fresh child process.
+To access it:
+
+```mjs
+import { bench, suite } from 'node:bench';
+```
+
+```cjs
+const { bench, suite } = require('node:bench');
+```
+
+This module is only available under the `node:` scheme.
+
+## Example benchmark
+
+Save the following as `benchmark.mjs`:
+
+```mjs
+import { bench, suite } from 'node:bench';
+
+suite('URL', () => {
+  const input = 'https://example.com/a?b=c';
+
+  bench('construct', {
+    samples: 30,
+    params: { input: 'short' },
+  }, (b) => {
+    const operations = 10_000;
+    let totalLength = 0;
+
+    b.start();
+    for (let i = 0; i < operations; i++) {
+      totalLength += new URL(input).href.length;
+    }
+    b.end(operations);
+
+    if (totalLength !== operations * input.length) {
+      throw new Error('Unexpected URL result');
+    }
+  });
+});
+```
+
+Run the benchmark from the command line:
+
+```console
+node --bench benchmark.mjs
+```
+
+Benchmarks are executed serially in declaration order. Declared benchmarks are
+scheduled automatically. Call `run()` during the same turn as the declarations
+to consume the event stream or configure filtering.
+If an automatically scheduled run fails and `run()` was not called, the process
+exit code is set to `1`.
+
+## Measurement model
+
+Each warmup and measured sample invokes the benchmark function once with a
+fresh {BenchContext}. The function must either call `context.start()` and
+`context.end(operations)` exactly once, or call `context.record(sample)` exactly
+once to provide an externally measured sample. Setup before `start()` and
+cleanup after `end()` are outside the measured region. Promise-returning
+functions are awaited.
+
+By default, an event loop turn occurs between sample invocations. An embedded
+runner can disable this using `yieldBetweenSamples`. The runner executes
+benchmarks serially, but it does not provide process isolation. Other work in
+the process, JIT compilation, garbage collection, CPU frequency changes, and
+system load can all affect results. Keep raw samples when comparing results and
+investigate noisy or skewed distributions rather than treating a confidence
+interval as a pass/fail threshold.
+
+### Measurement integrity
+
+A statistically consistent result does not prove that a benchmark measured the
+intended work. An optimizing runtime can remove work whose result is unused or
+specialize it more narrowly than the workload being modeled. Framework and loop
+overhead can also dominate operations that are too short. To reduce these risks:
+
+* Make values produced by measured work observable outside the measured
+  interval, for example by validating an aggregate derived from every result.
+  Passing them only through unused local computations is insufficient.
+* Perform enough operations in each sample to amortize fixed timer reads and
+  calls to `context.start()` and `context.end()`. If loop bookkeeping is material
+  relative to one operation, batch multiple operations per iteration and report
+  the total operation count.
+* Inspect raw `samples` for trends that indicate insufficient warmup or
+  optimization tiering, pauses consistent with garbage collection, and
+  multimodal distributions.
+* Validate surprising results with an independent benchmark shape that performs
+  the same intended work differently.
+
+`node:bench` does not force a particular optimization state or infer whether an
+engine eliminated work. Such controls and diagnostics are runtime-specific and
+heuristic, and do not replace validating the benchmark workload.
+
+### Dynamic sampling and variable batches
+
+Calling `context.done()` during a measured sample completes the benchmark after
+that sample. This allows a higher-level tool to treat `samples` as a maximum and
+implement a dynamic sampling policy.
+
+The number of operations can differ between samples. Summary statistics treat
+each sample's `rate` as one equally weighted observation. In particular,
+`summary.mean` is the arithmetic mean of the per-sample rates. It is not the
+pooled throughput calculated as:
+
+```text
+1_000_000_000 * sum(sample.operations) / sum(sample.duration_ns)
+```
+
+The two values can differ when sample durations vary because pooled throughput
+weights each per-sample rate by its duration. A higher-level tool that varies
+batch sizes should choose the aggregation that matches its analysis. It can
+calculate pooled throughput from the raw `samples`; operation counts should be
+summed as `bigint` values because their total can exceed
+`Number.MAX_SAFE_INTEGER` even though each count cannot.
+
+### Comparing benchmark results
+
+`node:bench` does not designate a benchmark as a baseline or produce a pass/fail
+comparison between runs. It exposes raw samples, stable benchmark identities,
+parameters, and tags so that comparison policy can remain in higher-level
+tools. A tool can use `benchId` to match the same declaration and parameters
+across compatible source layouts, and use a tag or its own metadata to identify
+a baseline.
+
+Comparison tools should retain the raw sample rates and verify that execution
+plans and relevant environment details are comparable. The appropriate analysis
+depends on the experimental design and distribution. For example, independent
+samples might use Welch's t-test or a rank-based test, while observations that
+were deliberately paired require paired analysis. Tools should also consider
+effect sizes, uncertainty, and correction when testing multiple benchmarks.
+The general-purpose {Histogram} statistics in `node:perf_hooks` can support such
+analysis, but the runner does not select a method or significance threshold.
+
+## Reusable runners
+
+The module-level declaration functions use a shared runner and schedule it
+automatically. Higher-level tools can create isolated, explicitly started
+runners instead:
+
+```mjs
+import { createRunner } from 'node:bench';
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('example', { samples: 100 }, (b) => {
+  const operations = chooseOperationCount();
+  b.start();
+  runOperations(operations);
+  const sample = b.end(operations);
+
+  if (hasEnoughData(sample)) b.done();
+});
+
+for await (const record of runner.run()) {
+  // Consume structured benchmark records.
+}
+```
+
+Each runner has independent declarations, hooks, filtering, and output. Unlike
+the module-level declarations, creating a benchmark on an explicit runner does
+not schedule execution. This allows packages to collect declarations and start
+them later. Calling the explicit runner's `run()` function prevents additional
+declarations and a second call to `run()` is an error.
+
+## Command-line runner
+
+The `--bench` flag runs one or more explicit benchmark files or glob patterns:
+
+```console
+node --bench benchmark.mjs
+node --bench --bench-reporter=json 'benchmarks/**/*.js'
+```
+
+Files are sorted and executed serially. The default
+`--bench-isolation=process` mode runs each file in a separate child process and
+emits one aggregate summary. Structured events are transferred to the parent
+without JSON conversion, preserving BigInt durations, errors, and parameter
+values. Child writes to stdout and stderr are emitted as diagnostic records so
+they do not corrupt reporter output.
+
+`--bench-isolation=none` imports all files into the runner process. This mode
+has lower startup overhead, but module, heap, and process state carry between
+files, and user writes share stdout and stderr with reporters.
+
+Worker-thread isolation is not a CLI mode. Each newly constructed {Worker} has a
+separate V8 isolate, JavaScript heap, and event loop, typically with lower
+startup cost than a child process. Reusing a worker preserves its module and heap
+state. Workers also share libuv's process-wide thread pool and can share
+process-global native or addon state, so they do not provide the same boundary
+as process isolation.
+
+Higher-level tools can experiment with worker isolation by loading benchmark
+code inside a worker, measuring there, transferring structured sample data, and
+passing it to [`context.record()`][]. The reported `duration_ns` can exclude
+message transport when the worker captures both timestamps. Tools should
+identify worker modules and workloads explicitly. They should not stringify
+arbitrary functions or closures to move them between isolates, because closures
+cannot be reconstructed with their original lexical environment.
+
+Benchmark files passed to `--bench` should declare benchmarks but must not call
+`run()`. The CLI supports `--bench-name-pattern`, `--bench-samples`,
+`--bench-warmup`, `--bench-reporter`, and `--bench-reporter-destination`. See
+the [command-line options documentation][] for details.
+
+Preload modules passed through `--require` or `--import` should not declare
+benchmarks. Such declarations are not associated with an entry file and have
+an `entryFile` value of `null`. Their `fileRunId` identifies the runner or child
+execution in which they occurred. With process isolation, a preload is evaluated
+and its declarations run once for every benchmark child process.
+
+## Benchmark reporters
+
+The built-in reporters are available from the scheme-only
+`node:bench/reporters` module:
+
+```mjs
+import { json, spec } from 'node:bench/reporters';
+```
+
+```cjs
+const { json, spec } = require('node:bench/reporters');
+```
+
+Reporter values can be passed directly to `stream.compose()`:
+
+```mjs
+import { bench, run } from 'node:bench';
+import { spec } from 'node:bench/reporters';
+import process from 'node:process';
+
+bench('example', (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+run().compose(spec).pipe(process.stdout);
+```
+
+The `spec` reporter buffers results and outputs a concise table containing the
+sample count, mean rate, 95% confidence interval for the mean, median rate, and
+warnings. A coefficient of variation above 5% is reported as `noisy`, and an
+absolute skewness above 1 is reported as `skewed`. The exact human-readable
+format is subject to change.
+
+The `json` reporter emits every lifecycle record as newline-delimited JSON.
+BigInt values, including `duration_ns`, are encoded as decimal strings. Errors
+are represented using their `name`, `message`, `stack`, `code`, `cause`, and
+`errors` properties. As required by JSON, non-finite numbers are encoded as
+`null`.
+
+Custom reporters use the same composition contract. They can be transforms or
+functions accepted by `stream.compose()`. The composed readable can be piped to
+any writable destination:
+
+```mjs
+import { run } from 'node:bench';
+import process from 'node:process';
+
+async function* names(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:complete') {
+      yield `${data.name}\n`;
+    }
+  }
+}
+
+run().compose(names).pipe(process.stdout);
+```
+
+## `createRunner([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. Disabling this also prevents timer-based abort signals from
+    firing between synchronous callbacks. Benchmark timeouts continue to be
+    checked against a monotonic deadline. **Default:** `true`.
+* Returns: {Object} An isolated benchmark runner with bound `after`, `afterEach`,
+  `before`, `beforeEach`, `bench`, `describe`, `run`, and `suite` functions.
+
+Creates an explicitly started benchmark runner. Declarations made through one
+runner do not interact with declarations made through another runner or through
+the module-level functions. Call the returned `run()` function to start the
+runner and obtain its {BenchmarksStream}.
+
+Each runner can be started once. Its `run()` function accepts the same options
+as the module-level [`run()`][]. `run({ yieldBetweenSamples })` overrides the
+value passed to `createRunner()`.
+
+## `bench([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string} The benchmark name. **Default:** The `name` property of `fn`,
+  or `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names, deduplicated
+    and inherited from containing suites by union. Symbol values in the array
+    are silently ignored. **Default:** `[]`.
+  * `only` {boolean} When any benchmark or containing suite has `only` set,
+    benchmarks without `only` in their hierarchy are skipped. **Default:**
+    `false`.
+  * `params` {Object} String, finite number, or boolean metadata identifying
+    this benchmark configuration. Parameter keys are sorted when constructing
+    the stable benchmark identity. **Default:** An empty object.
+  * `samples` {number} The maximum number of measured callback invocations.
+    Must be a positive 32-bit unsigned integer. The benchmark may finish earlier
+    by calling `context.done()`. **Default:** `30`.
+  * `signal` {AbortSignal} Allows aborting this benchmark.
+  * `skip` {boolean|string} If truthy, the benchmark is skipped. A string is
+    included in the result as the skip reason. **Default:** `false`.
+  * `tags` {string\[]} Labels associated with the benchmark. Tags are
+    lowercased, deduplicated, and inherited from containing suites by union.
+    **Default:** `[]`.
+  * `timeout` {number} The number of milliseconds after which the benchmark
+    fails. **Default:** `Infinity`.
+  * `warmup` {number} The number of unreported callback invocations before
+    measured samples. Must be a 32-bit unsigned integer. **Default:** `0`.
+* `fn` {Function|AsyncFunction} The benchmark function. It receives a
+  {BenchContext}.
+* Returns: {Promise} Fulfilled with the benchmark result after a top-level
+  benchmark finishes, or with `undefined` immediately when declared in a
+  suite.
+
+Warmup invocations use the same callback and timing contract as measured
+samples, but their samples are discarded. An exception, rejection, timeout,
+abort, missing timing call, or duplicate timing call stops the current
+benchmark. Later benchmarks continue to run.
+
+After a timeout or abort, the runner briefly waits for asynchronous benchmark
+work to settle before continuing. If it remains pending, all later benchmarks
+that were selected to run fail without running so that their measurements
+cannot overlap with that work.
+
+For each warmup and measured callback, the runner subscribes to the configured
+diagnostics channels. Each publication queues a context diagnostic whose
+`message` is `{ name, message }`, containing the string channel name and the
+published message. Subscriptions are removed when the callback settles or is
+aborted.
+
+A timeout or abort cannot interrupt synchronous JavaScript and does not forcibly
+cancel asynchronous work that ignores `context.signal`.
+
+The `benchId` is based on the declaration source file, hierarchical suite and
+benchmark names, and canonicalized parameters. It is stable for repeated runs
+from the same source location, but the embedded source value is not normalized
+across checkout roots, module formats, operating systems, or path casing.
+
+Execution scope is represented separately. A `runId` identifies one logical
+run, while `fileRunId` identifies a file runner or child execution within that
+run. The `entryFile` field records which entry-file import caused a declaration
+and is `null` for declarations made by preload modules.
+The same `benchId` can therefore occur under multiple `fileRunId` values when
+entry files use a shared declaration helper. Declaring the same `benchId` more
+than once within one file execution scope reports an error rather than merging
+the samples.
+
+### `bench.skip([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Shorthand for `bench(name, { ...options, skip: true }, fn)`.
+
+### `bench.only([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Shorthand for `bench(name, { ...options, only: true }, fn)`.
+
+## `suite([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `name` {string} The suite name. **Default:** The `name` property of `fn`, or
+  `'<anonymous>'` when `fn` has no name.
+* `options` {Object}
+  * `diagnosticChannels` {Array} String diagnostics channel names inherited by
+    nested suites and benchmarks. Symbol values in the array are silently
+    ignored. **Default:** `[]`.
+  * `only` {boolean} Selects all benchmarks nested in this suite. **Default:**
+    `false`.
+  * `skip` {boolean|string} Skips all benchmarks nested in this suite.
+    **Default:** `false`.
+  * `tags` {string\[]} Labels inherited by nested suites and benchmarks.
+    **Default:** `[]`.
+* `fn` {Function|AsyncFunction} A function that declares nested suites,
+  benchmarks, and hooks.
+* Returns: {Promise} Fulfilled when a top-level suite finishes, or with
+  `undefined` immediately when declared in another suite.
+
+Suite functions run while declarations are collected. Promise-returning suite
+functions are awaited before benchmark execution begins.
+
+## `describe([name][, options], fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Alias for `suite()`.
+
+## `before(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once before the benchmarks in the current suite.
+
+## `after(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function.
+
+Registers a hook that runs once after the benchmarks in the current suite.
+
+## `beforeEach(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once before each complete logical benchmark in the
+current suite. It does not run before every sample. Per-sample setup belongs in
+the benchmark function before `context.start()` or `context.record()`.
+
+## `afterEach(fn)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `fn` {Function|AsyncFunction} The hook function. It receives an object with
+  the benchmark's `name`, `params`, and `signal`.
+
+Registers a hook that runs once after each complete logical benchmark in the
+current suite. It does not run after every sample. Per-sample cleanup belongs
+in the benchmark function after `context.end()` or `context.record()`.
+
+## `run([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `namePattern` {string|RegExp} Only runs benchmarks whose full hierarchical
+    name matches the pattern. String values are interpreted as JavaScript
+    regular expressions.
+  * `samples` {number} Overrides the maximum number of measured callback
+    invocations for every benchmark. Must be a positive 32-bit unsigned integer.
+  * `signal` {AbortSignal} Allows aborting in-progress benchmark execution.
+  * `warmup` {number} Overrides the number of unreported warmup callback
+    invocations for every benchmark. Must be a 32-bit unsigned integer.
+  * `yieldBetweenSamples` {boolean} Schedule an event loop turn between sample
+    callbacks. **Default:** `true`, or the value passed to `createRunner()` for
+    an explicit runner.
+* Returns: {BenchmarksStream}
+
+Returns the object-mode event stream for the in-process benchmark run. Call
+`run()` during the same turn in which benchmarks are declared, before automatic
+execution begins. Calling `run()` is optional when the returned stream is not
+needed. An explicit runner created by `createRunner()` does not run
+automatically, so its `run()` function may be called later.
+
+```mjs
+import { bench, run } from 'node:bench';
+
+bench('example', { samples: 3 }, (b) => {
+  b.start();
+  doWork();
+  b.end(1);
+});
+
+for await (const { type, data } of run()) {
+  if (type === 'bench:complete' && data.error === undefined) {
+    console.log(data.name, data.summary.mean);
+  }
+}
+```
+
+## `runFile(path[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `path` {string|Buffer|URL} The path of one benchmark module.
+* `options` {Object}
+  * `env` {Object} The child process environment. Property values must be
+    strings or `undefined`. This replaces, rather than extends, the parent
+    environment. **Default:** A snapshot of `process.env`.
+  * `execArgv` {string\[]} Node.js command-line options for the child process.
+    This replaces, rather than extends, inherited options. Benchmark runner
+    options, positional arguments, and options that select another execution
+    mode are not allowed. **Default:** Compatible options inherited from the
+    current process.
+  * `signal` {AbortSignal} Terminates the child process when aborted.
+* Returns: {BenchmarksStream}
+
+Runs exactly one benchmark module in a fresh child process and returns its
+object-mode event stream. A relative `path` is resolved from the current working
+directory when `runFile()` is called. `path` is not interpreted as a glob.
+Unless the signal is aborted or the stream is destroyed before startup, every
+call uses a new child. Input discovery, ordering, concurrency, retries, and
+multi-file scheduling remain the caller's responsibility.
+
+When the Permission Model is enabled, the caller must have file system read
+access to `path` and permission to create child processes.
+
+Records use advanced child process serialization, preserving supported
+structured values such as `bigint` and errors. Child writes to stdout and stderr
+become `'bench:diagnostic'` records. A permission failure, module loading error,
+abnormal child exit, or cancellation also emits an error diagnostic and produces
+a terminal `'bench:summary'` whose `success` property is `false`; these execution
+failures do not error the stream. If module evaluation fails after declaring
+benchmarks, those declarations still run before the unsuccessful summary.
+
+`env`, effective inherited options, and an explicitly provided `execArgv` are
+copied when `runFile()` is called. The runner removes `NODE_OPTIONS`, replaces
+IPC-related environment variables, and sets its private child-context, run
+identity, and file identity variables, overriding properties with those names
+in `env`. Pass child Node.js options through `execArgv`, not `NODE_OPTIONS`.
+Standard `child_process` environment propagation still applies, including
+`NODE_V8_COVERAGE`, permission-model options, and required z/OS variables.
+Aborting `signal` before the child starts produces an `AbortError` diagnostic
+without spawning it. Aborting during execution sends `SIGTERM` to the child and
+escalates to `SIGKILL` if it does not exit. Destroying the returned stream
+follows the same termination procedure.
+
+## Class: `BenchContext`
+
+An instance of `BenchContext` is passed to every benchmark invocation. A new
+instance is created for every warmup and measured sample.
+
+### `context.index`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {number}
+
+The zero-based invocation index within the current `context.phase`. Warmup and
+measured samples have separate index sequences.
+
+### `context.name`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {string}
+
+The benchmark name.
+
+### `context.params`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {Object}
+
+The benchmark's canonicalized parameter metadata.
+
+### `context.phase`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {string}
+
+The current sample phase. It is `'warmup'` for an unreported warmup invocation
+and `'measurement'` for a measured invocation.
+
+### `context.signal`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* {AbortSignal}
+
+An abort signal that is triggered when the benchmark is aborted, times out, or
+finishes.
+
+### `context.start()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Starts the measured region using `process.hrtime.bigint()`. Calling `start()`
+more than once is an error.
+
+### `context.end(operations[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `operations` {number} The number of completed operations. Must be a positive
+  safe integer.
+* `options` {Object}
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The sample's `operations`, `duration_ns`, computed `rate`,
+  and optional cloned `detail`.
+
+Ends the measured region. The end timestamp is captured before `operations` is
+validated. Calling `end()` before `start()`, calling it more than once, or
+recording a zero-duration sample is an error. When provided, `detail` is cloned
+after the end timestamp is captured, so cloning time is outside the measured
+region.
+
+### `context.record(sample)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `sample` {Object}
+  * `operations` {number} The number of completed operations. Must be a positive
+    safe integer.
+  * `duration_ns` {bigint} An externally measured positive duration in
+    nanoseconds no greater than `Number.MAX_SAFE_INTEGER`.
+  * `detail` {any} Additional structured-cloneable sample data. With CLI process
+    isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {Object} The normalized sample, including its computed `rate` and
+  optional cloned `detail`.
+
+Records a measurement made by another clock or execution environment. This is
+useful when a higher-level tool measures work in a worker and needs to exclude
+message transport from the duration. `record()` is mutually exclusive with
+`start()` and `end()` within one callback and must be called exactly once.
+
+### `context.diagnostic(message[, options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `message` {any} A structured-cloneable diagnostic value. With CLI process
+  isolation, it must also be supported by advanced child process serialization.
+* `options` {Object}
+  * `level` {string} Either `'info'` or `'warning'`. **Default:** `'info'`.
+  * `detail` {any} Additional structured-cloneable diagnostic data. With CLI
+    process isolation, it must also be supported by advanced child process
+    serialization.
+* Returns: {undefined}
+
+Queues a diagnostic associated with the current benchmark, phase, and sample
+index. Multiple diagnostics preserve call order. They are emitted after the
+sample callback settles and before that sample's `'bench:sample'` event. Warmup
+diagnostics are emitted even though warmup samples are not. Diagnostics queued
+before a callback failure are emitted before the failed `'bench:complete'`
+event and do not themselves cause the benchmark to fail. If a timeout or abort
+wins before the callback settles, queued diagnostics might not be emitted.
+
+The message and detail are cloned synchronously. Options are also validated
+synchronously. Calling `diagnostic()` between `context.start()` and
+`context.end()` therefore includes that work in the measured duration. Invalid
+arguments or an uncloneable message or detail violate the sample contract.
+
+### `context.done()`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+Requests successful benchmark completion after the current measured sample.
+The callback must still call either `start()` and `end()`, or `record()`.
+Calling `done()` during a warmup invocation is an error. The configured
+`samples` value remains the maximum number of measured invocations if `done()`
+is not called.
+
+## Class: `BenchmarksStream`
+
+`BenchmarksStream` is an object-mode {stream.Readable}. Each lifecycle record is
+both emitted as a named event and made available on the stream as
+`{ type, data }`.
+
+The events are emitted in execution order:
+
+* `'bench:plan'`
+* `'bench:start'`
+* `'bench:sample'`
+* `'bench:complete'`
+* `'bench:diagnostic'`
+* `'bench:summary'`
+
+Named event payloads, readable records, and benchmark completion values are
+independent snapshots. Mutating a value received through one delivery mechanism
+does not change values received through the others. As with other
+{EventEmitter} events, multiple listeners for the same named event receive the
+same event payload. Memory referenced through a {SharedArrayBuffer} remains
+shared, following structured clone semantics.
+
+Once a consumer starts reading, the runner honors the stream's object-mode
+high-water mark and waits between records when the consumer is slower than the
+producer. These waits occur after sample timing has ended, and records are not
+dropped. Snapshot creation and delivery waits are excluded from benchmark
+timeout accounting. Before readable consumption starts, records accumulate in
+the standard readable buffer and are included in `readableLength`. This keeps an
+unread stream and a consumer using only named events from deadlocking, but the
+buffer can grow without bound. A named-event-only consumer that does not need
+readable records should call `stream.resume()` to discard them. Destroying the
+stream stops readable delivery but does not cancel benchmark execution, so
+benchmark completion promises still settle. Automatically scheduled
+module-level runs drain their stream internally.
+
+With process isolation, each record sent by a child is acknowledged only after
+the parent has accepted it. A child sends no additional record until it receives
+that acknowledgement, bounding the IPC relay when a reporter is slow.
+
+Every benchmark-scoped event contains `runId`, `fileRunId`, `entryFile`,
+`benchId`, `parentId`, and `namePath`. `runId` and `fileRunId` are opaque and
+change between runs. `entryFile` identifies the top-level benchmark file whose
+loading caused the declaration, while `file` identifies the source location of
+the declaration itself. `parentId` is based on the containing suite's source
+file and hierarchical name path.
+
+After asynchronous suite declarations settle, an in-process runner emits one
+`'bench:plan'` event for every benchmark it collected, in declaration order.
+All plans from that runner are emitted before its suite hooks or benchmark
+callbacks run. With process isolation, files run in separate children, so plans
+for a later file are emitted after an earlier child has completed. With no
+isolation, all files share one runner and their plans are emitted before any
+benchmark executes. Plan data contains the benchmark-scoped identity, location,
+tags, and parameters described in [benchmark result][], together with:
+
+* `diagnosticChannels` {string\[]} The inherited string channel names
+  subscribed to during each callback.
+* `samples` {number} The effective maximum number of measured callback
+  invocations after run-level overrides.
+* `warmup` {number} The effective number of unreported warmup callback
+  invocations after run-level overrides.
+* `timeout` {number|null} The timeout in milliseconds, or `null` when no timeout
+  is configured.
+* `yieldBetweenSamples` {boolean} Whether an event loop turn is scheduled between
+  sample callbacks.
+* `selected` {boolean} Whether the benchmark is eligible to run after applying
+  `skip`, `only`, and `namePattern` selection. Execution can still be prevented
+  by a duplicate declaration, suite build, hook, abort, or other runtime failure.
+* `skip` {boolean|string} When `selected` is `false`, the explicit skip value or
+  the selection reason, such as `'only'` or `'name pattern'`.
+
+The plan contains execution settings known to the runner. Runtime version,
+operating system, processor, and other environment metadata are intentionally
+left for reporters and higher-level tools to collect.
+
+`'bench:complete'` data contains a [benchmark result][]. A failed result has an
+additional `error` property and may contain samples recorded before the error.
+A skipped result has an additional `skip` property and an empty `samples`
+array. `'bench:diagnostic'` reports loading, suite, and hook errors as well as
+public context diagnostics. A context diagnostic contains the benchmark-scoped
+identity fields, `phase`, `index`, `message`, `level`, source location, and
+optional `detail`. `'bench:summary'` contains overall `runId`, `fileRunId`,
+`entryFile`, `success`, `counts`, `duration_ns`, and `file` properties.
+`fileRunId`, `entryFile`, and `file` are {string|null}; they are `null` when the
+summary aggregates multiple files.
+
+## Sample result
+
+Each measured sample has the following properties:
+
+* `operations` {number} The positive operation count passed to
+  `context.end()` or `context.record()`.
+* `duration_ns` {bigint} The measured duration in nanoseconds.
+* `rate` {number} Operations per second.
+* `detail` {any} The optional cloned sample detail.
+
+## Benchmark result
+
+A completed benchmark result contains:
+
+* `runId` {string} The opaque logical run identity.
+* `fileRunId` {string} The opaque file runner or child execution identity.
+* `entryFile` {string|null} The top-level file that caused this declaration.
+* `benchId` {string} The stable declaration identity within the same source
+  layout.
+* `parentId` {string|null} The stable containing suite identity.
+* `name` {string} The benchmark name.
+* `namePath` {string\[]} The hierarchical suite and benchmark names.
+* `file` {string} The declaration source file.
+* `line` {number} The source line.
+* `column` {number} The source column.
+* `tags` {string\[]} The inherited canonical tags.
+* `params` {Object} The canonical parameter metadata.
+* `samples` {Object\[]} The exact measured samples in measurement invocation
+  order.
+* `summary` {Object}
+  * `mean` {number} The equally weighted arithmetic mean of per-sample rates,
+    not pooled throughput across all operations and durations.
+  * `median` {number} The median per-sample rate.
+  * `min` {number} The minimum per-sample rate.
+  * `max` {number} The maximum per-sample rate.
+  * `stddev` {number} The population standard deviation of rates.
+  * `coefficientOfVariation` {number} `stddev / mean`.
+  * `confidenceInterval` {Object} The 95% Student's t confidence interval for
+    the mean rate, with `lower` and `upper` properties.
+  * `medianConfidenceInterval` {Object} The 95% nonparametric confidence
+    interval for the median rate, with `lower` and `upper` properties.
+  * `skewness` {number} The skewness of the scaled rate histogram.
+
+[`context.record()`]: #contextrecordsample
+[`run()`]: #runoptions
+[benchmark result]: #benchmark-result
+[command-line options documentation]: cli.md#--bench
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index c4369716c6f9..fe22de84f9d1 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -5345,7 +5345,9 @@ added:
   - v19.6.0
   - v18.15.0
 changes:
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64504
     description: Detached `ArrayBuffer`s and views backed by them are treated
                  as empty.
@@ -5366,7 +5368,9 @@ added:
   - v19.4.0
   - v18.14.0
 changes:
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64504
     description: Detached `ArrayBuffer`s and views backed by them are treated
                  as empty.
@@ -5690,8 +5694,9 @@ since the extra bytes are not free.
 
 Because the address of a `Buffer`'s memory cannot be chosen directly, extra bytes
 have to be allocated or skipped to reach an aligned address.
-[`Buffer.allocUnsafeSlow()`][] over-allocates up to `alignment - 1` bytes and
-positions the returned `Buffer` at the first suitably aligned byte within them.
+[`Buffer.allocUnsafeSlow()`][] over-allocates `alignment` bytes, or 8 when
+`alignment` is smaller than that, and positions the returned `Buffer` at the
+first suitably aligned byte within them.
 [`Buffer.allocUnsafe()`][] instead pads its offset into the shared internal pool,
 whose start is always aligned to 64 bytes, and only falls back to an allocation
 of its own when `alignment` is larger than that. Either way,
diff --git a/doc/api/child_process.md b/doc/api/child_process.md
index 138fb52f8612..e06f88af3a5f 100644
--- a/doc/api/child_process.md
+++ b/doc/api/child_process.md
@@ -561,6 +561,8 @@ changes:
     is used, it must contain exactly one item with value `'ipc'` or an error
     will be thrown. For instance `[0, 1, 2, 'ipc']`.
   * `uid` {number} Sets the user identity of the process (see setuid(2)).
+  * `windowsHide` {boolean} Hide the subprocess console window that would
+    normally be created on Windows systems. **Default:** `false`.
   * `windowsVerbatimArguments` {boolean} No quoting or escaping of arguments is
     done on Windows. Ignored on Unix. **Default:** `false`.
   * `timeout` {number} In milliseconds the maximum amount of time the process
@@ -1581,7 +1583,7 @@ added: v0.5.9
 
 * `message` {Object} A parsed JSON object or primitive value.
 * `sendHandle` {Handle|undefined} `undefined` or a [`net.Socket`][],
-  [`net.Server`][], or [`dgram.Socket`][] object.
+  [`net.Server`][], [`net.BoundSocket`][], or [`dgram.Socket`][] object.
 
 The `'message'` event is triggered when a child process uses
 [`process.send()`][] to send messages.
@@ -1891,6 +1893,9 @@ subprocess.ref();
 <!-- YAML
 added: v0.5.9
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64725
+    description: '`net.BoundSocket` instances can now be sent.'
   - version: v5.8.0
     pr-url: https://github.com/nodejs/node/pull/5283
     description: The `options` parameter, and the `keepOpen` option
@@ -1905,7 +1910,7 @@ changes:
 
 * `message` {Object}
 * `sendHandle` {Handle|undefined} `undefined`, or a [`net.Socket`][],
-  [`net.Server`][], or [`dgram.Socket`][] object.
+  [`net.Server`][], [`net.BoundSocket`][], or [`dgram.Socket`][] object.
 * `options` {Object} The `options` argument, if present, is an object used to
   parameterize the sending of certain types of handles. `options` supports
   the following properties:
@@ -1972,12 +1977,18 @@ Applications should avoid using such messages or listening for
 `'internalMessage'` events as it is subject to change without notice.
 
 The optional `sendHandle` argument that may be passed to `subprocess.send()` is
-for passing a TCP server or socket object to the child process. The child process will
+for passing a TCP server, socket or [`net.BoundSocket`][] object to the child
+process. The child process will
 receive the object as the second argument passed to the callback function
 registered on the [`'message'`][] event. Any data that is received
 and buffered in the socket will not be sent to the child. Sending IPC sockets is
 not supported on Windows.
 
+Sending a `net.BoundSocket` moves its underlying TCP handle to the child
+process, leaving the source instance in the adopted state as if it had been
+adopted by a server or socket. The bound socket must not have been adopted or
+closed, and pipe (`path`) binds cannot be sent.
+
 The optional `callback` is a function that is invoked after the message is
 sent but before the child process may have received it. The function is called with a
 single argument: `null` on success, or an [`Error`][] object on failure.
@@ -2405,6 +2416,7 @@ or [`child_process.fork()`][].
 [`child_process.spawnSync()`]: #child_processspawnsynccommand-args-options
 [`dgram.Socket`]: dgram.md#class-dgramsocket
 [`maxBuffer` and Unicode]: #maxbuffer-and-unicode
+[`net.BoundSocket`]: net.md#class-netboundsocket
 [`net.Server`]: net.md#class-netserver
 [`net.Socket`]: net.md#class-netsocket
 [`options.detached`]: #optionsdetached
diff --git a/doc/api/cli.md b/doc/api/cli.md
index 59945be330a2..41f9d6534f81 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -268,6 +268,26 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 ```
 
+### `--allow-fs-vfs`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.1 - Active development
+
+When using the [Permission Model][], a [virtual file system][] cannot be
+mounted by default: [`vfs.mount()`][] throws `ERR_INVALID_STATE` unless the
+user explicitly passes the `--allow-fs-vfs` flag when starting Node.js.
+
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on `--allow-fs-read` or
+`--allow-fs-write`.
+
+```console
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+```
+
 ### `--allow-fs-write`
 
 <!-- YAML
@@ -364,7 +384,9 @@ Error: connect ERR_ACCESS_DENIED Access to this API has been restricted. Use --a
 ### `--allow-openssl-store`
 
 <!-- YAML
-added: v26.7.0
+added:
+ - v26.7.0
+ - v24.21.0
 -->
 
 > Stability: 1.1 - Active development
@@ -450,6 +472,112 @@ Error: Access to this API has been restricted
 }
 ```
 
+### `--bench`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+
+```console
+node --bench benchmark.mjs
+node --bench 'benchmarks/**/*.js'
+```
+
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using `node:bench`; they must not
+call `run()` themselves. See the [benchmark runner][] documentation for more
+details.
+
+This flag cannot be combined with `--test`, `--watch`, `--watch-path`,
+`--check`, `--eval`, or `--interactive`.
+
+### `--bench-isolation=mode`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Configures benchmark file isolation. When `mode` is `'process'`, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+
+When `mode` is `'none'`, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+
+The supported modes are `'process'` and `'none'`.
+
+### `--bench-name-pattern=pattern`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression `pattern`. Non-matching benchmarks are reported as skipped.
+
+### `--bench-reporter-destination=destination`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Specifies the destination for the corresponding benchmark reporter. The value
+can be `stdout`, `stderr`, or a file path. A single reporter defaults to
+`stdout` when no destination is specified.
+
+### `--bench-reporter=reporter`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Specifies a benchmark reporter. The built-in reporters are `spec` and `json`.
+The `json` reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding `--bench-reporter-destination`. The default reporter is
+`spec`.
+
+### `--bench-samples=count`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+`context.done()`. `count` must be an integer between `1` and `4294967295`.
+
+### `--bench-warmup=count`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. `count` must be an integer between `0` and `4294967295`.
+
 ### `--build-sea=config`
 
 <!-- YAML
@@ -2298,6 +2426,17 @@ added: v6.0.0
 
 Silence all process warnings (including deprecations).
 
+### `--no-worker-snapshot`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1 - Experimental
+
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+
 ### `--node-memory-debug`
 
 <!-- YAML
@@ -3906,12 +4045,19 @@ one is included in the list below.
 * `--allow-child-process`
 * `--allow-ffi`
 * `--allow-fs-read`
+* `--allow-fs-vfs`
 * `--allow-fs-write`
 * `--allow-inspector`
 * `--allow-net`
 * `--allow-openssl-store`
 * `--allow-wasi`
 * `--allow-worker`
+* `--bench-isolation`
+* `--bench-name-pattern`
+* `--bench-reporter-destination`
+* `--bench-reporter`
+* `--bench-samples`
+* `--bench-warmup`
 * `--conditions`, `-C`
 * `--cpu-prof-dir`
 * `--cpu-prof-interval`
@@ -3992,6 +4138,7 @@ one is included in the list below.
 * `--no-strip-types`
 * `--no-warnings`
 * `--no-webstorage`
+* `--no-worker-snapshot`
 * `--node-memory-debug`
 * `--openssl-config`
 * `--openssl-legacy-provider`
@@ -4619,7 +4766,9 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [`v8.startupSnapshot.addDeserializeCallback()`]: v8.md#v8startupsnapshotadddeserializecallbackcallback-data
 [`v8.startupSnapshot.setDeserializeMainFunction()`]: v8.md#v8startupsnapshotsetdeserializemainfunctioncallback-data
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
+[`vfs.mount()`]: vfs.md#vfsmount
 [asynchronous module customization hooks]: module.md#asynchronous-customization-hooks
+[benchmark runner]: bench.md#command-line-runner
 [captured by the built-in snapshot of Node.js]: https://github.com/nodejs/node/blob/b19525a33cc84033af4addd0f80acd4dc33ce0cf/test/parallel/test-bootstrap-modules.js#L24
 [collecting code coverage from tests]: test.md#collecting-code-coverage
 [conditional exports]: packages.md#conditional-exports
@@ -4650,4 +4799,5 @@ node --stack-trace-limit=12 -p -e "Error.stackTraceLimit" # prints 12
 [test runner execution model]: test.md#test-runner-execution-model
 [timezone IDs]: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
 [tracking issue for user-land snapshots]: https://github.com/nodejs/node/issues/44014
+[virtual file system]: vfs.md
 [ways that `TZ` is handled in other environments]: https://www.gnu.org/software/libc/manual/html_node/TZ-Variable.html
diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index a08519a57688..c95104f4e16e 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -4225,7 +4225,9 @@ require options or a key with provider-specific properties.
 <!-- YAML
 added: v11.6.0
 changes:
-  - version: v26.7.0
+  - version:
+     - v26.7.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63949
     description: The key can also be a URL referencing an object for an
                  OpenSSL STORE loader. The `properties` option was added.
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 10fa3964372f..5179f0bc5420 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -774,6 +774,9 @@ the API is not useful.
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65074
+    description: Runtime deprecation.
   - version:
     - v6.12.0
     - v4.8.6
@@ -784,9 +787,10 @@ changes:
     description: Documentation-only deprecation.
 -->
 
-Type: Documentation-only
+Type: Runtime
 
-The [`domain`][] module is deprecated and should not be used.
+The [`domain`][] module is deprecated and should not be used. Loading the
+module emits a runtime deprecation warning.
 
 ### DEP0033: `EventEmitter.listenerCount()`
 
@@ -4705,7 +4709,7 @@ successfully before the response closed.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v26.8.2
     pr-url: https://github.com/nodejs/node/pull/64794
     description: Runtime deprecation.
 -->
@@ -4722,7 +4726,7 @@ calling or overriding `_listen2`.
 
 <!-- YAML
 changes:
-  - version: REPLACEME
+  - version: v26.8.2
     pr-url: https://github.com/nodejs/node/pull/64342
     description: Documentation-only deprecation.
 -->
diff --git a/doc/api/domain.md b/doc/api/domain.md
index 4838d4d4a7ef..af0613e16b9a 100644
--- a/doc/api/domain.md
+++ b/doc/api/domain.md
@@ -3,6 +3,10 @@
 <!-- YAML
 deprecated: v1.4.2
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65074
+    description: Loading the module now emits a runtime deprecation warning
+                 (`DEP0032`).
   - version: v8.8.0
     pr-url: https://github.com/nodejs/node/pull/15695
     description: Any `Promise`s created in VM contexts no longer have a
@@ -21,12 +25,11 @@ changes:
 
 <!-- source_link=lib/domain.js -->
 
-**This module is pending deprecation.** Once a replacement API has been
-finalized, this module will be fully deprecated. Most developers should
-**not** have cause to use this module. Users who absolutely must have
-the functionality that domains provide may rely on it for the time being
-but should expect to have to migrate to a different solution
-in the future.
+**This module is deprecated and should not be used.** Loading the module emits
+a runtime deprecation warning (`DEP0032`). Most developers should **not** have
+cause to use this module. Users who absolutely must have the functionality
+that domains provide may rely on it for the time being but should expect to
+have to migrate to a different solution in the future.
 
 Domains provide a way to handle multiple different IO operations as a
 single group. If any of the event emitters or callbacks registered to a
diff --git a/doc/api/embedding.md b/doc/api/embedding.md
index 0309e1120969..dfb84b49ef9b 100644
--- a/doc/api/embedding.md
+++ b/doc/api/embedding.md
@@ -93,6 +93,16 @@ to as `node::Environment`. Each `node::Environment` is associated with:
   that `node::IsolateData` is shared only among `node::Environment`s that
   use the same `v8::Isolate`, Node.js does not perform this check.
 
+`node::Environment`s that share a `node::IsolateData` also share its
+`uv_loop_t`. `node::FreeEnvironment()` runs that loop until the handles of the
+`node::Environment` being freed have closed, and JavaScript execution is
+disallowed on the whole `v8::Isolate` while it does, so pending timers, I/O
+callbacks and thread pool completions that belong to other `node::Environment`s
+on the same loop can run inside that call without being able to call into
+JavaScript. `node::Environment`s that are freed independently of one another
+should each use their own `uv_loop_t` and `node::IsolateData`, or the embedder
+should make sure the others have no pending work when one of them is freed.
+
 In order to set up a `v8::Isolate`, an `v8::ArrayBuffer::Allocator` needs
 to be provided. One possible choice is the default Node.js allocator, which
 can be created through `node::ArrayBufferAllocator::Create()`. Using the Node.js
diff --git a/doc/api/errors.md b/doc/api/errors.md
index fa73cb12036b..f54ba1d9058c 100644
--- a/doc/api/errors.md
+++ b/doc/api/errors.md
@@ -397,6 +397,32 @@ error object, such as a {Proxy}.
 Indicates the failure of an assertion. For details, see
 [`Class: assert.AssertionError`][].
 
+## Class: `DOMException`
+
+<!-- YAML
+added: v17.0.0
+-->
+
+* Extends: {errors.Error}
+
+The Web IDL {DOMException} class. These errors are thrown by web-platform APIs
+in Node.js such as [`fetch()`][], {AbortController}, {AbortSignal}, and Web
+Streams. For details, see also [`Class: DOMException`][] on the Globals page.
+
+The [`domException.name`][] property identifies the type of the exception (for
+example, `'AbortError'`). Unlike most errors in Node.js, the
+[`domException.code`][] property is a number that corresponds to a
+[legacy error code name][Web IDL error names] (for example, `20` for
+`ABORT_ERR`).
+
+Node.js-specific APIs that support {AbortSignal} (such as
+[`events.once()`][]) throw a Node.js `AbortError` (a native {errors.Error} with
+`name` of `'AbortError'` and `code` of [`'ABORT_ERR'`][ABORT_ERR]) rather than a
+{DOMException}. To identify abort errors in either case, checking
+`err?.name === 'AbortError'` is sufficient.
+
+See also [`ABORT_ERR`][].
+
 ## Class: `RangeError`
 
 * Extends: {errors.Error}
@@ -3057,8 +3083,9 @@ A call was made and the UDP subsystem was not running.
 ### `ERR_SOCKET_HANDLE_ADOPTED`
 
 An operation was attempted on a [`BoundSocket`][] that had already been adopted
-by a [`net.Server`][] or [`net.Socket`][]. Once a bound socket is adopted, its
-`address()` and `close()` methods can no longer be used.
+by a [`net.Server`][] or [`net.Socket`][], or transferred to another thread.
+Once a bound socket is adopted or transferred, its `address()` and `close()`
+methods can no longer be used.
 
 <a id="ERR_SOURCE_MAP_CORRUPT"></a>
 
@@ -3626,9 +3653,10 @@ The `Response` that has been passed to `WebAssembly.compileStreaming` or to
 
 ### `ERR_WORKER_HANDLE_NOT_TRANSFERABLE`
 
-An attempt was made to transfer a `net.Socket` or `net.Server` to another thread
-via a `worker_threads` `postMessage()` call while it was not in a transferable
-state, for example because it had already started reading or had buffered data.
+An attempt was made to transfer a `net.Socket`, `net.Server` or
+`net.BoundSocket` to another thread via a `worker_threads` `postMessage()` call
+while it was not in a transferable state, for example because it had already
+started reading, had buffered data, or had already been adopted.
 
 <a id="ERR_WORKER_INIT_FAILED"></a>
 
@@ -4680,6 +4708,7 @@ The public key in the certificate SubjectPublicKeyInfo could not be read.
 
 An error occurred trying to allocate memory. This should never happen.
 
+[ABORT_ERR]: #abort_err
 [ES Module]: esm.md
 [ICU]: intl.md#internationalization-support
 [JSON Web Key Elliptic Curve Registry]: https://www.iana.org/assignments/jose/jose.xhtml#web-key-elliptic-curve
@@ -4693,6 +4722,7 @@ An error occurred trying to allocate memory. This should never happen.
 [V8's stack trace API]: https://v8.dev/docs/stack-trace-api
 [WHATWG Supported Encodings]: util.md#whatwg-supported-encodings
 [WHATWG URL API]: url.md#the-whatwg-url-api
+[Web IDL error names]: https://webidl.spec.whatwg.org/#dfn-error-names-table
 [`"exports"`]: packages.md#exports
 [`"imports"`]: packages.md#imports
 [`'uncaughtException'`]: process.md#event-uncaughtexception
@@ -4700,7 +4730,9 @@ An error occurred trying to allocate memory. This should never happen.
 [`--force-fips`]: cli.md#--force-fips
 [`--no-addons`]: cli.md#--no-addons
 [`--unhandled-rejections`]: cli.md#--unhandled-rejectionsmode
+[`ABORT_ERR`]: #abort_err
 [`BoundSocket`]: net.md#class-netboundsocket
+[`Class: DOMException`]: globals.md#class-domexception
 [`Class: assert.AssertionError`]: assert.md#class-assertassertionerror
 [`ERR_INCOMPATIBLE_OPTION_PAIR`]: #err_incompatible_option_pair
 [`ERR_INVALID_ARG_TYPE`]: #err_invalid_arg_type
@@ -4729,10 +4761,13 @@ An error occurred trying to allocate memory. This should never happen.
 [`dgram.createSocket()`]: dgram.md#dgramcreatesocketoptions-callback
 [`dgram.disconnect()`]: dgram.md#socketdisconnect
 [`dgram.remoteAddress()`]: dgram.md#socketremoteaddress
+[`domException.code`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException/code
 [`domException.name`]: https://developer.mozilla.org/en-US/docs/Web/API/DOMException/name
 [`errno`(3) man page]: https://man7.org/linux/man-pages/man3/errno.3.html
 [`error.code`]: #errorcode
 [`error.message`]: #errormessage
+[`events.once()`]: events.md#eventsonceemitter-name-options
+[`fetch()`]: globals.md#fetch
 [`fs.Dir`]: fs.md#class-fsdir
 [`fs.cp()`]: fs.md#fscpsrc-dest-options-callback
 [`fs.readFileSync`]: fs.md#fsreadfilesyncpath-options
diff --git a/doc/api/fs.md b/doc/api/fs.md
index 1ad902ad5fb6..4d15a82e4a09 100644
--- a/doc/api/fs.md
+++ b/doc/api/fs.md
@@ -1637,6 +1637,9 @@ makeDirectory().catch(console.error);
 <!-- YAML
 added: v10.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
   - version:
     - v20.6.0
     - v18.19.0
@@ -1651,9 +1654,11 @@ changes:
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
-* Returns: {Promise}  Fulfills with a string containing the file system path
-  of the newly created temporary directory.
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
+* Returns: {Promise} Fulfills with the created directory path.
+  If `encoding` is `'buffer'`, then the resulting directory
+  path is returned as a {Buffer}. Otherwise, the path is returned as a
+  {string} using the specified encoding.
 
 Creates a unique temporary directory. A unique directory name is generated by
 appending six random characters to the end of the provided `prefix`. Due to
@@ -1686,20 +1691,25 @@ characters directly to the `prefix` string. For instance, given a directory
 
 <!-- YAML
 added: v24.4.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
 -->
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * Returns: {Promise} Fulfills with a Promise for an async-disposable Object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {AsyncFunction} A function which removes the created directory.
   * `[Symbol.asyncDispose]` {AsyncFunction} The same as `remove`.
 
 The resulting Promise holds an async-disposable object whose `path` property
-holds the created directory path. When the object is disposed, the directory
-and its contents will be removed asynchronously if it still exists. If the
-directory cannot be deleted, disposal will throw an error. The object has an
+holds the created directory path. If `encoding` is `'buffer'`, the `path` will
+also be a {Buffer}, otherwise a {string}. When the object is disposed, the
+directory and its contents will be removed asynchronously if it still exists. If
+the directory cannot be deleted, disposal will throw an error. The object has an
 async `remove()` method which will perform the same task.
 
 Both this function and the disposal function on the resulting object are
@@ -2975,7 +2985,9 @@ behavior is similar to `cp dir1/ dir2/`.
 <!-- YAML
 added: v0.1.31
 changes:
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63851
     description: Add the `windowsHandle` option.
   - version: v16.10.0
@@ -3112,7 +3124,9 @@ If `options` is a string, then it specifies the encoding.
 <!-- YAML
 added: v0.1.31
 changes:
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/63851
     description: Add the `windowsHandle` option.
   - version: v22.0.0
@@ -3975,6 +3989,9 @@ See the POSIX mkdir(2) documentation for more details.
 <!-- YAML
 added: v5.10.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
   - version:
     - v20.6.0
     - v18.19.0
@@ -4005,10 +4022,10 @@ changes:
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * `callback` {Function}
   * `err` {Error}
-  * `directory` {string}
+  * `directory` {string|Buffer}
 
 Creates a unique temporary directory.
 
@@ -4018,12 +4035,14 @@ inconsistencies, avoid trailing `X` characters in `prefix`. Some platforms,
 notably the BSDs, can return more than six random characters, and replace
 trailing `X` characters in `prefix` with random characters.
 
-The created directory path is passed as a string to the callback's second
-parameter.
-
 The optional `options` argument can be a string specifying an encoding, or an
 object with an `encoding` property specifying the character encoding to use.
 
+The created directory path is passed to the callback's second parameter. If
+`encoding` is `'buffer'`, then the resulting directory path is passed as a
+{Buffer}. Otherwise, the path is passed as a {string} using the specified
+encoding.
+
 ```mjs
 import { mkdtemp } from 'node:fs';
 import { join } from 'node:path';
@@ -6485,6 +6504,9 @@ See the POSIX mkdir(2) documentation for more details.
 <!-- YAML
 added: v5.10.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
   - version:
     - v20.6.0
     - v18.19.0
@@ -6499,10 +6521,12 @@ changes:
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
-* Returns: {string}
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
+* Returns: {string|Buffer}
 
-Returns the created directory path.
+Returns the created directory path. If `encoding` is `'buffer'`, then the
+resulting directory path is returned as a {Buffer}. Otherwise, the path
+is returned as a {string} using the specified encoding.
 
 For detailed information, see the documentation of the asynchronous version of
 this API: [`fs.mkdtemp()`][].
@@ -6514,21 +6538,25 @@ object with an `encoding` property specifying the character encoding to use.
 
 <!-- YAML
 added: v24.4.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64397
+    description: The `encoding` option now defaults to `'buffer'` if `prefix` is a `Buffer`.
 -->
 
 * `prefix` {string|Buffer|URL}
 * `options` {string|Object}
-  * `encoding` {string} **Default:** `'utf8'`
+  * `encoding` {string} **Default:** `'utf8'` (or `'buffer'` if `prefix` is a `Buffer`)
 * Returns: {Object} A disposable object:
-  * `path` {string} The path of the created directory.
+  * `path` {string|Buffer} The path of the created directory.
   * `remove` {Function} A function which removes the created directory.
   * `[Symbol.dispose]` {Function} The same as `remove`.
 
 Returns a disposable object whose `path` property holds the created directory
-path. When the object is disposed, the directory and its contents will be
-removed if it still exists. If the directory cannot be deleted, disposal will
-throw an error. The object has a `remove()` method which will perform the same
-task.
+path. If `encoding` is `'buffer'`, the `path` will be a {Buffer}. When the
+object is disposed, the directory and its contents will be removed if it still
+exists. If the directory cannot be deleted, disposal will throw an error. The
+object has a `remove()` method which will perform the same task.
 
 See the [MDN documentation on `using` statements][`using`] for more information about
 explicit resource management.
@@ -7330,8 +7358,9 @@ Asynchronously read the next directory entry via readdir(3) as an
 A promise is returned that will be fulfilled with an {fs.Dirent}, or `null`
 if there are no more directory entries to read.
 
-Directory entries returned by this function are in no particular order as
-provided by the operating system's underlying directory mechanisms.
+For directory reads handled by the native file system, directory entries
+returned by this function are in no particular order as provided by the
+operating system's underlying directory mechanisms.
 Entries added or removed while iterating over the directory might not be
 included in the iteration results.
 
diff --git a/doc/api/http2.md b/doc/api/http2.md
index fe31f970b2f4..f3d8ff6d85fc 100644
--- a/doc/api/http2.md
+++ b/doc/api/http2.md
@@ -669,10 +669,16 @@ added:
 
 * `windowSize` {number}
 
-Sets the local endpoint's window size.
+Sets the local endpoint's connection-level window size.
 The `windowSize` is the total window size to set, not
 the delta.
 
+Increases take effect immediately, but decreases only apply as the window
+already advertised to the peer is consumed, since a window that has been
+advertised cannot be retracted. To use a window smaller than the default from
+the start of the connection, set the `connectionWindowSize` option when
+creating the server or client session instead.
+
 ```mjs
 import { createServer } from 'node:http2';
 
@@ -2844,6 +2850,9 @@ Throws `ERR_INVALID_ARG_TYPE` for invalid `settings` argument.
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65619
+    description: Added the `connectionWindowSize` option.
   - version:
      - v25.7.0
      - v24.15.0
@@ -2961,6 +2970,13 @@ changes:
     error that should tell the peer to not open any more streams, continuing
     to open streams is therefore regarded as a sign of a misbehaving peer.
     **Default:** `100`.
+  * `connectionWindowSize` {number} Sets the initial flow control window for
+    each session, in bytes. This is the total amount of data the remote peer
+    may send across all streams before it has to wait for a `WINDOW_UPDATE`.
+    The equivalent per-stream limit is `settings.initialWindowSize`. The
+    minimum allowed value is `1` and the maximum is 2<sup>31</sup>-1. Values
+    below 65535 will not take effect until the initial protocol-default
+    window of 65535 has been used.
   * `settings` {HTTP/2 Settings Object} The initial settings to send to the
     remote peer upon connection.
   * `streamResetBurst` {number} and `streamResetRate` {number} Sets the rate
@@ -3072,6 +3088,9 @@ server.listen(8000);
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65619
+    description: Added the `connectionWindowSize` option.
   - version:
      - v25.7.0
      - v24.15.0
@@ -3180,6 +3199,14 @@ changes:
     error that should tell the peer to not open any more streams, continuing
     to open streams is therefore regarded as a sign of a misbehaving peer.
     **Default:** `100`.
+  * `connectionWindowSize` {number} Sets the initial flow control window for
+    each session, in bytes. This is the total amount of data the remote peer
+    may send across all streams before it has to wait for a `WINDOW_UPDATE`.
+    The equivalent per-stream limit is `settings.initialWindowSize`. The
+    minimum allowed value is `1` and the maximum is 2<sup>31</sup>-1. Values
+    below 65535 will not take effect until the initial protocol-default
+    window of 65535 has been used.
+    **Default:** `33554432`.
   * `settings` {HTTP/2 Settings Object} The initial settings to send to the
     remote peer upon connection.
   * `streamResetBurst` {number} and `streamResetRate` {number} Sets the rate
@@ -3276,6 +3303,9 @@ server.listen(8443);
 <!-- YAML
 added: v8.4.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65619
+    description: Added the `connectionWindowSize` option.
   - version:
       - v15.10.0
       - v14.16.0
@@ -3363,6 +3393,14 @@ changes:
   * `protocol` {string} The protocol to connect with, if not set in the
     `authority`. Value may be either `'http:'` or `'https:'`. **Default:**
     `'https:'`
+  * `connectionWindowSize` {number} Sets the initial flow control window for
+    this session, in bytes. This is the total amount of data the remote peer
+    may send across all streams before it has to wait for a `WINDOW_UPDATE`.
+    The equivalent per-stream limit is `settings.initialWindowSize`. The
+    minimum allowed value is `1` and the maximum is 2<sup>31</sup>-1. Values
+    below 65535 will not take effect until the initial protocol-default
+    window of 65535 has been used.
+    **Default:** `33554432`.
   * `settings` {HTTP/2 Settings Object} The initial settings to send to the
     remote peer upon connection.
   * `remoteCustomSettings` {Array} The array of integer values determines the
@@ -3795,6 +3833,9 @@ properties.
 * `initialWindowSize` {number} Specifies the _sender's_ initial window size in
   bytes for stream-level flow control. The minimum allowed value is 0. The
   maximum allowed value is 2<sup>32</sup>-1. **Default:** `4194304`.
+  This is a per-stream limit; the window for the connection as a whole is
+  configured separately with the `connectionWindowSize` option of
+  [`http2.createServer()`][] or [`http2.connect()`][].
 * `maxFrameSize` {number} Specifies the size in bytes of the largest frame
   payload. The minimum allowed value is 16,384. The maximum allowed value is
   2<sup>24</sup>-1. **Default:** `16384`.
@@ -5258,6 +5299,7 @@ you need to implement any fall-back behavior yourself.
 [`http.createServer()`]: http.md#httpcreateserveroptions-requestlistener
 [`http2.SecureServer`]: #class-http2secureserver
 [`http2.Server`]: #class-http2server
+[`http2.connect()`]: #http2connectauthority-options-listener
 [`http2.createSecureServer()`]: #http2createsecureserveroptions-onrequesthandler
 [`http2.createServer()`]: #http2createserveroptions-onrequesthandler
 [`http2stream.pushStream()`]: #http2streampushstreamheaders-options-callback
diff --git a/doc/api/index.md b/doc/api/index.md
index 146c0e13df65..a30724c064e1 100644
--- a/doc/api/index.md
+++ b/doc/api/index.md
@@ -9,6 +9,7 @@
 * [Assertion testing](assert.md)
 * [Asynchronous context tracking](async_context.md)
 * [Async hooks](async_hooks.md)
+* [Benchmark runner](bench.md)
 * [Buffer](buffer.md)
 * [C++ addons](addons.md)
 * [C/C++ addons with Node-API](n-api.md)
diff --git a/doc/api/module.md b/doc/api/module.md
index 1aac20780c4d..a4f83a812f96 100644
--- a/doc/api/module.md
+++ b/doc/api/module.md
@@ -2,19 +2,30 @@
 
 <!--introduced_in=v12.20.0-->
 
+> Stability: 2 - Stable
+
+<!-- source_link=lib/module.js -->
+
+The `node:module` module provides utilities for interacting with the Node.js
+module system.
+
+It can be accessed using:
+
+```mjs
+import module from 'node:module';
+```
+
+## Class: `Module`
+
 <!-- YAML
-added: v0.3.7
+added: v0.3.5
 -->
 
-## The `Module` object
+`module` objects in [CommonJS][] modules are instances of this class.
 
-* Type: {Object}
+See the CommonJS documentation for [the `module` object][].
 
-Provides general utility methods when interacting with instances of
-`Module`, the [`module`][] variable often seen in [CommonJS][] modules. Accessed
-via `import 'node:module'` or `require('node:module')`.
-
-### `module.builtinModules`
+## `module.builtinModules`
 
 <!-- YAML
 added:
@@ -29,25 +40,18 @@ changes:
 
 * Type: {string\[]}
 
-A list of the names of all modules provided by Node.js. Can be used to verify
-if a module is maintained by a third party or not.
-
-`module` in this context isn't the same object that's provided
-by the [module wrapper][]. To access it, require the `Module` module:
+A list of the names of all modules provided by Node.js.
 
 ```mjs
-// module.mjs
-// In an ECMAScript module
-import { builtinModules as builtin } from 'node:module';
+import { builtinModules } from 'node:module';
+console.log(builtinModules.filter((name) => name.startsWith('path')));
+// Prints: [ 'path', 'path/posix', 'path/win32' ]
 ```
 
-```cjs
-// module.cjs
-// In a CommonJS module
-const builtin = require('node:module').builtinModules;
-```
+To test whether a module name corresponds to a builtin module, use
+[`module.isBuiltin()`][].
 
-### `module.createRequire(filename)`
+## `module.createRequire(filename)`
 
 <!-- YAML
 added: v12.2.0
@@ -66,7 +70,7 @@ const require = createRequire(import.meta.url);
 const siblingModule = require('./sibling-module');
 ```
 
-### `module.findPackageJSON(specifier[, base])`
+## `module.findPackageJSON(specifier[, base])`
 
 <!-- YAML
 added:
@@ -154,7 +158,7 @@ findPackageJSON('@foo/qux', __filename);
 // '/path/to/project/packages/qux/package.json'
 ```
 
-### `module.isBuiltin(moduleName)`
+## `module.isBuiltin(moduleName)`
 
 <!-- YAML
 added:
@@ -172,7 +176,7 @@ isBuiltin('fs'); // true
 isBuiltin('wss'); // false
 ```
 
-### `module.register(specifier[, parentURL][, options])`
+## `module.register(specifier[, parentURL][, options])`
 
 <!-- YAML
 added:
@@ -222,7 +226,7 @@ resolution and loading behavior. See [Customization hooks][].
 
 This feature requires `--allow-worker` if used with the [Permission Model][].
 
-### `module.registerHooks(options)`
+## `module.registerHooks(options)`
 
 <!-- YAML
 added:
@@ -251,7 +255,7 @@ Register [hooks][] that customize Node.js module resolution and loading behavior
 See [Customization hooks][]. The returned object can be used to
 [deregister the hooks][deregistration of synchronous customization hooks].
 
-### `module.stripTypeScriptTypes(code[, options])`
+## `module.stripTypeScriptTypes(code[, options])`
 
 <!-- YAML
 added:
@@ -316,7 +320,7 @@ console.log(strippedCode);
 // Prints: const a         = 1\n\n//# sourceURL=source.ts;
 ```
 
-### `module.syncBuiltinESMExports()`
+## `module.syncBuiltinESMExports()`
 
 <!-- YAML
 added: v12.12.0
@@ -2094,9 +2098,9 @@ returned object contains the following keys:
 [`module.enableCompileCache()`]: #moduleenablecompilecacheoptions
 [`module.flushCompileCache()`]: #moduleflushcompilecache
 [`module.getCompileCacheDir()`]: #modulegetcompilecachedir
+[`module.isBuiltin()`]: #moduleisbuiltinmodulename
 [`module.registerHooks()`]: #moduleregisterhooksoptions
 [`module.setSourceMapsSupport()`]: #modulesetsourcemapssupportenabled-options
-[`module`]: #the-module-object
 [`os.tmpdir()`]: os.md#ostmpdir
 [`register`]: #moduleregisterspecifier-parenturl-options
 [`util.TextDecoder`]: util.md#class-utiltextdecoder
@@ -2109,11 +2113,11 @@ returned object contains the following keys:
 [hooks]: #customization-hooks
 [load hook]: #synchronous-loadurl-context-nextload
 [module compile cache]: #module-compile-cache
-[module wrapper]: modules.md#the-module-wrapper
 [realm]: https://tc39.es/ecma262/#realm
 [resolve hook]: #synchronous-resolvespecifier-context-nextresolve
 [source map include directives]: https://tc39.es/ecma426/#sec-linking-generated-code
 [synchronous hook functions]: #hook-functions-accepted-by-moduleregisterhooks
+[the `module` object]: modules.md#the-module-object
 [the documentation of `Worker`]: worker_threads.md#new-workerfilename-options
 [transferable objects]: worker_threads.md#portpostmessagevalue-transferlist
 [type-stripping]: typescript.md#type-stripping
diff --git a/doc/api/net.md b/doc/api/net.md
index d0b0e34c6504..f6fac2b6932a 100644
--- a/doc/api/net.md
+++ b/doc/api/net.md
@@ -99,7 +99,9 @@ Adds a rule to block the given IP address.
 ### `blockList.addAddresses(addresses[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `addresses` {string\[]|net.SocketAddress\[]} An array of IPv4 or IPv6
@@ -114,7 +116,9 @@ are inserted under a single internal lock acquisition.
 ### `blockList.addCIDR(cidr)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
@@ -128,7 +132,9 @@ the parsed network address, prefix length, and family.
 ### `blockList.addCIDRs(cidrs)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `cidrs` {string\[]} An array of IPv4 or IPv6 subnets in CIDR notation.
@@ -202,7 +208,9 @@ console.log(blockList.check('::ffff:123.123.123.123', 'ipv6')); // Prints: true
 ### `blockList.clear()`
 
 <!--
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 Clears all rules from the `BlockList`.
@@ -245,7 +253,9 @@ added:
 ### `BlockList.PRIVATE_RANGES`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {string\[]}
@@ -277,7 +287,9 @@ console.log(blockList.check('8.8.8.8'));       // Prints: false
 ### `blockList.removeAddress(address[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `address` {string|net.SocketAddress} An IPv4 or IPv6 address.
@@ -290,7 +302,9 @@ specified address does not exist, this is a no-op.
 ### `blockList.removeCIDR(cidr)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `cidr` {string} An IPv4 or IPv6 subnet in CIDR notation (e.g.
@@ -304,7 +318,9 @@ and family. If the specified subnet does not exist, this is a no-op.
 ### `blockList.removeRange(start, end[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `start` {string|net.SocketAddress} The starting IPv4 or IPv6 address in the
@@ -319,7 +335,9 @@ If the specified range does not exist, this is a no-op.
 ### `blockList.removeSubnet(net, prefix[, type])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `net` {string|net.SocketAddress} The network IPv4 or IPv6 address.
@@ -347,7 +365,9 @@ The list of rules added to the blocklist.
 ### `blockList.size`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -986,6 +1006,13 @@ server.listen(8000);
 A listening [`net.Server`][] can be transferred the same way, which moves the
 listening socket itself (and its pending accept queue) to the receiving thread.
 
+An un-adopted TCP [`BoundSocket`][] can also be transferred, which moves the
+bound (but not yet listening or connected) socket. This allows a port to be
+reserved synchronously on one thread and adopted by a server or outgoing
+connection on another. Pipe binds are not transferable. After the transfer, the
+source `BoundSocket` behaves as if it had been adopted: `address()`, `fd()` and
+`close()` throw [`ERR_SOCKET_HANDLE_ADOPTED`][].
+
 ### `new net.Socket([options])`
 
 <!-- YAML
@@ -1921,6 +1948,13 @@ file system entry; abstract and TCP binds have none to remove.
 When a pipe `BoundSocket` bound to a source `path` is adopted as a client, that
 path is reported as the socket's `localAddress` once it connects.
 
+An un-adopted TCP `BoundSocket` can be moved to another thread by listing it in
+the `transferList` of a [`worker_threads`][] `postMessage()` call, see
+[Transferring TCP handles to other threads][]. It can likewise be sent to a
+child process as the `sendHandle` argument of [`subprocess.send()`][]. In both
+cases the source is left in the adopted state. Pipe binds cannot be moved
+either way.
+
 When an adopted `BoundSocket` connects to a numeric IP literal, `connect(2)` is
 issued synchronously, so [`socket.localAddress`][] is resolved once
 [`socket.connect()`][] returns. Connection failures are still reported via a
@@ -2644,6 +2678,7 @@ console.log('listening on', server.address().port);
 [`socket.setTimeout()`]: #socketsettimeouttimeout-callback
 [`socket.setTimeout(timeout)`]: #socketsettimeouttimeout-callback
 [`stream.getDefaultHighWaterMark()`]: stream.md#streamgetdefaulthighwatermarkobjectmode
+[`subprocess.send()`]: child_process.md#subprocesssendmessage-sendhandle-options-callback
 [`worker_threads`]: worker_threads.md
 [`writable.destroy()`]: stream.md#writabledestroyerror
 [`writable.destroyed`]: stream.md#writabledestroyed
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index b9e00c63d2aa..8926fc0a16ec 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1091,6 +1091,54 @@ changes:
 The high resolution millisecond timestamp representing the time immediately
 before Node.js receives the first byte of the response from the server.
 
+### `performanceResourceTiming.finalResponseHeadersStart`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the final response,
+as opposed to an interim response.
+
+### `performanceResourceTiming.firstInterimResponseStart`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the first interim response, such as
+a `103 Early Hints` response.
+
+### `performanceResourceTiming.responseStart`
+
+<!-- YAML
+added:
+  - v18.2.0
+  - v16.17.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65017
+    description: This property now returns `firstInterimResponseStart`
+                 when it is non-zero.
+  - version: v19.0.0
+    pr-url: https://github.com/nodejs/node/pull/44483
+    description: This property getter must be called with the
+                 `PerformanceResourceTiming` object as the receiver.
+-->
+
+* Type: {number}
+
+The high resolution millisecond timestamp representing the time immediately
+after Node.js receives the first byte of the response from the server. This
+is `firstInterimResponseStart` when it is non-zero, and
+`finalResponseHeadersStart` otherwise.
+
 ### `performanceResourceTiming.responseEnd`
 
 <!-- YAML
@@ -1166,6 +1214,37 @@ A number representing the size (in octets) received from the fetch
 (HTTP or cache), of the message body, after removing any applied
 content-codings.
 
+### `performanceResourceTiming.renderBlockingStatus`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The render blocking status of the resource. It is either `'blocking'` or `'non-blocking'`.
+
+### `performanceResourceTiming.contentType`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The minimized MIME type of the content of the fetched resource, or an empty
+string if it cannot be determined.
+
+### `performanceResourceTiming.contentEncoding`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* Type: {string}
+
+The content encoding of the fetched resource, such as `'gzip'` or `'br'`.
+
 ### `performanceResourceTiming.toJSON()`
 
 <!-- YAML
@@ -1885,7 +1964,9 @@ added: v11.10.0
 ### `histogram.burnRate(sloTarget)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `sloTarget` {number} The SLO target as a fraction between 0 and 1
@@ -1940,7 +2021,9 @@ The number of samples recorded by the histogram.
 ### `histogram.ccdf(value)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `value` {number} The value to query.
@@ -1953,7 +2036,9 @@ will exceed `value`. Equivalent to `1 - histogram.cdf(value)`.
 ### `histogram.cdf(value)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `value` {number} The value to query.
@@ -1967,7 +2052,9 @@ than or equal to `value`. This is the inverse operation of
 ### `histogram.cliffsD(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -1982,7 +2069,9 @@ opposite; 0 means no tendency in either direction.
 ### `histogram.cohensD(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -1997,7 +2086,9 @@ Both histograms must have at least 2 recorded values; otherwise returns 0.
 ### `histogram.countAt(value)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `value` {number} The value to query.
@@ -2033,7 +2124,7 @@ loop delay threshold.
 ### `histogram.export()`
 
 <!-- YAML
-added: REPLACEME
+added: v24.21.0
 -->
 
 * Returns: {Uint8Array}
@@ -2082,7 +2173,9 @@ Returns `0` when EWMA is disabled or no values have been recorded.
 ### `histogram.ewmaStddev`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2094,7 +2187,9 @@ when EWMA is disabled or no values have been recorded.
 ### `histogram.ewmaErrorRate`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2107,7 +2202,9 @@ recorded.
 ### `histogram.ksTest(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2121,7 +2218,9 @@ detecting performance regressions by comparing before/after histograms.
 ### `histogram.kurtosis`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2134,7 +2233,9 @@ lighter tails.
 ### `histogram.linearBuckets(stepSize)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `stepSize` {number} The width of each linear bucket.
@@ -2146,7 +2247,9 @@ of `stepSize`. Useful for visualization and export.
 ### `histogram.logBuckets(firstBucket, base)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `firstBucket` {number} The value of the first bucket boundary.
@@ -2160,7 +2263,9 @@ Useful for visualization and export.
 ### `histogram.mannWhitneyTest(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2207,6 +2312,41 @@ added: v11.10.0
 
 The mean of the recorded event loop delays.
 
+### `histogram.meanCI([options])`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `options` {Object}
+  * `confidence` {number} The confidence level for the interval, between
+    0 and 1 (exclusive). **Default:** `0.95`.
+* Returns: {Object}
+  * `mean` {number} The mean estimate, equivalent to `histogram.mean`.
+  * `lower` {number} The lower bound of the confidence interval.
+  * `upper` {number} The upper bound of the confidence interval.
+
+Returns a two-sided confidence interval for the mean using Student's
+t-distribution and the sample standard error. A higher confidence level
+produces a wider interval. This interval assumes that samples are independent
+and approximately normally distributed, although the approximation is robust
+for sufficiently large samples.
+
+The result reflects the histogram's configured precision and is calculated
+from the values represented by its buckets. With fewer than two recorded
+values, `lower` and `upper` are `NaN`. When all recorded values are equal,
+`lower` and `upper` equal `mean`.
+
+```js
+const { createHistogram } = require('node:perf_hooks');
+
+const h = createHistogram();
+for (let i = 1; i <= 100; i++) h.record(i);
+
+const { mean, lower, upper } = h.meanCI();
+console.log(`mean=${mean}, 95% CI=[${lower}, ${upper}]`);
+```
+
 ### `histogram.min`
 
 <!-- YAML
@@ -2256,7 +2396,9 @@ Returns the value at the given percentile.
 ### `histogram.percentileCI(percentile[, options])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `percentile` {number} A percentile value in the range (0, 100].
@@ -2312,7 +2454,9 @@ Returns a `Map` object detailing the accumulated percentile distribution.
 ### `histogram.percentilesAt(percentiles)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `percentiles` {number\[]} An array of percentile values in the range (0, 100].
@@ -2334,7 +2478,9 @@ Resets the collected histogram data.
 ### `histogram.skewness`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * Type: {number}
@@ -2357,7 +2503,9 @@ The standard deviation of the recorded event loop delays.
 ### `histogram.welchTest(other[, options])`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {Histogram} The histogram to compare against.
@@ -2473,7 +2621,9 @@ previous call to `recordDelta()` and records that amount in the histogram.
 ### `histogram.recordCorrected(val, expectedInterval)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `val` {number|bigint} The value to record.
@@ -2488,7 +2638,9 @@ latency.
 ### `histogram.subtract(other)`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `other` {RecordableHistogram}
diff --git a/doc/api/quic.md b/doc/api/quic.md
index a9e7414f4a3e..9cbff24bc086 100644
--- a/doc/api/quic.md
+++ b/doc/api/quic.md
@@ -2779,8 +2779,8 @@ added: v23.8.0
 
 The endpoint maintains an internal cache of validated socket addresses as a
 performance optimization. This option sets the maximum number of addresses
-that are cached. This is an advanced option that users typically won't have
-need to specify.
+that are cached. The value must be greater than `0`. This is an advanced option
+that users typically won't have need to specify.
 
 #### `endpointOptions.disableStatelessReset`
 
diff --git a/doc/api/single-executable-applications.md b/doc/api/single-executable-applications.md
index be5667cbd499..5083d16894d6 100644
--- a/doc/api/single-executable-applications.md
+++ b/doc/api/single-executable-applications.md
@@ -116,6 +116,7 @@ The configuration currently reads the following top-level fields:
   "disableExperimentalSEAWarning": true, // Default: false
   "useSnapshot": false,  // Default: false
   "useCodeCache": true, // Default: false
+  "useVfs": true, // Default: false
   "execArgv": ["--no-warnings", "--max-old-space-size=4096"], // Optional
   "execArgvExtension": "env", // Default: "env", options: "none", "env", "cli"
   "assets": {  // Optional
@@ -175,6 +176,105 @@ const raw = getRawAsset('a.jpg');
 See documentation of the [`sea.getAsset()`][], [`sea.getAssetAsBlob()`][],
 [`sea.getRawAsset()`][] and [`sea.getAssetKeys()`][] APIs for more information.
 
+### Virtual file system (VFS) for assets
+
+<!-- YAML
+added: REPLACEME
+-->
+
+> Stability: 1.0 - Early development
+
+In addition to using the `node:sea` API to access individual assets, the
+bundled assets can be exposed as a read-only [virtual file system][] and
+accessed through standard `node:fs` APIs. To enable this, set
+`"useVfs": true` in the SEA configuration.
+
+A virtual file system never shadows the real file system: it is mounted at a
+reserved mount point that cannot exist on the real file system, and the mount
+point is chosen at runtime rather than being a fixed path. When `useVfs` is
+enabled, the injected main script itself is placed at the root of the mount
+and executed from there, so `__filename` and `__dirname` point inside the
+virtual file system instead of reflecting [`process.execPath`][]. Bundled
+code therefore reaches the assets through `__dirname`-relative paths and
+relative [`require()`][] calls, without having to know the mount point:
+
+```cjs
+const fs = require('node:fs');
+const path = require('node:path');
+
+// __dirname is the root of the virtual file system holding the assets.
+const rawConfig = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const data = fs.readFileSync(path.join(__dirname, 'data/file.txt'));
+
+// Directory operations work too.
+const files = fs.readdirSync(path.join(__dirname, 'assets'));
+
+// Check if a bundled file exists.
+if (fs.existsSync(path.join(__dirname, 'optional.json'))) {
+  // ...
+}
+```
+
+The VFS supports the `node:fs` operations for reading files and directories.
+Since the SEA VFS is read-only, write operations fail with `EROFS`. See the
+[VFS documentation][] for the full list of supported operations.
+
+#### Loading modules from the VFS in a SEA
+
+When `useVfs` is enabled, the main script is executed from inside the
+virtual file system, and `require()` uses the [module loader
+integration][] of the VFS to load modules from the bundled assets. This
+supports relative requires (e.g. `require('./helper.js')`) as well as
+`node_modules` package lookups, which are confined to the mount:
+
+```cjs
+// Require bundled modules using relative paths.
+const myModule = require('./lib/mymodule.js');
+
+// Packages bundled under the node_modules asset prefix also resolve.
+const dep = require('some-package');
+```
+
+#### ESM entry points
+
+`"useVfs": true` also supports `"mainFormat": "module"`. The ESM main
+script is loaded from inside the mount through the ESM loader, so
+`import.meta.url`, `import.meta.filename`, and `import.meta.dirname`
+reflect the location of the main script in the virtual file system, and
+static and dynamic imports resolve against the bundled assets:
+
+```mjs
+import fs from 'node:fs';
+import path from 'node:path';
+
+// import.meta.dirname is the root of the virtual file system.
+const data = fs.readFileSync(
+  path.join(import.meta.dirname, 'data/file.txt'));
+
+// Relative and bare specifier imports resolve inside the mount.
+import myModule from './lib/mymodule.mjs';
+const lazy = await import('./lib/lazy.mjs');
+```
+
+Module format detection works the same way as on the real file
+system: name bundled ES modules with the `.mjs` extension (or provide the
+relevant `package.json` files as assets) so they are interpreted as ESM.
+
+#### Snapshot and code caching limitations
+
+`"useVfs": true` cannot be used together with `"useSnapshot": true` or
+`"useCodeCache": true`. The code cache limitation is due to incomplete
+implementation, not a technical impossibility. Consider bundling the
+application if startup performance matters and do not rely on module loading
+from the VFS in that case.
+
+#### Native addon limitations
+
+Native addons (`.node` files) cannot be loaded directly from the VFS because
+`process.dlopen()` requires files on the real file system. To use native
+addons in a SEA with VFS, write the asset to a temporary file first. See
+[Using native addons in the injected main script][] for an example.
+
 ### Startup snapshot support
 
 The `useSnapshot` field can be used to enable startup snapshot support. In this
@@ -648,6 +748,8 @@ to help us document them.
 [Generating single executable preparation blobs]: #1-generating-single-executable-preparation-blobs
 [Mach-O]: https://en.wikipedia.org/wiki/Mach-O
 [PE]: https://en.wikipedia.org/wiki/Portable_Executable
+[Using native addons in the injected main script]: #using-native-addons-in-the-injected-main-script
+[VFS documentation]: vfs.md
 [Windows SDK]: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/
 [`process.execPath`]: process.md#processexecpath
 [`require()`]: modules.md#requireid
@@ -660,8 +762,10 @@ to help us document them.
 [`v8.startupSnapshot` API]: v8.md#startup-snapshot-api
 [documentation about startup snapshot support in Node.js]: cli.md#--build-snapshot
 [fuse]: https://www.electronjs.org/docs/latest/tutorial/fuses
+[module loader integration]: vfs.md#module-loader-integration
 [postject]: https://github.com/nodejs/postject
 [postject-linux-arm64-issue]: https://github.com/nodejs/postject/issues/105
 [signtool]: https://learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
 [single executable applications]: https://github.com/nodejs/single-executable
 [supported by Node.js]: https://github.com/nodejs/node/blob/main/BUILDING.md#platform-list
+[virtual file system]: vfs.md
diff --git a/doc/api/sqlite.md b/doc/api/sqlite.md
index 8a875035f8cb..36804b060e80 100644
--- a/doc/api/sqlite.md
+++ b/doc/api/sqlite.md
@@ -101,7 +101,7 @@ exception.
 
 | Storage class | JavaScript to SQLite                                            | SQLite to JavaScript                  |
 | ------------- | --------------------------------------------------------------- | ------------------------------------- |
-| `NULL`        | {null}                                                          | {null}                                |
+| `NULL`        | {null} or {undefined}                                           | {null}                                |
 | `INTEGER`     | {number}, {bigint}, or {boolean}                                | {number} or {bigint} _(configurable)_ |
 | `REAL`        | {number}                                                        | {number}                              |
 | `TEXT`        | {string}                                                        | {string}                              |
@@ -113,6 +113,10 @@ values (`1n` and `0n`) when reading BigInts is enabled. Writing a {bigint} that
 does not fit in a signed 64-bit integer throws an `ERR_INVALID_ARG_VALUE`
 error.
 
+`undefined` is written as `NULL`, so passing it explicitly is equivalent to
+omitting a named parameter. `NULL` always reads back as {null}, never
+`undefined`.
+
 APIs that read values from SQLite have a configuration option that determines
 whether `INTEGER` values are converted to `number` or `bigint` in JavaScript,
 such as the `readBigInts` option for statements and the `useBigIntArguments`
@@ -243,7 +247,8 @@ Registers a new aggregate function with the SQLite database. This method is a wr
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `options.step` and `options.inverse` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `inverse` and `step` must be invoked with exactly `length` arguments.
+    `inverse` and `step` must be invoked with exactly `length` arguments, and
+    their `length` properties must be integers.
     **Default:** `false`.
   * `start` {number | string | null | Array | Object | Function} The identity
     value for the aggregation function. This value is used when the aggregation
@@ -430,7 +435,8 @@ added:
     JavaScript numbers. **Default:** `false`.
   * `varargs` {boolean} If `true`, `function` may be invoked with any number of
     arguments (between zero and [`SQLITE_MAX_FUNCTION_ARG`][]). If `false`,
-    `function` must be invoked with exactly `function.length` arguments.
+    `function` must be invoked with exactly `function.length` arguments, which
+    must be an integer.
     **Default:** `false`.
 * `fn` {Function} The JavaScript function to call when the SQLite function is
   invoked. The return value of this function should be a valid SQLite data type:
@@ -709,7 +715,9 @@ changes:
   - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/62757
     description: Add the `persistent` option.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/65157
     description: Throw `ERR_INVALID_ARG_VALUE` if `sql` contains no statements.
 -->
@@ -1089,6 +1097,11 @@ Binding a key that does not name a parameter of the statement throws an
 `ERR_INVALID_STATE` error unless unknown named parameters are ignored. See
 [`statement.setAllowUnknownNamedParameters()`][].
 
+Parameters that are never bound are `NULL`, and binding `undefined` has the same
+effect, so `{ $a: undefined }` and `{}` are equivalent. Because `undefined` is
+not an object, passing it in place of `namedParameters` binds it as an anonymous
+parameter instead.
+
 See [Type conversion between JavaScript and SQLite][] for the values that can be
 bound. Binding any other value throws an `ERR_INVALID_ARG_TYPE` error.
 
@@ -1097,10 +1110,17 @@ bound. Binding any other value throws an `ERR_INVALID_ARG_TYPE` error.
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1112,7 +1132,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Array} An array of objects. Each object corresponds to a row
   returned by executing the prepared statement. The keys and values of each
@@ -1185,10 +1206,17 @@ execution of this prepared statement. This property is a wrapper around
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1200,7 +1228,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Object|undefined} An object corresponding to the first row returned
   by executing the prepared statement. The keys and values of the object
@@ -1220,10 +1249,17 @@ added:
   - v23.4.0
   - v22.13.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1235,7 +1271,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Iterator} An iterable iterator of objects. Each object corresponds to a row
   returned by executing the prepared statement. The keys and values of each
@@ -1264,10 +1301,17 @@ executions of the same prepared statement.
 <!-- YAML
 added: v22.5.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
   - version:
@@ -1279,7 +1323,8 @@ changes:
 
 * `namedParameters` {Object} An optional object used to bind named parameters.
   The keys of this object are used to configure the mapping.
-* `...anonymousParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...anonymousParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Zero or more values to bind to anonymous parameters.
 * Returns: {Object}
   * `changes` {number|bigint} The number of rows modified, inserted, or deleted
@@ -1448,17 +1493,25 @@ class execute synchronously.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Array} An array of objects representing the rows returned by the query.
 
@@ -1473,17 +1526,25 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Object | undefined} An object representing the first row returned by
   the query, or `undefined` if no rows are returned.
@@ -1498,17 +1559,25 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Iterator} An iterator that yields objects representing the rows returned by the query.
 
@@ -1522,17 +1591,25 @@ called directly.
 <!-- YAML
 added: v24.9.0
 changes:
-  - version: v26.8.0
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65709
+    description: Bind `undefined` to `NULL`.
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62001
     description: Add support for boolean values in bound parameters.
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/62061
     description: Add support for `ArrayBuffer` and `SharedArrayBuffer` objects in bound parameters.
 -->
 
 * `stringElements` {string\[]} Template literal elements containing the SQL
   query.
-* `...boundParameters` {null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
+* `...boundParameters`
+  {undefined|null|number|bigint|boolean|string|Buffer|TypedArray|DataView|ArrayBuffer|SharedArrayBuffer}
   Parameter values to be bound to placeholders in the template string.
 * Returns: {Object} An object containing information about the execution, including `changes` and `lastInsertRowid`.
 
diff --git a/doc/api/stream_iter.md b/doc/api/stream_iter.md
index c1ebacd3dfad..f2fbba2286e0 100644
--- a/doc/api/stream_iter.md
+++ b/doc/api/stream_iter.md
@@ -401,6 +401,12 @@ const { writer, readable } = push({
 A writer is any object conforming to the Writer interface. Only `write()` is
 required; all other methods are optional.
 
+Writer arguments use Web IDL conversion semantics. A non-`Uint8Array` chunk is
+converted to a `USVString` and then UTF-8 encoded. `writev()` and
+`writevSync()` accept any iterable object whose values can be converted to
+chunks. Writer option dictionaries treat `null` as an empty dictionary and
+ignore unknown members.
+
 Each async method has a synchronous `*Sync` counterpart designed for a
 try-fallback pattern: attempt the fast synchronous path first, and fall back
 to the async version only when the synchronous call indicates it could not
@@ -417,9 +423,13 @@ writer.fail(err);  // Always synchronous, no fallback needed
 
 * {boolean|null}
 
-Returns `true` if the next write is likely to be accepted (buffered data is
-below capacity), `false` if backpressure is active, or `null` if the writer
-is closed or the consumer has disconnected.
+Returns `true` if the slots buffer has physical capacity (buffered data is
+below the configured byte budget), `false` if the budget is exhausted, or
+`null` if the writer is closed or the consumer has disconnected.
+
+This reports physical capacity independently of the backpressure policy. With
+`'drop-oldest'` or `'drop-newest'`, writes still complete when this is `false`
+by evicting buffered data or discarding the incoming data, respectively.
 
 This is a hint, not a guarantee: the state can change between the check and
 the write. Use [`ondrain()`][] to wait for capacity rather than polling.
@@ -431,7 +441,11 @@ the write. Use [`ondrain()`][] to wait for capacity rather than polling.
     the pending `end()` call; it does not fail the writer itself.
 * Returns: {Promise} Fulfills with the total number of bytes written.
 
-Signals that no more data will be written and waits for buffered data to drain.
+Signals that no more data will be written. Writes already waiting for buffer
+space remain ordered before the end of the stream, while later writes fail. If
+data is outstanding, the returned promise fulfills after the consumer pulls
+`done: true` beyond the final batch. If no data is buffered or pending, the
+writer closes immediately.
 
 #### `writer.endSync()`
 
@@ -449,14 +463,21 @@ if (result < 0) {
 }
 ```
 
-#### `writer.fail(reason)`
+#### `writer.fail([reason])`
 
 * `reason` {any}
 
 Put the writer into a terminal error state. If the writer is already closed
 or errored, this is a no-op. Unlike `write()` and `end()`, `fail()` is
 unconditionally synchronous because failing a writer is a pure state
-transition with no async work to perform.
+transition with no async work to perform. The reason is stored and propagated
+without modification. If omitted, the reason is `undefined`.
+
+#### `writer[Symbol.asyncDispose]()`
+
+If the writer is open, calls `writer.fail()`. If the writer is closing after
+`end()` or `endSync()`, waits for buffered data to drain. If the writer is
+already closed or errored, resolves immediately.
 
 #### `writer.write(chunk[, options])`
 
@@ -478,7 +499,7 @@ Synchronous write. Does not block; returns `false` if backpressure is active.
 
 #### `writer.writev(chunks[, options])`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * `options` {Object}
   * `signal` {AbortSignal} Cancel just this write operation. The signal cancels
     only the pending `writev()` call; it does not fail the writer itself.
@@ -488,7 +509,7 @@ Write multiple chunks as a single batch.
 
 #### `writer.writevSync(chunks)`
 
-* `chunks` {Uint8Array\[]|string\[]}
+* `chunks` {Iterable} of {Uint8Array|string} values
 * Returns: {boolean} `true` if the write was accepted, `false` if the
   buffer is full.
 
@@ -507,6 +528,12 @@ import { from, pull, bytes, Stream } from 'node:stream/iter';
 Stream.from('hello');
 ```
 
+Options dictionaries defined by the Iterable Streams API use Web IDL
+conversion semantics. `null` is treated as an empty dictionary, unknown
+members are ignored, and known members are converted to their declared types
+before the operation runs. Conversion failures use Node.js error codes such as
+`ERR_INVALID_ARG_TYPE`, `ERR_INVALID_ARG_VALUE`, and `ERR_OUT_OF_RANGE`.
+
 ```cjs
 // Named exports
 const { from, pull, bytes, Stream } = require('node:stream/iter');
@@ -533,7 +560,8 @@ added:
 
 Create an async byte stream from the given input. Strings are UTF-8 encoded.
 `ArrayBuffer` and `ArrayBufferView` values are wrapped as `Uint8Array`. Arrays
-and iterables in `input` are recursively flattened and normalized.
+and iterables in `input` are recursively flattened and normalized. Flattened
+values may be split across implementation-defined bounded batches.
 
 Objects implementing `Symbol.for('Stream.toAsyncStreamable')` or
 `Symbol.for('Stream.toStreamable')` are converted via those protocols. The
@@ -605,7 +633,8 @@ added:
 * `...transforms` {Function|Object} Zero or more transforms to apply.
 * `writer` {Object} Destination with `write(chunk)` method.
 * `options` {Object}
-  * `signal` {AbortSignal} Abort the pipeline.
+  * `signal` {AbortSignal} Abort the pipeline. Aborting fails the destination
+    writer unless `preventFail` is `true`.
   * `preventClose` {boolean} If `true`, do not call `writer.end()` when
     the source ends. **Default:** `false`.
   * `preventFail` {boolean} If `true`, do not call `writer.fail()` on
@@ -688,8 +717,10 @@ added:
   * `signal` {AbortSignal} Abort the pipeline.
 * Returns: {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
 
-Create a lazy async pipeline. Data is not read from `source` until the
-returned iterable is consumed. Transforms are applied in order.
+Create a lazy async pipeline. Source conversion and streamable protocol
+dispatch occur when `pull()` is called, but data is not read from `source`
+until the returned iterable is consumed. A signal that is already aborted is
+thrown synchronously after source conversion. Transforms are applied in order.
 
 ```mjs
 import { from, pull, text } from 'node:stream/iter';
@@ -759,7 +790,8 @@ added:
 * `...transforms` {Function|Object} Zero or more sync transforms.
 * Returns: {Iterable} whose chunks return {Uint8Array\[]}
 
-Synchronous version of [`pull()`][]. All transforms must be synchronous.
+Synchronous version of [`pull()`][]. Source conversion and streamable protocol
+dispatch occur when `pullSync()` is called. All transforms must be synchronous.
 
 ## Push streams
 
@@ -779,7 +811,9 @@ added:
     **Default:** `16384`.
   * `backpressure` {string} Backpressure policy: `'strict'`, `'unbounded'`,
     `'drop-oldest'`, or `'drop-newest'`. **Default:** `'strict'`.
-  * `signal` {AbortSignal} Abort the stream.
+  * `signal` {AbortSignal} Abort the stream. The signal remains active while
+    buffered data drains after `writer.end()`; aborting during that time fails
+    the writer and rejects the pending `end()` promise.
 * Returns: {Object}
   * `writer` {Writable} The writer side.
   * `readable` {AsyncIterable} whose chunks fulfill with {Uint8Array\[]}
@@ -839,7 +873,7 @@ added:
 
 * `options` {Object}
   * `budget` {number} Buffer size in bytes for both directions.
-    **Default:** `16384`.
+    Must be >= 16384. **Default:** `16384`.
   * `backpressure` {string} Policy for both directions.
     **Default:** `'strict'`.
   * `signal` {AbortSignal} Cancellation signal for both channels.
@@ -1089,9 +1123,13 @@ added:
 * `drainable` {Object} An object implementing the drainable protocol.
 * Returns: {Promise|null}
 
-Wait for a drainable writer's backpressure to clear. Returns `null` if
-the object does not implement the drainable protocol, or a promise that
-fulfills with `true` when the writer can accept more data.
+Wait for a drainable writer to regain physical buffer capacity. Returns `null`
+if the object does not implement the drainable protocol, or a promise that
+fulfills with `true` when buffered data falls below the byte budget.
+
+For writers using `'drop-oldest'` or `'drop-newest'`, this waits for physical
+capacity even though writes do not block. This allows producers to avoid data
+loss by waiting before writing.
 
 ```mjs
 import { push, ondrain, text } from 'node:stream/iter';
@@ -1300,9 +1338,10 @@ run().catch(console.error);
 
 #### `broadcast.cancel([reason])`
 
-* `reason` {Error}
+* `reason` {any}
 
-Cancel the broadcast. All consumers receive an error.
+Cancel the broadcast. If `reason` is provided, all consumers reject with that
+exact reason. If it is omitted, consumers complete normally.
 
 #### `broadcast.consumerCount`
 
@@ -1354,6 +1393,7 @@ added:
     **Default:** `65536`.
   * `backpressure` {string} `'strict'`, `'unbounded'`, `'drop-oldest'`, or
     `'drop-newest'`. **Default:** `'strict'`.
+  * `signal` {AbortSignal}
 * Returns: {Share}
 
 Create a pull-model multi-consumer shared stream. Unlike `broadcast()`, the
@@ -1409,9 +1449,10 @@ Create a {Share} from an existing source.
 
 #### `share.cancel([reason])`
 
-* `reason` {Error}
+* `reason` {any}
 
-Cancel the share. All consumers receive an error.
+Cancel the share. If `reason` is provided, all consumers reject with that exact
+reason. If it is omitted, consumers complete normally.
 
 #### `share.consumerCount`
 
@@ -1483,9 +1524,10 @@ The number of chunks currently buffered.
 
 #### `share.cancel([reason])`
 
-* `reason` {Error}
+* `reason` {any}
 
-Cancel the share. All consumers receive an error.
+Cancel the share. If `reason` is provided, all consumers throw that exact
+reason. If it is omitted, consumers complete normally.
 
 #### `share.consumerCount`
 
@@ -1609,6 +1651,11 @@ the synchronous Writer methods (`writeSync`, `writevSync`, `endSync`) always
 return `false` or `-1`, deferring to the async path. The per-write
 `options.signal` parameter from the Writer interface is also ignored.
 
+If `writer.fail(reason)` receives a non-Error reason, the classic Writable is
+destroyed with an `ERR_FALSY_VALUE_REJECTION` or `ERR_OPERATION_FAILED` error.
+Its `reason` property contains the original value, which remains the Writer's
+stored failure reason.
+
 The result is cached per instance and backpressure policy -- calling
 `fromWritable()` twice with the same stream and `backpressure` option returns
 the same Writer.
@@ -1667,6 +1714,11 @@ Creates a byte-mode [`stream.Readable`][] from the `source`
 (the native batch format used by the stream/iter API). Each `Uint8Array` in a
 yielded batch is pushed as a separate chunk into the Readable.
 
+Classic streams cannot represent arbitrary values as emitted errors. A
+non-Error reason is wrapped in an `ERR_FALSY_VALUE_REJECTION` or
+`ERR_OPERATION_FAILED` error whose `reason` property contains the original
+value.
+
 ```mjs
 import { createWriteStream } from 'node:fs';
 import { from, pull, toReadable } from 'node:stream/iter';
@@ -1751,6 +1803,11 @@ sync path returns `false`. Similarly, `_final()` tries `endSync()`
 before `end()`. When the sync path succeeds, the callback is deferred via
 `queueMicrotask` to preserve the async resolution contract.
 
+Classic stream callbacks cannot represent arbitrary values as errors. A
+non-Error reason is wrapped in an `ERR_FALSY_VALUE_REJECTION` or
+`ERR_OPERATION_FAILED` error before it is passed to the callback. The error's
+`reason` property contains the original value.
+
 The Writable's `highWaterMark` is set to `Number.MAX_SAFE_INTEGER` to
 effectively disable its internal buffering, allowing the underlying Writer
 to manage backpressure directly.
diff --git a/doc/api/tls.md b/doc/api/tls.md
index c8e12eaacf62..7df2ab938606 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -1095,7 +1095,7 @@ property is set only when `tlsSocket.authorized === false`.
 <!-- YAML
 added: v0.11.4
 changes:
-  - version: REPLACEME
+  - version: v26.8.0
     pr-url: https://github.com/nodejs/node/pull/64677
     description: On TLS 1.3, a resumed session where the client presented no
                  certificate is no longer reported as authorized.
diff --git a/doc/api/tty.md b/doc/api/tty.md
index 5af3c454fe2f..8fee96bb4c6d 100644
--- a/doc/api/tty.md
+++ b/doc/api/tty.md
@@ -70,7 +70,9 @@ A `boolean` that is always `true` for `tty.ReadStream` instances.
 <!-- YAML
 added: v0.7.7
 changes:
-  - version: v26.8.0
+  - version:
+     - v26.8.0
+     - v24.21.0
     pr-url: https://github.com/nodejs/node/pull/64140
     description: The `mode` argument supports `'raw'` and `'io'`.
 -->
@@ -104,7 +106,9 @@ Windows.
 ### `readStream.rawMode`
 
 <!-- YAML
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * {boolean|string}
diff --git a/doc/api/util.md b/doc/api/util.md
index f9bfed5b5998..81ccff315d1a 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -1691,6 +1691,17 @@ console.log(util.isDeepStrictEqual(foo, bar, true));
 See [`assert.deepStrictEqual()`][] for more information about deep strict
 equality.
 
+## `util.markPromiseAsHandled(promise)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+* `promise` {promise} The promise to mark as handled
+
+Marks a promise as handled so that unhandled rejections are ignored and are not
+reported to the `'unhandledrejection'` event.
+
 ## Class: `util.MIMEType`
 
 <!-- YAML
@@ -1899,7 +1910,9 @@ console.log(JSON.stringify(myMIMES));
 ### `MIMEType.parse(string)`
 
 <!--
-added: v26.8.0
+added:
+ - v26.8.0
+ - v24.21.0
 -->
 
 * `string` {string} The input MIME to parse
diff --git a/doc/api/vfs.md b/doc/api/vfs.md
index ccf8d159cbfe..6f67a85ad8a8 100644
--- a/doc/api/vfs.md
+++ b/doc/api/vfs.md
@@ -419,6 +419,43 @@ system, the callers are responsible for avoiding removal or
 invalidation of modules in the virtual file system while they are
 being loaded.
 
+Native addons (`.node` files) stored in a mounted VFS can be `require()`d as
+well. The operating system's dynamic loader cannot open a virtual path, so the
+addon's bytes are read from the VFS and loaded from a private, self-cleaning
+temporary image instead. Addons on the real file system are unaffected and
+load directly.
+
+## Use with Single Executable Applications
+
+When running as a [Single Executable Application][] built with
+`"useVfs": true` in the SEA configuration, the bundled assets are
+automatically mounted as a read-only virtual file system and the injected
+main script is executed from the root of the mount. No additional setup is
+required. Since the mount point is reserved and chosen at runtime, bundled
+code accesses the assets through `__dirname`-relative paths and relative
+`require()` calls rather than through a fixed path:
+
+```cjs
+// In the SEA main script, __dirname is the root of the mounted assets.
+const fs = require('node:fs');
+const path = require('node:path');
+
+const config = JSON.parse(
+  fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8'));
+const template = fs.readFileSync(
+  path.join(__dirname, 'templates/index.html'), 'utf8');
+```
+
+ESM entry points (`"mainFormat": "module"`) are supported: the main module
+is loaded from inside the mount through the ESM loader, and
+`import.meta.dirname` points at the mount root.
+
+`"useVfs"` cannot be used together with `"useSnapshot"` or `"useCodeCache"`.
+The SEA configuration parser will error if either combination is detected.
+
+See the [Single Executable Application][] documentation for more information
+on creating SEA builds with assets.
+
 ## Class: `VirtualProvider`
 
 <!-- YAML
@@ -591,6 +628,7 @@ fields use synthetic but stable values:
 [CommonJS resolution algorithm]: modules.md#all-together
 [ES modules resolution algorithm]: esm.md#resolution-algorithm
 [Explicit Resource Management]: https://github.com/tc39/proposal-explicit-resource-management
+[Single Executable Application]: single-executable-applications.md
 [`MemoryProvider`]: #class-memoryprovider
 [`RealFSProvider`]: #class-realfsprovider
 [`VirtualFileSystem`]: #class-virtualfilesystem
diff --git a/doc/api/webcrypto.md b/doc/api/webcrypto.md
index 6e2acacd5854..1d94af41363c 100644
--- a/doc/api/webcrypto.md
+++ b/doc/api/webcrypto.md
@@ -2,6 +2,9 @@
 
 <!-- YAML
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
      - v25.9.0
      - v24.18.0
@@ -136,6 +139,9 @@ Algorithms:
 * `'ML-KEM-512'`[^openssl35]
 * `'ML-KEM-768'`[^openssl35]
 * `'ML-KEM-1024'`[^openssl35]
+* `'MLKEM768-P256'`[^openssl35]
+* `'MLKEM768-X25519'`[^openssl35]
+* `'MLKEM1024-P384'`[^openssl35]
 * `'SHA3-256'`
 * `'SHA3-384'`
 * `'SHA3-512'`
@@ -531,9 +537,10 @@ Crypto API implementation and the APIs supported for each:
   `'ECDSA'`, `'Ed25519'`, `'Ed448'`[^secure-curves],
   `'ML-DSA-44'`[^modern-algos], `'ML-DSA-65'`[^modern-algos],
   `'ML-DSA-87'`[^modern-algos], `'ML-KEM-512'`[^modern-algos],
-  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos], `'RSA-OAEP'`,
-  `'RSA-PSS'`, `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and
-  `'X448'`[^secure-curves].
+  `'ML-KEM-768'`[^modern-algos], `'ML-KEM-1024'`[^modern-algos],
+  `'MLKEM768-P256'`[^modern-algos], `'MLKEM768-X25519'`[^modern-algos],
+  `'MLKEM1024-P384'`[^modern-algos], `'RSA-OAEP'`, `'RSA-PSS'`,
+  `'RSASSA-PKCS1-v1_5'`, `'X25519'`, and `'X448'`[^secure-curves].
 
 ### Crypto Operation APIs
 
@@ -553,8 +560,10 @@ Crypto API implementation and the APIs supported for each:
   `'ChaCha20-Poly1305'`[^modern-algos], and `'RSA-OAEP'`.
 * [`subtle.encapsulateBits()`][], [`subtle.decapsulateBits()`][],
   [`subtle.encapsulateKey()`][], and [`subtle.decapsulateKey()`][] support
-  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos], and
-  `'ML-KEM-1024'`[^modern-algos].
+  `'ML-KEM-512'`[^modern-algos], `'ML-KEM-768'`[^modern-algos],
+  `'ML-KEM-1024'`[^modern-algos], `'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos].
 * [`subtle.digest()`][] supports `'cSHAKE128'`[^modern-algos],
   `'cSHAKE256'`[^modern-algos], `'KT128'`[^modern-algos],
   `'KT256'`[^modern-algos], `'SHA-1'`, `'SHA-256'`, `'SHA-384'`, `'SHA-512'`,
@@ -586,6 +595,10 @@ and [`subtle.exportKey()`][].
   `'ML-KEM-768'`[^modern-algos], and `'ML-KEM-1024'`[^modern-algos]** can be
   imported and exported using `'spki'`, `'pkcs8'`, `'jwk'`,
   `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
+* **`'MLKEM768-P256'`[^modern-algos],
+  `'MLKEM768-X25519'`[^modern-algos], and
+  `'MLKEM1024-P384'`[^modern-algos]** can be imported and exported using
+  `'jwk'`, `'raw-public'`[^modern-algos], and `'raw-seed'`[^modern-algos].
 * **`'RSA-OAEP'`, `'RSA-PSS'`, and `'RSASSA-PKCS1-v1_5'`** can be imported
   and exported using `'spki'`, `'pkcs8'`, and `'jwk'`.
 
@@ -790,6 +803,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decapsulateKey(decapsulationAlgorithm, decapsulationKey, ciphertext, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -816,6 +832,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.decrypt(algorithm, key, data)`
 
@@ -1014,6 +1033,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encapsulateKey(encapsulationAlgorithm, encapsulationKey, sharedKeyAlgorithm, extractable, keyUsages)`
 
@@ -1038,6 +1060,9 @@ The algorithms currently supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 
 ### `subtle.encrypt(algorithm, key, data)`
 
@@ -1076,6 +1101,9 @@ The algorithms currently supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
     - v26.1.0
     - v24.18.0
@@ -1142,6 +1170,9 @@ Derives the public key from a given private key.
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version: v24.8.0
     pr-url: https://github.com/nodejs/node/pull/59647
     description: KMAC algorithms are now supported.
@@ -1183,6 +1214,9 @@ include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
@@ -1206,6 +1240,9 @@ The {CryptoKey} (secret key) generating algorithms supported include:
 <!-- YAML
 added: v15.0.0
 changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65759
+    description: Hybrid KEM algorithms are now supported.
   - version:
     - v26.1.0
     - v24.18.0
@@ -1379,6 +1416,9 @@ The unwrapped key algorithms supported include:
 * `'ML-KEM-512'`[^modern-algos]
 * `'ML-KEM-768'`[^modern-algos]
 * `'ML-KEM-1024'`[^modern-algos]
+* `'MLKEM768-P256'`[^modern-algos]
+* `'MLKEM768-X25519'`[^modern-algos]
+* `'MLKEM1024-P384'`[^modern-algos]
 * `'RSA-OAEP'`
 * `'RSA-PSS'`
 * `'RSASSA-PKCS1-v1_5'`
diff --git a/doc/api/worker_threads.md b/doc/api/worker_threads.md
index e7b6b19b355c..d39365d965e4 100644
--- a/doc/api/worker_threads.md
+++ b/doc/api/worker_threads.md
@@ -1238,7 +1238,7 @@ port2.postMessage(circularData);
 ```
 
 `transferList` may be a list of {ArrayBuffer}, [`MessagePort`][],
-[`FileHandle`][], {net.Server}, and {net.Socket} objects.
+[`FileHandle`][], {net.Server}, {net.Socket}, and {net.BoundSocket} objects.
 After transferring, they are not usable on the sending side of the channel
 anymore (even if they are not contained in `value`).
 
@@ -1249,6 +1249,8 @@ freshly accepted or created TCP connection that has not yet started reading and
 has no buffered data, otherwise `postMessage()` throws
 `ERR_WORKER_HANDLE_NOT_TRANSFERABLE`. This makes it possible to accept
 connections on one thread and distribute them across a pool of worker threads.
+Transferring a {net.BoundSocket} moves an un-adopted pre-bound socket, so a
+port can be reserved synchronously on one thread and adopted on another.
 Only TCP handles are supported.
 
 If `value` contains {SharedArrayBuffer} instances, those are accessible
diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index 9ab581678e08..fc6bc63b9766 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -2230,7 +2230,7 @@ Each Zstd-based class takes an `options` object. All options are optional.
   to improve compression efficiency when compressing or decompressing data that
   shares common patterns with the dictionary.
 * `rejectGarbageAfterEnd` {boolean} If `true`, decompression fails when
-  input remains after the first complete compressed stream. **Default:** `false`
+  input remains after a complete sequence of Zstd frames. **Default:** `false`
 
 For example:
 
@@ -2266,7 +2266,8 @@ added:
   - v22.15.0
 -->
 
-Decompress data using the Zstd algorithm.
+Decompress data using the Zstd algorithm. Concatenated Zstd and skippable frames
+are decoded as a single stream.
 
 ## `zlib.constants`
 
diff --git a/doc/changelogs/CHANGELOG_V24.md b/doc/changelogs/CHANGELOG_V24.md
index 912abaabc33b..b8bc22c8c5ad 100644
--- a/doc/changelogs/CHANGELOG_V24.md
+++ b/doc/changelogs/CHANGELOG_V24.md
@@ -9,6 +9,7 @@
 </tr>
 <tr>
 <td>
+<a href="#24.21.0">24.21.0</a><br/>
 <a href="#24.20.0">24.20.0</a><br/>
 <a href="#24.19.0">24.19.0</a><br/>
 <a href="#24.18.1">24.18.1</a><br/>
@@ -71,6 +72,261 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="24.21.0"></a>
+
+## 2026-09-08, Version 24.21.0 'Krypton' (LTS), @aduh95
+
+### Notable Changes
+
+* \[[`71106e1f17`](https://github.com/nodejs/node/commit/71106e1f17)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
+* \[[`afca0a912d`](https://github.com/nodejs/node/commit/afca0a912d)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](https://github.com/nodejs/node/pull/63949)
+* \[[`6274fccbd9`](https://github.com/nodejs/node/commit/6274fccbd9)] - **deps**: update OpenSSL to 3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`53cba013c7`](https://github.com/nodejs/node/commit/53cba013c7)] - **deps**: update Undici to 7.29.1 (Node.js GitHub Bot) [#65789](https://github.com/nodejs/node/pull/65789)
+* \[[`0529772798`](https://github.com/nodejs/node/commit/0529772798)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
+* \[[`41c7062b81`](https://github.com/nodejs/node/commit/41c7062b81)] - **(SEMVER-MINOR)** **net**: improve performance of `net.BlockList` (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
+* \[[`5197b5a3c5`](https://github.com/nodejs/node/commit/5197b5a3c5)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`35c635b032`](https://github.com/nodejs/node/commit/35c635b032)] - **(SEMVER-MINOR)** **util**: add non-throwing `MIMEType.parse` (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
+
+### Commits
+
+* \[[`84d706cb9b`](https://github.com/nodejs/node/commit/84d706cb9b)] - **assert**: improve documentation wording (Kamal Rawal) [#64953](https://github.com/nodejs/node/pull/64953)
+* \[[`90d127db33`](https://github.com/nodejs/node/commit/90d127db33)] - **(SEMVER-MINOR)** **benchmark**: add --analyze mode to compare.js (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`ad1d7884c3`](https://github.com/nodejs/node/commit/ad1d7884c3)] - **benchmark**: add test-only and mock timers cases (Luan Muniz) [#64097](https://github.com/nodejs/node/pull/64097)
+* \[[`1d8f045914`](https://github.com/nodejs/node/commit/1d8f045914)] - **benchmark**: apply `highWaterMark` in webstreams `pipe-to` (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`ed7ba3c993`](https://github.com/nodejs/node/commit/ed7ba3c993)] - **benchmark**: complete the sqlite is-transaction fix (Edy Silva) [#65218](https://github.com/nodejs/node/pull/65218)
+* \[[`c8837e1aa3`](https://github.com/nodejs/node/commit/c8837e1aa3)] - **benchmark**: add test runner hooks and options (Luan Muniz) [#63754](https://github.com/nodejs/node/pull/63754)
+* \[[`2ba8661e23`](https://github.com/nodejs/node/commit/2ba8661e23)] - **buffer**: prevent string write offset overflow (Matteo Collina) [#65043](https://github.com/nodejs/node/pull/65043)
+* \[[`cc9ee6c2ae`](https://github.com/nodejs/node/commit/cc9ee6c2ae)] - **buffer**: treat detached ArrayBuffers as empty (Archkon) [#64504](https://github.com/nodejs/node/pull/64504)
+* \[[`5a5d73e4c5`](https://github.com/nodejs/node/commit/5a5d73e4c5)] - **build**: pass target architecture to small-icu genccode (ulofiai) [#65095](https://github.com/nodejs/node/pull/65095)
+* \[[`273e72d1a5`](https://github.com/nodejs/node/commit/273e72d1a5)] - **build**: deprecate always enabled `--enable-static` (Chengzhong Wu) [#65103](https://github.com/nodejs/node/pull/65103)
+* \[[`89a67246e3`](https://github.com/nodejs/node/commit/89a67246e3)] - **build**: check FIPS option value in node.gyp (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`2d21f41cd5`](https://github.com/nodejs/node/commit/2d21f41cd5)] - **build**: handle malformed OpenSSL macros (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`f62bc0f862`](https://github.com/nodejs/node/commit/f62bc0f862)] - **build,win**: add PGO workload scripts (Stefan Stojanovic) [#63696](https://github.com/nodejs/node/pull/63696)
+* \[[`33d0c7dc12`](https://github.com/nodejs/node/commit/33d0c7dc12)] - **child\_process**: keep SIGWINCH from killing on Win (Kirill Saied) [#64510](https://github.com/nodejs/node/pull/64510)
+* \[[`71106e1f17`](https://github.com/nodejs/node/commit/71106e1f17)] - **crypto**: update root certificates to NSS 3.126 (Node.js GitHub Bot) [#65495](https://github.com/nodejs/node/pull/65495)
+* \[[`419af8b86d`](https://github.com/nodejs/node/commit/419af8b86d)] - **crypto**: fix missing error checks on ASN1\_STRING\_to\_UTF8() (Nora Dossche) [#65200](https://github.com/nodejs/node/pull/65200)
+* \[[`8029383f3f`](https://github.com/nodejs/node/commit/8029383f3f)] - **crypto**: use available BoringSSL APIs (Filip Skokan) [#65423](https://github.com/nodejs/node/pull/65423)
+* \[[`a9bd780e19`](https://github.com/nodejs/node/commit/a9bd780e19)] - **crypto**: remove obsolete BoringSSL shims (Filip Skokan) [#65423](https://github.com/nodejs/node/pull/65423)
+* \[[`7defefad3f`](https://github.com/nodejs/node/commit/7defefad3f)] - **crypto**: read WebCrypto inputs through primordials (Filip Skokan) [#65115](https://github.com/nodejs/node/pull/65115)
+* \[[`6ed1e38627`](https://github.com/nodejs/node/commit/6ed1e38627)] - **crypto**: fix disabling FIPS mode (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`afca0a912d`](https://github.com/nodejs/node/commit/afca0a912d)] - **(SEMVER-MINOR)** **crypto**: support loading private keys through STORE loaders (Filip Skokan) [#63949](https://github.com/nodejs/node/pull/63949)
+* \[[`9b9dd6e9cf`](https://github.com/nodejs/node/commit/9b9dd6e9cf)] - **debugger**: wait for target startup (Filip Skokan) [#65194](https://github.com/nodejs/node/pull/65194)
+* \[[`07faaeeffd`](https://github.com/nodejs/node/commit/07faaeeffd)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`53cba013c7`](https://github.com/nodejs/node/commit/53cba013c7)] - **deps**: update undici to 7.29.1 (Node.js GitHub Bot) [#65789](https://github.com/nodejs/node/pull/65789)
+* \[[`0268ca547c`](https://github.com/nodejs/node/commit/0268ca547c)] - **deps**: update archs files for openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`6274fccbd9`](https://github.com/nodejs/node/commit/6274fccbd9)] - **deps**: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`6bdcd121fa`](https://github.com/nodejs/node/commit/6bdcd121fa)] - **deps**: update zlib to 1.3.2.1-motley-8002e91 (Node.js GitHub Bot) [#65316](https://github.com/nodejs/node/pull/65316)
+* \[[`c2aa446b6d`](https://github.com/nodejs/node/commit/c2aa446b6d)] - **deps**: update simdjson to 4.6.7 (Node.js GitHub Bot) [#65318](https://github.com/nodejs/node/pull/65318)
+* \[[`3e58e48ea8`](https://github.com/nodejs/node/commit/3e58e48ea8)] - **deps**: update googletest to 49495eacfdbda3f4b6ba219923fedbb2e3f99376 (Node.js GitHub Bot) [#65317](https://github.com/nodejs/node/pull/65317)
+* \[[`670b3665c0`](https://github.com/nodejs/node/commit/670b3665c0)] - **deps**: cherry-pick libuv/libuv\@e640dc9 (ulofiai) [#65118](https://github.com/nodejs/node/pull/65118)
+* \[[`ca1c67b021`](https://github.com/nodejs/node/commit/ca1c67b021)] - **deps**: float ICU-23262 patch for icu78 (René) [#64678](https://github.com/nodejs/node/pull/64678)
+* \[[`4ad043b0aa`](https://github.com/nodejs/node/commit/4ad043b0aa)] - **deps**: enable AVX-512 OpenSSL asm with clang (Daniel Lemire) [#65136](https://github.com/nodejs/node/pull/65136)
+* \[[`96b4af109b`](https://github.com/nodejs/node/commit/96b4af109b)] - **deps**: update googletest to d89aac5f0dd4021198d903d39de16f896726de21 (Node.js GitHub Bot) [#65153](https://github.com/nodejs/node/pull/65153)
+* \[[`774f663c56`](https://github.com/nodejs/node/commit/774f663c56)] - **dgram**: don't swallow bind errors when callback is provided (armanmikoyan) [#62602](https://github.com/nodejs/node/pull/62602)
+* \[[`94b118d62e`](https://github.com/nodejs/node/commit/94b118d62e)] - **diagnostics\_channel**: validate before channel activation (Trivikram Kamat) [#65313](https://github.com/nodejs/node/pull/65313)
+* \[[`09788665bd`](https://github.com/nodejs/node/commit/09788665bd)] - **dns**: validate address type in lookupService (Lazizbek Ergashev) [#64878](https://github.com/nodejs/node/pull/64878)
+* \[[`15f95fc0e2`](https://github.com/nodejs/node/commit/15f95fc0e2)] - **dns**: validate port range in `setServers()` (René) [#65021](https://github.com/nodejs/node/pull/65021)
+* \[[`37b9e9a154`](https://github.com/nodejs/node/commit/37b9e9a154)] - **dns**: fix crash on setServers with port 0 (Lazizbek Ergashev) [#65009](https://github.com/nodejs/node/pull/65009)
+* \[[`cd6205fa0d`](https://github.com/nodejs/node/commit/cd6205fa0d)] - **doc**: update AHAFS reference link (Taeuk Ha) [#65481](https://github.com/nodejs/node/pull/65481)
+* \[[`0e6f9ae42e`](https://github.com/nodejs/node/commit/0e6f9ae42e)] - **doc**: fix property names in os.networkInterfaces() example (Jihwan) [#65469](https://github.com/nodejs/node/pull/65469)
+* \[[`034a827b41`](https://github.com/nodejs/node/commit/034a827b41)] - **doc**: fix broken links in cli.md (Donghoon Kang) [#65412](https://github.com/nodejs/node/pull/65412)
+* \[[`eb364621d4`](https://github.com/nodejs/node/commit/eb364621d4)] - **doc**: remove outdated WASI version fallback (이혜미) [#65303](https://github.com/nodejs/node/pull/65303)
+* \[[`b13f425bf8`](https://github.com/nodejs/node/commit/b13f425bf8)] - **doc**: fix broken GYP link in n-api.md (Donghoon Kang) [#65413](https://github.com/nodejs/node/pull/65413)
+* \[[`45c4011067`](https://github.com/nodejs/node/commit/45c4011067)] - **doc**: document that an empty OPENSSL\_CONF skips config loading (Orgad Shaneh) [#64949](https://github.com/nodejs/node/pull/64949)
+* \[[`fde6776c5f`](https://github.com/nodejs/node/commit/fde6776c5f)] - **doc**: fix broken TLS security level example (soreavis) [#65391](https://github.com/nodejs/node/pull/65391)
+* \[[`290c1fec04`](https://github.com/nodejs/node/commit/290c1fec04)] - **doc**: clarify socket destroyed behavior (Dayun) [#65395](https://github.com/nodejs/node/pull/65395)
+* \[[`a7e8269947`](https://github.com/nodejs/node/commit/a7e8269947)] - **doc**: update outdated nodejs.org guide links (Donghoon Kang) [#65394](https://github.com/nodejs/node/pull/65394)
+* \[[`7809f11249`](https://github.com/nodejs/node/commit/7809f11249)] - **doc**: clarify that ipv4 mapped to ipv6 are classified as ipv6 (Vedant Kulkarni) [#62117](https://github.com/nodejs/node/pull/62117)
+* \[[`64cd3a6e95`](https://github.com/nodejs/node/commit/64cd3a6e95)] - **doc**: clarify how fs.Dirent file types are determined (soreavis) [#64532](https://github.com/nodejs/node/pull/64532)
+* \[[`9b92fdce14`](https://github.com/nodejs/node/commit/9b92fdce14)] - **doc**: update security release prepare command (Rafael Gonzaga) [#64699](https://github.com/nodejs/node/pull/64699)
+* \[[`6f9b9df3c1`](https://github.com/nodejs/node/commit/6f9b9df3c1)] - **doc**: clarify copyFile symlink behavior (T) [#62941](https://github.com/nodejs/node/pull/62941)
+* \[[`2480acb550`](https://github.com/nodejs/node/commit/2480acb550)] - **doc**: document setRawMode write access on Windows (Erik Demaine) [#63856](https://github.com/nodejs/node/pull/63856)
+* \[[`a1e9c3a5db`](https://github.com/nodejs/node/commit/a1e9c3a5db)] - **doc**: add missing return types in fs.md (Chaseton Collins) [#65307](https://github.com/nodejs/node/pull/65307)
+* \[[`4533572040`](https://github.com/nodejs/node/commit/4533572040)] - **doc**: add missing return types in buffer.md (Yuya Inoue) [#65308](https://github.com/nodejs/node/pull/65308)
+* \[[`39ecedbbd2`](https://github.com/nodejs/node/commit/39ecedbbd2)] - **doc**: fix lint clean command (greenhead) [#65274](https://github.com/nodejs/node/pull/65274)
+* \[[`0b1fb8fcd8`](https://github.com/nodejs/node/commit/0b1fb8fcd8)] - **doc**: fix typo in onboarding.md (서울민트초코) [#65295](https://github.com/nodejs/node/pull/65295)
+* \[[`3165b5d38a`](https://github.com/nodejs/node/commit/3165b5d38a)] - **doc**: add missing `added:` tags to `fs.lchmod` (Lazizbek Ergashev) [#65283](https://github.com/nodejs/node/pull/65283)
+* \[[`113b808e59`](https://github.com/nodejs/node/commit/113b808e59)] - **doc**: fix SQLite changeset constant descriptions (greenhead) [#65265](https://github.com/nodejs/node/pull/65265)
+* \[[`c3eb51d5a1`](https://github.com/nodejs/node/commit/c3eb51d5a1)] - **doc**: document open pull request limit (Matteo Collina) [#65250](https://github.com/nodejs/node/pull/65250)
+* \[[`d7accdcd52`](https://github.com/nodejs/node/commit/d7accdcd52)] - **doc**: document http2 header constants (Harjoth Khara) [#64548](https://github.com/nodejs/node/pull/64548)
+* \[[`f47111416f`](https://github.com/nodejs/node/commit/f47111416f)] - **doc**: create ai-guidelines and include to CONTRIBUTING (Rafael Gonzaga) [#62105](https://github.com/nodejs/node/pull/62105)
+* \[[`c3b120e737`](https://github.com/nodejs/node/commit/c3b120e737)] - **doc**: update synopsis (Augustin Mauroy) [#65171](https://github.com/nodejs/node/pull/65171)
+* \[[`39f4c831fd`](https://github.com/nodejs/node/commit/39f4c831fd)] - **doc**: fix broken internal links (greenhead) [#64901](https://github.com/nodejs/node/pull/64901)
+* \[[`be25cdd69e`](https://github.com/nodejs/node/commit/be25cdd69e)] - **doc**: report proper return type on urlPattern.test (Brian Muenzenmeyer) [#64831](https://github.com/nodejs/node/pull/64831)
+* \[[`1bf7737810`](https://github.com/nodejs/node/commit/1bf7737810)] - **doc**: fix permission documentation examples (greenhead) [#64897](https://github.com/nodejs/node/pull/64897)
+* \[[`b7932e68a1`](https://github.com/nodejs/node/commit/b7932e68a1)] - **doc**: document sqlite parameter binding (Guilherme Araújo) [#65089](https://github.com/nodejs/node/pull/65089)
+* \[[`5234a5169c`](https://github.com/nodejs/node/commit/5234a5169c)] - **doc**: finalize statements in sqlite examples (Guilherme Araújo) [#65088](https://github.com/nodejs/node/pull/65088)
+* \[[`39ea929da7`](https://github.com/nodejs/node/commit/39ea929da7)] - **doc**: document quic stopSending() and resetStream() (Issac) [#64888](https://github.com/nodejs/node/pull/64888)
+* \[[`2ba198db73`](https://github.com/nodejs/node/commit/2ba198db73)] - **doc**: clarify sqlite bare parameter default (Sumit Kumar Das) [#62009](https://github.com/nodejs/node/pull/62009)
+* \[[`314f9b200f`](https://github.com/nodejs/node/commit/314f9b200f)] - **doc**: remove usage of `util.inherits` (Augustin Mauroy) [#60817](https://github.com/nodejs/node/pull/60817)
+* \[[`d82a61662c`](https://github.com/nodejs/node/commit/d82a61662c)] - **doc**: fix grammar in worker\_threads.md (이혜미) [#64913](https://github.com/nodejs/node/pull/64913)
+* \[[`44c0c8ff5b`](https://github.com/nodejs/node/commit/44c0c8ff5b)] - **doc**: clarify OpenSSL FIPS configuration (Filip Skokan) [#64982](https://github.com/nodejs/node/pull/64982)
+* \[[`9b2ca70e0d`](https://github.com/nodejs/node/commit/9b2ca70e0d)] - **doc**: remove `--expose-gc` flag from CLI documentation (Dario Piotrowicz) [#58909](https://github.com/nodejs/node/pull/58909)
+* \[[`a0a12397b9`](https://github.com/nodejs/node/commit/a0a12397b9)] - **doc**: document ArrayBuffer support in pbkd2Sync (kyungrae2002) [#64976](https://github.com/nodejs/node/pull/64976)
+* \[[`b48699e077`](https://github.com/nodejs/node/commit/b48699e077)] - **doc**: correct default highWaterMark values (Yilong Li) [#64617](https://github.com/nodejs/node/pull/64617)
+* \[[`0312ee133c`](https://github.com/nodejs/node/commit/0312ee133c)] - **esm**: avoid super-linear data URL MIME regex (Sumit Kumar Das) [#61951](https://github.com/nodejs/node/pull/61951)
+* \[[`cd84d55c81`](https://github.com/nodejs/node/commit/cd84d55c81)] - **esm**: only register text format when enabled (Efe Karasakal) [#64992](https://github.com/nodejs/node/pull/64992)
+* \[[`c0a8ef611e`](https://github.com/nodejs/node/commit/c0a8ef611e)] - **esm**: fix wasm import name in error message (이혜미) [#64950](https://github.com/nodejs/node/pull/64950)
+* \[[`e6c34f90c2`](https://github.com/nodejs/node/commit/e6c34f90c2)] - **events**: inline iterationCondition hybrid dispatch closure (Szymon Łągiewka) [#64473](https://github.com/nodejs/node/pull/64473)
+* \[[`6ee4b40c91`](https://github.com/nodejs/node/commit/6ee4b40c91)] - **events**: inline createEvent hybrid dispatch closure (Szymon Łągiewka) [#64473](https://github.com/nodejs/node/pull/64473)
+* \[[`367549eed5`](https://github.com/nodejs/node/commit/367549eed5)] - **fs**: use sized reads for large files in readFileUtf8 (Shelley Vohr) [#65328](https://github.com/nodejs/node/pull/65328)
+* \[[`8a5b1ae4c2`](https://github.com/nodejs/node/commit/8a5b1ae4c2)] - **fs**: fix realpath of namespaced drive paths (Jason Zhang) [#65378](https://github.com/nodejs/node/pull/65378)
+* \[[`c9233b950d`](https://github.com/nodejs/node/commit/c9233b950d)] - **fs**: fix glob early return skipping sibling entries (Srinu desetti) [#64895](https://github.com/nodejs/node/pull/64895)
+* \[[`bc54dd8905`](https://github.com/nodejs/node/commit/bc54dd8905)] - **fs**: pass symlink type in cp when filter is provided (Jerry Zhao) [#62654](https://github.com/nodejs/node/pull/62654)
+* \[[`fcb4333aca`](https://github.com/nodejs/node/commit/fcb4333aca)] - **fs**: allocate FSReqPromise stat arrays lazily (Samuel Attard) [#63886](https://github.com/nodejs/node/pull/63886)
+* \[[`c35876154e`](https://github.com/nodejs/node/commit/c35876154e)] - **fs**: fix out-of-bounds write in mkdtemp for long prefixes (Hierax\_Umbra) [#64770](https://github.com/nodejs/node/pull/64770)
+* \[[`b269616936`](https://github.com/nodejs/node/commit/b269616936)] - **fs**: treat `std::errc::permission_denied` as `EPERM` error (Kirill Saied) [#64698](https://github.com/nodejs/node/pull/64698)
+* \[[`212fe77e76`](https://github.com/nodejs/node/commit/212fe77e76)] - **fs**: add windowsHandle option to file streams (Kirill Saied) [#63851](https://github.com/nodejs/node/pull/63851)
+* \[[`75df6cb435`](https://github.com/nodejs/node/commit/75df6cb435)] - **http**: improve performance with known-length calls to end() (Tim Perry) [#65466](https://github.com/nodejs/node/pull/65466)
+* \[[`48d9cd4a28`](https://github.com/nodejs/node/commit/48d9cd4a28)] - **http**: cache maxHeaderPairs per header section (GetThatCookie) [#64988](https://github.com/nodejs/node/pull/64988)
+* \[[`04785c8f43`](https://github.com/nodejs/node/commit/04785c8f43)] - **http**: fix keylog listener setup on existing agent sockets (Shani Singh) [#65066](https://github.com/nodejs/node/pull/65066)
+* \[[`4b90031534`](https://github.com/nodejs/node/commit/4b90031534)] - **http**: emit drain on socket takeover and avoid stale HWM reuse (Naman Trivedi) [#64991](https://github.com/nodejs/node/pull/64991)
+* \[[`83a27559cd`](https://github.com/nodejs/node/commit/83a27559cd)] - **http2**: adapt receive deferral for Node.js 24 (Matteo Collina) [#65093](https://github.com/nodejs/node/pull/65093)
+* \[[`f43bed0ecc`](https://github.com/nodejs/node/commit/f43bed0ecc)] - **http2**: avoid uaf while receiving and sending rst\_stream (esgor) [#64166](https://github.com/nodejs/node/pull/64166)
+* \[[`b42d664321`](https://github.com/nodejs/node/commit/b42d664321)] - **inspector**: avoid calling into JS from V8 interrupts (Joyee Cheung) [#65028](https://github.com/nodejs/node/pull/65028)
+* \[[`6bf852197d`](https://github.com/nodejs/node/commit/6bf852197d)] - **lib**: use bracket notation instead of startsWith/endsWith for single char (Taejin Kim) [#61500](https://github.com/nodejs/node/pull/61500)
+* \[[`151ca7e104`](https://github.com/nodejs/node/commit/151ca7e104)] - **lib**: harden webidl dictionary member reads (Filip Skokan) [#65115](https://github.com/nodejs/node/pull/65115)
+* \[[`7e8c2c9f44`](https://github.com/nodejs/node/commit/7e8c2c9f44)] - **lib**: use validateArray for array arguments (greenhead) [#64959](https://github.com/nodejs/node/pull/64959)
+* \[[`424fe2bc5a`](https://github.com/nodejs/node/commit/424fe2bc5a)] - **lib**: add and test \[EnforceRange] in webcrypto dictionaries (Filip Skokan) [#65091](https://github.com/nodejs/node/pull/65091)
+* \[[`0529772798`](https://github.com/nodejs/node/commit/0529772798)] - **(SEMVER-MINOR)** **lib,src**: improve histogram implementation (James M Snell) [#65024](https://github.com/nodejs/node/pull/65024)
+* \[[`186e1b76e8`](https://github.com/nodejs/node/commit/186e1b76e8)] - **meta**: move targos to emeritus (Michaël Zasso) [#65393](https://github.com/nodejs/node/pull/65393)
+* \[[`b41b07c72a`](https://github.com/nodejs/node/commit/b41b07c72a)] - **meta**: add unified http api initiative (James M Snell) [#65139](https://github.com/nodejs/node/pull/65139)
+* \[[`f85b6ecd67`](https://github.com/nodejs/node/commit/f85b6ecd67)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#65182](https://github.com/nodejs/node/pull/65182)
+* \[[`8f3d01bdce`](https://github.com/nodejs/node/commit/8f3d01bdce)] - **meta**: add Aviv Keller to `.mailmap` (Aviv Keller) [#65048](https://github.com/nodejs/node/pull/65048)
+* \[[`cfad1d5b28`](https://github.com/nodejs/node/commit/cfad1d5b28)] - **meta**: update sccache to 0.17.0 (René) [#64985](https://github.com/nodejs/node/pull/64985)
+* \[[`349c53c441`](https://github.com/nodejs/node/commit/349c53c441)] - **module**: report unreadable package.json (Paul Bouchon) [#65223](https://github.com/nodejs/node/pull/65223)
+* \[[`bd21e6706e`](https://github.com/nodejs/node/commit/bd21e6706e)] - **module**: cache nearest parent package.json per directory (Shelley Vohr) [#65326](https://github.com/nodejs/node/pull/65326)
+* \[[`961bd04370`](https://github.com/nodejs/node/commit/961bd04370)] - **module**: fix --check on ambiguous ESM files (Paul Bouchon) [#65203](https://github.com/nodejs/node/pull/65203)
+* \[[`f45ef73420`](https://github.com/nodejs/node/commit/f45ef73420)] - **net**: handle undefined parent in \_unrefTimer and \_destroy (Shivay-98) [#64644](https://github.com/nodejs/node/pull/64644)
+* \[[`41c7062b81`](https://github.com/nodejs/node/commit/41c7062b81)] - **(SEMVER-MINOR)** **net**: improve performance of net.BlockList (James M Snell) [#64974](https://github.com/nodejs/node/pull/64974)
+* \[[`5197b5a3c5`](https://github.com/nodejs/node/commit/5197b5a3c5)] - **(SEMVER-MINOR)** **perf\_hooks**: add statistical hypothesis testing to histogram (James M Snell) [#65416](https://github.com/nodejs/node/pull/65416)
+* \[[`1722ddac28`](https://github.com/nodejs/node/commit/1722ddac28)] - **permission**: enforce addon permission in GetLinkedBinding (Rafael Gonzaga) [#65432](https://github.com/nodejs/node/pull/65432)
+* \[[`dff2b675db`](https://github.com/nodejs/node/commit/dff2b675db)] - **process**: validate resource stats array offsets (Archkon) [#65098](https://github.com/nodejs/node/pull/65098)
+* \[[`f277983e7b`](https://github.com/nodejs/node/commit/f277983e7b)] - **quic**: changes for nghttp3\_conn\_close\_stream2 (Marten Richter) [#64574](https://github.com/nodejs/node/pull/64574)
+* \[[`a4c770c78e`](https://github.com/nodejs/node/commit/a4c770c78e)] - **quic**: mark drain promise handled (James M Snell) [#65319](https://github.com/nodejs/node/pull/65319)
+* \[[`2460b171c5`](https://github.com/nodejs/node/commit/2460b171c5)] - **quic**: reset rejected HTTP/3 request streams with H3\_REQUEST\_REJECTED (trivenay) [#65442](https://github.com/nodejs/node/pull/65442)
+* \[[`18a7ccf302`](https://github.com/nodejs/node/commit/18a7ccf302)] - **quic**: write desired size needs update on maxstream (Marten Richter) [#64768](https://github.com/nodejs/node/pull/64768)
+* \[[`9017f4a780`](https://github.com/nodejs/node/commit/9017f4a780)] - **quic**: do not destroy incoming streams that have a consumer (trivenay) [#65335](https://github.com/nodejs/node/pull/65335)
+* \[[`ddc41c1ef4`](https://github.com/nodejs/node/commit/ddc41c1ef4)] - **quic**: fix wake up blob (Marten Richter) [#64044](https://github.com/nodejs/node/pull/64044)
+* \[[`88bee43d7c`](https://github.com/nodejs/node/commit/88bee43d7c)] - **quic**: convert incoming :status header to number (Hallison Pereira Melo) [#63589](https://github.com/nodejs/node/pull/63589)
+* \[[`cd776fe97c`](https://github.com/nodejs/node/commit/cd776fe97c)] - **quic**: fix infinite loop if STOP\_SENDING received on a buffering stream (Tim Perry) [#64715](https://github.com/nodejs/node/pull/64715)
+* \[[`4f6eda3c23`](https://github.com/nodejs/node/commit/4f6eda3c23)] - **repl**: keep entries added while history file is loading (Mhayk Whandson) [#64513](https://github.com/nodejs/node/pull/64513)
+* \[[`cd1e6ce29b`](https://github.com/nodejs/node/commit/cd1e6ce29b)] - **repl**: add benchmarks (Aviv Keller) [#64590](https://github.com/nodejs/node/pull/64590)
+* \[[`2ba740669d`](https://github.com/nodejs/node/commit/2ba740669d)] - **sea**: avoid dangling CLI option pointers (Archkon) [#64755](https://github.com/nodejs/node/pull/64755)
+* \[[`ec5e2d6856`](https://github.com/nodejs/node/commit/ec5e2d6856)] - **sea**: handle NUL bytes in asset keys (Archkon) [#64773](https://github.com/nodejs/node/pull/64773)
+* \[[`703b854293`](https://github.com/nodejs/node/commit/703b854293)] - **sea**: reject trailing content in config JSON (Archkon) [#64774](https://github.com/nodejs/node/pull/64774)
+* \[[`a61a5fdd1c`](https://github.com/nodejs/node/commit/a61a5fdd1c)] - **sqlite**: prevent reentrant session.close() (Trivikram Kamat) [#65349](https://github.com/nodejs/node/pull/65349)
+* \[[`6ae81be0a3`](https://github.com/nodejs/node/commit/6ae81be0a3)] - **sqlite**: reject statement-less SQL in prepare() (Trevor Burnham) [#65157](https://github.com/nodejs/node/pull/65157)
+* \[[`043dfe4996`](https://github.com/nodejs/node/commit/043dfe4996)] - **sqlite**: reject statement-less SQL in SQLTagStore (Trevor Burnham) [#65157](https://github.com/nodejs/node/pull/65157)
+* \[[`b8faee02e1`](https://github.com/nodejs/node/commit/b8faee02e1)] - **sqlite**: check null returns from sqlite value functions (Nora Dossche) [#63288](https://github.com/nodejs/node/pull/63288)
+* \[[`d6d2a71bee`](https://github.com/nodejs/node/commit/d6d2a71bee)] - **sqlite**: validate maxSize argument in createTagStore() (Anshika Jain) [#63792](https://github.com/nodejs/node/pull/63792)
+* \[[`61a046309f`](https://github.com/nodejs/node/commit/61a046309f)] - **sqlite**: reject non-positive backup rates (Trivikram Kamat) [#64893](https://github.com/nodejs/node/pull/64893)
+* \[[`514e3f30fb`](https://github.com/nodejs/node/commit/514e3f30fb)] - **sqlite**: clear SQLTagStore bindings (Matteo Collina) [#65041](https://github.com/nodejs/node/pull/65041)
+* \[[`c1542255b8`](https://github.com/nodejs/node/commit/c1542255b8)] - **sqlite**: bind Boolean (mike-git374) [#62001](https://github.com/nodejs/node/pull/62001)
+* \[[`cdb732beb5`](https://github.com/nodejs/node/commit/cdb732beb5)] - **sqlite**: fix undefined behaviour in `Session::Changeset()` (Nora Dossche) [#63637](https://github.com/nodejs/node/pull/63637)
+* \[[`fbe8861111`](https://github.com/nodejs/node/commit/fbe8861111)] - **sqlite**: bind ArrayBuffer (mike-git374) [#62061](https://github.com/nodejs/node/pull/62061)
+* \[[`e3c6bd6bc8`](https://github.com/nodejs/node/commit/e3c6bd6bc8)] - **src**: add missing vector include (Filip Skokan) [#65622](https://github.com/nodejs/node/pull/65622)
+* \[[`793cf69df8`](https://github.com/nodejs/node/commit/793cf69df8)] - **src**: fix heap value deduplication in embedder graph (Ilyas Shabi) [#64801](https://github.com/nodejs/node/pull/64801)
+* \[[`ea5935b04c`](https://github.com/nodejs/node/commit/ea5935b04c)] - **src**: fix out-of-bounds write when transcoding odd-length ucs2 (nashit hayat) [#64512](https://github.com/nodejs/node/pull/64512)
+* \[[`22e5023f4d`](https://github.com/nodejs/node/commit/22e5023f4d)] - **src**: escape Windows environment variables in task runner (Antoine du Hamel) [#65217](https://github.com/nodejs/node/pull/65217)
+* \[[`a0f3c62bd9`](https://github.com/nodejs/node/commit/a0f3c62bd9)] - **src**: simplify c++ diagnostics channel API (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`8e831a3d2e`](https://github.com/nodejs/node/commit/8e831a3d2e)] - **src**: make minor cleanup to permission checks (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`968b2ca3a3`](https://github.com/nodejs/node/commit/968b2ca3a3)] - **src**: use DictionaryTemplate for permission diag channel message (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`18e16e7f8d`](https://github.com/nodejs/node/commit/18e16e7f8d)] - **src**: cache permission strings (James M Snell) [#65158](https://github.com/nodejs/node/pull/65158)
+* \[[`c8625a4b6f`](https://github.com/nodejs/node/commit/c8625a4b6f)] - **src**: add SetAbortHandler (Max H Fisher) [#64684](https://github.com/nodejs/node/pull/64684)
+* \[[`c990140d60`](https://github.com/nodejs/node/commit/c990140d60)] - **src**: match cmd.exe case-insensitively in task runner (Archkon) [#64907](https://github.com/nodejs/node/pull/64907)
+* \[[`d7463b9dbc`](https://github.com/nodejs/node/commit/d7463b9dbc)] - **src**: reuse cached env strings in remaining files (Seongeun Lee) [#65039](https://github.com/nodejs/node/pull/65039)
+* \[[`b055a43b93`](https://github.com/nodejs/node/commit/b055a43b93)] - **src**: expose Windows-only fs open flags (Kirill Saied) [#64775](https://github.com/nodejs/node/pull/64775)
+* \[[`7f21e37496`](https://github.com/nodejs/node/commit/7f21e37496)] - **src**: report why --enable-fips failed (Filip Skokan) [#64979](https://github.com/nodejs/node/pull/64979)
+* \[[`8c11beae27`](https://github.com/nodejs/node/commit/8c11beae27)] - **src**: update repeated use strings to env (James M Snell) [#64760](https://github.com/nodejs/node/pull/64760)
+* \[[`9e2c477e26`](https://github.com/nodejs/node/commit/9e2c477e26)] - **stream**: normalize fused stateless transform results (Trivikram Kamat) [#65367](https://github.com/nodejs/node/pull/65367)
+* \[[`107e96dd41`](https://github.com/nodejs/node/commit/107e96dd41)] - **stream**: encode whole chunks in TextEncoderStream (Matteo Collina) [#65414](https://github.com/nodejs/node/pull/65414)
+* \[[`164068279b`](https://github.com/nodejs/node/commit/164068279b)] - **stream**: prevent share from eagerly draining source (Trivikram Kamat) [#65338](https://github.com/nodejs/node/pull/65338)
+* \[[`93d822bdc1`](https://github.com/nodejs/node/commit/93d822bdc1)] - **stream**: drain pending writes before broadcast end (Trivikram Kamat) [#65334](https://github.com/nodejs/node/pull/65334)
+* \[[`6b8b9c362f`](https://github.com/nodejs/node/commit/6b8b9c362f)] - **stream**: reuse unexposed managed read buffers (GetThatCookie) [#64990](https://github.com/nodejs/node/pull/64990)
+* \[[`4ec4fab367`](https://github.com/nodejs/node/commit/4ec4fab367)] - **stream**: avoid duplicated endReadableNT scheduling (Matteo Collina) [#65310](https://github.com/nodejs/node/pull/65310)
+* \[[`86d1196ebf`](https://github.com/nodejs/node/commit/86d1196ebf)] - **stream**: decouple transform backpressure changes (Matteo Collina) [#65143](https://github.com/nodejs/node/pull/65143)
+* \[[`b8a7a75b19`](https://github.com/nodejs/node/commit/b8a7a75b19)] - **stream**: reject pull on signal abort during flush (Trivikram Kamat) [#65346](https://github.com/nodejs/node/pull/65346)
+* \[[`386ed6a06d`](https://github.com/nodejs/node/commit/386ed6a06d)] - **stream**: avoid leaking consumers on signal failure (Trivikram Kamat) [#65299](https://github.com/nodejs/node/pull/65299)
+* \[[`74d53bd73b`](https://github.com/nodejs/node/commit/74d53bd73b)] - **stream**: use validateObject for zlib/iter params (greenhead) [#65015](https://github.com/nodejs/node/pull/65015)
+* \[[`3a174ce16b`](https://github.com/nodejs/node/commit/3a174ce16b)] - **stream**: use validateNumber for BYOB reader options.min (greenhead) [#65014](https://github.com/nodejs/node/pull/65014)
+* \[[`859ea01cb2`](https://github.com/nodejs/node/commit/859ea01cb2)] - **stream**: consolidate non-op algorithm callbacks (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`c577669825`](https://github.com/nodejs/node/commit/c577669825)] - **stream**: cut promise churn in webstreams hot paths (Matteo Collina) [#65138](https://github.com/nodejs/node/pull/65138)
+* \[[`d631e910db`](https://github.com/nodejs/node/commit/d631e910db)] - **stream**: preserve falsy cancellation reasons (Trivikram Kamat) [#64705](https://github.com/nodejs/node/pull/64705)
+* \[[`f9c21eabbd`](https://github.com/nodejs/node/commit/f9c21eabbd)] - **stream**: use validateBuffer for BYOB reader view (greenhead) [#65046](https://github.com/nodejs/node/pull/65046)
+* \[[`b89c8f5d1e`](https://github.com/nodejs/node/commit/b89c8f5d1e)] - **stream**: fix recursive WritableStream abort (Jeong SeokChan) [#64825](https://github.com/nodejs/node/pull/64825)
+* \[[`39e0457e86`](https://github.com/nodejs/node/commit/39e0457e86)] - **test**: fix link-local dgram scope assertion (Filip Skokan) [#65629](https://github.com/nodejs/node/pull/65629)
+* \[[`1433cf9d5b`](https://github.com/nodejs/node/commit/1433cf9d5b)] - **test**: account for varied OpenSSL CCM final behaviours (Filip Skokan) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`7d135d24b7`](https://github.com/nodejs/node/commit/7d135d24b7)] - **test**: convert forEach to for of test-messageevent-brandcheck file (Nachiketa Pathak) [#65279](https://github.com/nodejs/node/pull/65279)
+* \[[`421ee11715`](https://github.com/nodejs/node/commit/421ee11715)] - **test**: use spawnSyncAndAssert in windowsHide test (Junsoo Ha) [#65351](https://github.com/nodejs/node/pull/65351)
+* \[[`929d5705bc`](https://github.com/nodejs/node/commit/929d5705bc)] - **test**: remove test-debugger-run-after-quit-restart as flaky on macOS (Yuya Inoue) [#65424](https://github.com/nodejs/node/pull/65424)
+* \[[`f38f154c14`](https://github.com/nodejs/node/commit/f38f154c14)] - **test**: simplify test-timers-interval-promisified.js (Donghoon Kang) [#65322](https://github.com/nodejs/node/pull/65322)
+* \[[`a98e27f2a9`](https://github.com/nodejs/node/commit/a98e27f2a9)] - **test**: add Headers coverage and benchmark (Yagiz Nizipli) [#65365](https://github.com/nodejs/node/pull/65365)
+* \[[`38fdbb62aa`](https://github.com/nodejs/node/commit/38fdbb62aa)] - **test**: deflake test-net-listen-ipv6only (sangwook) [#64173](https://github.com/nodejs/node/pull/64173)
+* \[[`06c7684b01`](https://github.com/nodejs/node/commit/06c7684b01)] - **test**: use common/child\_process spawnSync helpers (Junsoo Ha) [#65377](https://github.com/nodejs/node/pull/65377)
+* \[[`6438c70004`](https://github.com/nodejs/node/commit/6438c70004)] - **test**: fix Linux debug skip in SEA test guard (구현우) [#63751](https://github.com/nodejs/node/pull/63751)
+* \[[`fe0e4f1b65`](https://github.com/nodejs/node/commit/fe0e4f1b65)] - **test**: avoid timer race in event loop delay test (Trivikram Kamat) [#64728](https://github.com/nodejs/node/pull/64728)
+* \[[`6ff69baea8`](https://github.com/nodejs/node/commit/6ff69baea8)] - **test**: enforce exit code in `test-http-server-stale-close` (Antoine du Hamel) [#65198](https://github.com/nodejs/node/pull/65198)
+* \[[`ba87603016`](https://github.com/nodejs/node/commit/ba87603016)] - **test**: convert test-async-local-storage-bind to async loop (freida-code) [#65270](https://github.com/nodejs/node/pull/65270)
+* \[[`8d6b89f454`](https://github.com/nodejs/node/commit/8d6b89f454)] - **test**: replace `forEach()` with `for...of` in parallel tests (Phillip Markert) [#65272](https://github.com/nodejs/node/pull/65272)
+* \[[`a60572a7bb`](https://github.com/nodejs/node/commit/a60572a7bb)] - **test**: convert forEach to for in test-constant.js file (NIxxy25) [#65271](https://github.com/nodejs/node/pull/65271)
+* \[[`f82060c6ce`](https://github.com/nodejs/node/commit/f82060c6ce)] - **test**: use for-of instead of forEach (Felix P.) [#65268](https://github.com/nodejs/node/pull/65268)
+* \[[`5ded71f9cc`](https://github.com/nodejs/node/commit/5ded71f9cc)] - **test**: cover `realpathSync` resolving symlinks after a FIFO stat (Hendrik Liebau) [#65113](https://github.com/nodejs/node/pull/65113)
+* \[[`ac9835225e`](https://github.com/nodejs/node/commit/ac9835225e)] - **test**: account for \[EnforceRange] in test-webcrypto-prototype-pollution (Filip Skokan) [#65173](https://github.com/nodejs/node/pull/65173)
+* \[[`550d24277e`](https://github.com/nodejs/node/commit/550d24277e)] - **test**: update WPT for WebCryptoAPI to 4c2fd05ed5 (Node.js GitHub Bot) [#65150](https://github.com/nodejs/node/pull/65150)
+* \[[`2aa26559f0`](https://github.com/nodejs/node/commit/2aa26559f0)] - **test**: update WPT for urlpattern to 4832db4761 (Node.js GitHub Bot) [#65151](https://github.com/nodejs/node/pull/65151)
+* \[[`d45c010108`](https://github.com/nodejs/node/commit/d45c010108)] - **test**: fix hidden error in test-http-server-stale-close.js (Meghan Denny) [#59357](https://github.com/nodejs/node/pull/59357)
+* \[[`881f8d092d`](https://github.com/nodejs/node/commit/881f8d092d)] - **test**: avoid deadlock issue in pipeline http2 tests to fix flakiness (Tim Perry) [#65079](https://github.com/nodejs/node/pull/65079)
+* \[[`e4b1e3ee75`](https://github.com/nodejs/node/commit/e4b1e3ee75)] - **test**: allow half-open CONNECT tunnel sockets (Trivikram Kamat) [#64973](https://github.com/nodejs/node/pull/64973)
+* \[[`00f4240d48`](https://github.com/nodejs/node/commit/00f4240d48)] - **test**: update passphrases to comply with the next OpenSSL FIPS mode (Filip Skokan) [#65077](https://github.com/nodejs/node/pull/65077)
+* \[[`cf7680efb7`](https://github.com/nodejs/node/commit/cf7680efb7)] - **test**: use libuv clock for immediate queue test (Trivikram Kamat) [#64889](https://github.com/nodejs/node/pull/64889)
+* \[[`b0c12772ff`](https://github.com/nodejs/node/commit/b0c12772ff)] - **test**: increase timeout in probe-failure-hang-during-evaluate (Joyee Cheung) [#64719](https://github.com/nodejs/node/pull/64719)
+* \[[`7e279104b4`](https://github.com/nodejs/node/commit/7e279104b4)] - **test**: update WPT for WebCryptoAPI to 82c3d9069c (Node.js GitHub Bot) [#64977](https://github.com/nodejs/node/pull/64977)
+* \[[`ac11f88d16`](https://github.com/nodejs/node/commit/ac11f88d16)] - **test,doc**: cover and document multi-byte offset/size in randomFill (kyungrae2002) [#64834](https://github.com/nodejs/node/pull/64834)
+* \[[`67da38cada`](https://github.com/nodejs/node/commit/67da38cada)] - **test\_runner**: match dotfiles in default coverage exclude (semimikoh) [#63401](https://github.com/nodejs/node/pull/63401)
+* \[[`b06c61a08f`](https://github.com/nodejs/node/commit/b06c61a08f)] - **test\_runner**: print coverage and diagnostic info with dot reporter (mag123c) [#61423](https://github.com/nodejs/node/pull/61423)
+* \[[`7cb9c9c126`](https://github.com/nodejs/node/commit/7cb9c9c126)] - **test\_runner**: use run options with isolation="none" (Sylvester Keil) [#62269](https://github.com/nodejs/node/pull/62269)
+* \[[`339acf4201`](https://github.com/nodejs/node/commit/339acf4201)] - **test\_runner**: mock dual-package with conditional exports (Maruthan G) [#62943](https://github.com/nodejs/node/pull/62943)
+* \[[`e7a68bca08`](https://github.com/nodejs/node/commit/e7a68bca08)] - **test\_runner**: add classname hierarchy for JUnit reporter (mag123c) [#60220](https://github.com/nodejs/node/pull/60220)
+* \[[`6a248acefe`](https://github.com/nodejs/node/commit/6a248acefe)] - **test\_runner**: fix junit report on empty diagnostic (Lazizbek Ergashev) [#65357](https://github.com/nodejs/node/pull/65357)
+* \[[`d01dda79b6`](https://github.com/nodejs/node/commit/d01dda79b6)] - **test\_runner**: do not tag-filter test file wrappers (Chemi Atlow) [#65170](https://github.com/nodejs/node/pull/65170)
+* \[[`32ead10ddd`](https://github.com/nodejs/node/commit/32ead10ddd)] - **test\_runner**: fix env option validation (Jihwan) [#64865](https://github.com/nodejs/node/pull/64865)
+* \[[`b0ef155440`](https://github.com/nodejs/node/commit/b0ef155440)] - **tls**: throw on invalid ALPNProtocols instead of aborting (Sankalp Thakur) [#65076](https://github.com/nodejs/node/pull/65076)
+* \[[`dcf65c50ce`](https://github.com/nodejs/node/commit/dcf65c50ce)] - **tls**: fix authorized state on no-cert TLS1.3 client cert resumption (Tim Perry) [#64677](https://github.com/nodejs/node/pull/64677)
+* \[[`b0f54bda78`](https://github.com/nodejs/node/commit/b0f54bda78)] - **tools**: improve commit queue failure comment (Filip Skokan) [#65433](https://github.com/nodejs/node/pull/65433)
+* \[[`bc1f2718d5`](https://github.com/nodejs/node/commit/bc1f2718d5)] - **tools**: fix max body length handler in `create-release-proposal.sh` (Antoine du Hamel) [#65455](https://github.com/nodejs/node/pull/65455)
+* \[[`bbe76516a9`](https://github.com/nodejs/node/commit/bbe76516a9)] - **tools**: bump brace-expansion in `/tools/clang-format` (dependabot\[bot]) [#64984](https://github.com/nodejs/node/pull/64984)
+* \[[`67697debdf`](https://github.com/nodejs/node/commit/67697debdf)] - **tools**: make env variables consistent in cron jobs (Antoine du Hamel) [#65168](https://github.com/nodejs/node/pull/65168)
+* \[[`ac8a68ec92`](https://github.com/nodejs/node/commit/ac8a68ec92)] - **tools**: only include fast-tracked and old enough PRs in CQ (Antoine du Hamel) [#65197](https://github.com/nodejs/node/pull/65197)
+* \[[`6d9999fa2e`](https://github.com/nodejs/node/commit/6d9999fa2e)] - **tools**: remove skip logic in `commit-queue.sh` (Antoine du Hamel) [#65162](https://github.com/nodejs/node/pull/65162)
+* \[[`60bfa1694e`](https://github.com/nodejs/node/commit/60bfa1694e)] - **tools**: bump js-yaml from 4.2.0 to 4.3.1 in /tools/lint-md (dependabot\[bot]) [#65129](https://github.com/nodejs/node/pull/65129)
+* \[[`782748527e`](https://github.com/nodejs/node/commit/782748527e)] - **tools**: bump js-yaml from 4.2.0 to 4.3.1 in /tools/eslint (dependabot\[bot]) [#65130](https://github.com/nodejs/node/pull/65130)
+* \[[`dac257340f`](https://github.com/nodejs/node/commit/dac257340f)] - **tools**: fix GITHUB\_TOKEN permissions for CQ workflow (Antoine du Hamel) [#65192](https://github.com/nodejs/node/pull/65192)
+* \[[`e624785846`](https://github.com/nodejs/node/commit/e624785846)] - **tools**: use the read-only token when filtering PRs in CQ (Antoine du Hamel) [#65169](https://github.com/nodejs/node/pull/65169)
+* \[[`7d9dcfaaa7`](https://github.com/nodejs/node/commit/7d9dcfaaa7)] - **tools**: delay removal of `commit-queue` label (Antoine du Hamel) [#65101](https://github.com/nodejs/node/pull/65101)
+* \[[`0d7c7936e7`](https://github.com/nodejs/node/commit/0d7c7936e7)] - **tools**: move ncu config to global for commit queue (Filip Skokan) [#65132](https://github.com/nodejs/node/pull/65132)
+* \[[`5e1db5a38a`](https://github.com/nodejs/node/commit/5e1db5a38a)] - **tools**: prefilter commit queue metadata (Filip Skokan) [#64343](https://github.com/nodejs/node/pull/64343)
+* \[[`f41509b91d`](https://github.com/nodejs/node/commit/f41509b91d)] - **tools**: lazy-abort failed PR merges in CQ (Antoine du Hamel) [#65004](https://github.com/nodejs/node/pull/65004)
+* \[[`ceb0e99acd`](https://github.com/nodejs/node/commit/ceb0e99acd)] - **tools**: sync mk-ca-bundle.pl with curl (Archkon) [#64753](https://github.com/nodejs/node/pull/64753)
+* \[[`600663b23f`](https://github.com/nodejs/node/commit/600663b23f)] - **tty**: add raw-vt and io raw modes (Samuel Williams) [#64140](https://github.com/nodejs/node/pull/64140)
+* \[[`a40bfc742e`](https://github.com/nodejs/node/commit/a40bfc742e)] - **typings**: add signal\_wrap internal binding types (Seongeun Lee) [#65229](https://github.com/nodejs/node/pull/65229)
+* \[[`b103a4a3b9`](https://github.com/nodejs/node/commit/b103a4a3b9)] - **typings**: add diagnostics\_channel typings (Seongeun Lee) [#65227](https://github.com/nodejs/node/pull/65227)
+* \[[`e64de34b89`](https://github.com/nodejs/node/commit/e64de34b89)] - **typings**: add watchdog internal binding types (Seongeun Lee) [#65228](https://github.com/nodejs/node/pull/65228)
+* \[[`c57c83b4d1`](https://github.com/nodejs/node/commit/c57c83b4d1)] - **typings**: add internal\_only\_v8 binding typeis (Donghoon Kang) [#65071](https://github.com/nodejs/node/pull/65071)
+* \[[`f15e8c9dcd`](https://github.com/nodejs/node/commit/f15e8c9dcd)] - **typings**: add credentials internal binding types (Donghoon Kang) [#65036](https://github.com/nodejs/node/pull/65036)
+* \[[`a500256b0b`](https://github.com/nodejs/node/commit/a500256b0b)] - **url**: skip unused href reuse comparison (Yagiz Nizipli) [#65361](https://github.com/nodejs/node/pull/65361)
+* \[[`58390f8bec`](https://github.com/nodejs/node/commit/58390f8bec)] - **url**: speed up WHATWG URL parsing (Yagiz Nizipli) [#65361](https://github.com/nodejs/node/pull/65361)
+* \[[`7d5428c812`](https://github.com/nodejs/node/commit/7d5428c812)] - **url**: speed up URLSearchParams (Yagiz Nizipli) [#65363](https://github.com/nodejs/node/pull/65363)
+* \[[`8e2461d819`](https://github.com/nodejs/node/commit/8e2461d819)] - **url**: bounds-check short Windows file URL paths (Archkon) [#64788](https://github.com/nodejs/node/pull/64788)
+* \[[`9ffc0da90c`](https://github.com/nodejs/node/commit/9ffc0da90c)] - **url**: handle unparsable serialized URLs in setters (Matteo Collina) [#64651](https://github.com/nodejs/node/pull/64651)
+* \[[`fa9d4e075d`](https://github.com/nodejs/node/commit/fa9d4e075d)] - **util**: allow single-line format when break length is infinite (Hamid Reza Ghavami) [#64238](https://github.com/nodejs/node/pull/64238)
+* \[[`b68a7c3862`](https://github.com/nodejs/node/commit/b68a7c3862)] - **util**: fix OSC 8 hyperlink stripping in stripVTControlCharacters (Dushyant Singh Hada) [#64319](https://github.com/nodejs/node/pull/64319)
+* \[[`10cbb6dc00`](https://github.com/nodejs/node/commit/10cbb6dc00)] - **util**: fix formatting of functions returned from getters (Richard Gibson) [#64839](https://github.com/nodejs/node/pull/64839)
+* \[[`64c20b449e`](https://github.com/nodejs/node/commit/64c20b449e)] - **util**: use more primordials in `comparisons.js` (Ayoub Mabrouk) [#61198](https://github.com/nodejs/node/pull/61198)
+* \[[`cea9786de8`](https://github.com/nodejs/node/commit/cea9786de8)] - **util**: preserve function names without source map names (Hiroki Osame) [#65108](https://github.com/nodejs/node/pull/65108)
+* \[[`35c635b032`](https://github.com/nodejs/node/commit/35c635b032)] - **(SEMVER-MINOR)** **util**: add non-throwing MIMEType.parse (James M Snell) [#64965](https://github.com/nodejs/node/pull/64965)
+* \[[`5858c2ba9a`](https://github.com/nodejs/node/commit/5858c2ba9a)] - **zlib**: validate pledgedSrcSize for sync zstd (Archkon) [#64601](https://github.com/nodejs/node/pull/64601)
+
 <a id="24.20.0"></a>
 
 ## 2026-08-26, Version 24.20.0 'Krypton' (LTS), @aduh95
diff --git a/doc/changelogs/CHANGELOG_V26.md b/doc/changelogs/CHANGELOG_V26.md
index d88306ed1b34..11c30aeef58b 100644
--- a/doc/changelogs/CHANGELOG_V26.md
+++ b/doc/changelogs/CHANGELOG_V26.md
@@ -8,6 +8,7 @@
 </tr>
 <tr>
 <td>
+<a href="#26.8.2">26.8.2</a><br/>
 <a href="#26.8.1">26.8.1</a><br/>
 <a href="#26.8.0">26.8.0</a><br/>
 <a href="#26.7.0">26.7.0</a><br/>
@@ -52,6 +53,96 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="26.8.2"></a>
+
+## 2026-09-09, Version 26.8.2 (Current), @aduh95
+
+### Notable Changes
+
+* \[[`616bd3fa26`](https://github.com/nodejs/node/commit/616bd3fa26)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`ae1801eb55`](https://github.com/nodejs/node/commit/ae1801eb55)] - **meta**: refine the security vuln posture for experimental features (James M Snell) [#65438](https://github.com/nodejs/node/pull/65438)
+* \[[`09feba74c8`](https://github.com/nodejs/node/commit/09feba74c8)] - **deps**: update Undici to 8.10.2 (Node.js GitHub Bot) [#65788](https://github.com/nodejs/node/pull/65788)
+* \[[`7efdbe3eb9`](https://github.com/nodejs/node/commit/7efdbe3eb9)] - **deps**: update OpenSSL to 3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+
+### Commits
+
+* \[[`d8aedd6584`](https://github.com/nodejs/node/commit/d8aedd6584)] - **build**: skip dockit on riscv64 (Stewart X Addison) [#62251](https://github.com/nodejs/node/pull/62251)
+* \[[`1899c274eb`](https://github.com/nodejs/node/commit/1899c274eb)] - **build**: activate correct default flags for riscv64 (Stewart X Addison) [#65708](https://github.com/nodejs/node/pull/65708)
+* \[[`ec8a3be996`](https://github.com/nodejs/node/commit/ec8a3be996)] - **build**: derive NODE\_ARCH from target\_cpu in the GN build (Shelley Vohr) [#65491](https://github.com/nodejs/node/pull/65491)
+* \[[`b73118a507`](https://github.com/nodejs/node/commit/b73118a507)] - **build,win**: remove LTO parallelisation limit (Stefan Stojanovic) [#65535](https://github.com/nodejs/node/pull/65535)
+* \[[`09feba74c8`](https://github.com/nodejs/node/commit/09feba74c8)] - **deps**: update undici to 8.10.2 (Node.js GitHub Bot) [#65788](https://github.com/nodejs/node/pull/65788)
+* \[[`e47c432dd6`](https://github.com/nodejs/node/commit/e47c432dd6)] - **deps**: upgrade npm to 11.19.1 (npm team) [#65573](https://github.com/nodejs/node/pull/65573)
+* \[[`2fd6ce36a9`](https://github.com/nodejs/node/commit/2fd6ce36a9)] - **deps**: update corepack to 0.36.0 (Node.js GitHub Bot) [#65653](https://github.com/nodejs/node/pull/65653)
+* \[[`49dec2767a`](https://github.com/nodejs/node/commit/49dec2767a)] - **deps**: update googletest to 36ba75f0ad5383a9759f17f3f72fd4661c72cb6d (Node.js GitHub Bot) [#65654](https://github.com/nodejs/node/pull/65654)
+* \[[`676174a071`](https://github.com/nodejs/node/commit/676174a071)] - **deps**: update simdjson to 4.6.9 (Node.js GitHub Bot) [#65655](https://github.com/nodejs/node/pull/65655)
+* \[[`2f1b7fa0bb`](https://github.com/nodejs/node/commit/2f1b7fa0bb)] - **deps**: update perfetto to 58.2 (Node.js GitHub Bot) [#65656](https://github.com/nodejs/node/pull/65656)
+* \[[`12acd0ad15`](https://github.com/nodejs/node/commit/12acd0ad15)] - **deps**: update zlib to 1.3.2.1-motley-5eb4d7e (Node.js GitHub Bot) [#65494](https://github.com/nodejs/node/pull/65494)
+* \[[`48631c80fb`](https://github.com/nodejs/node/commit/48631c80fb)] - **deps**: update archs files for openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`7efdbe3eb9`](https://github.com/nodejs/node/commit/7efdbe3eb9)] - **deps**: upgrade openssl sources to openssl-3.5.8 (Node.js GitHub Bot) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`bdc75900ee`](https://github.com/nodejs/node/commit/bdc75900ee)] - **doc**: replace `node:modules` documentation header (René) [#65800](https://github.com/nodejs/node/pull/65800)
+* \[[`44c8a499ba`](https://github.com/nodejs/node/commit/44c8a499ba)] - **doc**: clarify return type of `fs.mkdtemp*` (Antoine du Hamel) [#65743](https://github.com/nodejs/node/pull/65743)
+* \[[`025fb5eeb0`](https://github.com/nodejs/node/commit/025fb5eeb0)] - **doc**: update `changelog-maker` instructions for releasing (Juan José) [#65707](https://github.com/nodejs/node/pull/65707)
+* \[[`5f64847afa`](https://github.com/nodejs/node/commit/5f64847afa)] - **doc**: add stability status to `crypto.setEngine` (Antoine du Hamel) [#65746](https://github.com/nodejs/node/pull/65746)
+* \[[`299dee0cb9`](https://github.com/nodejs/node/commit/299dee0cb9)] - **doc**: remove outdated TLS authorized warning (Tim Perry) [#65597](https://github.com/nodejs/node/pull/65597)
+* \[[`e97dcc0278`](https://github.com/nodejs/node/commit/e97dcc0278)] - **doc**: fix broken `using` link in ffi.md (Soul Lee) [#65632](https://github.com/nodejs/node/pull/65632)
+* \[[`2c9cc7d237`](https://github.com/nodejs/node/commit/2c9cc7d237)] - **doc**: fix some broken links (Antoine du Hamel) [#65583](https://github.com/nodejs/node/pull/65583)
+* \[[`0c330ec329`](https://github.com/nodejs/node/commit/0c330ec329)] - **doc**: fix stale TOC in maintaining-dependencies (greenhead) [#65523](https://github.com/nodejs/node/pull/65523)
+* \[[`9c522a3a69`](https://github.com/nodejs/node/commit/9c522a3a69)] - **doc**: refactor the AI guidelines (Joyee Cheung) [#65269](https://github.com/nodejs/node/pull/65269)
+* \[[`46cbf1bf8c`](https://github.com/nodejs/node/commit/46cbf1bf8c)] - **doc**: fix triggerAsyncId() comment in async\_hooks example (soreavis) [#64583](https://github.com/nodejs/node/pull/64583)
+* \[[`788904ff78`](https://github.com/nodejs/node/commit/788904ff78)] - **doc**: fix fsPromises.watch overflow value (Matt Radbourne) [#64605](https://github.com/nodejs/node/pull/64605)
+* \[[`3d06ff19e8`](https://github.com/nodejs/node/commit/3d06ff19e8)] - **doc**: clarify stream direction in options.stdio note (Avocado) [#65236](https://github.com/nodejs/node/pull/65236)
+* \[[`d334838379`](https://github.com/nodejs/node/commit/d334838379)] - **doc**: clarify signal listener behavior (Som Samantray) [#65243](https://github.com/nodejs/node/pull/65243)
+* \[[`d55a2bd56a`](https://github.com/nodejs/node/commit/d55a2bd56a)] - **doc**: add test reporter event lifecycle diagram (sangwook) [#63780](https://github.com/nodejs/node/pull/63780)
+* \[[`c17dfc87de`](https://github.com/nodejs/node/commit/c17dfc87de)] - **doc**: discourage AbortSignal cleanup for long-lived resources (Efe Karasakal) [#64342](https://github.com/nodejs/node/pull/64342)
+* \[[`616bd3fa26`](https://github.com/nodejs/node/commit/616bd3fa26)] - **doc**: deprecate `Server.prototype._listen2` in `node:net` (Antoine du Hamel) [#65593](https://github.com/nodejs/node/pull/65593)
+* \[[`4e6d7e0ca6`](https://github.com/nodejs/node/commit/4e6d7e0ca6)] - **meta**: cleanup targos emeritus changes (Antoine du Hamel) [#65738](https://github.com/nodejs/node/pull/65738)
+* \[[`a70cfe1747`](https://github.com/nodejs/node/commit/a70cfe1747)] - **meta**: bump github/codeql-action/init from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65714](https://github.com/nodejs/node/pull/65714)
+* \[[`e43a0ad4ce`](https://github.com/nodejs/node/commit/e43a0ad4ce)] - **meta**: bump github/codeql-action/autobuild from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65717](https://github.com/nodejs/node/pull/65717)
+* \[[`99e06288f1`](https://github.com/nodejs/node/commit/99e06288f1)] - **meta**: bump actions/checkout from 7.0.0 to 7.0.1 (dependabot\[bot]) [#65718](https://github.com/nodejs/node/pull/65718)
+* \[[`89662762b3`](https://github.com/nodejs/node/commit/89662762b3)] - **meta**: bump cachix/install-nix-action from 31.11.0 to 31.11.1 (dependabot\[bot]) [#65719](https://github.com/nodejs/node/pull/65719)
+* \[[`6b8f078672`](https://github.com/nodejs/node/commit/6b8f078672)] - **meta**: bump actions/setup-node from 6.4.0 to 7.0.0 (dependabot\[bot]) [#65720](https://github.com/nodejs/node/pull/65720)
+* \[[`6c6fb18e63`](https://github.com/nodejs/node/commit/6c6fb18e63)] - **meta**: bump step-security/harden-runner from 2.20.0 to 2.21.0 (dependabot\[bot]) [#65721](https://github.com/nodejs/node/pull/65721)
+* \[[`0e002e859f`](https://github.com/nodejs/node/commit/0e002e859f)] - **meta**: bump github/codeql-action/upload-sarif from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65722](https://github.com/nodejs/node/pull/65722)
+* \[[`98aaffe4b9`](https://github.com/nodejs/node/commit/98aaffe4b9)] - **meta**: bump github/codeql-action/analyze from 4.37.3 to 4.37.9 (dependabot\[bot]) [#65723](https://github.com/nodejs/node/pull/65723)
+* \[[`d247cb2975`](https://github.com/nodejs/node/commit/d247cb2975)] - **meta**: document collaborator automation (Filip Skokan) [#65671](https://github.com/nodejs/node/pull/65671)
+* \[[`ae1801eb55`](https://github.com/nodejs/node/commit/ae1801eb55)] - **meta**: refine the security vuln posture for experimental features (James M Snell) [#65438](https://github.com/nodejs/node/pull/65438)
+* \[[`fab81d15c3`](https://github.com/nodejs/node/commit/fab81d15c3)] - **test**: widen the gap in the resolver maxTimeout comparison (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`62e2a6265c`](https://github.com/nodejs/node/commit/62e2a6265c)] - **test**: fix the thread-spawn handshake in the WASI threads fixture (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`7eb20b1810`](https://github.com/nodejs/node/commit/7eb20b1810)] - **test**: only count restarts after the write in watch emit-restarted test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`14c3a77bc5`](https://github.com/nodejs/node/commit/14c3a77bc5)] - **test**: ignore tunnel resets in proxy invalid-char-in-url test (Shelley Vohr) [#65780](https://github.com/nodejs/node/pull/65780)
+* \[[`ebc99e0560`](https://github.com/nodejs/node/commit/ebc99e0560)] - **test**: handle EPIPE in closed channel test (Christian Aurich) [#65770](https://github.com/nodejs/node/pull/65770)
+* \[[`5e73a2ca79`](https://github.com/nodejs/node/commit/5e73a2ca79)] - **test**: deflake test-permission-net-udp-handle (Christian Aurich) [#65767](https://github.com/nodejs/node/pull/65767)
+* \[[`beb669f7de`](https://github.com/nodejs/node/commit/beb669f7de)] - **test**: deflake test-runner-coverage (Christian Aurich) [#65728](https://github.com/nodejs/node/pull/65728)
+* \[[`ef4b6bfa62`](https://github.com/nodejs/node/commit/ef4b6bfa62)] - **test**: set type=none on IBM i for empty source (Abdirahim Musse) [#65545](https://github.com/nodejs/node/pull/65545)
+* \[[`027eef0691`](https://github.com/nodejs/node/commit/027eef0691)] - **test**: deflake WASI poll timing checks (Filip Skokan) [#65672](https://github.com/nodejs/node/pull/65672)
+* \[[`a352b0e2fe`](https://github.com/nodejs/node/commit/a352b0e2fe)] - **test**: skip `fs-watch-recursive-delete-race` on AIX (Antoine du Hamel) [#65698](https://github.com/nodejs/node/pull/65698)
+* \[[`f9ce35aa43`](https://github.com/nodejs/node/commit/f9ce35aa43)] - **test**: deflake test-inspect-async-hook-setup-at-inspect (Christian Aurich) [#65584](https://github.com/nodejs/node/pull/65584)
+* \[[`32281cec7b`](https://github.com/nodejs/node/commit/32281cec7b)] - **test**: deflake test-watch-mode-restart-esm-loading-error (Christian Aurich) [#65623](https://github.com/nodejs/node/pull/65623)
+* \[[`79be5d61be`](https://github.com/nodejs/node/commit/79be5d61be)] - **test**: avoid orphaned child on Windows abort test (Kirill Saied) [#65451](https://github.com/nodejs/node/pull/65451)
+* \[[`8972b8540b`](https://github.com/nodejs/node/commit/8972b8540b)] - **test**: fix link-local dgram scope assertion (Filip Skokan) [#65629](https://github.com/nodejs/node/pull/65629)
+* \[[`b7cd1d96de`](https://github.com/nodejs/node/commit/b7cd1d96de)] - **test**: riscv64: skip node-api sea test (Stewart X Addison) [#65569](https://github.com/nodejs/node/pull/65569)
+* \[[`7eeb9d0e57`](https://github.com/nodejs/node/commit/7eeb9d0e57)] - **test**: mark platform-specific tests as flaky (Filip Skokan) [#65562](https://github.com/nodejs/node/pull/65562)
+* \[[`649ac82bda`](https://github.com/nodejs/node/commit/649ac82bda)] - **test**: account for varied OpenSSL CCM final behaviours (Filip Skokan) [#65542](https://github.com/nodejs/node/pull/65542)
+* \[[`050fb1a15d`](https://github.com/nodejs/node/commit/050fb1a15d)] - **tools**: bump @humanfs/node from 0.16.7 to 0.16.8 in /tools/eslint (dependabot\[bot]) [#65757](https://github.com/nodejs/node/pull/65757)
+* \[[`5314dda396`](https://github.com/nodejs/node/commit/5314dda396)] - **tools**: bump browserslist from 4.28.4 to 4.28.8 in /tools/eslint (dependabot\[bot]) [#65758](https://github.com/nodejs/node/pull/65758)
+* \[[`5938a08929`](https://github.com/nodejs/node/commit/5938a08929)] - **tools**: do not hardcode `yamllint` path (Antoine du Hamel) [#65747](https://github.com/nodejs/node/pull/65747)
+* \[[`d8408f7415`](https://github.com/nodejs/node/commit/d8408f7415)] - **tools**: refine contributor guidance workflow (Filip Skokan) [#65745](https://github.com/nodejs/node/pull/65745)
+* \[[`196e372b69`](https://github.com/nodejs/node/commit/196e372b69)] - **tools**: bump the eslint group in /tools/eslint with 4 updates (dependabot\[bot]) [#65716](https://github.com/nodejs/node/pull/65716)
+* \[[`7e986b09f6`](https://github.com/nodejs/node/commit/7e986b09f6)] - **tools**: do not flag force push as invalid message (Antoine du Hamel) [#65700](https://github.com/nodejs/node/pull/65700)
+* \[[`837ce2ccef`](https://github.com/nodejs/node/commit/837ce2ccef)] - **tools**: do not hardcode path to Ruff (Antoine du Hamel) [#65681](https://github.com/nodejs/node/pull/65681)
+* \[[`1c7149a96a`](https://github.com/nodejs/node/commit/1c7149a96a)] - **tools**: retry first-time contributor query (Filip Skokan) [#65648](https://github.com/nodejs/node/pull/65648)
+* \[[`bd310a2bea`](https://github.com/nodejs/node/commit/bd310a2bea)] - **tools**: query first-time contributor status (Filip Skokan) [#65592](https://github.com/nodejs/node/pull/65592)
+* \[[`ab7b57e547`](https://github.com/nodejs/node/commit/ab7b57e547)] - **tools**: offset GitHub crons by 3 minutes (Michaël Zasso) [#65612](https://github.com/nodejs/node/pull/65612)
+* \[[`62ece28eae`](https://github.com/nodejs/node/commit/62ece28eae)] - **tools**: label PRs lacking second approval (Filip Skokan) [#65538](https://github.com/nodejs/node/pull/65538)
+* \[[`68227b4029`](https://github.com/nodejs/node/commit/68227b4029)] - **tools**: welcome first-time contributors (Filip Skokan) [#65533](https://github.com/nodejs/node/pull/65533)
+* \[[`490dc93e37`](https://github.com/nodejs/node/commit/490dc93e37)] - **tools**: enable concurrency for eslint (Huáng Jùnliàng) [#62352](https://github.com/nodejs/node/pull/62352)
+* \[[`d794676217`](https://github.com/nodejs/node/commit/d794676217)] - **typings**: fix fs\_event\_wrap start filename type (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`29e2b5a325`](https://github.com/nodejs/node/commit/29e2b5a325)] - **typings**: add fs\_event\_wrap internal binding types (leah-1ee) [#65661](https://github.com/nodejs/node/pull/65661)
+* \[[`6357c8f56e`](https://github.com/nodejs/node/commit/6357c8f56e)] - **typings**: add stream\_pipe internal binding types (Seongeun Lee) [#65664](https://github.com/nodejs/node/pull/65664)
+* \[[`569720ac7f`](https://github.com/nodejs/node/commit/569720ac7f)] - **typings**: add profiler internal binding types (Seongeun Lee) [#65660](https://github.com/nodejs/node/pull/65660)
+* \[[`52ae89c69d`](https://github.com/nodejs/node/commit/52ae89c69d)] - **typings**: add ffi internal binding types (Donghoon Kang) [#65734](https://github.com/nodejs/node/pull/65734)
+* \[[`22c7469062`](https://github.com/nodejs/node/commit/22c7469062)] - **typings**: update zlib binding declarations (이혜미) [#65639](https://github.com/nodejs/node/pull/65639)
+
 <a id="26.8.1"></a>
 
 ## 2026-08-26, Version 26.8.1 (Current), @aduh95
diff --git a/doc/contributing/collaborator-guide.md b/doc/contributing/collaborator-guide.md
index e9dc344dcd38..49ece70c2bb0 100644
--- a/doc/contributing/collaborator-guide.md
+++ b/doc/contributing/collaborator-guide.md
@@ -87,6 +87,7 @@ A pull request is _author ready_ when:
 * There is a CI run in progress or completed.
 * There is at least one collaborator approval.
 * There are no outstanding review comments.
+* There are no conflicts with the base branch.
 
 Please always add the `author ready` label to the pull request in that case.
 Please always remove it again as soon as the conditions are not met anymore.
@@ -490,6 +491,10 @@ generated commit message will not have a subsystem and might violate line length
 rules. That is OK. Append the reason for the revert and any `Refs` or `Fixes`
 metadata. Raise a pull request like any other change.
 
+Apply `dont-land-on-v?.x` labels to the revert pull request and to its
+corresponding original pull request,
+unless the original pull request has already been backported.
+
 ### Introducing new modules
 
 Treat commits that introduce new core modules with extra care.
diff --git a/doc/contributing/releases.md b/doc/contributing/releases.md
index c214f8c97cc5..57bf2dc31bf8 100644
--- a/doc/contributing/releases.md
+++ b/doc/contributing/releases.md
@@ -460,7 +460,7 @@ Collect a formatted list of commits since the last release. Use
 [`changelog-maker`](https://github.com/nodejs/changelog-maker) to do this:
 
 ```bash
-changelog-maker --group --markdown
+changelog-maker --group --format=markdown
 ```
 
 `changelog-maker` counts commits since the last tag and if the last tag
@@ -468,7 +468,7 @@ in the repository was not on the current branch you may have to supply a
 `--start-ref` argument:
 
 ```bash
-changelog-maker --group --markdown --filter-release --start-ref v1.2.2
+changelog-maker --group --format=markdown --filter-release --start-ref v1.2.2
 ```
 
 `--filter-release` will remove the release commit from the previous release.
diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index a7ee78f42aae..1b275178f9ee 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -11,6 +11,7 @@ agenda to ensure they are active and have the support they need.
 | QUIC / HTTP3           | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Unified HTTP API       | [James M Snell][jasnell]         | <https://github.com/nodejs/node>              |
 | Shadow Realm           | [Chengzhong Wu][legendecas]      | <https://github.com/nodejs/node/issues/42528> |
+| V8 Currency            |                                  |                                               |
 | Next-10                | [Jacob Smith][JakobJingleheimer] | <https://github.com/nodejs/next-10>           |
 | Single executable apps | [Darshan Sen][RaisinTen]         | <https://github.com/nodejs/single-executable> |
 | Performance            | [Rafael Gonzaga][RafaelGSS]      | <https://github.com/nodejs/performance>       |
diff --git a/doc/contributing/writing-and-running-benchmarks.md b/doc/contributing/writing-and-running-benchmarks.md
index aa28cf8e6d92..a4c8e20244cd 100644
--- a/doc/contributing/writing-and-running-benchmarks.md
+++ b/doc/contributing/writing-and-running-benchmarks.md
@@ -17,6 +17,7 @@
     * [Using `--analyze` (no external tools needed)](#using---analyze-no-external-tools-needed)
     * [Using R scripts or node-benchmark-compare](#using-r-scripts-or-node-benchmark-compare)
   * [Comparing parameters](#comparing-parameters)
+  * [Evaluating `node:bench` ports](#evaluating-nodebench-ports)
   * [Running benchmarks on the CI](#running-benchmarks-on-the-ci)
 * [Creating a benchmark](#creating-a-benchmark)
   * [Basics of a benchmark](#basics-of-a-benchmark)
@@ -706,6 +707,42 @@ chunkLen     encoding      rate confidence.interval
 
 ![compare tool boxplot](doc_img/scatter-plot.png)
 
+### Evaluating `node:bench` ports
+
+The experimental `compare-node-bench.js` and `scatter-node-bench.js` tools are
+parallel versions of the existing tools for explicit `node:bench` files. They
+do not modify or replace the legacy benchmark framework. Each repeated
+observation for a benchmark identity uses one measured sample from a separate
+process invocation. Configurations declared in the same file still execute
+serially in that process, unlike the legacy framework's configuration-level
+process isolation, and can share runtime state.
+
+Both parallel tools support inline analysis. `scatter-node-bench.js --analyze`
+uses the same `--xaxis`, `--category`, and `--no-chart` interface described for
+`scatter.js`. `compare-node-bench.js --analyze` performs Welch's t-test, while
+`--max-regression N` adds a corrected regression gate. The gate requires both a
+Holm-Bonferroni-adjusted one-sided p-value against the `N%` threshold below 0.05
+and a 95% confidence interval lying entirely beyond `-N%`; the point estimate
+alone cannot fail the command.
+Scatter analysis reduces aggregated configurations to one value per outer
+process and uses disjoint process sets for consecutive Mann-Whitney comparisons
+so configurations sharing a process are not treated as independent samples.
+
+Underscore-prefixed ports are kept beside selected legacy benchmarks and are
+excluded from legacy discovery. For example:
+
+```console
+./node benchmark/scatter.js --runs 30 \
+  benchmark/crypto/create-hash.js > legacy.csv
+./node benchmark/scatter-node-bench.js --runs 30 -- \
+  benchmark/crypto/_create-hash.node-bench.js > node-bench.csv
+```
+
+The port uses the legacy relative filename as its benchmark name and preserves
+the same parameter names. The two CSV files can therefore be analyzed with the
+same scripts to check whether their rate distributions and measurement units
+agree. See [`benchmark/README.md`][] for compare and scatter examples.
+
 ### Running benchmarks on the CI
 
 To see the performance impact of a pull request by running benchmarks on
@@ -889,6 +926,7 @@ Supported options keys are:
 
 [Cliff's delta]: https://en.wikipedia.org/wiki/Effect_size#Effect_size_for_ordinal_data
 [Mann-Whitney U test]: https://en.wikipedia.org/wiki/Mann%E2%80%93Whitney_U_test
+[`benchmark/README.md`]: ../../benchmark/README.md#nodebench-evaluation-tools
 [autocannon]: https://github.com/mcollina/autocannon
 [benchmark-ci]: https://github.com/nodejs/benchmarking/blob/HEAD/docs/core_benchmarks.md
 [git-for-windows]: https://git-scm.com/download/win
diff --git a/doc/node.1 b/doc/node.1
index e0a467967f7c..5448bfd9b78e 100644
--- a/doc/node.1
+++ b/doc/node.1
@@ -166,6 +166,17 @@ process.permission.has('fs.read', 'custom-require.js'); // true
 process.permission.has('fs.read', 'custom-require-2.js'); // true
 .Ed
 .
+.It Fl -allow-fs-vfs
+When using the Permission Model, a virtual file system cannot be
+mounted by default: \fBvfs.mount()\fR throws \fBERR_INVALID_STATE\fR unless the
+user explicitly passes the \fB--allow-fs-vfs\fR flag when starting Node.js.
+A mounted VFS serves paths that the file system permissions do not describe,
+so mounting one is gated on its own flag rather than on \fB--allow-fs-read\fR or
+\fB--allow-fs-write\fR.
+.Bd -literal
+$ node --experimental-vfs --permission --allow-fs-vfs app.js
+.Ed
+.
 .It Fl -allow-fs-write
 This flag configures file system write permissions using
 the Permission Model.
@@ -281,6 +292,57 @@ Error: Access to this API has been restricted
 }
 .Ed
 .
+.It Fl -bench
+Starts the Node.js command-line benchmark runner. At least one explicit file or
+glob pattern is required:
+.Bd -literal
+node --bench benchmark.mjs
+node --bench 'benchmarks/**/*.js'
+.Ed
+Quote glob patterns to prevent expansion by the shell. Matching files are
+sorted and executed serially. By default, each file runs in a separate child
+process. Benchmark files declare benchmarks using \fBnode:bench\fR; they must not
+call \fBrun()\fR themselves. See the benchmark runner documentation for more
+details.
+This flag cannot be combined with \fB--test\fR, \fB--watch\fR, \fB--watch-path\fR,
+\fB--check\fR, \fB--eval\fR, or \fB--interactive\fR.
+.
+.It Fl -bench-isolation Ns = Ns Ar mode
+Configures benchmark file isolation. When \fBmode\fR is \fB'process'\fR, each matching
+file runs in a separate child process. This is the default. Files are still run
+serially so their measured work does not overlap.
+When \fBmode\fR is \fB'none'\fR, all matching files and benchmarks run serially in the
+benchmark runner process. This reduces startup overhead but allows module,
+heap, and process state to carry between files. User writes to stdout or stderr
+also share destinations with benchmark reporters in this mode.
+The supported modes are \fB'process'\fR and \fB'none'\fR.
+.
+.It Fl -bench-name-pattern Ns = Ns Ar pattern
+Only runs benchmarks whose full hierarchical name matches the JavaScript
+regular expression \fBpattern\fR. Non-matching benchmarks are reported as skipped.
+.
+.It Fl -bench-reporter-destination Ns = Ns Ar destination
+Specifies the destination for the corresponding benchmark reporter. The value
+can be \fBstdout\fR, \fBstderr\fR, or a file path. A single reporter defaults to
+\fBstdout\fR when no destination is specified.
+.
+.It Fl -bench-reporter Ns = Ns Ar reporter
+Specifies a benchmark reporter. The built-in reporters are \fBspec\fR and \fBjson\fR.
+The \fBjson\fR reporter emits newline-delimited JSON. A custom reporter can be
+specified using a module specifier resolved from the current working directory.
+This option can be repeated. When multiple reporters are specified, each must
+have a corresponding \fB--bench-reporter-destination\fR. The default reporter is
+\fBspec\fR.
+.
+.It Fl -bench-samples Ns = Ns Ar count
+Overrides the maximum number of measured callback invocations for every
+selected benchmark. A benchmark may finish earlier by calling
+\fBcontext.done()\fR. \fBcount\fR must be an integer between \fB1\fR and \fB4294967295\fR.
+.
+.It Fl -bench-warmup Ns = Ns Ar count
+Overrides the number of unreported warmup callback invocations for every
+selected benchmark. \fBcount\fR must be an integer between \fB0\fR and \fB4294967295\fR.
+.
 .It Fl -build-sea Ns = Ns Ar config
 Generates a single executable application from a JSON
 configuration file. The argument must be a path to the configuration file. If
@@ -1159,6 +1221,10 @@ For more information, see the TypeScript type-stripping documentation.
 .It Fl -no-warnings
 Silence all process warnings (including deprecations).
 .
+.It Fl -no-worker-snapshot
+Start worker threads by running the internal bootstrap from scratch instead of
+deserializing the bootstrapped context from the built-in startup snapshot.
+.
 .It Fl -node-memory-debug
 Enable extra debug checks for memory leaks in Node.js internals. This is
 usually only useful for developers debugging Node.js itself.
@@ -1964,6 +2030,8 @@ one is included in the list below.
 .It
 \fB--allow-fs-read\fR
 .It
+\fB--allow-fs-vfs\fR
+.It
 \fB--allow-fs-write\fR
 .It
 \fB--allow-inspector\fR
@@ -1976,6 +2044,18 @@ one is included in the list below.
 .It
 \fB--allow-worker\fR
 .It
+\fB--bench-isolation\fR
+.It
+\fB--bench-name-pattern\fR
+.It
+\fB--bench-reporter-destination\fR
+.It
+\fB--bench-reporter\fR
+.It
+\fB--bench-samples\fR
+.It
+\fB--bench-warmup\fR
+.It
 \fB--conditions\fR, \fB-C\fR
 .It
 \fB--cpu-prof-dir\fR
@@ -2136,6 +2216,8 @@ one is included in the list below.
 .It
 \fB--no-webstorage\fR
 .It
+\fB--no-worker-snapshot\fR
+.It
 \fB--node-memory-debug\fR
 .It
 \fB--openssl-config\fR
diff --git a/lib/_http_incoming.js b/lib/_http_incoming.js
index 067a4cda3e39..ecd0d5e95179 100644
--- a/lib/_http_incoming.js
+++ b/lib/_http_incoming.js
@@ -299,6 +299,13 @@ IncomingMessage.prototype._destroy = function _destroy(err, cb) {
       cleanup();
       process.nextTick(onError, this, e || err, cb);
     });
+  } else if (err == null && !this.aborted) {
+    // The message was received completely and is being destroyed cleanly:
+    // complete the destroy synchronously. 'close' is still emitted on a
+    // later tick by the stream machinery. The deferral below only exists
+    // so that 'error' listeners attached right after destroy(err) still
+    // receive the error, which cannot matter when there is no error.
+    cb();
   } else {
     process.nextTick(onError, this, err, cb);
   }
@@ -512,7 +519,14 @@ IncomingMessage.prototype._dump = function _dump() {
     // If there is buffered data, it may trigger 'data' events.
     // Remove 'data' event listeners explicitly.
     this.removeAllListeners('data');
-    this.resume();
+    if (this.complete && !this.destroyed && this.readableLength === 0) {
+      // The message was fully received and never read: there is nothing to
+      // pull off the wire. Go straight to the 'end' emission instead of
+      // paying for the resume() and flow() scheduling machinery.
+      this.read(0);
+    } else {
+      this.resume();
+    }
   }
 };
 
diff --git a/lib/bench.js b/lib/bench.js
new file mode 100644
index 000000000000..96e199773d90
--- /dev/null
+++ b/lib/bench.js
@@ -0,0 +1,39 @@
+'use strict';
+
+const {
+  ObjectAssign,
+} = primordials;
+
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  suite,
+} = require('internal/bench_runner/harness');
+const {
+  createRunner,
+  run,
+  runFile,
+} = require('internal/bench_runner/runner');
+
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+module.exports = bench;
+ObjectAssign(module.exports, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  createRunner,
+  describe: suite,
+  run,
+  runFile,
+  suite,
+});
diff --git a/lib/bench/reporters.js b/lib/bench/reporters.js
new file mode 100644
index 000000000000..8f33b423c9ad
--- /dev/null
+++ b/lib/bench/reporters.js
@@ -0,0 +1,34 @@
+'use strict';
+
+const {
+  ObjectDefineProperties,
+  ReflectConstruct,
+} = primordials;
+const { emitExperimentalWarning } = require('internal/util');
+
+let json;
+let specFn;
+
+emitExperimentalWarning('Benchmarks');
+
+ObjectDefineProperties(module.exports, {
+  __proto__: null,
+  json: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    get() {
+      json ??= require('internal/bench_runner/reporter/json');
+      return json;
+    },
+  },
+  spec: {
+    __proto__: null,
+    configurable: true,
+    enumerable: true,
+    value: function spec() {
+      specFn ??= require('internal/bench_runner/reporter/spec');
+      return ReflectConstruct(specFn, arguments);
+    },
+  },
+});
diff --git a/lib/buffer.js b/lib/buffer.js
index 19574064ad12..7b0e37239abb 100644
--- a/lib/buffer.js
+++ b/lib/buffer.js
@@ -141,6 +141,7 @@ const {
   addBufferPrototypeMethods,
   createUnsafeBuffer,
   createUnsafeAlignedBuffer,
+  alignmentPadding,
   asciiWrite,
   latin1Write,
   utf8Write,
@@ -482,9 +483,9 @@ Buffer.allocUnsafe = function allocUnsafe(size, alignment) {
  *
  * If `alignment` is given, the memory backing the returned buffer starts at an
  * address that is a multiple of `alignment`, which is required by e.g. reads
- * and writes on file descriptors opened with `O_DIRECT`. Note that up to
- * `alignment - 1` extra bytes are allocated to satisfy the request, and that
- * the returned buffer's `byteOffset` is therefore usually non-zero.
+ * and writes on file descriptors opened with `O_DIRECT`. Note that at least
+ * `alignment` extra bytes are allocated to satisfy the request, and that the
+ * returned buffer's `byteOffset` is therefore usually non-zero.
  * @param {number} size
  * @param {number} [alignment] A power of two, at most 2 ** 30
  * @returns {FastBuffer}
@@ -504,10 +505,10 @@ function validateAlignment(size, alignment) {
     throw new ERR_INVALID_ARG_VALUE(
       'alignment', alignment, 'must be a power of two');
   }
-  // Satisfying the alignment costs up to `alignment - 1` extra bytes.
-  if (size > kMaxLength - (alignment - 1)) {
+  const padding = alignmentPadding(alignment);
+  if (size > kMaxLength - padding) {
     throw new ERR_OUT_OF_RANGE(
-      'size', `<= ${kMaxLength - (alignment - 1)}`, size);
+      'size', `<= ${kMaxLength - padding}`, size);
   }
 }
 
diff --git a/lib/diagnostics_channel.js b/lib/diagnostics_channel.js
index 7c1f4fa845ed..54c25839e611 100644
--- a/lib/diagnostics_channel.js
+++ b/lib/diagnostics_channel.js
@@ -522,11 +522,15 @@ class TracingChannel {
     return done;
   }
 
-  traceSync(fn, context = { __proto__: null }, thisArg, ...args) {
+  traceSync(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       return ReflectApply(fn, thisArg, args);
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
 
     // eslint-disable-next-line no-unused-vars
@@ -542,7 +546,7 @@ class TracingChannel {
     }
   }
 
-  tracePromise(fn, context = { __proto__: null }, thisArg, ...args) {
+  tracePromise(fn, context = undefined, thisArg, ...args) {
     if (!this.hasSubscribers) {
       const result = ReflectApply(fn, thisArg, args);
       if (typeof result?.then !== 'function') {
@@ -551,6 +555,10 @@ class TracingChannel {
       return result;
     }
 
+    if (context === undefined) {
+      context = { __proto__: null };
+    }
+
     const { error } = this;
     const continuationWindow = this.#continuationWindow;
 
diff --git a/lib/domain.js b/lib/domain.js
index cbd2b2bcd9b0..caf97983b8f8 100644
--- a/lib/domain.js
+++ b/lib/domain.js
@@ -21,8 +21,9 @@
 
 'use strict';
 
-// WARNING: THIS MODULE IS PENDING DEPRECATION.
+// WARNING: THIS MODULE IS DEPRECATED (DEP0032).
 //
+// Loading this module emits a runtime deprecation warning.
 // No new pull requests targeting this module will be accepted
 // unless they address existing, critical bugs.
 
@@ -44,6 +45,11 @@ const {
   ERR_UNHANDLED_ERROR,
 } = require('internal/errors').codes;
 
+// The `domain` module is deprecated (DEP0032). Emit a runtime deprecation
+// warning when the module is loaded.
+process.emitWarning('The `domain` module is deprecated and should not be used.',
+                    'DeprecationWarning', 'DEP0032');
+
 // Use AsyncLocalStorage for domain context propagation
 // Lazy initialization - ALS is created on first domain use
 let domainStorage;
diff --git a/lib/eslint.config_partial.mjs b/lib/eslint.config_partial.mjs
index 638e60c923b7..9240b00ac709 100644
--- a/lib/eslint.config_partial.mjs
+++ b/lib/eslint.config_partial.mjs
@@ -412,12 +412,6 @@ export default [
           name: 'SubtleCrypto',
           message: "Use `const { SubtleCrypto } = require('internal/crypto/webcrypto');` instead of the global.",
         },
-        // Float16Array is not available in primordials because it can be
-        // disabled with --no-js-float16array CLI flag.
-        {
-          name: 'Float16Array',
-          message: 'Use `const { Float16Array } = globalThis;` instead of the global.',
-        },
         // DisposableStack and AsyncDisposableStack are not available in primordials because they can be
         // disabled with --no-js-explicit-resource-management CLI flag.
         {
@@ -478,6 +472,7 @@ export default [
           name: 'FinalizationRegistry',
           into: 'Safe',
         },
+        { name: 'Float16Array' },
         { name: 'Float32Array' },
         { name: 'Float64Array' },
         { name: 'Function' },
diff --git a/lib/ffi.js b/lib/ffi.js
index cbd188793200..ce8345f155fb 100644
--- a/lib/ffi.js
+++ b/lib/ffi.js
@@ -256,11 +256,10 @@ function exportString(str, data, len, encoding = 'utf8') {
     throw new ERR_OUT_OF_RANGE('len', `>= ${requiredLength}`, len);
   }
 
-  const targetBuffer = toBuffer(data, len, false);
-  const dataLength = sourceBuffer.length;
-
-  sourceBuffer.copy(targetBuffer, 0, 0, dataLength);
-  targetBuffer.fill(0, dataLength, dataLength + terminatorSize);
+  const terminated = Buffer.allocUnsafe(requiredLength);
+  sourceBuffer.copy(terminated);
+  terminated.fill(0, sourceBuffer.length);
+  exportBytes(terminated, data, len);
 }
 
 function exportBuffer(source, data, len) {
diff --git a/lib/fs.js b/lib/fs.js
index e1406596c583..10ab1cb2ecae 100644
--- a/lib/fs.js
+++ b/lib/fs.js
@@ -28,7 +28,6 @@ const {
   ArrayFromAsync,
   ArrayPrototypePush,
   BigIntPrototypeToString,
-  Boolean,
   FunctionPrototypeCall,
   MathMax,
   Number,
@@ -57,9 +56,6 @@ const {
   F_OK,
   O_WRONLY,
   O_SYMLINK,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const pathModule = require('path');
@@ -83,6 +79,7 @@ const {
 const {
   FSReqCallback,
   ReadFileJob,
+  WriteFileJob,
 } = binding;
 const { toPathIfFileURL } = require('internal/url');
 const {
@@ -103,10 +100,11 @@ const {
     kReadFileBufferLength,
     kMaxUserId,
   },
+  collectRecursiveReaddirResult,
   copyObject,
   Dirent,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getValidatedFd,
   getValidatedPath,
@@ -1744,57 +1742,40 @@ function mkdirSync(path, options) {
 }
 
 /**
- * Appends one directory's entries to `context.results` and the subdirectories
- * still to visit to `context.dirs` (with the prefix their entries get in
- * string results in `context.prefixes`). `result` is a `binding.readdir()`
- * result with file types, so only symbolic links and entries of unknown type
- * need a stat() to find out whether they lead to a directory.
- * @param {string} dir
- * @param {string} prefix
- * @param {[string[], number[]]} result
- * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
- */
-function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
-  const { length } = names;
-  for (let i = 0; i < length; i++) {
-    const name = names[i];
-    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-    let isDirectory;
-    if (context.withFileTypes) {
-      const dirent = getDirent(dir, name, types[i]);
-      ArrayPrototypePush(context.results, dirent);
-      // Follow symbolic links to directories, see https://github.com/nodejs/node/issues/52663
-      isDirectory = dirent.isDirectory() ||
-        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    } else {
-      ArrayPrototypePush(context.results, relative);
-      const type = types[i];
-      isDirectory = type === UV_DIRENT_DIR ||
-        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
-    }
-    if (isDirectory) {
-      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
-      ArrayPrototypePush(context.prefixes, relative);
-    }
-  }
-}
-
-/*
- * An recursive algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Reads the entire contents of the `basePath` directory. This function does
+ * not validate `basePath` as a directory. It is passed directly to
+ * `binding.readdirRecursive`, or to `binding.readdir` for each directory when
+ * the permission model is enabled, since that checks every directory on the
+ * main thread where the native walk can not.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
  * @param {(
  *   err?: Error,
  *   files?: string[] | Buffer[] | Dirent[]
  * ) => any} callback
  * @returns {void}
-*/
+ */
 function readdirRecursive(basePath, options, callback) {
+  if (permission.isEnabled()) {
+    readdirRecursiveWithPermissionModel(basePath, options, callback);
+    return;
+  }
+  const withFileTypes = !!options.withFileTypes;
+  const req = new FSReqCallback();
+  req.oncomplete = (err, result) => {
+    if (err) {
+      callback(err);
+      return;
+    }
+    callback(null, withFileTypes ? getRecursiveDirents(basePath, result) : result);
+  };
+  binding.readdirRecursive(basePath, options.encoding, withFileTypes, req);
+}
+
+function readdirRecursiveWithPermissionModel(basePath, options, callback) {
+  const { encoding } = options;
   const context = {
-    withFileTypes: Boolean(options.withFileTypes),
+    withFileTypes: !!options.withFileTypes,
     results: [],
     dirs: [basePath],
     prefixes: [''],
@@ -1816,11 +1797,6 @@ function readdirRecursive(basePath, options, callback) {
         return;
       }
 
-      if (result === undefined) {
-        callback(null, context.results);
-        return;
-      }
-
       try {
         collectRecursiveReaddirResult(path, prefix, result, context);
       } catch (err) {
@@ -1835,37 +1811,37 @@ function readdirRecursive(basePath, options, callback) {
       }
     };
 
-    binding.readdir(path, options.encoding, true, req);
+    binding.readdir(path, encoding, true, req);
   }
 
   read(context.dirs[i], context.prefixes[i++]);
 }
 
 /**
- * An iterative algorithm for reading the entire contents of the `basePath` directory.
- * This function does not validate `basePath` as a directory. It is passed directly to
- * `binding.readdir`.
- * @param {string} basePath
+ * Synchronously reads the entire contents of the `basePath` directory, see
+ * `readdirRecursive`.
+ * @param {string | Buffer} basePath
  * @param {{ encoding: string, withFileTypes: boolean }} options
- * @returns {string[] | Dirent[]}
+ * @returns {string[] | Buffer[] | Dirent[]}
  */
 function readdirSyncRecursive(basePath, options) {
-  const context = {
-    withFileTypes: Boolean(options.withFileTypes),
-    results: [],
-    dirs: [basePath],
-    prefixes: [''],
-  };
-
-  for (let i = 0; i < context.dirs.length; i++) {
-    const dir = context.dirs[i];
-    const result = binding.readdir(dir, options.encoding, true);
-    if (result !== undefined) {
+  const withFileTypes = !!options.withFileTypes;
+  if (permission.isEnabled()) {
+    const context = {
+      withFileTypes,
+      results: [],
+      dirs: [basePath],
+      prefixes: [''],
+    };
+    for (let i = 0; i < context.dirs.length; i++) {
+      const dir = context.dirs[i];
+      const result = binding.readdir(dir, options.encoding, true);
       collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
     }
+    return context.results;
   }
-
-  return context.results;
+  const result = binding.readdirRecursive(basePath, options.encoding, withFileTypes);
+  return result !== undefined && withFileTypes ? getRecursiveDirents(basePath, result) : result;
 }
 
 /**
@@ -1899,9 +1875,6 @@ function readdir(path, options, callback) {
   }
 
   if (options.recursive) {
-    // Make shallow copy to prevent mutating options from affecting results
-    options = copyObject(options);
-
     readdirRecursive(path, options, callback);
     return;
   }
@@ -2019,7 +1992,8 @@ function lstat(path, options = { __proto__: null, bigint: false }, callback) {
 
   callback = makeStatsCallback(callback);
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     callback(new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource));
     return;
@@ -2076,7 +2050,13 @@ function statfs(path, options = { __proto__: null, bigint: false }, callback) {
 
   const h = vfsState.handlers;
   if (h !== null) {
-    const result = h.statfsSync(path, options);
+    let result;
+    try {
+      result = h.statfsSync(path, options);
+    } catch (err) {
+      process.nextTick(callback, err);
+      return;
+    }
     if (result !== undefined) {
       process.nextTick(callback, null, result);
       return;
@@ -2137,7 +2117,8 @@ function lstatSync(path, options = { __proto__: null, bigint: false, throwIfNoEn
     }
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = BufferIsBuffer(path) ? BufferToString(path) : path;
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2264,7 +2245,8 @@ function symlink(target, path, type, callback) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     callback(new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.'));
     return;
   }
@@ -2338,7 +2320,8 @@ function symlinkSync(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -2957,6 +2940,23 @@ function writeFile(path, data, options, callback) {
   if (checkAborted(options.signal, callback))
     return;
 
+  if (!flush) {
+    // Open + write + close in one thread pool round trip.
+    const signal = options.signal;
+    path = getValidatedPath(path);
+    const job = new WriteFileJob(path, stringToFlags(flag, 'options.flag'),
+                                 parseFileMode(options.mode, 'mode', 0o666), data);
+    job.ondone = signal == null ? callback : (err) => {
+      // An abort that arrived while the write was in flight still wins.
+      callback(signal.aborted && !err ? new AbortError(undefined, { cause: signal.reason }) : err);
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      callback(accessError);
+    }
+    return;
+  }
+
   fs.open(path, flag, options.mode, (openErr, fd) => {
     if (openErr) {
       callback(openErr);
@@ -3689,7 +3689,9 @@ function mkdtemp(prefix, options, callback) {
   if (h !== null && vfsResult(h.mkdtemp(prefix, typeof options === 'function' ? undefined : options), callback)) return;
 
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
@@ -3712,7 +3714,9 @@ function mkdtempSync(prefix, options) {
   }
 
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
   return binding.mkdtemp(prefix, options.encoding);
@@ -3728,7 +3732,9 @@ function mkdtempSync(prefix, options) {
  */
 function mkdtempDisposableSync(prefix, options) {
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
diff --git a/lib/https.js b/lib/https.js
index 6ae2e5d8a213..75ec8bb3f895 100644
--- a/lib/https.js
+++ b/lib/https.js
@@ -70,6 +70,7 @@ let debug = require('internal/util/debuglog').debuglog('https', (fn) => {
   debug = fn;
 });
 const net = require('net');
+const { Buffer } = require('buffer');
 const { URL, urlToHttpOptions, isURL } = require('internal/url');
 const { validateObject } = require('internal/validators');
 const { isIP } = require('internal/net');
@@ -204,6 +205,7 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
   const result = {
     __proto__: null,
     proxyTunnelPayload: payload,
+    maxHeaderSize: reqOptions.maxHeaderSize || getOptionValue('--max-http-header-size'),
     requestOptions: {  // Options used for the request sent after the tunnel is established.
       __proto__: null,
       servername: reqOptions.servername || ipType ? undefined : reqOptions.host,
@@ -215,17 +217,17 @@ function getTunnelConfigForProxiedHttps(agent, reqOptions) {
 };
 
 function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
-  const { proxyTunnelPayload } = tunnelConfig;
+  const { proxyTunnelPayload, maxHeaderSize } = tunnelConfig;
   // By default, the socket is in paused mode. Read to look for the 200
   // connection established response.
   function read() {
     let chunk;
     while ((chunk = socket.read()) !== null) {
-      if (onProxyData(chunk) !== -1) {
-        break;
+      if (onProxyData(chunk)) {
+        return;
       }
     }
-    socket.on('readable', read);
+    socket.once('readable', read);
   }
 
   function cleanup() {
@@ -243,14 +245,25 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
 
   // Read the headers from the chunks and check for the status code. If it fails we
   // clean up the socket and return an error. Otherwise we establish the tunnel.
-  let buffer = '';
+  let buffer;
   function onProxyData(chunk) {
-    const str = chunk.toString();
-    debug('onProxyData', str);
-    buffer += str;
+    debug('onProxyData', chunk.length);
+    buffer = buffer === undefined ? chunk :
+      Buffer.concat([buffer, chunk], buffer.length + chunk.length);
     const headerEndIndex = buffer.indexOf('\r\n\r\n');
-    if (headerEndIndex === -1) return headerEndIndex;
-    const statusLine = buffer.substring(0, buffer.indexOf('\r\n'));
+    const headerLength = headerEndIndex === -1 ?
+      buffer.length : headerEndIndex + 4;
+    if (headerLength > maxHeaderSize) {
+      debug(`Proxy response headers exceed ${maxHeaderSize} bytes, cleaning up`);
+      cleanup();
+      const err = new ERR_PROXY_TUNNEL(
+        `Proxy response headers exceeded ${maxHeaderSize} bytes`);
+      afterSocket(err, socket);
+      return true;
+    }
+    if (headerEndIndex === -1) return false;
+    const statusLineEndIndex = buffer.indexOf('\r\n');
+    const statusLine = buffer.subarray(0, statusLineEndIndex).toString();
     const statusCode = statusLine.split(' ')[1];
     if (statusCode !== '200') {
       debug(`onProxyData receives ${statusCode}, cleaning up`);
@@ -292,7 +305,7 @@ function establishTunnel(agent, socket, options, tunnelConfig, afterSocket) {
       });
       tunneldSocket.on('error', onTLSHandshakeError);
     }
-    return headerEndIndex;
+    return true;
   }
 
   function onProxyEnd() {
diff --git a/lib/internal/abort_controller.js b/lib/internal/abort_controller.js
index 09b160e9fe5a..ef30d9619749 100644
--- a/lib/internal/abort_controller.js
+++ b/lib/internal/abort_controller.js
@@ -149,8 +149,8 @@ function refreshCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
   }
@@ -170,8 +170,8 @@ function followCompositeSignal(signal) {
       continue;
     }
 
-    if (sourceSignal.aborted) {
-      abortSignal(signal, sourceSignal.reason);
+    if (sourceSignal[kAborted]) {
+      abortSignal(signal, sourceSignal[kReason]);
       return;
     }
 
@@ -217,6 +217,14 @@ function setWeakAbortSignalTimeout(weakRef, delay) {
 }
 
 class AbortSignal extends EventTarget {
+  #brand;
+
+  static {
+    converters.AbortSignal = createInterfaceConverter(
+      'AbortSignal',
+      (value) => typeof value === 'object' && value !== null && #brand in value,
+    );
+  }
 
   /**
    * @param {symbol | undefined} dontThrowSymbol
@@ -337,8 +345,9 @@ class AbortSignal extends EventTarget {
         gcPersistentSignals.add(signal);
       }
 
-      if (signal.aborted) {
-        abortSignal(resultSignal, signal.reason);
+      refreshCompositeSignal(signal);
+      if (signal[kAborted]) {
+        abortSignal(resultSignal, signal[kReason]);
         return resultSignal;
       }
 
@@ -348,11 +357,6 @@ class AbortSignal extends EventTarget {
       } else if (!signal[kSourceSignals]) {
         continue;
       } else {
-        refreshCompositeSignal(signal);
-        if (signal.aborted) {
-          abortSignal(resultSignal, signal.reason);
-          return resultSignal;
-        }
         for (const sourceSignalWeakRef of signal[kSourceSignals]) {
           const sourceSignal = sourceSignalWeakRef.deref();
           if (!sourceSignal) {
@@ -360,8 +364,8 @@ class AbortSignal extends EventTarget {
           }
           assert(!sourceSignal[kComposite]);
 
-          if (sourceSignal.aborted) {
-            abortSignal(resultSignal, sourceSignal.reason);
+          if (sourceSignal[kAborted]) {
+            abortSignal(resultSignal, sourceSignal[kReason]);
             return resultSignal;
           }
 
@@ -466,7 +470,6 @@ class AbortSignal extends EventTarget {
   }
 }
 
-converters.AbortSignal = createInterfaceConverter('AbortSignal', AbortSignal.prototype);
 converters['sequence<AbortSignal>'] = createSequenceConverter(converters.AbortSignal);
 
 function ClonedAbortSignal() {
@@ -639,6 +642,7 @@ module.exports = {
   AbortController,
   AbortSignal,
   ClonedAbortSignal,
+  abortSignal,
   aborted,
   transferableAbortSignal,
   transferableAbortController,
diff --git a/lib/internal/bench_runner/benchmark.js b/lib/internal/bench_runner/benchmark.js
new file mode 100644
index 000000000000..375f8e6b635f
--- /dev/null
+++ b/lib/internal/bench_runner/benchmark.js
@@ -0,0 +1,591 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSort,
+  JSONStringify,
+  MathFloor,
+  MathMax,
+  MathMin,
+  MathRound,
+  MathSqrt,
+  Number,
+  NumberIsFinite,
+  NumberMAX_SAFE_INTEGER,
+  ObjectFreeze,
+  ObjectKeys,
+  PromiseWithResolvers,
+  SafeSet,
+  StringPrototypeToLowerCase,
+} = primordials;
+const { AsyncResource } = require('async_hooks');
+const {
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+    ERR_OUT_OF_RANGE,
+  },
+} = require('internal/errors');
+const { createHistogram } = require('internal/histogram');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateFunction,
+  validateInteger,
+  validateNumber,
+  validateObject,
+  validateString,
+  validateUint32,
+} = require('internal/validators');
+const { structuredClone } = require('internal/worker/js_transferable');
+
+const { bigint: hrtime } = process.hrtime;
+const kDefaultSamples = 30;
+const kDefaultWarmup = 0;
+const kEmptyDiagnosticChannels = ObjectFreeze([]);
+const kEmptyNamePath = ObjectFreeze([]);
+const kEmptyParams = ObjectFreeze({ __proto__: null });
+const kEmptyTags = ObjectFreeze([]);
+
+function validateSkip(skip) {
+  if (skip !== undefined && typeof skip !== 'boolean' &&
+      typeof skip !== 'string') {
+    throw new ERR_INVALID_ARG_TYPE('options.skip', ['boolean', 'string'], skip);
+  }
+}
+
+function canonicalizeTags(tags, parentTags = kEmptyTags) {
+  if (tags === undefined) return parentTags;
+  if (!ArrayIsArray(tags)) {
+    throw new ERR_INVALID_ARG_TYPE('options.tags', 'Array', tags);
+  }
+
+  const result = ArrayPrototypeSlice(parentTags);
+  const seen = new SafeSet(parentTags);
+  for (let i = 0; i < tags.length; i++) {
+    validateString(tags[i], `options.tags[${i}]`);
+    if (tags[i].length === 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        `options.tags[${i}]`, tags[i], 'must not be empty');
+    }
+    const tag = StringPrototypeToLowerCase(tags[i]);
+    if (!seen.has(tag)) {
+      seen.add(tag);
+      ArrayPrototypePush(result, tag);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeDiagnosticChannels(
+  diagnosticChannels,
+  parentDiagnosticChannels = kEmptyDiagnosticChannels,
+) {
+  if (diagnosticChannels === undefined) return parentDiagnosticChannels;
+  if (!ArrayIsArray(diagnosticChannels)) {
+    throw new ERR_INVALID_ARG_TYPE(
+      'options.diagnosticChannels', 'Array', diagnosticChannels);
+  }
+
+  const result = ArrayPrototypeSlice(parentDiagnosticChannels);
+  const seen = new SafeSet(parentDiagnosticChannels);
+  for (let i = 0; i < diagnosticChannels.length; i++) {
+    const name = diagnosticChannels[i];
+    if (typeof name === 'symbol') continue;
+    if (typeof name !== 'string') {
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.diagnosticChannels[${i}]`, ['string', 'symbol'], name);
+    }
+    if (!seen.has(name)) {
+      seen.add(name);
+      ArrayPrototypePush(result, name);
+    }
+  }
+  return ObjectFreeze(result);
+}
+
+function canonicalizeParams(params) {
+  if (params === undefined) return kEmptyParams;
+  validateObject(params, 'options.params');
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(params);
+  ArrayPrototypeSort(keys);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const value = params[key];
+    if (typeof value !== 'string' && typeof value !== 'boolean' &&
+        (typeof value !== 'number' || !NumberIsFinite(value))) {
+      if (typeof value === 'number') {
+        throw new ERR_OUT_OF_RANGE(
+          `options.params.${key}`, 'a finite number', value);
+      }
+      throw new ERR_INVALID_ARG_TYPE(
+        `options.params.${key}`, ['string', 'number', 'boolean'], value);
+    }
+    result[key] = value;
+  }
+  return ObjectFreeze(result);
+}
+
+function validateNodeOptions(options, parentTags, parentDiagnosticChannels) {
+  validateObject(options, 'options');
+  const { diagnosticChannels, only = false, skip, tags } = options;
+  if (typeof only !== 'boolean') {
+    throw new ERR_INVALID_ARG_TYPE('options.only', 'boolean', only);
+  }
+  validateSkip(skip);
+  return {
+    __proto__: null,
+    diagnosticChannels: canonicalizeDiagnosticChannels(
+      diagnosticChannels, parentDiagnosticChannels),
+    only,
+    skip,
+    tags: canonicalizeTags(tags, parentTags),
+  };
+}
+
+function createLocation(loc, fallbackFile) {
+  return {
+    __proto__: null,
+    file: loc?.[2] ?? fallbackFile,
+    line: loc?.[0],
+    column: loc?.[1],
+  };
+}
+
+function getNamePath(parent, name) {
+  const path = [];
+  for (let current = parent; current?.parent !== null; current = current.parent) {
+    ArrayPrototypePush(path, current.name);
+  }
+  ArrayPrototypeReverse(path);
+  ArrayPrototypePush(path, name);
+  return path;
+}
+
+function cloneSample(sample) {
+  const result = {
+    __proto__: null,
+    operations: sample.operations,
+    duration_ns: sample.duration_ns,
+    rate: sample.rate,
+  };
+  if (sample.detail !== undefined) {
+    result.detail = structuredClone(sample.detail);
+  }
+  return result;
+}
+
+class Suite extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc, isRoot = false) {
+    super('BenchSuite');
+    const validated = validateNodeOptions(
+      options,
+      parent?.tags ?? kEmptyTags,
+      parent?.diagnosticChannels ?? kEmptyDiagnosticChannels,
+    );
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.isRoot = isRoot;
+    this.fileScope = isRoot ? null :
+      (parent.isRoot ? harness.getFileScope() : parent.fileScope);
+    this.namePath = isRoot ? kEmptyNamePath :
+      ObjectFreeze(getNamePath(parent, name));
+    this.suiteId = isRoot ? null : JSONStringify([
+      this.loc.file,
+      this.namePath,
+    ]);
+    this.parentId = isRoot || parent.isRoot ? null : parent.suiteId;
+    this.diagnosticChannels = validated.diagnosticChannels;
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.children = [];
+    this.hooks = {
+      __proto__: null,
+      after: [],
+      afterEach: [],
+      before: [],
+      beforeEach: [],
+    };
+    this.buildError = null;
+    this.buildPromise = null;
+    this.finished = false;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class Bench extends AsyncResource {
+  constructor(harness, parent, name, options, fn, loc) {
+    super('Benchmark');
+    const validated = validateNodeOptions(
+      options, parent.tags, parent.diagnosticChannels);
+    const {
+      params,
+      samples = kDefaultSamples,
+      signal,
+      timeout = Infinity,
+      warmup = kDefaultWarmup,
+    } = options;
+
+    validateUint32(samples, 'options.samples', true);
+    validateUint32(warmup, 'options.warmup');
+    validateAbortSignal(signal, 'options.signal');
+    if (timeout !== Infinity) {
+      validateNumber(timeout, 'options.timeout', 0, TIMEOUT_MAX);
+    }
+
+    this.harness = harness;
+    this.parent = parent;
+    this.name = name;
+    this.fn = fn;
+    this.loc = createLocation(loc, harness.entryFile);
+    this.diagnosticChannels = validated.diagnosticChannels;
+    this.only = validated.only;
+    this.skip = validated.skip;
+    this.tags = validated.tags;
+    this.params = canonicalizeParams(params);
+    this.samples = samples;
+    this.warmup = warmup;
+    this.timeout = timeout;
+    this.outerSignal = signal;
+    this.fileScope = parent.isRoot ? harness.getFileScope() : parent.fileScope;
+    this.namePath = ObjectFreeze(getNamePath(parent, name));
+    this.fullName = ArrayPrototypeJoin(this.namePath, ' ');
+    this.benchId = JSONStringify([
+      this.loc.file,
+      this.namePath,
+      this.params,
+    ]);
+    this.parentId = parent.suiteId;
+    this.finished = false;
+    this.result = null;
+    this.completion = PromiseWithResolvers();
+  }
+}
+
+class BenchContext {
+  #closed = false;
+  #done = false;
+  #endCalled = false;
+  #index;
+  #invalid = false;
+  #onDiagnostic;
+  #phase;
+  #recordCalled = false;
+  #sample = null;
+  #startCalled = false;
+  #startTime;
+
+  constructor(bench, signal, phase, index, onDiagnostic) {
+    this.name = bench.name;
+    this.params = bench.params;
+    this.signal = signal;
+    this.#phase = phase;
+    this.#index = index;
+    this.#onDiagnostic = onDiagnostic;
+  }
+
+  get index() {
+    return this.#index;
+  }
+
+  get phase() {
+    return this.#phase;
+  }
+
+  diagnostic(message, options = kEmptyObject) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    try {
+      const clonedMessage = structuredClone(message);
+      validateObject(options, 'options');
+      const { detail, level = 'info' } = options;
+      validateString(level, 'options.level');
+      if (level !== 'info' && level !== 'warning') {
+        throw new ERR_INVALID_ARG_VALUE(
+          'options.level', level, "must be 'info' or 'warning'");
+      }
+      const diagnostic = { __proto__: null, level, message: clonedMessage };
+      if (detail !== undefined) diagnostic.detail = structuredClone(detail);
+      this.#onDiagnostic(diagnostic);
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+  }
+
+  start() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() cannot be combined with record()');
+    }
+    if (this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'start() must be called exactly once per benchmark sample');
+    }
+    this.#startCalled = true;
+    this.#startTime = hrtime();
+  }
+
+  end(operations, options = kEmptyObject) {
+    const endTime = hrtime();
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() cannot be combined with record()');
+    }
+    if (this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'end() must be called exactly once per benchmark sample');
+    }
+    this.#endCalled = true;
+    if (!this.#startCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('end() cannot be called before start()');
+    }
+
+    try {
+      validateObject(options, 'options');
+      const { detail } = options;
+      validateInteger(operations, 'operations', 1, NumberMAX_SAFE_INTEGER);
+      const duration = endTime - this.#startTime;
+      if (duration === 0n) {
+        throw new ERR_INVALID_STATE(
+          'insufficient clock precision for benchmark sample');
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns: duration,
+        rate: operations / (Number(duration) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  record(sample) {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#recordCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() must be called exactly once per benchmark sample');
+    }
+    if (this.#startCalled || this.#endCalled) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'record() cannot be combined with start() or end()');
+    }
+    this.#recordCalled = true;
+
+    try {
+      validateObject(sample, 'sample');
+      const { detail, duration_ns, operations } = sample;
+      validateInteger(
+        operations, 'sample.operations', 1, NumberMAX_SAFE_INTEGER);
+      if (typeof duration_ns !== 'bigint') {
+        throw new ERR_INVALID_ARG_TYPE(
+          'sample.duration_ns', 'bigint', duration_ns);
+      }
+      if (duration_ns <= 0n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns', 'a positive bigint', duration_ns);
+      }
+      if (duration_ns > 9_007_199_254_740_991n) {
+        throw new ERR_OUT_OF_RANGE(
+          'sample.duration_ns',
+          'less than or equal to Number.MAX_SAFE_INTEGER',
+          duration_ns);
+      }
+      this.#sample = {
+        __proto__: null,
+        operations,
+        duration_ns,
+        rate: operations / (Number(duration_ns) / 1e9),
+      };
+      if (detail !== undefined) {
+        this.#sample.detail = structuredClone(detail);
+      }
+    } catch (error) {
+      this.#invalid = true;
+      throw error;
+    }
+    return cloneSample(this.#sample);
+  }
+
+  done() {
+    if (this.#closed) {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE('benchmark sample is no longer active');
+    }
+    if (this.#phase !== 'measurement') {
+      this.#invalid = true;
+      throw new ERR_INVALID_STATE(
+        'done() can only be called during a measured sample');
+    }
+    this.#done = true;
+  }
+
+  finish() {
+    this.#closed = true;
+    if (this.#invalid) {
+      throw new ERR_INVALID_STATE(
+        'benchmark sample violated the context method contract');
+    }
+    if (!this.#recordCalled && !this.#startCalled) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call start() or record()');
+    }
+    if (!this.#recordCalled && (!this.#endCalled || this.#sample === null)) {
+      throw new ERR_INVALID_STATE(
+        'benchmark callback did not call end()');
+    }
+    return {
+      __proto__: null,
+      done: this.#done,
+      sample: this.#sample,
+    };
+  }
+
+  close() {
+    this.#closed = true;
+  }
+}
+
+function arithmeticMean(values) {
+  let sum = 0;
+  let compensation = 0;
+  for (let i = 0; i < values.length; i++) {
+    const adjusted = values[i] - compensation;
+    const next = sum + adjusted;
+    compensation = (next - sum) - adjusted;
+    sum = next;
+  }
+  return sum / values.length;
+}
+
+function summarizeSamples(samples) {
+  const rates = [];
+  let min = Infinity;
+  let max = -Infinity;
+  for (let i = 0; i < samples.length; i++) {
+    const rate = samples[i].rate;
+    ArrayPrototypePush(rates, rate);
+    min = MathMin(min, rate);
+    max = MathMax(max, rate);
+  }
+
+  const mean = arithmeticMean(rates);
+  let variance = 0;
+  for (let i = 0; i < rates.length; i++) {
+    const difference = rates[i] - mean;
+    variance += difference * difference;
+  }
+  variance /= rates.length;
+  const stddev = MathSqrt(variance);
+
+  const sorted = ArrayPrototypeSlice(rates);
+  ArrayPrototypeSort(sorted, (a, b) => a - b);
+  const middle = MathFloor(sorted.length / 2);
+  const median = sorted.length % 2 === 0 ?
+    (sorted[middle - 1] + sorted[middle]) / 2 : sorted[middle];
+
+  const scale = MathMin(1_000_000, NumberMAX_SAFE_INTEGER / max);
+  const histogram = createHistogram({ __proto__: null, figures: 5 });
+  for (let i = 0; i < rates.length; i++) {
+    const value = MathMax(
+      1,
+      MathMin(NumberMAX_SAFE_INTEGER, MathRound(rates[i] * scale)),
+    );
+    histogram.record(value);
+  }
+
+  const meanCI = histogram.meanCI();
+  const histogramMean = meanCI.mean / scale;
+  const medianCI = histogram.percentileCI(50);
+
+  return {
+    __proto__: null,
+    mean,
+    median,
+    min,
+    max,
+    stddev,
+    coefficientOfVariation: stddev / mean,
+    confidenceInterval: {
+      __proto__: null,
+      lower: mean + meanCI.lower / scale - histogramMean,
+      upper: mean + meanCI.upper / scale - histogramMean,
+    },
+    medianConfidenceInterval: {
+      __proto__: null,
+      lower: medianCI.lower / scale,
+      upper: medianCI.upper / scale,
+    },
+    skewness: histogram.skewness,
+  };
+}
+
+function normalizeArgs(type, name, options, fn) {
+  if (typeof name === 'function') {
+    fn = name;
+    name = fn.name || '<anonymous>';
+    options = kEmptyObject;
+  } else if (name !== null && typeof name === 'object') {
+    fn = options;
+    options = name;
+    name = fn?.name || '<anonymous>';
+  } else if (typeof options === 'function') {
+    fn = options;
+    options = kEmptyObject;
+  }
+
+  validateFunction(fn, `${type} function`);
+  validateString(name, `${type} name`);
+  if (name.length === 0) {
+    throw new ERR_INVALID_ARG_VALUE(`${type} name`, name, 'must not be empty');
+  }
+  validateObject(options, 'options');
+  return { __proto__: null, fn, name, options };
+}
+
+module.exports = {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+};
diff --git a/lib/internal/bench_runner/benchmarks_stream.js b/lib/internal/bench_runner/benchmarks_stream.js
new file mode 100644
index 000000000000..295aa20483ce
--- /dev/null
+++ b/lib/internal/bench_runner/benchmarks_stream.js
@@ -0,0 +1,291 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayIsArray,
+  ArrayPrototypePush,
+  MapPrototypeClear,
+  MapPrototypeEntries,
+  MapPrototypeSet,
+  ObjectDefineProperty,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetOwnPropertyNames,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectSetPrototypeOf,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  SafeMap,
+  SetPrototypeAdd,
+  SetPrototypeClear,
+  SetPrototypeValues,
+  Symbol,
+} = primordials;
+const Readable = require('internal/streams/readable');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { isError } = require('internal/util');
+const { isMap, isSet } = require('internal/util/types');
+const { structuredClone } = require('internal/worker/js_transferable');
+
+const kEmitMessage = Symbol('kEmitMessage');
+
+function repairError(source, clone, seen) {
+  const serialized = deserializeError(serializeError(source));
+  let sourceName;
+  try {
+    sourceName = source.name;
+  } catch {
+    // The serialized form already omits properties whose getters throw.
+  }
+  let repaired = clone;
+  if (!isError(repaired) ||
+      (sourceName !== undefined && repaired.name !== sourceName)) {
+    repaired = serialized;
+  }
+  if (repaired === null || typeof repaired !== 'object') return repaired;
+  seen.set(source, repaired);
+
+  if (serialized !== null && typeof serialized === 'object') {
+    const serializedKeys = ObjectGetOwnPropertyNames(serialized);
+    for (let i = 0; i < serializedKeys.length; i++) {
+      const key = serializedKeys[i];
+      if (ObjectPrototypeHasOwnProperty(repaired, key)) continue;
+      const descriptor = ObjectGetOwnPropertyDescriptor(serialized, key);
+      ObjectSetPrototypeOf(descriptor, null);
+      ObjectDefineProperty(repaired, key, descriptor);
+    }
+  }
+
+  const keys = ObjectGetOwnPropertyNames(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value') ||
+        typeof descriptor.value === 'function' ||
+        typeof descriptor.value === 'symbol') {
+      continue;
+    }
+    const existing = ObjectGetOwnPropertyDescriptor(repaired, key);
+    const value = descriptor.value !== null &&
+      typeof descriptor.value === 'object' ?
+      repairClone(descriptor.value, existing?.value, seen) : descriptor.value;
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(repaired, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  return repaired;
+}
+
+function repairClone(source, clone, seen) {
+  if (source === null || (typeof source !== 'object' &&
+                          typeof source !== 'function')) {
+    return clone === undefined ? source : clone;
+  }
+  if (typeof source === 'function') return clone;
+  if (seen.has(source)) return seen.get(source);
+  if (isError(source)) return repairError(source, clone, seen);
+  if (clone === null || typeof clone !== 'object') {
+    try {
+      clone = structuredClone(source);
+    } catch {
+      const prototype = ObjectGetPrototypeOf(source);
+      if (!ArrayIsArray(source) && prototype !== null &&
+          prototype !== ObjectPrototype) {
+        return clone;
+      }
+      clone = ArrayIsArray(source) ? [] : { __proto__: prototype };
+    }
+  }
+  seen.set(source, clone);
+  if (isMap(source) && isMap(clone)) {
+    const sourceEntries = ArrayFrom(MapPrototypeEntries(source));
+    const cloneEntries = ArrayFrom(MapPrototypeEntries(clone));
+    const repairedEntries = [];
+    for (let i = 0; i < sourceEntries.length; i++) {
+      ArrayPrototypePush(repairedEntries, [
+        repairClone(sourceEntries[i][0], cloneEntries[i][0], seen),
+        repairClone(sourceEntries[i][1], cloneEntries[i][1], seen),
+      ]);
+    }
+    MapPrototypeClear(clone);
+    for (let i = 0; i < repairedEntries.length; i++) {
+      MapPrototypeSet(clone, repairedEntries[i][0], repairedEntries[i][1]);
+    }
+    return clone;
+  }
+  if (isSet(source) && isSet(clone)) {
+    const sourceValues = ArrayFrom(SetPrototypeValues(source));
+    const cloneValues = ArrayFrom(SetPrototypeValues(clone));
+    const repairedValues = [];
+    for (let i = 0; i < sourceValues.length; i++) {
+      ArrayPrototypePush(
+        repairedValues, repairClone(sourceValues[i], cloneValues[i], seen));
+    }
+    SetPrototypeClear(clone);
+    for (let i = 0; i < repairedValues.length; i++) {
+      SetPrototypeAdd(clone, repairedValues[i]);
+    }
+    return clone;
+  }
+  const prototype = ObjectGetPrototypeOf(source);
+  if (prototype === null) ObjectSetPrototypeOf(clone, null);
+  if (prototype !== null && prototype !== ObjectPrototype &&
+      !ArrayIsArray(source)) {
+    return clone;
+  }
+  const keys = ObjectKeys(source);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, key);
+    if (!ObjectPrototypeHasOwnProperty(descriptor, 'value')) continue;
+    const existing = ObjectGetOwnPropertyDescriptor(clone, key);
+    const value = repairClone(descriptor.value, existing?.value, seen);
+    if ((existing !== undefined && existing.value === value) ||
+        existing?.configurable === false) {
+      continue;
+    }
+    ObjectDefineProperty(clone, key, {
+      __proto__: null,
+      configurable: descriptor.configurable,
+      enumerable: descriptor.enumerable,
+      value,
+      writable: descriptor.writable,
+    });
+  }
+  if (ArrayIsArray(source)) {
+    const descriptor = ObjectGetOwnPropertyDescriptor(source, 'length');
+    ObjectSetPrototypeOf(descriptor, null);
+    ObjectDefineProperty(clone, 'length', descriptor);
+  }
+  return clone;
+}
+
+function cloneRecordData(data) {
+  let clone;
+  try {
+    clone = structuredClone(data);
+  } catch (error) {
+    if (data.error === undefined) throw error;
+    clone = structuredClone({ __proto__: null, ...data, error: undefined });
+    clone.error = deserializeError(serializeError(data.error));
+  }
+  try {
+    return repairClone(data, clone, new SafeMap());
+  } catch {
+    return clone;
+  }
+}
+
+class BenchmarksStream extends Readable {
+  #blocked = false;
+  #drainWaiters = [];
+  #hasReader = false;
+
+  constructor() {
+    super({
+      __proto__: null,
+      objectMode: true,
+    });
+  }
+
+  _read() {
+    if (this.#blocked) {
+      this.#blocked = false;
+      const waiters = this.#drainWaiters;
+      this.#drainWaiters = [];
+      for (let i = 0; i < waiters.length; i++) waiters[i].resolve();
+    }
+  }
+
+  read(size) {
+    if (size !== 0) this.#hasReader = true;
+    return super.read(size);
+  }
+
+  _destroy(error, callback) {
+    const failure = error ??
+      new ERR_INVALID_STATE('benchmark stream is closed');
+    const waiters = this.#drainWaiters;
+    this.#drainWaiters = [];
+    for (let i = 0; i < waiters.length; i++) waiters[i].reject(failure);
+    callback(error);
+  }
+
+  waitForDrain() {
+    if (this.destroyed) {
+      return PromiseReject(this.errored ??
+        new ERR_INVALID_STATE('benchmark stream is closed'));
+    }
+    if (!this.#blocked) return PromiseResolve();
+    const waiter = PromiseWithResolvers();
+    ArrayPrototypePush(this.#drainWaiters, waiter);
+    return waiter.promise;
+  }
+
+  plan(data) {
+    return this[kEmitMessage]('bench:plan', data);
+  }
+
+  start(data) {
+    return this[kEmitMessage]('bench:start', data);
+  }
+
+  sample(data) {
+    return this[kEmitMessage]('bench:sample', data);
+  }
+
+  complete(data) {
+    return this[kEmitMessage]('bench:complete', data);
+  }
+
+  diagnostic(data) {
+    return this[kEmitMessage]('bench:diagnostic', data);
+  }
+
+  summary(data) {
+    return this[kEmitMessage]('bench:summary', data);
+  }
+
+  end() {
+    return this.#tryPush(null);
+  }
+
+  [kEmitMessage](type, data) {
+    const recordData = cloneRecordData(data);
+    const record = { __proto__: null, type, data: recordData };
+    if (this.listenerCount(type) > 0) {
+      this.emit(type, cloneRecordData(recordData));
+    }
+    return this.#tryPush(record);
+  }
+
+  #tryPush(record) {
+    if (this.destroyed) return false;
+    const canPush = this.push(record);
+    if (record !== null && !canPush && this.#hasReader) {
+      this.#blocked = true;
+      return false;
+    }
+    return true;
+  }
+}
+
+module.exports = {
+  BenchmarksStream,
+};
diff --git a/lib/internal/bench_runner/cli.js b/lib/internal/bench_runner/cli.js
new file mode 100644
index 000000000000..5eaf0a317147
--- /dev/null
+++ b/lib/internal/bench_runner/cli.js
@@ -0,0 +1,1311 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayIsArray,
+  ArrayPrototypeFilter,
+  ArrayPrototypeIncludes,
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  ArrayPrototypePushApply,
+  ArrayPrototypeSlice,
+  ArrayPrototypeSome,
+  ArrayPrototypeSort,
+  MathMax,
+  NumberIsFinite,
+  NumberIsSafeInteger,
+  ObjectGetOwnPropertyDescriptor,
+  ObjectGetPrototypeOf,
+  ObjectKeys,
+  ObjectPrototype,
+  ObjectPrototypeHasOwnProperty,
+  ObjectValues,
+  Promise,
+  PromisePrototypeThen,
+  PromiseReject,
+  PromiseResolve,
+  PromiseWithResolvers,
+  RegExp,
+  SafeMap,
+  SafePromiseAllReturnVoid,
+  SafeSet,
+  String,
+  StringPrototypeIndexOf,
+  StringPrototypeReplaceAll,
+  StringPrototypeSlice,
+  StringPrototypeStartsWith,
+  StringPrototypeToUpperCase,
+  SymbolDispose,
+  uncurryThis,
+} = primordials;
+const { Buffer } = require('buffer');
+const BufferToString = uncurryThis(Buffer.prototype.toString);
+const { spawn } = require('child_process');
+const { createWriteStream, statSync } = require('fs');
+const { Glob } = require('internal/fs/glob');
+const { getValidatedPath } = require('internal/fs/utils');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+const {
+  configureRunScope,
+  createRunId,
+  runInFileScope,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+const { deserializeError, serializeError } = require('internal/error_serdes');
+const {
+  AbortError,
+  codes: {
+    ERR_ACCESS_DENIED,
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  getCLIOptionsInfo,
+  getOptionValue,
+  getOptionsAsFlagsFromBinding,
+} = require('internal/options');
+const permission = require('internal/process/permission');
+const { TIMEOUT_MAX } = require('internal/timers');
+const { kEmptyObject } = require('internal/util');
+const {
+  validateAbortSignal,
+  validateArray,
+  validateObject,
+  validateStringWithoutNullBytes,
+  validateUint32,
+} = require('internal/validators');
+const { pathToFileURL } = require('internal/url');
+const { pipeline } = require('stream/promises');
+const { resolve, sep } = require('path');
+const { clearTimeout, setTimeout } = require('timers');
+
+const console = require('internal/console/global');
+const esmLoader = require('internal/modules/esm/loader');
+const { bigint: hrtime } = process.hrtime;
+
+const kBuiltinDestinations = new SafeMap([
+  ['stdout', process.stdout],
+  ['stderr', process.stderr],
+]);
+const kBuiltinReporters = new SafeMap([
+  ['json', 'internal/bench_runner/reporter/json'],
+  ['spec', 'internal/bench_runner/reporter/spec'],
+]);
+const kChildAckMessageType = 'node:bench:ack';
+const kChildMessageType = 'node:bench:record';
+const kEventTypes = new SafeSet([
+  'bench:plan',
+  'bench:start',
+  'bench:sample',
+  'bench:complete',
+  'bench:diagnostic',
+  'bench:summary',
+]);
+const kFilterArgs = ['--bench', '--experimental-default-config-file'];
+const kFilterArgValues = [
+  '--bench-isolation',
+  '--bench-name-pattern',
+  '--bench-reporter',
+  '--bench-reporter-destination',
+  '--bench-samples',
+  '--bench-warmup',
+  '--experimental-config-file',
+];
+const kIncompatibleExecArgv = new SafeSet([
+  '--build-sea',
+  '--build-snapshot',
+  '--build-snapshot-config',
+  '--check',
+  '--completion-bash',
+  '--eval',
+  '--experimental-sea-config',
+  '--help',
+  '--help-all',
+  '--input-type',
+  '--interactive',
+  '--print',
+  '--prof-process',
+  '--run',
+  '--test',
+  '--version',
+  '--v8-options',
+  '--watch',
+  '--watch-path',
+  '-c',
+  '-e',
+  '-h',
+  '-i',
+  '-p',
+  '-v',
+]);
+const kExecArgvWithValue = new SafeSet([
+  '--eval',
+  '--input-type',
+  '--print',
+  '--run',
+  '--watch-path',
+  '-e',
+  '-p',
+]);
+const kIPCEnvironmentVariables = new SafeSet([
+  'NODE_CHANNEL_FD',
+  'NODE_CHANNEL_SERIALIZATION_MODE',
+  'NODE_BENCH_CONTEXT',
+  'NODE_BENCH_FILE_RUN_ID',
+  'NODE_BENCH_RUN_ID',
+  'NODE_OPTIONS',
+]);
+const kForceKillDelay = 1_000;
+
+function createBenchmarkFileList(patterns, cwd) {
+  if (patterns.length === 0) {
+    console.error('--bench requires at least one file or glob pattern');
+    return null;
+  }
+
+  const glob = new Glob(patterns, { __proto__: null, cwd });
+  const files = ArrayPrototypeFilter(glob.globSync(), (path) => {
+    try {
+      return statSync(resolve(cwd, path)).isFile();
+    } catch {
+      return false;
+    }
+  });
+  if (files.length === 0) {
+    console.error(`Could not find '${ArrayPrototypeJoin(patterns, ', ')}'`);
+    return null;
+  }
+  return ArrayPrototypeSort(files);
+}
+
+function createChildFileList(patterns, cwd) {
+  if (patterns.length !== 1) {
+    console.error('benchmark child process requires exactly one file');
+    return null;
+  }
+  const path = resolve(cwd, patterns[0]);
+  try {
+    if (statSync(path).isFile()) return [path];
+  } catch {
+    // Fall through to the standard not-found diagnostic.
+  }
+  console.error(`Could not find '${patterns[0]}'`);
+  return null;
+}
+
+function createFileScopes(files, options) {
+  const scopes = [];
+  for (let i = 0; i < files.length; i++) {
+    ArrayPrototypePush(scopes, {
+      __proto__: null,
+      entryFile: resolve(options.cwd, files[i]),
+      fileRunId: options.isChild && i === 0 &&
+        options.fileRunId !== undefined ? options.fileRunId : createRunId(),
+    });
+  }
+  return scopes;
+}
+
+function parseNamePattern(value) {
+  if (value.length === 0) return undefined;
+  try {
+    return new RegExp(value);
+  } catch (error) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-name-pattern', value,
+      `is an invalid regular expression. ${error.message}`);
+  }
+}
+
+function parseCommandLine() {
+  const reporters = getOptionValue('--bench-reporter');
+  const destinations = getOptionValue('--bench-reporter-destination');
+  const isChild = process.env.NODE_BENCH_CONTEXT === 'child' &&
+    typeof process.send === 'function';
+
+  if (!isChild) {
+    if (reporters.length === 0 && destinations.length === 0) {
+      ArrayPrototypePush(reporters, 'spec');
+    }
+    if (reporters.length === 1 && destinations.length === 0) {
+      ArrayPrototypePush(destinations, 'stdout');
+    }
+    if (reporters.length !== destinations.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        '--bench-reporter', reporters,
+        'must match the number of specified ' +
+        "'--bench-reporter-destination'");
+    }
+  }
+
+  const samples = getOptionValue('[has_bench_samples]') ?
+    getOptionValue('--bench-samples') : undefined;
+  const warmup = getOptionValue('[has_bench_warmup]') ?
+    getOptionValue('--bench-warmup') : undefined;
+  if (samples !== undefined) {
+    validateUint32(samples, '--bench-samples', true);
+  }
+  if (warmup !== undefined) {
+    validateUint32(warmup, '--bench-warmup');
+  }
+
+  return {
+    __proto__: null,
+    cwd: process.cwd(),
+    destinations,
+    fileRunId: isChild && process.env.NODE_BENCH_FILE_RUN_ID ?
+      process.env.NODE_BENCH_FILE_RUN_ID : undefined,
+    isChild,
+    isolation: getOptionValue('--bench-isolation'),
+    namePattern: parseNamePattern(getOptionValue('--bench-name-pattern')),
+    namePatternSource: getOptionValue('--bench-name-pattern'),
+    reporters,
+    runId: isChild && process.env.NODE_BENCH_RUN_ID ?
+      process.env.NODE_BENCH_RUN_ID : undefined,
+    samples,
+    warmup,
+  };
+}
+
+async function loadReporter(name) {
+  const builtin = kBuiltinReporters.get(name);
+  let reporter;
+  if (builtin !== undefined) {
+    reporter = require(builtin);
+  } else {
+    let parentURL;
+    try {
+      parentURL = pathToFileURL(`${process.cwd()}${sep}`).href;
+    } catch {
+      parentURL = 'file:///';
+    }
+    const loader = esmLoader.getOrInitializeCascadedLoader();
+    reporter = await loader.import(name, parentURL, kEmptyObject);
+  }
+
+  reporter = reporter?.default ?? reporter;
+  if (reporter?.prototype &&
+      ObjectGetOwnPropertyDescriptor(reporter.prototype, 'constructor')) {
+    reporter = new reporter();
+  }
+  if (!reporter) {
+    throw new ERR_INVALID_ARG_VALUE(
+      '--bench-reporter', name, 'is not a valid reporter');
+  }
+  return reporter;
+}
+
+async function setupReporters(stream, reporters, destinations) {
+  const state = { __proto__: null, error: undefined, pending: [] };
+  try {
+    for (let i = 0; i < reporters.length; i++) {
+      const reporter = await loadReporter(reporters[i]);
+      const builtinDestination = kBuiltinDestinations.get(destinations[i]);
+      const destination = builtinDestination ??
+        createWriteStream(destinations[i], { __proto__: null, flush: true });
+      const pending = PromisePrototypeThen(pipeline(
+        stream,
+        reporter,
+        destination,
+        { __proto__: null, end: builtinDestination === undefined },
+      ), undefined, (error) => {
+        state.error ??= error;
+      });
+      ArrayPrototypePush(state.pending, pending);
+    }
+  } catch (error) {
+    stream.destroy();
+    await SafePromiseAllReturnVoid(state.pending);
+    throw error;
+  }
+  return state;
+}
+
+async function finishReporters(state) {
+  await SafePromiseAllReturnVoid(state.pending);
+  if (state.error !== undefined) throw state.error;
+}
+
+function emitRecord(stream, record) {
+  switch (record.type) {
+    case 'bench:plan':
+      return stream.plan(record.data);
+    case 'bench:start':
+      return stream.start(record.data);
+    case 'bench:sample':
+      return stream.sample(record.data);
+    case 'bench:complete':
+      return stream.complete(record.data);
+    case 'bench:diagnostic':
+      return stream.diagnostic(record.data);
+    case 'bench:summary':
+      return stream.summary(record.data);
+    default:
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark event type', record.type, 'is not recognized');
+  }
+}
+
+function emitRecordAndWait(stream, record) {
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  if (emitRecord(stream, record)) return undefined;
+  if (stream.destroyed) {
+    return PromiseReject(stream.errored ??
+      new ERR_INVALID_STATE('benchmark output stream is closed'));
+  }
+  return stream.waitForDrain();
+}
+
+function serializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: serializeError(record.data.error),
+    },
+  };
+}
+
+function deserializeRecord(record) {
+  if (record.data.error === undefined) return record;
+  return {
+    __proto__: null,
+    type: record.type,
+    data: {
+      __proto__: null,
+      ...record.data,
+      error: deserializeError(record.data.error),
+    },
+  };
+}
+
+function isStringArray(value) {
+  if (!ArrayIsArray(value)) return false;
+  for (let i = 0; i < value.length; i++) {
+    if (typeof value[i] !== 'string') return false;
+  }
+  return true;
+}
+
+function isContextDiagnostic(record) {
+  return record.type === 'bench:diagnostic' &&
+    (record.data.benchId !== undefined ||
+     record.data.phase !== undefined ||
+     record.data.index !== undefined ||
+     record.data.detail !== undefined);
+}
+
+function validateRecord(record) {
+  if (record === null || typeof record !== 'object' ||
+      !kEventTypes.has(record.type) || record.data === null ||
+      typeof record.data !== 'object' ||
+      typeof record.data.runId !== 'string' ||
+      (record.data.fileRunId !== null &&
+       typeof record.data.fileRunId !== 'string') ||
+      (record.data.entryFile !== null &&
+       typeof record.data.entryFile !== 'string')) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  const contextDiagnostic = isContextDiagnostic(record);
+  if ((record.type === 'bench:plan' || record.type === 'bench:start' ||
+       record.type === 'bench:sample' || record.type === 'bench:complete' ||
+       contextDiagnostic) &&
+      (typeof record.data.fileRunId !== 'string' ||
+       typeof record.data.benchId !== 'string' ||
+       (record.data.parentId !== null &&
+         typeof record.data.parentId !== 'string') ||
+        typeof record.data.name !== 'string' ||
+        !isStringArray(record.data.namePath))) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child message', record, 'is not a valid benchmark record');
+  }
+  if (record.type === 'bench:plan') {
+    const {
+      samples,
+      selected,
+      skip,
+      timeout,
+      warmup,
+      yieldBetweenSamples,
+    } = record.data;
+    if (!isStringArray(record.data.diagnosticChannels) ||
+        typeof record.data.file !== 'string' ||
+        !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+        !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+        !isStringArray(record.data.tags) ||
+        record.data.params === null ||
+        typeof record.data.params !== 'object' ||
+        ArrayIsArray(record.data.params) ||
+        (ObjectGetPrototypeOf(record.data.params) !== null &&
+         ObjectGetPrototypeOf(record.data.params) !== ObjectPrototype) ||
+        ArrayPrototypeSome(ObjectValues(record.data.params), (value) =>
+          typeof value !== 'string' && typeof value !== 'boolean' &&
+          (typeof value !== 'number' || !NumberIsFinite(value))) ||
+        !NumberIsSafeInteger(samples) || samples <= 0 ||
+        samples > 0xFFFFFFFF ||
+        !NumberIsSafeInteger(warmup) || warmup < 0 || warmup > 0xFFFFFFFF ||
+        (timeout !== null &&
+         (!NumberIsFinite(timeout) || timeout < 0 || timeout > TIMEOUT_MAX)) ||
+        typeof yieldBetweenSamples !== 'boolean' ||
+        typeof selected !== 'boolean' ||
+        (selected && skip !== undefined) ||
+        (!selected && skip !== true && typeof skip !== 'string')) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child plan', record.data,
+        'is not a valid benchmark plan');
+    }
+  }
+  if (contextDiagnostic &&
+      ((record.data.phase !== 'warmup' &&
+        record.data.phase !== 'measurement') ||
+       !NumberIsSafeInteger(record.data.index) || record.data.index < 0 ||
+       record.data.index > 0xFFFFFFFF ||
+       !ObjectPrototypeHasOwnProperty(record.data, 'message') ||
+       (record.data.level !== 'info' && record.data.level !== 'warning') ||
+       typeof record.data.file !== 'string' ||
+       !NumberIsSafeInteger(record.data.line) || record.data.line < 0 ||
+       !NumberIsSafeInteger(record.data.column) || record.data.column < 0 ||
+       record.data.error !== undefined)) {
+    throw new ERR_INVALID_ARG_VALUE(
+      'benchmark child diagnostic', record.data,
+      'is not a valid benchmark diagnostic');
+  }
+  if (record.type === 'bench:summary') {
+    const { counts, duration_ns, success } = record.data;
+    if (typeof success !== 'boolean' || typeof duration_ns !== 'bigint' ||
+        counts === null || typeof counts !== 'object' ||
+        !NumberIsSafeInteger(counts.completed) || counts.completed < 0 ||
+        !NumberIsSafeInteger(counts.failed) || counts.failed < 0 ||
+        !NumberIsSafeInteger(counts.skipped) || counts.skipped < 0 ||
+        !NumberIsSafeInteger(counts.total) || counts.total < 0) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'benchmark child summary', record.data,
+        'is not a valid benchmark summary');
+    }
+  }
+  return record;
+}
+
+let nextChildRecordId = 0;
+let listeningForAcks = false;
+const pendingChildRecordAcks = new SafeMap();
+
+function listenForAcks() {
+  if (listeningForAcks) return;
+  listeningForAcks = true;
+  process.on('message', (message) => {
+    if (message?.type !== kChildAckMessageType) return;
+    const pending = pendingChildRecordAcks.get(message.id);
+    if (pending === undefined) return;
+    pendingChildRecordAcks.delete(message.id);
+    pending.resolve();
+  });
+  process.once('disconnect', () => {
+    const error = new ERR_INVALID_STATE(
+      'benchmark IPC channel closed before acknowledging records');
+    for (const pending of pendingChildRecordAcks.values()) {
+      pending.reject(error);
+    }
+    pendingChildRecordAcks.clear();
+  });
+}
+
+function sendRecord(record) {
+  listenForAcks();
+  const id = nextChildRecordId++;
+  const acknowledged = PromiseWithResolvers();
+  pendingChildRecordAcks.set(id, acknowledged);
+  try {
+    process.send({
+      __proto__: null,
+      id,
+      type: kChildMessageType,
+      record: serializeRecord(record),
+    }, undefined, undefined, (error) => {
+      if (error) {
+        pendingChildRecordAcks.delete(id);
+        acknowledged.reject(error);
+      }
+    });
+  } catch (error) {
+    pendingChildRecordAcks.delete(id);
+    acknowledged.reject(error);
+  }
+  return acknowledged.promise;
+}
+
+function sendAck(child, id) {
+  return new Promise((resolve, reject) => {
+    if (!child.connected) {
+      reject(new ERR_INVALID_STATE(
+        'benchmark child disconnected before acknowledgement'));
+      return;
+    }
+    child.send({ __proto__: null, id, type: kChildAckMessageType },
+               undefined, undefined, (error) => {
+                 if (error) reject(error);
+                 else resolve();
+               });
+  });
+}
+
+async function loadUserImports(options) {
+  const parentURL = pathToFileURL(`${options.cwd}${sep}`).href;
+  const loader = esmLoader.getOrInitializeCascadedLoader();
+  const userImports = getOptionValue('--import');
+  for (let i = 0; i < userImports.length; i++) {
+    await loader.import(userImports[i], parentURL, kEmptyObject);
+  }
+  return { __proto__: null, loader, parentURL };
+}
+
+async function loadBenchmarkFiles(files, options, modules, onRecord) {
+  const { loader, parentURL } = modules;
+  let loadFailed = false;
+  for (let i = 0; i < files.length; i++) {
+    const file = resolve(options.cwd, files[i]);
+    try {
+      await runInFileScope(options.fileScopes[i], () =>
+        loader.import(pathToFileURL(file), parentURL, kEmptyObject));
+    } catch (error) {
+      loadFailed = true;
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...options.fileScopes[i],
+          message: error?.message ?? String(error),
+          error,
+          level: 'error',
+          file,
+        },
+      });
+    }
+  }
+
+  const stream = runBenchmarks({
+    __proto__: null,
+    namePattern: options.namePattern,
+    samples: options.samples,
+    warmup: options.warmup,
+  }, true);
+  let summary;
+  for await (const record of stream) {
+    if (record.type === 'bench:summary' && (process.exitCode ?? 0) !== 0) {
+      const scope = files.length === 1 ? options.fileScopes[0] : {
+        __proto__: null,
+        entryFile: null,
+        fileRunId: null,
+      };
+      await onRecord({
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: `Benchmark process set exit code ${process.exitCode}`,
+          level: 'error',
+          file: files.length === 1 ?
+            resolve(options.cwd, files[0]) : null,
+        },
+      });
+    }
+    if (record.type === 'bench:summary' &&
+        (loadFailed || (process.exitCode ?? 0) !== 0)) {
+      record.data.success = false;
+    }
+    if (record.type === 'bench:summary') {
+      record.data.file = files.length === 1 ?
+        resolve(options.cwd, files[0]) : null;
+      record.data.fileRunId = files.length === 1 ?
+        options.fileScopes[0].fileRunId : null;
+      record.data.entryFile = files.length === 1 ?
+        options.fileScopes[0].entryFile : null;
+      summary = record.data;
+    }
+    await onRecord(record);
+  }
+  return summary;
+}
+
+function filterExecArgv(arg, index, args) {
+  const name = getOptionName(arg);
+  return !ArrayPrototypeIncludes(kFilterArgs, name) &&
+    !ArrayPrototypeSome(kFilterArgValues, (option) => {
+      return name === option ||
+        (option !== '--experimental-config-file' &&
+         index > 0 &&
+         StringPrototypeIndexOf(args[index - 1], '=') === -1 &&
+         getOptionName(args[index - 1]) === option);
+    });
+}
+
+function getOptionName(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  const name = equals === -1 ? arg : StringPrototypeSlice(arg, 0, equals);
+  return StringPrototypeReplaceAll(name, '_', '-');
+}
+
+function getRunFileOptionName(arg) {
+  if (StringPrototypeStartsWith(arg, '-') &&
+      !StringPrototypeStartsWith(arg, '--') && arg.length > 2) {
+    const shortName = StringPrototypeSlice(arg, 0, 2);
+    if (kIncompatibleExecArgv.has(shortName)) return shortName;
+  }
+  return getOptionName(arg);
+}
+
+function filterRunFileExecArgv(arg, index, args) {
+  if (!filterExecArgv(arg, index, args)) return false;
+  if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+    return false;
+  }
+  const name = getRunFileOptionName(arg);
+  if (kIncompatibleExecArgv.has(name)) return false;
+  if (index > 0) {
+    const previous = getRunFileOptionName(args[index - 1]);
+    if (kExecArgvWithValue.has(previous) &&
+        StringPrototypeIndexOf(args[index - 1], '=') === -1) {
+      return false;
+    }
+  }
+  return true;
+}
+
+function runFileOptionRequiresValue(arg) {
+  const equals = StringPrototypeIndexOf(arg, '=');
+  let name = getRunFileOptionName(arg);
+  const { aliases, options } = getCLIOptionsInfo();
+  let info = options.get(name);
+  if (info === undefined) {
+    const alias = aliases.get(name);
+    if (alias !== undefined) info = options.get(alias[0]);
+  }
+  if (info === undefined && StringPrototypeStartsWith(name, '--no-')) {
+    name = `--${StringPrototypeSlice(name, 5)}`;
+    info = options.get(name);
+  }
+  return info !== undefined && info.type >= 3 &&
+    (equals === -1 || equals === arg.length - 1);
+}
+
+const kOptionAliases = new SafeMap([
+  ['--loader', '--experimental-loader'],
+  ['-C', '--conditions'],
+  ['-r', '--require'],
+]);
+
+function getInheritedChildArgs() {
+  const nodeOptions = getOptionsAsFlagsFromBinding();
+  const args = ArrayPrototypeFilter(nodeOptions, filterExecArgv);
+  const nodeOptionNames = new SafeSet();
+  for (let i = 0; i < nodeOptions.length; i++) {
+    nodeOptionNames.add(getOptionName(nodeOptions[i]));
+  }
+  const unknownExecArgv = ArrayPrototypeFilter(
+    process.execArgv,
+    (arg, index, values) => {
+      if (!filterExecArgv(arg, index, values)) return false;
+      const optionName = getOptionName(arg);
+      const name = kOptionAliases.get(optionName) ?? optionName;
+      if (nodeOptionNames.has(name)) return false;
+      if (!StringPrototypeStartsWith(arg, '-') && index > 0) {
+        const previousName = getOptionName(values[index - 1]);
+        const previous = kOptionAliases.get(previousName) ?? previousName;
+        if (nodeOptionNames.has(previous)) return false;
+      }
+      return true;
+    },
+  );
+  ArrayPrototypePushApply(args, unknownExecArgv);
+  // Option serialization omits port 0, which would otherwise become 9229.
+  if (process.debugPort === 0) ArrayPrototypePush(args, '--inspect-port=0');
+  return args;
+}
+
+function getChildArgs(path, options) {
+  const args = options.execArgv === undefined ?
+    getInheritedChildArgs() : ArrayPrototypeSlice(options.execArgv);
+  ArrayPrototypePush(args, '--bench', '--bench-isolation=none');
+  if (options.namePatternSource.length > 0) {
+    ArrayPrototypePush(
+      args, `--bench-name-pattern=${options.namePatternSource}`);
+  }
+  if (options.samples !== undefined) {
+    ArrayPrototypePush(args, `--bench-samples=${options.samples}`);
+  }
+  if (options.warmup !== undefined) {
+    ArrayPrototypePush(args, `--bench-warmup=${options.warmup}`);
+  }
+  ArrayPrototypePush(args, '--', resolve(options.cwd, path));
+  return args;
+}
+
+async function runChild(path, options, scope, onRecord) {
+  if (options.signal?.aborted) {
+    return {
+      __proto__: null,
+      aborted: true,
+      error: new AbortError(undefined, {
+        __proto__: null,
+        cause: options.signal.reason,
+      }),
+    };
+  }
+  const resource = resolve(options.cwd, path);
+  if (permission.isEnabled() &&
+      !permission.has('fs.read', resource) &&
+      !permission.isAuditMode()) {
+    throw new ERR_ACCESS_DENIED(
+      'Access to this API has been restricted. Use --allow-fs-read to manage permissions.',
+      'FileSystemRead',
+      resource,
+    );
+  }
+  const child = spawn(
+    options.execPath ?? process.execPath,
+    getChildArgs(path, options),
+    {
+      __proto__: null,
+      cwd: options.cwd,
+      env: {
+        __proto__: null,
+        ...(options.env ?? process.env),
+        NODE_BENCH_CONTEXT: 'child',
+        NODE_BENCH_FILE_RUN_ID: scope.fileRunId,
+        NODE_BENCH_RUN_ID: options.runId,
+      },
+      serialization: 'advanced',
+      stdio: ['inherit', 'pipe', 'pipe', 'ipc'],
+    },
+  );
+  let childClosed = false;
+  let forceKillTimer;
+  const terminateChild = () => {
+    if (childClosed) return;
+    child.kill();
+    forceKillTimer ??= setTimeout(() => {
+      child.kill('SIGKILL');
+    }, kForceKillDelay);
+  };
+  const closed = PromiseWithResolvers();
+  let closeTracked = false;
+  let spawnError;
+  try {
+    child.once('close', (...status) => closed.resolve(status));
+    closeTracked = true;
+    child.once('error', (error) => {
+      spawnError ??= error;
+      terminateChild();
+    });
+  } catch (error) {
+    terminateChild();
+    if (closeTracked) {
+      try {
+        await closed.promise;
+      } catch {
+        // Preserve the setup error.
+      }
+    }
+    throw error;
+  }
+  let protocolError;
+  let abortError;
+  let aborted = false;
+  let activeBenchId;
+  let plansComplete = false;
+  let recordPending = false;
+  let summaryReceived = false;
+  let abortListener;
+  const closeListener = () => {
+    terminateChild();
+  };
+  try {
+    if (options.signal !== undefined) {
+      abortListener = addAbortListener(options.signal, () => {
+        aborted = true;
+        abortError = new AbortError(undefined, {
+          __proto__: null,
+          cause: options.signal.reason,
+        });
+        terminateChild();
+      });
+    }
+    options.output?.once('close', closeListener);
+    if (options.output?.destroyed) closeListener();
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  const pendingRecords = new SafeSet();
+  const handleRecord = (record) => {
+    if (protocolError !== undefined) return;
+    try {
+      return onRecord(record);
+    } catch (error) {
+      protocolError = error;
+      terminateChild();
+    }
+  };
+  const trackPending = (pending, source) => {
+    if (pending === undefined) return;
+    source?.pause();
+    const tracked = PromisePrototypeThen(PromiseResolve(pending), () => {
+      pendingRecords.delete(tracked);
+      source?.resume();
+    }, (error) => {
+      pendingRecords.delete(tracked);
+      if (!aborted) protocolError ??= error;
+      terminateChild();
+    });
+    pendingRecords.add(tracked);
+  };
+  const reportOutput = (source, stream, message) => {
+    const pending = handleRecord({
+      __proto__: null,
+      type: 'bench:diagnostic',
+      data: {
+        __proto__: null,
+        runId: options.runId,
+        ...scope,
+        message,
+        level: 'info',
+        file: path,
+        stream,
+      },
+    });
+    trackPending(pending, source);
+  };
+  try {
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (data) => {
+      reportOutput(child.stdout, 'stdout', data);
+    });
+    child.stderr.on('data', (data) => {
+      reportOutput(child.stderr, 'stderr', data);
+    });
+    child.on('message', (message) => {
+      if (message?.type !== kChildMessageType) return;
+      try {
+        if (!NumberIsSafeInteger(message.id) || message.id < 0 || recordPending) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid record sequence');
+        }
+        recordPending = true;
+        const record = deserializeRecord(validateRecord(message.record));
+        const contextDiagnostic = isContextDiagnostic(record);
+        if (summaryReceived || (record.type === 'bench:plan' && plansComplete) ||
+            (record.type === 'bench:start' && activeBenchId !== undefined) ||
+            ((record.type === 'bench:sample' || contextDiagnostic) &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:complete' && activeBenchId !== undefined &&
+             activeBenchId !== record.data.benchId) ||
+            (record.type === 'bench:summary' && activeBenchId !== undefined)) {
+          throw new ERR_INVALID_ARG_VALUE(
+            'benchmark child message', message,
+            'does not have a valid lifecycle sequence');
+        }
+        if (record.type !== 'bench:plan' &&
+            record.type !== 'bench:diagnostic') {
+          plansComplete = true;
+        }
+        if (record.type === 'bench:start') {
+          activeBenchId = record.data.benchId;
+        } else if (record.type === 'bench:complete' &&
+                   activeBenchId === record.data.benchId) {
+          activeBenchId = undefined;
+        }
+        if (record.type === 'bench:summary') summaryReceived = true;
+        record.data.runId = options.runId;
+        record.data.fileRunId = scope.fileRunId;
+        if (record.data.entryFile !== null) {
+          record.data.entryFile = scope.entryFile;
+        }
+        const pending = handleRecord(record);
+        if (protocolError === undefined) {
+          const acknowledged = PromisePrototypeThen(
+            PromiseResolve(pending), () => sendAck(child, message.id));
+          trackPending(PromisePrototypeThen(acknowledged, () => {
+            recordPending = false;
+          }));
+        }
+      } catch (error) {
+        if (!aborted) protocolError ??= error;
+        terminateChild();
+      }
+    });
+  } catch (error) {
+    terminateChild();
+    try {
+      await closed.promise;
+    } catch {
+      // Preserve the setup error.
+    }
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+    throw error;
+  }
+  let status;
+  try {
+    status = await closed.promise;
+  } finally {
+    childClosed = true;
+    if (forceKillTimer !== undefined) clearTimeout(forceKillTimer);
+    abortListener?.[SymbolDispose]();
+    options.output?.removeListener('close', closeListener);
+  }
+  const { 0: code, 1: signal } = status;
+  await SafePromiseAllReturnVoid(ArrayFrom(pendingRecords));
+  if (!aborted && spawnError !== undefined) throw spawnError;
+  if (!aborted && protocolError !== undefined) throw protocolError;
+  return {
+    __proto__: null,
+    aborted,
+    code,
+    error: abortError,
+    signal,
+  };
+}
+
+async function runIsolated(files, options, output) {
+  const counts = {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 0,
+  };
+  const start = hrtime();
+  let success = true;
+
+  for (let i = 0; i < files.length; i++) {
+    const path = files[i];
+    const scope = options.fileScopes[i];
+    const observedCounts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    let childSummary;
+    let result;
+    try {
+      result = await runChild(path, options, scope, (record) => {
+        if (record.type === 'bench:summary') {
+          childSummary = record.data;
+          return;
+        }
+        if (record.type === 'bench:plan') observedCounts.total++;
+        if (record.type === 'bench:complete') {
+          if (ObjectPrototypeHasOwnProperty(record.data, 'error')) {
+            observedCounts.failed++;
+          } else if (ObjectPrototypeHasOwnProperty(record.data, 'skip')) {
+            observedCounts.skipped++;
+          } else {
+            observedCounts.completed++;
+          }
+        }
+        return emitRecordAndWait(output, record);
+      });
+    } catch (error) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: error.message,
+          error,
+          level: 'error',
+          file: path,
+        },
+      });
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
+      continue;
+    }
+
+    if (result.aborted) {
+      success = false;
+      await emitRecordAndWait(output, {
+        __proto__: null,
+        type: 'bench:diagnostic',
+        data: {
+          __proto__: null,
+          runId: options.runId,
+          ...scope,
+          message: result.error.message,
+          error: result.error,
+          level: 'error',
+          file: path,
+        },
+      });
+    }
+    if (childSummary !== undefined) {
+      success &&= childSummary.success;
+      counts.completed += childSummary.counts.completed;
+      counts.failed += childSummary.counts.failed;
+      counts.skipped += childSummary.counts.skipped;
+      counts.total += childSummary.counts.total;
+    } else {
+      counts.completed += observedCounts.completed;
+      counts.failed += observedCounts.failed;
+      counts.skipped += observedCounts.skipped;
+      counts.total += MathMax(
+        observedCounts.total,
+        observedCounts.completed + observedCounts.failed +
+          observedCounts.skipped);
+    }
+    if (!result.aborted && (childSummary === undefined || result.code !== 0 ||
+        result.signal !== null)) {
+      success = false;
+      if (childSummary === undefined || childSummary.success) {
+        const status = result.signal === null ?
+          `exit code ${result.code}` : `signal ${result.signal}`;
+        await emitRecordAndWait(output, {
+          __proto__: null,
+          type: 'bench:diagnostic',
+          data: {
+            __proto__: null,
+            runId: options.runId,
+            ...scope,
+            message: `Benchmark file '${path}' failed with ${status}`,
+            level: 'error',
+            file: path,
+          },
+        });
+      }
+    }
+  }
+
+  const scope = files.length === 1 ? options.fileScopes[0] : null;
+  const summary = {
+    __proto__: null,
+    runId: options.runId,
+    fileRunId: scope?.fileRunId ?? null,
+    entryFile: scope?.entryFile ?? null,
+    success: success && (options.useProcessExitCode === false ||
+      (process.exitCode ?? 0) === 0),
+    counts,
+    duration_ns: hrtime() - start,
+    file: files.length === 1 ? resolve(options.cwd, files[0]) : null,
+  };
+  await emitRecordAndWait(output, {
+    __proto__: null,
+    type: 'bench:summary',
+    data: summary,
+  });
+  return summary;
+}
+
+function runFile(path, options = kEmptyObject) {
+  path = getValidatedPath(path);
+  if (typeof path !== 'string') path = BufferToString(path);
+  const file = resolve(path);
+  validateObject(options, 'options');
+  const {
+    env = process.env,
+    execArgv,
+    signal,
+  } = options;
+  let childExecArgv;
+  if (execArgv !== undefined) {
+    validateArray(execArgv, 'options.execArgv');
+    childExecArgv = [];
+    const length = execArgv.length;
+    for (let i = 0; i < length; i++) {
+      const arg = execArgv[i];
+      validateStringWithoutNullBytes(arg, `options.execArgv[${i}]`);
+      if (!StringPrototypeStartsWith(arg, '-') || arg === '-' || arg === '--') {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must be a Node.js command-line option');
+      }
+      if (kIncompatibleExecArgv.has(getRunFileOptionName(arg))) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'is not compatible with benchmark execution');
+      }
+      if (runFileOptionRequiresValue(arg)) {
+        const equals = StringPrototypeIndexOf(arg, '=');
+        if (equals !== -1) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must include a non-empty value');
+        }
+        if (i + 1 >= length) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, arg,
+            'must be followed by a value');
+        }
+        ArrayPrototypePush(childExecArgv, arg);
+        i++;
+        const value = execArgv[i];
+        validateStringWithoutNullBytes(value, `options.execArgv[${i}]`);
+        if (value.length === 0) {
+          throw new ERR_INVALID_ARG_VALUE(
+            `options.execArgv[${i}]`, value,
+            'must not be empty');
+        }
+        ArrayPrototypePush(childExecArgv, value);
+        continue;
+      }
+      if (!StringPrototypeStartsWith(arg, '--') &&
+          StringPrototypeIndexOf(arg, '=') !== -1) {
+        throw new ERR_INVALID_ARG_VALUE(
+          `options.execArgv[${i}]`, arg,
+          'must not use = with a short option');
+      }
+      ArrayPrototypePush(childExecArgv, arg);
+    }
+    if (ArrayPrototypeFilter(childExecArgv, filterExecArgv).length !==
+        childExecArgv.length) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.execArgv', childExecArgv,
+        'must not contain benchmark runner options');
+    }
+  } else {
+    childExecArgv = ArrayPrototypeFilter(
+      getInheritedChildArgs(), filterRunFileExecArgv);
+  }
+  validateObject(env, 'options.env');
+  const childEnv = { __proto__: null };
+  const envKeys = ObjectKeys(env);
+  for (let i = 0; i < envKeys.length; i++) {
+    const key = envKeys[i];
+    validateStringWithoutNullBytes(key, 'options.env key');
+    const value = env[key];
+    if (value === undefined) continue;
+    validateStringWithoutNullBytes(value, `options.env.${key}`);
+    if (kIPCEnvironmentVariables.has(StringPrototypeToUpperCase(key))) continue;
+    childEnv[key] = value;
+  }
+  validateAbortSignal(signal, 'options.signal');
+  if (signal !== undefined &&
+      (typeof signal.addEventListener !== 'function' ||
+       typeof signal.removeEventListener !== 'function')) {
+    throw new ERR_INVALID_ARG_TYPE('options.signal', 'AbortSignal', signal);
+  }
+
+  const runId = createRunId();
+  const scope = {
+    __proto__: null,
+    entryFile: file,
+    fileRunId: createRunId(),
+  };
+  const output = new BenchmarksStream();
+  const runOptions = {
+    __proto__: null,
+    cwd: process.cwd(),
+    env: childEnv,
+    execPath: process.execPath,
+    execArgv: childExecArgv,
+    fileScopes: [scope],
+    namePatternSource: '',
+    output,
+    runId,
+    signal,
+    useProcessExitCode: false,
+  };
+  const execution = PromisePrototypeThen(PromiseResolve(), () =>
+    (output.destroyed ? undefined : runIsolated([file], runOptions, output)));
+  PromisePrototypeThen(execution, () => output.end(),
+                       (error) => output.destroy(error));
+  return output;
+}
+
+async function run(patterns) {
+  const options = parseCommandLine();
+  const files = options.isChild ?
+    createChildFileList(patterns, options.cwd) :
+    createBenchmarkFileList(patterns, options.cwd);
+  if (files === null) return { __proto__: null, success: false };
+
+  options.runId ??= createRunId();
+  options.fileScopes = createFileScopes(files, options);
+  const scope = files.length === 1 ? options.fileScopes[0] : {
+    __proto__: null,
+    entryFile: null,
+    fileRunId: options.runId,
+  };
+  configureRunScope({
+    __proto__: null,
+    runId: options.runId,
+    ...scope,
+  });
+
+  if (options.isChild) {
+    try {
+      const modules = await loadUserImports(options);
+      return await loadBenchmarkFiles(
+        files, options, modules, sendRecord);
+    } finally {
+      if (process.connected) process.disconnect();
+    }
+  }
+
+  const output = new BenchmarksStream();
+  let executionError;
+  let reporterState;
+  let summary;
+  try {
+    options.modules = await loadUserImports(options);
+    reporterState = await setupReporters(
+      output, options.reporters, options.destinations);
+    if (options.isolation === 'process') {
+      summary = await runIsolated(files, options, output);
+    } else {
+      summary = await loadBenchmarkFiles(
+        files,
+        options,
+        options.modules,
+        (record) => emitRecordAndWait(output, record),
+      );
+    }
+  } catch (error) {
+    executionError = error;
+  } finally {
+    output.end();
+  }
+  if (reporterState !== undefined) await finishReporters(reporterState);
+  if (executionError !== undefined) throw executionError;
+  return summary;
+}
+
+module.exports = { run, runFile };
diff --git a/lib/internal/bench_runner/harness.js b/lib/internal/bench_runner/harness.js
new file mode 100644
index 000000000000..985440634217
--- /dev/null
+++ b/lib/internal/bench_runner/harness.js
@@ -0,0 +1,1139 @@
+'use strict';
+
+const {
+  ArrayPrototypePush,
+  ArrayPrototypeReverse,
+  ArrayPrototypeSlice,
+  BigInt,
+  FunctionPrototypeCall,
+  JSONStringify,
+  MathCeil,
+  Number,
+  Promise,
+  PromisePrototypeThen,
+  PromiseResolve,
+  PromiseWithResolvers,
+  ReflectApply,
+  RegExp,
+  RegExpPrototypeExec,
+  SafeMap,
+  SafePromiseRace,
+  String,
+  SymbolDispose,
+} = primordials;
+const { getCallerLocation } = internalBinding('util');
+const { exitCodes: { kGenericUserError } } = internalBinding('errors');
+const { AsyncLocalStorage } = require('async_hooks');
+const {
+  subscribe: subscribeToChannel,
+  unsubscribe: unsubscribeFromChannel,
+} = require('diagnostics_channel');
+const { AbortController } = require('internal/abort_controller');
+const {
+  AbortError,
+  codes: {
+    ERR_INVALID_ARG_TYPE,
+    ERR_INVALID_STATE,
+    ERR_OPERATION_FAILED,
+  },
+} = require('internal/errors');
+const { addAbortListener } = require('internal/events/abort_listener');
+const {
+  kEmptyObject,
+} = require('internal/util');
+const { isRegExp } = require('internal/util/types');
+const {
+  validateAbortSignal,
+  validateBoolean,
+  validateFunction,
+  validateObject,
+  validateUint32,
+} = require('internal/validators');
+const { queueMicrotask } = require('internal/process/task_queues');
+const { getOptionValue } = require('internal/options');
+const { clearTimeout, setImmediate, setTimeout } = require('timers');
+const {
+  Bench,
+  BenchContext,
+  Suite,
+  normalizeArgs,
+  summarizeSamples,
+} = require('internal/bench_runner/benchmark');
+const {
+  BenchmarksStream,
+} = require('internal/bench_runner/benchmarks_stream');
+
+const { bigint: hrtime } = process.hrtime;
+const kCancellationGracePeriod = 100;
+const kHookNames = ['after', 'afterEach', 'before', 'beforeEach'];
+const kIsCliRunner = getOptionValue('--bench');
+let nextRunId = 0;
+
+function createRunId() {
+  return `${process.pid}:${String(hrtime())}:${nextRunId++}`;
+}
+
+function eventLoopTurn() {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+async function settlesPromptly(work) {
+  const timeout = PromiseWithResolvers();
+  const timer = setTimeout(
+    () => timeout.resolve(false), kCancellationGracePeriod);
+  try {
+    return await SafePromiseRace([
+      PromisePrototypeThen(work, () => true, () => true),
+      timeout.promise,
+    ]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+function createAbortError(signal) {
+  return new AbortError(undefined, { __proto__: null, cause: signal.reason });
+}
+
+function createTimeoutError(benchmark) {
+  return new ERR_OPERATION_FAILED(
+    `Benchmark timed out after ${benchmark.timeout}ms`);
+}
+
+class Harness {
+  #abortReason = null;
+  #autoRun;
+  #buildPromises = [];
+  #duplicateErrors = new SafeMap();
+  #explicitRun = false;
+  #fileScopeStorage = new AsyncLocalStorage();
+  #hasOnly = false;
+  #runPromise = null;
+  #scheduled = false;
+  #starting = false;
+  #storage = new AsyncLocalStorage();
+  #yieldBetweenSamples;
+
+  constructor(options = kEmptyObject) {
+    validateObject(options, 'options');
+    const {
+      autoRun = true,
+      yieldBetweenSamples = true,
+    } = options;
+    validateBoolean(autoRun, 'options.autoRun');
+    validateBoolean(
+      yieldBetweenSamples, 'options.yieldBetweenSamples');
+    this.#autoRun = autoRun;
+    this.#yieldBetweenSamples = yieldBetweenSamples;
+    this.runId = createRunId();
+    this.fileRunId = this.runId;
+    this.entryFile = process.argv?.[1] ?? null;
+    this.stream = new BenchmarksStream();
+    this.state = 'collecting';
+    this.namePattern = null;
+    this.outerSignal = undefined;
+    this.samples = undefined;
+    this.success = true;
+    this.warmup = undefined;
+    this.counts = {
+      __proto__: null,
+      completed: 0,
+      failed: 0,
+      skipped: 0,
+      total: 0,
+    };
+    this.root = new Suite(
+      this,
+      null,
+      '<root>',
+      kEmptyObject,
+      undefined,
+      undefined,
+      true,
+    );
+  }
+
+  getFileScope() {
+    return this.#fileScopeStorage.getStore() ?? null;
+  }
+
+  runInFileScope(scope, fn) {
+    return this.#fileScopeStorage.run(scope, fn);
+  }
+
+  setRunScope({ entryFile, fileRunId, runId }) {
+    if (this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE(
+        'benchmark execution scope cannot change after execution has started');
+    }
+    this.entryFile = entryFile;
+    this.fileRunId = fileRunId;
+    this.runId = runId;
+  }
+
+  #ensureCollecting() {
+    if (this.state === 'building' &&
+        this.#storage.getStore() instanceof Suite) return;
+    if (!this.#explicitRun && !this.#starting &&
+        this.state === 'collecting') return;
+    throw new ERR_INVALID_STATE(
+      'benchmarks cannot be declared after execution has started');
+  }
+
+  #getParent() {
+    const current = this.#storage.getStore();
+    return current instanceof Suite ? current : this.root;
+  }
+
+  createBench(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('benchmark', name, options, fn);
+    const parent = this.#getParent();
+    const benchmark = new Bench(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, benchmark);
+    this.#schedule();
+    return parent.isRoot ? benchmark.completion.promise : PromiseResolve();
+  }
+
+  createSuite(name, options, fn, overrides = kEmptyObject) {
+    this.#ensureCollecting();
+    const normalized = normalizeArgs('suite', name, options, fn);
+    const parent = this.#getParent();
+    const suite = new Suite(
+      this,
+      parent,
+      normalized.name,
+      { __proto__: null, ...normalized.options, ...overrides },
+      normalized.fn,
+      overrides.loc,
+    );
+    ArrayPrototypePush(parent.children, suite);
+    this.#buildSuite(suite);
+    this.#schedule();
+    return parent.isRoot ? suite.completion.promise : PromiseResolve();
+  }
+
+  createHook(name, fn, options = kEmptyObject) {
+    this.#ensureCollecting();
+    validateFunction(fn, 'hook function');
+    validateObject(options, 'options');
+    const parent = this.#getParent();
+    ArrayPrototypePush(parent.hooks[name], {
+      __proto__: null,
+      fileScope: parent.isRoot ? this.getFileScope() : parent.fileScope,
+      fn,
+      loc: getCallerLocation(),
+    });
+    this.#schedule();
+  }
+
+  #buildSuite(suite) {
+    let result;
+    try {
+      result = suite.runInAsyncScope(() => this.#storage.run(
+        suite,
+        () => FunctionPrototypeCall(suite.fn),
+      ));
+    } catch (error) {
+      suite.buildError = error;
+      result = undefined;
+    }
+
+    suite.buildPromise = PromisePrototypeThen(
+      PromiseResolve(result),
+      undefined,
+      (error) => {
+        suite.buildError = error;
+      },
+    );
+    ArrayPrototypePush(this.#buildPromises, suite.buildPromise);
+  }
+
+  configure(options = kEmptyObject) {
+    validateObject(options, 'options');
+
+    const {
+      namePattern,
+      samples,
+      signal,
+      warmup,
+      yieldBetweenSamples,
+    } = options;
+    let nextNamePattern = this.namePattern;
+    let nextSamples = this.samples;
+    let nextWarmup = this.warmup;
+    let nextYieldBetweenSamples = this.#yieldBetweenSamples;
+    if (namePattern !== undefined) {
+      if (typeof namePattern === 'string') {
+        nextNamePattern = new RegExp(namePattern);
+      } else if (isRegExp(namePattern)) {
+        nextNamePattern = new RegExp(namePattern);
+      } else {
+        throw new ERR_INVALID_ARG_TYPE(
+          'options.namePattern', ['string', 'RegExp'], namePattern);
+      }
+    }
+    if (samples !== undefined) {
+      validateUint32(samples, 'options.samples', true);
+      nextSamples = samples;
+    }
+    validateAbortSignal(signal, 'options.signal');
+    if (warmup !== undefined) {
+      validateUint32(warmup, 'options.warmup');
+      nextWarmup = warmup;
+    }
+    if (yieldBetweenSamples !== undefined) {
+      validateBoolean(
+        yieldBetweenSamples, 'options.yieldBetweenSamples');
+      nextYieldBetweenSamples = yieldBetweenSamples;
+    }
+
+    this.namePattern = nextNamePattern;
+    this.samples = nextSamples;
+    this.outerSignal = signal;
+    this.warmup = nextWarmup;
+    this.#yieldBetweenSamples = nextYieldBetweenSamples;
+  }
+
+  #ensureCanRun() {
+    if (this.#explicitRun || this.#starting || this.state !== 'collecting') {
+      throw new ERR_INVALID_STATE('benchmark execution has already started');
+    }
+  }
+
+  run(options = kEmptyObject, force = false) {
+    if (kIsCliRunner && !force) {
+      throw new ERR_INVALID_STATE(
+        'run() cannot be called from a file run with --bench');
+    }
+    this.#ensureCanRun();
+    this.#starting = true;
+    try {
+      this.configure(options);
+      this.#explicitRun = true;
+    } finally {
+      this.#starting = false;
+    }
+    this.#schedule(force, true);
+    return this.stream;
+  }
+
+  #schedule(force = false, explicit = false) {
+    if (!force && kIsCliRunner) return;
+    if (!explicit && !this.#autoRun) return;
+    if (this.#scheduled) return;
+    this.#scheduled = true;
+    queueMicrotask(() => {
+      if (this.#runPromise === null) {
+        if (!this.#explicitRun) this.stream.resume();
+        this.#runPromise = PromisePrototypeThen(
+          this.#execute(), undefined, (error) => this.#recover(error));
+      }
+    });
+  }
+
+  async #recover(error) {
+    this.#settleSubtree(this.root, error);
+    if (this.state !== 'finished') {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the original error.
+      }
+    }
+    try {
+      await this.#finish();
+    } catch {
+      // Stream failure has already been reported to its consumer.
+    }
+  }
+
+  #settleSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child.finished) continue;
+      if (child instanceof Suite) {
+        this.#settleSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+      } else {
+        this.success = false;
+        this.counts.failed++;
+        const result = this.#createResult(
+          child, [], { __proto__: null, error });
+        child.finished = true;
+        child.result = result;
+        child.completion.resolve(result);
+      }
+      child.emitDestroy();
+    }
+  }
+
+  async #waitForBuild() {
+    for (let i = 0; i < this.#buildPromises.length; i++) {
+      await this.#buildPromises[i];
+    }
+  }
+
+  #walk(node, callback) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      callback(child);
+      if (child instanceof Suite) this.#walk(child, callback);
+    }
+  }
+
+  #prepare() {
+    const identities = new SafeMap();
+    this.#walk(this.root, (node) => {
+      if (node.only) this.#hasOnly = true;
+      if (!(node instanceof Bench)) return;
+
+      this.counts.total++;
+      const identity = JSONStringify([
+        this.#getRecordScope(node).fileRunId,
+        node.benchId,
+      ]);
+      const existing = identities.get(identity);
+      if (existing === undefined) {
+        identities.set(identity, node);
+      } else {
+        this.#duplicateErrors.set(node, new ERR_INVALID_STATE(
+          `duplicate benchmark identity for "${node.fullName}"`));
+      }
+    });
+  }
+
+  async #emitPlans() {
+    const benchmarks = [];
+    this.#walk(this.root, (node) => {
+      if (node instanceof Bench) ArrayPrototypePush(benchmarks, node);
+    });
+    for (let i = 0; i < benchmarks.length; i++) {
+      const benchmark = benchmarks[i];
+      const skip = this.#getSkip(benchmark);
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        diagnosticChannels: ArrayPrototypeSlice(benchmark.diagnosticChannels),
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+        tags: ArrayPrototypeSlice(benchmark.tags),
+        params: benchmark.params,
+        samples: this.samples ?? benchmark.samples,
+        warmup: this.warmup ?? benchmark.warmup,
+        timeout: benchmark.timeout === Infinity ? null : benchmark.timeout,
+        yieldBetweenSamples: this.#yieldBetweenSamples,
+        selected: skip === null,
+      };
+      if (skip !== null) data.skip = skip;
+      await this.#waitForStream(this.stream.plan(data));
+    }
+  }
+
+  #hasSelectedAncestor(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.only) return true;
+    }
+    return false;
+  }
+
+  #getSkip(benchmark) {
+    for (let current = benchmark; current !== null; current = current.parent) {
+      if (current.skip !== undefined && current.skip !== false) {
+        return current.skip;
+      }
+    }
+    if (this.#hasOnly && !this.#hasSelectedAncestor(benchmark)) return 'only';
+    if (this.namePattern !== null) {
+      this.namePattern.lastIndex = 0;
+      if (RegExpPrototypeExec(this.namePattern, benchmark.fullName) === null) {
+        return 'name pattern';
+      }
+    }
+    return null;
+  }
+
+  #suiteHasActiveBench(suite) {
+    for (let i = 0; i < suite.children.length; i++) {
+      const child = suite.children[i];
+      if (child instanceof Suite) {
+        if (this.#suiteHasActiveBench(child)) return true;
+      } else if (this.#getSkip(child) === null) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  async #invoke(resource, store, fn, args) {
+    const result = resource.runInAsyncScope(() => this.#storage.run(
+      store,
+      () => ReflectApply(fn, undefined, args),
+    ));
+    return PromiseResolve(result);
+  }
+
+  async #runHooks(suite, name, resource, store, context) {
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      await this.#invoke(resource, store, hooks[i].fn, [context]);
+    }
+  }
+
+  async #runSuiteHooks(suite, name) {
+    const context = {
+      __proto__: null,
+      name: suite.name,
+      signal: this.outerSignal,
+    };
+    const hooks = suite.hooks[name];
+    for (let i = 0; i < hooks.length; i++) {
+      try {
+        await this.#invoke(suite, suite, hooks[i].fn, [context]);
+      } catch (error) {
+        return { __proto__: null, error, hook: hooks[i] };
+      }
+    }
+    return null;
+  }
+
+  #getRecordScope(node = undefined) {
+    const scope = node?.fileScope;
+    if (scope !== null && scope !== undefined) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: scope.fileRunId,
+        entryFile: scope.entryFile,
+      };
+    }
+    if (node !== undefined && kIsCliRunner) {
+      return {
+        __proto__: null,
+        runId: this.runId,
+        fileRunId: this.fileRunId,
+        entryFile: null,
+      };
+    }
+    return {
+      __proto__: null,
+      runId: this.runId,
+      fileRunId: this.fileRunId,
+      entryFile: this.entryFile,
+    };
+  }
+
+  async #waitForStream(canContinue) {
+    if (canContinue) return;
+    try {
+      await this.stream.waitForDrain();
+    } catch (error) {
+      if (!this.stream.destroyed) throw error;
+    }
+  }
+
+  async #diagnostic(error, loc, level = 'info', node = undefined) {
+    this.success = false;
+    await this.#waitForStream(this.stream.diagnostic({
+      __proto__: null,
+      ...this.#getRecordScope(node),
+      message: error?.message ?? `${error}`,
+      error,
+      level,
+      file: loc?.file ?? loc?.[2],
+      line: loc?.line ?? loc?.[0],
+      column: loc?.column ?? loc?.[1],
+    }));
+  }
+
+  async #emitSampleDiagnostics(benchmark, phase, index, diagnostics) {
+    for (let i = 0; i < diagnostics.length; i++) {
+      const diagnostic = diagnostics[i];
+      const data = {
+        __proto__: null,
+        ...this.#getRecordScope(benchmark),
+        benchId: benchmark.benchId,
+        parentId: benchmark.parentId,
+        name: benchmark.name,
+        namePath: ArrayPrototypeSlice(benchmark.namePath),
+        phase,
+        index,
+        message: diagnostic.message,
+        level: diagnostic.level,
+        file: benchmark.loc.file,
+        line: benchmark.loc.line,
+        column: benchmark.loc.column,
+      };
+      if (diagnostic.detail !== undefined) data.detail = diagnostic.detail;
+      await this.#waitForStream(this.stream.diagnostic(data));
+    }
+  }
+
+  async #completeSubtree(node, error) {
+    for (let i = 0; i < node.children.length; i++) {
+      const child = node.children[i];
+      if (child instanceof Suite) {
+        await this.#completeSubtree(child, error);
+        child.finished = true;
+        child.completion.resolve();
+        child.emitDestroy();
+      } else {
+        await this.#executeBench(child, error);
+      }
+    }
+  }
+
+  async #executeSuite(suite) {
+    if (this.#abortReason !== null) {
+      await this.#completeSubtree(suite, this.#abortReason);
+      suite.finished = true;
+      suite.completion.resolve();
+      if (!suite.isRoot) suite.emitDestroy();
+      return;
+    }
+
+    if (suite.buildError !== null) {
+      await this.#diagnostic(suite.buildError, suite.loc, 'error', suite);
+      await this.#completeSubtree(suite, suite.buildError);
+      suite.finished = true;
+      suite.completion.resolve();
+      suite.emitDestroy();
+      return;
+    }
+
+    const active = this.#suiteHasActiveBench(suite);
+    let beforeError;
+    if (active) {
+      const failure = await this.#runSuiteHooks(suite, 'before');
+      if (failure !== null) {
+        beforeError = failure.error;
+        await this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
+      }
+    }
+
+    if (beforeError !== undefined) {
+      await this.#completeSubtree(suite, beforeError);
+    } else {
+      for (let i = 0; i < suite.children.length; i++) {
+        const child = suite.children[i];
+        if (child instanceof Suite) {
+          await this.#executeSuite(child);
+        } else {
+          await this.#executeBench(child);
+        }
+      }
+    }
+
+    if (active && this.#abortReason === null) {
+      const failure = await this.#runSuiteHooks(suite, 'after');
+      if (failure !== null) {
+        await this.#diagnostic(
+          failure.error, failure.hook.loc, 'error', failure.hook);
+      }
+    }
+    suite.finished = true;
+    suite.completion.resolve();
+    if (!suite.isRoot) suite.emitDestroy();
+  }
+
+  #getHookSuites(benchmark) {
+    const suites = [];
+    for (let current = benchmark.parent; current !== null; current = current.parent) {
+      ArrayPrototypePush(suites, current);
+    }
+    ArrayPrototypeReverse(suites);
+    return suites;
+  }
+
+  async #runBenchHooks(benchmark, name, context) {
+    const suites = this.#getHookSuites(benchmark);
+    if (name === 'afterEach') ArrayPrototypeReverse(suites);
+    for (let i = 0; i < suites.length; i++) {
+      await this.#runHooks(
+        suites[i], name, benchmark, benchmark, context);
+    }
+  }
+
+  async #runWithStop(benchmark, controller, callback, deadline) {
+    const signals = [];
+    if (this.outerSignal !== undefined) {
+      ArrayPrototypePush(signals, this.outerSignal);
+    }
+    if (benchmark.outerSignal !== undefined &&
+        benchmark.outerSignal !== this.outerSignal) {
+      ArrayPrototypePush(signals, benchmark.outerSignal);
+    }
+
+    for (let i = 0; i < signals.length; i++) {
+      if (signals[i].aborted) {
+        const error = createAbortError(signals[i]);
+        controller.abort(error);
+        throw error;
+      }
+    }
+
+    const stop = PromiseWithResolvers();
+    const listeners = [];
+    let pausedWork;
+    let timer;
+    for (let i = 0; i < signals.length; i++) {
+      const signal = signals[i];
+      ArrayPrototypePush(listeners, addAbortListener(signal, () => {
+        const error = createAbortError(signal);
+        controller.abort(error);
+        stop.reject(error);
+      }));
+    }
+    const armTimer = () => {
+      let remaining = deadline.value - hrtime();
+      if (remaining < 0n) remaining = 0n;
+      timer = setTimeout(() => {
+        const error = createTimeoutError(benchmark);
+        controller.abort(error);
+        stop.reject(error);
+      }, Number(remaining) / 1e6);
+    };
+    if (deadline !== null) armTimer();
+
+    const pause = (work) => {
+      pausedWork = (async () => {
+        if (deadline === null) return work();
+        clearTimeout(timer);
+        timer = undefined;
+        const start = hrtime();
+        try {
+          return await work();
+        } finally {
+          deadline.value += hrtime() - start;
+          if (!controller.signal.aborted) armTimer();
+        }
+      })();
+      return pausedWork;
+    };
+
+    const work = callback(pause);
+    try {
+      if (signals.length === 0 && timer === undefined) return await work;
+      return await SafePromiseRace([work, stop.promise]);
+    } catch (error) {
+      try {
+        await pausedWork;
+      } catch {
+        // Preserve the error that stopped benchmark execution.
+      }
+      if (!await settlesPromptly(work) && this.#abortReason === null) {
+        this.#abortReason = new AbortError(
+          'The benchmark run was aborted because asynchronous work did not ' +
+          'settle after cancellation',
+          { __proto__: null, cause: error },
+        );
+      }
+      throw error;
+    } finally {
+      if (timer !== undefined) clearTimeout(timer);
+      for (let i = 0; i < listeners.length; i++) {
+        listeners[i][SymbolDispose]();
+      }
+    }
+  }
+
+  async #runSample(benchmark, signal, phase, index) {
+    const diagnostics = [];
+    const context = new BenchContext(
+      benchmark, signal, phase, index,
+      (diagnostic) => ArrayPrototypePush(diagnostics, diagnostic));
+    const channels = benchmark.diagnosticChannels;
+    let abortSubscription;
+    let diagnosticError;
+    let diagnosticFailed = false;
+    let subscribed = 0;
+    const onMessage = (message, name) => {
+      if (signal.aborted || diagnosticFailed) return;
+      try {
+        context.diagnostic({ __proto__: null, name, message });
+      } catch (error) {
+        diagnosticError = error;
+        diagnosticFailed = true;
+      }
+    };
+    const unsubscribe = () => {
+      while (subscribed > 0) {
+        subscribed--;
+        unsubscribeFromChannel(channels[subscribed], onMessage);
+      }
+    };
+    try {
+      for (let i = 0; i < channels.length; i++) {
+        subscribeToChannel(channels[i], onMessage);
+        subscribed++;
+      }
+      if (subscribed > 0) {
+        abortSubscription = addAbortListener(signal, unsubscribe);
+      }
+      await this.#invoke(
+        benchmark, benchmark, benchmark.fn, [context]);
+      if (diagnosticFailed) throw diagnosticError;
+      const { done, sample } = context.finish();
+      return {
+        __proto__: null,
+        diagnostics,
+        done,
+        failed: false,
+        sample,
+      };
+    } catch (error) {
+      context.close();
+      return {
+        __proto__: null,
+        diagnostics,
+        error,
+        failed: true,
+      };
+    } finally {
+      abortSubscription?.[SymbolDispose]();
+      unsubscribe();
+    }
+  }
+
+  #createResult(benchmark, samples, extra = kEmptyObject) {
+    return {
+      __proto__: null,
+      ...this.#getRecordScope(benchmark),
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+      samples,
+      ...extra,
+    };
+  }
+
+  async #recordResult(benchmark, result) {
+    benchmark.finished = true;
+    benchmark.result = result;
+    let canContinue;
+    try {
+      canContinue = this.stream.complete(result);
+    } finally {
+      benchmark.completion.resolve(result);
+      benchmark.emitDestroy();
+    }
+    await this.#waitForStream(canContinue);
+  }
+
+  async #executeBench(benchmark, forcedError = undefined) {
+    const duplicateError = this.#duplicateErrors.get(benchmark);
+    if (duplicateError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: duplicateError },
+      ));
+      return;
+    }
+
+    const skip = this.#getSkip(benchmark);
+    if (skip !== null) {
+      this.counts.skipped++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, skip },
+      ));
+      return;
+    }
+
+    if (this.#abortReason !== null) forcedError = this.#abortReason;
+    if (forcedError !== undefined) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        [],
+        { __proto__: null, error: forcedError },
+      ));
+      return;
+    }
+
+    await this.#waitForStream(this.stream.start({
+      __proto__: null,
+      ...this.#getRecordScope(benchmark),
+      benchId: benchmark.benchId,
+      parentId: benchmark.parentId,
+      name: benchmark.name,
+      namePath: ArrayPrototypeSlice(benchmark.namePath),
+      file: benchmark.loc.file,
+      line: benchmark.loc.line,
+      column: benchmark.loc.column,
+      tags: ArrayPrototypeSlice(benchmark.tags),
+      params: benchmark.params,
+    }));
+
+    const controller = new AbortController();
+    const deadline = benchmark.timeout === Infinity ? null : {
+      __proto__: null,
+      value: hrtime() + BigInt(MathCeil(benchmark.timeout * 1e6)),
+    };
+    const checkDeadline = () => {
+      if (deadline !== null && hrtime() >= deadline.value) {
+        const timeoutError = createTimeoutError(benchmark);
+        controller.abort(timeoutError);
+        throw timeoutError;
+      }
+    };
+    const samples = [];
+    const hookContext = {
+      __proto__: null,
+      name: benchmark.name,
+      params: benchmark.params,
+      signal: controller.signal,
+    };
+    let error;
+    let failed = false;
+    const runAfterEach = async () => {
+      await this.#runBenchHooks(
+        benchmark, 'afterEach', hookContext);
+      checkDeadline();
+    };
+
+    try {
+      await this.#runWithStop(benchmark, controller, async (pause) => {
+        try {
+          await this.#runBenchHooks(
+            benchmark, 'beforeEach', hookContext);
+          checkDeadline();
+          const warmup = this.warmup ?? benchmark.warmup;
+          const total = warmup + (this.samples ?? benchmark.samples);
+          for (let i = 0; i < total; i++) {
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            const phase = i < warmup ? 'warmup' : 'measurement';
+            const index = phase === 'warmup' ? i : i - warmup;
+            const outcome = await this.#runSample(
+              benchmark, controller.signal, phase, index);
+            if (!outcome.failed) {
+              checkDeadline();
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+              if (i >= warmup) {
+                ArrayPrototypePush(samples, outcome.sample);
+              }
+            }
+
+            let diagnosticError;
+            let diagnosticFailed = false;
+            if (outcome.diagnostics.length > 0 &&
+                !controller.signal.aborted) {
+              try {
+                await pause(() => this.#emitSampleDiagnostics(
+                  benchmark, phase, index, outcome.diagnostics));
+              } catch (cause) {
+                diagnosticFailed = true;
+                diagnosticError = cause;
+              }
+            }
+            if (outcome.failed) throw outcome.error;
+            if (diagnosticFailed) throw diagnosticError;
+            if (controller.signal.aborted) {
+              throw controller.signal.reason;
+            }
+            if (i >= warmup) {
+              await pause(() => this.#waitForStream(this.stream.sample({
+                __proto__: null,
+                ...this.#getRecordScope(benchmark),
+                benchId: benchmark.benchId,
+                parentId: benchmark.parentId,
+                name: benchmark.name,
+                namePath: ArrayPrototypeSlice(benchmark.namePath),
+                index: i - warmup,
+                ...outcome.sample,
+              })));
+              if (controller.signal.aborted) {
+                throw controller.signal.reason;
+              }
+            }
+            if (outcome.done) break;
+            if (i + 1 < total && this.#yieldBetweenSamples) {
+              await eventLoopTurn();
+            }
+          }
+        } finally {
+          await runAfterEach();
+        }
+      }, deadline);
+    } catch (cause) {
+      failed = true;
+      error = cause;
+    } finally {
+      controller.abort();
+    }
+
+    if (failed) {
+      this.success = false;
+      this.counts.failed++;
+      await this.#recordResult(benchmark, this.#createResult(
+        benchmark,
+        samples,
+        { __proto__: null, error },
+      ));
+      return;
+    }
+
+    this.counts.completed++;
+    await this.#recordResult(benchmark, this.#createResult(
+      benchmark,
+      samples,
+      { __proto__: null, summary: summarizeSamples(samples) },
+    ));
+  }
+
+  async #finish(startTime) {
+    if (this.state === 'finished') return;
+    this.state = 'finished';
+    const duration = startTime === undefined ? 0n : hrtime() - startTime;
+    try {
+      await this.#waitForStream(this.stream.summary({
+        __proto__: null,
+        ...this.#getRecordScope(),
+        success: this.success,
+        counts: this.counts,
+        duration_ns: duration,
+        file: this.entryFile,
+      }));
+    } catch (error) {
+      try {
+        await this.#diagnostic(error, undefined, 'error');
+      } catch {
+        // The stream can fail while reporting the summary listener error.
+      }
+    } finally {
+      this.stream.end();
+      this.root.finished = true;
+      this.root.completion.resolve();
+      this.root.emitDestroy();
+      this.#storage.disable();
+      if (!this.#explicitRun && !this.success) {
+        process.exitCode = kGenericUserError;
+      }
+    }
+  }
+
+  async #execute() {
+    this.state = 'building';
+    const startTime = hrtime();
+    await this.#waitForBuild();
+    this.#fileScopeStorage.disable();
+    this.#prepare();
+    this.state = 'running';
+    await this.#emitPlans();
+    await this.#executeSuite(this.root);
+    await this.#finish(startTime);
+  }
+}
+
+let globalHarness;
+
+function lazyHarness() {
+  globalHarness ??= new Harness();
+  return globalHarness;
+}
+
+function createDeclaration(type, getHarness) {
+  const declare = (name, options, fn, overrides = kEmptyObject) => {
+    const harness = getHarness();
+    const loc = getCallerLocation();
+    const declarationOptions = { __proto__: null, ...overrides, loc };
+    return type === 'benchmark' ?
+      harness.createBench(name, options, fn, declarationOptions) :
+      harness.createSuite(name, options, fn, declarationOptions);
+  };
+
+  if (type === 'benchmark') {
+    declare.skip = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, skip: true });
+    declare.only = (name, options, fn) => declare(
+      name, options, fn, { __proto__: null, only: true });
+  }
+  return declare;
+}
+
+function createHook(name, getHarness) {
+  return (fn, options) => getHarness().createHook(name, fn, options);
+}
+
+const bench = createDeclaration('benchmark', lazyHarness);
+const suite = createDeclaration('suite', lazyHarness);
+
+function createRunner(options = kEmptyObject) {
+  validateObject(options, 'options');
+  const harness = new Harness({
+    __proto__: null,
+    autoRun: false,
+    yieldBetweenSamples: options.yieldBetweenSamples === undefined ?
+      true : options.yieldBetweenSamples,
+  });
+  const getHarness = () => harness;
+  const runnerBench = createDeclaration('benchmark', getHarness);
+  const runnerSuite = createDeclaration('suite', getHarness);
+  return {
+    __proto__: null,
+    after: createHook(kHookNames[0], getHarness),
+    afterEach: createHook(kHookNames[1], getHarness),
+    before: createHook(kHookNames[2], getHarness),
+    beforeEach: createHook(kHookNames[3], getHarness),
+    bench: runnerBench,
+    describe: runnerSuite,
+    run: (runOptions = kEmptyObject) => harness.run(runOptions),
+    suite: runnerSuite,
+  };
+}
+
+function configureRunScope(scope) {
+  lazyHarness().setRunScope(scope);
+}
+
+function runInFileScope(scope, fn) {
+  return lazyHarness().runInFileScope(scope, fn);
+}
+
+function runBenchmarks(options, force) {
+  return lazyHarness().run(options, force);
+}
+
+module.exports = {
+  Harness,
+  after: createHook(kHookNames[0], lazyHarness),
+  afterEach: createHook(kHookNames[1], lazyHarness),
+  before: createHook(kHookNames[2], lazyHarness),
+  beforeEach: createHook(kHookNames[3], lazyHarness),
+  bench,
+  configureRunScope,
+  createRunId,
+  createRunner,
+  runInFileScope,
+  runBenchmarks,
+  suite,
+};
diff --git a/lib/internal/bench_runner/reporter/json.js b/lib/internal/bench_runner/reporter/json.js
new file mode 100644
index 000000000000..3237a3e1b26c
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/json.js
@@ -0,0 +1,64 @@
+'use strict';
+
+const {
+  ArrayIsArray,
+  ArrayPrototypePush,
+  JSONStringify,
+  ObjectKeys,
+  SafeWeakSet,
+  String,
+} = primordials;
+const { isError } = require('internal/util');
+
+function toJSONValue(value, seen) {
+  if (typeof value === 'bigint') return String(value);
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return '[Circular]';
+  seen.add(value);
+
+  if (isError(value)) {
+    const result = {
+      __proto__: null,
+      name: value.name,
+      message: value.message,
+      stack: value.stack,
+      code: value.code,
+    };
+    if (value.cause !== undefined) {
+      result.cause = toJSONValue(value.cause, seen);
+    }
+    if (value.errors !== undefined) {
+      result.errors = toJSONValue(value.errors, seen);
+    }
+    return result;
+  }
+
+  if (ArrayIsArray(value)) {
+    const result = [];
+    for (let i = 0; i < value.length; i++) {
+      ArrayPrototypePush(result, toJSONValue(value[i], seen));
+    }
+    return result;
+  }
+
+  const result = { __proto__: null };
+  const keys = ObjectKeys(value);
+  for (let i = 0; i < keys.length; i++) {
+    const key = keys[i];
+    result[key] = toJSONValue(value[key], seen);
+  }
+  return result;
+}
+
+function stringify(record) {
+  return JSONStringify(record === undefined ? null :
+    toJSONValue(record, new SafeWeakSet()));
+}
+
+async function* jsonReporter(source) {
+  for await (const record of source) {
+    yield `${stringify(record)}\n`;
+  }
+}
+
+module.exports = jsonReporter;
diff --git a/lib/internal/bench_runner/reporter/spec.js b/lib/internal/bench_runner/reporter/spec.js
new file mode 100644
index 000000000000..34f5831553f3
--- /dev/null
+++ b/lib/internal/bench_runner/reporter/spec.js
@@ -0,0 +1,149 @@
+'use strict';
+
+const {
+  ArrayPrototypeJoin,
+  ArrayPrototypePush,
+  JSONStringify,
+  MathAbs,
+  NumberIsFinite,
+  NumberPrototypeToFixed,
+  NumberPrototypeToPrecision,
+  ObjectEntries,
+  String,
+  StringPrototypeReplaceAll,
+} = primordials;
+const Transform = require('internal/streams/transform');
+
+const kHeader =
+  'benchmark | samples | mean rate | 95% CI | median rate | warning\n';
+
+function escapeCell(value) {
+  let result = String(value);
+  result = StringPrototypeReplaceAll(result, '\r', '\\r');
+  result = StringPrototypeReplaceAll(result, '\n', '\\n');
+  return StringPrototypeReplaceAll(result, '|', '\\|');
+}
+
+function formatName(data) {
+  const name = escapeCell(data.name);
+  const entries = ObjectEntries(data.params);
+  if (entries.length === 0) return name;
+
+  const params = [];
+  for (let i = 0; i < entries.length; i++) {
+    const { 0: key, 1: value } = entries[i];
+    ArrayPrototypePush(
+      params, `${escapeCell(key)}=${escapeCell(JSONStringify(value))}`);
+  }
+  return `${name} [${ArrayPrototypeJoin(params, ', ')}]`;
+}
+
+function formatRate(rate) {
+  if (!NumberIsFinite(rate)) return '-';
+
+  const absolute = MathAbs(rate);
+  let divisor = 1;
+  let prefix = '';
+  if (absolute >= 1e9) {
+    divisor = 1e9;
+    prefix = 'G';
+  } else if (absolute >= 1e6) {
+    divisor = 1e6;
+    prefix = 'M';
+  } else if (absolute >= 1e3) {
+    divisor = 1e3;
+    prefix = 'k';
+  }
+
+  const scaled = rate / divisor;
+  const formatted = MathAbs(scaled) > 0 && MathAbs(scaled) < 1 ?
+    NumberPrototypeToPrecision(scaled, 3) :
+    NumberPrototypeToFixed(scaled, 2);
+  return `${formatted}${prefix} ops/s`;
+}
+
+function formatWarning(summary) {
+  const warnings = [];
+  if (NumberIsFinite(summary.coefficientOfVariation) &&
+      summary.coefficientOfVariation > 0.05) {
+    ArrayPrototypePush(warnings, 'noisy');
+  }
+  if (NumberIsFinite(summary.skewness) && MathAbs(summary.skewness) > 1) {
+    ArrayPrototypePush(warnings, 'skewed');
+  }
+  return ArrayPrototypeJoin(warnings, ', ');
+}
+
+function formatResult(data) {
+  const name = formatName(data);
+  if (data.skip !== undefined) {
+    const reason = typeof data.skip === 'string' && data.skip.length > 0 ?
+      `: ${escapeCell(data.skip)}` : '';
+    return `${name} | 0 | - | - | - | skipped${reason}\n`;
+  }
+  if (data.error !== undefined) {
+    const message = data.error?.message ?? data.error;
+    return `${name} | ${data.samples.length} | - | - | - | ` +
+      `error: ${escapeCell(message)}\n`;
+  }
+
+  const { confidenceInterval, median } = data.summary;
+  return `${name} | ${data.samples.length} | ` +
+    `${formatRate(data.summary.mean)} | ` +
+    `[${formatRate(confidenceInterval.lower)}, ` +
+    `${formatRate(confidenceInterval.upper)}] | ` +
+    `${formatRate(median)} | ${formatWarning(data.summary)}\n`;
+}
+
+class SpecReporter extends Transform {
+  #diagnostics = [];
+  #reported = false;
+  #results = [];
+
+  constructor() {
+    super({ __proto__: null, writableObjectMode: true });
+  }
+
+  #format(summary = undefined) {
+    let output = kHeader;
+    for (let i = 0; i < this.#results.length; i++) {
+      output += formatResult(this.#results[i]);
+    }
+    for (let i = 0; i < this.#diagnostics.length; i++) {
+      output += `diagnostic: ${escapeCell(this.#diagnostics[i].message)}\n`;
+    }
+    if (summary !== undefined) {
+      const { completed, failed, skipped } = summary.counts;
+      output += `\n${completed} completed, ${failed} failed, ` +
+        `${skipped} skipped\n`;
+    }
+    return output;
+  }
+
+  _transform({ type, data }, _encoding, callback) {
+    switch (type) {
+      case 'bench:complete':
+        ArrayPrototypePush(this.#results, data);
+        break;
+      case 'bench:diagnostic':
+        ArrayPrototypePush(this.#diagnostics, data);
+        break;
+      case 'bench:summary':
+        this.#reported = true;
+        callback(null, this.#format(data));
+        return;
+    }
+    callback();
+  }
+
+  _flush(callback) {
+    if (this.#reported ||
+        (this.#results.length === 0 && this.#diagnostics.length === 0)) {
+      callback();
+      return;
+    }
+    callback(null, this.#format());
+  }
+}
+
+module.exports = SpecReporter;
diff --git a/lib/internal/bench_runner/runner.js b/lib/internal/bench_runner/runner.js
new file mode 100644
index 000000000000..c48a0a5339fa
--- /dev/null
+++ b/lib/internal/bench_runner/runner.js
@@ -0,0 +1,21 @@
+'use strict';
+
+const { kEmptyObject } = require('internal/util');
+const {
+  createRunner,
+  runBenchmarks,
+} = require('internal/bench_runner/harness');
+
+function run(options = kEmptyObject) {
+  return runBenchmarks(options);
+}
+
+function runFile(path, options = kEmptyObject) {
+  return require('internal/bench_runner/cli').runFile(path, options);
+}
+
+module.exports = {
+  createRunner,
+  run,
+  runFile,
+};
diff --git a/lib/internal/blocklist.js b/lib/internal/blocklist.js
index 5b5023b0f923..9436078eaa2c 100644
--- a/lib/internal/blocklist.js
+++ b/lib/internal/blocklist.js
@@ -383,7 +383,7 @@ class BlockList {
         // - 2001:db8:85a3::8a2e:370:7334/64 (compressed)
         // - 2001:db8:85a3::192.0.2.128/64 (mixed)
         const ipv6SubnetMatch = item.match(
-          /Subnet: IPv6 ([0-9a-fA-F:]{1,39})\/([0-9]{1,3})/i,
+          /Subnet: IPv6 ([0-9a-fA-F:.]{1,45})\/([0-9]{1,3})/i,
         );
         if (ipv6SubnetMatch) {
           const { 1: network, 2: prefix } = ipv6SubnetMatch;
@@ -396,7 +396,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334 (full)
         // - 2001:db8:85a3::8a2e:370:7334 (compressed)
         // - 2001:db8:85a3::192.0.2.128 (mixed)
-        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:]{1,39})/i);
+        const ipv6AddressMatch = item.match(/Address: IPv6 ([0-9a-fA-F:.]{1,45})/i);
         if (ipv6AddressMatch) {
           const { 1: address } = ipv6AddressMatch;
           this.addAddress(address, 'ipv6');
@@ -408,7 +408,7 @@ class BlockList {
         // - 2001:0db8:85a3:0000:0000:8a2e:0370:7334-2001:0db8:85a3:0000:0000:8a2e:0370:7335 (full)
         // - 2001:db8:85a3::8a2e:370:7334-2001:db8:85a3::8a2e:370:7335 (compressed)
         // - 2001:db8:85a3::192.0.2.128-2001:db8:85a3::192.0.2.129 (mixed)
-        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:]{1,39})-([0-9a-fA-F:]{1,39})/i);
+        const ipv6RangeMatch = item.match(/Range: IPv6 ([0-9a-fA-F:.]{1,45})-([0-9a-fA-F:.]{1,45})/i);
         if (ipv6RangeMatch) {
           const { 1: start, 2: end } = ipv6RangeMatch;
           this.addRange(start, end, 'ipv6');
diff --git a/lib/internal/bootstrap/realm.js b/lib/internal/bootstrap/realm.js
index 4dfb39ae9568..81ac2a0e398e 100644
--- a/lib/internal/bootstrap/realm.js
+++ b/lib/internal/bootstrap/realm.js
@@ -124,6 +124,8 @@ const legacyWrapperList = new SafeSet([
 // beginning with "internal/".
 // Modules that can only be imported via the node: scheme.
 const schemelessBlockList = new SafeSet([
+  'bench',
+  'bench/reporters',
   'dtls',
   'ffi',
   'sea',
diff --git a/lib/internal/bootstrap/switches/is_not_main_thread.js b/lib/internal/bootstrap/switches/is_not_main_thread.js
index 6fa30aec748a..1716bea20149 100644
--- a/lib/internal/bootstrap/switches/is_not_main_thread.js
+++ b/lib/internal/bootstrap/switches/is_not_main_thread.js
@@ -6,6 +6,12 @@ const {
 
 delete process._debugProcess;
 delete process._debugEnd;
+// Also drop the other main-thread-only helpers is_main_thread.js installs, so
+// that this switch can be applied on top of a context bootstrapped for the
+// main thread (as when a worker starts from the built-in snapshot).
+delete process._debugPause;
+delete process._startProfilerIdleNotifier;
+delete process._stopProfilerIdleNotifier;
 
 function defineStream(name, getter) {
   ObjectDefineProperty(process, name, {
diff --git a/lib/internal/buffer.js b/lib/internal/buffer.js
index 5977bdf23768..325df6ca01ad 100644
--- a/lib/internal/buffer.js
+++ b/lib/internal/buffer.js
@@ -5,6 +5,7 @@ const {
   Float32Array,
   Float64Array,
   MathFloor,
+  MathMax,
   Number,
   Symbol,
   Uint8Array,
@@ -1114,24 +1115,33 @@ function createUnsafeBuffer(size) {
   return new FastBuffer(createUnsafeArrayBuffer(size));
 }
 
+// Reaching an aligned address needs at most `alignment - 1` extra bytes, but a
+// multiple of 8 is padded instead. Backing store addresses are 8 byte aligned
+// too, so the bytes left over after the buffer then remain a whole number of
+// elements of any typed array created over its ArrayBuffer.
+function alignmentPadding(alignment) {
+  return MathMax(alignment, 8);
+}
+
 // Returns an uninitialized buffer of `size` bytes whose first byte is located at
 // a memory address that is a multiple of `alignment`. `alignment` must be a
-// power of two, and `size + alignment - 1` must not exceed the maximum buffer
-// length. Since the address of a backing store cannot be chosen, `alignment - 1`
-// extra bytes are allocated and skipped, which leaves the returned buffer with a
-// non-zero `byteOffset` into a larger ArrayBuffer.
+// power of two, and `size` plus its padding must not exceed the maximum buffer
+// length. Since the address of a backing store cannot be chosen, that padding is
+// allocated and skipped, which leaves the returned buffer with a non-zero
+// `byteOffset` into a larger ArrayBuffer.
 function createUnsafeAlignedBuffer(size, alignment) {
   if (size === 0) {
     return new FastBuffer();
   }
 
-  const ab = createUnsafeArrayBuffer(size + alignment - 1);
+  const ab = createUnsafeArrayBuffer(size + alignmentPadding(alignment));
   return new FastBuffer(ab, arrayBufferAlignedOffset(ab, alignment), size);
 }
 
 module.exports = {
   FastBuffer,
   addBufferPrototypeMethods,
+  alignmentPadding,
   markAsUntransferable,
   isMarkedAsUntransferable,
   createUnsafeBuffer,
diff --git a/lib/internal/child_process.js b/lib/internal/child_process.js
index a12b2954db81..06daf2183db3 100644
--- a/lib/internal/child_process.js
+++ b/lib/internal/child_process.js
@@ -54,6 +54,10 @@ const { TCP } = internalBinding('tcp_wrap');
 const { TTY } = internalBinding('tty_wrap');
 const { UDP } = internalBinding('udp_wrap');
 const SocketList = require('internal/socket_list');
+const {
+  kDeserialize,
+  kTransfer,
+} = require('internal/worker/js_transferable');
 const { owner_symbol } = require('internal/async_hooks').symbols;
 const { convertToValidSignal } = require('internal/util');
 const { isArrayBufferView } = require('internal/util/types');
@@ -86,6 +90,24 @@ const kChannelHandle = Symbol('kChannelHandle');
 const kIsUsedAsStdio = Symbol('kIsUsedAsStdio');
 const kPendingMessages = Symbol('kPendingMessages');
 
+// Store the handle after successfully sending it, so it can be closed when
+// the NODE_HANDLE_ACK is received. If the handle could not be sent, just
+// close it.
+function closeHandleAfterAck(message, handle, options, callback, target) {
+  if (handle && !options.keepOpen) {
+    if (target) {
+      // There can only be one _pendingMessage as passing handles are
+      // processed one at a time: handles are stored in _handleQueue while
+      // waiting for the NODE_HANDLE_ACK of the current passing handle.
+      assert(!target._pendingMessage);
+      target._pendingMessage =
+          { callback, message, handle, options, retransmissions: 0 };
+    } else {
+      handle.close();
+    }
+  }
+}
+
 // This object contain function to convert TCP objects to native handle objects
 // and back again.
 const handleConversion = {
@@ -116,6 +138,29 @@ const handleConversion = {
     },
   },
 
+  'net.BoundSocket': {
+    simultaneousAccepts: true,
+
+    send(message, boundSocket, options) {
+      // Pipe (path) binds cannot be sent over the IPC channel.
+      if (boundSocket.isPipe)
+        throw new ERR_INVALID_HANDLE_TYPE();
+
+      // Reuse the worker_threads transfer protocol: detaches the handle,
+      // leaving the source in the adopted state, and throws if the bound
+      // socket is not in a transferable state.
+      return boundSocket[kTransfer]().data.handle;
+    },
+
+    postSend: closeHandleAfterAck,
+
+    got(message, handle, emit) {
+      const boundSocket = new net._TransferredBoundSocket();
+      boundSocket[kDeserialize]({ handle });
+      emit(boundSocket);
+    },
+  },
+
   'net.Socket': {
     send(message, socket, options) {
       if (!socket._handle)
@@ -165,23 +210,7 @@ const handleConversion = {
       return handle;
     },
 
-    postSend(message, handle, options, callback, target) {
-      // Store the handle after successfully sending it, so it can be closed
-      // when the NODE_HANDLE_ACK is received. If the handle could not be sent,
-      // just close it.
-      if (handle && !options.keepOpen) {
-        if (target) {
-          // There can only be one _pendingMessage as passing handles are
-          // processed one at a time: handles are stored in _handleQueue while
-          // waiting for the NODE_HANDLE_ACK of the current passing handle.
-          assert(!target._pendingMessage);
-          target._pendingMessage =
-              { callback, message, handle, options, retransmissions: 0 };
-        } else {
-          handle.close();
-        }
-      }
-    },
+    postSend: closeHandleAfterAck,
 
     got(message, handle, emit) {
       const socket = new net.Socket({
@@ -822,6 +851,8 @@ function setupChannel(target, channel, serializationMode) {
         message.type = 'net.Socket';
       } else if (handle instanceof net.Server) {
         message.type = 'net.Server';
+      } else if (handle instanceof net.BoundSocket) {
+        message.type = 'net.BoundSocket';
       } else if (handle instanceof TCP || handle instanceof Pipe) {
         message.type = 'net.Native';
       } else if (handle instanceof dgram.Socket) {
diff --git a/lib/internal/cli_table.js b/lib/internal/cli_table.js
index be0bd44bbc36..13b3c86c5e40 100644
--- a/lib/internal/cli_table.js
+++ b/lib/internal/cli_table.js
@@ -81,8 +81,10 @@ const table = (head, columns) => {
                ArrayPrototypeJoin(divider, tableChars.rowMiddle) +
                tableChars.rightMiddle + '\n';
 
-  for (const row of rows)
+  for (let i = 0; i < rows.length; i++) {
+    const row = rows[i];
     result += `${renderRow(row, columnWidths)}\n`;
+  }
 
   result += tableChars.bottomLeft +
             ArrayPrototypeJoin(divider, tableChars.bottomMiddle) +
diff --git a/lib/internal/crypto/hkdf.js b/lib/internal/crypto/hkdf.js
index fcff7070164f..8673f9b46817 100644
--- a/lib/internal/crypto/hkdf.js
+++ b/lib/internal/crypto/hkdf.js
@@ -4,6 +4,8 @@ const {
   ArrayBuffer,
   FunctionPrototypeCall,
   PromiseResolve,
+  TypedArrayPrototypeGetByteLength,
+  Uint8Array,
 } = primordials;
 
 const {
@@ -22,6 +24,7 @@ const {
 const { kMaxLength } = require('buffer');
 
 const {
+  getBufferSourceByteLength,
   jobPromise,
   normalizeHashName,
   toBuf,
@@ -41,6 +44,7 @@ const {
 const {
   isAnyArrayBuffer,
   isArrayBufferView,
+  isSharedArrayBuffer,
 } = require('internal/util/types');
 
 const {
@@ -51,6 +55,13 @@ const {
   hideStackFrames,
 } = require('internal/errors');
 
+function getByteSourceByteLength(source) {
+  if (isSharedArrayBuffer(source)) {
+    return TypedArrayPrototypeGetByteLength(new Uint8Array(source));
+  }
+  return getBufferSourceByteLength(source);
+}
+
 const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   validateString.withoutStackTrace(hash, 'digest');
   key = prepareKey(key);
@@ -61,11 +72,12 @@ const validateParameters = hideStackFrames((hash, key, salt, info, length) => {
   // Coerce -0 to +0.
   length += 0;
 
-  if (info.byteLength > 1024) {
+  const infoByteLength = getByteSourceByteLength(info);
+  if (infoByteLength > 1024) {
     throw new ERR_OUT_OF_RANGE.HideStackFramesError(
       'info',
       'must not contain more than 1024 bytes',
-      info.byteLength);
+      infoByteLength);
   }
 
   return {
@@ -103,18 +115,20 @@ function prepareKey(key) {
   return key;
 }
 
-function hkdf(hash, key, salt, info, length, callback) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
+function createHkdfJob(mode, params) {
+  return new HKDFJob(
+    mode,
+    params.hash,
+    params.key,
+    params.salt,
+    params.info,
+    params.length);
+}
 
+function hkdf(hash, key, salt, info, length, callback) {
+  const params = validateParameters(hash, key, salt, info, length);
   validateFunction(callback, 'callback');
-
-  const job = new HKDFJob(kCryptoJobAsync, hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobAsync, params);
 
   job.ondone = (error, bits) => {
     if (error) return FunctionPrototypeCall(callback, job, error);
@@ -125,15 +139,8 @@ function hkdf(hash, key, salt, info, length, callback) {
 }
 
 function hkdfSync(hash, key, salt, info, length) {
-  ({
-    hash,
-    key,
-    salt,
-    info,
-    length,
-  } = validateParameters(hash, key, salt, info, length));
-
-  const job = new HKDFJob(kCryptoJobSync, hash, key, salt, info, length);
+  const params = validateParameters(hash, key, salt, info, length);
+  const job = createHkdfJob(kCryptoJobSync, params);
   const { 0: err, 1: bits } = job.run();
   if (err !== undefined)
     throw err;
diff --git a/lib/internal/crypto/kem_hybrids.js b/lib/internal/crypto/kem_hybrids.js
new file mode 100644
index 000000000000..6565b8dcae0a
--- /dev/null
+++ b/lib/internal/crypto/kem_hybrids.js
@@ -0,0 +1,1173 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  BigInt,
+  PromiseWithResolvers,
+  SafeSet,
+  TypedArrayOf,
+  TypedArrayPrototypeGetBuffer,
+  TypedArrayPrototypeGetByteLength,
+  TypedArrayPrototypeGetLength,
+  TypedArrayPrototypeSet,
+  TypedArrayPrototypeSubarray,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+
+const {
+  getCryptoKeyExtractable,
+  getCryptoKeyAlgorithm,
+  getCryptoKeyHandle,
+  getCryptoKeySeedData,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeyType,
+  getCryptoKeyUsages,
+  InternalCryptoKey,
+} = require('internal/crypto/keys');
+
+const {
+  DHBitsJob,
+  KEMDecapsulateJob,
+  KEMEncapsulateJob,
+  KeyObjectHandle,
+  kCryptoJobWebCrypto,
+  kKeyFormatRawPrivate,
+  kKeyFormatRawPublic,
+  kKeyFormatRawSeed,
+  kKeyTypePrivate,
+  kKeyTypePublic,
+  timingSafeEqual,
+} = internalBinding('crypto');
+
+const {
+  crypto: {
+    POINT_CONVERSION_UNCOMPRESSED,
+  },
+} = internalBinding('constants');
+
+const {
+  getBufferSourceBytes,
+  getUsagesMask,
+  jobPromise,
+  jobPromiseThen,
+  resolveWebCryptoResult,
+} = require('internal/crypto/util');
+
+const {
+  lazyDOMException,
+  setOwnProperty,
+} = require('internal/util');
+
+const {
+  hash,
+} = require('internal/crypto/hash');
+
+const {
+  randomBytes,
+} = require('internal/crypto/random');
+
+const {
+  createKeyUsages,
+  getKeyPairUsages,
+  validateJwk,
+  validateKeyUsages,
+  validateUsagesNotEmpty,
+  verifyAcceptableKeyUse,
+} = require('internal/crypto/webcrypto_util');
+
+// Concrete PQ/T Hybrid KEM instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4
+// CG framework used by those instances:
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.5
+
+const kKemPqSeedLength = 64;
+const kSeedLength = 32;
+const kX25519KeyLength = 32;
+const kP256KeyLength = 32;
+const kP384KeyLength = 48;
+const kEcPointPrefixLength = 1;
+const kEcUncompressedPointPrefix = 0x04;
+const kKemPq768EncapsulationKeyLength = 1184;
+const kKemPq768CiphertextLength = 1088;
+const kKemPq1024EncapsulationKeyLength = 1568;
+const kKemPq1024CiphertextLength = 1568;
+const kKemPq768Name = 'ML-KEM-768';
+const kKemPq1024Name = 'ML-KEM-1024';
+const kX25519Name = 'X25519';
+const kEcdhName = 'ECDH';
+const kEcKeyType = 'ec';
+const kP256Name = 'P-256';
+const kP384Name = 'P-384';
+// P-256 and P-384 group order constants are used by RandomScalar.
+// https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-3.1.1
+// https://www.rfc-editor.org/rfc/rfc8017#section-4.2
+const kP256Order = 0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n;
+const kP384Order = 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973n;
+
+const kEncapsulationUsages = ['encapsulateKey', 'encapsulateBits'];
+const kDecapsulationUsages = ['decapsulateKey', 'decapsulateBits'];
+const kUsages = createKeyUsages(kEncapsulationUsages, kDecapsulationUsages);
+
+/**
+ * Adds lengths that are the concatenation of the PQ KEM component and the
+ * traditional group component.
+ * @param {object} config
+ * @returns {object}
+ */
+function withHybridLengths(config) {
+  return {
+    __proto__: null,
+    ...config,
+    encapsulationKeyLength:
+      config.kemPqEncapsulationKeyLength + config.groupElementLength,
+    ciphertextLength:
+      config.kemPqCiphertextLength + config.groupElementLength,
+  };
+}
+
+const kAlgorithms = {
+  '__proto__': null,
+  'MLKEM768-P256': withHybridLengths({
+    name: 'MLKEM768-P256',
+    kemPqName: kKemPq768Name,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP256Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP256KeyLength,
+    groupScalarLength: kP256KeyLength,
+    groupSeedLength: 4 * kP256KeyLength,
+    groupOrder: kP256Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x37, 0x36,
+      0x38, 0x2d, 0x50, 0x32, 0x35, 0x36, // "MLKEM768-P256"
+    ),
+  }),
+  'MLKEM768-X25519': withHybridLengths({
+    name: 'MLKEM768-X25519',
+    kemPqName: kKemPq768Name,
+    kemPqEncapsulationKeyLength: kKemPq768EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq768CiphertextLength,
+    groupName: kX25519Name,
+    groupKeyType: kX25519Name,
+    // Curve25519 RandomScalar is identity and Exp is X25519.
+    // https://www.rfc-editor.org/rfc/rfc7748#section-5
+    groupElementLength: kX25519KeyLength,
+    groupScalarLength: kX25519KeyLength,
+    groupSeedLength: kX25519KeyLength,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x5c, 0x2e, 0x2f, 0x2f, 0x5e, 0x5c, // "\\.//^\\"
+    ),
+  }),
+  'MLKEM1024-P384': withHybridLengths({
+    name: 'MLKEM1024-P384',
+    kemPqName: kKemPq1024Name,
+    kemPqEncapsulationKeyLength: kKemPq1024EncapsulationKeyLength,
+    kemPqCiphertextLength: kKemPq1024CiphertextLength,
+    groupName: kEcdhName,
+    groupKeyType: kEcKeyType,
+    namedCurve: kP384Name,
+    groupElementLength: kEcPointPrefixLength + 2 * kP384KeyLength,
+    groupScalarLength: kP384KeyLength,
+    groupSeedLength: kP384KeyLength,
+    groupOrder: kP384Order,
+    label: TypedArrayOf(
+      Uint8Array,
+      0x4d, 0x4c, 0x4b, 0x45, 0x4d, 0x31, 0x30,
+      0x32, 0x34, 0x2d, 0x50, 0x33, 0x38, 0x34, // "MLKEM1024-P384"
+    ),
+  }),
+};
+
+/**
+ * Wraps native or lower-level failures as WebCrypto OperationError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function operationFailure(cause) {
+  return lazyDOMException(
+    'The operation failed for an operation-specific reason',
+    { name: 'OperationError', cause });
+}
+
+/**
+ * Wraps native or lower-level failures as WebCrypto DataError failures.
+ * @param {unknown} [cause]
+ * @returns {DOMException}
+ */
+function dataFailure(cause) {
+  return lazyDOMException('Invalid keyData', { name: 'DataError', cause });
+}
+
+/**
+ * Copies supported BufferSource-like data into a new Uint8Array.
+ * @param {ArrayBuffer | ArrayBufferView} data
+ * @returns {Uint8Array}
+ */
+function copyBytes(data) {
+  return new Uint8Array(getBufferSourceBytes(data));
+}
+
+/**
+ * Concatenates byte arrays into a new Uint8Array of the expected length.
+ * @param {Uint8Array[]} chunks
+ * @param {number} length
+ * @returns {Uint8Array}
+ */
+function concatBytes(chunks, length) {
+  const output = new Uint8Array(length);
+  let offset = 0;
+  for (let n = 0; n < chunks.length; n++) {
+    const chunk = chunks[n];
+    TypedArrayPrototypeSet(output, chunk, offset);
+    offset += TypedArrayPrototypeGetByteLength(chunk);
+  }
+  return output;
+}
+
+/**
+ * Compares byte arrays by value.
+ * @param {Uint8Array} a
+ * @param {Uint8Array} b
+ * @returns {boolean}
+ */
+function bytesEqual(a, b) {
+  return TypedArrayPrototypeGetByteLength(a) === TypedArrayPrototypeGetByteLength(b) &&
+    timingSafeEqual(a, b);
+}
+
+/**
+ * Decodes a JWK base64url member.
+ * @param {string} input
+ * @returns {Uint8Array}
+ */
+function decodeJwkBase64Url(input) {
+  return Buffer.from(input, 'base64url');
+}
+
+/**
+ * Encodes JWK key material as unpadded base64url.
+ * @param {Uint8Array} input
+ * @returns {string}
+ */
+function base64urlEncode(input) {
+  return Buffer.from(input).toString('base64url');
+}
+
+/**
+ * Copies a Uint8Array's represented bytes into an ArrayBuffer result.
+ * @param {Uint8Array} data
+ * @returns {ArrayBuffer}
+ */
+function toArrayBuffer(data) {
+  return TypedArrayPrototypeGetBuffer(copyBytes(data));
+}
+
+/**
+ * Validates fixed-size key material.
+ * @param {Uint8Array} data
+ * @param {number} length
+ */
+function validateLength(data, length) {
+  if (TypedArrayPrototypeGetByteLength(data) !== length) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+}
+
+/**
+ * Splits bytes into the PQ KEM and traditional group portions.
+ * @param {Uint8Array} data
+ * @param {number} offset
+ * @returns {{ head: Uint8Array, tail: Uint8Array }}
+ */
+function splitAt(data, offset) {
+  return {
+    __proto__: null,
+    head: TypedArrayPrototypeSubarray(data, 0, offset),
+    tail: TypedArrayPrototypeSubarray(data, offset),
+  };
+}
+
+/**
+ * Splits a Hybrid KEM raw-public key into its PQ and group public-key parts.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitEncapsulationKey(rawEncapsulationKey, config) {
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  const { head, tail } = splitAt(
+    rawEncapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  return { __proto__: null, kemPq: head, group: tail };
+}
+
+/**
+ * Copies and splits a Hybrid KEM ciphertext into its PQ and group parts.
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @param {object} config
+ * @returns {{ kemPq: Uint8Array, group: Uint8Array }}
+ */
+function splitCiphertext(ciphertext, config) {
+  const ciphertextBuffer = copyBytes(ciphertext);
+  if (TypedArrayPrototypeGetByteLength(ciphertextBuffer) !==
+      config.ciphertextLength) {
+    throw operationFailure();
+  }
+  const { head, tail } = splitAt(
+    ciphertextBuffer,
+    config.kemPqCiphertextLength);
+  return { __proto__: null, kemPq: head, group: copyBytes(tail) };
+}
+
+/**
+ * Converts an octet string to a non-negative integer.
+ * @param {Uint8Array} data
+ * @returns {bigint}
+ */
+function os2ip(data) {
+  let value = 0n;
+  for (let n = 0; n < TypedArrayPrototypeGetLength(data); n++)
+    value = (value << 8n) | BigInt(data[n]);
+  return value;
+}
+
+/**
+ * Derives a valid traditional group scalar from expanded seed bytes.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function randomScalar(seed, config) {
+  if (config.groupOrder === undefined)
+    return copyBytes(seed);
+
+  const { groupOrder, groupScalarLength } = config;
+  for (let offset = 0;
+    offset + groupScalarLength <= TypedArrayPrototypeGetLength(seed);
+    offset += groupScalarLength) {
+    const scalar = copyBytes(
+      TypedArrayPrototypeSubarray(seed, offset, offset + groupScalarLength));
+    const value = os2ip(scalar);
+    if (value !== 0n && value < groupOrder)
+      return scalar;
+  }
+
+  throw operationFailure();
+}
+
+/**
+ * Imports raw key material into a native KeyObjectHandle.
+ * @param {number} keyType
+ * @param {Uint8Array} keyData
+ * @param {number} format
+ * @param {string} asymmetricKeyType
+ * @param {string} [namedCurve]
+ * @returns {KeyObjectHandle}
+ */
+function importRawKeyHandle(
+  keyType,
+  keyData,
+  format,
+  asymmetricKeyType,
+  namedCurve) {
+  const handle = new KeyObjectHandle();
+  handle.init(
+    keyType,
+    keyData,
+    format,
+    asymmetricKeyType,
+    null,
+    namedCurve ?? null);
+  if (asymmetricKeyType === kEcKeyType && !handle.checkEcKeyData())
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return handle;
+}
+
+/**
+ * Imports the PQ KEM decapsulation seed.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqDecapsulationHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawSeed,
+    config.kemPqName);
+}
+
+/**
+ * Imports the PQ KEM encapsulation key.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importKemPqEncapsulationHandle(rawEncapsulationKey, config) {
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    rawEncapsulationKey,
+    kKeyFormatRawPublic,
+    config.kemPqName);
+}
+
+/**
+ * Imports the traditional group private scalar.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupPrivateHandle(seed, config) {
+  return importRawKeyHandle(
+    kKeyTypePrivate,
+    seed,
+    kKeyFormatRawPrivate,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Imports the traditional group public element.
+ * @param {Uint8Array} groupElement
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importGroupElementHandle(groupElement, config) {
+  if (config.groupKeyType === kEcKeyType &&
+      groupElement[0] !== kEcUncompressedPointPrefix) {
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  }
+  return importRawKeyHandle(
+    kKeyTypePublic,
+    groupElement,
+    kKeyFormatRawPublic,
+    config.groupKeyType,
+    config.namedCurve);
+}
+
+/**
+ * Exports the raw public key bytes from the PQ KEM handle.
+ * @param {KeyObjectHandle} handle
+ * @returns {Uint8Array}
+ */
+function rawKemPqEncapsulationKey(handle) {
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Exports the raw public element from the traditional group handle.
+ * @param {KeyObjectHandle} handle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawGroupElement(handle, config) {
+  if (config.groupKeyType === kEcKeyType) {
+    return copyBytes(
+      handle.exportECPublicRaw(POINT_CONVERSION_UNCOMPRESSED));
+  }
+  return copyBytes(handle.rawPublicKey());
+}
+
+/**
+ * Builds the Hybrid KEM raw-public key from component public handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config) {
+  return concatBytes([
+    rawKemPqEncapsulationKey(kemPqHandle),
+    rawGroupElement(groupHandle, config),
+  ], config.encapsulationKeyLength);
+}
+
+/**
+ * Imports both components of a Hybrid KEM public key.
+ * @param {Uint8Array} kemPq
+ * @param {Uint8Array} group
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPublicKeyHandles(kemPq, group, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqEncapsulationHandle(kemPq, config),
+      groupHandle: importGroupElementHandle(group, config),
+    };
+  } catch (err) {
+    throw dataFailure(err);
+  }
+}
+
+/**
+ * Imports both components of a Hybrid KEM private key.
+ * @param {Uint8Array} seedPq
+ * @param {Uint8Array} groupSeed
+ * @param {object} config
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function importPrivateKeyHandles(seedPq, groupSeed, config) {
+  try {
+    return {
+      __proto__: null,
+      kemPqHandle: importKemPqDecapsulationHandle(seedPq, config),
+      groupHandle: importGroupPrivateHandle(groupSeed, config),
+    };
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from imported component handles.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle);
+}
+
+/**
+ * Creates a Hybrid KEM private CryptoKey from imported component handles and seed.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPrivateKeyFromComponents(
+  kemPqHandle,
+  groupHandle,
+  seed,
+  config,
+  extractable,
+  keyUsages) {
+  const usagesSet = new SafeSet(keyUsages);
+  return new InternalCryptoKey(
+    kemPqHandle,
+    { name: config.name },
+    getUsagesMask(usagesSet),
+    extractable,
+    groupHandle,
+    seed);
+}
+
+/**
+ * Creates a Hybrid KEM public CryptoKey from concatenated raw-public bytes.
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function createPublicKeyFromRaw(
+  rawEncapsulationKey,
+  config,
+  extractable,
+  keyUsages) {
+  const { kemPq, group } = splitEncapsulationKey(rawEncapsulationKey, config);
+  const { kemPqHandle, groupHandle } =
+    importPublicKeyHandles(kemPq, group, config);
+
+  return createPublicKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    config,
+    extractable,
+    keyUsages);
+}
+
+/**
+ * Expands the 32-byte Hybrid KEM seed into PQ KEM seed and group seed material.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @returns {{ seedPq: Uint8Array, groupSeed: Uint8Array }}
+ */
+function expandSeed(seed, config) {
+  validateLength(seed, kSeedLength);
+
+  // DeriveKeyPair(seed) expands seed into seed_PQ and seed_T.
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-concrete-hybrid-kems-04.html#section-4.1
+  const expanded = copyBytes(hash('shake256', seed, {
+    outputEncoding: 'buffer',
+    outputLength: kKemPqSeedLength + config.groupSeedLength,
+  }));
+
+  const { head, tail } = splitAt(expanded, kKemPqSeedLength);
+  return {
+    __proto__: null,
+    seedPq: copyBytes(head),
+    groupSeed: randomScalar(tail, config),
+  };
+}
+
+/**
+ * Derives the Hybrid KEM private key and, when requested, the matching public key.
+ * @param {Uint8Array} seed
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string> | string[]} decapsulationKeyUsages
+ * @param {Set<string> | string[]} [encapsulationKeyUsages]
+ * @returns {{ privateKey: InternalCryptoKey, publicKey?: InternalCryptoKey }}
+ */
+function deriveKeyPair(
+  seed,
+  config,
+  extractable,
+  decapsulationKeyUsages,
+  encapsulationKeyUsages) {
+  const { seedPq, groupSeed } = expandSeed(seed, config);
+  const { kemPqHandle, groupHandle } =
+    importPrivateKeyHandles(seedPq, groupSeed, config);
+
+  const privateKey = createPrivateKeyFromComponents(
+    kemPqHandle,
+    groupHandle,
+    seed,
+    config,
+    extractable,
+    decapsulationKeyUsages);
+
+  if (encapsulationKeyUsages === undefined)
+    return { __proto__: null, privateKey };
+
+  const publicKey = createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(
+      kemPqHandle,
+      groupHandle,
+      config),
+    config,
+    true,
+    encapsulationKeyUsages);
+  return { __proto__: null, privateKey, publicKey };
+}
+
+/**
+ * Extracts both component handles stored in a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {{ kemPqHandle: KeyObjectHandle, groupHandle: KeyObjectHandle }}
+ */
+function getHybridKeyHandles(key) {
+  const kemPqHandle = getCryptoKeyHandle(key);
+  const groupHandle = getCryptoKeySecondaryHandle(key);
+  if (groupHandle === undefined) {
+    throw operationFailure();
+  }
+  return { __proto__: null, kemPqHandle, groupHandle };
+}
+
+/**
+ * Extracts and copies the stored 32-byte Hybrid KEM seed from a private key.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array}
+ */
+function getHybridSeed(key) {
+  const seed = getCryptoKeySeedData(key);
+  if (seed === undefined) {
+    throw operationFailure();
+  }
+  return copyBytes(seed);
+}
+
+/**
+ * Returns the algorithm config and component handles for a Hybrid KEM CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {object}
+ */
+function getHybridKeyContext(key) {
+  const config = kAlgorithms[getCryptoKeyAlgorithm(key).name];
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(key);
+  return { __proto__: null, config, kemPqHandle, groupHandle };
+}
+
+/**
+ * Validates the CryptoKey type and returns its Hybrid KEM key context.
+ * @param {CryptoKey} key
+ * @param {'public' | 'private'} type
+ * @param {string} message
+ * @returns {object}
+ */
+function requireHybridKeyContext(key, type, message) {
+  if (getCryptoKeyType(key) !== type)
+    throw lazyDOMException(message, 'InvalidAccessError');
+  return getHybridKeyContext(key);
+}
+
+/**
+ * Runs ECDH/X25519 over the traditional group component.
+ * @param {KeyObjectHandle} publicHandle
+ * @param {KeyObjectHandle} privateHandle
+ * @returns {Promise<Uint8Array>}
+ */
+function deriveGroupBits(publicHandle, privateHandle) {
+  const bits = jobPromise(() => new DHBitsJob(
+    kCryptoJobWebCrypto,
+    publicHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    privateHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  return jobPromiseThen(
+    bits,
+    (bits) => copyBytes(bits),
+    (err) => { throw operationFailure(err); });
+}
+
+/**
+ * Applies the C2PRI combiner to the PQ and traditional shared secrets.
+ * @param {Uint8Array} sharedSecretPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {Uint8Array} ciphertextT
+ * @param {Uint8Array} encapsulationKey
+ * @param {object} config
+ * @returns {Uint8Array}
+ */
+function combineSharedSecret(
+  sharedSecretPq,
+  sharedSecretT,
+  ciphertextT,
+  encapsulationKey,
+  config) {
+  // C2PRICombiner(ss_PQ, ss_T, ct_T, ek_T, Label).
+  // https://www.ietf.org/archive/id/draft-irtf-cfrg-hybrid-kems-12.html#section-5.1.3
+  const encapsulationKeyT = TypedArrayPrototypeSubarray(
+    encapsulationKey,
+    config.kemPqEncapsulationKeyLength);
+  const inputLength =
+    TypedArrayPrototypeGetByteLength(sharedSecretPq) +
+    TypedArrayPrototypeGetByteLength(sharedSecretT) +
+    TypedArrayPrototypeGetByteLength(ciphertextT) +
+    TypedArrayPrototypeGetByteLength(encapsulationKeyT) +
+    TypedArrayPrototypeGetByteLength(config.label);
+
+  const input = concatBytes([
+    sharedSecretPq,
+    sharedSecretT,
+    ciphertextT,
+    encapsulationKeyT,
+    config.label,
+  ], inputLength);
+
+  return copyBytes(hash('sha3-256', input, {
+    outputEncoding: 'buffer',
+  }));
+}
+
+/**
+ * Splits requested Hybrid KEM key usages into private and public key usages.
+ * @param {string} name
+ * @param {string[]} keyUsages
+ * @returns {{ privateUsages: Set<string>, publicUsages: Set<string> }}
+ */
+function getGenerateKeyUsages(name, keyUsages) {
+  const usageSet = validateKeyUsages(keyUsages, kUsages.keygen, name);
+  const usages = getKeyPairUsages(usageSet, kUsages);
+  validateUsagesNotEmpty(usages.private);
+
+  return {
+    __proto__: null,
+    privateUsages: usages.private,
+    publicUsages: usages.public,
+  };
+}
+
+/**
+ * Imports a Hybrid KEM JWK, validating public/private consistency when `priv`
+ * is present.
+ * @param {object} input
+ * @param {string} name
+ * @param {object} config
+ * @param {boolean} extractable
+ * @param {Set<string>} usagesSet
+ * @returns {InternalCryptoKey}
+ */
+function importJwkKey(input, name, config, extractable, usagesSet) {
+  const isPublic = input.priv === undefined;
+  verifyAcceptableKeyUse(
+    name,
+    usagesSet,
+    isPublic ? kUsages.public : kUsages.private);
+  validateJwk(input, 'AKP', extractable, usagesSet, 'enc');
+  if (input.alg !== name) {
+    throw lazyDOMException(
+      'JWK "alg" Parameter and algorithm name mismatch',
+      'DataError');
+  }
+
+  const rawEncapsulationKey = decodeJwkBase64Url(input.pub);
+  validateLength(rawEncapsulationKey, config.encapsulationKeyLength);
+  if (isPublic) {
+    return createPublicKeyFromRaw(
+      rawEncapsulationKey,
+      config,
+      extractable,
+      usagesSet);
+  }
+
+  const { privateKey } = deriveKeyPair(
+    decodeJwkBase64Url(input.priv),
+    config,
+    extractable,
+    usagesSet);
+  const { kemPqHandle, groupHandle } = getHybridKeyHandles(privateKey);
+  const derivedRawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  if (!bytesEqual(derivedRawEncapsulationKey, rawEncapsulationKey))
+    throw lazyDOMException('Invalid keyData', 'DataError');
+  return privateKey;
+}
+
+/**
+ * Exports a Hybrid KEM key as an AKP JWK.
+ * @param {CryptoKey} key
+ * @param {Uint8Array} rawEncapsulationKey
+ * @param {object} config
+ * @returns {object}
+ */
+function exportJwkKey(key, rawEncapsulationKey, config) {
+  const jwk = {
+    kty: 'AKP',
+    alg: config.name,
+    pub: base64urlEncode(rawEncapsulationKey),
+    key_ops: ArrayPrototypeSlice(getCryptoKeyUsages(key), 0),
+    ext: getCryptoKeyExtractable(key),
+  };
+  if (getCryptoKeyType(key) === 'private')
+    setOwnProperty(jwk, 'priv', base64urlEncode(getHybridSeed(key)));
+  return jwk;
+}
+
+/**
+ * Implements generateKey for Hybrid KEM algorithms.
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {{ publicKey: InternalCryptoKey, privateKey: InternalCryptoKey }}
+ */
+function kemHybridGenerateKey(algorithm, extractable, keyUsages) {
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const { privateUsages, publicUsages } =
+    getGenerateKeyUsages(name, keyUsages);
+
+  const keyPair = deriveKeyPair(
+    copyBytes(randomBytes(kSeedLength)),
+    config,
+    extractable,
+    privateUsages,
+    publicUsages);
+  return { publicKey: keyPair.publicKey, privateKey: keyPair.privateKey };
+}
+
+/**
+ * Implements importKey for Hybrid KEM algorithms.
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @param {ArrayBuffer | ArrayBufferView | object} input
+ * @param {object} algorithm
+ * @param {boolean} extractable
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey | undefined}
+ */
+function kemHybridImportKey(
+  format,
+  input,
+  algorithm,
+  extractable,
+  keyUsages) {
+
+  const { name } = algorithm;
+  const config = kAlgorithms[name];
+  const usagesSet = new SafeSet(keyUsages);
+
+  switch (format) {
+    case 'raw-public': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.public);
+      return createPublicKeyFromRaw(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet);
+    }
+    case 'raw-seed': {
+      verifyAcceptableKeyUse(name, usagesSet, kUsages.private);
+      return deriveKeyPair(
+        copyBytes(input),
+        config,
+        extractable,
+        usagesSet).privateKey;
+    }
+    case 'jwk':
+      return importJwkKey(input, name, config, extractable, usagesSet);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements exportKey for Hybrid KEM algorithms.
+ * @param {CryptoKey} key
+ * @param {'raw-public' | 'raw-seed' | 'jwk'} format
+ * @returns {ArrayBuffer | object | undefined}
+ */
+function kemHybridExportKey(key, format) {
+  const { config, kemPqHandle, groupHandle } = getHybridKeyContext(key);
+  const rawEncapsulationKey =
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config);
+  switch (format) {
+    case 'raw-public':
+      return toArrayBuffer(rawEncapsulationKey);
+    case 'raw-seed':
+      if (getCryptoKeyType(key) === 'private') {
+        return toArrayBuffer(getHybridSeed(key));
+      }
+      return undefined;
+    case 'jwk':
+      return exportJwkKey(key, rawEncapsulationKey, config);
+    default:
+      return undefined;
+  }
+}
+
+/**
+ * Implements getPublicKey for Hybrid KEM private keys.
+ * @param {CryptoKey} privateKey
+ * @param {string[]} keyUsages
+ * @returns {InternalCryptoKey}
+ */
+function kemHybridGetPublicKey(privateKey, keyUsages) {
+  const { config, kemPqHandle, groupHandle } =
+    getHybridKeyContext(privateKey);
+  const usageSet = new SafeSet(keyUsages);
+  verifyAcceptableKeyUse(config.name, usageSet, kUsages.public);
+  return createPublicKeyFromRaw(
+    rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+    config,
+    true,
+    usageSet);
+}
+
+/**
+ * Generates the ephemeral traditional group private key for encapsulation.
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function generateEphemeralGroupScalar(config) {
+  const seed = randomScalar(
+    copyBytes(randomBytes(config.groupSeedLength)),
+    config);
+  return importGroupPrivateHandle(seed, config);
+}
+
+/**
+ * Continues a WebCrypto job promise and routes synchronous continuation
+ * failures to the provided reject callback.
+ * @param {Promise} promise
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function continueJob(promise, reject, onFulfilled) {
+  jobPromiseThen(promise, (value) => {
+    try {
+      onFulfilled(value);
+    } catch (err) {
+      reject(err);
+    }
+  }, reject);
+}
+
+/**
+ * Continues a WebCrypto job promise and resolves with WebCrypto result
+ * shielding for object results.
+ * @param {Promise} promise
+ * @param {Function} resolve
+ * @param {Function} reject
+ * @param {Function} onFulfilled
+ */
+function resolveJob(promise, resolve, reject, onFulfilled) {
+  continueJob(promise, reject, (value) => {
+    resolveWebCryptoResult(resolve, onFulfilled(value));
+  });
+}
+
+/**
+ * Prepares the traditional group side of encapsulation and starts its derive job.
+ * @param {KeyObjectHandle} kemPqHandle
+ * @param {KeyObjectHandle} groupHandle
+ * @param {object} config
+ * @returns {object}
+ */
+function prepareEncapsulationGroup(kemPqHandle, groupHandle, config) {
+  const ephemeralGroupHandle = generateEphemeralGroupScalar(config);
+  const ciphertextT = rawGroupElement(ephemeralGroupHandle, config);
+  const sharedSecretT = deriveGroupBits(
+    groupHandle,
+    ephemeralGroupHandle);
+  return {
+    __proto__: null,
+    ciphertextT,
+    sharedSecretT,
+    rawEncapsulationKey:
+      rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+  };
+}
+
+/**
+ * Combines the PQ and traditional encapsulation outputs into WebCrypto's
+ * encapsulation result object.
+ * @param {object} encapsPq
+ * @param {Uint8Array} sharedSecretT
+ * @param {object} group
+ * @param {object} config
+ * @returns {{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }}
+ */
+function hybridEncapsulationResult(encapsPq, sharedSecretT, group, config) {
+  const sharedKey = combineSharedSecret(
+    copyBytes(encapsPq.sharedKey),
+    sharedSecretT,
+    group.ciphertextT,
+    group.rawEncapsulationKey,
+    config);
+  const ciphertext = concatBytes([
+    copyBytes(encapsPq.ciphertext),
+    group.ciphertextT,
+  ], config.ciphertextLength);
+
+  return {
+    sharedKey: toArrayBuffer(sharedKey),
+    ciphertext: toArrayBuffer(ciphertext),
+  };
+}
+
+/**
+ * Imports the traditional group ciphertext component as a public key handle.
+ * @param {Uint8Array} ciphertextT
+ * @param {object} config
+ * @returns {KeyObjectHandle}
+ */
+function importCiphertextGroupHandle(ciphertextT, config) {
+  try {
+    return importGroupElementHandle(ciphertextT, config);
+  } catch (err) {
+    throw operationFailure(err);
+  }
+}
+
+/**
+ * Implements encapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} encapsulationKey
+ * @returns {Promise<{ sharedKey: ArrayBuffer, ciphertext: ArrayBuffer }>}
+ */
+function kemHybridEncaps(encapsulationKey) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    encapsulationKey,
+    'public',
+    'Key must be a public key');
+  const encapsPq = jobPromise(() => new KEMEncapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(encapsPq, reject, (encapsPq) => {
+    const group = prepareEncapsulationGroup(
+      kemPqHandle,
+      groupHandle,
+      config);
+    resolveJob(group.sharedSecretT, resolve, reject, (sharedSecretT) =>
+      hybridEncapsulationResult(encapsPq, sharedSecretT, group, config));
+  });
+
+  return promise;
+}
+
+/**
+ * Implements decapsulateBits for Hybrid KEM algorithms.
+ * @param {CryptoKey} decapsulationKey
+ * @param {ArrayBuffer | ArrayBufferView} ciphertext
+ * @returns {Promise<ArrayBuffer>}
+ */
+function kemHybridDecaps(decapsulationKey, ciphertext) {
+  const { config, kemPqHandle, groupHandle } = requireHybridKeyContext(
+    decapsulationKey,
+    'private',
+    'Key must be a private key');
+  const { kemPq: ciphertextPq, group: ciphertextT } =
+    splitCiphertext(ciphertext, config);
+  const groupPublicHandle =
+    importCiphertextGroupHandle(ciphertextT, config);
+
+  const sharedSecretPq = jobPromise(() => new KEMDecapsulateJob(
+    kCryptoJobWebCrypto,
+    kemPqHandle,
+    undefined,
+    undefined,
+    undefined,
+    undefined,
+    ciphertextPq));
+  const {
+    promise,
+    resolve,
+    reject,
+  } = PromiseWithResolvers();
+
+  continueJob(sharedSecretPq, reject, (sharedSecretPq) => {
+    const sharedSecretT = deriveGroupBits(
+      groupPublicHandle,
+      groupHandle);
+    resolveJob(sharedSecretT, resolve, reject, (sharedSecretT) =>
+      toArrayBuffer(combineSharedSecret(
+        copyBytes(sharedSecretPq),
+        sharedSecretT,
+        ciphertextT,
+        rawEncapsulationKeyFromHandles(kemPqHandle, groupHandle, config),
+        config)));
+  });
+
+  return promise;
+}
+
+module.exports = {
+  kemHybridDecaps,
+  kemHybridEncaps,
+  kemHybridExportKey,
+  kemHybridGenerateKey,
+  kemHybridGetPublicKey,
+  kemHybridImportKey,
+};
diff --git a/lib/internal/crypto/keys.js b/lib/internal/crypto/keys.js
index 1623825b5273..2f6830efce17 100644
--- a/lib/internal/crypto/keys.js
+++ b/lib/internal/crypto/keys.js
@@ -91,6 +91,7 @@ const {
 } = require('internal/util');
 
 const { inspect } = require('internal/util/inspect');
+const { Buffer } = require('buffer');
 
 // Key input contexts.
 const kConsumePublic = 0;
@@ -202,6 +203,12 @@ const {
           key,
           'must be an extractable CryptoKey');
       }
+      if (getCryptoKeySecondaryHandle(key) !== undefined) {
+        throw new ERR_INVALID_ARG_VALUE(
+          'key',
+          key,
+          'cannot be represented by a single KeyObject');
+      }
       const handle = getCryptoKeyHandle(key);
       switch (getCryptoKeyType(key)) {
         /* eslint-disable no-use-before-define */
@@ -372,7 +379,7 @@ const {
   return [KeyObject, SecretKeyObject, PublicKeyObject, PrivateKeyObject];
 });
 
-function parseKeyFormat(formatStr, defaultFormat, optionName) {
+function parseKeyFormat(formatStr, defaultFormat, objName) {
   if (formatStr === undefined && defaultFormat !== undefined)
     return defaultFormat;
   else if (formatStr === 'pem')
@@ -387,10 +394,10 @@ function parseKeyFormat(formatStr, defaultFormat, optionName) {
     return kKeyFormatRawPrivate;
   else if (formatStr === 'raw-seed')
     return kKeyFormatRawSeed;
-  throw new ERR_INVALID_ARG_VALUE(optionName, formatStr);
+  throw new ERR_INVALID_ARG_VALUE(option('format', objName), formatStr);
 }
 
-function parseKeyType(typeStr, required, keyType, isPublic, optionName) {
+function parseKeyType(typeStr, required, keyType, isPublic, objName) {
   if (typeStr === undefined && !required) {
     return undefined;
   } else if (typeStr === 'pkcs1') {
@@ -411,7 +418,7 @@ function parseKeyType(typeStr, required, keyType, isPublic, optionName) {
     return kKeyEncodingSEC1;
   }
 
-  throw new ERR_INVALID_ARG_VALUE(optionName, typeStr);
+  throw new ERR_INVALID_ARG_VALUE(option('type', objName), typeStr);
 }
 
 function option(name, prefix) {
@@ -425,7 +432,7 @@ function parseKeyFormatAndType(enc, keyType, isPublic, objName) {
   const isInput = keyType === undefined;
   const format = parseKeyFormat(formatStr,
                                 isInput ? kKeyFormatPEM : undefined,
-                                option('format', objName));
+                                objName);
 
   if (format === kKeyFormatRawPublic) {
     if (isPublic === false) {
@@ -461,7 +468,7 @@ function parseKeyFormatAndType(enc, keyType, isPublic, objName) {
                             isRequired,
                             keyType,
                             isPublic,
-                            option('type', objName));
+                            objName);
   return { format, type };
 }
 
@@ -471,6 +478,10 @@ function isStringOrBuffer(val) {
          isAnyArrayBuffer(val);
 }
 
+function encodeKeyString(value, encoding) {
+  return Buffer.from(value, encoding === 'buffer' ? 'utf8' : encoding);
+}
+
 function parseKeyEncoding(enc, keyType, isPublic, objName) {
   validateObject(enc, 'options');
 
@@ -518,8 +529,8 @@ function parseKeyEncoding(enc, keyType, isPublic, objName) {
     }
   }
 
-  if (passphrase !== undefined)
-    passphrase = getArrayBufferOrView(passphrase, 'key.passphrase', encoding);
+  if (typeof passphrase === 'string')
+    passphrase = encodeKeyString(passphrase, encoding);
 
   return { format, type, cipher, passphrase };
 }
@@ -547,11 +558,11 @@ function validateAsymmetricKeyType(type, ctx, key) {
     );
   }
 
-  if (type !== 'private') {
+  if (type !== kKeyTypePrivate) {
     if (ctx === kConsumePrivate || ctx === kCreatePublic)
-      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(type, 'private');
-    if (type !== 'public') {
-      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(type,
+      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(keyObjectTypeToString(type), 'private');
+    if (type !== kKeyTypePublic) {
+      throw new ERR_CRYPTO_INVALID_KEY_OBJECT_TYPE(keyObjectTypeToString(type),
                                                    'private or public');
     }
   }
@@ -593,10 +604,9 @@ function prepareStorePrivateKey(url, name, passphrase, encoding, properties) {
     if (!isStringOrBuffer(passphrase)) {
       throw new ERR_INVALID_ARG_VALUE(option('passphrase', name), passphrase);
     }
-    passphrase = getArrayBufferOrView(
-      passphrase,
-      option('passphrase', name),
-      encoding);
+    if (typeof passphrase === 'string') {
+      passphrase = encodeKeyString(passphrase, encoding);
+    }
   }
 
   if (properties !== undefined) {
@@ -621,96 +631,113 @@ function prepareStorePrivateKey(url, name, passphrase, encoding, properties) {
 }
 
 function prepareAsymmetricKey(key, ctx, name = 'key') {
+  if (typeof key === 'string') {
+    return { format: kKeyFormatPEM, data: encodeKeyString(key) };
+  }
+  if (isArrayBufferView(key)) {
+    return { format: kKeyFormatPEM, data: key };
+  }
   const isPrivateKeyInput = ctx === kConsumePrivate || ctx === kCreatePrivate;
 
   if (isKeyObject(key)) {
     // Best case: A key object, as simple as that.
-    const type = getKeyObjectType(key);
-    validateAsymmetricKeyType(type, ctx, key);
-    return { data: getKeyObjectHandle(key) };
+    const slots = getKeyObjectSlots(key);
+    validateAsymmetricKeyType(slots[kKeyObjectSlotType], ctx, key);
+    return { data: slots[kKeyObjectSlotHandle] };
   }
   if (isPrivateKeyInput && isURLInstance(key)) {
     // A private key referenced by a URI for an OpenSSL STORE loader.
     return prepareStorePrivateKey(key, name);
   }
-  if (isStringOrBuffer(key)) {
-    // Expect PEM by default, mostly for backward compatibility.
-    return { format: kKeyFormatPEM, data: getArrayBufferOrView(key, name) };
+  if (isAnyArrayBuffer(key)) {
+    return { format: kKeyFormatPEM, data: key };
   }
   if (typeof key === 'object') {
-    const { key: data, encoding, format, properties } = key;
-
-    // The 'key' property can be a KeyObject as well to allow specifying
-    // additional options such as padding along with the key.
-    if (isKeyObject(data)) {
-      const type = getKeyObjectType(data);
-      validateAsymmetricKeyType(type, ctx, data);
-      return { data: getKeyObjectHandle(data) };
-    }
-    if (isPrivateKeyInput && isURLInstance(data)) {
-      // A private key referenced by a URI for an OpenSSL STORE loader, with
-      // an optional passphrase/PIN.
-      return prepareStorePrivateKey(
-        data,
-        name,
-        key.passphrase,
-        encoding,
-        properties);
-    }
-    if (format === 'jwk') {
-      validateObject(data, `${name}.key`);
-      return { data, format: kKeyFormatJWK };
-    } else if (format === 'raw-public' || format === 'raw-private' ||
+    return prepareAsymmetricKeyOptions(key, ctx, name, isPrivateKeyInput);
+  }
+
+  throw new ERR_INVALID_ARG_TYPE(
+    name,
+    getKeyTypes({
+      allowKeyObject: ctx !== kCreatePrivate,
+      allowURL: isPrivateKeyInput,
+    }),
+    key);
+}
+
+function prepareAsymmetricKeyOptions(key, ctx, name, isPrivateKeyInput) {
+  const { key: data, encoding, format, properties } = key;
+  let isData = typeof data === 'string' || isArrayBufferView(data);
+
+  // The 'key' property can be a KeyObject as well to allow specifying
+  // additional options such as padding along with the key.
+  if (!isData && isKeyObject(data)) {
+    const slots = getKeyObjectSlots(data);
+    validateAsymmetricKeyType(slots[kKeyObjectSlotType], ctx, data);
+    return { data: slots[kKeyObjectSlotHandle] };
+  }
+  isData ||= isAnyArrayBuffer(data);
+  if (!isData && isPrivateKeyInput && isURLInstance(data)) {
+    // A private key referenced by a URI for an OpenSSL STORE loader, with
+    // an optional passphrase/PIN.
+    return prepareStorePrivateKey(
+      data,
+      name,
+      key.passphrase,
+      encoding,
+      properties);
+  }
+  if (format === 'jwk') {
+    validateObject(data, `${name}.key`);
+    return { data, format: kKeyFormatJWK };
+  }
+  if (format === 'raw-public' || format === 'raw-private' ||
                format === 'raw-seed') {
-      if ((ctx === kConsumePrivate || ctx === kCreatePrivate) &&
-          format === 'raw-public') {
-        throw new ERR_INVALID_ARG_VALUE(`${name}.format`, format);
-      }
-      if (!isArrayBufferView(data) && !isAnyArrayBuffer(data)) {
-        throw new ERR_INVALID_ARG_TYPE(
-          `${name}.key`,
-          ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'],
-          data);
-      }
-      validateString(key.asymmetricKeyType, `${name}.asymmetricKeyType`);
-      if (key.asymmetricKeyType === 'ec') {
-        validateString(key.namedCurve, `${name}.namedCurve`);
-      }
-      const rawFormat = parseKeyFormat(format, undefined, `${name}.format`);
-      return {
-        data: getArrayBufferOrView(data, `${name}.key`),
-        format: rawFormat,
-        type: key.asymmetricKeyType,
-        namedCurve: key.namedCurve ?? null,
-      };
+    if (isPrivateKeyInput && format === 'raw-public') {
+      throw new ERR_INVALID_ARG_VALUE(`${name}.format`, format);
     }
-
-    // Either PEM or DER using PKCS#1 or SPKI.
-    if (!isStringOrBuffer(data)) {
+    if (!isData || typeof data === 'string') {
       throw new ERR_INVALID_ARG_TYPE(
         `${name}.key`,
-        getKeyTypes({
-          allowKeyObject: ctx !== kCreatePrivate,
-          allowURL: isPrivateKeyInput,
-        }),
+        ['ArrayBuffer', 'Buffer', 'TypedArray', 'DataView'],
         data);
     }
-
-    const isPublic =
-      (ctx === kConsumePrivate || ctx === kCreatePrivate) ? false : undefined;
+    validateString(key.asymmetricKeyType, `${name}.asymmetricKeyType`);
+    if (key.asymmetricKeyType === 'ec') {
+      validateString(key.namedCurve, `${name}.namedCurve`);
+    }
+    const rawFormat = format === 'raw-public' ? kKeyFormatRawPublic :
+      format === 'raw-private' ? kKeyFormatRawPrivate : kKeyFormatRawSeed;
     return {
-      data: getArrayBufferOrView(data, `${name}.key`, encoding),
-      ...parseKeyEncoding(key, undefined, isPublic, name),
+      data,
+      format: rawFormat,
+      type: key.asymmetricKeyType,
+      namedCurve: key.namedCurve ?? null,
     };
   }
 
-  throw new ERR_INVALID_ARG_TYPE(
-    name,
-    getKeyTypes({
-      allowKeyObject: ctx !== kCreatePrivate,
-      allowURL: isPrivateKeyInput,
-    }),
-    key);
+  // Either PEM or DER using PKCS#1 or SPKI.
+  if (!isData) {
+    throw new ERR_INVALID_ARG_TYPE(
+      `${name}.key`,
+      getKeyTypes({
+        allowKeyObject: ctx !== kCreatePrivate,
+        allowURL: isPrivateKeyInput,
+      }),
+      data);
+  }
+
+  const isPublic = isPrivateKeyInput ? false : undefined;
+  const keyData = typeof data === 'string' ?
+    encodeKeyString(data, encoding) : data;
+  const parsed = parseKeyEncoding(key, undefined, isPublic, name);
+  return {
+    data: keyData,
+    format: parsed.format,
+    type: parsed.type,
+    cipher: parsed.cipher,
+    passphrase: parsed.passphrase,
+  };
 }
 
 function preparePrivateKey(key, name) {
@@ -1045,7 +1072,9 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 
 // CryptoKey is a plain JS class whose prototype's [[Prototype]] is
 // Object.prototype, as Web Crypto requires. Instance storage (type enum,
-// extractable, algorithm, usages mask, and the KeyObject handle) lives
+// extractable, algorithm, usages mask, the primary KeyObject handle, an
+// optional Hybrid KEM-only secondary KeyObject handle, and optional Hybrid
+// KEM-only seed data) lives
 // on a C++ class, NativeCryptoKey, created by createCryptoKeyClass.
 // InternalCryptoKey is the only constructor we expose to internal
 // code; it extends NativeCryptoKey to get that storage and then has
@@ -1054,12 +1083,12 @@ function getKeyObjectAsymmetricKeyDetails(key) {
 //            -> CryptoKey.prototype
 //            -> Object.prototype
 //
-// Normal construction caches all five internal slots in a private class
+// Normal construction caches all native internal slots in a private class
 // field on `InternalCryptoKey`. Partially initialized transferred keys read
 // them from C++ in a single `getCryptoKeySlots` call on first access. The
 // cache is invisible to reflection (`Object.getOwnPropertySymbols` etc.) and
-// leaves each CryptoKey's hidden class pristine. The `getCryptoKey{Type,
-// Extractable,Algorithm,Usages,Handle}` helpers index into that
+// CryptoKey's hidden class pristine. The `getCryptoKey{Type,Extractable,
+// Algorithm,Usages,Handle,SecondaryHandle,SeedData}` helpers index into that
 // array and convert native enums/masks back to Web Crypto strings.
 // The internal algorithm object is stored as a null-prototype clone
 // so it cannot observe polluted Object.prototype properties.
@@ -1075,9 +1104,11 @@ const kSlotExtractable = 1;
 const kSlotAlgorithm = 2;
 const kSlotUsagesMask = 3;
 const kSlotHandle = 4;
-const kSlotClonedAlgorithm = 5;
-const kSlotClonedUsages = 6;
-const kSlotUsages = 7;
+const kSlotSecondaryHandle = 5;
+const kSlotSeedData = 6;
+const kSlotClonedAlgorithm = 7;
+const kSlotClonedUsages = 8;
+const kSlotUsages = 9;
 
 function cloneAlgorithm(raw) {
   const cloned = { ...raw };
@@ -1118,6 +1149,9 @@ const {
       if (depth < 0)
         return this;
 
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
+
       const opts = {
         ...options,
         depth: options.depth == null ? null : options.depth - 1,
@@ -1132,14 +1166,20 @@ const {
     }
 
     get type() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       return getCryptoKeyType(this);
     }
 
     get extractable() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       return getCryptoKeyExtractable(this);
     }
 
     get algorithm() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       const slots = getSlots(this);
       let cached = slots[kSlotClonedAlgorithm];
       if (cached === undefined) {
@@ -1150,6 +1190,8 @@ const {
     }
 
     get usages() {
+      if (!isCryptoKey(this))
+        throw new ERR_INVALID_THIS('CryptoKey');
       const slots = getSlots(this);
       let cached = slots[kSlotClonedUsages];
       if (cached === undefined) {
@@ -1163,10 +1205,24 @@ const {
   class InternalCryptoKey extends NativeCryptoKey {
     #slots;
 
-    constructor(handle, algorithm, usagesMask, extractable) {
+    constructor(
+      handle,
+      algorithm,
+      usagesMask,
+      extractable,
+      secondaryHandle,
+      seedData) {
       if (algorithm !== undefined)
         algorithm = cloneInternalAlgorithm(algorithm);
-      super(handle, algorithm, usagesMask, extractable);
+      if (seedData !== undefined)
+        seedData = new Uint8Array(seedData);
+      super(
+        handle,
+        algorithm,
+        usagesMask,
+        extractable,
+        secondaryHandle,
+        seedData);
       if (algorithm !== undefined) {
         this.#slots = [
           handle.getKeyType(),
@@ -1174,6 +1230,8 @@ const {
           algorithm,
           usagesMask,
           handle,
+          secondaryHandle,
+          seedData,
         ];
       }
     }
@@ -1184,14 +1242,12 @@ const {
         return #slots in key || isNativeCryptoKey(key);
       };
       getSlots = (key) => {
-        if (!key || typeof key !== 'object')
-          throw new ERR_INVALID_THIS('CryptoKey');
-        if (#slots in key) {
-          const cached = key.#slots;
-          if (cached !== undefined) return cached;
-        }
+        const cached = key.#slots;
+        if (cached !== undefined) return cached;
         const slots = nativeGetCryptoKeySlots(key);
         slots[kSlotAlgorithm] = cloneInternalAlgorithm(slots[kSlotAlgorithm]);
+        if (slots[kSlotSeedData] !== undefined)
+          slots[kSlotSeedData] = new Uint8Array(slots[kSlotSeedData]);
         key.#slots = slots;
         return slots;
       };
@@ -1312,6 +1368,25 @@ function getCryptoKeyHandle(key) {
   return getSlots(key)[kSlotHandle];
 }
 
+/**
+ * Returns the optional Hybrid KEM-only secondary KeyObjectHandle wrapping a
+ * CryptoKey's other underlying key material.
+ * @param {CryptoKey} key
+ * @returns {KeyObjectHandle | undefined}
+ */
+function getCryptoKeySecondaryHandle(key) {
+  return getSlots(key)[kSlotSecondaryHandle];
+}
+
+/**
+ * Returns the optional Hybrid KEM-only seed data stored with a CryptoKey.
+ * @param {CryptoKey} key
+ * @returns {Uint8Array | undefined}
+ */
+function getCryptoKeySeedData(key) {
+  return getSlots(key)[kSlotSeedData];
+}
+
 function importGenericSecretKey(
   algorithm,
   format,
@@ -1367,6 +1442,11 @@ module.exports = {
   parsePrivateKeyEncoding,
   parseKeyEncoding,
   toPublicCryptoKey,
+  prepareAsymmetricKey,
+  kConsumePublic,
+  kConsumePrivate,
+  kCreatePublic,
+  kCreatePrivate,
   preparePrivateKey,
   preparePublicOrPrivateKey,
   prepareSecretKey,
@@ -1387,5 +1467,7 @@ module.exports = {
   getCryptoKeyUsagesMask,
   hasCryptoKeyUsage,
   getCryptoKeyHandle,
+  getCryptoKeySecondaryHandle,
+  getCryptoKeySeedData,
   importGenericSecretKey,
 };
diff --git a/lib/internal/crypto/util.js b/lib/internal/crypto/util.js
index c408f26e5a9f..ca1d68b5127b 100644
--- a/lib/internal/crypto/util.js
+++ b/lib/internal/crypto/util.js
@@ -429,6 +429,30 @@ const kAlgorithmDefinitions = {
     'decapsulate': null,
     'get shared key length': null,
   },
+  'MLKEM768-P256': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM768-X25519': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
+  'MLKEM1024-P384': {
+    'generateKey': null,
+    'exportKey': null,
+    'importKey': null,
+    'encapsulate': null,
+    'decapsulate': null,
+    'get shared key length': null,
+  },
   'PBKDF2': {
     'importKey': null,
     'deriveBits': 'Pbkdf2Params',
@@ -499,6 +523,18 @@ const conditionalAlgorithms = {
   'ML-KEM-512': !!EVP_PKEY_ML_KEM_512,
   'ML-KEM-768': !!EVP_PKEY_ML_KEM_768,
   'ML-KEM-1024': !!EVP_PKEY_ML_KEM_1024,
+  'MLKEM768-P256': !isFips && !!EVP_PKEY_ML_KEM_768 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM768-X25519': !isFips && !!EVP_PKEY_ML_KEM_768 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
+  'MLKEM1024-P384': !isFips && !!EVP_PKEY_ML_KEM_1024 &&
+    (!process.features.openssl_is_boringssl ||
+      (ArrayPrototypeIncludes(getHashes(), 'sha3-256') &&
+       ArrayPrototypeIncludes(getHashes(), 'shake256'))),
   'SHA3-256': !process.features.openssl_is_boringssl ||
     ArrayPrototypeIncludes(getHashes(), 'sha3-256'),
   'SHA3-384': !process.features.openssl_is_boringssl ||
@@ -528,6 +564,9 @@ const experimentalAlgorithms = [
   'ML-KEM-512',
   'ML-KEM-768',
   'ML-KEM-1024',
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
   'SHA3-256',
   'SHA3-384',
   'SHA3-512',
@@ -1173,6 +1212,7 @@ module.exports = {
   cleanupWebCryptoResult,
   prepareWebCryptoResult,
   validateKmacKeyLength,
+  resolveWebCryptoResult,
   validateMaxBufferLength,
   numBitsToBytes,
   truncateToBitLength,
diff --git a/lib/internal/crypto/webcrypto.js b/lib/internal/crypto/webcrypto.js
index f8a1ef8d00e7..e61ff3d47dd4 100644
--- a/lib/internal/crypto/webcrypto.js
+++ b/lib/internal/crypto/webcrypto.js
@@ -239,6 +239,13 @@ function generateKeyImpl(
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemGenerateKey(normalizedAlgorithm, extractable, usages);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGenerateKey(normalizedAlgorithm, extractable, usages);
     case 'KMAC128':
       // Fall through
     case 'KMAC256':
@@ -355,6 +362,12 @@ function getSharedKeyLength({ name }) {
     case 'ML-KEM-768':
       // Fall through
     case 'ML-KEM-1024':
+      // Fall through
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
       return 256;
     /* c8 ignore start */
     default: {
@@ -617,6 +630,17 @@ function exportKeyRawPublic(key, format) {
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
     }
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384': {
+      if (format !== 'raw-public') {
+        return undefined;
+      }
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, format);
+    }
     default:
       return undefined;
   }
@@ -638,6 +662,13 @@ function exportKeyRawSeed(key) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemExportKey(key, kWebCryptoKeyFormatRaw);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'raw-seed');
     default:
       return undefined;
   }
@@ -713,6 +744,13 @@ function exportKeyJWK(key) {
       // Fall through
     case 'ML-KEM-1024':
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridExportKey(key, 'jwk');
     case 'Ed25519':
       // Fall through
     case 'Ed448':
@@ -1032,6 +1070,14 @@ function importKeySync(format, keyData, algorithm, extractable, usages) {
           extractable,
           usages);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      result = require('internal/crypto/kem_hybrids')
+        .kemHybridImportKey(format, keyData, algorithm, extractable, usages);
+      break;
   }
 
   if (!result) {
@@ -1412,6 +1458,14 @@ function getPublicKeyImpl(key, keyUsages) {
     throw lazyDOMException('key must be a private key',
                            type === 'secret' ? 'NotSupportedError' : 'InvalidAccessError');
 
+  switch (getCryptoKeyAlgorithm(key).name) {
+    case 'MLKEM768-P256':
+    case 'MLKEM768-X25519':
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridGetPublicKey(key, usages);
+  }
+
   return toPublicCryptoKey(key, usages);
 }
 
@@ -1451,6 +1505,13 @@ function encapsulateBitsImpl(encapsulationAlgorithm, encapsulationKey) {
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1515,6 +1576,14 @@ function encapsulateKeyImpl(
       encapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemEncapsulate(encapsulationKey);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      encapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridEncaps(encapsulationKey);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1578,6 +1647,13 @@ function decapsulateBitsImpl(decapsulationAlgorithm, decapsulationKey, ciphertex
     case 'ML-KEM-1024':
       return require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      return require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
@@ -1645,6 +1721,14 @@ function decapsulateKeyImpl(
       decapsulatedBits = require('internal/crypto/ml_kem')
         .mlKemDecapsulate(decapsulationKey, ciphertext);
       break;
+    case 'MLKEM768-P256':
+      // Fall through
+    case 'MLKEM768-X25519':
+      // Fall through
+    case 'MLKEM1024-P384':
+      decapsulatedBits = require('internal/crypto/kem_hybrids')
+        .kemHybridDecaps(decapsulationKey, ciphertext);
+      break;
     /* c8 ignore start */
     default: {
       const assert = require('internal/assert');
diff --git a/lib/internal/crypto/webidl.js b/lib/internal/crypto/webidl.js
index 7f73d1bd66de..5ea062dcaf7f 100644
--- a/lib/internal/crypto/webidl.js
+++ b/lib/internal/crypto/webidl.js
@@ -15,12 +15,13 @@ const {
   lazyDOMException,
 } = require('internal/util');
 const {
+  isInt32,
   isUint32,
 } = require('internal/validators');
-const { CryptoKey } = require('internal/crypto/webcrypto');
 const {
   getCryptoKeyAlgorithm,
   getCryptoKeyType,
+  isCryptoKey,
 } = require('internal/crypto/keys');
 const {
   bigIntArrayToUnsignedInt,
@@ -489,6 +490,11 @@ converters.Pbkdf2Params = createDictionaryConverter(
         validator: (V, dict) => {
           if (V === 0)
             throw lazyDOMException('iterations cannot be zero', 'OperationError');
+          if (!isInt32(V)) {
+            throw lazyDOMException(
+              'iterations exceeds the implementation limit',
+              'NotSupportedError');
+          }
         },
         required: true,
       },
@@ -618,7 +624,7 @@ converters.AesCtrParams = createDictionaryConverter(
   ]);
 
 converters.CryptoKey = createInterfaceConverter(
-  'CryptoKey', CryptoKey.prototype);
+  'CryptoKey', isCryptoKey);
 
 converters.EcdhKeyDeriveParams = createDictionaryConverter(
   'EcdhKeyDeriveParams', [
diff --git a/lib/internal/error_serdes.js b/lib/internal/error_serdes.js
index efe75192d9f5..d473da06fd49 100644
--- a/lib/internal/error_serdes.js
+++ b/lib/internal/error_serdes.js
@@ -1,6 +1,7 @@
 'use strict';
 
 const {
+  AggregateError,
   ArrayPrototypeForEach,
   Error,
   EvalError,
@@ -41,7 +42,14 @@ const kCircularReference = 5;
 const kSymbolStringLength = 'Symbol('.length;
 
 const errors = {
-  Error, TypeError, RangeError, URIError, SyntaxError, ReferenceError, EvalError,
+  AggregateError,
+  Error,
+  EvalError,
+  RangeError,
+  ReferenceError,
+  SyntaxError,
+  TypeError,
+  URIError,
 };
 const errorConstructorNames = new SafeSet(ObjectKeys(errors));
 
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index 221a40ecdf86..5202737453b3 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1035,11 +1035,16 @@ function determineSpecificType(value) {
       return `type symbol (${String(value)})`;
     case 'function':
       return `function ${value.name}`;
-    case 'object':
-      if (value.constructor && 'name' in value.constructor) {
-        return `an instance of ${value.constructor.name}`;
+    case 'object': {
+      // `constructor` may be user-controlled: it need not be an object, and
+      // its `name` need not be a non-empty string. Reading either can invoke
+      // an accessor, so read each one once.
+      const name = value.constructor?.name;
+      if (typeof name === 'string' && name !== '') {
+        return `an instance of ${name}`;
       }
       return `${lazyInternalUtilInspect().inspect(value, { depth: -1 })}`;
+    }
     case 'string':
       value.length > 28 && (value = `${StringPrototypeSlice(value, 0, 25)}...`);
       if (StringPrototypeIndexOf(value, "'") === -1) {
diff --git a/lib/internal/freeze_intrinsics.js b/lib/internal/freeze_intrinsics.js
index 05437199726c..5dd425cb0934 100644
--- a/lib/internal/freeze_intrinsics.js
+++ b/lib/internal/freeze_intrinsics.js
@@ -54,6 +54,8 @@ const {
   EvalErrorPrototype,
   FinalizationRegistry,
   FinalizationRegistryPrototype,
+  Float16Array,
+  Float16ArrayPrototype,
   Float32Array,
   Float32ArrayPrototype,
   Float64Array,
@@ -196,6 +198,7 @@ module.exports = function() {
     Uint16ArrayPrototype,
     Int32ArrayPrototype,
     Uint32ArrayPrototype,
+    Float16ArrayPrototype,
     Float32ArrayPrototype,
     Float64ArrayPrototype,
     BigInt64ArrayPrototype,
@@ -296,6 +299,7 @@ module.exports = function() {
     Uint16Array,
     Int32Array,
     Uint32Array,
+    Float16Array,
     Float32Array,
     Float64Array,
     BigInt64Array,
diff --git a/lib/internal/fs/cp/cp.js b/lib/internal/fs/cp/cp.js
index 35fcefb12d10..1ec5a2d89cac 100644
--- a/lib/internal/fs/cp/cp.js
+++ b/lib/internal/fs/cp/cp.js
@@ -6,6 +6,8 @@ const {
   ArrayPrototypeEvery,
   ArrayPrototypeFilter,
   Boolean,
+  ErrorCaptureStackTrace,
+  Promise,
   PromisePrototypeThen,
   PromiseReject,
   SafePromiseAll,
@@ -55,6 +57,7 @@ const {
   sep,
 } = require('path');
 const fsBinding = internalBinding('fs');
+const permission = require('internal/process/permission');
 
 async function cpFn(src, dest, opts) {
   // Warn about using preserveTimestamps on 32-bit node
@@ -211,30 +214,19 @@ async function getStatsForCopy(destStat, src, dest, opts) {
     return onFile(srcStat, destStat, src, dest, opts);
   } else if (srcStat.isSymbolicLink()) {
     return onLink(destStat, src, dest, opts);
-  } else if (srcStat.isSocket()) {
-    throw new ERR_FS_CP_SOCKET({
-      message: `cannot copy a socket file: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
-  } else if (srcStat.isFIFO()) {
-    throw new ERR_FS_CP_FIFO_PIPE({
-      message: `cannot copy a FIFO pipe: ${dest}`,
-      path: dest,
-      syscall: 'cp',
-      errno: EINVAL,
-      code: 'EINVAL',
-    });
   }
-  throw new ERR_FS_CP_UNKNOWN({
-    message: `cannot copy an unknown file type: ${dest}`,
-    path: dest,
-    syscall: 'cp',
-    errno: EINVAL,
-    code: 'EINVAL',
-  });
+  throw errorForSpecialFile(srcStat.isSocket() ? 'socket' : srcStat.isFIFO() ? 'fifo' : 'unknown', dest);
+}
+
+function errorForSpecialFile(kind, dest) {
+  const info = { path: dest, syscall: 'cp', errno: EINVAL, code: 'EINVAL' };
+  if (kind === 'socket') {
+    return new ERR_FS_CP_SOCKET({ message: `cannot copy a socket file: ${dest}`, ...info });
+  }
+  if (kind === 'fifo') {
+    return new ERR_FS_CP_FIFO_PIPE({ message: `cannot copy a FIFO pipe: ${dest}`, ...info });
+  }
+  return new ERR_FS_CP_UNKNOWN({ message: `cannot copy an unknown file type: ${dest}`, ...info });
 }
 
 function onFile(srcStat, destStat, src, dest, opts) {
@@ -318,6 +310,15 @@ async function onDir(srcStat, destStat, src, dest, opts) {
 }
 
 async function mkDirAndCopy(srcMode, src, dest, opts) {
+  // A destination directory that does not exist yet is filled in one thread
+  // pool request by the walk fs.cpSync() uses, unless a filter has to run per
+  // entry, links inside the tree must be dereferenced, or the permission model
+  // has to check each path. Copying into an existing tree keeps the per-entry
+  // walk below and its rules for what may already be there.
+  if (!opts.filter && !opts.dereference && !permission.isEnabled()) {
+    // Creates dest itself, with the mode of src.
+    return copyDirNative(src, dest, opts);
+  }
   await mkdir(dest);
   await copyDir(src, dest, opts);
   if (opts.preserveTimestamps) {
@@ -326,6 +327,27 @@ async function mkDirAndCopy(srcMode, src, dest, opts) {
   return setDestMode(dest, srcMode);
 }
 
+function copyDirNative(src, dest, opts) {
+  return new Promise((resolve, reject) => {
+    const job = new fsBinding.CpDirJob(src, dest, opts.force, opts.dereference, opts.errorOnExist,
+                                       opts.verbatimSymlinks, opts.preserveTimestamps, opts.mode);
+    // Sockets, FIFOs and unknown entries come back as (kind, path) so that
+    // they reject with the same errors as the walk above.
+    job.ondone = (err, specialFile, specialFilePath) => {
+      if (specialFile !== undefined) {
+        err = errorForSpecialFile(specialFile, specialFilePath);
+      }
+      if (err != null) {
+        ErrorCaptureStackTrace(err, copyDirNative);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    job.run();
+  });
+}
+
 async function copyDir(src, dest, opts) {
   const dir = await opendir(src);
 
diff --git a/lib/internal/fs/glob.js b/lib/internal/fs/glob.js
index a949303b58bd..b5949c471813 100644
--- a/lib/internal/fs/glob.js
+++ b/lib/internal/fs/glob.js
@@ -664,7 +664,10 @@ class Glob {
         // consistent comparison before instantiating matchers.
         const matchers = exclude
           .map((pattern) => resolve(this.#root, pattern))
-          .map((pattern) => createMatcher(pattern));
+          // Exclude matching is a pure string comparison with no filesystem
+          // lookups, so unlike include patterns, literal patterns must also
+          // match case-insensitively on case-insensitive platforms.
+          .map((pattern) => createMatcher(pattern, { nocaseMagicOnly: false }));
         this.#isExcluded = (value) =>
           matchers.some((matcher) => matcher.match(value));
         this.#results.setup(this.#root, this.#isExcluded);
diff --git a/lib/internal/fs/promises.js b/lib/internal/fs/promises.js
index a9d03ebb1d18..bb54d2fc596e 100644
--- a/lib/internal/fs/promises.js
+++ b/lib/internal/fs/promises.js
@@ -1,7 +1,6 @@
 'use strict';
 
 const {
-  ArrayPrototypePop,
   ArrayPrototypePush,
   Error,
   ErrorCaptureStackTrace,
@@ -16,6 +15,7 @@ const {
   SafeArrayIterator,
   SafePromisePrototypeFinally,
   SafePromiseRace,
+  SafeSet,
   Symbol,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
@@ -32,9 +32,6 @@ const {
   O_WRONLY,
   S_IFMT,
   S_IFREG,
-  UV_DIRENT_DIR,
-  UV_DIRENT_LINK,
-  UV_DIRENT_UNKNOWN,
 } = constants;
 
 const binding = internalBinding('fs');
@@ -65,9 +62,10 @@ const {
     kReadFileUnknownBufferLength,
     kWriteFileMaxChunkSize,
   },
+  collectRecursiveReaddirResult,
   copyObject,
-  getDirent,
   getDirents,
+  getRecursiveDirents,
   getOptions,
   getStatFsFromBinding,
   getStatsFromBinding,
@@ -164,8 +162,9 @@ const lazyReadableStream = getLazy(() =>
 let newStreamsPull;
 let newStreamsPullSync;
 let newStreamsParsePullArgs;
-let newStreamsToUint8Array;
+let newStreamsToWriterUint8Array;
 let newStreamsConvertChunks;
+let newStreamsGetWriterSignal;
 function lazyNewStreams() {
   if (newStreamsPull === undefined) {
     const pullModule = require('internal/streams/iter/pull');
@@ -173,8 +172,9 @@ function lazyNewStreams() {
     newStreamsPullSync = pullModule.pullSync;
     const utils = require('internal/streams/iter/utils');
     newStreamsParsePullArgs = utils.parsePullArgs;
-    newStreamsToUint8Array = utils.toUint8Array;
+    newStreamsToWriterUint8Array = utils.toWriterUint8Array;
     newStreamsConvertChunks = utils.convertChunks;
+    newStreamsGetWriterSignal = utils.getWriterSignal;
   }
 }
 
@@ -538,9 +538,7 @@ if (getOptionValue('--experimental-stream-iter')) {
             // Signal-aware path
             while (remaining !== 0) {
               if (signal.aborted) {
-                throw signal.reason ??
-                      lazyDOMException('The operation was aborted',
-                                       'AbortError');
+                throw signal.reason;
               }
               const toRead = remaining > 0 ?
                 MathMin(readSize, remaining) : readSize;
@@ -746,9 +744,13 @@ if (getOptionValue('--experimental-stream-iter')) {
     let totalBytesWritten = 0;
     let closed = false;
     let closing = false;
-    let pendingEndPromise = null;
-    let error = null;
-    let asyncPending = false;
+    let pendingEnd = null;
+    let endingCleanup = false;
+    let errored = false;
+    let error;
+    let asyncPending = 0;
+    let released = false;
+    const pendingWrites = new SafeSet();
 
     validateBoolean(autoClose, 'options.autoClose');
 
@@ -767,85 +769,124 @@ if (getOptionValue('--experimental-stream-iter')) {
 
     // Write a single buffer with EAGAIN retry (up to 5 retries).
     async function writeAll(buf, offset, length, position, signal) {
-      asyncPending = true;
-      try {
-        let retries = 0;
-        while (length > 0) {
-          const bytesWritten = (await PromisePrototypeThen(
-            binding.writeBuffer(fd, buf, offset, length, position,
-                                kUsePromises),
-            undefined,
-            handleErrorFromBinding,
-          )) || 0;
-
-          signal?.throwIfAborted();
-
-          if (bytesWritten === 0) {
-            if (++retries > 5) {
-              throw new ERR_OPERATION_FAILED('write failed after retries');
-            }
-          } else {
-            retries = 0;
-          }
+      let retries = 0;
+      while (length > 0) {
+        const bytesWritten = (await PromisePrototypeThen(
+          binding.writeBuffer(fd, buf, offset, length, position,
+                              kUsePromises),
+          undefined,
+          handleErrorFromBinding,
+        )) || 0;
+
+        signal?.throwIfAborted();
 
-          totalBytesWritten += bytesWritten;
-          offset += bytesWritten;
-          length -= bytesWritten;
-          if (position >= 0) position += bytesWritten;
+        if (bytesWritten === 0) {
+          if (++retries > 5) {
+            throw new ERR_OPERATION_FAILED('write failed after retries');
+          }
+        } else {
+          retries = 0;
         }
-      } finally {
-        asyncPending = false;
+
+        totalBytesWritten += bytesWritten;
+        offset += bytesWritten;
+        length -= bytesWritten;
+        if (position >= 0) position += bytesWritten;
       }
     }
 
     // Writev with EAGAIN retry. On partial write, concatenates remaining
     // buffers and falls back to writeAll (same approach as WriteStream).
     async function writevAll(buffers, position, signal) {
-      asyncPending = true;
-      try {
-        let totalSize = 0;
-        for (let i = 0; i < buffers.length; i++) {
-          totalSize += buffers[i].byteLength;
-        }
+      let totalSize = 0;
+      for (let i = 0; i < buffers.length; i++) {
+        totalSize += buffers[i].byteLength;
+      }
 
-        let retries = 0;
-        while (totalSize > 0) {
-          const bytesWritten = (await PromisePrototypeThen(
-            binding.writeBuffers(fd, buffers, position, kUsePromises),
-            undefined,
-            handleErrorFromBinding,
-          )) || 0;
+      let retries = 0;
+      while (totalSize > 0) {
+        const bytesWritten = (await PromisePrototypeThen(
+          binding.writeBuffers(fd, buffers, position, kUsePromises),
+          undefined,
+          handleErrorFromBinding,
+        )) || 0;
 
-          signal?.throwIfAborted();
+        signal?.throwIfAborted();
 
-          if (bytesWritten === 0) {
-            if (++retries > 5) {
-              throw new ERR_OPERATION_FAILED('writev failed after retries');
-            }
-          } else {
-            retries = 0;
+        if (bytesWritten === 0) {
+          if (++retries > 5) {
+            throw new ERR_OPERATION_FAILED('writev failed after retries');
           }
+        } else {
+          retries = 0;
+        }
 
-          totalBytesWritten += bytesWritten;
-          totalSize -= bytesWritten;
-          if (position >= 0) position += bytesWritten;
-
-          if (totalSize > 0) {
-            // Partial write - concatenate remaining and use writeAll.
-            const remaining = Buffer.concat(buffers);
-            const wrote = bytesWritten;
-            // writeAll is already inside asyncPending = true, but
-            // writeAll sets it again - that's fine (idempotent).
-            await writeAll(remaining, wrote, remaining.length - wrote,
-                           position, signal);
-            return;
-          }
+        totalBytesWritten += bytesWritten;
+        totalSize -= bytesWritten;
+        if (position >= 0) position += bytesWritten;
+
+        if (totalSize > 0) {
+          // Partial write - concatenate remaining and use writeAll.
+          const remaining = Buffer.concat(buffers);
+          const wrote = bytesWritten;
+          await writeAll(remaining, wrote, remaining.length - wrote,
+                         position, signal);
+          return;
         }
-      } finally {
-        asyncPending = false;
       }
     }
 
+    function releaseAfterFailure() {
+      if (!errored || asyncPending !== 0 || released) return;
+      released = true;
+      handle[kLocked] = false;
+      handle[kUnref]();
+      if (autoClose) {
+        handle[kCloseSync]();
+      }
+    }
+
+    function finishEnd() {
+      if (!closing || errored || asyncPending !== 0 || endingCleanup) return;
+      endingCleanup = true;
+      PromisePrototypeThen(cleanup(), () => {
+        endingCleanup = false;
+        if (errored) return;
+        closing = false;
+        closed = true;
+        pendingEnd.resolve(totalBytesWritten);
+        pendingEnd = null;
+      }, (error) => {
+        endingCleanup = false;
+        if (errored) return;
+        closing = false;
+        closed = true;
+        pendingEnd.reject(error);
+        pendingEnd = null;
+      });
+    }
+
+    function trackOperation(operation) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      const pending = { __proto__: null, reject };
+      pendingWrites.add(pending);
+      asyncPending++;
+      PromisePrototypeThen(operation, (value) => {
+        const active = pendingWrites.delete(pending);
+        asyncPending--;
+        releaseAfterFailure();
+        if (active) resolve(value);
+        finishEnd();
+      }, (error) => {
+        const active = pendingWrites.delete(pending);
+        asyncPending--;
+        releaseAfterFailure();
+        if (active) reject(error);
+        finishEnd();
+      });
+      return promise;
+    }
+
     // Synchronous write with EAGAIN retry. Throws on I/O error.
     // Used by writeSync for the full write, and by writevSync for
     // completing a partial writev.
@@ -873,8 +914,8 @@ if (getOptionValue('--experimental-stream-iter')) {
     }
 
     async function cleanup() {
-      if (closed) return;
-      closed = true;
+      if (released) return;
+      released = true;
       handle[kLocked] = false;
       handle[kUnref]();
       if (autoClose) {
@@ -885,24 +926,22 @@ if (getOptionValue('--experimental-stream-iter')) {
     return {
       __proto__: null,
       write(chunk, options = kNullPrototo) {
-        if (error) {
+        chunk = newStreamsToWriterUint8Array(chunk);
+        const signal = newStreamsGetWriterSignal(options);
+        if (errored) {
           return PromiseReject(error);
         }
         if (closed) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (closing) {
+          return PromiseReject(
+            new ERR_INVALID_STATE.TypeError('The writer is closing'));
+        }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunk = newStreamsToUint8Array(chunk);
         if (bytesRemaining >= 0 && chunk.byteLength > bytesRemaining) {
           return PromiseReject(
             new ERR_OUT_OF_RANGE('write', `<= ${bytesRemaining} bytes`,
@@ -911,28 +950,27 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (bytesRemaining > 0) bytesRemaining -= chunk.byteLength;
         const position = pos;
         if (pos >= 0) pos += chunk.byteLength;
-        return writeAll(chunk, 0, chunk.byteLength, position, signal);
+        return trackOperation(
+          writeAll(chunk, 0, chunk.byteLength, position, signal));
       },
 
       writev(chunks, options = kNullPrototo) {
-        if (error) {
+        chunks = newStreamsConvertChunks(chunks);
+        const signal = newStreamsGetWriterSignal(options);
+        if (errored) {
           return PromiseReject(error);
         }
         if (closed) {
           return PromiseReject(
             new ERR_INVALID_STATE.TypeError('The writer is closed'));
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal?.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (closing) {
+          return PromiseReject(
+            new ERR_INVALID_STATE.TypeError('The writer is closing'));
+        }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
-        chunks = newStreamsConvertChunks(chunks);
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -945,12 +983,12 @@ if (getOptionValue('--experimental-stream-iter')) {
         if (bytesRemaining > 0) bytesRemaining -= totalSize;
         const position = pos;
         if (pos >= 0) pos += totalSize;
-        return writevAll(chunks, position, signal);
+        return trackOperation(writevAll(chunks, position, signal));
       },
 
       writeSync(chunk) {
-        if (error || closed || asyncPending) return false;
-        chunk = newStreamsToUint8Array(chunk);
+        chunk = newStreamsToWriterUint8Array(chunk);
+        if (errored || closed || closing || asyncPending) return false;
         const length = chunk.byteLength;
         if (length > syncWriteThreshold) return false;
         if (length === 0) return true;
@@ -980,8 +1018,8 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       writevSync(chunks) {
-        if (error || closed || asyncPending) return false;
         chunks = newStreamsConvertChunks(chunks);
+        if (errored || closed || closing || asyncPending) return false;
         let totalSize = 0;
         for (let i = 0; i < chunks.length; i++) {
           totalSize += chunks[i].byteLength;
@@ -1016,36 +1054,32 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       end(options = kNullPrototo) {
-        if (error) {
+        const signal = newStreamsGetWriterSignal(options);
+        if (errored) {
           return PromiseReject(error);
         }
         if (closed) {
           return PromiseResolve(totalBytesWritten);
         }
         if (closing) {
-          return pendingEndPromise;
+          return pendingEnd.promise;
         }
-        validateObject(options, 'options');
-        const {
-          signal,
-        } = options;
-        if (signal !== undefined) {
-          validateAbortSignal(signal, 'options.signal');
-          if (signal.aborted) {
-            return PromiseReject(signal.reason);
-          }
+        if (signal?.aborted) {
+          return PromiseReject(signal.reason);
         }
         closing = true;
-        pendingEndPromise = PromisePrototypeThen(
-          cleanup(), () => totalBytesWritten);
-        return pendingEndPromise;
+        pendingEnd = PromiseWithResolvers();
+        finishEnd();
+        return pendingEnd.promise;
       },
 
       endSync() {
-        if (error) return -1;
+        if (errored) return -1;
         if (closed) return totalBytesWritten;
+        if (closing) return -1;
         if (asyncPending) return -1;
         closed = true;
+        released = true;
         handle[kLocked] = false;
         handle[kUnref]();
         if (autoClose) {
@@ -1055,21 +1089,25 @@ if (getOptionValue('--experimental-stream-iter')) {
       },
 
       fail(reason) {
-        if (closed || error) return;
-        error = reason ?? new ERR_INVALID_STATE('Failed');
+        if (closed || errored) return;
+        errored = true;
+        error = reason;
+        closing = false;
         closed = true;
-        handle[kLocked] = false;
-        handle[kUnref]();
-        if (autoClose) {
-          handle[kCloseSync]();
+        pendingEnd?.reject(reason);
+        pendingEnd = null;
+        for (const pending of pendingWrites) {
+          pending.reject(reason);
         }
+        pendingWrites.clear();
+        releaseAfterFailure();
       },
 
       [SymbolAsyncDispose]() {
         if (closing) {
-          return pendingEndPromise ?? PromiseResolve();
+          return pendingEnd?.promise ?? PromiseResolve();
         }
-        if (!closed && !error) {
+        if (!closed && !errored) {
           this.fail();
         }
         return PromiseResolve();
@@ -1648,42 +1686,42 @@ async function mkdir(path, options) {
 }
 
 async function readdirRecursive(originalPath, options) {
+  if (permission.isEnabled()) {
+    return readdirRecursiveWithPermissionModel(originalPath, options);
+  }
   const withFileTypes = !!options.withFileTypes;
-  const readdirWithTypes = (path) => PromisePrototypeThen(
-    binding.readdir(path, options.encoding, true, kUsePromises),
+  const result = await PromisePrototypeThen(
+    binding.readdirRecursive(
+      originalPath,
+      options.encoding,
+      withFileTypes,
+      kUsePromises,
+    ),
     undefined,
     handleErrorFromBinding,
   );
-  const result = [];
-  const queue = [[originalPath, '', await readdirWithTypes(originalPath)]];
-
-  while (queue.length > 0) {
-    // If we want to implement BFS make this a `shift` call instead of `pop`
-    const { 0: path, 1: prefix, 2: { 0: names, 1: types } } = ArrayPrototypePop(queue);
-    for (let i = 0; i < names.length; i++) {
-      const name = names[i];
-      const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
-      let isDirectory;
-      if (withFileTypes) {
-        const dirent = getDirent(path, name, types[i]);
-        ArrayPrototypePush(result, dirent);
-        isDirectory = dirent.isDirectory();
-      } else {
-        ArrayPrototypePush(result, relative);
-        // Entries that are, or may be, symbolic links to directories are followed.
-        const type = types[i];
-        isDirectory = type === UV_DIRENT_DIR ||
-          ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
-           binding.internalModuleStat(pathModule.join(path, name)) === 1);
-      }
-      if (isDirectory) {
-        const direntPath = pathModule.join(path, name);
-        ArrayPrototypePush(queue, [direntPath, relative, await readdirWithTypes(direntPath)]);
-      }
-    }
-  }
+  return withFileTypes ? getRecursiveDirents(originalPath, result) : result;
+}
 
-  return result;
+// TODO: native?
+async function readdirRecursiveWithPermissionModel(basePath, options) {
+  const { encoding } = options;
+  const context = {
+    withFileTypes: !!options.withFileTypes,
+    results: [],
+    dirs: [basePath],
+    prefixes: [''],
+  };
+  for (let i = 0; i < context.dirs.length; i++) {
+    const dir = context.dirs[i];
+    const result = await PromisePrototypeThen(
+      binding.readdir(dir, encoding, true, kUsePromises),
+      undefined,
+      handleErrorFromBinding,
+    );
+    collectRecursiveReaddirResult(dir, context.prefixes[i], result, context);
+  }
+  return context.results;
 }
 
 async function readdir(path, options) {
@@ -1751,7 +1789,8 @@ async function symlink(target, path, type) {
   // Due to the nature of Node.js runtime, symlinks has different edge cases that can bypass
   // the permission model security guarantees. Thus, this API is disabled unless fs.read
   // and fs.write permission has been given.
-  if (permission.isEnabled() && !permission.has('fs')) {
+  if (permission.isEnabled() && !permission.has('fs') &&
+      !permission.isAuditMode()) {
     throw new ERR_ACCESS_DENIED('fs.symlink API requires full fs.read and fs.write permissions.');
   }
 
@@ -1796,7 +1835,8 @@ async function lstat(path, options = { __proto__: null, bigint: false }) {
     if (promise !== undefined) return await promise;
   }
   path = getValidatedPath(path);
-  if (permission.isEnabled() && !permission.has('fs.read', path)) {
+  if (permission.isEnabled() && !permission.has('fs.read', path) &&
+      !permission.isAuditMode()) {
     const resource = pathModule.toNamespacedPath(BufferIsBuffer(path) ? BufferToString(path) : path);
     throw new ERR_ACCESS_DENIED('Access to this API has been restricted', 'FileSystemRead', resource);
   }
@@ -2042,9 +2082,10 @@ async function mkdtemp(prefix, options) {
     const promise = h.mkdtemp(prefix, options);
     if (promise !== undefined) return await promise;
   }
-
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
@@ -2057,7 +2098,9 @@ async function mkdtemp(prefix, options) {
 
 async function mkdtempDisposable(prefix, options) {
   options = getOptions(options);
-
+  if (BufferIsBuffer(prefix)) {
+    options = { ...options, encoding: 'buffer' };
+  }
   prefix = getValidatedPath(prefix, 'prefix');
   warnOnNonPortableTemplate(prefix);
 
@@ -2119,6 +2162,14 @@ async function writeFile(path, data, options) {
 
   checkAborted(options.signal);
 
+  if (!flush && !isCustomIterable(data) && data.byteLength <= kWriteFileMaxChunkSize) {
+    path = getValidatedPath(path);
+    await writeFileInOneRoundTrip(path, stringToFlags(flag, 'options.flag'),
+                                  parseFileMode(options.mode, 'mode', 0o666), data);
+    checkAborted(options.signal);  // An abort during the write still wins.
+    return;
+  }
+
   const fd = await open(path, flag, options.mode);
   let writeOp = writeFileHandle(fd, data, options.signal, options.encoding);
 
@@ -2129,6 +2180,33 @@ async function writeFile(path, data, options) {
   return handleFdClose(writeOp, fd.close);
 }
 
+/**
+ * Open + write + close as one thread pool round trip.
+ * @param {string|Buffer} path Validated path
+ * @param {number} flagsNumber
+ * @param {number} mode
+ * @param {ArrayBufferView} data
+ * @returns {Promise<void>}
+ */
+function writeFileInOneRoundTrip(path, flagsNumber, mode, data) {
+  return new Promise((resolve, reject) => {
+    const job = new binding.WriteFileJob(path, flagsNumber, mode, data);
+    job.ondone = (err) => {
+      if (err != null) {
+        ErrorCaptureStackTrace(err, writeFileInOneRoundTrip);
+        reject(err);
+      } else {
+        resolve();
+      }
+    };
+    const accessError = job.run(path);
+    if (accessError !== undefined) {
+      ErrorCaptureStackTrace(accessError, writeFileInOneRoundTrip);
+      reject(accessError);
+    }
+  });
+}
+
 function isCustomIterable(obj) {
   return isIterable(obj) && !isArrayBufferView(obj) && typeof obj !== 'string';
 }
diff --git a/lib/internal/fs/recursive_watch.js b/lib/internal/fs/recursive_watch.js
index c01f1807cc8f..85d84f9dd8f3 100644
--- a/lib/internal/fs/recursive_watch.js
+++ b/lib/internal/fs/recursive_watch.js
@@ -37,6 +37,24 @@ function lazyLoadFsSync() {
 
 let kResistStopPropagation;
 
+const kIsAIX = process.platform === 'aix';
+
+function isPathMissingForWatch(error, file) {
+  if (error.code === 'ENOENT') {
+    return true;
+  }
+  // AIX reports ENODEV when the path disappears before fs.watch() starts.
+  // Check that it is actually gone so other ENODEV errors still propagate.
+  if (!kIsAIX || error.code !== 'ENODEV') {
+    return false;
+  }
+  try {
+    return lazyLoadFsSync().statSync(file, { throwIfNoEntry: false }) === undefined;
+  } catch {
+    return false;
+  }
+}
+
 // Inotify reports changes to a directory's entries, with their names, on the
 // directory's own watch, so one watcher per directory is enough on Linux.
 // kqueue and event ports only report that the directory itself changed, so
@@ -116,56 +134,81 @@ class FSWatcher extends EventEmitter {
   }
 
   #forget(file) {
+    const watcher = this.#watchers.get(file);
+    if (watcher !== undefined) {
+      watcher.close();
+      this.#watchers.delete(file);
+    }
+    this.#entries.delete(file);
+    this.#symbolicLinks.delete(file);
+
     const childPrefix = file + pathSep;
     for (const entry of this.#entries) {
-      if (entry === file || StringPrototypeStartsWith(entry, childPrefix)) {
+      if (StringPrototypeStartsWith(entry, childPrefix)) {
         this.#entries.delete(entry);
         this.#symbolicLinks.delete(entry);
-        const watcher = this.#watchers.get(entry);
-        if (watcher !== undefined) {
-          watcher.close();
+        const childWatcher = this.#watchers.get(entry);
+        if (childWatcher !== undefined) {
+          childWatcher.close();
           this.#watchers.delete(entry);
         }
       }
     }
   }
 
-  // An entry that vanished between being listed and being watched is left to
-  // the directory's own watcher to report.
+  // Report an entry that vanished between being listed and being watched so
+  // the caller can discard its stale bookkeeping.
   #watch(file, onChange) {
-    if (this.#closed || this.#watchers.has(file)) {
-      return;
+    if (this.#closed) {
+      return false;
+    }
+    if (this.#watchers.has(file)) {
+      return true;
     }
     const { watch } = lazyLoadFsSync();
     let watcher;
     try {
       watcher = watch(file, { persistent: this.#options.persistent }, onChange);
     } catch (err) {
-      if (err.code === 'ENOENT') {
-        return;
+      if (isPathMissingForWatch(err, file) &&
+          (file !== this.#rootPath || !this.#options.throwIfNoEntry)) {
+        return false;
       }
       throw err;
     }
     this.#watchers.set(file, watcher);
+    return true;
   }
 
-  // Registers the entries of `folder` that are not known yet (emitting
-  // 'rename' for them unless this is the initial scan) and arms one watcher
-  // for the directory; #addEntry() descends into subdirectories.
+  // Arms one watcher for `folder`, then registers entries that are not known
+  // yet (emitting 'rename' for them unless this is the initial scan);
+  // #addEntry() descends into subdirectories.
   #scanFolder(folder, initial) {
+    if (!this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename))) {
+      this.#forget(folder);
+      return;
+    }
+
     const { readdirSync } = lazyLoadFsSync();
     let entries;
     try {
       entries = readdirSync(folder, { withFileTypes: true });
     } catch (error) {
-      if (error.code !== 'ENOENT') {
+      if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+        if (folder === this.#rootPath && initial &&
+            (error.code !== 'ENOENT' || this.#options.throwIfNoEntry)) {
+          throw error;
+        }
+        if (!initial && !this.#closed) {
+          this.#emit('rename', folder);
+        }
+        this.#forget(folder);
+      } else {
         this.emit('error', error);
       }
       return;
     }
 
-    this.#watch(folder, (eventType, filename) => this.#onFolderEvent(folder, filename));
-
     for (const entry of entries) {
       if (this.#closed) {
         break;
@@ -187,11 +230,15 @@ class FSWatcher extends EventEmitter {
       // The link target is watched so that changes behind the link surface
       // as a 'rename' of the link, as they always have on this code path.
       this.#symbolicLinks.add(file);
-      this.#watch(file, () => this.#emit('rename', file));
+      if (!this.#watch(file, () => this.#emit('rename', file))) {
+        this.#forget(file);
+      }
     } else if (entry.isDirectory()) {
       this.#scanFolder(file, initial);
     } else if (!kDirectoryWatchReportsEntries) {
-      this.#watch(file, () => this.#onEntryEvent(file));
+      if (!this.#watch(file, () => this.#onEntryEvent(file))) {
+        this.#forget(file);
+      }
     }
   }
 
@@ -253,7 +300,7 @@ class FSWatcher extends EventEmitter {
   #watchRootFile(file) {
     const { statSync } = lazyLoadFsSync();
     this.#entries.add(file);
-    this.#watch(file, () => {
+    if (!this.#watch(file, () => {
       if (this.#closed) {
         return;
       }
@@ -263,7 +310,9 @@ class FSWatcher extends EventEmitter {
       } else {
         this.emit('change', 'change', pathBasename(file));
       }
-    });
+    })) {
+      this.#forget(file);
+    }
   }
 
   [kFSWatchStart](filename) {
diff --git a/lib/internal/fs/utils.js b/lib/internal/fs/utils.js
index 70aaa7e7c58e..3aadc19c4732 100644
--- a/lib/internal/fs/utils.js
+++ b/lib/internal/fs/utils.js
@@ -2,6 +2,7 @@
 
 const {
   ArrayIsArray,
+  ArrayPrototypePush,
   BigInt,
   Date,
   DateNow,
@@ -65,6 +66,11 @@ const {
   validateUint32,
 } = require('internal/validators');
 const pathModule = require('path');
+const binding = internalBinding('fs');
+const {
+  CHAR_BACKWARD_SLASH,
+  CHAR_FORWARD_SLASH,
+} = require('internal/constants');
 const kType = Symbol('type');
 const kStats = Symbol('stats');
 const kPartialAtimeNs = Symbol('partialAtimeNs');
@@ -323,6 +329,81 @@ function getDirent(path, name, type, callback) {
   }
 }
 
+/**
+ * Builds the Dirent objects for a `binding.readdirRecursive()` result, whose
+ * entries are grouped by directory: `counts[i]` entries under `dirs[i]`.
+ * @param {string | Buffer} basePath
+ * @param {[string[] | Buffer[], Uint8Array, Uint32Array, string[] | Buffer[]]} result
+ * @returns {Dirent[]}
+ */
+function getRecursiveDirents(basePath, { 0: names, 1: types, 2: counts, 3: dirs }) {
+  let i = 0;
+  for (let d = 0; d < dirs.length; d++) {
+    // The root keeps the path as given, the directories below it get the
+    // relative directory joined onto it.
+    const parentPath = d === 0 ? basePath : joinParentPath(basePath, dirs[d]);
+    for (const end = i + counts[d]; i < end; i++) {
+      names[i] = new Dirent(names[i], types[i], parentPath);
+    }
+  }
+  return names;
+}
+
+/**
+ * Joins the relative path of a directory onto the path a recursive readdir
+ * was given.
+ * @param {string | Buffer} basePath
+ * @param {string | Buffer} relative
+ * @returns {string | Buffer}
+ */
+function joinParentPath(basePath, relative) {
+  if (typeof basePath === 'string' && typeof relative === 'string') {
+    return pathModule.join(basePath, relative);
+  }
+  const base = typeof basePath === 'string' ? Buffer.from(basePath) : basePath;
+  const parts = [base];
+  const last = base.length === 0 ? -1 : base[base.length - 1];
+  if (last !== CHAR_FORWARD_SLASH && (!isWindows || last !== CHAR_BACKWARD_SLASH)) {
+    ArrayPrototypePush(parts, Buffer.from(pathModule.sep));
+  }
+  ArrayPrototypePush(parts, typeof relative === 'string' ? Buffer.from(relative) : relative);
+  return Buffer.concat(parts);
+}
+
+/**
+ * Appends one directory's entries to `context.results` and the subdirectories
+ * still to visit to `context.dirs`.
+ * @param {string} dir
+ * @param {string} prefix
+ * @param {[string[], number[]]} result
+ * @param {{ withFileTypes: boolean, results: (string | Dirent)[], dirs: string[], prefixes: string[] }} context
+ */
+function collectRecursiveReaddirResult(dir, prefix, { 0: names, 1: types }, context) {
+  const { length } = names;
+  for (let i = 0; i < length; i++) {
+    const name = names[i];
+    const relative = prefix === '' ? name : `${prefix}${pathModule.sep}${name}`;
+    let isDirectory;
+    if (context.withFileTypes) {
+      const dirent = getDirent(dir, name, types[i]);
+      ArrayPrototypePush(context.results, dirent);
+      // https://github.com/nodejs/node/issues/52663
+      isDirectory = dirent.isDirectory() ||
+        (dirent.isSymbolicLink() && binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    } else {
+      ArrayPrototypePush(context.results, relative);
+      const type = types[i];
+      isDirectory = type === UV_DIRENT_DIR ||
+        ((type === UV_DIRENT_LINK || type === UV_DIRENT_UNKNOWN) &&
+         binding.internalModuleStat(pathModule.join(dir, name)) === 1);
+    }
+    if (isDirectory) {
+      ArrayPrototypePush(context.dirs, pathModule.join(dir, name));
+      ArrayPrototypePush(context.prefixes, relative);
+    }
+  }
+}
+
 function getOptions(options, defaultOptions = kEmptyObject) {
   if (options == null || typeof options === 'function') {
     return defaultOptions;
@@ -1111,6 +1192,7 @@ const vfsState = { __proto__: null, handlers: null };
 function setVfsHandlers(handlers) { vfsState.handlers = handlers; }
 
 module.exports = {
+  collectRecursiveReaddirResult,
   constants: {
     kIoMaxLength,
     kMaxUserId,
@@ -1128,6 +1210,7 @@ module.exports = {
   getDirent,
   getDirents,
   getOptions,
+  getRecursiveDirents,
   getValidatedFd,
   getValidatedPath,
   handleErrorFromBinding,
diff --git a/lib/internal/histogram.js b/lib/internal/histogram.js
index febb696d5e22..f325adab484e 100644
--- a/lib/internal/histogram.js
+++ b/lib/internal/histogram.js
@@ -197,6 +197,30 @@ class Histogram {
     return this[kHandle]?.mean();
   }
 
+  /**
+   * Returns a confidence interval for the mean using Student's t-distribution.
+   * @param {{ confidence?: number }} [options]
+   * @returns {{ mean: number, lower: number, upper: number }}
+   */
+  meanCI(options = kEmptyObject) {
+    if (!isHistogram(this))
+      throw new ERR_INVALID_THIS('Histogram');
+    validateObject(options, 'options');
+    const { confidence = 0.95 } = options;
+    validateNumber(confidence, 'options.confidence');
+    if (NumberIsNaN(confidence) || confidence <= 0 || confidence >= 1)
+      throw new ERR_OUT_OF_RANGE('options.confidence',
+                                 '> 0 && < 1', confidence);
+    const result = this[kHandle]?.meanCI(confidence);
+    if (result === undefined) return undefined;
+    return {
+      __proto__: null,
+      mean: result[0],
+      lower: result[1],
+      upper: result[2],
+    };
+  }
+
   /**
    * @readonly
    * @type {number}
diff --git a/lib/internal/http.js b/lib/internal/http.js
index 304ef04d6638..d4efd7ad3adb 100644
--- a/lib/internal/http.js
+++ b/lib/internal/http.js
@@ -10,7 +10,7 @@ const {
 
 const { setUnrefTimeout } = require('internal/timers');
 const {
-  getCategoryEnabledBuffer,
+  categoryEnabledChecker,
   trace,
   nodeTraceEventCategory,
   kAsyncBegin,
@@ -44,11 +44,7 @@ function getNextTraceEventId() {
   return ++traceEventId;
 }
 
-const httpEnabled = getCategoryEnabledBuffer('node.http');
-
-function isTraceHTTPEnabled() {
-  return httpEnabled[0] > 0;
-}
+const isTraceHTTPEnabled = categoryEnabledChecker('node.http');
 
 const traceEventCategory = nodeTraceEventCategory('node.http');
 
diff --git a/lib/internal/http2/core.js b/lib/internal/http2/core.js
index 4700120b0dd4..ceb173aa04e6 100644
--- a/lib/internal/http2/core.js
+++ b/lib/internal/http2/core.js
@@ -241,6 +241,8 @@ function debugSessionObj(session, message, ...args) {
 const kMaxFrameSize = (2 ** 24) - 1;
 const kMaxInt = (2 ** 32) - 1;
 const kMaxInitialWindowSize = (2 ** 31) - 1;  // HTTP/2 spec maximum
+// A connection window of 0 stalls the connection
+const kMinConnectionWindowSize = 1;
 const kMaxStreams = (2 ** 32) - 1;
 const kMaxALTSVC = (2 ** 14) - 2;
 
@@ -3590,12 +3592,8 @@ function connectionListener(socket) {
   this.emit('session', session);
 }
 
-function initializeOptions(options) {
-  assertIsObject(options, 'options');
-  options = { ...options };
-  assertIsObject(options.settings, 'options.settings');
-  options.settings = { ...options.settings };
-
+// Validates the session options that apply to both client and server sessions
+function validateSessionOptions(options) {
   assertIsArray(options.remoteCustomSettings, 'options.remoteCustomSettings');
   if (options.remoteCustomSettings) {
     options.remoteCustomSettings = [ ...options.remoteCustomSettings ];
@@ -3603,6 +3601,29 @@ function initializeOptions(options) {
       throw new ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS();
   }
 
+  if (options.strictSingleValueFields !== undefined) {
+    validateBoolean(
+      options.strictSingleValueFields,
+      'options.strictSingleValueFields',
+    );
+  } else {
+    options.strictSingleValueFields = true;
+  }
+
+  if (options.connectionWindowSize !== undefined) {
+    validateInt32(options.connectionWindowSize, 'options.connectionWindowSize',
+                  kMinConnectionWindowSize, kMaxInitialWindowSize);
+  }
+}
+
+function initializeOptions(options) {
+  assertIsObject(options, 'options');
+  options = { ...options };
+  assertIsObject(options.settings, 'options.settings');
+  options.settings = { ...options.settings };
+
+  validateSessionOptions(options);
+
   if (options.maxSessionInvalidFrames !== undefined)
     validateUint32(options.maxSessionInvalidFrames, 'options.maxSessionInvalidFrames');
 
@@ -3619,16 +3640,6 @@ function initializeOptions(options) {
     // TODO(danbev): is this a good default value?
     options.unknownProtocolTimeout = 10000;
 
-  if (options.strictSingleValueFields !== undefined) {
-    validateBoolean(
-      options.strictSingleValueFields,
-      'options.strictSingleValueFields',
-    );
-  } else {
-    options.strictSingleValueFields = true;
-  }
-
-
   // Initialize http1Options bag for HTTP/1 fallback when allowHTTP1 is true.
   // This bag is passed to storeHTTPOptions() to configure HTTP/1 server
   // behavior (timeouts, IncomingMessage/ServerResponse classes, etc.).
@@ -3840,21 +3851,7 @@ function connect(authority, options, listener) {
     maxOriginSetSize = 128;
   }
 
-  assertIsArray(options.remoteCustomSettings, 'options.remoteCustomSettings');
-  if (options.remoteCustomSettings) {
-    options.remoteCustomSettings = [ ...options.remoteCustomSettings ];
-    if (options.remoteCustomSettings.length > MAX_ADDITIONAL_SETTINGS)
-      throw new ERR_HTTP2_TOO_MANY_CUSTOM_SETTINGS();
-  }
-
-  if (options.strictSingleValueFields !== undefined) {
-    validateBoolean(
-      options.strictSingleValueFields,
-      'options.strictSingleValueFields',
-    );
-  } else {
-    options.strictSingleValueFields = true;
-  }
+  validateSessionOptions(options);
 
   if (typeof authority === 'string')
     authority = new URL(authority);
diff --git a/lib/internal/http2/util.js b/lib/internal/http2/util.js
index 159ba5bd5315..e2e6288b9ec6 100644
--- a/lib/internal/http2/util.js
+++ b/lib/internal/http2/util.js
@@ -233,7 +233,8 @@ const IDX_OPTIONS_MAX_SETTINGS = 9;
 const IDX_OPTIONS_STREAM_RESET_RATE = 10;
 const IDX_OPTIONS_STREAM_RESET_BURST = 11;
 const IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION = 12;
-const IDX_OPTIONS_FLAGS = 13;
+const IDX_OPTIONS_CONNECTION_WINDOW_SIZE = 13;
+const IDX_OPTIONS_FLAGS = 14;
 
 function updateOptionsBuffer(options) {
   let flags = 0;
@@ -303,6 +304,11 @@ function updateOptionsBuffer(options) {
     optionsBuffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION] =
       options.strictFieldWhitespaceValidation === true ? 0 : 1;
   }
+  if (typeof options.connectionWindowSize === 'number') {
+    flags |= (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE);
+    optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE] =
+      options.connectionWindowSize;
+  }
 
   optionsBuffer[IDX_OPTIONS_FLAGS] = flags;
 }
diff --git a/lib/internal/main/bench_runner.js b/lib/internal/main/bench_runner.js
new file mode 100644
index 000000000000..ff3647fe785c
--- /dev/null
+++ b/lib/internal/main/bench_runner.js
@@ -0,0 +1,31 @@
+'use strict';
+
+const {
+  ArrayPrototypeSlice,
+  PromisePrototypeThen,
+} = primordials;
+const {
+  markBootstrapComplete,
+  prepareTestRunnerMainExecution,
+} = require('internal/process/pre_execution');
+const { emitExperimentalWarning } = require('internal/util');
+const {
+  triggerUncaughtException,
+  exitCodes: { kGenericUserError },
+} = internalBinding('errors');
+
+prepareTestRunnerMainExecution();
+markBootstrapComplete();
+if (process.env.NODE_BENCH_CONTEXT !== 'child' ||
+    typeof process.send !== 'function') {
+  emitExperimentalWarning('Benchmarks');
+}
+
+const { run } = require('internal/bench_runner/cli');
+const patterns = ArrayPrototypeSlice(process.argv, 1);
+
+PromisePrototypeThen(run(patterns), ({ success }) => {
+  if (!success) process.exitCode = kGenericUserError;
+}, (error) => {
+  triggerUncaughtException(error, true /* fromPromise */);
+});
diff --git a/lib/internal/main/embedding.js b/lib/internal/main/embedding.js
index 863f90a32f40..31c55459a13e 100644
--- a/lib/internal/main/embedding.js
+++ b/lib/internal/main/embedding.js
@@ -12,10 +12,15 @@
 const {
   prepareMainThreadExecution,
 } = require('internal/process/pre_execution');
-const { isExperimentalSeaWarningNeeded, isSea } = internalBinding('sea');
+const {
+  isExperimentalSeaWarningNeeded,
+  isSea,
+  isVfsEnabled,
+  mainCodePath: seaMainCodePath,
+} = internalBinding('sea');
 const { emitExperimentalWarning } = require('internal/util');
 const { emitWarningSync } = require('internal/process/warning');
-const { Module } = require('internal/modules/cjs/loader');
+const { Module, wrapModuleLoad } = require('internal/modules/cjs/loader');
 const { compileFunctionForCJSLoader } = internalBinding('contextify');
 const { maybeCacheSourceMap } = require('internal/source_map/source_map_cache');
 const { pathToFileURL } = require('internal/url');
@@ -120,10 +125,54 @@ function embedderRunESM(content, filename) {
   return wrap.getNamespace();
 }
 
+/* c8 ignore start -- only reachable in an actual SEA binary */
+/**
+ * Mounts the SEA virtual file system with the main script placed at the
+ * mount point root, and returns the path of the main script inside the
+ * mount, or null when the VFS could not be set up.
+ * @param {string} content The source of the SEA main script
+ * @returns {string|null} The VFS path of the main script
+ */
+function setUpSeaVfs(content) {
+  const mainName = path.basename(seaMainCodePath || process.execPath);
+  const { initSeaVfs } = require('internal/vfs/sea');
+  const seaVfs = initSeaVfs({ extraFiles: { [mainName]: content } });
+  if (seaVfs === null) {
+    return null;
+  }
+  return path.join(seaVfs.mountPoint, mainName);
+}
+/* c8 ignore stop */
+
 function embedderRunEntryPoint(content, format, filename) {
   format ||= moduleFormats.kCommonJS;
   filename ||= process.execPath;
 
+  /* c8 ignore start -- only reachable in an actual SEA binary */
+  if (isLoadingSea && isVfsEnabled()) {
+    // Run the main script from inside the SEA VFS mount so that
+    // `__filename`, `__dirname`, `import.meta`, relative requires and
+    // imports, and `node_modules` lookups all resolve against the
+    // bundled assets.
+    const vfsMain = setUpSeaVfs(content);
+    if (vfsMain !== null) {
+      if (format === moduleFormats.kCommonJS) {
+        return wrapModuleLoad(vfsMain, null, true);
+      } else if (format === moduleFormats.kModule) {
+        const { runEntryPointWithESMLoader } =
+          require('internal/modules/run_main');
+        const mainURL = pathToFileURL(vfsMain);
+        return runEntryPointWithESMLoader((cascadedLoader) => {
+          // Note that if the graph contains unsettled TLA, this may never
+          // resolve even after the event loop stops running.
+          return cascadedLoader.import(
+            mainURL, undefined, { __proto__: null }, undefined, true);
+        });
+      }
+    }
+  }
+  /* c8 ignore stop */
+
   if (format === moduleFormats.kCommonJS) {
     return embedderRunCjs(content, filename);
   } else if (format === moduleFormats.kModule) {
diff --git a/lib/internal/per_context/primordials.js b/lib/internal/per_context/primordials.js
index 49576c2d9497..2e610f4ab508 100644
--- a/lib/internal/per_context/primordials.js
+++ b/lib/internal/per_context/primordials.js
@@ -196,6 +196,7 @@ function copyPrototype(src, dest, prefix) {
   'Error',
   'EvalError',
   'FinalizationRegistry',
+  'Float16Array',
   'Float32Array',
   'Float64Array',
   'Function',
diff --git a/lib/internal/perf/resource_timing.js b/lib/internal/perf/resource_timing.js
index f8459efa48e3..6b8f0d2aa524 100644
--- a/lib/internal/perf/resource_timing.js
+++ b/lib/internal/perf/resource_timing.js
@@ -17,6 +17,7 @@ const { enqueue, bufferResourceTiming } = require('internal/perf/observe');
 const { validateThisInternalField } = require('internal/validators');
 const { kEnumerableProperty } = require('internal/util');
 
+const kBodyInfo = Symbol('kBodyInfo');
 const kCacheMode = Symbol('kCacheMode');
 const kRequestedUrl = Symbol('kRequestedUrl');
 const kTimingInfo = Symbol('kTimingInfo');
@@ -110,11 +111,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kTimingInfo].finalNetworkRequestStartTime;
   }
 
-  get responseStart() {
+  get finalResponseHeadersStart() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].finalNetworkResponseStartTime;
   }
 
+  get firstInterimResponseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ?? 0;
+  }
+
+  get responseStart() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].firstInterimNetworkResponseStartTime ||
+      this[kTimingInfo].finalNetworkResponseStartTime;
+  }
+
   get responseEnd() {
     validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
     return this[kTimingInfo].endTime;
@@ -148,6 +160,22 @@ class PerformanceResourceTiming extends PerformanceEntry {
     return this[kResponseStatus];
   }
 
+  get renderBlockingStatus() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kTimingInfo].renderBlocking === true ?
+      'blocking' : 'non-blocking';
+  }
+
+  get contentType() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentType ?? '';
+  }
+
+  get contentEncoding() {
+    validateThisInternalField(this, kTimingInfo, 'PerformanceResourceTiming');
+    return this[kBodyInfo]?.contentEncoding ?? '';
+  }
+
   toJSON() {
     validateThisInternalField(this, kInitiatorType, 'PerformanceResourceTiming');
     return {
@@ -167,6 +195,8 @@ class PerformanceResourceTiming extends PerformanceEntry {
       connectEnd: this.connectEnd,
       secureConnectionStart: this.secureConnectionStart,
       requestStart: this.requestStart,
+      finalResponseHeadersStart: this.finalResponseHeadersStart,
+      firstInterimResponseStart: this.firstInterimResponseStart,
       responseStart: this.responseStart,
       responseEnd: this.responseEnd,
       transferSize: this.transferSize,
@@ -174,6 +204,9 @@ class PerformanceResourceTiming extends PerformanceEntry {
       decodedBodySize: this.decodedBodySize,
       deliveryType: this.deliveryType,
       responseStatus: this.responseStatus,
+      renderBlockingStatus: this.renderBlockingStatus,
+      contentType: this.contentType,
+      contentEncoding: this.contentEncoding,
     };
   }
 }
@@ -191,6 +224,8 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   connectEnd: kEnumerableProperty,
   secureConnectionStart: kEnumerableProperty,
   requestStart: kEnumerableProperty,
+  finalResponseHeadersStart: kEnumerableProperty,
+  firstInterimResponseStart: kEnumerableProperty,
   responseStart: kEnumerableProperty,
   responseEnd: kEnumerableProperty,
   transferSize: kEnumerableProperty,
@@ -198,6 +233,9 @@ ObjectDefineProperties(PerformanceResourceTiming.prototype, {
   decodedBodySize: kEnumerableProperty,
   deliveryType: kEnumerableProperty,
   responseStatus: kEnumerableProperty,
+  renderBlockingStatus: kEnumerableProperty,
+  contentType: kEnumerableProperty,
+  contentEncoding: kEnumerableProperty,
   toJSON: kEnumerableProperty,
   [SymbolToStringTag]: {
     __proto__: null,
@@ -224,6 +262,7 @@ function createPerformanceResourceTiming(
   // The spec doesn't say to validate it in the class construction.
   resourceTiming[kTimingInfo] = timingInfo;
   resourceTiming[kCacheMode] = cacheMode;
+  resourceTiming[kBodyInfo] = bodyInfo;
   resourceTiming[kDeliveryType] = deliveryType;
   resourceTiming[kResponseStatus] = responseStatus;
 
diff --git a/lib/internal/process/pre_execution.js b/lib/internal/process/pre_execution.js
index 1c9d903f0c9c..817b76cfc74b 100644
--- a/lib/internal/process/pre_execution.js
+++ b/lib/internal/process/pre_execution.js
@@ -163,14 +163,12 @@ function prepareExecution(options) {
     // channel. This needs to be done before any user code gets executed
     // (including preload modules).
     initializeClusterIPC();
-
-    // TODO(joyeecheung): do this for worker threads as well.
-    runDeserializeCallbacks();
   } else {
     assert(!internalBinding('worker').isMainThread);
     // The setup should be called in LOAD_SCRIPT message handler.
     assert(!initializeModules);
   }
+  runDeserializeCallbacks();
 
   const { initializeExtensionFormatMap } = require('internal/modules/esm/get_format');
   initializeExtensionFormatMap();
diff --git a/lib/internal/quic/quic.js b/lib/internal/quic/quic.js
index d55603daf1f4..95288775d42a 100644
--- a/lib/internal/quic/quic.js
+++ b/lib/internal/quic/quic.js
@@ -50,7 +50,9 @@ let debug = require('internal/util/debuglog').debuglog('quic', (fn) => {
 
 const {
   Endpoint: Endpoint_,
+  sendHeaders,
   setCallbacks,
+  setHeadersInterest,
 
   // The constants to be exposed to end users for various options.
   CC_ALGO_RENO_STR: CC_ALGO_RENO,
@@ -138,8 +140,9 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
-  toUint8Array,
   convertChunks,
+  getWriterSignal,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const {
@@ -164,7 +167,6 @@ const {
 } = require('internal/fs/promises');
 
 const {
-  validateAbortSignal,
   validateBoolean,
   validateFunction,
   validateInteger,
@@ -962,9 +964,10 @@ setCallbacks({
     // Called when the stream C++ handle has been closed. The error is
     // either undefined (clean close) or a raw array [type, code, reason]
     // from QuicError::ToV8Value. Convert to a proper Node.js Error.
+    if (!this[kOwner]) return;
     if (error !== undefined) {
       error = convertQuicError(error);
-    } else if (this[kOwner] && !this[kOwner].destroyed) {
+    } else if (!this[kOwner].destroyed) {
       // The stream is closing cleanly, but it may have been reset by the
       // peer (ReceiveStreamReset) or locally (resetStream). The C++ side
       // records the reset code in state.resetCode. If set, surface the
@@ -1303,6 +1306,17 @@ function parseHeaderPairs(pairs) {
   return block;
 }
 
+function updateHeaderInterest(handle, inner) {
+  if (handle === undefined) return;
+  setHeadersInterest(
+    handle,
+    inner.onheaders !== undefined ||
+      inner.ontrailers !== undefined ||
+      inner.oninfo !== undefined,
+    inner.onwanttrailers !== undefined || inner.pendingTrailers !== undefined,
+  );
+}
+
 /**
  * Applies session and stream callbacks from an options object to a session.
  * @param {QuicSession} session
@@ -1827,13 +1841,12 @@ class QuicStream {
     const inner = this.#inner;
     if (fn === undefined) {
       inner.onheaders = undefined;
-      inner.state.wantsHeaders = false;
     } else {
       validateFunction(fn, 'onheaders');
       assertHeadersSupported(inner.session);
       inner.onheaders = FunctionPrototypeBind(fn, this);
-      inner.state.wantsHeaders = true;
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /** @type {Function|undefined} */
@@ -1852,6 +1865,7 @@ class QuicStream {
       assertHeadersSupported(inner.session);
       inner.oninfo = FunctionPrototypeBind(fn, this);
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /** @type {Function|undefined} */
@@ -1870,6 +1884,7 @@ class QuicStream {
       assertHeadersSupported(inner.session);
       inner.ontrailers = FunctionPrototypeBind(fn, this);
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /** @type {Function|undefined} */
@@ -1883,13 +1898,12 @@ class QuicStream {
     const inner = this.#inner;
     if (fn === undefined) {
       inner.onwanttrailers = undefined;
-      inner.state.wantsTrailers = false;
     } else {
       validateFunction(fn, 'onwanttrailers');
       assertHeadersSupported(inner.session);
       inner.onwanttrailers = FunctionPrototypeBind(fn, this);
-      inner.state.wantsTrailers = true;
     }
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /**
@@ -1918,10 +1932,12 @@ class QuicStream {
     assertHeadersSupported(inner.session);
     if (headers === undefined) {
       inner.pendingTrailers = undefined;
+      updateHeaderInterest(this.#handle, inner);
       return;
     }
     validateObject(headers, 'headers');
     inner.pendingTrailers = headers;
+    updateHeaderInterest(this.#handle, inner);
   }
 
   /**
@@ -2104,7 +2120,8 @@ class QuicStream {
     const headerString = buildNgHeaderString(
       headers, assertValidPseudoHeader, true /* strictSingleValueFields */);
     const flags = terminal ? kHeadersFlagsTerminal : kHeadersFlagsNone;
-    return this.#handle.sendHeaders(kHeadersKindInitial, headerString, flags);
+    return sendHeaders(
+      this.#handle, kHeadersKindInitial, headerString, flags);
   }
 
   /**
@@ -2123,8 +2140,8 @@ class QuicStream {
     validateObject(headers, 'headers');
     const headerString = buildNgHeaderString(
       headers, assertValidPseudoHeader, true);
-    return this.#handle.sendHeaders(
-      kHeadersKindHints, headerString, kHeadersFlagsNone);
+    return sendHeaders(
+      this.#handle, kHeadersKindHints, headerString, kHeadersFlagsNone);
   }
 
   /**
@@ -2143,8 +2160,8 @@ class QuicStream {
     }
     validateObject(headers, 'headers');
     const headerString = buildNgHeaderString(headers);
-    return this.#handle.sendHeaders(
-      kHeadersKindTrailing, headerString, kHeadersFlagsNone);
+    return sendHeaders(
+      this.#handle, kHeadersKindTrailing, headerString, kHeadersFlagsNone);
   }
 
   /**
@@ -2197,7 +2214,7 @@ class QuicStream {
     // signals backpressure additional writes are rejected until the buffer has
     // capacity again.
 
-    function writeSync(chunk) {
+    function writeConvertedSync(chunk) {
       // If the stream is closed, errored, or write-ended, we cannot accept
       // more data. Refuse the sync write.
       // If a drain is already pending, another operation is waiting
@@ -2205,7 +2222,6 @@ class QuicStream {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunk = toUint8Array(chunk);
       const len = TypedArrayPrototypeGetByteLength(chunk);
       if (len === 0) return true;
       // Refuse the write only when there is no available capacity at
@@ -2223,17 +2239,22 @@ class QuicStream {
       return true;
     }
 
-    async function write(chunk, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writeSync(chunk) {
+      return writeConvertedSync(toWriterUint8Array(chunk));
+    }
+
+    function write(chunk, options = kEmptyObject) {
+      chunk = toWriterUint8Array(chunk);
+      const signal = getWriterSignal(options);
+      return writeAsync(chunk, signal);
+    }
+
+    async function writeAsync(chunk, signal) {
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
       }
+      signal?.throwIfAborted();
       // If a drain is already pending, another operation is waiting
       // for capacity. Under strict policy, reject immediately.
       // Later, if we add support for other backpressure policies,
@@ -2242,16 +2263,15 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writeSync(chunk)) {
+      if (!writeConvertedSync(chunk)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
 
-    function writevSync(chunks) {
+    function writevConvertedSync(chunks) {
       if (closed || errored || stream.#inner.state.writeEnded || drainWakeup != null) {
         return false;
       }
-      chunks = convertChunks(chunks);
       let len = 0;
       for (const c of chunks) len += TypedArrayPrototypeGetByteLength(c);
       if (len === 0) return true;
@@ -2262,18 +2282,22 @@ class QuicStream {
       return true;
     }
 
-    async function writev(chunks, options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
-      if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
-        signal.throwIfAborted();
-      }
+    function writevSync(chunks) {
+      return writevConvertedSync(convertChunks(chunks));
+    }
+
+    function writev(chunks, options = kEmptyObject) {
+      chunks = convertChunks(chunks);
+      const signal = getWriterSignal(options);
+      return writevAsync(chunks, signal);
+    }
 
+    async function writevAsync(chunks, signal) {
       if (errored) throw error;
       if (closed || stream.#inner.state.writeEnded) {
         throw new ERR_INVALID_STATE('Writer is closed');
       }
+      signal?.throwIfAborted();
 
       // If a drain is already pending, another operation is waiting
       // for capacity. Under strict policy, reject immediately.
@@ -2283,7 +2307,7 @@ class QuicStream {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
 
-      if (!writevSync(chunks)) {
+      if (!writevConvertedSync(chunks)) {
         throw new ERR_INVALID_STATE('Stream write buffer is full');
       }
     }
@@ -2308,11 +2332,15 @@ class QuicStream {
       return totalBytesWritten;
     }
 
-    async function end(options = kEmptyObject) {
-      validateObject(options, 'options');
-      const { signal } = options;
+    function end(options = kEmptyObject) {
+      const signal = getWriterSignal(options);
+      return endAsync(signal);
+    }
+
+    async function endAsync(signal) {
+      if (errored) throw error;
+      if (closed) return totalBytesWritten;
       if (signal !== undefined) {
-        validateAbortSignal(signal, 'options.signal');
         signal.throwIfAborted();
         // TODO(@jasnell): The stream/iter spec allows individual sync end
         // calls to be canceled via an AbortSignal. We currently do not support
@@ -2343,13 +2371,16 @@ class QuicStream {
       } finally {
         drainWakeup = null;
       }
-      return endSync();
+      if (errored) throw error;
+      const result = endSync();
+      if (errored) throw error;
+      return result;
     }
 
     function fail(reason) {
       if (closed || errored) return;
       errored = true;
-      error = reason ?? new ERR_INVALID_STATE('Failed');
+      error = reason;
       // `writer.fail()` is always an error path, so the wire code on
       // RESET_STREAM must never be `0n` (which means "no error" in
       // most application protocols). Resolve the code in priority
@@ -2552,7 +2583,7 @@ class QuicStream {
       assertValidPseudoHeader,
       true, // This could become an option in future
     );
-    return this.#handle.sendHeaders(kind, headerString, flags);
+    return sendHeaders(this.#handle, kind, headerString, flags);
   }
 
   [kFinishClose](error) {
@@ -2660,7 +2691,6 @@ class QuicStream {
 
     switch (kindName) {
       case 'initial':
-        assert(inner.onheaders, 'Unexpected stream headers event');
         inner.headers ??= block;
         if (onStreamHeadersChannel.hasSubscribers) {
           onStreamHeadersChannel.publish({
@@ -2670,7 +2700,8 @@ class QuicStream {
             headers: block,
           });
         }
-        safeCallbackInvoke(inner.onheaders, this, block);
+        if (inner.onheaders)
+          safeCallbackInvoke(inner.onheaders, this, block);
         break;
       case 'trailing':
         if (onStreamTrailersChannel.hasSubscribers) {
@@ -2706,8 +2737,20 @@ class QuicStream {
     // nghttp3 is asking us to provide trailers to send.
     // Check for pre-set pendingTrailers first, then the callback.
     if (inner.pendingTrailers) {
-      this.sendTrailers(inner.pendingTrailers);
+      let sent;
+      try {
+        sent = this.sendTrailers(inner.pendingTrailers);
+      } catch (error) {
+        this.destroy(error);
+        return;
+      }
+      if (!sent) {
+        this.destroy(new ERR_QUIC_STREAM_ABORTED(
+          'Failed to submit trailing headers'));
+        return;
+      }
       inner.pendingTrailers = undefined;
+      updateHeaderInterest(this.#handle, inner);
     } else if (typeof inner.onwanttrailers === 'function') {
       safeCallbackInvoke(inner.onwanttrailers, this);
     }
diff --git a/lib/internal/quic/state.js b/lib/internal/quic/state.js
index 769fee687498..21db0f0e3d59 100644
--- a/lib/internal/quic/state.js
+++ b/lib/internal/quic/state.js
@@ -101,10 +101,8 @@ const {
   IDX_STATE_STREAM_HAS_OUTBOUND,
   IDX_STATE_STREAM_HAS_READER,
   IDX_STATE_STREAM_WANTS_BLOCK,
-  IDX_STATE_STREAM_WANTS_HEADERS,
   IDX_STATE_STREAM_WANTS_RESET,
   IDX_STATE_STREAM_WANTS_STOP_SENDING,
-  IDX_STATE_STREAM_WANTS_TRAILERS,
   IDX_STATE_STREAM_RECEIVED_EARLY_DATA,
   IDX_STATE_STREAM_WRITE_DESIRED_SIZE,
   IDX_STATE_STREAM_BUDGET,
@@ -145,10 +143,8 @@ assert(IDX_STATE_STREAM_RESET !== undefined);
 assert(IDX_STATE_STREAM_HAS_OUTBOUND !== undefined);
 assert(IDX_STATE_STREAM_HAS_READER !== undefined);
 assert(IDX_STATE_STREAM_WANTS_BLOCK !== undefined);
-assert(IDX_STATE_STREAM_WANTS_HEADERS !== undefined);
 assert(IDX_STATE_STREAM_WANTS_RESET !== undefined);
 assert(IDX_STATE_STREAM_WANTS_STOP_SENDING !== undefined);
-assert(IDX_STATE_STREAM_WANTS_TRAILERS !== undefined);
 assert(IDX_STATE_STREAM_WRITE_DESIRED_SIZE !== undefined);
 assert(IDX_STATE_STREAM_RESET_CODE !== undefined);
 
@@ -824,20 +820,6 @@ class QuicStreamState {
     DataViewPrototypeSetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_BLOCK, val ? 1 : 0);
   }
 
-  /** @type {boolean} */
-  get wantsHeaders() {
-    const handle = this.#handle;
-    if (handle === undefined) return undefined;
-    return DataViewPrototypeGetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_HEADERS) !== 0;
-  }
-
-  /** @type {boolean} */
-  set wantsHeaders(val) {
-    const handle = this.#handle;
-    if (handle === undefined) return;
-    DataViewPrototypeSetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_HEADERS, val ? 1 : 0);
-  }
-
   /** @type {boolean} */
   get wantsReset() {
     const handle = this.#handle;
@@ -870,20 +852,6 @@ class QuicStreamState {
       val ? 1 : 0);
   }
 
-  /** @type {boolean} */
-  get wantsTrailers() {
-    const handle = this.#handle;
-    if (handle === undefined) return undefined;
-    return DataViewPrototypeGetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_TRAILERS) !== 0;
-  }
-
-  /** @type {boolean} */
-  set wantsTrailers(val) {
-    const handle = this.#handle;
-    if (handle === undefined) return;
-    DataViewPrototypeSetUint8(handle, this.#offset + IDX_STATE_STREAM_WANTS_TRAILERS, val ? 1 : 0);
-  }
-
   /** @type {boolean} */
   get early() {
     const handle = this.#handle;
@@ -948,8 +916,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode,
       writeDesiredSize,
@@ -969,8 +935,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode: `${resetCode}`,
       writeDesiredSize,
@@ -1007,8 +971,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode,
       writeDesiredSize,
@@ -1028,8 +990,6 @@ class QuicStreamState {
       wantsBlock,
       wantsReset,
       wantsStopSending,
-      wantsHeaders,
-      wantsTrailers,
       early,
       resetCode,
       writeDesiredSize,
diff --git a/lib/internal/source_map/source_map_cache.js b/lib/internal/source_map/source_map_cache.js
index 95b09090c473..e1fa55c5caba 100644
--- a/lib/internal/source_map/source_map_cache.js
+++ b/lib/internal/source_map/source_map_cache.js
@@ -9,6 +9,7 @@ const {
   RegExpPrototypeSymbolSplit,
   SafeMap,
   StringPrototypeCodePointAt,
+  StringPrototypeIndexOf,
   StringPrototypeSplit,
   StringPrototypeStartsWith,
 } = primordials;
@@ -176,16 +177,14 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   // Normalize the sourceURL to a file URL if it is a path.
   sourceURL = normalizeReferrerURL(sourceURL);
 
-  const data = dataFromUrl(filename, sourceMapURL);
-  // `data` could be null if the source map is invalid.
-  // In this case, create a cache entry with null data with source url for test coverage.
-
+  // The payload is resolved on first use (see sourceMapData()), except under
+  // coverage, where it is serialized at exit when no more JS may run.
   const entry = {
     __proto__: null,
     lineLengths: lineLengths(content),
-    data,
-    // Save the source map url if it is not a data url.
-    sourceMapURL: data ? null : sourceMapURL,
+    data: process.env.NODE_V8_COVERAGE ? dataFromUrl(filename, sourceMapURL) : undefined,
+    filename,
+    sourceMapURL,
     sourceURL,
   };
 
@@ -254,20 +253,36 @@ function dataFromUrl(sourceURL, sourceMappingURL) {
   return sourceMapFromFile(mapURL);
 }
 
+const kUnicodeLineTerminators = /[\u2028\u2029]/;
+
 // Cache the length of each line in the file that a source map was extracted
 // from. This allows translation from byte offset V8 coverage reports,
 // to line/column offset Source Map V3.
 function lineLengths(content) {
+  if (RegExpPrototypeExec(kUnicodeLineTerminators, content) !== null) {
+    return lineLengthsWithUnicodeTerminators(content);
+  }
+  // We purposefully keep \r as part of the line-length calculation, in
+  // cases where there is a \r\n separator, so that this can be taken into
+  // account in coverage calculations.
+  const output = [];
+  let lineStart = 0;
+  let lineEnd;
+  while ((lineEnd = StringPrototypeIndexOf(content, '\n', lineStart)) !== -1) {
+    ArrayPrototypePush(output, lineEnd - lineStart);
+    lineStart = lineEnd + 1;
+  }
+  ArrayPrototypePush(output, content.length - lineStart);
+  return output;
+}
+
+function lineLengthsWithUnicodeTerminators(content) {
   const contentLength = content.length;
   const output = [];
   let lineLength = 0;
   for (let i = 0; i < contentLength; i++, lineLength++) {
     const codePoint = StringPrototypeCodePointAt(content, i);
-
-    // We purposefully keep \r as part of the line-length calculation, in
-    // cases where there is a \r\n separator, so that this can be taken into
-    // account in coverage calculations.
-    // codepoints for \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
+    // \n (new line), \u2028 (line separator) and \u2029 (paragraph separator)
     if (codePoint === 10 || codePoint === 0x2028 || codePoint === 0x2029) {
       ArrayPrototypePush(output, lineLength);
       lineLength = -1; // To not count the matched codePoint such as \n character
@@ -351,16 +366,31 @@ function sourceMapCacheToObject() {
 
   const obj = { __proto__: null };
   for (const { 0: k, 1: v } of moduleSourceMapCache) {
+    const data = v.data ?? null;
     obj[k] = {
       __proto__: null,
       lineLengths: v.lineLengths,
-      data: v.data,
-      url: v.sourceMapURL,
+      data,
+      // Save the source map url if it is not a data url.
+      url: data ? null : v.sourceMapURL,
     };
   }
   return obj;
 }
 
+/**
+ * Resolve and parse the payload of a cache entry the first time it is needed;
+ * `null` marks a source map that could not be loaded.
+ * @param {object} entry
+ * @returns {object|null}
+ */
+function sourceMapData(entry) {
+  if (entry.data === undefined) {
+    entry.data = dataFromUrl(entry.filename, entry.sourceMapURL);
+  }
+  return entry.data;
+}
+
 /**
  * Find a source map for a given actual source URL or path.
  *
@@ -390,7 +420,7 @@ function findSourceMap(sourceURL) {
       sourceURL = pathToFileURL(sourceURL).href;
     }
     const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
-    if (entry?.data == null) {
+    if (entry === undefined || sourceMapData(entry) === null) {
       return undefined;
     }
 
diff --git a/lib/internal/stream_base_commons.js b/lib/internal/stream_base_commons.js
index 6d144f8a0fa6..7bf3a2bab638 100644
--- a/lib/internal/stream_base_commons.js
+++ b/lib/internal/stream_base_commons.js
@@ -8,11 +8,10 @@ const {
 const { Buffer } = require('buffer');
 const { FastBuffer } = require('internal/buffer');
 const {
-  WriteWrap,
   kReadBytesOrError,
   kArrayBufferOffset,
   kBytesWritten,
-  kLastWriteWasAsync,
+  kLastWriteErr,
   streamBaseState,
 } = internalBinding('stream_wrap');
 const { UV_EOF } = internalBinding('uv');
@@ -43,41 +42,6 @@ const kBuffer = Symbol('kBuffer');
 const kBufferGen = Symbol('kBufferGen');
 const kBufferCb = Symbol('kBufferCb');
 
-function handleWriteReq(req, data, encoding) {
-  const { handle } = req;
-
-  switch (encoding) {
-    case 'buffer':
-    {
-      const ret = handle.writeBuffer(req, data);
-      if (streamBaseState[kLastWriteWasAsync])
-        req.buffer = data;
-      return ret;
-    }
-    case 'latin1':
-    case 'binary':
-      return handle.writeLatin1String(req, data);
-    case 'utf8':
-    case 'utf-8':
-      return handle.writeUtf8String(req, data);
-    case 'ascii':
-      return handle.writeAsciiString(req, data);
-    case 'ucs2':
-    case 'ucs-2':
-    case 'utf16le':
-    case 'utf-16le':
-      return handle.writeUcs2String(req, data);
-    default:
-    {
-      const buffer = Buffer.from(data, encoding);
-      const ret = handle.writeBuffer(req, buffer);
-      if (streamBaseState[kLastWriteWasAsync])
-        req.buffer = buffer;
-      return ret;
-    }
-  }
-}
-
 function onWriteComplete(status) {
   debug('onWriteComplete', status, this.error);
 
@@ -105,21 +69,8 @@ function onWriteComplete(status) {
     this.callback(null);
 }
 
-function createWriteWrap(handle, callback) {
-  const req = new WriteWrap();
-
-  req.handle = handle;
-  req.oncomplete = onWriteComplete;
-  req.async = false;
-  req.bytes = 0;
-  req.buffer = null;
-  req.callback = callback;
-
-  return req;
-}
-
 function writevGeneric(self, data, cb) {
-  const req = createWriteWrap(self[kHandle], cb);
+  const handle = self[kHandle];
   const allBuffers = data.allBuffers;
   let chunks;
   if (allBuffers) {
@@ -134,33 +85,87 @@ function writevGeneric(self, data, cb) {
       chunks[i * 2 + 1] = entry.encoding;
     }
   }
-  const err = req.handle.writev(req, chunks, allBuffers);
-
-  // Retain chunks
-  if (err === 0) req._chunks = chunks;
+  const ret = handle.writev(null, chunks, allBuffers);
 
-  afterWriteDispatched(req, err, cb);
-  return req;
+  return afterWriteDispatched(handle, ret, chunks, cb);
 }
 
 function writeGeneric(self, data, encoding, cb) {
-  const req = createWriteWrap(self[kHandle], cb);
-  const err = handleWriteReq(req, data, encoding);
+  const handle = self[kHandle];
+  let ret;
+  let buffer = null;
 
-  afterWriteDispatched(req, err, cb);
-  return req;
+  switch (encoding) {
+    case 'buffer':
+      buffer = data;
+      ret = handle.writeBuffer(null, data);
+      break;
+    case 'latin1':
+    case 'binary':
+      ret = handle.writeLatin1String(null, data);
+      break;
+    case 'utf8':
+    case 'utf-8':
+      ret = handle.writeUtf8String(null, data);
+      break;
+    case 'ascii':
+      ret = handle.writeAsciiString(null, data);
+      break;
+    case 'ucs2':
+    case 'ucs-2':
+    case 'utf16le':
+    case 'utf-16le':
+      ret = handle.writeUcs2String(null, data);
+      break;
+    default:
+      buffer = Buffer.from(data, encoding);
+      ret = handle.writeBuffer(null, buffer);
+      break;
+  }
+
+  return afterWriteDispatched(handle, ret, buffer, cb);
 }
 
-function afterWriteDispatched(req, err, cb) {
-  req.bytes = streamBaseState[kBytesWritten];
-  req.async = !!streamBaseState[kLastWriteWasAsync];
+// `ret` is either a numeric error code (when the write - or its failure -
+// completed synchronously and no write request was created) or the WriteWrap
+// object of a dispatched write.
+function afterWriteDispatched(handle, ret, buffer, cb) {
+  const bytes = streamBaseState[kBytesWritten];
+
+  if (typeof ret === 'number') {
+    // The write (or its failure) completed synchronously.
+    if (ret !== 0)
+      cb(new ErrnoException(ret, 'write'));
+    else if (typeof cb === 'function')
+      cb();
+    return { async: false, bytes };
+  }
 
-  if (err !== 0)
-    return cb(new ErrnoException(err, 'write', req.error));
+  const req = ret;
+  const err = streamBaseState[kLastWriteErr];
+  if (err !== 0) {
+    cb(new ErrnoException(err, 'write', req.error));
+    return { async: false, bytes };
+  }
 
-  if (!req.async && typeof req.callback === 'function') {
-    req.callback();
+  req.handle = handle;
+  req.oncomplete = onWriteComplete;
+  req.callback = cb;
+  req.async = true;
+  req.bytes = bytes;
+  // Retain the data (or chunks) being written until the write completes.
+  req.buffer = buffer;
+
+  // If the write completed synchronously inside the write call, before
+  // `oncomplete` could be attached, the completion status has been recorded;
+  // deliver it now.
+  const status = req.writeStatus;
+  if (status !== null) {
+    req.writeStatus = null;
+    req.oncomplete(status);
   }
+
+  return req;
 }
 
 function onStreamRead(arrayBuffer) {
diff --git a/lib/internal/streams/iter/broadcast.js b/lib/internal/streams/iter/broadcast.js
index 0674d4d57037..ddce0d12d42c 100644
--- a/lib/internal/streams/iter/broadcast.js
+++ b/lib/internal/streams/iter/broadcast.js
@@ -21,7 +21,6 @@ const {
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const { lazyDOMException } = require('internal/util');
@@ -34,10 +33,7 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 const {
@@ -52,22 +48,25 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   kMultiConsumerDefaultBudget,
   kResolvedPromise,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
   parsePullArgs,
-  wrapError,
-  toUint8Array,
-  validateBackpressure,
+  toWriterUint8Array,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -81,6 +80,7 @@ const kCanWrite = Symbol('kCanWrite');
 const kOnBufferDrained = Symbol('kOnBufferDrained');
 const kOnEndDrained = Symbol('kOnEndDrained');
 const kPendingWriteRemoved = Symbol('kPendingWriteRemoved');
+const kNoBroadcastError = Symbol('kNoBroadcastError');
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -107,6 +107,7 @@ class BroadcastImpl {
   #waiters = [];  // Consumers with pending resolve (subset of #consumers)
   #ended = false;
   #error;
+  #errored = false;
   #cancelled = false;
   #options;
   #writer = null;
@@ -134,9 +135,13 @@ class BroadcastImpl {
   }
 
   push(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -157,12 +162,7 @@ class BroadcastImpl {
     // When no transforms, return rawConsumer directly (controller elided
     // per PULL-02 optimization -- no transforms means no signal recipient).
     if (transforms.length > 0 || signal) {
-      const pullArgs = [...transforms];
-      if (signal) {
-        ArrayPrototypePush(pullArgs,
-                           { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...pullArgs);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -177,6 +177,7 @@ class BroadcastImpl {
       reject: null,
       pending: [],
       detached: false,
+      error: kNoBroadcastError,
     };
 
     this.#consumers.add(state);
@@ -212,15 +213,16 @@ class BroadcastImpl {
           __proto__: null,
           next() {
             if (state.detached) {
-              if (self.#error !== undefined) {
-                return PromiseReject(self.#error);
+              if (state.error !== kNoBroadcastError) {
+                return PromiseReject(state.error);
               }
               return kDone;
             }
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
+              if (chunk === null) return PromiseReject(self.#error);
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -231,8 +233,9 @@ class BroadcastImpl {
                 { __proto__: null, done: false, value: chunk });
             }
 
-            if (self.#error !== undefined) {
+            if (self.#errored) {
               state.detached = true;
+              state.error = self.#error;
               self.#deleteConsumer(state);
               return PromiseReject(self.#error);
             }
@@ -272,11 +275,13 @@ class BroadcastImpl {
 
   cancel(reason) {
     if (this.#cancelled) return;
+    const hasReason = arguments.length > 0;
     this.#cancelled = true;
     this.#ended = true; // Prevents [kAbort]() from redundantly iterating consumers
 
-    if (reason !== undefined) {
+    if (hasReason) {
       this.#error = reason;
+      this.#errored = true;
     }
 
     // Reject pending writes on the writer so the pump doesn't hang
@@ -284,7 +289,7 @@ class BroadcastImpl {
 
     for (const consumer of this.#consumers) {
       if (consumer.resolve) {
-        if (reason !== undefined) {
+        if (hasReason) {
           consumer.reject?.(reason);
         } else {
           consumer.resolve({ __proto__: null, done: true, value: undefined });
@@ -292,7 +297,8 @@ class BroadcastImpl {
         consumer.resolve = null;
         consumer.reject = null;
       }
-      if (reason !== undefined) {
+      if (hasReason) {
+        consumer.error = reason;
         this.#rejectPending(consumer, reason);
       } else {
         this.#resolvePendingDone(consumer);
@@ -309,10 +315,11 @@ class BroadcastImpl {
 
   // Methods accessed by BroadcastWriter via symbol keys
 
-  [kWrite](chunk) {
+  [kWrite](entry) {
     if (this.#ended || this.#cancelled) return false;
 
-    const batchSize = this.#batchByteSize(chunk);
+    const batchSize = entry.byteLength;
+    let droppedOldest = false;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -324,10 +331,11 @@ class BroadcastImpl {
         case 'unbounded':
           return false;
         case 'drop-oldest':
+          droppedOldest = true;
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -343,9 +351,13 @@ class BroadcastImpl {
       }
     }
 
-    this.#buffer.push(chunk);
+    this.#buffer.push(entry);
     this.#bufferedBytes += batchSize;
     this.#notifyConsumers();
+    if (droppedOldest &&
+        this.#bufferedBytes < this.#options.budget) {
+      this[kOnBufferDrained]?.();
+    }
     return true;
   }
 
@@ -357,7 +369,8 @@ class BroadcastImpl {
       while (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -382,7 +395,8 @@ class BroadcastImpl {
   }
 
   [kAbort](reason) {
-    if (this.#error !== undefined) return;
+    if (this.#errored) return;
+    this.#errored = true;
     this.#error = reason;
     this.#ended = true;
 
@@ -394,6 +408,7 @@ class BroadcastImpl {
         consumer.reject = null;
       }
       this.#rejectPending(consumer, reason);
+      consumer.error = reason;
       consumer.detached = true;
     }
     this.#consumers.clear();
@@ -401,15 +416,13 @@ class BroadcastImpl {
   }
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if ended/cancelled, true/false otherwise.
    * @returns {boolean | null}
    */
   [kCanWrite]() {
     if (this.#ended || this.#cancelled) return null;
-    if ((this.#options.backpressure === 'strict' ||
-        this.#options.backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#options.budget) {
+    if (this.#bufferedBytes >= this.#options.budget) {
       return false;
     }
     return true;
@@ -438,7 +451,7 @@ class BroadcastImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -450,12 +463,16 @@ class BroadcastImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.#writer.fail(error);
+      if (!this.#errored) this[kAbort](error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      return null;
     }
-    return size;
   }
 
   #notifyConsumers() {
@@ -469,7 +486,8 @@ class BroadcastImpl {
       if (consumer.resolve) {
         const bufferIndex = consumer.cursor - this.#bufferStart;
         if (bufferIndex < this.#buffer.length) {
-          const chunk = this.#buffer.get(bufferIndex);
+          const chunk = this.#readEntry(this.#buffer.get(bufferIndex));
+          if (chunk === null) return;
           const cursor = consumer.cursor;
           consumer.cursor++;
           if (cursor === this.#cachedMinCursor &&
@@ -588,33 +606,34 @@ class BroadcastWriter {
   }
 
   write(chunk, options) {
+    const converted = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = toUint8Array(chunk);
-      this.#broadcast[kWrite]([converted]);
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+      const batch = createBatchEntry([converted]);
+      this.#broadcast[kWrite](batch);
+      this.#totalBytes += batch.byteLength;
       return kResolvedPromise;
     }
-    return this.#writevSlow([chunk], signal);
+    return this.#writeBatchSlow(createBatchEntry([converted]), signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const converted = convertChunks(chunks);
     const signal = getWriterSignal(options);
+    const batch = createBatchEntry(converted);
     // Fast path: no signal, writer open, buffer has space
     if (this.#canUseWriteFastPath(signal)) {
-      const converted = convertChunks(chunks);
-      this.#broadcast[kWrite](converted);
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
+      if (this.#state === 'open' && this.#broadcast[kWrite](batch)) {
+        this.#totalBytes += batch.byteLength;
+        return kResolvedPromise;
       }
-      return kResolvedPromise;
+      return this.#writeBatchSlow(batch, signal);
     }
-    return this.#writevSlow(chunks, signal);
+    return this.#writeBatchSlow(batch, signal);
   }
 
-  async #writevSlow(chunks, signal) {
+  async #writeBatchSlow(batch, signal) {
     if (this.#state === 'errored') {
       throw this.#error;
     }
@@ -624,12 +643,8 @@ class BroadcastWriter {
 
     signal?.throwIfAborted();
 
-    const converted = convertChunks(chunks);
-
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return;
     }
 
@@ -641,34 +656,30 @@ class BroadcastWriter {
           'Backpressure violation: too many pending writes. ' +
           'Await each write() call to respect backpressure.');
       }
-      return this.#createPendingWrite(converted, signal);
+      return this.#createPendingWrite(batch, signal);
     }
 
     // 'unbounded' policy
-    return this.#createPendingWrite(converted, signal);
+    return this.#createPendingWrite(batch, signal);
   }
 
   writeSync(chunk) {
+    const converted = toWriterUint8Array(chunk);
     if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
-    const converted =
-      toUint8Array(chunk);
-    if (this.#broadcast[kWrite]([converted])) {
-      this.#totalBytes += TypedArrayPrototypeGetByteLength(converted);
+    const batch = createBatchEntry([converted]);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
-    if (this.#state !== 'open') return false;
-    if (!this.#broadcast[kCanWrite]()) return false;
     const converted = convertChunks(chunks);
-    if (this.#broadcast[kWrite](converted)) {
-      for (let i = 0; i < converted.length; i++) {
-        this.#totalBytes += TypedArrayPrototypeGetByteLength(converted[i]);
-      }
+    if (this.#state !== 'open') return false;
+    const batch = createBatchEntry(converted);
+    if (this.#broadcast[kWrite](batch)) {
+      this.#totalBytes += batch.byteLength;
       return true;
     }
     return false;
@@ -703,12 +714,11 @@ class BroadcastWriter {
   fail(reason) {
     if (this.#state === 'errored' || this.#state === 'closed') return;
     this.#state = 'errored';
-    const error = reason ?? new ERR_INVALID_STATE.TypeError('Failed');
-    this.#error = error;
-    this.#rejectPendingWrites(error);
-    this.#rejectPendingDrains(error);
-    this.#pendingEnd?.reject(error);
-    this.#broadcast[kAbort](error);
+    this.#error = reason;
+    this.#rejectPendingWrites(reason);
+    this.#rejectPendingDrains(reason);
+    this.#pendingEnd?.reject(reason);
+    this.#broadcast[kAbort](reason);
   }
 
   [SymbolAsyncDispose]() {
@@ -757,9 +767,9 @@ class BroadcastWriter {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunk, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunk, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
     if (signal) {
       wireBroadcastWriteSignal(entry, signal, resolve, reject, this);
@@ -770,14 +780,17 @@ class BroadcastWriter {
   #resolvePendingWrites() {
     while (this.#pendingWrites.length > 0 && this.#broadcast[kCanWrite]()) {
       const pending = this.#pendingWrites.shift();
-      if (this.#broadcast[kWrite](pending.chunk)) {
-        for (let i = 0; i < pending.chunk.length; i++) {
-          this.#totalBytes += TypedArrayPrototypeGetByteLength(pending.chunk[i]);
+      try {
+        validateBatchEntry(pending.batch);
+        if (this.#broadcast[kWrite](pending.batch)) {
+          this.#totalBytes += pending.batch.byteLength;
+          pending.resolve();
+        } else {
+          this.#pendingWrites.unshift(pending);
+          break;
         }
-        pending.resolve();
-      } else {
-        this.#pendingWrites.unshift(pending);
-        break;
+      } catch (error) {
+        pending.reject(error);
       }
     }
     this.#finishEndIfReady();
@@ -811,18 +824,18 @@ function wireBroadcastWriteSignal(entry, signal, resolve, reject, self) {
     const pendingWrites = getBroadcastPendingWrites(self);
     const idx = pendingWrites.indexOf(entry);
     if (idx !== -1) pendingWrites.removeAt(idx);
-    entry.chunk = null;
-    reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
+    entry.batch = null;
+    reject(signal.reason);
     if (idx !== -1) self[kPendingWriteRemoved]();
   };
   entry.resolve = function() {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     resolve();
   };
   entry.reject = function(reason) {
     signal.removeEventListener('abort', onAbort);
-    entry.chunk = null;
+    entry.batch = null;
     reject(reason);
   };
   signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
@@ -842,17 +855,16 @@ function onBroadcastCancel(broadcastImpl, signal) {
  * @returns {{ writer: Writer, broadcast: Broadcast }}
  */
 function broadcast(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.BroadcastOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -895,8 +907,12 @@ const Broadcast = {
         'input', ['Broadcastable', 'AsyncIterable', 'Iterable'], input);
     }
 
+    options = converters.BroadcastOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const result = broadcast(options);
-    const signal = options?.signal;
+    const { signal } = options;
 
     const pump = async () => {
       const w = result.writer;
@@ -928,7 +944,7 @@ const Broadcast = {
           await w.end(signal ? { signal } : undefined);
         }
       } catch (error) {
-        w.fail(wrapError(error));
+        w.fail(error);
       }
     };
     PromisePrototypeThen(pump(), undefined, () => {});
diff --git a/lib/internal/streams/iter/classic.js b/lib/internal/streams/iter/classic.js
index 0769348a3981..4ca384cae9ab 100644
--- a/lib/internal/streams/iter/classic.js
+++ b/lib/internal/streams/iter/classic.js
@@ -13,6 +13,7 @@
 
 const {
   ArrayPrototypePush,
+  FunctionPrototypeCall,
   NumberMAX_SAFE_INTEGER,
   Promise,
   PromisePrototypeThen,
@@ -32,15 +33,16 @@ const {
   AbortError,
   aggregateTwoErrors,
   codes: {
+    ERR_FALSY_VALUE_REJECTION,
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
     ERR_INVALID_STATE,
+    ERR_OPERATION_FAILED,
     ERR_STREAM_WRITE_AFTER_END,
   },
 } = require('internal/errors');
 
 const {
-  validateArray,
   validateInteger,
   validateObject,
 } = require('internal/validators');
@@ -60,13 +62,33 @@ const {
 } = require('internal/streams/iter/types');
 
 const {
+  convertChunks,
   getWriterSignal,
   validateBackpressure,
-  toUint8Array,
+  toWriterUint8Array,
 } = require('internal/streams/iter/utils');
 
 const { Buffer } = require('buffer');
 const destroyImpl = require('internal/streams/destroy');
+const { isError } = require('internal/util');
+
+// Classic stream error channels require a truthy Error object.
+function toClassicError(reason, reasonMap) {
+  try {
+    if (isError(reason)) return reason;
+  } catch {
+    // Wrap values whose proxy traps make the Error check fail.
+  }
+  let error;
+  if (!reason) {
+    error = new ERR_FALSY_VALUE_REJECTION.HideStackFramesError(reason);
+  } else {
+    error = new ERR_OPERATION_FAILED('Non-Error value');
+    error.reason = reason;
+  }
+  reasonMap?.set(error, { __proto__: null, reason });
+  return error;
+}
 
 // Lazy-loaded to avoid circular dependencies. Readable and Writable
 // both require this module's parent, so we defer the require.
@@ -299,11 +321,17 @@ function toReadable(source, options = kNullPrototype) {
         backpressure.resolve();
         backpressure = null;
       }
-      if (typeof iterator.return === 'function') {
-        PromisePrototypeThen(iterator.return(),
-                             () => cb(err), (e) => cb(e || err));
-      } else {
-        cb(err);
+      try {
+        const returnMethod = iterator.return;
+        if (typeof returnMethod !== 'function') {
+          cb(err);
+          return;
+        }
+        const returned = FunctionPrototypeCall(returnMethod, iterator);
+        PromisePrototypeThen(PromiseResolve(returned), () => cb(err),
+                             (error) => cb(err || toClassicError(error)));
+      } catch (error) {
+        cb(err || toClassicError(error));
       }
     },
   });
@@ -331,7 +359,7 @@ function toReadable(source, options = kNullPrototype) {
       }
     } catch (err) {
       done = true;
-      readable.destroy(err);
+      readable.destroy(toClassicError(err));
     }
   }
 
@@ -372,30 +400,43 @@ function toReadableSync(source, options = kNullPrototype) {
     __proto__: null,
     highWaterMark,
     read() {
-      for (;;) {
-        if (hasBatch) {
-          while (batchIndex < batch.length) {
-            if (!this.push(batch[batchIndex++])) return;
+      try {
+        for (;;) {
+          if (hasBatch) {
+            while (batchIndex < batch.length) {
+              if (!this.push(batch[batchIndex++])) return;
+            }
+            batch = undefined;
+            hasBatch = false;
+            batchIndex = 0;
           }
-          batch = undefined;
-          hasBatch = false;
-          batchIndex = 0;
-        }
 
-        const result = iterator.next();
-        const { done } = result;
-        if (done) {
-          this.push(null);
-          return;
+          const result = iterator.next();
+          const { done } = result;
+          if (done) {
+            this.push(null);
+            return;
+          }
+          batch = result.value;
+          hasBatch = true;
         }
-        batch = result.value;
-        hasBatch = true;
+      } catch (error) {
+        const classicError = toClassicError(error);
+        throw classicError;
       }
     },
     destroy(err, cb) {
       batch = undefined;
       hasBatch = false;
-      if (typeof iterator.return === 'function') iterator.return();
+      try {
+        const returnMethod = iterator.return;
+        if (typeof returnMethod === 'function') {
+          FunctionPrototypeCall(returnMethod, iterator);
+        }
+      } catch (error) {
+        cb(err || toClassicError(error));
+        return;
+      }
       cb(err);
     },
   });
@@ -471,6 +512,9 @@ function fromWritable(writable, options = kNullPrototype) {
   // expose the full stream.Writable property set.
   const hwm = writable.writableHighWaterMark ?? 16384;
   let totalBytes = 0;
+  let errored = false;
+  let error;
+  let pendingEnd;
 
   // Waiters pending on backpressure resolution (block policy only).
   // Multiple un-awaited writes can each add a waiter, so this must be
@@ -504,11 +548,17 @@ function fromWritable(writable, options = kNullPrototype) {
   }
 
   // Reject all pending waiters and remove the drain/error listeners.
-  function cleanup(err) {
+  function cleanup(err, preserveReason = false) {
     const pending = waiters;
     waiters = [];
     for (let i = 0; i < pending.length; i++) {
-      pending[i].reject(err ?? new AbortError());
+      if (!preserveReason &&
+          (err === undefined || err === null) &&
+          pending[i].close !== undefined) {
+        pending[i].close();
+      } else {
+        pending[i].reject(preserveReason ? err : err ?? new AbortError());
+      }
     }
     if (!listenersInstalled) return;
     listenersInstalled = false;
@@ -526,7 +576,8 @@ function fromWritable(writable, options = kNullPrototype) {
   function isWritable() {
     // Duck-typed streams may not have these properties -- treat missing
     // as false (i.e., writable is still open).
-    return !(writable.destroyed ?? false) &&
+    return !errored &&
+           !(writable.destroyed ?? false) &&
            !(writable.writableFinished ?? false) &&
            !(writable.writableEnded ?? false);
   }
@@ -538,7 +589,7 @@ function fromWritable(writable, options = kNullPrototype) {
   function writeChunks(chunks) {
     let ok = true;
     for (let i = 0; i < chunks.length; i++) {
-      const bytes = toUint8Array(chunks[i]);
+      const bytes = chunks[i];
       totalBytes += TypedArrayPrototypeGetByteLength(bytes);
       ok = writable.write(bytes);
     }
@@ -554,10 +605,12 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writeSync(chunk) {
+      toWriterUint8Array(chunk);
       return false;
     },
 
     writevSync(chunks) {
+      convertChunks(chunks);
       return false;
     },
 
@@ -576,18 +629,13 @@ function fromWritable(writable, options = kNullPrototype) {
     // otherwise ignored. Classic stream.Writable has no per-write abort signal
     // support; cancellation should be handled at the pipeline level instead.
     write(chunk, options) {
+      const bytes = toWriterUint8Array(chunk);
       getWriterSignal(options);
+      if (errored) return PromiseReject(error);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
 
-      let bytes;
-      try {
-        bytes = toUint8Array(chunk);
-      } catch (err) {
-        return PromiseReject(err);
-      }
-
       if (backpressure === 'strict' && isFull()) {
         return PromiseReject(new ERR_INVALID_STATE.RangeError(
           'Backpressure violation: buffer is full. ' +
@@ -619,8 +667,9 @@ function fromWritable(writable, options = kNullPrototype) {
     },
 
     writev(chunks, options) {
-      validateArray(chunks, 'chunks');
+      chunks = convertChunks(chunks);
       getWriterSignal(options);
+      if (errored) return PromiseReject(error);
       if (!isWritable()) {
         return PromiseReject(new ERR_STREAM_WRITE_AFTER_END());
       }
@@ -634,8 +683,7 @@ function fromWritable(writable, options = kNullPrototype) {
       if (backpressure === 'drop-newest' && isFull()) {
         // Discard entire batch.
         for (let i = 0; i < chunks.length; i++) {
-          totalBytes +=
-            TypedArrayPrototypeGetByteLength(toUint8Array(chunks[i]));
+          totalBytes += TypedArrayPrototypeGetByteLength(chunks[i]);
         }
         return PromiseResolve();
       }
@@ -670,51 +718,71 @@ function fromWritable(writable, options = kNullPrototype) {
     // write().
     end(options) {
       getWriterSignal(options);
+      if (errored) return PromiseReject(error);
+      if (pendingEnd) return pendingEnd.promise;
       if ((writable.writableFinished ?? false) ||
           (writable.destroyed ?? false)) {
         cleanup();
         return PromiseResolve(totalBytes);
       }
 
-      const { promise, resolve, reject } = PromiseWithResolvers();
+      pendingEnd = PromiseWithResolvers();
+      const { promise, resolve, reject } = pendingEnd;
 
-      if (!(writable.writableEnded ?? false)) {
-        writable.end();
-      }
+      try {
+        if (!(writable.writableEnded ?? false)) {
+          writable.end();
+        }
 
-      eos(writable, { writable: true, readable: false }, (err) => {
-        cleanup(err);
-        if (err) reject(err);
-        else resolve(totalBytes);
-      });
+        eos(writable, { writable: true, readable: false }, (err) => {
+          if (errored) return;
+          pendingEnd = undefined;
+          cleanup(err);
+          if (err) reject(err);
+          else resolve(totalBytes);
+        });
+      } catch (reason) {
+        pendingEnd = undefined;
+        errored = true;
+        error = reason;
+        cleanup(reason, true);
+        reject(reason);
+        try {
+          writable.destroy?.(toClassicError(reason));
+        } catch {
+          // Preserve the original terminal reason.
+        }
+      }
 
       return promise;
     },
 
     fail(reason) {
-      cleanup(reason);
+      if (errored ||
+          (writable.writableFinished ?? false) ||
+          (writable.destroyed ?? false)) {
+        return;
+      }
+      errored = true;
+      error = reason;
+      pendingEnd?.reject(reason);
+      pendingEnd = undefined;
+      cleanup(reason, true);
       if (typeof writable.destroy === 'function') {
-        writable.destroy(reason);
+        writable.destroy(toClassicError(reason));
       }
     },
 
     [SymbolAsyncDispose]() {
+      if (pendingEnd) return pendingEnd.promise;
       if (isWritable()) {
-        cleanup();
-        if (typeof writable.destroy === 'function') {
-          writable.destroy();
-        }
+        this.fail();
       }
       return PromiseResolve();
     },
 
     [SymbolDispose]() {
-      if (isWritable()) {
-        cleanup();
-        if (typeof writable.destroy === 'function') {
-          writable.destroy();
-        }
-      }
+      this.fail();
     },
   };
 
@@ -724,11 +792,12 @@ function fromWritable(writable, options = kNullPrototype) {
     if ((writable.writableLength ?? 0) < hwm) {
       return PromiseResolve(true);
     }
-    const { promise, resolve } = PromiseWithResolvers();
+    const { promise, resolve, reject } = PromiseWithResolvers();
     ArrayPrototypePush(waiters, {
       __proto__: null,
       resolve() { resolve(true); },
-      reject() { resolve(false); },
+      reject,
+      close() { resolve(false); },
     });
     installListeners();
     return promise;
@@ -766,6 +835,7 @@ function toWritable(writer) {
   const hasEndSync = hasEnd &&
                      typeof writer.endSync === 'function';
   const hasFail = typeof writer.fail === 'function';
+  const classicErrorReasons = new SafeWeakMap();
   // Try-sync-first pattern: attempt the synchronous method and fall back to the
   // async method if it returns false (data not accepted synchronously).
   // When the sync path succeeds, the callback is deferred via queueMicrotask
@@ -783,14 +853,16 @@ function toWritable(writer) {
         }
         // WriteSync returned false: not accepted, fall through to async.
       } catch (err) {
-        cb(err);
+        cb(toClassicError(err, classicErrorReasons));
         return;
       }
     }
     try {
-      PromisePrototypeThen(writer.write(bytes), () => cb(), cb);
+      PromisePrototypeThen(
+        writer.write(bytes), () => cb(),
+        (err) => cb(toClassicError(err, classicErrorReasons)));
     } catch (err) {
-      cb(err);
+      cb(toClassicError(err, classicErrorReasons));
     }
   }
 
@@ -809,14 +881,16 @@ function toWritable(writer) {
         }
         // WritevSync returned false: not accepted, fall through to async.
       } catch (err) {
-        cb(err);
+        cb(toClassicError(err, classicErrorReasons));
         return;
       }
     }
     try {
-      PromisePrototypeThen(writer.writev(chunks), () => cb(), cb);
+      PromisePrototypeThen(
+        writer.writev(chunks), () => cb(),
+        (err) => cb(toClassicError(err, classicErrorReasons)));
     } catch (err) {
-      cb(err);
+      cb(toClassicError(err, classicErrorReasons));
     }
   }
 
@@ -834,22 +908,31 @@ function toWritable(writer) {
         }
         // Result < 0: can't end synchronously, fall through to async.
       } catch (err) {
-        cb(err);
+        cb(toClassicError(err, classicErrorReasons));
         return;
       }
     }
     try {
-      PromisePrototypeThen(writer.end(), () => cb(), cb);
+      PromisePrototypeThen(
+        writer.end(), () => cb(),
+        (err) => cb(toClassicError(err, classicErrorReasons)));
     } catch (err) {
-      cb(err);
+      cb(toClassicError(err, classicErrorReasons));
     }
   }
 
   function _destroy(err, cb) {
     if (err && hasFail) {
-      writer.fail(err);
+      const wrapped = classicErrorReasons.get(err);
+      classicErrorReasons.delete(err);
+      try {
+        writer.fail(wrapped === undefined ? err : wrapped.reason);
+      } catch (error) {
+        cb(err || toClassicError(error, classicErrorReasons));
+        return;
+      }
     }
-    cb();
+    cb(err);
   }
 
   const writableOptions = {
diff --git a/lib/internal/streams/iter/consumers.js b/lib/internal/streams/iter/consumers.js
index e3bd7856dcd4..75ad4026ad7c 100644
--- a/lib/internal/streams/iter/consumers.js
+++ b/lib/internal/streams/iter/consumers.js
@@ -18,6 +18,8 @@ const {
   Promise,
   PromisePrototypeThen,
   SafePromiseAllReturnVoid,
+  SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -34,11 +36,7 @@ const {
 } = require('internal/errors');
 const { TextDecoder } = require('internal/encoding');
 const {
-  validateAbortSignal,
   validateFunction,
-  validateInteger,
-  validateObject,
-  validateString,
 } = require('internal/validators');
 
 const {
@@ -54,6 +52,8 @@ const {
 
 const {
   concatBytes,
+  createBatchEntry,
+  validateBatchEntry,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
 
@@ -62,6 +62,9 @@ const {
   toAsyncStreamable,
   toStreamable,
 } = require('internal/streams/iter/types');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   isAnyArrayBuffer,
@@ -89,6 +92,17 @@ function isMergeOptions(value) {
 // Shared chunk collection helpers
 // =============================================================================
 
+function flattenBatchEntries(entries) {
+  const chunks = [];
+  for (let i = 0; i < entries.length; i++) {
+    const batch = validateBatchEntry(entries[i]);
+    for (let j = 0; j < batch.length; j++) {
+      ArrayPrototypePush(chunks, batch[j]);
+    }
+  }
+  return chunks;
+}
+
 /**
  * Collect chunks from a sync source into an array.
  * @param {Iterable<Uint8Array[]>} source
@@ -98,23 +112,23 @@ function isMergeOptions(value) {
 function collectSync(source, limit) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  const chunks = [];
+  const entries = [];
   let totalBytes = 0;
 
   for (const batch of normalized) {
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -128,19 +142,15 @@ async function collectAsync(source, signal, limit) {
   signal?.throwIfAborted();
 
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
-  const abortableSource = signal && isAsyncIterable(source) ?
-    yieldAbortable(source, signal) : source;
-  const normalized = from(abortableSource);
-  const chunks = [];
+  const normalized = from(source);
+  const entries = [];
 
   // Fast path: no signal and no limit
   if (!signal && limit === undefined) {
     for await (const batch of normalized) {
-      for (let i = 0; i < batch.length; i++) {
-        ArrayPrototypePush(chunks, batch[i]);
-      }
+      ArrayPrototypePush(entries, createBatchEntry(batch));
     }
-    return chunks;
+    return flattenBatchEntries(entries);
   }
 
   // Slow path: with signal or limit checks
@@ -149,19 +159,19 @@ async function collectAsync(source, signal, limit) {
 
   for await (const batch of iterable) {
     signal?.throwIfAborted();
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (limit !== undefined) {
-        totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+    const entry = createBatchEntry(batch);
+    if (limit !== undefined) {
+      for (let i = 0; i < entry.views.length; i++) {
+        totalBytes += entry.views[i].byteLength;
         if (totalBytes > limit) {
           throw new ERR_OUT_OF_RANGE('totalBytes', `<= ${limit}`, totalBytes);
         }
       }
-      ArrayPrototypePush(chunks, chunk);
     }
+    ArrayPrototypePush(entries, entry);
   }
 
-  return chunks;
+  return flattenBatchEntries(entries);
 }
 
 /**
@@ -186,37 +196,6 @@ function toArrayBuffer(data) {
                                    byteOffset + byteLength);
 }
 
-// =============================================================================
-// Shared option validation
-// =============================================================================
-
-function validateBaseConsumerOptions(options) {
-  validateObject(options, 'options');
-  if (options.limit !== undefined) {
-    validateInteger(options.limit, 'options.limit', 0);
-  }
-  if (options.encoding !== undefined) {
-    validateString(options.encoding, 'options.encoding');
-    try {
-      new TextDecoder(options.encoding);
-    } catch {
-      throw new ERR_INVALID_ARG_VALUE.RangeError(
-        'options.encoding', options.encoding);
-    }
-  }
-}
-
-function validateConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-  if (options.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
-}
-
-function validateSyncConsumerOptions(options) {
-  validateBaseConsumerOptions(options);
-}
-
 // =============================================================================
 // Sync Consumers
 // =============================================================================
@@ -230,7 +209,10 @@ const kNullPrototype = { __proto__: null };
  * @returns {Uint8Array}
  */
 function bytesSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return concatBytes(collectSync(source, options.limit));
 }
 
@@ -241,9 +223,18 @@ function bytesSync(source, options = kNullPrototype) {
  * @returns {string}
  */
 function textSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.TextConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const data = concatBytes(collectSync(source, options.limit));
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -257,7 +248,10 @@ function textSync(source, options = kNullPrototype) {
  * @returns {ArrayBuffer}
  */
 function arrayBufferSync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return toArrayBuffer(concatBytes(collectSync(source, options.limit)));
 }
 
@@ -268,7 +262,10 @@ function arrayBufferSync(source, options = kNullPrototype) {
  * @returns {Uint8Array[]}
  */
 function arraySync(source, options = kNullPrototype) {
-  validateSyncConsumerOptions(options);
+  options = converters.ConsumeSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectSync(source, options.limit);
 }
 
@@ -283,7 +280,10 @@ function arraySync(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array>}
  */
 async function bytes(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return concatBytes(chunks);
 }
@@ -295,10 +295,19 @@ async function bytes(source, options = kNullPrototype) {
  * @returns {Promise<string>}
  */
 async function text(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.TextConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
+  try {
+    new TextDecoder(options.encoding);
+  } catch {
+    throw new ERR_INVALID_ARG_VALUE.RangeError(
+      'options.encoding', options.encoding);
+  }
   const chunks = await collectAsync(source, options.signal, options.limit);
   const data = concatBytes(chunks);
-  const decoder = new TextDecoder(options.encoding ?? 'utf-8', {
+  const decoder = new TextDecoder(options.encoding, {
     __proto__: null,
     fatal: true,
   });
@@ -312,7 +321,10 @@ async function text(source, options = kNullPrototype) {
  * @returns {Promise<ArrayBuffer>}
  */
 async function arrayBuffer(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const chunks = await collectAsync(source, options.signal, options.limit);
   return toArrayBuffer(concatBytes(chunks));
 }
@@ -324,7 +336,10 @@ async function arrayBuffer(source, options = kNullPrototype) {
  * @returns {Promise<Uint8Array[]>}
  */
 async function array(source, options = kNullPrototype) {
-  validateConsumerOptions(options);
+  options = converters.ConsumeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   return collectAsync(source, options.signal, options.limit);
 }
 
@@ -390,6 +405,8 @@ function ondrain(drainable) {
 // Merge Utility
 // =============================================================================
 
+const kNoMergeError = Symbol('kNoMergeError');
+
 /**
  * Merge multiple async iterables by yielding values in temporal order.
  * @param {...(AsyncIterable<Uint8Array[]>|object)} args
@@ -406,9 +423,10 @@ function merge(...args) {
     sources = args;
   }
 
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  options = converters.MergeOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
 
   // Normalize each source via from()
   const normalized = ArrayPrototypeMap(sources, (source) => from(source));
@@ -416,7 +434,7 @@ function merge(...args) {
   return {
     __proto__: null,
     async *[SymbolAsyncIterator]() {
-      const signal = options?.signal;
+      const { signal } = options;
 
       signal?.throwIfAborted();
 
@@ -437,9 +455,11 @@ function merge(...args) {
       // async tick per batch. Each source has at most one pending .next()
       // at a time. Every batch from every source is preserved.
       const ready = [];
+      const pendingPulls = new SafeSet();
       let activeCount = normalized.length;
       let waitResolve = null;
       let onAbort;
+      let stopped = false;
 
       if (signal) {
         onAbort = () => {
@@ -457,11 +477,14 @@ function merge(...args) {
       // Called when a source's .next() settles. Pushes the result into
       // the ready queue and wakes the consumer if it's waiting.
       const onSettled = (iterator, result) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
         if (result.done) {
           activeCount--;
         } else {
           ArrayPrototypePush(ready, {
             __proto__: null,
+            kind: 'value',
             iterator,
             value: result.value,
           });
@@ -472,25 +495,34 @@ function merge(...args) {
         }
       };
 
+      const onRejected = (iterator, reason) => {
+        pendingPulls.delete(iterator);
+        if (stopped) return;
+        ArrayPrototypePush(ready, {
+          __proto__: null,
+          kind: 'error',
+          reason,
+        });
+        if (waitResolve) {
+          waitResolve();
+          waitResolve = null;
+        }
+      };
+
       // Start one .next() per source
       const iterators = [];
       for (let i = 0; i < normalized.length; i++) {
         const iterator = normalized[i][SymbolAsyncIterator]();
         ArrayPrototypePush(iterators, iterator);
+        pendingPulls.add(iterator);
         PromisePrototypeThen(
           iterator.next(),
           (r) => onSettled(iterator, r),
-          (err) => {
-            ArrayPrototypePush(ready, { __proto__: null, error: err });
-            if (waitResolve) {
-              waitResolve();
-              waitResolve = null;
-            }
-          },
+          (reason) => onRejected(iterator, reason),
         );
       }
 
-      let primaryError;
+      let primaryError = kNoMergeError;
       try {
         while (activeCount > 0 || ready.length > 0) {
           signal?.throwIfAborted();
@@ -498,20 +530,15 @@ function merge(...args) {
           // Drain ready queue synchronously
           while (ready.length > 0) {
             const item = ArrayPrototypeShift(ready);
-            if (item?.error) {
-              throw item.error;
+            if (item.kind === 'error') {
+              throw item.reason;
             }
             yield item.value;
+            pendingPulls.add(item.iterator);
             PromisePrototypeThen(
               item.iterator.next(),
               (r) => onSettled(item.iterator, r),
-              (err) => {
-                ArrayPrototypePush(ready, { __proto__: null, error: err });
-                if (waitResolve) {
-                  waitResolve();
-                  waitResolve = null;
-                }
-              },
+              (reason) => onRejected(item.iterator, reason),
             );
           }
 
@@ -529,6 +556,7 @@ function merge(...args) {
       } catch (err) {
         primaryError = err;
       } finally {
+        stopped = true;
         if (onAbort !== undefined) {
           signal.removeEventListener('abort', onAbort);
         }
@@ -538,32 +566,32 @@ function merge(...args) {
         await cleanupIterators(
           iterators,
           primaryError,
-          signal?.aborted && primaryError === signal.reason,
+          pendingPulls,
         );
       }
     },
   };
 }
 
-async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
-  let cleanupError;
+async function cleanupIterators(iterators, primaryError, pendingPulls) {
+  let cleanupError = kNoMergeError;
   await SafePromiseAllReturnVoid(iterators, async (iterator) => {
     if (iterator.return) {
       try {
         const result = iterator.return();
-        if (skipAwaitCleanup) {
+        if (pendingPulls.has(iterator)) {
           markPromiseAsHandled(result);
         } else {
           await result;
         }
       } catch (err) {
         // Keep the first cleanup error encountered.
-        cleanupError ??= err;
+        if (cleanupError === kNoMergeError) cleanupError = err;
       }
     }
   });
-  if (cleanupError !== undefined) {
-    if (primaryError !== undefined) {
+  if (cleanupError !== kNoMergeError) {
+    if (primaryError !== kNoMergeError) {
       // Both a primary error and a cleanup error occurred.
       // Wrap in SuppressedError so neither is lost:
       // .error = primaryError, .suppressed = cleanupError.
@@ -573,7 +601,7 @@ async function cleanupIterators(iterators, primaryError, skipAwaitCleanup) {
     // No primary error - the cleanup error is the only error.
     throw cleanupError;
   }
-  if (primaryError !== undefined) {
+  if (primaryError !== kNoMergeError) {
     throw primaryError;
   }
 }
diff --git a/lib/internal/streams/iter/duplex.js b/lib/internal/streams/iter/duplex.js
index b37b91279232..674ef81a53c9 100644
--- a/lib/internal/streams/iter/duplex.js
+++ b/lib/internal/streams/iter/duplex.js
@@ -6,17 +6,18 @@
 // channel's writer appears in the other channel's readable.
 
 const {
+  SafePromiseAllReturnVoid,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
 } = primordials;
 
 const {
+  isConsumerReturnError,
   push,
 } = require('internal/streams/iter/push');
 const {
-  validateAbortSignal,
-  validateObject,
-} = require('internal/validators');
+  converters,
+} = require('internal/streams/iter/webidl');
 
 /**
  * Create a pair of connected duplex channels for bidirectional communication.
@@ -25,17 +26,11 @@ const {
  * @returns {[DuplexChannel, DuplexChannel]}
  */
 function duplex(options = { __proto__: null }) {
-  validateObject(options, 'options');
+  options = converters.DuplexOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const { budget, backpressure, signal, a, b } = options;
-  if (a !== undefined) {
-    validateObject(a, 'options.a');
-  }
-  if (b !== undefined) {
-    validateObject(b, 'options.b');
-  }
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   // Channel A writes to B's readable (A->B direction).
   // Signal is NOT passed to push() -- we handle abort via close() below.
@@ -50,68 +45,8 @@ function duplex(options = { __proto__: null }) {
     backpressure: b?.backpressure ?? backpressure,
   });
 
-  let aClosed = false;
-  let bClosed = false;
-  // Track active iterators so close() can call .return() on them
-  let aReadableIterator = null;
-  let bReadableIterator = null;
-
-  const channelA = {
-    __proto__: null,
-    get writer() { return aWriter; },
-    // Wrap readable to track the iterator for cleanup on close()
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = aReadable[SymbolAsyncIterator]();
-          aReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (aClosed) return;
-      aClosed = true;
-      // End the writer (signals end-of-stream to B's readable)
-      aWriter.endSync();
-      // Stop iteration of this channel's readable
-      if (aReadableIterator?.return) {
-        await aReadableIterator.return();
-        aReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
-
-  const channelB = {
-    __proto__: null,
-    get writer() { return bWriter; },
-    get readable() {
-      return {
-        __proto__: null,
-        [SymbolAsyncIterator]() {
-          const iter = bReadable[SymbolAsyncIterator]();
-          bReadableIterator = iter;
-          return iter;
-        },
-      };
-    },
-    async close() {
-      if (bClosed) return;
-      bClosed = true;
-      bWriter.endSync();
-      if (bReadableIterator?.return) {
-        await bReadableIterator.return();
-        bReadableIterator = null;
-      }
-    },
-    [SymbolAsyncDispose]() {
-      return this.close();
-    },
-  };
+  const channelA = createDuplexChannel(aWriter, aReadable);
+  const channelB = createDuplexChannel(bWriter, bReadable);
 
   // Signal handler: fail both writers with the abort reason so consumers
   // see the error. This is an error-path shutdown, not a clean close.
@@ -132,6 +67,42 @@ function duplex(options = { __proto__: null }) {
   return [channelA, channelB];
 }
 
+function createDuplexChannel(writer, readable) {
+  // A push readable has one shared consumer state. Keeping an iterator from
+  // creation lets close() terminate that state even if no caller has iterated.
+  const closeIterator = readable[SymbolAsyncIterator]();
+  let closePromise;
+
+  return {
+    __proto__: null,
+    get writer() { return writer; },
+    get readable() { return readable; },
+    close() {
+      closePromise ??= closeDuplexChannel(writer, closeIterator);
+      return closePromise;
+    },
+    [SymbolAsyncDispose]() {
+      return this.close();
+    },
+  };
+}
+
+async function closeDuplexChannel(writer, closeIterator) {
+  const result = writer.endSync();
+  const endPromise = result < 0 ? writer.end() : undefined;
+  const returnPromise = closeIterator.return();
+
+  if (endPromise !== undefined) {
+    try {
+      await SafePromiseAllReturnVoid([endPromise, returnPromise]);
+    } catch (error) {
+      if (!isConsumerReturnError(error)) throw error;
+    }
+  } else {
+    await returnPromise;
+  }
+}
+
 module.exports = {
   duplex,
 };
diff --git a/lib/internal/streams/iter/from.js b/lib/internal/streams/iter/from.js
index 59ac6a15775b..7fe03511861f 100644
--- a/lib/internal/streams/iter/from.js
+++ b/lib/internal/streams/iter/from.js
@@ -15,6 +15,7 @@ const {
   DataViewPrototypeGetByteLength,
   DataViewPrototypeGetByteOffset,
   FunctionPrototypeCall,
+  PromisePrototypeThen,
   SymbolAsyncIterator,
   SymbolIterator,
   TypedArrayPrototypeGetBuffer,
@@ -23,6 +24,8 @@ const {
   Uint8Array,
 } = primordials;
 
+const { markPromiseAsHandled } = internalBinding('util');
+
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
@@ -360,9 +363,13 @@ async function* normalizeAsyncSource(source) {
         continue;
       }
       // Slow path: normalize the value
-      const batch = [];
+      let batch = [];
       for await (const chunk of normalizeAsyncValue(value)) {
         ArrayPrototypePush(batch, chunk);
+        if (batch.length === FROM_BATCH_SIZE) {
+          yield batch;
+          batch = [];
+        }
       }
       if (batch.length > 0) {
         yield batch;
@@ -594,7 +601,11 @@ function from(input) {
   // Check toAsyncStreamable protocol (takes precedence over toStreamable and
   // iteration protocols)
   if (typeof input[toAsyncStreamable] === 'function') {
-    const result = input[toAsyncStreamable]();
+    let result = input[toAsyncStreamable]();
+    if (isPromise(result)) {
+      result = PromisePrototypeThen(result, undefined, undefined);
+      markPromiseAsHandled(result);
+    }
     // Synchronous validated source (e.g. Readable batched iterator)
     if (result?.[kValidatedSource]) {
       return result;
diff --git a/lib/internal/streams/iter/pull.js b/lib/internal/streams/iter/pull.js
index b6c2d9849c42..01a9504dc871 100644
--- a/lib/internal/streams/iter/pull.js
+++ b/lib/internal/streams/iter/pull.js
@@ -8,15 +8,13 @@
 
 const {
   ArrayBufferIsView,
-  ArrayFromAsync,
-  ArrayIsArray,
   ArrayPrototypePush,
   ArrayPrototypeSlice,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   SymbolAsyncIterator,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
   Uint8Array,
 } = primordials;
 
@@ -24,17 +22,21 @@ const {
   codes: {
     ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
+    ERR_INVALID_STATE,
     ERR_OUT_OF_RANGE,
   },
 } = require('internal/errors');
 const { lazyDOMException } = require('internal/util');
-const { validateAbortSignal } = require('internal/validators');
 const {
   isAnyArrayBuffer,
   isPromise,
   isUint8Array,
 } = require('internal/util/types');
-const { AbortController } = require('internal/abort_controller');
+const {
+  AbortController,
+  AbortSignal,
+  abortSignal,
+} = require('internal/abort_controller');
 
 const {
   arrayBufferViewToUint8Array,
@@ -42,26 +44,25 @@ const {
   fromSync,
   isSyncIterable,
   isAsyncIterable,
-  isPrimitiveChunk,
   isUint8ArrayBatch,
-  normalizeAsyncValue,
 } = require('internal/streams/iter/from');
 
 const {
-  isPullOptions,
+  createBatchEntry,
   isTransform,
   isTransformObject,
   parsePullArgs,
   toUint8Array,
-  wrapError,
+  validateBatchEntry,
+  validateByteView,
   yieldAbortable,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
-  kValidatedSource,
   kValidatedTransform,
-  toAsyncStreamable,
-  toStreamable,
 } = require('internal/streams/iter/types');
 
 // =============================================================================
@@ -80,7 +81,7 @@ function hasMethod(value, name) {
  * Parse pipeTo/pipeToSync arguments: [...transforms, writer, options?]
  * @param {Array} args
  * @param {string} requiredMethod - 'write' for pipeTo, 'writeSync' for pipeToSync
- * @returns {{ transforms: Array, writer: object, options: object }}
+ * @returns {{ transforms: Array, writer: object, options: unknown }}
  */
 function parsePipeToArgs(args, requiredMethod) {
   if (args.length === 0) {
@@ -92,7 +93,7 @@ function parsePipeToArgs(args, requiredMethod) {
 
   // Check if last arg is options
   const last = args[args.length - 1];
-  if (isPullOptions(last) && !hasMethod(last, requiredMethod)) {
+  if (!isTransform(last) && !hasMethod(last, requiredMethod)) {
     options = last;
     writerIndex = args.length - 2;
   }
@@ -124,22 +125,6 @@ function parsePipeToArgs(args, requiredMethod) {
   };
 }
 
-function canUseSyncIterablePipeToFastPath(source, transforms, signal) {
-  if (signal !== undefined ||
-      transforms.length !== 0 ||
-      isPrimitiveChunk(source) ||
-      ArrayIsArray(source) ||
-      source?.[kValidatedSource] ||
-      !isSyncIterable(source) ||
-      isAsyncIterable(source)) {
-    return false;
-  }
-
-  // Preserve from()'s top-level protocol precedence for custom iterables.
-  return typeof source[toAsyncStreamable] !== 'function' &&
-    typeof source[toStreamable] !== 'function';
-}
-
 // =============================================================================
 // Transform Output Flattening
 // =============================================================================
@@ -521,8 +506,9 @@ function* withFlushSync(source) {
   yield null;
 }
 
-function* applyStatefulSyncTransform(source, transform) {
-  const output = transform(withFlushSync(source));
+function* applyStatefulSyncTransform(source, transform, receiver) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushSync(source));
   for (const item of output) {
     if (item === null) continue;
     const batch = [];
@@ -553,7 +539,8 @@ function* createSyncPipeline(source, transforms) {
         current = applyFusedStatelessSyncTransforms(current, statelessRun);
         statelessRun = [];
       }
-      current = applyStatefulSyncTransform(current, transform.transform);
+      current = applyStatefulSyncTransform(
+        current, transform.transform, transform);
     } else {
       ArrayPrototypePush(statelessRun, transform);
     }
@@ -664,8 +651,10 @@ async function* withFlushAsync(source) {
   yield null;
 }
 
-async function* applyStatefulAsyncTransform(source, transform, options) {
-  const output = transform(withFlushAsync(source), options);
+async function* applyStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, withFlushAsync(source), options);
   for await (const item of output) {
     if (item === null) continue;
     // Fast path: item is already a Uint8Array[] batch (e.g. compression transforms)
@@ -697,8 +686,10 @@ async function* applyStatefulAsyncTransform(source, transform, options) {
  * skips isUint8ArrayBatch validation (transform guarantees valid output).
  * @yields {Uint8Array[]}
  */
-async function* applyValidatedStatefulAsyncTransform(source, transform, options) {
-  const output = transform(source, options);
+async function* applyValidatedStatefulAsyncTransform(
+  source, transform, receiver, options) {
+  const output = FunctionPrototypeCall(
+    transform, receiver, source, options);
   for await (const batch of output) {
     if (batch.length > 0) {
       yield batch;
@@ -732,8 +723,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
   let abortHandler;
   if (signal) {
     abortHandler = () => {
-      controller.abort(signal.reason ??
-        lazyDOMException('Aborted', 'AbortError'));
+      abortSignal(controller.signal, signal.reason);
     };
     signal.addEventListener('abort', abortHandler, { __proto__: null, once: true });
   }
@@ -766,10 +756,10 @@ async function* createAsyncPipeline(source, transforms, signal) {
       const opts = { __proto__: null, signal: transformSignal };
       if (transform[kValidatedTransform]) {
         current = applyValidatedStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       } else {
         current = applyStatefulAsyncTransform(
-          current, transform.transform, opts);
+          current, transform.transform, transform, opts);
       }
     } else {
       ArrayPrototypePush(statelessRun, transform);
@@ -794,7 +784,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
     completed = true;
   } catch (error) {
     if (!controller.signal.aborted) {
-      controller.abort(wrapError(error));
+      abortSignal(controller.signal, error);
     }
     throw error;
   } finally {
@@ -821,6 +811,7 @@ async function* createAsyncPipeline(source, transforms, signal) {
  * @returns {Iterable<Uint8Array[]>}
  */
 function pullSync(source, ...transforms) {
+  const normalized = fromSync(source);
   for (let i = 0; i < transforms.length; i++) {
     if (!isTransform(transforms[i])) {
       throw new ERR_INVALID_ARG_TYPE(
@@ -831,7 +822,7 @@ function pullSync(source, ...transforms) {
   return {
     __proto__: null,
     *[SymbolIterator]() {
-      yield* createSyncPipeline(fromSync(source), transforms);
+      yield* createSyncPipeline(normalized, transforms);
     },
   };
 }
@@ -844,26 +835,127 @@ function pullSync(source, ...transforms) {
  * @returns {AsyncIterable<Uint8Array[]>}
  */
 function pull(source, ...args) {
-  const { transforms, options } = parsePullArgs(args);
-  const signal = options?.signal;
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-    // Eagerly check abort at call time per spec
-    if (signal.aborted) {
+  const parsed = parsePullArgs(args);
+  const { transforms } = parsed;
+  const options = converters.PullOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
+  const normalized = from(source);
+  signal?.throwIfAborted();
+
+  return {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      const controller = new AbortController();
+      const iteratorSignal = signal === undefined ?
+        controller.signal : AbortSignal.any([signal, controller.signal]);
+
+      async function* pipeline() {
+        yield* createAsyncPipeline(normalized, transforms, iteratorSignal);
+      }
+      const iterator = pipeline();
+
       return {
         __proto__: null,
-        // eslint-disable-next-line require-yield
-        async *[SymbolAsyncIterator]() {
-          throw signal.reason;
+        next(value) {
+          return iterator.next(value);
+        },
+        return(value) {
+          controller.abort(lazyDOMException('Aborted', 'AbortError'));
+          return iterator.return(value);
+        },
+        throw(error) {
+          abortSignal(controller.signal, error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
         },
       };
+    },
+  };
+}
+
+// Keep ownership of a bonded consumer outside the transform pipeline so it can
+// be detached even when the pipeline never starts or terminates early.
+function pullWithConsumerCleanup(source, transforms, signal) {
+  const sourceIterator = source[SymbolAsyncIterator]();
+  const pipelineSource = {
+    __proto__: null,
+    [SymbolAsyncIterator]() {
+      return sourceIterator;
+    },
+  };
+  let sourceClosed = false;
+  let abortHandler;
+
+  function closeSource(method, value) {
+    if (sourceClosed) return;
+    sourceClosed = true;
+    if (abortHandler !== undefined) {
+      signal.removeEventListener('abort', abortHandler);
     }
+    const close = sourceIterator[method] ?? sourceIterator.return;
+    if (typeof close === 'function') {
+      const result = FunctionPrototypeCall(close, sourceIterator, value);
+      PromisePrototypeThen(PromiseResolve(result), undefined, () => {});
+    }
+  }
+
+  if (signal?.aborted) {
+    closeSource('throw', signal.reason);
+    return {
+      __proto__: null,
+      // eslint-disable-next-line require-yield
+      async *[SymbolAsyncIterator]() {
+        throw signal.reason;
+      },
+    };
+  }
+
+  const pipeline = signal === undefined ?
+    pull(pipelineSource, ...transforms) :
+    pull(pipelineSource, ...transforms, { __proto__: null, signal });
+
+  if (signal !== undefined) {
+    abortHandler = () => closeSource('throw', signal.reason);
+    signal.addEventListener('abort', abortHandler,
+                            { __proto__: null, once: true });
+    if (signal.aborted) abortHandler();
   }
 
   return {
     __proto__: null,
-    async *[SymbolAsyncIterator]() {
-      yield* createAsyncPipeline(from(source), transforms, signal);
+    [SymbolAsyncIterator]() {
+      const iterator = pipeline[SymbolAsyncIterator]();
+      return {
+        __proto__: null,
+        next(value) {
+          return PromisePrototypeThen(
+            iterator.next(value),
+            (result) => {
+              if (result.done) closeSource('return');
+              return result;
+            },
+            (error) => {
+              closeSource('throw', error);
+              throw error;
+            });
+        },
+        return(value) {
+          closeSource('return', value);
+          return iterator.return(value);
+        },
+        throw(error) {
+          closeSource('throw', error);
+          return iterator.throw(error);
+        },
+        [SymbolAsyncIterator]() {
+          return this;
+        },
+      };
     },
   };
 }
@@ -879,7 +971,19 @@ function pull(source, ...args) {
  * @returns {number} Total bytes written
  */
 function pipeToSync(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'writeSync');
+  const parsed = parsePipeToArgs(args, 'writeSync');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToSyncOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const hasWritevSync = typeof writer.writevSync === 'function';
+  const endSync = writer.endSync;
+
+  if (!options.preventClose && typeof endSync !== 'function') {
+    throw new ERR_INVALID_ARG_TYPE(
+      'writer.endSync', 'Function', endSync);
+  }
 
   // Normalize source and create pipeline
   const normalized = fromSync(source);
@@ -888,39 +992,42 @@ function pipeToSync(source, ...args) {
     normalized;
 
   let totalBytes = 0;
-  const hasWritevSync = typeof writer.writevSync === 'function';
-  const hasEndSync = typeof writer.endSync === 'function';
 
   try {
     for (const batch of pipeline) {
+      const entry = createBatchEntry(batch);
       if (hasWritevSync && batch.length > 1) {
-        if (writer.writevSync(batch) === false) {
+        const accepted = writer.writevSync(validateBatchEntry(entry));
+        validateBatchEntry(entry);
+        if (accepted === false) {
           throw new ERR_OUT_OF_RANGE(
             'write', 'within byte budget', 'budget exhausted');
         }
-        for (let i = 0; i < batch.length; i++) {
-          totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-        }
+        totalBytes += entry.byteLength;
       } else {
-        for (let i = 0; i < batch.length; i++) {
-          const chunk = batch[i];
-          if (writer.writeSync(chunk) === false) {
+        for (let i = 0; i < entry.views.length; i++) {
+          const view = entry.views[i];
+          const chunk = validateByteView(view);
+          const accepted = writer.writeSync(chunk);
+          validateByteView(view);
+          if (accepted === false) {
             throw new ERR_OUT_OF_RANGE(
               'write', 'within byte budget', 'budget exhausted');
           }
-          totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+          totalBytes += view.byteLength;
         }
       }
     }
 
-    if (!options?.preventClose) {
-      if (!hasEndSync || writer.endSync() < 0) {
-        writer.end?.();
+    if (!options.preventClose) {
+      if (FunctionPrototypeCall(endSync, writer) < 0) {
+        throw new ERR_INVALID_STATE(
+          'Writer could not be closed synchronously');
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
-      writer.fail?.(wrapError(error));
+    if (!options.preventFail) {
+      writer.fail?.(error);
     }
     throw error;
   }
@@ -935,20 +1042,29 @@ function pipeToSync(source, ...args) {
  * @returns {Promise<number>} Total bytes written
  */
 async function pipeTo(source, ...args) {
-  const { transforms, writer, options } = parsePipeToArgs(args, 'write');
-  if (options?.signal !== undefined) {
-    validateAbortSignal(options.signal, 'options.signal');
-  }
+  const parsed = parsePipeToArgs(args, 'write');
+  const { transforms, writer } = parsed;
+  const options = converters.PipeToOptions(parsed.options, {
+    __proto__: null,
+    context: 'options',
+  });
+  const { signal } = options;
 
-  const signal = options?.signal;
+  function failWriter(error) {
+    if (!options.preventFail) {
+      writer.fail?.(error);
+    }
+  }
 
-  // Check for abort
-  signal?.throwIfAborted();
+  try {
+    signal?.throwIfAborted();
+  } catch (error) {
+    failWriter(error);
+    throw error;
+  }
 
   const hasWriteSync = typeof writer.writeSync === 'function';
-  const useSyncIterableFastPath =
-    hasWriteSync && canUseSyncIterablePipeToFastPath(source, transforms, signal);
-  const normalized = useSyncIterableFastPath ? undefined : from(source);
+  const normalized = from(source);
 
   let totalBytes = 0;
   const hasWritev = typeof writer.writev === 'function';
@@ -957,19 +1073,26 @@ async function pipeTo(source, ...args) {
 
   // Async fallback for writeBatch when sync write fails partway through.
   // Continues writing from batch[startIndex] using async write().
-  async function writeBatchAsyncFallback(batch, startIndex) {
-    for (let i = startIndex; i < batch.length; i++) {
-      const chunk = batch[i];
-      if (hasWriteSync && writer.writeSync(chunk)) {
-        // Sync retry succeeded
-      } else {
-        const result = writer.write(
-          chunk, signal ? { __proto__: null, signal } : undefined);
-        if (result !== undefined) {
-          await result;
+  async function writeBatchAsyncFallback(entry, startIndex) {
+    for (let i = startIndex; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      if (hasWriteSync) {
+        const chunk = validateByteView(view);
+        if (writer.writeSync(chunk)) {
+          validateByteView(view);
+          totalBytes += view.byteLength;
+          continue;
         }
+        validateByteView(view);
+      }
+      const result = writer.write(
+        validateByteView(view),
+        signal ? { __proto__: null, signal } : undefined);
+      if (result !== undefined) {
+        await result;
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
@@ -977,63 +1100,42 @@ async function pipeTo(source, ...args) {
   // Returns undefined on sync success, or a Promise when async fallback
   // is required. Callers must check: const p = writeBatch(b); if (p) await p;
   function writeBatch(batch) {
+    const entry = createBatchEntry(batch);
     if (hasWritev && batch.length > 1) {
-      if (!hasWritevSync || !writer.writevSync(batch)) {
+      if (!hasWritevSync ||
+          !writer.writevSync(validateBatchEntry(entry))) {
+        validateBatchEntry(entry);
         const opts = signal ? { __proto__: null, signal } : undefined;
-        const writevResult = writer.writev(batch, opts);
+        const writevResult = writer.writev(validateBatchEntry(entry), opts);
         if (writevResult === undefined) {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
           return;
         }
         return PromisePrototypeThen(PromiseResolve(writevResult), () => {
-          for (let i = 0; i < batch.length; i++) {
-            totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-          }
+          validateBatchEntry(entry);
+          totalBytes += entry.byteLength;
         });
       }
-      for (let i = 0; i < batch.length; i++) {
-        totalBytes += TypedArrayPrototypeGetByteLength(batch[i]);
-      }
+      validateBatchEntry(entry);
+      totalBytes += entry.byteLength;
       return;
     }
-    for (let i = 0; i < batch.length; i++) {
-      const chunk = batch[i];
+    for (let i = 0; i < entry.views.length; i++) {
+      const view = entry.views[i];
+      const chunk = validateByteView(view);
       if (!hasWriteSync || !writer.writeSync(chunk)) {
+        if (hasWriteSync) validateByteView(view);
         // Sync path failed at index i - fall back to async for the rest.
-        return writeBatchAsyncFallback(batch, i);
+        return writeBatchAsyncFallback(entry, i);
       }
-      totalBytes += TypedArrayPrototypeGetByteLength(chunk);
+      validateByteView(view);
+      totalBytes += view.byteLength;
     }
   }
 
   try {
-    if (useSyncIterableFastPath) {
-      // Avoid from()'s async sync-iterable batching path. This keeps writes
-      // incremental for synchronous sources while preserving async
-      // normalization for non-primitive yielded values.
-      for (const value of source) {
-        if (isUint8ArrayBatch(value)) {
-          if (value.length > 0) {
-            const p = writeBatch(value);
-            if (p) await p;
-          }
-          continue;
-        }
-        if (isUint8Array(value)) {
-          const p = writeBatch([value]);
-          if (p) await p;
-          continue;
-        }
-
-        const batch = await ArrayFromAsync(normalizeAsyncValue(value));
-        if (batch.length > 0) {
-          const p = writeBatch(batch);
-          if (p) await p;
-        }
-      }
-    } else if (transforms.length === 0) {
+    if (transforms.length === 0) {
       // Fast path: no transforms - iterate normalized source directly
       if (signal) {
         for await (const batch of yieldAbortable(normalized, signal)) {
@@ -1064,15 +1166,13 @@ async function pipeTo(source, ...args) {
       }
     }
 
-    if (!options?.preventClose) {
+    if (!options.preventClose) {
       if (!hasEndSync || writer.endSync() < 0) {
         await writer.end?.(signal ? { __proto__: null, signal } : undefined);
       }
     }
   } catch (error) {
-    if (!options?.preventFail) {
-      writer.fail?.(wrapError(error));
-    }
+    failWriter(error);
     throw error;
   }
 
@@ -1084,4 +1184,5 @@ module.exports = {
   pipeToSync,
   pull,
   pullSync,
+  pullWithConsumerCleanup,
 };
diff --git a/lib/internal/streams/iter/push.js b/lib/internal/streams/iter/push.js
index cc7bfc900cec..31b437c85b75 100644
--- a/lib/internal/streams/iter/push.js
+++ b/lib/internal/streams/iter/push.js
@@ -11,11 +11,10 @@ const {
   PromiseReject,
   PromiseResolve,
   PromiseWithResolvers,
-  Symbol,
+  SafeWeakSet,
   SymbolAsyncDispose,
   SymbolAsyncIterator,
   SymbolDispose,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -23,10 +22,7 @@ const {
     ERR_INVALID_STATE,
   },
 } = require('internal/errors');
-const { lazyDOMException } = require('internal/util');
 const {
-  validateAbortSignal,
-  validateArray,
   validateInteger,
 } = require('internal/validators');
 
@@ -37,23 +33,31 @@ const {
 const {
   kPushDefaultBudget,
   kResolvedPromise,
+  createBatchEntry,
   onSignalAbort,
-  toUint8Array,
+  toWriterUint8Array,
   convertChunks,
   getWriterSignal,
   parsePullArgs,
-  validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
-  pull: pullWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   RingBuffer,
 } = require('internal/streams/iter/ringbuffer');
 
-const kNoFailReason = Symbol('kNoFailReason');
+const consumerReturnErrors = new SafeWeakSet();
+
+function isConsumerReturnError(error) {
+  return consumerReturnErrors.has(error);
+}
 
 function raceEndWithSignal(promise, signal) {
   if (!signal) return promise;
@@ -101,8 +105,10 @@ class PushQueue {
   #writerState = 'open';
   /** Consumer state: 'active' | 'returned' | 'thrown' */
   #consumerState = 'active';
-  /** Error that closed the stream */
-  #error = null;
+  /** Error that closed the writer */
+  #writerError;
+  /** Error supplied by the consumer */
+  #consumerError;
   /** Total bytes written */
   #bytesWritten = 0;
   /** Pending end promise (resolves when consumer drains past end sentinel) */
@@ -117,16 +123,16 @@ class PushQueue {
   #bufferedBytes = 0;
 
   constructor(options = { __proto__: null }) {
+    options = converters.PushStreamOptions(options, {
+      __proto__: null,
+      context: 'options',
+    });
     const {
       budget = kPushDefaultBudget,
       backpressure = 'strict',
       signal,
     } = options;
     validateInteger(budget, 'options.budget', 16384);
-    validateBackpressure(backpressure);
-    if (signal !== undefined) {
-      validateAbortSignal(signal, 'options.signal');
-    }
     this.#budget = budget;
     this.#backpressure = backpressure;
     this.#signal = signal;
@@ -145,7 +151,7 @@ class PushQueue {
   // ===========================================================================
 
   /**
-   * Check if the next write is likely to be accepted.
+   * Check whether the slots buffer has capacity.
    * Returns null if writer is closed/errored or consumer has terminated.
    * @returns {boolean | null}
    */
@@ -153,14 +159,16 @@ class PushQueue {
     if (this.#writerState !== 'open' || this.#consumerState !== 'active') {
       return null;
     }
-    if ((this.#backpressure === 'strict' ||
-          this.#backpressure === 'unbounded') &&
-        this.#bufferedBytes >= this.#budget) {
+    if (this.#bufferedBytes >= this.#budget) {
       return false;
     }
     return true;
   }
 
+  get signal() {
+    return this.#signal;
+  }
+
   /**
    * Check if a sync write would be accepted.
    * @returns {boolean}
@@ -185,7 +193,11 @@ class PushQueue {
     if (this.#writerState !== 'open') return false;
     if (this.#consumerState !== 'active') return false;
 
-    const batchSize = this.#batchByteSize(chunks);
+    return this.#writeEntry(createBatchEntry(chunks));
+  }
+
+  #writeEntry(entry) {
+    const batchSize = entry.byteLength;
 
     // Skip empty chunks -- zero-byte writes would accumulate infinitely
     // without ever triggering backpressure under a byte-budget model.
@@ -201,7 +213,7 @@ class PushQueue {
           while (this.#bufferedBytes >= this.#budget &&
                  this.#slots.length > 0) {
             const evicted = this.#slots.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
           }
           break;
         case 'drop-newest':
@@ -211,7 +223,7 @@ class PushQueue {
       }
     }
 
-    this.#slots.push(chunks);
+    this.#slots.push(entry);
     this.#bufferedBytes += batchSize;
     this.#bytesWritten += batchSize;
 
@@ -242,19 +254,18 @@ class PushQueue {
       throw new ERR_INVALID_STATE.TypeError('Writer is closing');
     }
     if (this.#writerState === 'errored') {
-      throw this.#error;
+      throw this.#writerError;
     }
     if (this.#consumerState !== 'active') {
-      throw this.#consumerState === 'thrown' && this.#error ?
-        this.#error :
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+      if (this.#consumerState === 'thrown') throw this.#consumerError;
+      throw new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
     }
 
     // Check for pre-aborted signal (after state checks per spec)
     signal?.throwIfAborted();
 
-    // Try sync first
-    if (this.writeSync(chunks)) {
+    const entry = createBatchEntry(chunks);
+    if (this.#writeEntry(entry)) {
       return;
     }
 
@@ -266,9 +277,9 @@ class PushQueue {
             'Backpressure violation: too many pending writes. ' +
             'Await each write() call to respect backpressure.');
         }
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       case 'unbounded':
-        return this.#createPendingWrite(chunks, signal);
+        return this.#createPendingWrite(entry, signal);
       default:
         throw new ERR_INVALID_STATE(
           'Unexpected: writeSync should have handled non-strict policy');
@@ -281,17 +292,20 @@ class PushQueue {
    * promise rejects. Signal listeners are cleaned up on normal resolution.
    * @returns {Promise<void>}
    */
-  #createPendingWrite(chunks, signal) {
+  #createPendingWrite(batch, signal) {
     const { promise, resolve, reject } = PromiseWithResolvers();
-    const entry = { __proto__: null, chunks, resolve, reject };
+    const entry = { __proto__: null, batch, resolve, reject };
     this.#pendingWrites.push(entry);
 
     if (signal) {
       const onAbort = () => {
         // Remove from queue so it doesn't occupy a slot
         const idx = this.#pendingWrites.indexOf(entry);
-        if (idx !== -1) this.#pendingWrites.removeAt(idx);
-        reject(signal.reason ?? lazyDOMException('Aborted', 'AbortError'));
+        if (idx !== -1) {
+          this.#pendingWrites.removeAt(idx);
+          this.#resolvePendingReads();
+        }
+        reject(signal.reason);
       };
 
       // Wrap resolve/reject to clean up signal listener
@@ -325,31 +339,33 @@ class PushQueue {
       return this.#bytesWritten; // Idempotent
     }
 
-    this.#cleanup();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Writer closed'));
     this.#resolvePendingDrains(false);
 
-    // If buffer is empty, close immediately
-    if (this.#slots.length === 0) {
+    // If there is no accepted work to drain, close immediately.
+    if (this.#slots.length === 0 && this.#pendingWrites.length === 0) {
       this.#writerState = 'closed';
+      this.#cleanup();
       this.#resolvePendingReads();
       return this.#bytesWritten;
     }
 
-    // Buffer has data: transition to closing, defer completion until drained
+    // Accepted work remains: close after it drains and the consumer pulls EOF.
     this.#writerState = 'closing';
     return -3; // Signal to PushWriter: create deferred end promise
   }
 
   /**
-   * Called by the read path when the consumer has drained all data while
-   * the writer is in the 'closing' state. Transitions to 'closed' and
-   * resolves the pending end promise.
+   * Called when the consumer pulls past all accepted data while the writer is
+   * closing. Transitions to 'closed' and resolves the pending end promise.
    */
   endDrained() {
-    if (this.#writerState !== 'closing') return;
+    if (this.#writerState !== 'closing' ||
+        this.#slots.length > 0 ||
+        this.#pendingWrites.length > 0) {
+      return;
+    }
     this.#writerState = 'closed';
+    this.#cleanup();
     if (this.#pendingEnd) {
       this.#pendingEnd.resolve(this.#bytesWritten);
       this.#pendingEnd = null;
@@ -361,28 +377,25 @@ class PushQueue {
    * No-op if errored or closed (fully drained).
    * If closing (draining), short-circuits the drain.
    */
-  fail(reason = kNoFailReason) {
+  fail(reason) {
     if (this.#writerState === 'errored' || this.#writerState === 'closed') {
       return;
     }
 
     const wasClosing = this.#writerState === 'closing';
     this.#writerState = 'errored';
-    this.#error = reason === kNoFailReason ?
-      new ERR_INVALID_STATE('Failed') :
-      reason;
+    this.#writerError = reason;
     this.#cleanup();
-    this.#rejectPendingReads(this.#error);
-    this.#rejectPendingDrains(this.#error);
+    this.#rejectPendingReads(this.#writerError);
+    this.#rejectPendingDrains(this.#writerError);
+    this.#rejectPendingWrites(this.#writerError);
 
     if (wasClosing) {
       // Short-circuit the graceful drain: reject the pending end promise
       if (this.#pendingEnd) {
-        this.#pendingEnd.reject(this.#error);
+        this.#pendingEnd.reject(this.#writerError);
         this.#pendingEnd = null;
       }
-    } else {
-      this.#rejectPendingWrites(this.#error);
     }
   }
 
@@ -391,7 +404,7 @@ class PushQueue {
   }
 
   get error() {
-    return this.#error;
+    return this.#writerError;
   }
 
   get backpressurePolicy() {
@@ -402,12 +415,12 @@ class PushQueue {
     return this.#writerState;
   }
 
-  get pendingEndPromise() {
-    return this.#pendingEnd?.promise ?? null;
-  }
-
-  setPendingEnd(pending) {
-    this.#pendingEnd = pending;
+  getPendingEndPromise() {
+    if (this.#pendingEnd === null) {
+      const { promise, resolve, reject } = PromiseWithResolvers();
+      this.#pendingEnd = { __proto__: null, promise, resolve, reject };
+    }
+    return this.#pendingEnd.promise;
   }
 
   /**
@@ -425,14 +438,17 @@ class PushQueue {
   // ===========================================================================
 
   async read() {
+    if (this.#consumerState === 'returned') {
+      return { __proto__: null, done: true, value: undefined };
+    }
+    if (this.#consumerState === 'thrown') {
+      throw this.#consumerError;
+    }
+
     // If there's data in the buffer, return it immediately
     if (this.#slots.length > 0) {
       const result = this.#drain();
       this.#resolvePendingWrites();
-      // After draining, check if writer was closing and buffer is now empty
-      if (this.#writerState === 'closing' && this.#slots.length === 0) {
-        this.endDrained();
-      }
       return { __proto__: null, done: false, value: result };
     }
 
@@ -447,7 +463,7 @@ class PushQueue {
     }
 
     if (this.#writerState === 'errored') {
-      throw this.#error;
+      throw this.#writerError;
     }
 
     const { promise, resolve, reject } = PromiseWithResolvers();
@@ -458,16 +474,10 @@ class PushQueue {
   consumerReturn() {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'returned';
-    this.#cleanup();
+    const error = new ERR_INVALID_STATE.TypeError('Stream closed by consumer');
+    consumerReturnErrors.add(error);
+    this.#terminateWriterFromConsumer(error);
     this.#resolvePendingReads();
-    this.#rejectPendingWrites(
-      new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-    // If closing, reject the pending end promise
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(
-        new ERR_INVALID_STATE.TypeError('Stream closed by consumer'));
-      this.#pendingEnd = null;
-    }
     // Resolve pending drains with false - no more data will be consumed
     this.#resolvePendingDrains(false);
   }
@@ -475,14 +485,9 @@ class PushQueue {
   consumerThrow(error) {
     if (this.#consumerState !== 'active') return;
     this.#consumerState = 'thrown';
-    this.#error = error;
-    this.#cleanup();
+    this.#consumerError = error;
+    this.#terminateWriterFromConsumer(error);
     this.#rejectPendingReads(error);
-    this.#rejectPendingWrites(error);
-    if (this.#writerState === 'closing' && this.#pendingEnd) {
-      this.#pendingEnd.reject(error);
-      this.#pendingEnd = null;
-    }
     // Reject pending drains - the consumer errored
     this.#rejectPendingDrains(error);
   }
@@ -492,38 +497,66 @@ class PushQueue {
   // ===========================================================================
 
   #drain() {
-    this.#bufferedBytes = 0;
-    if (this.#slots.length === 1) {
-      return this.#slots.shift();
-    }
+    try {
+      if (this.#slots.length === 1) {
+        const result = validateBatchEntry(this.#slots.shift());
+        this.#bufferedBytes = 0;
+        return result;
+      }
 
-    const result = [];
-    for (let i = 0; i < this.#slots.length; i++) {
-      const slot = this.#slots.get(i);
-      for (let j = 0; j < slot.length; j++) {
-        ArrayPrototypePush(result, slot[j]);
+      const result = [];
+      for (let i = 0; i < this.#slots.length; i++) {
+        const batch = validateBatchEntry(this.#slots.get(i));
+        for (let j = 0; j < batch.length; j++) {
+          ArrayPrototypePush(result, batch[j]);
+        }
       }
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      return result;
+    } catch (error) {
+      this.#slots.clear();
+      this.#bufferedBytes = 0;
+      this.fail(error);
+      throw error;
     }
-    this.#slots.clear();
-    return result;
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #terminateWriterFromConsumer(error) {
+    this.#slots.clear();
+    this.#bufferedBytes = 0;
+    if (this.#writerState === 'open' || this.#writerState === 'closing') {
+      this.#writerState = 'errored';
+      this.#writerError = error;
+    }
+    this.#cleanup();
+    this.#rejectPendingWrites(error);
+    if (this.#pendingEnd) {
+      this.#pendingEnd.reject(error);
+      this.#pendingEnd = null;
     }
-    return size;
   }
 
   #resolvePendingReads() {
     while (this.#pendingReads.length > 0) {
-      if (this.#slots.length > 0) {
+      if (this.#consumerState === 'returned') {
+        const pending = this.#pendingReads.shift();
+        pending.resolve({ __proto__: null, done: true, value: undefined });
+      } else if (this.#consumerState === 'thrown') {
+        const pending = this.#pendingReads.shift();
+        pending.reject(this.#consumerError);
+      } else if (this.#slots.length > 0) {
         const pending = this.#pendingReads.shift();
-        const result = this.#drain();
-        this.#resolvePendingWrites();
-        pending.resolve({ __proto__: null, done: false, value: result });
-      } else if (this.#writerState === 'closing' && this.#slots.length === 0) {
+        try {
+          const result = this.#drain();
+          this.#resolvePendingWrites();
+          pending.resolve({ __proto__: null, done: false, value: result });
+        } catch (error) {
+          pending.reject(error);
+        }
+      } else if (this.#writerState === 'closing' &&
+                 this.#slots.length === 0 &&
+                 this.#pendingWrites.length === 0) {
         this.endDrained();
         const pending = this.#pendingReads.shift();
         pending.resolve({ __proto__: null, done: true, value: undefined });
@@ -532,10 +565,7 @@ class PushQueue {
         pending.resolve({ __proto__: null, done: true, value: undefined });
       } else if (this.#writerState === 'errored') {
         const pending = this.#pendingReads.shift();
-        pending.reject(this.#error);
-      } else if (this.#consumerState === 'returned') {
-        const pending = this.#pendingReads.shift();
-        pending.resolve({ __proto__: null, done: true, value: undefined });
+        pending.reject(this.#writerError);
       } else {
         break;
       }
@@ -546,11 +576,15 @@ class PushQueue {
     while (this.#pendingWrites.length > 0 &&
           this.#bufferedBytes < this.#budget) {
       const pending = this.#pendingWrites.shift();
-      const batchSize = this.#batchByteSize(pending.chunks);
-      this.#slots.push(pending.chunks);
-      this.#bufferedBytes += batchSize;
-      this.#bytesWritten += batchSize;
-      pending.resolve();
+      try {
+        validateBatchEntry(pending.batch);
+        this.#slots.push(pending.batch);
+        this.#bufferedBytes += pending.batch.byteLength;
+        this.#bytesWritten += pending.batch.byteLength;
+        pending.resolve();
+      } catch (error) {
+        pending.reject(error);
+      }
     }
 
     if (this.#bufferedBytes < this.#budget) {
@@ -617,41 +651,41 @@ class PushWriter {
   }
 
   write(chunk, options) {
+    const bytes = toWriterUint8Array(chunk);
     const signal = getWriterSignal(options);
     if (!signal && this.#queue.canWriteSync()) {
-      const bytes = toUint8Array(chunk);
       this.#queue.writeSync([bytes]);
       return kResolvedPromise;
     }
-    const bytes = toUint8Array(chunk);
     return this.#queue.writeAsync([bytes], signal);
   }
 
   writev(chunks, options) {
-    validateArray(chunks, 'chunks');
+    const bytes = convertChunks(chunks);
     const signal = getWriterSignal(options);
-    if (!signal && this.#queue.canWriteSync()) {
-      const bytes = convertChunks(chunks);
-      this.#queue.writeSync(bytes);
+    if (!signal && this.#queue.writeSync(bytes)) {
       return kResolvedPromise;
     }
-    const bytes = convertChunks(chunks);
     return this.#queue.writeAsync(bytes, signal);
   }
 
   writeSync(chunk) {
-    const bytes = toUint8Array(chunk);
+    const bytes = toWriterUint8Array(chunk);
     return this.#queue.writeSync([bytes]);
   }
 
   writevSync(chunks) {
-    validateArray(chunks, 'chunks');
     const bytes = convertChunks(chunks);
     return this.#queue.writeSync(bytes);
   }
 
   end(options) {
     const signal = getWriterSignal(options);
+    const state = this.#queue.writerState;
+    if (state === 'errored') return PromiseReject(this.#queue.error);
+    if (state === 'closed') {
+      return PromiseResolve(this.#queue.totalBytesWritten);
+    }
     if (signal?.aborted) return PromiseReject(signal.reason);
 
     const result = this.#queue.end();
@@ -660,15 +694,7 @@ class PushWriter {
       return PromiseReject(this.#queue.error);
     }
     if (result === -3) {
-      // Closing: buffer has data, create deferred promise that resolves
-      // when consumer drains past the end sentinel
-      const pendingEndPromise = this.#queue.pendingEndPromise;
-      if (pendingEndPromise !== null) {
-        return raceEndWithSignal(pendingEndPromise, signal);
-      }
-      const { promise, resolve, reject } = PromiseWithResolvers();
-      this.#queue.setPendingEnd({ __proto__: null, promise, resolve, reject });
-      return raceEndWithSignal(promise, signal);
+      return raceEndWithSignal(this.#queue.getPendingEndPromise(), signal);
     }
     // >= 0: byte count (immediate close or idempotent)
     return PromiseResolve(result);
@@ -682,14 +708,13 @@ class PushWriter {
   }
 
   fail(reason) {
-    this.#queue.fail(arguments.length === 0 ? kNoFailReason : reason);
+    this.#queue.fail(reason);
   }
 
   [SymbolAsyncDispose]() {
     const state = this.#queue.writerState;
     if (state === 'closing') {
-      // Wait for graceful drain
-      return this.#queue.pendingEndPromise ?? PromiseResolve();
+      return this.#queue.getPendingEndPromise();
     }
     if (state === 'open') {
       this.fail();
@@ -756,12 +781,8 @@ function push(...args) {
   // Apply transforms lazily if provided
   let readable;
   if (transforms.length > 0) {
-    if (options.signal) {
-      readable = pullWithTransforms(
-        rawReadable, ...transforms, { __proto__: null, signal: options.signal });
-    } else {
-      readable = pullWithTransforms(rawReadable, ...transforms);
-    }
+    readable = pullWithConsumerCleanup(
+      rawReadable, transforms, queue.signal);
   } else {
     readable = rawReadable;
   }
@@ -770,5 +791,6 @@ function push(...args) {
 }
 
 module.exports = {
+  isConsumerReturnError,
   push,
 };
diff --git a/lib/internal/streams/iter/share.js b/lib/internal/streams/iter/share.js
index 711abeb21b9a..6154509a5b64 100644
--- a/lib/internal/streams/iter/share.js
+++ b/lib/internal/streams/iter/share.js
@@ -7,14 +7,16 @@
 
 const {
   ArrayPrototypePush,
+  FunctionPrototypeCall,
   PromisePrototypeThen,
   PromiseResolve,
   PromiseWithResolvers,
+  SafePromiseRace,
   SafeSet,
+  Symbol,
   SymbolAsyncIterator,
   SymbolDispose,
   SymbolIterator,
-  TypedArrayPrototypeGetByteLength,
 } = primordials;
 
 const {
@@ -30,19 +32,22 @@ const {
 } = require('internal/streams/iter/from');
 
 const {
-  pull: pullWithTransforms,
   pullSync: pullSyncWithTransforms,
+  pullWithConsumerCleanup,
 } = require('internal/streams/iter/pull');
 
 const {
   kMultiConsumerDefaultBudget,
+  createBatchEntry,
   getMinCursor,
   hasProtocol,
   onSignalAbort,
-  wrapError,
   parsePullArgs,
-  validateBackpressure,
+  validateBatchEntry,
 } = require('internal/streams/iter/utils');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 const {
   RingBuffer,
@@ -56,15 +61,16 @@ const {
   },
 } = require('internal/errors');
 const {
-  validateAbortSignal,
   validateInteger,
-  validateObject,
 } = require('internal/validators');
 
 // =============================================================================
 // Async Share Implementation
 // =============================================================================
 
+const kNoShareError = Symbol('kNoShareError');
+const kShareCancelled = Symbol('kShareCancelled');
+
 class ShareImpl {
   #source;
   #options;
@@ -73,10 +79,13 @@ class ShareImpl {
   #consumers = new SafeSet();
   #sourceIterator = null;
   #sourceExhausted = false;
-  #sourceError;
+  #sourceError = kNoShareError;
   #cancelled = false;
   #pulling = false;
   #pullWaiters = [];
+  #cancelPromise;
+  #resolveCancel;
+  #cancelError = kNoShareError;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
   /** Cumulative byte size of buffered entries */
@@ -85,6 +94,9 @@ class ShareImpl {
   constructor(source, options) {
     this.#source = source;
     this.#options = options;
+    const { promise, resolve } = PromiseWithResolvers();
+    this.#cancelPromise = promise;
+    this.#resolveCancel = resolve;
   }
 
   get consumerCount() {
@@ -92,9 +104,13 @@ class ShareImpl {
   }
 
   pull(...args) {
-    const { transforms, options } = parsePullArgs(args);
-    const signal = options?.signal;
-    validateAbortSignal(signal, 'options.signal');
+    const parsed = parsePullArgs(args);
+    const { transforms } = parsed;
+    const options = converters.PullOptions(parsed.options, {
+      __proto__: null,
+      context: 'options',
+    });
+    const { signal } = options;
 
     // Avoid registering a consumer that the pre-aborted pipeline will never
     // read or detach.
@@ -111,13 +127,7 @@ class ShareImpl {
     const rawConsumer = this.#createRawConsumer();
 
     if (transforms.length > 0 || signal) {
-      if (signal) {
-        return pullWithTransforms(
-          rawConsumer,
-          ...transforms,
-          { __proto__: null, signal });
-      }
-      return pullWithTransforms(rawConsumer, ...transforms);
+      return pullWithConsumerCleanup(rawConsumer, transforms, signal);
     }
     return rawConsumer;
   }
@@ -129,6 +139,7 @@ class ShareImpl {
       resolve: null,
       reject: null,
       detached: false,
+      error: kNoShareError,
       pendingNext: PromiseResolve(),
     };
 
@@ -147,32 +158,28 @@ class ShareImpl {
       __proto__: null,
       [SymbolAsyncIterator]() {
         const getNext = async () => {
-          if (self.#sourceError !== undefined) {
-            state.detached = true;
-            self.#consumers.delete(state);
-            throw self.#sourceError;
-          }
-
           // Loop until we get data, source is exhausted, or
           // consumer is detached. Multiple consumers may be woken
           // after a single pull - those that find no data at their
           // cursor must re-pull rather than terminating prematurely.
           for (;;) {
             if (state.detached) {
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             if (self.#cancelled) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
             // Check if data is available in buffer
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -185,7 +192,10 @@ class ShareImpl {
             if (self.#sourceExhausted) {
               state.detached = true;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (self.#sourceError !== kNoShareError) {
+                state.error = self.#sourceError;
+                throw state.error;
+              }
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -193,8 +203,9 @@ class ShareImpl {
             const shouldBuffer = await self.#waitForBufferSpace();
             if (shouldBuffer === null) {
               state.detached = true;
+              state.error = self.#cancelError;
               self.#deleteConsumer(state);
-              if (self.#sourceError !== undefined) throw self.#sourceError;
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
 
@@ -243,19 +254,33 @@ class ShareImpl {
 
   cancel(reason) {
     if (this.#cancelled) return;
+    const hasReason = arguments.length > 0;
     this.#cancelled = true;
 
-    if (reason !== undefined) {
-      this.#sourceError = reason;
+    if (hasReason) {
+      this.#cancelError = reason;
     }
 
-    if (this.#sourceIterator?.return) {
-      PromisePrototypeThen(this.#sourceIterator.return(), undefined, () => {});
+    this.#resolveCancel(kShareCancelled);
+    this.#resolveCancel = null;
+
+    try {
+      const returnMethod = this.#sourceIterator?.return;
+      if (typeof returnMethod === 'function') {
+        PromisePrototypeThen(
+          PromiseResolve(FunctionPrototypeCall(
+            returnMethod, this.#sourceIterator)),
+          undefined,
+          () => {});
+      }
+    } catch {
+      // Cancellation has precedence over source cleanup errors.
     }
 
     for (const consumer of this.#consumers) {
+      consumer.error = this.#cancelError;
       if (consumer.resolve) {
-        if (reason !== undefined) {
+        if (hasReason) {
           consumer.reject?.(reason);
         } else {
           consumer.resolve({ __proto__: null, done: true, value: undefined });
@@ -266,6 +291,8 @@ class ShareImpl {
       consumer.detached = true;
     }
     this.#consumers.clear();
+    this.#buffer.clear();
+    this.#bufferedBytes = 0;
 
     for (let i = 0; i < this.#pullWaiters.length; i++) {
       this.#pullWaiters[i]();
@@ -282,7 +309,7 @@ class ShareImpl {
   async #waitForBufferSpace() {
     while (this.#bufferedBytes >= this.#options.budget) {
       if (this.#cancelled ||
-          this.#sourceError !== undefined ||
+          this.#sourceError !== kNoShareError ||
           this.#sourceExhausted) {
         return this.#cancelled ? null : true;
       }
@@ -302,7 +329,7 @@ class ShareImpl {
           while (this.#bufferedBytes >= this.#options.budget &&
                  this.#buffer.length > 0) {
             const evicted = this.#buffer.shift();
-            this.#bufferedBytes -= this.#batchByteSize(evicted);
+            this.#bufferedBytes -= evicted.byteLength;
             this.#bufferStart++;
           }
           for (const consumer of this.#consumers) {
@@ -323,7 +350,7 @@ class ShareImpl {
   async #waitForBufferSpaceAfterDrop() {
     while (this.#bufferedBytes >= this.#options.budget &&
            !this.#cancelled &&
-           this.#sourceError === undefined &&
+           this.#sourceError === kNoShareError &&
            !this.#sourceExhausted) {
       const { promise, resolve } = PromiseWithResolvers();
       ArrayPrototypePush(this.#pullWaiters, resolve);
@@ -369,16 +396,22 @@ class ShareImpl {
           }
         }
 
-        const result = await this.#sourceIterator.next();
+        const result = await SafePromiseRace([
+          this.#sourceIterator.next(),
+          this.#cancelPromise,
+        ]);
+
+        if (this.#cancelled || result === kShareCancelled) return;
 
         if (result.done) {
           this.#sourceExhausted = true;
         } else if (!discard) {
-          this.#buffer.push(result.value);
-          this.#bufferedBytes += this.#batchByteSize(result.value);
+          const entry = createBatchEntry(result.value);
+          this.#buffer.push(entry);
+          this.#bufferedBytes += entry.byteLength;
         }
       } catch (error) {
-        this.#sourceError = wrapError(error);
+        this.#sourceError = error;
         this.#sourceExhausted = true;
       } finally {
         this.#pulling = false;
@@ -398,7 +431,7 @@ class ShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
@@ -409,12 +442,15 @@ class ShareImpl {
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -452,7 +488,7 @@ class SyncShareImpl {
   #consumers = new SafeSet();
   #sourceIterator = null;
   #sourceExhausted = false;
-  #sourceError;
+  #sourceError = kNoShareError;
   #cancelled = false;
   #cachedMinCursor = 0;
   #cachedMinCursorConsumers = 0;
@@ -482,6 +518,7 @@ class SyncShareImpl {
       __proto__: null,
       cursor: this.#bufferStart,
       detached: false,
+      error: kNoShareError,
     };
 
     this.#consumers.add(state);
@@ -501,14 +538,16 @@ class SyncShareImpl {
         return {
           __proto__: null,
           next() {
-            if (self.#sourceError !== undefined) {
-              state.detached = true;
-              self.#deleteConsumer(state);
-              throw self.#sourceError;
-            }
             if (state.detached) {
+              if (state.error !== kNoShareError) throw state.error;
               return { __proto__: null, done: true, value: undefined };
             }
+            if (self.#sourceError !== kNoShareError) {
+              state.detached = true;
+              state.error = self.#sourceError;
+              self.#deleteConsumer(state);
+              throw state.error;
+            }
             if (self.#cancelled) {
               state.detached = true;
               self.#deleteConsumer(state);
@@ -517,7 +556,7 @@ class SyncShareImpl {
 
             const bufferIndex = state.cursor - self.#bufferStart;
             if (bufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(bufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(bufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -549,7 +588,7 @@ class SyncShareImpl {
                   while (self.#bufferedBytes >= self.#options.budget &&
                          self.#buffer.length > 0) {
                     const evicted = self.#buffer.shift();
-                    self.#bufferedBytes -= self.#batchByteSize(evicted);
+                    self.#bufferedBytes -= evicted.byteLength;
                     self.#bufferStart++;
                   }
                   for (const consumer of self.#consumers) {
@@ -569,15 +608,16 @@ class SyncShareImpl {
 
             self.#pullFromSource();
 
-            if (self.#sourceError !== undefined) {
+            if (self.#sourceError !== kNoShareError) {
               state.detached = true;
+              state.error = self.#sourceError;
               self.#deleteConsumer(state);
-              throw self.#sourceError;
+              throw state.error;
             }
 
             const newBufferIndex = state.cursor - self.#bufferStart;
             if (newBufferIndex < self.#buffer.length) {
-              const chunk = self.#buffer.get(newBufferIndex);
+              const chunk = self.#readEntry(self.#buffer.get(newBufferIndex));
               const cursor = state.cursor;
               state.cursor++;
               if (cursor === self.#cachedMinCursor &&
@@ -618,17 +658,24 @@ class SyncShareImpl {
 
   cancel(reason) {
     if (this.#cancelled) return;
+    const hasReason = arguments.length > 0;
     this.#cancelled = true;
 
-    if (reason !== undefined) {
+    if (hasReason) {
       this.#sourceError = reason;
     }
 
-    if (this.#sourceIterator?.return) {
-      this.#sourceIterator.return();
+    try {
+      const returnMethod = this.#sourceIterator?.return;
+      if (typeof returnMethod === 'function') {
+        FunctionPrototypeCall(returnMethod, this.#sourceIterator);
+      }
+    } catch {
+      // Cancellation has precedence over source cleanup errors.
     }
 
     for (const consumer of this.#consumers) {
+      if (hasReason) consumer.error = reason;
       consumer.detached = true;
     }
     this.#consumers.clear();
@@ -649,11 +696,12 @@ class SyncShareImpl {
       if (result.done) {
         this.#sourceExhausted = true;
       } else {
-        this.#buffer.push(result.value);
-        this.#bufferedBytes += this.#batchByteSize(result.value);
+        const entry = createBatchEntry(result.value);
+        this.#buffer.push(entry);
+        this.#bufferedBytes += entry.byteLength;
       }
     } catch (error) {
-      this.#sourceError = wrapError(error);
+      this.#sourceError = error;
       this.#sourceExhausted = true;
     }
   }
@@ -666,19 +714,22 @@ class SyncShareImpl {
     if (trimCount > 0) {
       for (let i = 0; i < trimCount; i++) {
         const evicted = this.#buffer.get(i);
-        this.#bufferedBytes -= this.#batchByteSize(evicted);
+        this.#bufferedBytes -= evicted.byteLength;
       }
       this.#buffer.trimFront(trimCount);
       this.#bufferStart = this.#cachedMinCursor;
     }
   }
 
-  #batchByteSize(batch) {
-    let size = 0;
-    for (let i = 0; i < batch.length; i++) {
-      size += TypedArrayPrototypeGetByteLength(batch[i]);
+  #readEntry(entry) {
+    try {
+      return validateBatchEntry(entry);
+    } catch (error) {
+      this.cancel(error);
+      this.#buffer.clear();
+      this.#bufferedBytes = 0;
+      throw error;
     }
-    return size;
   }
 
   #recomputeMinCursor() {
@@ -715,17 +766,16 @@ function onShareCancel(shareImpl, signal) {
 function share(source, options = { __proto__: null }) {
   // Normalize source via from() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = from(source);
-  validateObject(options, 'options');
+  options = converters.ShareOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
     signal,
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
-  if (signal !== undefined) {
-    validateAbortSignal(signal, 'options.signal');
-  }
 
   const opts = {
     __proto__: null,
@@ -746,13 +796,15 @@ function share(source, options = { __proto__: null }) {
 function shareSync(source, options = { __proto__: null }) {
   // Normalize source via fromSync() - accepts strings, ArrayBuffers, protocols, etc.
   const normalized = fromSync(source);
-  validateObject(options, 'options');
+  options = converters.ShareSyncOptions(options, {
+    __proto__: null,
+    context: 'options',
+  });
   const {
     budget = kMultiConsumerDefaultBudget,
     backpressure = 'strict',
   } = options;
   validateInteger(budget, 'options.budget', 16384);
-  validateBackpressure(backpressure);
 
   const opts = {
     __proto__: null,
diff --git a/lib/internal/streams/iter/transform.js b/lib/internal/streams/iter/transform.js
index cb35906ded02..c4f08b8cd32b 100644
--- a/lib/internal/streams/iter/transform.js
+++ b/lib/internal/streams/iter/transform.js
@@ -35,7 +35,6 @@ const {
   },
   genericNodeError,
 } = require('internal/errors');
-const { lazyDOMException } = require('internal/util');
 const { isArrayBufferView, isAnyArrayBuffer } = require('internal/util/types');
 const { kValidatedTransform } = require('internal/streams/iter/types');
 const {
@@ -399,8 +398,7 @@ function makeZlibTransform(createHandleFn, processFlag, finishFlag) {
         resolveWrite = undefined;
         rejectWrite = undefined;
         if (reject) {
-          reject(signal.reason ??
-                 lazyDOMException('The operation was aborted', 'AbortError'));
+          reject(signal.reason);
         }
       };
       signal.addEventListener('abort', onAbort, { __proto__: null, once: true });
diff --git a/lib/internal/streams/iter/utils.js b/lib/internal/streams/iter/utils.js
index 9966f351b9d5..95d2d914eb1a 100644
--- a/lib/internal/streams/iter/utils.js
+++ b/lib/internal/streams/iter/utils.js
@@ -3,12 +3,12 @@
 const {
   Array,
   ArrayBufferPrototypeGetByteLength,
+  ArrayBufferPrototypeGetDetached,
   ArrayPrototypeSlice,
   PromiseResolve,
   PromiseWithResolvers,
   SafePromisePrototypeFinally,
   SafePromiseRace,
-  String,
   SymbolAsyncIterator,
   TypedArrayPrototypeGetBuffer,
   TypedArrayPrototypeGetByteLength,
@@ -25,17 +25,18 @@ const { TextEncoder } = require('internal/encoding');
 const {
   codes: {
     ERR_INVALID_ARG_TYPE,
-    ERR_OPERATION_FAILED,
+    ERR_INVALID_STATE,
   },
 } = require('internal/errors');
-const { isError } = require('internal/util');
 
 const { isSharedArrayBuffer, isUint8Array } = require('internal/util/types');
 
 const {
-  validateAbortSignal,
   validateOneOf,
 } = require('internal/validators');
+const {
+  converters,
+} = require('internal/streams/iter/webidl');
 
 // Cached resolved promise to avoid allocating a new one on every sync fast-path.
 const kResolvedPromise = PromiseResolve();
@@ -183,17 +184,69 @@ function toUint8Array(chunk) {
   return chunk;
 }
 
-/**
- * Check if all chunks in an array are already Uint8Array.
- * Short-circuits on the first non-Uint8Array chunk found.
- * @param {Array<Uint8Array|string>} chunks
- * @returns {boolean}
- */
-function allUint8Array(chunks) {
+function snapshotByteView(value) {
+  const buffer = TypedArrayPrototypeGetBuffer(value);
+  const sharedBufferView = isSharedArrayBuffer(buffer) ?
+    new Uint8Array(buffer) : undefined;
+  return {
+    __proto__: null,
+    value,
+    buffer,
+    bufferByteLength: sharedBufferView === undefined ?
+      ArrayBufferPrototypeGetByteLength(buffer) :
+      TypedArrayPrototypeGetByteLength(sharedBufferView),
+    byteLength: TypedArrayPrototypeGetByteLength(value),
+    byteOffset: TypedArrayPrototypeGetByteOffset(value),
+    detached: sharedBufferView === undefined &&
+      ArrayBufferPrototypeGetDetached(buffer),
+    sharedBufferView,
+  };
+}
+
+function validateByteView(snapshot) {
+  const {
+    value,
+    buffer,
+    bufferByteLength,
+    byteLength,
+    byteOffset,
+    detached,
+    sharedBufferView,
+  } = snapshot;
+  const currentBufferByteLength = sharedBufferView === undefined ?
+    ArrayBufferPrototypeGetByteLength(buffer) :
+    TypedArrayPrototypeGetByteLength(sharedBufferView);
+  const currentDetached = sharedBufferView === undefined &&
+    ArrayBufferPrototypeGetDetached(buffer);
+
+  if (TypedArrayPrototypeGetBuffer(value) !== buffer ||
+      currentBufferByteLength !== bufferByteLength ||
+      TypedArrayPrototypeGetByteLength(value) !== byteLength ||
+      TypedArrayPrototypeGetByteOffset(value) !== byteOffset ||
+      currentDetached !== detached) {
+    throw new ERR_INVALID_STATE.TypeError(
+      'Byte view was resized or detached after being accepted');
+  }
+  return value;
+}
+
+function createBatchEntry(chunks) {
+  const views = new Array(chunks.length);
+  let byteLength = 0;
   for (let i = 0; i < chunks.length; i++) {
-    if (!isUint8Array(chunks[i])) return false;
+    const view = snapshotByteView(chunks[i]);
+    views[i] = view;
+    byteLength += view.byteLength;
   }
-  return true;
+  return { __proto__: null, views, byteLength };
+}
+
+function validateBatchEntry(entry) {
+  const chunks = new Array(entry.views.length);
+  for (let i = 0; i < entry.views.length; i++) {
+    chunks[i] = validateByteView(entry.views[i]);
+  }
+  return chunks;
 }
 
 function copyBytes(chunk) {
@@ -250,9 +303,10 @@ function concatBytes(chunks) {
  * @returns {Uint8Array[]}
  */
 function convertChunks(chunks) {
-  if (allUint8Array(chunks)) {
-    return ArrayPrototypeSlice(chunks);
-  }
+  chunks = converters.WriterChunkSequence(chunks, {
+    __proto__: null,
+    context: 'chunks',
+  });
   const len = chunks.length;
   const result = new Array(len);
   for (let i = 0; i < len; i++) {
@@ -267,18 +321,17 @@ function convertChunks(chunks) {
  * @returns {AbortSignal|undefined}
  */
 function getWriterSignal(options) {
-  const signal = options?.signal;
-  validateAbortSignal(signal, 'options.signal');
-  return signal;
+  return converters.WriteOptions(options, {
+    __proto__: null,
+    context: 'options',
+  }).signal;
 }
 
-/**
- * Wrap a caught value as an Error, converting non-Error values.
- * @param {unknown} error
- * @returns {Error}
- */
-function wrapError(error) {
-  return isError(error) ? error : new ERR_OPERATION_FAILED(String(error));
+function toWriterUint8Array(chunk) {
+  return toUint8Array(converters.WriterChunk(chunk, {
+    __proto__: null,
+    context: 'chunk',
+  }));
 }
 
 /**
@@ -297,20 +350,6 @@ function hasProtocol(value, symbol) {
   );
 }
 
-/**
- * Check if a value is PullOptions (object without transform or write property).
- * @param {unknown} value
- * @returns {boolean}
- */
-function isPullOptions(value) {
-  return (
-    value !== null &&
-    typeof value === 'object' &&
-    !('transform' in value) &&
-    !('write' in value)
-  );
-}
-
 /**
  * Check if a value is a stateful transform object (has a transform method).
  * @param {unknown} value
@@ -333,7 +372,7 @@ function isTransform(value) {
  * Parse variadic arguments for pull/pullSync.
  * Returns { transforms, options }
  * @param {Array} args
- * @returns {{ transforms: Array, options: object|undefined }}
+ * @returns {{ transforms: Array, options: unknown }}
  */
 function parsePullArgs(args) {
   if (args.length === 0) {
@@ -343,7 +382,7 @@ function parsePullArgs(args) {
   let transforms;
   let options;
   const last = args[args.length - 1];
-  if (isPullOptions(last)) {
+  if (!isTransform(last)) {
     transforms = ArrayPrototypeSlice(args, 0, -1);
     options = last;
   } else {
@@ -379,19 +418,20 @@ module.exports = {
   kMultiConsumerDefaultBudget,
   kPushDefaultBudget,
   kResolvedPromise,
-  allUint8Array,
   concatBytes,
   convertChunks,
+  createBatchEntry,
   getWriterSignal,
   getMinCursor,
   hasProtocol,
-  isPullOptions,
   isTransform,
   isTransformObject,
   onSignalAbort,
   parsePullArgs,
   toUint8Array,
+  toWriterUint8Array,
   validateBackpressure,
-  wrapError,
+  validateBatchEntry,
+  validateByteView,
   yieldAbortable,
 };
diff --git a/lib/internal/streams/iter/webidl.js b/lib/internal/streams/iter/webidl.js
new file mode 100644
index 000000000000..273a52443bf2
--- /dev/null
+++ b/lib/internal/streams/iter/webidl.js
@@ -0,0 +1,176 @@
+'use strict';
+
+const {
+  converters: baseConverters,
+  convertToInt,
+  createDictionaryConverter,
+  createEnumConverter,
+  createSequenceConverter,
+} = require('internal/webidl');
+// Load AbortSignal to register its Web IDL converter in baseConverters.
+require('internal/abort_controller');
+const { isUint8Array } = require('internal/util/types');
+
+const converters = { __proto__: null };
+
+function unsignedLongLong(value, options) {
+  return convertToInt(value, 64, 'unsigned', options);
+}
+
+function enforceRangeUnsignedLongLong(value, options = { __proto__: null }) {
+  return convertToInt(value, 64, 'unsigned', {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    enforceRange: true,
+  });
+}
+
+function allowStreamBufferOptions(options) {
+  return {
+    __proto__: null,
+    prefix: options.prefix,
+    context: options.context,
+    code: options.code,
+    allowShared: true,
+    allowResizable: true,
+  };
+}
+
+converters.AbortSignal = baseConverters.AbortSignal;
+converters.BackpressurePolicy = createEnumConverter('BackpressurePolicy', [
+  'strict',
+  'unbounded',
+  'drop-oldest',
+  'drop-newest',
+]);
+converters.unsignedLongLong = unsignedLongLong;
+converters.enforceRangeUnsignedLongLong = enforceRangeUnsignedLongLong;
+converters.WriterChunk = (value, options = { __proto__: null }) => {
+  if (isUint8Array(value)) {
+    return baseConverters.Uint8Array(
+      value, allowStreamBufferOptions(options));
+  }
+  return baseConverters.USVString(value, options);
+};
+converters.WriterChunkSequence = createSequenceConverter(
+  converters.WriterChunk);
+
+const signalMember = {
+  __proto__: null,
+  key: 'signal',
+  converter: converters.AbortSignal,
+};
+const budgetMember = {
+  __proto__: null,
+  key: 'budget',
+  converter: converters.unsignedLongLong,
+};
+const backpressureMember = {
+  __proto__: null,
+  key: 'backpressure',
+  converter: converters.BackpressurePolicy,
+  defaultValue: () => 'strict',
+};
+const limitMember = {
+  __proto__: null,
+  key: 'limit',
+  converter: converters.enforceRangeUnsignedLongLong,
+};
+
+converters.WriteOptions = createDictionaryConverter('WriteOptions', [
+  signalMember,
+]);
+converters.PushStreamOptions = createDictionaryConverter(
+  'PushStreamOptions', [budgetMember, backpressureMember, signalMember]);
+converters.PullOptions = createDictionaryConverter('PullOptions', [
+  signalMember,
+]);
+converters.PipeToOptions = createDictionaryConverter('PipeToOptions', [
+  {
+    __proto__: null,
+    key: 'preventClose',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  {
+    __proto__: null,
+    key: 'preventFail',
+    converter: baseConverters.boolean,
+    defaultValue: () => false,
+  },
+  signalMember,
+]);
+converters.PipeToSyncOptions = createDictionaryConverter(
+  'PipeToSyncOptions', [
+    {
+      __proto__: null,
+      key: 'preventClose',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+    {
+      __proto__: null,
+      key: 'preventFail',
+      converter: baseConverters.boolean,
+      defaultValue: () => false,
+    },
+  ]);
+converters.ConsumeOptions = createDictionaryConverter('ConsumeOptions', [
+  limitMember,
+  signalMember,
+]);
+converters.ConsumeSyncOptions = createDictionaryConverter(
+  'ConsumeSyncOptions', [limitMember]);
+const encodingMember = {
+  __proto__: null,
+  key: 'encoding',
+  converter: baseConverters.DOMString,
+  defaultValue: () => 'utf-8',
+};
+converters.TextConsumeOptions = createDictionaryConverter(
+  'TextConsumeOptions', [
+    [limitMember, signalMember],
+    [encodingMember],
+  ]);
+converters.TextConsumeSyncOptions = createDictionaryConverter(
+  'TextConsumeSyncOptions', [
+    [limitMember],
+    [encodingMember],
+  ]);
+converters.MergeOptions = createDictionaryConverter('MergeOptions', [
+  signalMember,
+]);
+converters.BroadcastOptions = createDictionaryConverter(
+  'BroadcastOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareOptions = createDictionaryConverter(
+  'ShareOptions', [budgetMember, backpressureMember, signalMember]);
+converters.ShareSyncOptions = createDictionaryConverter(
+  'ShareSyncOptions', [budgetMember, backpressureMember]);
+converters.DuplexDirectionOptions = createDictionaryConverter(
+  'DuplexDirectionOptions', [
+    budgetMember,
+    {
+      __proto__: null,
+      key: 'backpressure',
+      converter: converters.BackpressurePolicy,
+    },
+  ]);
+converters.DuplexOptions = createDictionaryConverter('DuplexOptions', [
+  {
+    __proto__: null,
+    key: 'a',
+    converter: converters.DuplexDirectionOptions,
+  },
+  {
+    __proto__: null,
+    key: 'b',
+    converter: converters.DuplexDirectionOptions,
+  },
+  budgetMember,
+  backpressureMember,
+  signalMember,
+]);
+
+module.exports = { converters };
diff --git a/lib/internal/streams/operators.js b/lib/internal/streams/operators.js
index 6db2df0e3646..a5cbe1af428f 100644
--- a/lib/internal/streams/operators.js
+++ b/lib/internal/streams/operators.js
@@ -29,6 +29,7 @@ const {
   validateFunction,
 } = require('internal/validators');
 const { kWeakHandler, kResistStopPropagation } = require('internal/event_target');
+const destroyImpl = require('internal/streams/destroy');
 const { finished } = require('internal/streams/end-of-stream');
 
 const kEmpty = Symbol('kEmpty');
@@ -177,6 +178,7 @@ function map(fn, options) {
         resume();
         resume = null;
       }
+      destroyImpl.destroyer(stream, null);
     }
   }.call(this);
 }
diff --git a/lib/internal/streams/readable.js b/lib/internal/streams/readable.js
index 56b819abac4f..847b3837af4c 100644
--- a/lib/internal/streams/readable.js
+++ b/lib/internal/streams/readable.js
@@ -138,6 +138,7 @@ const kHasPaused = 1 << 25;
 const kPaused = 1 << 26;
 const kDataListening = 1 << 27;
 const kEndScheduled = 1 << 28;
+const kEofReadablePending = 1 << 29;
 
 // TODO(benjamingr) it is likely slower to do it this way than with free functions
 function makeBitMapDescriptor(bit) {
@@ -682,7 +683,7 @@ Readable.prototype.read = function(n) {
     state.highWaterMark = computeNewHighWaterMark(n);
 
   if (n !== 0)
-    state[kState] &= ~kEmittedReadable;
+    state[kState] &= ~(kEmittedReadable | kEofReadablePending);
 
   // If we're doing read(0) to trigger a readable event, but we
   // already have a bunch of data in the buffer, then just trigger
@@ -825,7 +826,16 @@ function onEofChunk(stream, state) {
     // If we are sync, wait until next tick to emit the data.
     // Otherwise we risk emitting data in the flow()
     // the readable code triggers during a read() call.
-    emitReadable(stream);
+    if ((state[kState] & (kFlowing | kNeedReadable)) !== 0 ||
+        stream.listenerCount('readable') > 0) {
+      emitReadable(stream);
+    } else {
+      // Nobody is observing the stream: do not schedule the 'readable'
+      // emission at all. A 'readable' listener attached later redeems it
+      // (see Readable.prototype.on), and read() and resume() reach the
+      // end of the stream on their own.
+      state[kState] |= kEofReadablePending;
+    }
   } else {
     // Emit 'readable' now to make sure it gets picked up.
     state[kState] &= ~kNeedReadable;
@@ -1178,8 +1188,17 @@ Readable.prototype.on = function(ev, fn) {
       debug('on readable');
       if (state.length) {
         emitReadable(this);
-      } else if ((state[kState] & kReading) === 0) {
-        process.nextTick(nReadingNextTick, this);
+      } else {
+        if ((state[kState] & kEofReadablePending) !== 0) {
+          // The end-of-stream 'readable' emission was skipped because
+          // nobody was listening when the stream ended (see onEofChunk):
+          // emit it now.
+          state[kState] &= ~kEofReadablePending;
+          emitReadable(this);
+        }
+        if ((state[kState] & kReading) === 0) {
+          process.nextTick(nReadingNextTick, this);
+        }
       }
     }
   }
diff --git a/lib/internal/streams/writable.js b/lib/internal/streams/writable.js
index 47e003ea3a8a..09d713f8a1fe 100644
--- a/lib/internal/streams/writable.js
+++ b/lib/internal/streams/writable.js
@@ -787,7 +787,7 @@ function clearBuffer(stream, state) {
 
     if (i === buffered.length) {
       resetBuffer(state);
-    } else if (i > 256) {
+    } else if (i > 256 && i * 2 >= buffered.length) {
       buffered.splice(0, i);
       state.bufferedIndex = 0;
     } else {
diff --git a/lib/internal/trace_events.js b/lib/internal/trace_events.js
index d240f4ad589e..77959e4d5825 100644
--- a/lib/internal/trace_events.js
+++ b/lib/internal/trace_events.js
@@ -1,6 +1,11 @@
 'use strict';
 
-const { getCategoryEnabledBuffer, trace, usePerfetto } = internalBinding('trace_events');
+const {
+  getCategoryEnabledBuffer,
+  isTraceCategoryEnabled,
+  trace,
+  usePerfetto,
+} = internalBinding('trace_events');
 const {
   CHAR_UPPERCASE_B,
   CHAR_LOWERCASE_B,
@@ -17,6 +22,16 @@ if (usePerfetto) {
   nodeTraceEventCategory = (category) => `node,${category}`;
 }
 
+// The returned function reads the category's enabled flag directly when the
+// binding can expose it to JS, and asks the tracing controller otherwise.
+function categoryEnabledChecker(category) {
+  const buffer = getCategoryEnabledBuffer(category);
+  if (buffer === undefined) {
+    return () => isTraceCategoryEnabled(category);
+  }
+  return () => buffer[0] > 0;
+}
+
 // The async events describe the execution of a single asynchronous operation, and are
 // used to measure the time spent in a single asynchronous operation.
 // Async events may overlap with each other. Different events do not have
@@ -44,7 +59,7 @@ const kTraceInstant = CHAR_LOWERCASE_N;
 
 module.exports = {
   usePerfetto,
-  getCategoryEnabledBuffer,
+  categoryEnabledChecker,
   trace,
   nodeTraceEventCategory,
   kAsyncBegin,
diff --git a/lib/internal/util/comparisons.js b/lib/internal/util/comparisons.js
index 6b608a66733a..3fa6081cb366 100644
--- a/lib/internal/util/comparisons.js
+++ b/lib/internal/util/comparisons.js
@@ -15,6 +15,7 @@ const {
   Date,
   DatePrototypeGetTime,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Function,
@@ -50,7 +51,6 @@ const {
   Uint8ClampedArray,
   WeakMap,
   WeakSet,
-  globalThis: { Float16Array },
 } = primordials;
 
 const { compare } = internalBinding('buffer');
@@ -70,6 +70,7 @@ const wellKnownConstructors = new SafeSet()
   .add(DataView)
   .add(Date)
   .add(Error)
+  .add(Float16Array)
   .add(Float32Array)
   .add(Float64Array)
   .add(Function)
@@ -91,10 +92,6 @@ const wellKnownConstructors = new SafeSet()
   .add(WeakMap)
   .add(WeakSet);
 
-if (Float16Array) { // TODO(BridgeAR): Remove when Flag got removed from V8
-  wellKnownConstructors.add(Float16Array);
-}
-
 const types = require('internal/util/types');
 const {
   isAnyArrayBuffer,
@@ -132,6 +129,8 @@ let getCryptoKeyType;
 let getCryptoKeyExtractable;
 let getCryptoKeyAlgorithm;
 let getCryptoKeyUsagesMask;
+let getCryptoKeySecondaryHandle;
+let getCryptoKeySeedData;
 let getKeyObjectHandle;
 let getKeyObjectType;
 
@@ -432,14 +431,28 @@ function objectComparisonStart(val1, val2, mode, memos) {
         getCryptoKeyExtractable,
         getCryptoKeyAlgorithm,
         getCryptoKeyUsagesMask,
+        getCryptoKeySecondaryHandle,
+        getCryptoKeySeedData,
       } = require('internal/crypto/keys'));
     }
+    const val1SecondaryHandle = getCryptoKeySecondaryHandle(val1);
+    const val2SecondaryHandle = isCryptoKey(val2) ?
+      getCryptoKeySecondaryHandle(val2) : undefined;
+    const val1SeedData = getCryptoKeySeedData(val1);
+    const val2SeedData = isCryptoKey(val2) ?
+      getCryptoKeySeedData(val2) : undefined;
     if (!isCryptoKey(val2) ||
       getCryptoKeyType(val1) !== getCryptoKeyType(val2) ||
       getCryptoKeyExtractable(val1) !== getCryptoKeyExtractable(val2) ||
       !innerDeepEqual(getCryptoKeyAlgorithm(val1), getCryptoKeyAlgorithm(val2), mode, memos) ||
       getCryptoKeyUsagesMask(val1) !== getCryptoKeyUsagesMask(val2) ||
-      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2))
+      !getCryptoKeyHandle(val1).equals(getCryptoKeyHandle(val2)) ||
+      (val1SecondaryHandle === undefined) !== (val2SecondaryHandle === undefined) ||
+      (val1SecondaryHandle !== undefined &&
+        !val1SecondaryHandle.equals(val2SecondaryHandle)) ||
+      (val1SeedData === undefined) !== (val2SeedData === undefined) ||
+      (val1SeedData !== undefined &&
+        !innerDeepEqual(val1SeedData, val2SeedData, mode, memos))
     ) {
       return false;
     }
diff --git a/lib/internal/util/debuglog.js b/lib/internal/util/debuglog.js
index 1cb3ba4df520..2eeab81dcff4 100644
--- a/lib/internal/util/debuglog.js
+++ b/lib/internal/util/debuglog.js
@@ -16,7 +16,7 @@ const {
 } = primordials;
 const { inspect, format, formatWithOptions } = require('internal/util/inspect');
 const {
-  getCategoryEnabledBuffer,
+  categoryEnabledChecker,
   trace,
   nodeTraceEventCategory,
   kAsyncBegin,
@@ -388,14 +388,14 @@ function debugWithTimer(set, cb) {
   }
 
   const traceCategory = nodeTraceEventCategory(`node.${StringPrototypeToLowerCase(set)}`);
-  let traceCategoryBuffer;
+  let traceCategoryEnabled;
   let debugLogCategoryEnabled = false;
   let timerFlags = kNone;
 
   function ensureTimerFlagsAreUpdated() {
     timerFlags &= ~kSkipTrace;
 
-    if (traceCategoryBuffer[0] === 0) {
+    if (!traceCategoryEnabled()) {
       timerFlags |= kSkipTrace;
     }
   }
@@ -469,7 +469,7 @@ function debugWithTimer(set, cb) {
     }
     emitWarningIfNeeded(set);
     debugLogCategoryEnabled = testEnabled(set);
-    traceCategoryBuffer = getCategoryEnabledBuffer(traceCategory);
+    traceCategoryEnabled = categoryEnabledChecker(traceCategory);
 
     timerFlags = kNone;
 
@@ -477,7 +477,7 @@ function debugWithTimer(set, cb) {
       timerFlags |= kSkipLog;
     }
 
-    if (traceCategoryBuffer[0] === 0) {
+    if (!traceCategoryEnabled()) {
       timerFlags |= kSkipTrace;
     }
 
diff --git a/lib/internal/vfs/fd.js b/lib/internal/vfs/fd.js
index bd36ad218f48..1d1ffaabc78d 100644
--- a/lib/internal/vfs/fd.js
+++ b/lib/internal/vfs/fd.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const {
+  FunctionPrototypeBind,
+  ObjectDefineProperty,
   SafeMap,
   Symbol,
 } = primordials;
@@ -46,6 +48,42 @@ class VirtualFD {
   get entry() {
     return this[kEntry];
   }
+
+  getAsyncId() {
+    return this[kFd];
+  }
+
+  async close() {
+    await this[kEntry].close();
+    closeVirtualFd(this[kFd]);
+  }
+
+  closeSync() {
+    this[kEntry].closeSync();
+    closeVirtualFd(this[kFd]);
+  }
+}
+
+const vfsFileHandleMethods = [
+  'appendFile', 'chmod', 'chown', 'datasync', 'sync', 'read', 'readv',
+  'readFile', 'stat', 'truncate', 'utimes', 'write', 'writev', 'writeFile',
+];
+let FileHandle;
+
+function createVfsFileHandle(vfd) {
+  FileHandle ??= require('internal/fs/promises').FileHandle;
+  const fileHandle = new FileHandle(vfd);
+  const entry = vfd.entry;
+  for (let i = 0; i < vfsFileHandleMethods.length; i++) {
+    const method = vfsFileHandleMethods[i];
+    ObjectDefineProperty(fileHandle, method, {
+      __proto__: null,
+      configurable: true,
+      value: FunctionPrototypeBind(entry[method], entry),
+      writable: true,
+    });
+  }
+  return fileHandle;
 }
 
 /**
@@ -81,6 +119,7 @@ function closeVirtualFd(fd) {
 module.exports = {
   VFS_FD_MASK,
   VirtualFD,
+  createVfsFileHandle,
   openVirtualFd,
   getVirtualFd,
   closeVirtualFd,
diff --git a/lib/internal/vfs/file_handle.js b/lib/internal/vfs/file_handle.js
index 7b60c9def2b5..a65fe5f99386 100644
--- a/lib/internal/vfs/file_handle.js
+++ b/lib/internal/vfs/file_handle.js
@@ -27,6 +27,52 @@ const kFlags = Symbol('kFlags');
 const kMode = Symbol('kMode');
 const kPosition = Symbol('kPosition');
 const kClosed = Symbol('kClosed');
+const kAccess = Symbol('kAccess');
+
+const { stringToFlags } = require('internal/fs/utils');
+const {
+  fs: { O_APPEND, O_CREAT, O_EXCL, O_RDONLY, O_RDWR, O_TRUNC, O_WRONLY },
+} = internalBinding('constants');
+
+/**
+ * Decodes open flags into what they ask for. Both the string spellings and
+ * the numeric `fs.constants` values are accepted. The bits decide, because
+ * several numeric combinations (`O_WRONLY` alone, `O_RDONLY | O_CREAT`)
+ * have no string spelling, and collapsing them to the nearest one changes
+ * their meaning: a plain `O_WRONLY` must neither create nor truncate.
+ * @param {string|number} flags
+ * @returns {{ readable: boolean, writable: boolean, create: boolean,
+ *   exclusive: boolean, truncate: boolean, append: boolean }}
+ */
+function decodeOpenFlags(flags) {
+  const bits = typeof flags === 'number' ? flags : stringToFlags(flags);
+  const access = bits & (O_RDONLY | O_WRONLY | O_RDWR);
+  return {
+    __proto__: null,
+    readable: access !== O_WRONLY,
+    writable: access !== O_RDONLY,
+    create: (bits & O_CREAT) !== 0,
+    exclusive: (bits & O_EXCL) !== 0,
+    truncate: (bits & O_TRUNC) !== 0,
+    append: (bits & O_APPEND) !== 0,
+  };
+}
+
+/**
+ * The string spelling closest to numeric flags, for `handle.flags`, which
+ * has always been a string. Behaviour is never derived from it.
+ * @param {string|number} flags
+ * @returns {string}
+ */
+function flagsToString(flags) {
+  if (typeof flags !== 'number') return flags;
+  const { readable, writable, exclusive, truncate, append } = decodeOpenFlags(flags);
+  const plus = readable && writable ? '+' : '';
+  const x = exclusive ? 'x' : '';
+  if (append) return `a${x}${plus}`;
+  if (truncate) return `w${x}${plus}`;
+  return writable ? 'r+' : 'r';
+}
 
 function isCurrentPosition(position) {
   return position === null || position === undefined || position === -1;
@@ -44,7 +90,8 @@ class VirtualFileHandle {
    */
   constructor(path, flags, mode) {
     this[kPath] = path;
-    this[kFlags] = flags;
+    this[kAccess] = decodeOpenFlags(flags);
+    this[kFlags] = flagsToString(flags);
     this[kMode] = mode ?? 0o644;
     this[kPosition] = 0;
     this[kClosed] = false;
@@ -387,19 +434,15 @@ class MemoryFileHandle extends VirtualFileHandle {
     this.#entry = entry;
     this.#getStats = getStats;
 
-    // Handle different open modes
-    if (flags === 'w' || flags === 'w+' ||
-        flags === 'wx' || flags === 'wx+') {
-      // Write mode: truncate
+    // O_TRUNC empties the file at open time. O_APPEND does not move the
+    // read offset: it only forces writes to the end, so the position stays
+    // at 0 and reads start from the beginning as they do on a real file.
+    if (this[kAccess].truncate) {
       this.#content = Buffer.alloc(0);
       this.#size = 0;
       if (entry) {
         entry.content = this.#content;
       }
-    } else if (flags === 'a' || flags === 'a+' ||
-               flags === 'ax' || flags === 'ax+') {
-      // Append mode: position at end
-      this.position = this.#size;
     }
   }
 
@@ -407,7 +450,7 @@ class MemoryFileHandle extends VirtualFileHandle {
    * Throws EBADF if the handle was not opened for writing.
    */
   #checkWritable() {
-    if (this.flags === 'r') {
+    if (!this[kAccess].writable) {
       throw createEBADF('write');
     }
   }
@@ -416,8 +459,7 @@ class MemoryFileHandle extends VirtualFileHandle {
    * Throws EBADF if the handle was not opened for reading.
    */
   #checkReadable() {
-    const f = this.flags;
-    if (f === 'w' || f === 'a' || f === 'wx' || f === 'ax') {
+    if (!this[kAccess].readable) {
       throw createEBADF('read');
     }
   }
@@ -427,8 +469,7 @@ class MemoryFileHandle extends VirtualFileHandle {
    * @returns {boolean}
    */
   #isAppend() {
-    const f = this.flags;
-    return f === 'a' || f === 'a+' || f === 'ax' || f === 'ax+';
+    return this[kAccess].append;
   }
 
   /**
@@ -605,42 +646,16 @@ class MemoryFileHandle extends VirtualFileHandle {
   }
 
   /**
-   * Writes data to the file synchronously.
-   * Replaces content in 'w' mode, appends in 'a' mode.
+   * Writes data to the file synchronously, from the current position (the
+   * end, in append mode), the way `filehandle.writeFile()` does. Whether
+   * earlier content is discarded was decided by the open flags: "w" has
+   * already truncated, "r+" overwrites in place and keeps any tail.
    * @param {Buffer|string} data The data to write
    * @param {object} [options] Options
    */
   writeFileSync(data, options) {
-    this.#checkClosed('write');
-    this.#checkWritable();
-
     const buffer = typeof data === 'string' ? Buffer.from(data, options?.encoding) : data;
-
-    // In append mode, append to existing content
-    if (this.#isAppend()) {
-      const neededSize = this.#size + buffer.length;
-      if (neededSize > this.#content.length) {
-        const newCapacity = MathMax(neededSize, this.#content.length * 2);
-        const newContent = Buffer.alloc(newCapacity);
-        this.#content.copy(newContent, 0, 0, this.#size);
-        this.#content = newContent;
-      }
-      buffer.copy(this.#content, this.#size);
-      this.#size = neededSize;
-    } else {
-      this.#content = Buffer.from(buffer);
-      this.#size = buffer.length;
-    }
-
-    // Update the entry's content, mtime, and ctime
-    if (this.#entry) {
-      const now = DateNow();
-      this.#entry.content = this.#content.subarray(0, this.#size);
-      this.#entry.mtime = now;
-      this.#entry.ctime = now;
-    }
-
-    this.position = this.#size;
+    this.writeSync(buffer, 0, buffer.length, null);
   }
 
   /**
@@ -721,4 +736,6 @@ class MemoryFileHandle extends VirtualFileHandle {
 module.exports = {
   VirtualFileHandle,
   MemoryFileHandle,
+  decodeOpenFlags,
+  kAccess,
 };
diff --git a/lib/internal/vfs/providers/memory.js b/lib/internal/vfs/providers/memory.js
index acec5b4166b2..2fd9a7d78cae 100644
--- a/lib/internal/vfs/providers/memory.js
+++ b/lib/internal/vfs/providers/memory.js
@@ -16,7 +16,7 @@ const { Buffer } = require('buffer');
 const { isPromise } = require('util/types');
 const { posix: pathPosix } = require('path');
 const { VirtualProvider } = require('internal/vfs/provider');
-const { MemoryFileHandle } = require('internal/vfs/file_handle');
+const { MemoryFileHandle, decodeOpenFlags } = require('internal/vfs/file_handle');
 const {
   VFSWatcher,
   VFSStatWatcher,
@@ -46,45 +46,12 @@ const { Dirent } = require('internal/fs/utils');
 const { kEmptyObject } = require('internal/util');
 const {
   fs: {
-    O_APPEND,
-    O_CREAT,
-    O_EXCL,
-    O_RDWR,
-    O_TRUNC,
-    O_WRONLY,
     UV_DIRENT_FILE,
     UV_DIRENT_DIR,
     UV_DIRENT_LINK,
   },
 } = internalBinding('constants');
 
-/**
- * Converts numeric flags to a string representation.
- * If already a string, returns as-is.
- * @param {string|number} flags The flags to normalize
- * @returns {string} Normalized string flags
- */
-function normalizeFlags(flags) {
-  if (typeof flags === 'string') return flags;
-  if (typeof flags !== 'number') return 'r';
-
-  const rdwr = (flags & O_RDWR) !== 0;
-  const append = (flags & O_APPEND) !== 0;
-  const excl = (flags & O_EXCL) !== 0;
-  const write = (flags & O_WRONLY) !== 0 ||
-                (flags & O_CREAT) !== 0 ||
-                (flags & O_TRUNC) !== 0;
-
-  if (append) {
-    return 'a' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  }
-  if (write) {
-    return 'w' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  }
-  if (rdwr) return 'r+';
-  return 'r';
-}
-
 /**
  * Converts a time argument (Date, number, or string) to milliseconds.
  * Numbers are treated as seconds (matching Node.js utimes convention).
@@ -496,33 +463,23 @@ class MemoryProvider extends VirtualProvider {
 
   openSync(path, flags, mode) {
     const normalized = this.#normalizePath(path);
+    const access = decodeOpenFlags(flags);
 
-    // Normalize numeric flags to string
-    flags = normalizeFlags(flags);
-
-    // Handle create and exclusive modes
-    const isCreate = flags === 'w' || flags === 'w+' ||
-                     flags === 'a' || flags === 'a+' ||
-                     flags === 'wx' || flags === 'wx+' ||
-                     flags === 'ax' || flags === 'ax+';
-    const isExclusive = flags === 'wx' || flags === 'wx+' ||
-                        flags === 'ax' || flags === 'ax+';
-    const isWritable = flags !== 'r';
-
-    // Check readonly for any writable mode
-    if (this.readonly && isWritable) {
+    // Creating a file is a write even when the handle itself is read-only.
+    if (this.readonly && (access.writable || access.create)) {
       throw createEROFS('open', path);
     }
 
     let entry;
     try {
       entry = this.#getEntry(normalized, 'open');
-      // Exclusive flag: file must not exist
-      if (isExclusive) {
+      // O_EXCL only means anything together with O_CREAT: the file must
+      // not exist yet.
+      if (access.create && access.exclusive) {
         throw createEEXIST('open', path);
       }
     } catch (err) {
-      if (err.code !== 'ENOENT' || !isCreate) throw err;
+      if (err.code !== 'ENOENT' || !access.create) throw err;
       // Create the file
       const parent = this.#ensureParent(normalized, false, 'open');
       const name = pathPosix.basename(normalized);
@@ -840,6 +797,10 @@ class MemoryProvider extends VirtualProvider {
 
     // Check if destination exists
     const existingDest = newParent.children.get(newName);
+    if (existingDest === entry) {
+      // Both names resolve to the same entry: rename does nothing
+      return;
+    }
     if (existingDest) {
       // Cannot overwrite a directory with a non-directory
       if (existingDest.isDirectory() && !entry.isDirectory()) {
@@ -849,6 +810,15 @@ class MemoryProvider extends VirtualProvider {
       if (!existingDest.isDirectory() && entry.isDirectory()) {
         throw createENOTDIR('rename', newPath);
       }
+      if (existingDest.isDirectory()) {
+        this.#ensurePopulated(existingDest, normalizedNew);
+        // Cannot overwrite a non-empty directory
+        if (existingDest.children.size > 0) {
+          throw createENOTEMPTY('rename', newPath);
+        }
+      } else {
+        existingDest.nlink--;
+      }
     }
 
     // Remove from old location (after destination validation)
diff --git a/lib/internal/vfs/providers/sea.js b/lib/internal/vfs/providers/sea.js
new file mode 100644
index 000000000000..4a03246c271b
--- /dev/null
+++ b/lib/internal/vfs/providers/sea.js
@@ -0,0 +1,349 @@
+'use strict';
+
+const {
+  ArrayFrom,
+  ArrayPrototypeFilter,
+  ArrayPrototypePop,
+  ArrayPrototypePush,
+  Boolean,
+  ObjectKeys,
+  SafeMap,
+  SafeSet,
+  StringPrototypeReplaceAll,
+  StringPrototypeSplit,
+  StringPrototypeStartsWith,
+  Symbol,
+  Uint8Array,
+} = primordials;
+
+const { Buffer } = require('buffer');
+const { posix: pathPosix } = require('path');
+const { VirtualProvider } = require('internal/vfs/provider');
+const { MemoryFileHandle } = require('internal/vfs/file_handle');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+const {
+  createENOENT,
+  createENOTDIR,
+  createEISDIR,
+  createEROFS,
+} = require('internal/vfs/errors');
+const {
+  createFileStats,
+  createDirectoryStats,
+} = require('internal/vfs/stats');
+const { Dirent } = require('internal/fs/utils');
+const { kEmptyObject } = require('internal/util');
+const {
+  fs: {
+    UV_DIRENT_FILE,
+    UV_DIRENT_DIR,
+  },
+} = internalBinding('constants');
+
+// Private symbols
+const kAssets = Symbol('kAssets');
+const kExtraFiles = Symbol('kExtraFiles');
+const kDirectories = Symbol('kDirectories');
+const kGetAsset = Symbol('kGetAsset');
+const kSizes = Symbol('kSizes');
+
+/* c8 ignore start -- the SEA provider requires an actual SEA binary to run */
+
+/**
+ * Read-only provider serving the assets bundled into a Single Executable
+ * Application. Asset content stays in the executable's SEA blob and is
+ * copied into JS memory only when a file is opened.
+ */
+class SEAProvider extends VirtualProvider {
+  /**
+   * @param {object} [options] Options
+   * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+   *   files to serve alongside the assets, keyed by path (used for the SEA
+   *   main script, whose source lives in the SEA blob but not in the assets)
+   */
+  constructor(options = kEmptyObject) {
+    super();
+
+    const { isSea, getAsset, getAssetKeys } = internalBinding('sea');
+
+    if (!isSea()) {
+      throw new ERR_INVALID_STATE(
+        'SEAProvider can only be used in a Single Executable Application');
+    }
+
+    this[kGetAsset] = getAsset;
+    // Map of normalized path -> asset key
+    this[kAssets] = new SafeMap();
+    // Map of normalized path -> Buffer content
+    this[kExtraFiles] = new SafeMap();
+    // Map of directory path -> SafeSet of child names
+    this[kDirectories] = new SafeMap();
+    // Cache of file sizes so stat does not have to copy asset content
+    this[kSizes] = new SafeMap();
+
+    // Root directory always exists
+    this[kDirectories].set('/', new SafeSet());
+
+    const keys = getAssetKeys() || [];
+    for (let i = 0; i < keys.length; i++) {
+      const key = keys[i];
+      this[kAssets].set(this.#normalizePath(key), key);
+    }
+    const extraFiles = options.extraFiles;
+    if (extraFiles !== undefined) {
+      const paths = ObjectKeys(extraFiles);
+      for (let i = 0; i < paths.length; i++) {
+        const path = paths[i];
+        const content = extraFiles[path];
+        const buffer = typeof content === 'string' ?
+          Buffer.from(content) : content;
+        const normalized = this.#normalizePath(path);
+        this[kExtraFiles].set(normalized, buffer);
+        this[kSizes].set(normalized, buffer.length);
+      }
+    }
+
+    // Derive the directory tree from the file paths
+    for (const path of this.#filePaths()) {
+      const parts = ArrayPrototypeFilter(
+        StringPrototypeSplit(path, '/'), Boolean);
+      let currentPath = '/';
+      for (let i = 0; i < parts.length - 1; i++) {
+        const parentPath = currentPath;
+        currentPath = pathPosix.join(currentPath, parts[i]);
+        if (!this[kDirectories].has(currentPath)) {
+          this[kDirectories].set(currentPath, new SafeSet());
+        }
+        this[kDirectories].get(parentPath).add(parts[i]);
+      }
+      if (parts.length > 0) {
+        this[kDirectories].get(pathPosix.dirname(path)).add(
+          pathPosix.basename(path));
+      }
+    }
+  }
+
+  get readonly() {
+    return true;
+  }
+
+  get supportsSymlinks() {
+    return false;
+  }
+
+  /**
+   * Iterates over the normalized paths of all files.
+   * @yields {string} The normalized path of each file
+   */
+  * #filePaths() {
+    yield* this[kAssets].keys();
+    yield* this[kExtraFiles].keys();
+  }
+
+  /**
+   * Normalizes a path to an absolute posix-style path.
+   * @param {string} path The path
+   * @returns {string} Normalized path
+   */
+  #normalizePath(path) {
+    let normalized = StringPrototypeReplaceAll(path, '\\', '/');
+    if (!StringPrototypeStartsWith(normalized, '/')) {
+      normalized = '/' + normalized;
+    }
+    return pathPosix.normalize(normalized);
+  }
+
+  /**
+   * Checks if a normalized path is a file.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isFile(path) {
+    return this[kAssets].has(path) || this[kExtraFiles].has(path);
+  }
+
+  /**
+   * Checks if a normalized path is a directory.
+   * @param {string} path Normalized path
+   * @returns {boolean}
+   */
+  #isDirectory(path) {
+    return this[kDirectories].has(path);
+  }
+
+  /**
+   * Gets the file content as an independently mutable Buffer.
+   * @param {string} path Normalized path
+   * @returns {Buffer}
+   */
+  #getContent(path) {
+    const extra = this[kExtraFiles].get(path);
+    if (extra !== undefined) {
+      return Buffer.from(extra);
+    }
+    const key = this[kAssets].get(path);
+    if (key === undefined) {
+      throw createENOENT('open', path);
+    }
+    // getAsset returns a zero-copy ArrayBuffer over the (possibly read-only)
+    // SEA blob in the executable; copy it so the handle owns mutable memory.
+    const content = Buffer.from(new Uint8Array(this[kGetAsset](key)));
+    this[kSizes].set(path, content.length);
+    return content;
+  }
+
+  /**
+   * Gets the size of a file, loading the content only on first access.
+   * @param {string} path Normalized path
+   * @returns {number}
+   */
+  #getSize(path) {
+    let size = this[kSizes].get(path);
+    if (size === undefined) {
+      size = this.#getContent(path).length;
+    }
+    return size;
+  }
+
+  openSync(path, flags, mode) {
+    // Normalize numeric flags (O_RDONLY === 0) to a string
+    const normalizedFlags = typeof flags === 'number' ?
+      (flags === 0 ? 'r' : null) : flags;
+    if (normalizedFlags !== 'r') {
+      throw createEROFS('open', path);
+    }
+
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      throw createEISDIR('open', path);
+    }
+    if (!this.#isFile(normalized)) {
+      throw createENOENT('open', path);
+    }
+
+    const content = this.#getContent(normalized);
+    const getStats = () => createFileStats(content.length, { mode: 0o444 });
+    return new MemoryFileHandle(normalized, 'r', 0o444, content, null,
+                                getStats);
+  }
+
+  async open(path, flags, mode) {
+    return this.openSync(path, flags, mode);
+  }
+
+  statSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (this.#isDirectory(normalized)) {
+      return createDirectoryStats({ mode: 0o555, bigint: options?.bigint });
+    }
+    if (this.#isFile(normalized)) {
+      return createFileStats(this.#getSize(normalized),
+                             { mode: 0o444, bigint: options?.bigint });
+    }
+    throw createENOENT('stat', path);
+  }
+
+  async stat(path, options) {
+    return this.statSync(path, options);
+  }
+
+  readdirSync(path, options) {
+    const normalized = this.#normalizePath(path);
+
+    if (!this.#isDirectory(normalized)) {
+      if (this.#isFile(normalized)) {
+        throw createENOTDIR('scandir', path);
+      }
+      throw createENOENT('scandir', path);
+    }
+
+    const withFileTypes = options?.withFileTypes === true;
+    const recursive = options?.recursive === true;
+
+    if (recursive) {
+      return this.#readdirRecursive(normalized, withFileTypes);
+    }
+
+    const names = ArrayFrom(this[kDirectories].get(normalized));
+    if (!withFileTypes) {
+      return names;
+    }
+
+    const dirents = [];
+    for (let i = 0; i < names.length; i++) {
+      const childPath = pathPosix.join(normalized, names[i]);
+      const type = this.#isDirectory(childPath) ?
+        UV_DIRENT_DIR : UV_DIRENT_FILE;
+      ArrayPrototypePush(dirents, new Dirent(names[i], type, normalized));
+    }
+    return dirents;
+  }
+
+  /**
+   * Recursively reads directory contents.
+   * @param {string} dirPath The normalized directory path
+   * @param {boolean} withFileTypes Whether to return Dirent objects
+   * @returns {string[]|Dirent[]}
+   */
+  #readdirRecursive(dirPath, withFileTypes) {
+    const results = [];
+
+    // Traverse depth-first in preorder with an explicit frame stack, so a
+    // deeply nested asset tree cannot exhaust the call stack.
+    const stack = [{
+      path: dirPath,
+      relative: '',
+      children: ArrayFrom(this[kDirectories].get(dirPath)),
+      index: 0,
+    }];
+
+    while (stack.length > 0) {
+      const frame = stack[stack.length - 1];
+      if (frame.index >= frame.children.length) {
+        ArrayPrototypePop(stack);
+        continue;
+      }
+
+      const name = frame.children[frame.index++];
+      const childPath = pathPosix.join(frame.path, name);
+      const childRelative = frame.relative ?
+        `${frame.relative}/${name}` : name;
+      const isDir = this.#isDirectory(childPath);
+
+      if (withFileTypes) {
+        const type = isDir ? UV_DIRENT_DIR : UV_DIRENT_FILE;
+        ArrayPrototypePush(results,
+                           new Dirent(childRelative, type, dirPath));
+      } else {
+        ArrayPrototypePush(results, childRelative);
+      }
+
+      if (isDir) {
+        ArrayPrototypePush(stack, {
+          path: childPath,
+          relative: childRelative,
+          children: ArrayFrom(this[kDirectories].get(childPath)),
+          index: 0,
+        });
+      }
+    }
+
+    return results;
+  }
+
+  async readdir(path, options) {
+    return this.readdirSync(path, options);
+  }
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  SEAProvider,
+};
diff --git a/lib/internal/vfs/providers/ziparchive.js b/lib/internal/vfs/providers/ziparchive.js
index f369cdd22f76..9f4ecceee460 100644
--- a/lib/internal/vfs/providers/ziparchive.js
+++ b/lib/internal/vfs/providers/ziparchive.js
@@ -5,6 +5,7 @@ const {
   ArrayPrototypePush,
   MathMax,
   MathMin,
+  Number,
   StringPrototypeIndexOf,
   StringPrototypeSlice,
   StringPrototypeStartsWith,
@@ -20,8 +21,13 @@ const {
   },
 } = require('internal/errors');
 const { VirtualProvider } = require('internal/vfs/provider');
-const { VirtualFileHandle } = require('internal/vfs/file_handle');
 const {
+  VirtualFileHandle,
+  decodeOpenFlags,
+  kAccess,
+} = require('internal/vfs/file_handle');
+const {
+  createEBADF,
   createEEXIST,
   createEISDIR,
   createENOENT,
@@ -33,12 +39,6 @@ const { createFileStats, createDirectoryStats } = require('internal/vfs/stats');
 const { Dirent } = require('internal/fs/utils');
 const {
   fs: {
-    O_APPEND,
-    O_CREAT,
-    O_EXCL,
-    O_RDWR,
-    O_TRUNC,
-    O_WRONLY,
     UV_DIRENT_DIR,
     UV_DIRENT_FILE,
   },
@@ -51,41 +51,30 @@ function normalize(vfsPath) {
   return StringPrototypeStartsWith(vfsPath, '/') ? StringPrototypeSlice(vfsPath, 1) : vfsPath;
 }
 
-// Converts numeric open flags (e.g. `fs.constants.O_RDWR`) to the flag strings
-// the helpers below understand, so a caller passing `node:fs`-style numeric
-// flags through the VFS is handled the same way `fs` would. Strings pass
-// through unchanged; anything else falls back to 'r'.
-function normalizeFlags(flags) {
-  if (typeof flags === 'string') return flags;
-  if (typeof flags !== 'number') return 'r';
-  const rdwr = (flags & O_RDWR) !== 0;
-  const append = (flags & O_APPEND) !== 0;
-  const excl = (flags & O_EXCL) !== 0;
-  const write = (flags & O_WRONLY) !== 0 || (flags & O_CREAT) !== 0 || (flags & O_TRUNC) !== 0;
-  if (append) return 'a' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  if (write) return 'w' + (excl ? 'x' : '') + (rdwr ? '+' : '');
-  if (rdwr) return 'r+';
-  return 'r';
-}
-
+// The open flags decide by their bits, not by a string spelling: numeric
+// `fs.constants` combinations such as `O_WRONLY` alone or `O_RDONLY | O_CREAT`
+// have no string form, so `decodeOpenFlags` is the one place that interprets
+// them and these helpers are thin readers over it. They accept both strings
+// and numbers so call sites need not care which they were given.
 function isCurrentPosition(position) {
   return position === null || position === undefined || position === -1;
 }
 
 function isWriteTruncate(flags) {
-  return flags === 'w' || flags === 'w+' || flags === 'wx' || flags === 'wx+';
+  return decodeOpenFlags(flags).truncate;
 }
 
-function isAppend(flags) {
-  return flags === 'a' || flags === 'a+' || flags === 'ax' || flags === 'ax+';
+function isExclusive(flags) {
+  const access = decodeOpenFlags(flags);
+  return access.create && access.exclusive;
 }
 
-function isReadableFlag(flags) {
-  return flags !== 'w' && flags !== 'a' && flags !== 'wx' && flags !== 'ax';
+function mustExist(flags) {
+  return !decodeOpenFlags(flags).create;
 }
 
 function isWritableFlag(flags) {
-  return flags !== 'r';
+  return decodeOpenFlags(flags).writable;
 }
 
 /**
@@ -115,6 +104,8 @@ class ZipFileHandle extends VirtualFileHandle {
   #buffer;
   #size;
   #dirty = false;
+  #entryMode;
+  #modified;
 
   /**
    * @param {string} path
@@ -125,20 +116,28 @@ class ZipFileHandle extends VirtualFileHandle {
    * @param {Buffer} initial The entry's current decompressed content, or an
    *   empty buffer for a new/truncated file
    */
-  constructor(path, flags, mode, source, name, initial) {
+  constructor(path, flags, mode, source, name, initial, entry = null, dirty = false) {
     super(path, flags, mode);
+    // An existing entry keeps its own mode and modification time across a
+    // rewrite; only a newly created file takes the mode open() was given.
+    this.#entryMode = entry === null ? this.mode : (entry.mode || 0o644);
+    this.#modified = entry === null ? null : entry.modified;
+    // Creation and truncation take effect at open time on a real file, so
+    // such a handle is committed on close even when nothing is written.
+    this.#dirty = dirty;
     this.#source = source;
     this.#name = name;
     this.#buffer = initial;
     this.#size = initial.length;
-    if (isAppend(flags)) this.position = this.#size;
   }
 
+  // Access-mode violations are EBADF, as for any descriptor opened without
+  // the needed access; EISDIR is for directories only.
   #checkReadable() {
-    if (!isReadableFlag(this.flags)) throw createEISDIR('read', this.path);
+    if (!this[kAccess].readable) throw createEBADF('read');
   }
   #checkWritable() {
-    if (!isWritableFlag(this.flags)) throw createEISDIR('write', this.path);
+    if (!this[kAccess].writable) throw createEBADF('write');
   }
   #ensureCapacity(size) {
     if (size <= this.#buffer.length) return;
@@ -151,7 +150,9 @@ class ZipFileHandle extends VirtualFileHandle {
   #doRead(buffer, offset, length, position) {
     this.#checkReadable();
     const useCurrent = isCurrentPosition(position);
-    const pos = useCurrent ? this.position : position;
+    // `position` may be a BigInt, which fs allows; the arithmetic below is
+    // on numbers.
+    const pos = useCurrent ? this.position : Number(position);
     const available = MathMax(0, this.#size - pos);
     const bytesRead = MathMin(length, available);
     if (bytesRead > 0) this.#buffer.copy(buffer, offset, pos, pos + bytesRead);
@@ -161,14 +162,16 @@ class ZipFileHandle extends VirtualFileHandle {
   async read(buffer, offset, length, position) {
     return this.#doRead(buffer, offset, length, position);
   }
+  // The synchronous form reports the count alone, like `fs.readSync` and the
+  // memory handle; the `{ bytesRead, buffer }` shape belongs to the promise.
   readSync(buffer, offset, length, position) {
-    return this.#doRead(buffer, offset, length, position);
+    return this.#doRead(buffer, offset, length, position).bytesRead;
   }
 
   #doWrite(buffer, offset, length, position) {
     this.#checkWritable();
     const useCurrent = isCurrentPosition(position);
-    const pos = isAppend(this.flags) ? this.#size : (useCurrent ? this.position : position);
+    const pos = this[kAccess].append ? this.#size : (useCurrent ? this.position : Number(position));
     this.#ensureCapacity(pos + length);
     buffer.copy(this.#buffer, pos, offset, offset + length);
     if (pos + length > this.#size) this.#size = pos + length;
@@ -180,7 +183,7 @@ class ZipFileHandle extends VirtualFileHandle {
     return this.#doWrite(buffer, offset, length, position);
   }
   writeSync(buffer, offset, length, position) {
-    return this.#doWrite(buffer, offset, length, position);
+    return this.#doWrite(buffer, offset, length, position).bytesWritten;
   }
 
   #doReadFile(options) {
@@ -196,22 +199,14 @@ class ZipFileHandle extends VirtualFileHandle {
     return this.#doReadFile(options);
   }
 
-  // Replaces content, except in append mode ('a'/'a+'/'ax'/'ax+'), where it
-  // appends to the existing content instead - matching MemoryFileHandle and
-  // what makes `appendFile()`/`appendFileSync()` (built on this, by
-  // VirtualProvider's defaults) actually append.
+  // Writes from the current position (the end, in append mode), the way
+  // `filehandle.writeFile()` does. Whether earlier content is discarded was
+  // decided by the open flags: "w" has already truncated, "r+" overwrites in
+  // place and keeps any tail. This is what makes `appendFile()` (built on
+  // this by VirtualProvider's defaults) actually append.
   #doWriteFile(data, options) {
-    this.#checkWritable();
     const content = typeof data === 'string' ? Buffer.from(data, options?.encoding) : Buffer.from(data);
-    if (isAppend(this.flags)) {
-      this.#ensureCapacity(this.#size + content.length);
-      content.copy(this.#buffer, this.#size);
-      this.#size += content.length;
-    } else {
-      this.#buffer = content;
-      this.#size = content.length;
-    }
-    this.#dirty = true;
+    this.#doWrite(content, 0, content.length, null);
   }
   async writeFile(data, options) {
     this.#doWriteFile(data, options);
@@ -220,8 +215,14 @@ class ZipFileHandle extends VirtualFileHandle {
     this.#doWriteFile(data, options);
   }
 
+  // Reports the entry's own mode and, until the handle has changed the file,
+  // its own modification time; once dirty the file is as new as its close.
   #doStat() {
-    return createFileStats(this.#size, { mode: this.mode });
+    return createFileStats(this.#size, {
+      __proto__: null,
+      mode: this.#entryMode,
+      mtimeMs: this.#dirty || this.#modified === null ? undefined : this.#modified.getTime(),
+    });
   }
   async stat(options) {
     return this.#doStat();
@@ -233,6 +234,10 @@ class ZipFileHandle extends VirtualFileHandle {
   #doTruncate(len) {
     this.#checkWritable();
     this.#ensureCapacity(len);
+    // Growing exposes bytes past the old size. A fresh buffer is zeroed, but
+    // one that was shrunk earlier still holds the cut-off content, which a
+    // real file never hands back.
+    if (len > this.#size) this.#buffer.fill(0, this.#size, len);
     this.#size = len;
     this.#dirty = true;
   }
@@ -245,13 +250,15 @@ class ZipFileHandle extends VirtualFileHandle {
 
   async close() {
     if (this.#dirty && isWritableFlag(this.flags)) {
-      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+      await this.#source.add(this.#name, this.#buffer.subarray(0, this.#size),
+                             { __proto__: null, mode: this.#entryMode });
     }
     await super.close();
   }
   closeSync() {
     if (this.#dirty && isWritableFlag(this.flags)) {
-      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size), { mode: this.mode });
+      this.#source.addSync(this.#name, this.#buffer.subarray(0, this.#size),
+                           { __proto__: null, mode: this.#entryMode });
     }
     super.closeSync();
   }
@@ -330,50 +337,50 @@ class ZipProvider extends VirtualProvider {
   }
 
   async open(path, flags, mode) {
-    flags = normalizeFlags(flags);
     const name = normalize(path);
     const fileEntry = await this.#getEntry(name);
     if (fileEntry === null && this.#isDirectory(name)) {
       throw createEISDIR('open', path);
     }
     const exists = fileEntry !== null;
-    if (isWritableFlag(flags) && this.readonly) {
+    if ((isWritableFlag(flags) || !mustExist(flags)) && this.readonly) {
       throw createEROFS('open', path);
     }
-    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+    if (isExclusive(flags) && exists) {
       throw createEEXIST('open', path);
     }
-    if (!exists && (flags === 'r' || flags === 'r+')) {
+    if (!exists && mustExist(flags)) {
       throw createENOENT('open', path);
     }
     let initial = EMPTY_BUFFER;
     if (exists && !isWriteTruncate(flags)) {
       initial = await fileEntry.content();
     }
-    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial,
+                             fileEntry, !exists || isWriteTruncate(flags));
   }
   openSync(path, flags, mode) {
-    flags = normalizeFlags(flags);
     const name = normalize(path);
     const fileEntry = this.#getEntrySync(name);
     if (fileEntry === null && this.#isDirectory(name)) {
       throw createEISDIR('open', path);
     }
     const exists = fileEntry !== null;
-    if (isWritableFlag(flags) && this.readonly) {
+    if ((isWritableFlag(flags) || !mustExist(flags)) && this.readonly) {
       throw createEROFS('open', path);
     }
-    if ((flags === 'wx' || flags === 'wx+' || flags === 'ax' || flags === 'ax+') && exists) {
+    if (isExclusive(flags) && exists) {
       throw createEEXIST('open', path);
     }
-    if (!exists && (flags === 'r' || flags === 'r+')) {
+    if (!exists && mustExist(flags)) {
       throw createENOENT('open', path);
     }
     let initial = EMPTY_BUFFER;
     if (exists && !isWriteTruncate(flags)) {
       initial = fileEntry.contentSync();
     }
-    return new ZipFileHandle(path, flags, mode, this.#source, name, initial);
+    return new ZipFileHandle(path, flags, mode, this.#source, name, initial,
+                             fileEntry, !exists || isWriteTruncate(flags));
   }
 
   async stat(path, options) {
@@ -531,6 +538,9 @@ class ZipProvider extends VirtualProvider {
     const newName = normalize(newPath);
     const entry = await this.#getEntry(oldName);
     if (entry === null) throw createENOENT('rename', oldPath);
+    // A file cannot take a directory's name; the archive would otherwise
+    // hold both under it.
+    if (this.#isDirectory(newName)) throw createEISDIR('rename', newPath);
     const content = await entry.content();
     await this.#source.add(newName, content, {
       mode: entry.mode || undefined,
@@ -545,6 +555,7 @@ class ZipProvider extends VirtualProvider {
     const newName = normalize(newPath);
     const entry = this.#getEntrySync(oldName);
     if (entry === null) throw createENOENT('rename', oldPath);
+    if (this.#isDirectory(newName)) throw createEISDIR('rename', newPath);
     const content = entry.contentSync();
     this.#source.addSync(newName, content, {
       mode: entry.mode || undefined,
diff --git a/lib/internal/vfs/sea.js b/lib/internal/vfs/sea.js
new file mode 100644
index 000000000000..f08bc71bd91b
--- /dev/null
+++ b/lib/internal/vfs/sea.js
@@ -0,0 +1,58 @@
+'use strict';
+
+const { isSea, isVfsEnabled } = internalBinding('sea');
+const { kEmptyObject } = require('internal/util');
+const {
+  codes: {
+    ERR_INVALID_STATE,
+  },
+} = require('internal/errors');
+
+let initialized = false;
+
+/* c8 ignore start -- SEA VFS initialization requires an actual SEA binary */
+
+/**
+ * Initializes the SEA virtual file system: a read-only VFS serving the
+ * assets bundled into the executable, mounted at its reserved mount point.
+ * Because a VFS never shadows the real file system, the assets live under
+ * the mount point returned by `vfs.mountPoint`, not at a fixed path; the
+ * SEA main script is placed at the mount point root so bundled code can
+ * reach the assets through `__dirname`-relative paths and relative
+ * `require()` calls.
+ * @param {object} [options] Configuration options
+ * @param {Record<string, string|Buffer>} [options.extraFiles] Additional
+ *   files to serve alongside the assets (used for the SEA main script)
+ * @returns {VirtualFileSystem|null} The mounted VFS, or null if not running
+ *   as a SEA or VFS is not enabled in the SEA configuration
+ * @throws {ERR_INVALID_STATE} If already initialized
+ */
+function initSeaVfs(options = kEmptyObject) {
+  if (initialized) {
+    throw new ERR_INVALID_STATE('SEA VFS is already initialized');
+  }
+  initialized = true;
+
+  if (!isSea() || !isVfsEnabled()) {
+    return null;
+  }
+
+  const { VirtualFileSystem } = require('internal/vfs/file_system');
+  const { SEAProvider } = require('internal/vfs/providers/sea');
+
+  const provider = new SEAProvider({ extraFiles: options.extraFiles });
+  // The SEA warning already covers the feature; don't emit the
+  // VirtualFileSystem experimental warning for the implicit SEA mount.
+  const vfs = new VirtualFileSystem(provider, {
+    emitExperimentalWarning: false,
+  });
+  vfs.mount();
+
+  return vfs;
+}
+
+/* c8 ignore stop */
+
+module.exports = {
+  initSeaVfs,
+};
diff --git a/lib/internal/vfs/setup.js b/lib/internal/vfs/setup.js
index 979990d1a855..3e183e422831 100644
--- a/lib/internal/vfs/setup.js
+++ b/lib/internal/vfs/setup.js
@@ -30,11 +30,12 @@ const {
   getLayerIdFromPath,
   getNormalizedVfsRoot,
 } = require('internal/vfs/router');
-const { getVirtualFd, closeVirtualFd } = require('internal/vfs/fd');
+const { getVirtualFd, closeVirtualFd, createVfsFileHandle } = require('internal/vfs/fd');
 const { assertEncoding, setVfsHandlers } = require('internal/fs/utils');
 const permission = require('internal/process/permission');
 const { getOptionValue } = require('internal/options');
 const nativeModulesBinding = internalBinding('modules');
+const { UV_ENOENT } = internalBinding('uv');
 let debug = require('internal/util/debuglog').debuglog('vfs', (fn) => {
   debug = fn;
 });
@@ -115,29 +116,50 @@ function deregisterVFS(vfs) {
 }
 
 /**
- * Resolves a path string to the active VFS that owns it, or null.
- * Ownership is decidable from the path alone: all mount points live
- * under the reserved `${os.devNull}/vfs/<id>` namespace, so a single
- * prefix comparison rejects every real-file-system path and a map
- * lookup finds the owning layer. The normalized path is returned
+ * Resolves a path string to the reserved VFS root, or null for a path
+ * outside it. Ownership is decidable from the path alone: all mount
+ * points live under the reserved `${os.devNull}/vfs/<id>` namespace, so
+ * a single prefix comparison rejects every real-file-system path and a
+ * map lookup finds the owning layer. The normalized path is returned
  * alongside the layer so downstream helpers can skip renormalization.
+ *
+ * A path under the root that no active layer owns comes back with
+ * `vfs: null` rather than as `null`, because the two cases must not be
+ * treated alike by the module loader. The loader manufactures such
+ * paths itself: resolving a mount point as a directory first probes the
+ * sibling names `<mount>.js`, `<mount>.json`, ..., and a package.json
+ * walk-up passes the parents of the mount point. They cannot name
+ * anything real, but on Windows the root sits under `\\.\nul`, and
+ * `\\.\nul\<anything>` opens the NUL device, which stats as a character
+ * device and reads as empty. Handed to the native loader, such a probe
+ * "finds" a file and the walk-up above it rejects the empty device as an
+ * invalid package.json, so the loader must answer for the whole root.
  * @param {string} inputPath
- * @returns {{ vfs: object, normalized: string }|null}
+ * @returns {{ vfs: object|null, normalized: string }|null}
  */
-function findVFS(inputPath) {
+function findVFSOrRoot(inputPath) {
   const normalized = normalizeMountedPath(inputPath);
   if (!StringPrototypeStartsWith(normalized, normalizedVfsRootPrefix)) {
     return null;
   }
   const layerId = getLayerIdFromPath(normalized);
-  if (layerId === -1) return null;
-  const vfs = activeVFSLayers.get(layerId);
+  const vfs = layerId === -1 ? undefined : activeVFSLayers.get(layerId);
   if (vfs === undefined || !vfs.shouldHandleNormalized(normalized)) {
-    return null;
+    return { vfs: null, normalized };
   }
   return { vfs, normalized };
 }
 
+/**
+ * Resolves a path string to the active VFS that owns it, or null.
+ * @param {string} inputPath
+ * @returns {{ vfs: object, normalized: string }|null}
+ */
+function findVFS(inputPath) {
+  const r = findVFSOrRoot(inputPath);
+  return r === null || r.vfs === null ? null : r;
+}
+
 /**
  * Drop the cache entries under `vfs`'s mount point from the
  * JS-reachable loader caches. Real-fs entries and other-VFS entries
@@ -210,16 +232,16 @@ function findVFSForStat(filename) {
 }
 
 /**
- * Finds the VFS owning `filename` and reads it.
+ * Reads `filename` from the VFS that owns it, reporting a missing file
+ * or a directory the way the native loader's read does.
+ * @param {object} vfs The VFS owning filename
  * @param {string} filename The absolute path to read
  * @param {string|object} options Read options
- * @returns {{ vfs: object, content: Buffer|string }|null}
+ * @returns {Buffer|string}
  */
-function findVFSForRead(filename, options) {
-  const r = findVFS(filename);
-  if (r === null) return null;
+function readVFS(vfs, filename, options) {
   try {
-    return { vfs: r.vfs, content: r.vfs.readFileSync(filename, options) };
+    return vfs.readFileSync(filename, options);
   } catch (e) {
     const code = e?.code;
     if (code === 'ENOENT' || code === 'EISDIR') {
@@ -298,6 +320,7 @@ function findVFSWith(filename, syscall, fn) {
   const r = findVFS(filename);
   if (r === null) return undefined;
   if (r.vfs.existsSync(filename)) {
+    if (fn === undefined) return true;
     return fn(r.vfs, filename);
   }
   throw createENOENT(syscall, filename);
@@ -410,7 +433,7 @@ function createVfsHandlers() {
     },
     statfsSync(path, options) {
       const pathStr = toPathStr(path);
-      if (pathStr !== null && findVFSForPath(pathStr) !== null) {
+      if (pathStr !== null && findVFSWith(pathStr, 'statfs')) {
         if (options?.bigint) {
           return {
             type: 0n, bsize: 4096n, blocks: 0n,
@@ -687,7 +710,7 @@ function createVfsHandlers() {
       vfsOp(path, (vfs, n) => vfs.promises.lutimes(n, atime, mtime).then(() => true)),
     statfs(path, options) {
       const pathStr = toPathStr(path);
-      if (pathStr !== null && findVFSForPath(pathStr) !== null) {
+      if (pathStr !== null && findVFSWith(pathStr, 'statfs')) {
         if (options?.bigint) {
           return {
             __proto__: null,
@@ -764,8 +787,7 @@ function createVfsHandlers() {
         const r = findVFSForPath(pathStr);
         if (r !== null) {
           const fd = r.vfs.openSync(r.path, flags, mode);
-          const vfd = getVirtualFd(fd);
-          return PromiseResolve(vfd.entry);
+          return PromiseResolve(createVfsFileHandle(getVirtualFd(fd)));
         }
       }
       return undefined;
@@ -794,30 +816,40 @@ function installModuleLoaderOverrides() {
   // wrapLoaderMethod then falls through to the native binding.
   setLoaderOverrides({
     internalModuleStat(filename) {
-      const result = findVFSForStat(filename);
-      return result !== null ? result.result : undefined;
+      const r = findVFSOrRoot(filename);
+      if (r === null) return undefined;
+      return r.vfs === null ? UV_ENOENT : vfsStat(r.vfs, filename);
     },
     readFileSync(filename, options) {
       const pathStr = typeof filename === 'string' ? filename :
         (filename instanceof URL ? fileURLToPath(filename) : String(filename));
-      const result = findVFSForRead(pathStr, options);
-      return result !== null ? result.content : undefined;
+      const r = findVFSOrRoot(pathStr);
+      if (r === null) return undefined;
+      if (r.vfs === null) throw createENOENT('open', pathStr);
+      return readVFS(r.vfs, pathStr, options);
     },
     realpathSync(filename) {
-      return findVFSWith(filename, 'realpath', (vfs, n) => vfs.realpathSync(n));
+      const r = findVFSOrRoot(filename);
+      if (r === null) return undefined;
+      if (r.vfs === null || !r.vfs.existsSync(filename)) {
+        throw createENOENT('realpath', filename);
+      }
+      return r.vfs.realpathSync(filename);
     },
     getResolutionRoot(pathStr) {
-      const r = findVFS(pathStr);
+      const r = findVFSOrRoot(pathStr);
       if (r === null) return undefined;
-      const mountPoint = r.vfs.mountPoint;
       // The boundary is compared as a plain string prefix by the
-      // callers, so only report it when the input carries the mount
-      // point verbatim.
-      return StringPrototypeStartsWith(pathStr, mountPoint) ?
-        mountPoint : undefined;
+      // callers, so only report it when the input carries it verbatim.
+      // An unowned path stops at the reserved root itself, so no
+      // node_modules lookup walks out into the real file system.
+      const boundary = r.vfs === null ?
+        getNormalizedVfsRoot() : r.vfs.mountPoint;
+      return StringPrototypeStartsWith(pathStr, boundary) ?
+        boundary : undefined;
     },
     legacyMainResolve(pkgPath, main, base) {
-      if (findVFS(pkgPath) === null) return undefined;
+      if (findVFSOrRoot(pkgPath) === null) return undefined;
 
       for (let i = 0; i < legacyMainResolveExtensions.length; i++) {
         const byMain = i <= kResolvedByMainIndexNode;
@@ -835,14 +867,14 @@ function installModuleLoaderOverrides() {
       throw new ERR_MODULE_NOT_FOUND(initial, base, undefined);
     },
     getFormatOfExtensionlessFile(filePath) {
-      let result;
+      const r = findVFSOrRoot(filePath);
+      if (r === null) return undefined;
+      let content;
       try {
-        result = findVFSForRead(filePath, null);
+        content = r.vfs === null ? null : readVFS(r.vfs, filePath, null);
       } catch {
         return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
       }
-      if (result === null) return undefined;
-      const content = result.content;
       // Wasm magic bytes: 0x00 0x61 0x73 0x6d
       if (content && content.length >= 4 &&
           content[0] === 0x00 && content[1] === 0x61 &&
@@ -852,8 +884,9 @@ function installModuleLoaderOverrides() {
       return internalConstants.EXTENSIONLESS_FORMAT_JAVASCRIPT;
     },
     readPackageJSON(jsonPath, isESM, base, specifier) {
-      const r = findVFS(jsonPath);
+      const r = findVFSOrRoot(jsonPath);
       if (r === null) return undefined;
+      if (r.vfs === null) return kLoaderOverrideNoResult;
       const { vfs } = r;
       if (vfsStat(vfs, jsonPath) !== 0) return kLoaderOverrideNoResult;
       let content;
@@ -868,8 +901,9 @@ function installModuleLoaderOverrides() {
         content, jsonPath, isESM, base, specifier);
     },
     getNearestParentPackageJSON(checkPath) {
-      const r = findVFS(checkPath);
+      const r = findVFSOrRoot(checkPath);
       if (r === null) return undefined;
+      if (r.vfs === null) return kLoaderOverrideNoResult;
       const found = findVFSPackageJSON(r.vfs, checkPath, r.normalized);
       return found.tuple ?? kLoaderOverrideNoResult;
     },
@@ -884,8 +918,11 @@ function installModuleLoaderOverrides() {
       } else {
         filePath = resolved;
       }
-      const r = findVFS(filePath);
+      const r = findVFSOrRoot(filePath);
       if (r === null) return undefined;
+      // The "not found" marker is the package.json beside the queried
+      // path, which is what the native binding reports for it.
+      if (r.vfs === null) return join(dirname(filePath), 'package.json');
       const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
       if (found.tuple !== undefined) return found.tuple;
       return found.sentinel;
@@ -901,8 +938,9 @@ function installModuleLoaderOverrides() {
       } else {
         filePath = url;
       }
-      const r = findVFS(filePath);
+      const r = findVFSOrRoot(filePath);
       if (r === null) return undefined;
+      if (r.vfs === null) return kLoaderOverrideNoResult;
       const found = findVFSPackageJSON(r.vfs, filePath, r.normalized);
       if (found.tuple !== undefined) {
         // Tuple shape: [name, main, type, imports, exports, filePath].
@@ -914,6 +952,26 @@ function installModuleLoaderOverrides() {
   });
 }
 
+let originalDlopen;
+
+function installAddonLoader() {
+  originalDlopen = process.dlopen;
+  process.dlopen = function(module, filename, flags) {
+    // dlopen(2) cannot open a native addon that lives in a VFS by path (it has
+    // no real inode). Read its bytes and hand them to the internal
+    // dlopenBinary(), which writes them to a private, self-cleaning temporary
+    // image - an in-memory memfd on Linux - and loads that. Only VFS paths take
+    // this route; everything else loads straight from disk through the
+    // unchanged process.dlopen().
+    if (StringPrototypeStartsWith(filename, normalizedVfsRootPrefix)) {
+      const { readFileSync } = require('fs');
+      const { dlopenBinary } = internalBinding('process_methods');
+      return dlopenBinary(module, filename, flags, readFileSync(filename));
+    }
+    return originalDlopen(module, filename, flags);
+  };
+}
+
 /**
  * Install all VFS hooks: module loader overrides and fs handlers.
  */
@@ -922,6 +980,7 @@ function installHooks() {
   debug('install hooks');
   normalizedVfsRootPrefix = getNormalizedVfsRoot() + sep;
   installModuleLoaderOverrides();
+  installAddonLoader();
   vfsHandlerObj = createVfsHandlers();
   setVfsHandlers(vfsHandlerObj);
   hooksInstalled = true;
@@ -939,6 +998,7 @@ function uninstallHooks() {
   setLoaderOverrides();
   setVfsHandlers(null);
   vfsHandlerObj = undefined;
+  process.dlopen = originalDlopen;
   hooksInstalled = false;
 }
 
diff --git a/lib/internal/webidl.js b/lib/internal/webidl.js
index 71513bbe86f4..ee0388b70e97 100644
--- a/lib/internal/webidl.js
+++ b/lib/internal/webidl.js
@@ -21,7 +21,6 @@ const {
   NumberMAX_SAFE_INTEGER,
   NumberMIN_SAFE_INTEGER,
   ObjectPrototypeHasOwnProperty,
-  ObjectPrototypeIsPrototypeOf,
   SafeArrayIterator,
   SafeSet,
   String,
@@ -38,6 +37,8 @@ const {
   isTypedArray,
 } = require('internal/util/types');
 
+const { getSharedArrayBufferGrowable } = internalBinding('util');
+
 const BIGINT_2_63 = 1n << 63n;
 const BIGINT_2_64 = 1n << 64n;
 
@@ -710,7 +711,7 @@ function createDictionaryConverter(
   };
 
   const dictionaries = ArrayIsArray(members[0]) ? members : [members];
-  const sortedDictionaries = [];
+  const sortedMembers = [];
 
   function ownMember(member, key) {
     return ObjectPrototypeHasOwnProperty(member, key) ? member[key] : undefined;
@@ -724,7 +725,7 @@ function createDictionaryConverter(
   // from least-derived to most-derived and sort only within each dictionary.
   // Callers with inheritance pass one member array per dictionary level.
   for (let i = 0; i < dictionaries.length; i++) {
-    const sortedMembers = ArrayPrototypeToSorted(
+    const sortedDictionary = ArrayPrototypeToSorted(
       dictionaries[i],
       compareMembers,
     );
@@ -733,22 +734,21 @@ function createDictionaryConverter(
     // Re-materialize each descriptor once with every key present, copied from
     // own properties only. The ordinary prototype is deliberate: nothing
     // consults it now, and detaching it measurably slows these reads down.
-    for (let j = 0; j < sortedMembers.length; j++) {
-      const member = sortedMembers[j];
+    for (let j = 0; j < sortedDictionary.length; j++) {
+      const member = sortedDictionary[j];
       const defaultValue = ownMember(member, 'defaultValue');
       const required = ownMember(member, 'required');
       if (typeof defaultValue === 'function' || required) {
         anyMissingMemberHandling = true;
       }
-      sortedMembers[j] = {
+      setOwnProperty(sortedMembers, sortedMembers.length, {
         key: ownMember(member, 'key'),
         converter: ownMember(member, 'converter'),
         defaultValue,
         required,
         validator: ownMember(member, 'validator'),
-      };
+      });
     }
-    ArrayPrototypePush(sortedDictionaries, sortedMembers);
   }
 
   const hasMissingMemberHandling = anyMissingMemberHandling;
@@ -764,43 +764,41 @@ function createDictionaryConverter(
 
     // Step 2: create the IDL dictionary value.
     const idlDict = { __proto__: null };
-
-    // Steps 3-4: iterate each dictionary level, then its sorted members.
-    for (let i = 0; i < sortedDictionaries.length; i++) {
-      const sortedMembers = sortedDictionaries[i];
-      for (let j = 0; j < sortedMembers.length; j++) {
-        const member = sortedMembers[j];
-        // Step 4.1.1: get the dictionary member identifier.
-        const key = member.key;
-        // Steps 4.1.2-4.1.3: read the JavaScript member value.
-        const jsMemberValue = jsDict == null ? undefined : jsDict[key];
-
-        // Step 4.1.4: convert and store present member values.
-        if (jsMemberValue !== undefined) {
-          const converter = member.converter;
-          // Step 4.1.4.1: convert the JavaScript value to IDL.
-          const idlMemberValue = converter(
-            jsMemberValue,
-            makeOptions(options, dictionaryMemberContext(key, options)),
-          );
-          // Validators are a Node.js extension after conversion. They let
-          // consumers reject known unsupported values while dictionary
-          // conversion still has precise member context. Web Crypto uses this
-          // so SubtleCrypto.supports() can make accurate decisions from
-          // normalized dictionaries instead of probing by running operations.
-          member.validator?.(idlMemberValue, jsDict);
-          // Step 4.1.4.2: set idlDict[key] to the IDL value.
-          idlDict[key] = idlMemberValue;
-        } else if (hasMissingMemberHandling) {
-          if (typeof member.defaultValue === 'function') {
-            // Step 4.1.5: store the member default value.
-            idlDict[key] = member.defaultValue();
-          } else if (member.required) {
-            // Step 4.1.6: required missing members throw.
-            throw makeException(
-              missingDictionaryMemberMessage(dictionaryName, key),
-              makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
-          }
+    if (jsDict == null && !hasMissingMemberHandling) return idlDict;
+
+    // Steps 3-4: members retain their per-dictionary order from construction.
+    for (let i = 0; i < sortedMembers.length; i++) {
+      const member = sortedMembers[i];
+      // Step 4.1.1: get the dictionary member identifier.
+      const key = member.key;
+      // Steps 4.1.2-4.1.3: read the JavaScript member value.
+      const jsMemberValue = jsDict == null ? undefined : jsDict[key];
+
+      // Step 4.1.4: convert and store present member values.
+      if (jsMemberValue !== undefined) {
+        const converter = member.converter;
+        // Step 4.1.4.1: convert the JavaScript value to IDL.
+        const idlMemberValue = converter(
+          jsMemberValue,
+          makeOptions(options, dictionaryMemberContext(key, options)),
+        );
+        // Validators are a Node.js extension after conversion. They let
+        // consumers reject known unsupported values while dictionary
+        // conversion still has precise member context. Web Crypto uses this
+        // so SubtleCrypto.supports() can make accurate decisions from
+        // normalized dictionaries instead of probing by running operations.
+        member.validator?.(idlMemberValue, jsDict);
+        // Step 4.1.4.2: set idlDict[key] to the IDL value.
+        idlDict[key] = idlMemberValue;
+      } else if (hasMissingMemberHandling) {
+        if (typeof member.defaultValue === 'function') {
+          // Step 4.1.5: store the member default value.
+          idlDict[key] = member.defaultValue();
+        } else if (member.required) {
+          // Step 4.1.6: required missing members throw.
+          throw makeException(
+            missingDictionaryMemberMessage(dictionaryName, key),
+            makeOptions(options, options.context, 'ERR_MISSING_OPTION'));
         }
       }
     }
@@ -836,7 +834,12 @@ function createSequenceConverter(converter) {
 
     // Step 4 and create-sequence step 1: get the iterator record.
     const iterator = FunctionPrototypeCall(method, V);
-    const nextMethod = iterator?.next;
+    if (type(iterator) !== 'Object') {
+      throw makeException(
+        'cannot be converted to sequence.',
+        options);
+    }
+    const nextMethod = iterator.next;
     if (typeof nextMethod !== 'function') {
       throw makeException(
         'cannot be converted to sequence.',
@@ -873,13 +876,13 @@ function createSequenceConverter(converter) {
  * Creates a converter for a Web IDL interface type.
  * @see https://webidl.spec.whatwg.org/#js-interface
  * @param {string} name Interface identifier.
- * @param {object} prototype Interface prototype object.
+ * @param {(value: any) => boolean} brandCheck Interface brand predicate.
  * @returns {Converter}
  */
-function createInterfaceConverter(name, prototype) {
+function createInterfaceConverter(name, brandCheck) {
   return (V, options = kEmptyObject) => {
     // Web IDL interface conversion step 1: return V if it implements I.
-    if (ObjectPrototypeIsPrototypeOf(prototype, V)) {
+    if (brandCheck(V)) {
       return V;
     }
     // Step 2: otherwise throw.
@@ -945,12 +948,8 @@ function validateBufferSourceBacking(buffer, options) {
 function validateAllowGrowableSharedArrayBuffer(buffer, options) {
   // SharedArrayBuffer and ArrayBufferView conversion step 3:
   // IsFixedLengthArrayBuffer(buffer) must be true without [AllowResizable].
-  // Do not use a primordial getter here. When this module is included in the
-  // startup snapshot, an early-captured SharedArrayBuffer.prototype.growable
-  // getter does not detect growable buffers created after deserialization.
-  // Lazily capturing the getter would work, but it would observe the runtime
-  // prototype at first comparison, so it would not be an actual primordial.
-  if (!options.allowResizable && buffer.growable) {
+  if (!options.allowResizable &&
+      FunctionPrototypeCall(getSharedArrayBufferGrowable, buffer)) {
     throw makeException(
       'is backed by a growable SharedArrayBuffer, which is not allowed.',
       options);
diff --git a/lib/internal/webstreams/adapters.js b/lib/internal/webstreams/adapters.js
index 42e1221bb307..ef99ad1d39f6 100644
--- a/lib/internal/webstreams/adapters.js
+++ b/lib/internal/webstreams/adapters.js
@@ -23,11 +23,16 @@ const { TextEncoder } = require('internal/encoding');
 const {
   ReadableStream,
   isReadableStream,
+  readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
 } = require('internal/webstreams/readablestream');
 
 const {
   WritableStream,
   isWritableStream,
+  writableStreamDefaultWriterWriteWithRequest,
 } = require('internal/webstreams/writablestream');
 
 const {
@@ -53,6 +58,10 @@ const {
   Buffer,
 } = require('buffer');
 
+const {
+  kResolvedPromise,
+} = require('internal/webstreams/util');
+
 const {
   isAnyArrayBuffer,
 } = require('internal/util/types');
@@ -85,6 +94,7 @@ const {
 const {
   WriteWrap,
   ShutdownWrap,
+  kArrayBufferOffset,
   kReadBytesOrError,
   kLastWriteWasAsync,
   streamBaseState,
@@ -141,6 +151,96 @@ function handleKnownInternalErrors(cause) {
 
 const noop = () => {};
 
+// A single shared write request tracks every chunk written to the
+// destination WritableStream, replacing the per-write promise pair that
+// writer.ready + writer.write() would allocate. Only one write/writev
+// batch is in flight at a time, so one callback slot is enough.
+// `promise` is non-undefined so writable-stream queue entries are
+// discriminated from kNilRequest by `promise === undefined`;
+// `failed`/`failure` latch a write that could not proceed.
+function createWriteTracker(getDestination) {
+  return {
+    promise: null,
+    pending: 0,
+    failed: false,
+    failure: undefined,
+    callback: undefined,
+    error: undefined,
+    hasError: false,
+    dispatching: false,
+    resolve() {
+      this.pending--;
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    reject(error) {
+      this.pending--;
+      if (!this.hasError) {
+        this.hasError = true;
+        this.error = error;
+      }
+      if (!this.dispatching && this.pending === 0 &&
+          this.callback !== undefined) {
+        this.settle();
+      }
+    },
+    settle() {
+      const callback = this.callback;
+      this.callback = undefined;
+      let error;
+      if (this.hasError) {
+        error = this.error;
+        this.hasError = false;
+        this.error = undefined;
+      } else if (this.failed) {
+        error = this.failure;
+      }
+      this.failed = false;
+      this.failure = undefined;
+      if (error !== undefined) {
+        // Deliver failures in a microtask: this can run while the
+        // writable-stream machinery is mid-transition (e.g. inside
+        // writableStreamFinishErroring), and the callback typically
+        // destroys the stream, which re-enters the machinery.
+        PromisePrototypeThen(kResolvedPromise, () => {
+          try {
+            callback(error);
+          } catch (err) {
+            process.nextTick(() => destroy(getDestination(), err));
+          }
+        });
+        return;
+      }
+      try {
+        callback(error);
+      } catch (err) {
+        // In a next tick because this can run within a promise context,
+        // and any error thrown must not become an unhandled rejection.
+        process.nextTick(() => destroy(getDestination(), err));
+      }
+    },
+  };
+}
+
+function dispatchWrite(writer, chunk, tracker) {
+  tracker.dispatching = true;
+  writableStreamDefaultWriterWriteWithRequest(writer, chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
+function dispatchWritev(writer, chunks, tracker) {
+  tracker.dispatching = true;
+  for (let i = 0; i < chunks.length; i++)
+    writableStreamDefaultWriterWriteWithRequest(writer, chunks[i].chunk, tracker);
+  tracker.dispatching = false;
+  if (tracker.pending === 0)
+    tracker.settle();
+}
+
 /**
  * @typedef {import('../../stream').Writable} Writable
  * @typedef {import('../../stream').Readable} Readable
@@ -313,6 +413,7 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
 
   const writer = writableStream.getWriter();
   let closed = false;
+  const writeTracker = createWriteTracker(() => writable);
 
   const writable = new Writable({
     highWaterMark,
@@ -321,27 +422,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(writable, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -360,18 +442,8 @@ function newStreamWritableFromWritableStream(writableStream, options = kEmptyObj
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(writable, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     destroy(error, callback) {
@@ -585,6 +657,14 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
 
   const reader = readableStream.getReader();
   let closed = false;
+  let readRequest;
+  let pendingChunk;
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    readable.push(chunk);
+  }
 
   const readable = new Readable({
     objectMode,
@@ -593,17 +673,25 @@ function newStreamReadableFromReadableStream(readableStream, options = kEmptyObj
     signal,
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            // Value should always be undefined here.
-            readable.push(null);
-          } else {
-            readable.push(chunk.value);
-          }
+      // At most one read is in flight (Readable does not call read()
+      // again before push()), so a single reused read request replaces
+      // the promise, read-result object, and reaction closures that
+      // reader.read() would allocate per chunk. The chunk is forwarded
+      // in a microtask to keep the old reaction position: a sync push
+      // could deliver a chunk that an error or destroy should beat.
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
+        },
+        [kClose]() {
+          readable.push(null);
         },
-        (error) => destroy(readable, error));
+        [kError](error) {
+          destroy(readable, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -769,6 +857,15 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
   const reader = readableStream.getReader();
   let writableClosed = false;
   let readableClosed = false;
+  let readRequest;
+  let pendingChunk;
+  const writeTracker = createWriteTracker(() => duplex);
+
+  function forwardChunk() {
+    const chunk = pendingChunk;
+    pendingChunk = undefined;
+    duplex.push(chunk);
+  }
 
   const duplex = new Duplex({
     allowHalfOpen,
@@ -779,27 +876,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     signal,
 
     writev(chunks, callback) {
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          // In a next tick because this is happening within
-          // a promise context, and if there are any errors
-          // thrown we don't want those to cause an unhandled
-          // rejection. Let's just escape the promise and
-          // handle it separately.
-          process.nextTick(() => destroy(duplex, error));
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(
-          writer.ready,
-          () => SafePromiseAllReturnVoid(
-            chunks,
-            (data) => writer.write(data.chunk))),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWritev(writer, chunks, writeTracker);
     },
 
     write(chunk, encoding, callback) {
@@ -818,18 +896,8 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
         }
       }
 
-      function done(error) {
-        try {
-          callback(error);
-        } catch (error) {
-          destroy(duplex, error);
-        }
-      }
-
-      PromisePrototypeThen(
-        PromisePrototypeThen(writer.ready, () => writer.write(chunk)),
-        done,
-        done);
+      writeTracker.callback = callback;
+      dispatchWrite(writer, chunk, writeTracker);
     },
 
     final(callback) {
@@ -855,16 +923,21 @@ function newStreamDuplexFromReadableWritablePair(pair = kEmptyObject, options =
     },
 
     read() {
-      PromisePrototypeThen(
-        reader.read(),
-        (chunk) => {
-          if (chunk.done) {
-            duplex.push(null);
-          } else {
-            duplex.push(chunk.value);
-          }
+      // Same single-in-flight reused read request as
+      // newStreamReadableFromReadableStream().
+      readRequest ??= {
+        [kChunk](chunk) {
+          pendingChunk = chunk;
+          PromisePrototypeThen(kResolvedPromise, forwardChunk);
         },
-        (error) => destroy(duplex, error));
+        [kClose]() {
+          duplex.push(null);
+        },
+        [kError](error) {
+          destroy(duplex, error);
+        },
+      };
+      readableStreamDefaultReaderRead(reader, readRequest);
     },
 
     destroy(error, callback) {
@@ -1049,7 +1122,8 @@ function newReadableStreamFromStreamBase(streamBase, strategy, options = kEmptyO
         return;
       }
 
-      controller.enqueue(arrayBuffer);
+      const offset = streamBaseState[kArrayBufferOffset];
+      controller.enqueue(new Uint8Array(arrayBuffer, offset, nread));
 
       if (controller.desiredSize <= 0)
         streamBase.readStop();
diff --git a/lib/internal/webstreams/readablestream.js b/lib/internal/webstreams/readablestream.js
index 78313bd03c1a..5402bb487be5 100644
--- a/lib/internal/webstreams/readablestream.js
+++ b/lib/internal/webstreams/readablestream.js
@@ -3870,6 +3870,9 @@ module.exports = {
   readableStreamReaderGenericRelease,
   readableStreamBYOBReaderRead,
   readableStreamDefaultReaderRead,
+  kChunk,
+  kClose,
+  kError,
   setupReadableStreamBYOBReader,
   setupReadableStreamDefaultReader,
   readableStreamDefaultControllerClose,
diff --git a/lib/net.js b/lib/net.js
index d2b510c64bbb..d9a99bc16758 100644
--- a/lib/net.js
+++ b/lib/net.js
@@ -392,6 +392,10 @@ const kBoundPath = Symbol('kBoundPath');
 
 const isLinux = process.platform === 'linux';
 
+// Internal: construct an empty BoundSocket shell during postMessage()
+// deserialization; the transferred handle is installed by [kDeserialize].
+const kBoundSocketDeserialize = Symbol('kBoundSocketDeserialize');
+
 // A role-neutral wrapper over a synchronously bound libuv handle: bound to a
 // local address (a numeric IP literal for TCP, or a filesystem/abstract path
 // for a unix-domain socket via { path }) but neither listening nor connecting
@@ -400,11 +404,20 @@ const isLinux = process.platform === 'linux';
 // handle must be closed by the caller. bind(2) is non-blocking, so binding
 // happens inline and errors throw synchronously. No DNS is performed.
 class BoundSocket {
-  #handle;
+  #handle = null;
   #address = {};
   #path;
 
   constructor(options = kEmptyObject) {
+    // An un-adopted BoundSocket can be moved to another thread by listing it
+    // in the transferList of a worker_threads postMessage() call. See
+    // [kTransfer]().
+    markTransferMode(this, false, true);
+
+    if (options === kBoundSocketDeserialize) {
+      return;
+    }
+
     validateObject(options, 'options');
 
     if (options.path !== undefined) {
@@ -548,7 +561,56 @@ class BoundSocket {
   get isPipe() {
     return this.#path !== undefined;
   }
+
+  // A BoundSocket can be transferred only while it still owns its handle,
+  // i.e. before it has been adopted, closed or already transferred. Only TCP
+  // binds are transferable; pipe handles cannot move between event loops.
+  #assertTransferable() {
+    if (this.#handle === null || !(this.#handle instanceof TCP)) {
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+  }
+
+  [kTransferList]() {
+    this.#assertTransferable();
+    return [this.#handle];
+  }
+
+  [kTransfer]() {
+    this.#assertTransferable();
+    const handle = this.#handle;
+    // Detach the handle; the messaging layer takes ownership of it via
+    // TCPWrap::TransferForMessaging(). Further use on the sending side throws
+    // ERR_SOCKET_HANDLE_ADOPTED, as after adoption.
+    this.#handle = null;
+    return {
+      data: { handle },
+      deserializeInfo: 'net:_TransferredBoundSocket',
+    };
+  }
+
+  [kDeserialize](data) {
+    const handle = data?.handle;
+    if (handle == null || !(handle instanceof TCP)) {
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+    // Re-derive the bound address from the transferred handle rather than
+    // trusting serialized state.
+    const err = handle.getsockname(this.#address);
+    if (err) {
+      handle.close();
+      throw new ERR_WORKER_HANDLE_NOT_TRANSFERABLE('net.BoundSocket');
+    }
+    this.#handle = handle;
+  }
+}
+
+// Deserialization target for a transferred BoundSocket: constructs an empty
+// shell without binding a new socket. Internal, not part of the public API.
+function _TransferredBoundSocket() {
+  return new BoundSocket(kBoundSocketDeserialize);
 }
+_TransferredBoundSocket.prototype = BoundSocket.prototype;
 
 function Socket(options) {
   if (!(this instanceof Socket)) return new Socket(options);
@@ -2967,6 +3029,7 @@ Server.prototype.unref = function() {
 module.exports = {
   _createServerHandle: createServerHandle,
   _normalizeArgs: normalizeArgs,
+  _TransferredBoundSocket,
   get BlockList() {
     BlockList ??= require('internal/blocklist').BlockList;
     return BlockList;
diff --git a/lib/path.js b/lib/path.js
index 63b037cddfb9..658b5d6901df 100644
--- a/lib/path.js
+++ b/lib/path.js
@@ -1262,8 +1262,7 @@ const posix = {
       }
 
       resolvedPath = `${path}/${resolvedPath}`;
-      resolvedAbsolute =
-        StringPrototypeCharCodeAt(path, 0) === CHAR_FORWARD_SLASH;
+      resolvedAbsolute = path[0] === '/';
     }
 
     if (!resolvedAbsolute) {
@@ -1296,10 +1295,8 @@ const posix = {
     if (path.length === 0)
       return '.';
 
-    const isAbsolute =
-      StringPrototypeCharCodeAt(path, 0) === CHAR_FORWARD_SLASH;
-    const trailingSeparator =
-      StringPrototypeCharCodeAt(path, path.length - 1) === CHAR_FORWARD_SLASH;
+    const isAbsolute = path[0] === '/';
+    const trailingSeparator = path[path.length - 1] === '/';
 
     // Normalize the path
     path = normalizeString(path, !isAbsolute, '/', isPosixPathSeparator);
@@ -1639,8 +1636,8 @@ const posix = {
 
     // Get non-dir info
     for (; i >= start; --i) {
-      const code = StringPrototypeCharCodeAt(path, i);
-      if (code === CHAR_FORWARD_SLASH) {
+      const char = path[i];
+      if (char === '/') {
         // If we reached a path separator that was not part of a set of path
         // separators at the end of the string, stop now
         if (!matchedSlash) {
@@ -1655,7 +1652,7 @@ const posix = {
         matchedSlash = false;
         end = i + 1;
       }
-      if (code === CHAR_DOT) {
+      if (char === '.') {
         // If this is our first dot, mark it as the start of our extension
         if (startDot === -1)
           startDot = i;
diff --git a/lib/util.js b/lib/util.js
index 7a9c06e8bdbb..d238a620e59a 100644
--- a/lib/util.js
+++ b/lib/util.js
@@ -588,6 +588,13 @@ function deprecate(fn, msg, code, { modifyPrototype } = kEmptyObject) {
   return internalDeprecate(fn, msg, code, undefined, modifyPrototype);
 }
 
+function markPromiseAsHandled(promise) {
+  if (!types.isPromise(promise)) {
+    throw new ERR_INVALID_ARG_TYPE('promise', 'Promise', promise);
+  }
+  binding.markPromiseAsHandled(promise);
+}
+
 // Keep the `exports =` so that various functions can still be monkeypatched
 module.exports = {
   _errnoException,
@@ -618,6 +625,7 @@ module.exports = {
     }
     return internalDeepEqual(a, b, skipPrototype);
   },
+  markPromiseAsHandled,
   promisify,
   stripVTControlCharacters,
   toUSVString(input) {
diff --git a/lib/v8.js b/lib/v8.js
index b76722a3e614..ea3366bb9617 100644
--- a/lib/v8.js
+++ b/lib/v8.js
@@ -20,6 +20,7 @@ const {
   BigUint64Array,
   DataView,
   Error,
+  Float16Array,
   Float32Array,
   Float64Array,
   Int16Array,
@@ -32,9 +33,6 @@ const {
   Uint32Array,
   Uint8Array,
   Uint8ClampedArray,
-  globalThis: {
-    Float16Array,
-  },
 } = primordials;
 
 const { Buffer } = require('buffer');
diff --git a/lib/zlib.js b/lib/zlib.js
index 3e6986bf8127..9fffcc20af62 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -201,9 +201,14 @@ function zlibOnError(message, errno, code) {
   // There is no way to cleanly recover.
   // Continuing only obscures problems.
 
-  const error = genericNodeError(message, { errno, code });
-  error.errno = errno;
-  error.code = code;
+  let error;
+  if (code === 'ERR_TRAILING_JUNK_AFTER_STREAM_END') {
+    error = new ERR_TRAILING_JUNK_AFTER_STREAM_END();
+  } else {
+    error = genericNodeError(message, { errno, code });
+    error.errno = errno;
+    error.code = code;
+  }
   self.destroy(error);
   self[kError] = error;
 }
@@ -924,6 +929,7 @@ class Zstd extends ZlibBase {
       writeState,
       processCallback,
       dictionary,
+      opts?.rejectGarbageAfterEnd === true,
     );
 
     super(opts, mode, handle, zstdDefaultOpts);
diff --git a/node.gni b/node.gni
index 21c8de1b2afb..fa4668a543e2 100644
--- a/node.gni
+++ b/node.gni
@@ -82,5 +82,19 @@ declare_args() {
   node_use_amaro = true
 }
 
+# Link against shared copies of the bundled dependencies instead of building
+# them, like configure's --shared-* options. The libraries are looked up with
+# pkg-config, so these are meant for Linux distribution builds.
+declare_args() {
+  node_shared_brotli = false
+  node_shared_cares = false
+  node_shared_hdr_histogram = false
+  node_shared_http_parser = false
+  node_shared_libuv = false
+  node_shared_nghttp2 = false
+  node_shared_sqlite = false
+  node_shared_zstd = false
+}
+
 assert(!node_enable_inspector || node_use_openssl,
        "node_enable_inspector requires node_use_openssl")
diff --git a/node.gyp b/node.gyp
index 942bea024498..52f421f3181c 100644
--- a/node.gyp
+++ b/node.gyp
@@ -15,10 +15,12 @@
     'node_lib_target_name%': 'libnode',
     'node_module_version%': '',
     'node_no_browser_globals%': 'false',
+    'node_shared_abseil%': 'false',
     'node_shared_brotli%': 'false',
     'node_shared_cares%': 'false',
     'node_shared_gtest%': 'false',
     'node_shared_hdr_histogram%': 'false',
+    'node_shared_highway%': 'false',
     'node_shared_http_parser%': 'false',
     'node_shared_libuv%': 'false',
     'node_shared_lief%': 'false',
@@ -26,6 +28,7 @@
     'node_shared_nbytes%': 'false',
     'node_shared_nghttp2%': 'false',
     'node_shared_openssl%': 'false',
+    'node_shared_perfetto%': 'false',
     'node_shared_sqlite%': 'false',
     'node_shared_ffi%': 'false',
     'node_shared_temporal_capi%': 'false',
@@ -901,7 +904,7 @@
         [ 'node_builtin_modules_path!=""', {
           'defines': [ 'NODE_BUILTIN_MODULES_PATH="<(node_builtin_modules_path)"' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_gtest=="false"', {
@@ -940,8 +943,12 @@
           'sources': [
             '<@(node_tracing_perfetto_sources)',
           ],
-          'dependencies': [
-            'deps/perfetto/perfetto.gyp:perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                'deps/perfetto/perfetto.gyp:perfetto_sdk',
+              ],
+            }],
           ],
         }, {
           'sources': [
@@ -1369,7 +1376,7 @@
         [ 'node_shared_gtest=="true"', {
           'libraries': [ '-lgtest_main' ],
         }],
-        [ 'node_use_bundled_v8!="false"', {
+        [ 'node_use_bundled_v8!="false" and node_shared_abseil=="false"', {
           'dependencies': [ 'tools/v8_gypfiles/abseil.gyp:abseil' ],
         }],
         [ 'node_shared_hdr_histogram=="false"', {
@@ -1399,7 +1406,7 @@
         }, {
           'sources!': [ '<@(node_cctest_quic_sources)' ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
@@ -1729,7 +1736,7 @@
             'NODE_USE_NODE_CODE_CACHE=1',
           ],
         }],
-        [ 'v8_use_perfetto==1', {
+        [ 'v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             'deps/perfetto/perfetto.gyp:perfetto_sdk',
           ],
diff --git a/node.gypi b/node.gypi
index 104e884e6614..bfe2d00ad929 100644
--- a/node.gypi
+++ b/node.gypi
@@ -99,6 +99,9 @@
     [ 'node_enable_v8windbg=="true"', {
       'dependencies': [ 'tools/v8_gypfiles/v8windbg.gyp:build_v8windbg' ],
     }],
+    [ 'node_enable_v8debughelper=="true"', {
+      'dependencies': [ 'tools/v8_gypfiles/v8_debug_helper.gyp:build_v8_debug_helper' ],
+    }],
     [ 'node_use_bundled_v8=="true"', {
       'dependencies': [
         'tools/v8_gypfiles/v8.gyp:v8_snapshot',
diff --git a/shell.nix b/shell.nix
index 96fcccbc1914..1829c1efd21b 100644
--- a/shell.nix
+++ b/shell.nix
@@ -29,6 +29,7 @@
         withSQLite
         withFFI
         withSSL
+        withPerfetto
         withTemporal
         ;
     }
@@ -52,6 +53,7 @@ let
   useSharedAda = builtins.hasAttr "ada" sharedLibDeps;
   useSharedOpenSSL = builtins.hasAttr "openssl" sharedLibDeps;
 
+  useSharedPerfetto = builtins.hasAttr "perfetto" sharedLibDeps;
   useSharedTemporal = builtins.hasAttr "temporal_capi" sharedLibDeps;
   needsRustCompiler = withTemporal && !useSharedTemporal;
 
@@ -63,6 +65,9 @@ let
     ];
   buildInputs =
     pkgs.lib.optional useSharedICU icu
+    ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) sharedLibDeps.abseil
+    ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) sharedLibDeps.highway
+    ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) sharedLibDeps.perfetto
     ++ pkgs.lib.optional (withTemporal && useSharedTemporal) sharedLibDeps.temporal_capi;
 
   # Put here only the configure flags that affect the V8 build
@@ -75,6 +80,9 @@ let
     )
     "--v8-${if withTemporal then "enable" else "disable"}-temporal-support"
   ]
+  ++ pkgs.lib.optional (builtins.hasAttr "abseil" sharedLibDeps) "--shared-abseil"
+  ++ pkgs.lib.optional (builtins.hasAttr "highway" sharedLibDeps) "--shared-highway"
+  ++ pkgs.lib.optional (withPerfetto && useSharedPerfetto) "--shared-perfetto"
   ++ pkgs.lib.optional (withTemporal && useSharedTemporal) "--shared-temporal_capi"
   ++ pkgs.lib.optional withPerfetto "--with-perfetto";
 in
@@ -132,6 +140,8 @@ pkgs.mkShell {
             builtins.attrNames (
               if (useSeparateDerivationForV8 != false) then
                 builtins.removeAttrs sharedLibDeps [
+                  "abseil"
+                  "highway"
                   "simdutf"
                   "temporal_capi"
                 ]
@@ -141,6 +151,22 @@ pkgs.mkShell {
           )
     );
   }
+  // (
+    let
+      ruff = pkgs.lib.lists.findFirst (p: p.meta.mainProgram == "ruff") null devTools;
+    in
+    pkgs.lib.optionalAttrs (ruff != null) {
+      RUFF = pkgs.lib.getExe ruff;
+    }
+  )
+  // (
+    let
+      yamllint = pkgs.lib.lists.findFirst (p: p.meta.mainProgram == "yamllint") null devTools;
+    in
+    pkgs.lib.optionalAttrs (yamllint != null) {
+      YAMLLINT = pkgs.lib.getExe yamllint;
+    }
+  )
   // pkgs.lib.optionalAttrs (!withSQLite) {
     NOSQLITE = "1";
   }
diff --git a/src/api/embed_helpers.cc b/src/api/embed_helpers.cc
index 929998a7f239..4e26befd7471 100644
--- a/src/api/embed_helpers.cc
+++ b/src/api/embed_helpers.cc
@@ -117,8 +117,6 @@ CommonEnvironmentSetup::CommonEnvironmentSetup(
   Isolate::CreateParams params;
   params.array_buffer_allocator = impl_->allocator.get();
   params.external_references = external_references.data();
-  params.cpp_heap =
-      v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 
   Isolate* isolate;
 
@@ -130,6 +128,8 @@ CommonEnvironmentSetup::CommonEnvironmentSetup(
     // isolate, so that the memory reducer can be initialized.
     isolate = impl_->isolate = Isolate::Allocate(GetOrCreateIsolateGroup());
     platform->RegisterIsolate(isolate, loop);
+    params.cpp_heap =
+        v8::CppHeap::Create(platform, v8::CppHeapCreateParams{{}}).release();
 
     if (snapshot_config != nullptr && snapshot_config->base_blob != nullptr) {
       params.snapshot_blob = snapshot_config->base_blob;
diff --git a/src/api/environment.cc b/src/api/environment.cc
index 459830a2af80..89c275f15b3c 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -391,7 +391,11 @@ IsolateData* CreateIsolateData(
     ArrayBufferAllocator* allocator,
     const EmbedderSnapshotData* embedder_snapshot_data) {
   return IsolateData::CreateIsolateData(
-      isolate, loop, platform, allocator, embedder_snapshot_data);
+      isolate,
+      loop,
+      platform,
+      allocator,
+      SnapshotData::FromEmbedderWrapper(embedder_snapshot_data));
 }
 
 void FreeIsolateData(IsolateData* isolate_data) {
@@ -425,6 +429,11 @@ Environment* CreateEnvironment(
 
   const bool use_snapshot = context.IsEmpty();
   const EnvSerializeInfo* env_snapshot_info = nullptr;
+  // A worker thread (its IsolateData knows its Worker) deserializes the same
+  // bootstrapped principal context the main thread uses and then has the
+  // worker-side bootstrap switches applied on top of it (they are written as
+  // overrides of the main-thread setup).
+  const bool for_worker = isolate_data->worker_context() != nullptr;
   if (use_snapshot) {
     CHECK_NOT_NULL(isolate_data->snapshot_data());
     env_snapshot_info = &isolate_data->snapshot_data()->env_info;
@@ -466,6 +475,25 @@ Environment* CreateEnvironment(
   Context::Scope context_scope(context);
   env->InitializeMainContext(context, env_snapshot_info);
 
+  if (use_snapshot && for_worker) {
+    // The deserialized context went through is_main_thread /
+    // does_own_process_state when the snapshot was built; the worker-side
+    // switches redefine exactly those pieces (stdio getters, signal wiring,
+    // process.abort/chdir/umask/..., debug helpers).
+    if (env->principal_realm()
+            ->ExecuteBootstrapper(
+                "internal/bootstrap/switches/is_not_main_thread")
+            .IsEmpty() ||
+        (!env->owns_process_state() &&
+         env->principal_realm()
+             ->ExecuteBootstrapper(
+                 "internal/bootstrap/switches/does_not_own_process_state")
+             .IsEmpty())) {
+      FreeEnvironment(env);
+      return nullptr;
+    }
+  }
+
 #if HAVE_INSPECTOR
   if (env->should_create_inspector()) {
     if (inspector_parent_handle) {
@@ -490,6 +518,9 @@ void FreeEnvironment(Environment* env) {
   Isolate* isolate = env->isolate();
   Isolate::DisallowJavascriptExecutionScope disallow_js(isolate,
       Isolate::DisallowJavascriptExecutionScope::THROW_ON_FAILURE);
+  // A termination requested by Stop() targets this Environment; if no JS ran
+  // since, it is still pending and must not hit the isolate's next user.
+  isolate->CancelTerminateExecution();
   {
     HandleScope handle_scope(isolate);  // For env->context().
     Context::Scope context_scope(env->context());
diff --git a/src/api/hooks.cc b/src/api/hooks.cc
index 09a79fb9da81..b46073b6b7cf 100644
--- a/src/api/hooks.cc
+++ b/src/api/hooks.cc
@@ -145,8 +145,15 @@ static ExclusiveAccess<CleanupHookRegistry> cleanup_hook_registry;
 
 static void CleanupHookThunkRun(void* arg) {
   const CleanupHookThunk* thunk = static_cast<CleanupHookThunk*>(arg);
-  thunk->fun(thunk->arg);
-  RemoveEnvironmentCleanupHook(thunk->isolate, thunk->fun, thunk->arg);
+  // `thunk->fun` may itself remove and free this CleanupHookThunk (e.g. via
+  // ~ObjectWrap(), which calls RemoveEnvironmentCleanupHook()), so cache the
+  // fields we still need before invoking it rather than reading them from
+  // `thunk` afterwards.
+  Isolate* isolate = thunk->isolate;
+  CleanupHook fun = thunk->fun;
+  void* fun_arg = thunk->arg;
+  fun(fun_arg);
+  RemoveEnvironmentCleanupHook(isolate, fun, fun_arg);
 }
 
 void AddEnvironmentCleanupHook(Isolate* isolate,
diff --git a/src/crypto/README.md b/src/crypto/README.md
index d3c1016e94a5..7bc4dbe4e148 100644
--- a/src/crypto/README.md
+++ b/src/crypto/README.md
@@ -184,12 +184,14 @@ cache.
 
 A `CryptoKey` is the Web Crypto API key type. In the Node.js implementation,
 public `CryptoKey` instances are backed by a native `NativeCryptoKey`, not by
-a `KeyObject`. `NativeCryptoKey` stores the same `KeyObjectData`
+a `KeyObject`. `NativeCryptoKey` stores the same primary `KeyObjectData`
 representation as `KeyObject`, plus the Web Crypto internal slots
 (`[[extractable]]`, `[[algorithm]]`, and `[[usages]]`). Normal construction
 primes a private JavaScript slot cache from the constructor arguments.
 Partially initialized transferred keys populate that cache from the native
-slots on first access.
+slots on first access. For Hybrid KEM `CryptoKey` instances only,
+`NativeCryptoKey` may also store a secondary `KeyObjectData` and `seed_data`
+used to reconstruct the hybrid key material.
 
 ### X.509 certificates
 
diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
index fde12953860c..b1b1c48e4cc7 100644
--- a/src/crypto/crypto_common.cc
+++ b/src/crypto/crypto_common.cc
@@ -28,7 +28,6 @@
 namespace node {
 
 using ncrypto::ClearErrorOnReturn;
-using ncrypto::ECKeyPointer;
 using ncrypto::EVPKeyPointer;
 using ncrypto::SSLPointer;
 using ncrypto::SSLSessionPointer;
@@ -231,9 +230,7 @@ MaybeLocal<Object> GetEphemeralKey(Environment* env, const SSLPointer& ssl) {
       case EVP_PKEY_X448: {
         const char* curve_name;
         if (kid == EVP_PKEY_EC) {
-          ECKeyPointer ec(key);
-          if (!ec) break;
-          int nid = EC_GROUP_get_curve_name(ec.getGroup());
+          int nid = ncrypto::Ec::GetCurveId(key);
           if (nid == NID_undef) break;
           curve_name = OBJ_nid2sn(nid);
         } else {
diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
index 7fbaf4fff5d9..27f3a8a4cbc9 100644
--- a/src/crypto/crypto_dh.cc
+++ b/src/crypto/crypto_dh.cc
@@ -22,8 +22,6 @@ using ncrypto::DHPointer;
 using ncrypto::EVPKeyCtxPointer;
 using ncrypto::EVPKeyPointer;
 using v8::ArrayBuffer;
-using v8::BackingStoreInitializationMode;
-using v8::BackingStoreOnFailureMode;
 using v8::ConstructorBehavior;
 using v8::Context;
 using v8::DontDelete;
@@ -60,21 +58,8 @@ MaybeLocal<Value> DataPointerToBuffer(Environment* env, DataPointer&& data) {
   struct Flag {
     bool secure;
   };
-#ifdef V8_ENABLE_SANDBOX
-  auto backing = ArrayBuffer::NewBackingStore(
+  auto backing = AdoptIntoBackingStore(
       env->isolate(),
-      data.size(),
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
-  if (!backing) {
-    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-    return MaybeLocal<Value>();
-  }
-  if (data.size() > 0) {
-    memcpy(backing->Data(), data.get(), data.size());
-  }
-#else
-  auto backing = ArrayBuffer::NewBackingStore(
       data.get(),
       data.size(),
       [](void* data, size_t len, void* ptr) {
@@ -83,7 +68,10 @@ MaybeLocal<Value> DataPointerToBuffer(Environment* env, DataPointer&& data) {
       },
       new Flag{data.isSecure()});
   data.release();
-#endif  // V8_ENABLE_SANDBOX
+  if (!backing) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<Value>();
+  }
 
   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
   return Buffer::New(env, ab, 0, ab->ByteLength()).FromMaybe(Local<Value>());
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index b08d4b7a9106..f9263635d0b0 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -134,9 +134,12 @@ void ECDH::GenerateKeys(const FunctionCallbackInfo<Value>& args) {
   ECDH* ecdh;
   ASSIGN_OR_RETURN_UNWRAP(&ecdh, args.This());
 
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.generate()) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env, "Failed to generate key");
   }
+  ecdh->MaybeCacheValidKeyPair(generation);
 }
 
 ECPointPointer ECDH::BufferToPoint(Environment* env,
@@ -307,6 +310,7 @@ void ECDH::SetPrivateKey(const FunctionCallbackInfo<Value>& args) {
 
   ecdh->key_ = std::move(new_key);
   ecdh->group_ = ecdh->key_.getGroup();
+  ecdh->has_valid_key_pair_ = false;
 }
 
 void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
@@ -325,6 +329,7 @@ void ECDH::SetPublicKey(const FunctionCallbackInfo<Value>& args) {
         "Failed to convert Buffer to EC_POINT");
   }
 
+  ecdh->has_valid_key_pair_ = false;
   if (!ecdh->key_.setPublicKey(pub)) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
         "Failed to set EC_POINT as the public key");
@@ -345,9 +350,22 @@ bool ECDH::IsKeyValidForCurve(const BignumPointer& private_key) {
          private_key < order;
 }
 
+void ECDH::MaybeCacheValidKeyPair(uint64_t generation) {
+  has_valid_key_pair_ = generation == ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_) valid_key_pair_generation_ = generation;
+}
+
 bool ECDH::IsKeyPairValid() {
+  const uint64_t generation = ncrypto::getFipsStateGeneration();
+  if (has_valid_key_pair_ && valid_key_pair_generation_ == generation) {
+    return true;
+  }
+  has_valid_key_pair_ = false;
+
   MarkPopErrorOnReturn mark_pop_error_on_return;
-  return key_.checkKey();
+  const bool is_valid = key_.checkKey();
+  if (is_valid) MaybeCacheValidKeyPair(generation);
+  return is_valid;
 }
 
 // Convert the input public key to compressed, uncompressed, or hybrid formats.
@@ -470,30 +488,21 @@ bool ExportJWKEcKey(Environment* env,
   const auto& m_pkey = key.GetAsymmetricKey();
   CHECK_EQ(m_pkey.id(), EVP_PKEY_EC);
 
-  ECKeyPointer ec(m_pkey);
-  if (!ec) {
-    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
+  BignumPointer x;
+  BignumPointer y;
+  BignumPointer priv;
+  int degree_bits;
+  if (!Ec::GetKeyComponents(
+          m_pkey,
+          &x,
+          &y,
+          key.GetKeyType() == kKeyTypePrivate ? &priv : nullptr,
+          &degree_bits)) {
     return false;
   }
-  // A provider-backed key need not expose its public point.
-  if (ec.getPublicKey() == nullptr) return false;
-
-  const auto pub = ec.getPublicKey();
-  const auto group = ec.getGroup();
-
-  int degree_bits = EC_GROUP_get_degree(group);
   int degree_bytes =
       (degree_bits / CHAR_BIT) + (7 + (degree_bits % CHAR_BIT)) / 8;
 
-  auto x = BignumPointer::New();
-  auto y = BignumPointer::New();
-
-  if (!EC_POINT_get_affine_coordinates(group, pub, x.get(), y.get(), nullptr)) {
-    ThrowCryptoError(env, ERR_get_error(),
-                     "Failed to get elliptic-curve point coordinates");
-    return false;
-  }
-
   if (!target
            ->DefineOwnProperty(
                env->context(), env->jwk_kty_string(), env->jwk_ec_string())
@@ -517,7 +526,7 @@ bool ExportJWKEcKey(Environment* env,
   }
 
   Local<String> crv_name;
-  const int nid = EC_GROUP_get_curve_name(group);
+  const int nid = Ec::GetCurveId(m_pkey);
   switch (nid) {
     case NID_X9_62_prime256v1:
       crv_name = env->p256_string();
@@ -544,9 +553,8 @@ bool ExportJWKEcKey(Environment* env,
   }
 
   if (key.GetKeyType() == kKeyTypePrivate) {
-    auto pvt = ec.getPrivateKey();
-    if (pvt == nullptr) return false;
-    return SetEncodedValue(env, target, env->jwk_d_string(), pvt, degree_bytes)
+    return SetEncodedValue(
+               env, target, env->jwk_d_string(), priv.get(), degree_bytes)
         .IsJust();
   }
 
@@ -738,7 +746,7 @@ KeyObjectData ImportJWKEcKey(Environment* env, Local<Object> jwk) {
       return {};
     }
     // Verify that the public point matches the private scalar (d*G == (x,y)).
-    if (!ec.checkKey()) {
+    if (!ec.checkPrivateKey()) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
       return {};
     }
@@ -746,7 +754,10 @@ KeyObjectData ImportJWKEcKey(Environment* env, Local<Object> jwk) {
 
   auto pkey = EVPKeyPointer::New();
   if (!pkey) return {};
-  CHECK(pkey.set(ec));
+  if (!pkey.set(ec)) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK EC key");
+    return {};
+  }
 
   return KeyObjectData::CreateAsymmetric(type, std::move(pkey));
 }
@@ -758,11 +769,7 @@ bool GetEcKeyDetail(Environment* env,
   const auto& m_pkey = key.GetAsymmetricKey();
   CHECK_EQ(m_pkey.id(), EVP_PKEY_EC);
 
-  ECKeyPointer ec(m_pkey);
-  if (!ec) return true;
-
-  const auto group = ec.getGroup();
-  int nid = EC_GROUP_get_curve_name(group);
+  int nid = Ec::GetCurveId(m_pkey);
   if (nid == NID_undef) return true;
 
   return target
diff --git a/src/crypto/crypto_ec.h b/src/crypto/crypto_ec.h
index 9bc817f3d7f5..3e83d541d7ae 100644
--- a/src/crypto/crypto_ec.h
+++ b/src/crypto/crypto_ec.h
@@ -48,11 +48,14 @@ class ECDH final : public BaseObject {
   static void GetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetPublicKey(const v8::FunctionCallbackInfo<v8::Value>& args);
 
+  void MaybeCacheValidKeyPair(uint64_t generation);
   bool IsKeyPairValid();
   bool IsKeyValidForCurve(const ncrypto::BignumPointer& private_key);
 
   ncrypto::ECKeyPointer key_;
   const EC_GROUP* group_;
+  bool has_valid_key_pair_ = false;
+  uint64_t valid_key_pair_generation_ = 0;
 };
 
 struct EcKeyPairParams final : public MemoryRetainer {
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index 2d80caf76661..b7d3ef9ae6da 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -386,21 +386,24 @@ bool KeyObjectData::ToEncodedPublicKey(
     Mutex::ScopedLock lock(mutex());
     const auto& pkey = GetAsymmetricKey();
     if (pkey.id() == EVP_PKEY_EC) {
+      auto form = static_cast<point_conversion_form_t>(config.ec_point_form);
+      auto bytes = ncrypto::Ec::TryExportPublic(pkey, form);
+      if (bytes)
+        return Buffer::Copy(env, bytes.get<const char>(), bytes.size())
+            .ToLocal(out);
       ECKeyPointer ec_key(pkey);
       if (!ec_key) {
         THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
         return false;
       }
-      // A provider-backed key need not expose its public point.
       if (ec_key.getPublicKey() == nullptr) {
         THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                           "Failed to export EC public key");
         return false;
       }
-      auto form = static_cast<point_conversion_form_t>(config.ec_point_form);
-      const auto group = ec_key.getGroup();
-      const auto point = ec_key.getPublicKey();
-      return ECPointToBuffer(env, group, point, form).ToLocal(out);
+      return ECPointToBuffer(
+                 env, ec_key.getGroup(), ec_key.getPublicKey(), form)
+          .ToLocal(out);
     }
     const int id = pkey.id();
     bool is_raw_supported = id == EVP_PKEY_ED25519 || id == EVP_PKEY_ED448 ||
@@ -441,25 +444,7 @@ bool KeyObjectData::ToEncodedPrivateKey(
     Mutex::ScopedLock lock(mutex());
     const auto& pkey = GetAsymmetricKey();
     if (pkey.id() == EVP_PKEY_EC) {
-      ECKeyPointer ec_key(pkey);
-      if (!ec_key) {
-        THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-        return false;
-      }
-      const BIGNUM* private_key = ec_key.getPrivateKey();
-      if (private_key == nullptr) {
-        THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                          "Failed to export EC private key");
-        return false;
-      }
-      const auto group = ec_key.getGroup();
-      auto order = BignumPointer::New();
-      if (!order || !EC_GROUP_get_order(group, order.get(), nullptr)) {
-        THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                          "Failed to export EC private key");
-        return false;
-      }
-      auto buf = BignumPointer::EncodePadded(private_key, order.byteLength());
+      auto buf = ncrypto::Ec::ExportPrivate(pkey);
       if (!buf) {
         THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                           "Failed to export EC private key");
@@ -1581,24 +1566,27 @@ void KeyObjectHandle::ExportECPublicRaw(
     return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
   }
 
+  CHECK(args[0]->IsInt32());
+  auto form =
+      static_cast<point_conversion_form_t>(args[0].As<Int32>()->Value());
+
+  auto bytes = ncrypto::Ec::TryExportPublic(m_pkey, form);
+  if (bytes) {
+    args.GetReturnValue().Set(
+        Buffer::Copy(env, bytes.get<const char>(), bytes.size())
+            .FromMaybe(Local<Value>()));
+    return;
+  }
   ECKeyPointer ec_key(m_pkey);
   if (!ec_key) return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-  // A provider-backed key need not expose its public point.
   if (ec_key.getPublicKey() == nullptr) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                              "Failed to export EC public key");
   }
-
-  CHECK(args[0]->IsInt32());
-  auto form =
-      static_cast<point_conversion_form_t>(args[0].As<Int32>()->Value());
-
-  const auto group = ec_key.getGroup();
-  const auto point = ec_key.getPublicKey();
-
   Local<Object> buf;
-  if (!ECPointToBuffer(env, group, point, form).ToLocal(&buf)) return;
-
+  if (!ECPointToBuffer(env, ec_key.getGroup(), ec_key.getPublicKey(), form)
+           .ToLocal(&buf))
+    return;
   args.GetReturnValue().Set(buf);
 }
 
@@ -1617,23 +1605,7 @@ void KeyObjectHandle::ExportECPrivateRaw(
     return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
   }
 
-  ECKeyPointer ec_key(m_pkey);
-  if (!ec_key) return THROW_ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS(env);
-
-  const BIGNUM* private_key = ec_key.getPrivateKey();
-  if (private_key == nullptr) {
-    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                             "Failed to export EC private key");
-  }
-
-  const auto group = ec_key.getGroup();
-  auto order = BignumPointer::New();
-  if (!order || !EC_GROUP_get_order(group, order.get(), nullptr)) {
-    return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
-                                             "Failed to export EC private key");
-  }
-
-  auto buf = BignumPointer::EncodePadded(private_key, order.byteLength());
+  auto buf = ncrypto::Ec::ExportPrivate(m_pkey);
   if (!buf) {
     return THROW_ERR_CRYPTO_OPERATION_FAILED(env,
                                              "Failed to export EC private key");
@@ -1913,11 +1885,15 @@ MaybeLocal<Value> NativeCryptoKey::Create(Environment* env,
 
 void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-  CHECK_EQ(args.Length(), 4);
+  CHECK_GE(args.Length(), 4);
+  CHECK_LE(args.Length(), 6);
   // args[0] is a KeyObjectHandle; we keep its KeyObjectData directly.
   // args[1] is the algorithm dictionary object.
   // args[2] is the usages mask.
   // args[3] is the extractable boolean.
+  // args[4], when present, is an optional secondary KeyObjectHandle for
+  // Hybrid KEM CryptoKeys.
+  // args[5], when present, is optional seed_data for Hybrid KEM CryptoKeys.
   //
   // args[1] is undefined only when called from
   // CryptoKeyTransferData::Deserialize for a partially-initialized
@@ -1931,7 +1907,24 @@ void NativeCryptoKey::New(const FunctionCallbackInfo<Value>& args) {
   KeyObjectHandle* handle = Unwrap<KeyObjectHandle>(args[0].As<Object>());
   CHECK_NOT_NULL(handle);
 
-  auto* native = new NativeCryptoKey(env, args.This(), handle->Data());
+  KeyObjectData secondary_data;
+  if (args.Length() >= 5 && !args[4]->IsUndefined()) {
+    CHECK(KeyObjectHandle::HasInstance(env, args[4]));
+    KeyObjectHandle* secondary_handle =
+        Unwrap<KeyObjectHandle>(args[4].As<Object>());
+    CHECK_NOT_NULL(secondary_handle);
+    secondary_data = secondary_handle->Data();
+  }
+
+  ByteSource seed_data;
+  if (args.Length() == 6 && !args[5]->IsUndefined()) {
+    CHECK(IsAnyBufferSource(args[5]));
+    ArrayBufferOrViewContents<char> buf(args[5]);
+    seed_data = buf.ToCopy();
+  }
+
+  auto* native = new NativeCryptoKey(
+      env, args.This(), handle->Data(), secondary_data, std::move(seed_data));
 
   if (!args[1]->IsUndefined()) {
     CHECK(args[1]->IsObject());
@@ -1979,9 +1972,10 @@ void NativeCryptoKey::CreateCryptoKeyClass(
 }
 
 // Returns all of the key's internal slot values as a single Array:
-// [type enum, extractable, algorithm, usages mask, handle]. JS-side helpers
-// call this once per key to prime a per-instance cache, so subsequent
-// reads don't need to cross into C++ at all.
+// [type enum, extractable, algorithm, usages mask, handle, secondary handle,
+// seed data]. JS-side helpers call this once per key to prime a per-instance
+// cache, so subsequent reads don't need to cross into C++ at all. The
+// secondary handle and seed data slots are only used by Hybrid KEM CryptoKeys.
 void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 1);
@@ -1998,15 +1992,38 @@ void NativeCryptoKey::GetSlots(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (native->secondary_handle_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, native->secondary_handle_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return;
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (native->seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(
+             env, native->seed_data_.data<char>(), native->seed_data_.size())
+             .ToLocal(&buf)) {
+      return;
+    }
+    seed_data = buf;
+  }
+
   Local<Value> algorithm = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm->IsObject());
-  Isolate* isolate = env->isolate();
   Local<Value> slots[] = {
       Uint32::NewFromUnsigned(isolate, native->handle_data_.GetKeyType()),
       v8::Boolean::New(isolate, native->extractable_),
       algorithm,
       Uint32::NewFromUnsigned(isolate, native->usages_mask_),
       handle,
+      secondary_handle,
+      seed_data,
   };
   args.GetReturnValue().Set(Array::New(isolate, slots, arraysize(slots)));
 }
@@ -2022,8 +2039,12 @@ std::unique_ptr<worker::TransferData> NativeCryptoKey::CloneForMessaging()
   Local<Value> algorithm_v = obj->GetInternalField(kAlgorithmField).As<Value>();
   CHECK(algorithm_v->IsObject());
   v8::Global<Object> algorithm_copy(isolate, algorithm_v.As<Object>());
-  return std::make_unique<CryptoKeyTransferData>(
-      handle_data_, std::move(algorithm_copy), usages_mask_, extractable_);
+  return std::make_unique<CryptoKeyTransferData>(handle_data_,
+                                                 secondary_handle_data_,
+                                                 seed_data_.ToCopy(),
+                                                 std::move(algorithm_copy),
+                                                 usages_mask_,
+                                                 extractable_);
 }
 
 Maybe<void> NativeCryptoKey::FinalizeTransferRead(
@@ -2103,9 +2124,29 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
   Local<Object> handle;
   if (!KeyObjectHandle::Create(env, data_).ToLocal(&handle)) return {};
 
+  Isolate* isolate = env->isolate();
+  Local<Value> secondary_handle = Undefined(isolate);
+  if (secondary_data_) {
+    Local<Object> secondary_handle_object;
+    if (!KeyObjectHandle::Create(env, secondary_data_)
+             .ToLocal(&secondary_handle_object)) {
+      return {};
+    }
+    secondary_handle = secondary_handle_object;
+  }
+
+  Local<Value> seed_data = Undefined(isolate);
+  if (seed_data_) {
+    Local<Object> buf;
+    if (!Buffer::Copy(env, seed_data_.data<char>(), seed_data_.size())
+             .ToLocal(&buf)) {
+      return {};
+    }
+    seed_data = buf;
+  }
+
   // Make sure internal/crypto/keys has been loaded so that the
   // CryptoKey constructor is registered with the Environment.
-  Isolate* isolate = env->isolate();
   Local<Value> arg = env->internal_crypto_keys_string();
   if (env->builtin_module_require()
           ->Call(context, Null(isolate), 1, &arg)
@@ -2122,9 +2163,11 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
       Undefined(isolate),
       Undefined(isolate),
       Undefined(isolate),
+      secondary_handle,
+      seed_data,
   };
   Local<Value> cryptokey;
-  if (!cryptokey_ctor->NewInstance(context, 4, ctor_args).ToLocal(&cryptokey)) {
+  if (!cryptokey_ctor->NewInstance(context, 6, ctor_args).ToLocal(&cryptokey)) {
     return {};
   }
 
@@ -2134,11 +2177,19 @@ BaseObjectPtr<BaseObject> NativeCryptoKey::CryptoKeyTransferData::Deserialize(
 
 void NativeCryptoKey::MemoryInfo(MemoryTracker* tracker) const {
   tracker->TrackField("handle_data", handle_data_);
+  if (secondary_handle_data_) {
+    tracker->TrackField("secondary_handle_data", secondary_handle_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
 }
 
 void NativeCryptoKey::CryptoKeyTransferData::MemoryInfo(
     MemoryTracker* tracker) const {
   tracker->TrackField("data", data_);
+  if (secondary_data_) {
+    tracker->TrackField("secondary_data", secondary_data_);
+  }
+  tracker->TrackFieldWithSize("seed_data", seed_data_.size());
   tracker->TrackField("algorithm", algorithm_);
 }
 
diff --git a/src/crypto/crypto_keys.h b/src/crypto/crypto_keys.h
index 8fffbec60467..9f3b1cce091c 100644
--- a/src/crypto/crypto_keys.h
+++ b/src/crypto/crypto_keys.h
@@ -258,9 +258,12 @@ class NativeKeyObject : public BaseObject {
 
 // NativeCryptoKey is the native base class for the Web Crypto
 // `CryptoKey`. It holds the internal slots - `[[type]]` as an enum,
-// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, and the
-// underlying KeyObjectData. The public `type`, `extractable`,
-// `algorithm`, and `usages` accessors on `CryptoKey.prototype` are
+// `[[extractable]]`, `[[algorithm]]`, `[[usages]]` as a mask, the
+// primary underlying KeyObjectData. Hybrid KEM CryptoKeys may also store an
+// optional secondary KeyObjectData and optional seed_data, both of which are
+// only used to reconstruct their hybrid key material. The public `type`,
+// `extractable`, `algorithm`, and `usages` accessors on `CryptoKey.prototype`
+// are
 // user-configurable per Web IDL, so internal consumers read these
 // values directly from the C++ side via a single `GetSlots` call
 // which returns all slots at once; JS primes a per-instance cache
@@ -291,8 +294,10 @@ class NativeCryptoKey : public BaseObject {
   // Used by `GetSlots` to validate its receiver.
   static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
 
-  // Returns [type, extractable, algorithm, usages mask, handle] in one call
-  // so JS can prime a per-instance cache on first access.
+  // Returns [type, extractable, algorithm, usages mask, handle,
+  // secondary handle, seed data] in one call so JS can prime a per-instance
+  // cache on first access. The secondary handle and seed data slots are only
+  // used by Hybrid KEM CryptoKeys.
   static void GetSlots(const v8::FunctionCallbackInfo<v8::Value>& args);
 
   void MemoryInfo(MemoryTracker* tracker) const override;
@@ -302,10 +307,15 @@ class NativeCryptoKey : public BaseObject {
   class CryptoKeyTransferData : public worker::TransferData {
    public:
     CryptoKeyTransferData(const KeyObjectData& data,
+                          const KeyObjectData& secondary_data,
+                          ByteSource&& seed_data,
                           v8::Global<v8::Object>&& algorithm,
                           uint32_t usages_mask,
                           bool extractable)
         : data_(data.addRef()),
+          secondary_data_(secondary_data ? secondary_data.addRef()
+                                         : KeyObjectData()),
+          seed_data_(std::move(seed_data)),
           algorithm_(std::move(algorithm)),
           usages_mask_(usages_mask),
           extractable_(extractable) {}
@@ -325,6 +335,8 @@ class NativeCryptoKey : public BaseObject {
 
    private:
     KeyObjectData data_;
+    KeyObjectData secondary_data_;
+    ByteSource seed_data_;
     v8::Global<v8::Object> algorithm_;
     uint32_t usages_mask_;
     bool extractable_;
@@ -337,16 +349,28 @@ class NativeCryptoKey : public BaseObject {
       v8::ValueDeserializer* deserializer) override;
 
   const KeyObjectData& handle_data() const { return handle_data_; }
+  const KeyObjectData& secondary_handle_data() const {
+    return secondary_handle_data_;
+  }
 
  private:
   NativeCryptoKey(Environment* env,
                   v8::Local<v8::Object> wrap,
-                  const KeyObjectData& handle_data)
-      : BaseObject(env, wrap), handle_data_(handle_data.addRef()) {
+                  const KeyObjectData& handle_data,
+                  const KeyObjectData& secondary_handle_data,
+                  ByteSource&& seed_data)
+      : BaseObject(env, wrap),
+        handle_data_(handle_data.addRef()),
+        secondary_handle_data_(secondary_handle_data
+                                   ? secondary_handle_data.addRef()
+                                   : KeyObjectData()),
+        seed_data_(std::move(seed_data)) {
     MakeWeak();
   }
 
   KeyObjectData handle_data_;
+  KeyObjectData secondary_handle_data_;
+  ByteSource seed_data_;
   uint32_t usages_mask_ = 0;
   bool extractable_ = false;
 };
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index e80c70c961df..f6919221a4f2 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -22,6 +22,7 @@ using ncrypto::EVPKeyPointer;
 #if NCRYPTO_USE_LEGACY_KEY_TYPES
 using ncrypto::RSAPointer;
 #endif
+using v8::Array;
 using v8::ArrayBuffer;
 using v8::BackingStoreInitializationMode;
 using v8::FunctionCallbackInfo;
@@ -39,6 +40,8 @@ using v8::Value;
 
 namespace crypto {
 namespace {
+constexpr uint32_t kMaxRsaOtherPrimeInfos = 8;
+
 bool IsRsaPssDigestEncodable(const Digest& digest) {
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   const int nid = EVP_MD_type(digest.get());
@@ -339,6 +342,29 @@ bool ExportJWKRsaKey(Environment* env,
             .IsNothing()) {
       return false;
     }
+
+    const auto other_prime_infos = rsa.getOtherPrimeInfos();
+    if (!other_prime_infos.empty()) {
+      const uint32_t count = static_cast<uint32_t>(other_prime_infos.size());
+      Local<Array> oth = Array::New(env->isolate(), count);
+      for (uint32_t i = 0; i < count; i++) {
+        const auto& info = other_prime_infos[i];
+        Local<Object> item = Object::New(env->isolate());
+        if (SetEncodedValue(env, item, env->jwk_r_string(), info.r)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_d_string(), info.d)
+                .IsNothing() ||
+            SetEncodedValue(env, item, env->jwk_t_string(), info.t)
+                .IsNothing() ||
+            !oth->Set(env->context(), i, item).FromMaybe(false)) {
+          return false;
+        }
+      }
+      if (!target->DefineOwnProperty(env->context(), env->jwk_oth_string(), oth)
+               .FromMaybe(false)) {
+        return false;
+      }
+    }
   }
 
   return true;
@@ -348,12 +374,13 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   Local<Value> n_value;
   Local<Value> e_value;
   Local<Value> d_value;
+  Local<Value> oth_value;
 
   if (!jwk->Get(env->context(), env->jwk_n_string()).ToLocal(&n_value) ||
       !jwk->Get(env->context(), env->jwk_e_string()).ToLocal(&e_value) ||
       !jwk->Get(env->context(), env->jwk_d_string()).ToLocal(&d_value) ||
-      !n_value->IsString() ||
-      !e_value->IsString()) {
+      !jwk->Get(env->context(), env->jwk_oth_string()).ToLocal(&oth_value) ||
+      !n_value->IsString() || !e_value->IsString()) {
     THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
     return {};
   }
@@ -364,6 +391,10 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
   }
 
   KeyType type = d_value->IsString() ? kKeyTypePrivate : kKeyTypePublic;
+  if (type == kKeyTypePublic && !oth_value->IsUndefined()) {
+    THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+    return {};
+  }
 
 #if NCRYPTO_USE_OPENSSL3_PROVIDER
   ncrypto::Rsa rsa_view;
@@ -417,19 +448,79 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
     ByteSource dq = ByteSource::FromEncodedString(env, dq_value.As<String>());
     ByteSource qi = ByteSource::FromEncodedString(env, qi_value.As<String>());
 
-    if (!rsa_view.setPrivateKey(
-            d.ToBN(), q.ToBN(), p.ToBN(), dp.ToBN(), dq.ToBN(), qi.ToBN())) {
+    ncrypto::Rsa::OtherPrimeInfoPointers other_prime_infos;
+    if (!oth_value->IsUndefined()) {
+      if (!oth_value->IsArray()) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+
+      Local<Array> oth = oth_value.As<Array>();
+      const uint32_t length = oth->Length();
+      if (length == 0 || length > kMaxRsaOtherPrimeInfos) {
+        THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+        return {};
+      }
+      other_prime_infos.reserve(length);
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> item_value;
+        Local<Value> r_value;
+        Local<Value> other_d_value;
+        Local<Value> t_value;
+        if (!oth->Get(env->context(), i).ToLocal(&item_value) ||
+            !item_value->IsObject()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        Local<Object> item = item_value.As<Object>();
+        if (!item->Get(env->context(), env->jwk_r_string()).ToLocal(&r_value) ||
+            !item->Get(env->context(), env->jwk_d_string())
+                 .ToLocal(&other_d_value) ||
+            !item->Get(env->context(), env->jwk_t_string()).ToLocal(&t_value) ||
+            !r_value->IsString() || !other_d_value->IsString() ||
+            !t_value->IsString()) {
+          THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
+          return {};
+        }
+
+        other_prime_infos.push_back({
+            ByteSource::FromEncodedString(env, r_value.As<String>()).ToBN(),
+            ByteSource::FromEncodedString(env, other_d_value.As<String>())
+                .ToBN(),
+            ByteSource::FromEncodedString(env, t_value.As<String>()).ToBN(),
+        });
+      }
+    }
+
+    if (!rsa_view.setPrivateKey(d.ToBN(),
+                                q.ToBN(),
+                                p.ToBN(),
+                                dp.ToBN(),
+                                dq.ToBN(),
+                                qi.ToBN(),
+                                std::move(other_prime_infos))) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
       return {};
     }
 
-    // Verify that n == p * q.
+    // Verify that n is the product of all prime factors.
     const auto& pub = rsa_view.getPublicKey();
     const auto& priv = rsa_view.getPrivateKey();
-    auto pq = BignumPointer::New();
+    auto product = BignumPointer::New();
     BN_CTX* ctx = BN_CTX_new();
-    bool n_valid = ctx && pq && BN_mul(pq.get(), priv.p, priv.q, ctx) == 1 &&
-                   BN_cmp(pq.get(), pub.n) == 0;
+    bool n_valid =
+        ctx && product && BN_mul(product.get(), priv.p, priv.q, ctx) == 1;
+    for (const auto& info : rsa_view.getOtherPrimeInfos()) {
+      auto next = BignumPointer::New();
+      if (!n_valid || !next ||
+          BN_mul(next.get(), product.get(), info.r, ctx) != 1) {
+        n_valid = false;
+        break;
+      }
+      product = std::move(next);
+    }
+    n_valid = n_valid && BN_cmp(product.get(), pub.n) == 0;
     BN_CTX_free(ctx);
     if (!n_valid) {
       THROW_ERR_CRYPTO_INVALID_JWK(env, "Invalid JWK RSA key");
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 942e00accba9..568325a99462 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -46,8 +46,6 @@ using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
 using v8::BackingStore;
-using v8::BackingStoreInitializationMode;
-using v8::BackingStoreOnFailureMode;
 using v8::BigInt;
 using v8::Context;
 using v8::DictionaryTemplate;
@@ -802,36 +800,18 @@ std::unique_ptr<BackingStore> ByteSource::ReleaseToBackingStore(
   // It's ok for allocated_data_ to be nullptr but
   // only if size_ is zero.
   CHECK_IMPLIES(size_ > 0, allocated_data_ != nullptr);
-#ifdef V8_ENABLE_SANDBOX
-  // If the v8 sandbox is enabled, then all array buffers must be allocated
-  // via the isolate. External buffers are not allowed. So, instead of wrapping
-  // the allocated data we'll copy it instead.
-
-  // TODO(@jasnell): It would be nice to use an abstracted utility to do this
-  // branch instead of duplicating the V8_ENABLE_SANDBOX check each time.
-  std::unique_ptr<BackingStore> ptr = ArrayBuffer::NewBackingStore(
+  std::unique_ptr<BackingStore> ptr = AdoptIntoBackingStore(
       env->isolate(),
-      size(),
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
-  if (!ptr) {
-    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-    return nullptr;
-  }
-  memcpy(ptr->Data(), allocated_data_, size());
-  OPENSSL_clear_free(allocated_data_, size_);
-#else
-  std::unique_ptr<BackingStore> ptr = ArrayBuffer::NewBackingStore(
       allocated_data_,
       size(),
-      [](void* data, size_t length, void* deleter_data) {
-        OPENSSL_clear_free(deleter_data, length);
-      }, allocated_data_);
-#endif  // V8_ENABLE_SANDBOX
-  CHECK(ptr);
+      [](void* data, size_t length, void*) {
+        OPENSSL_clear_free(data, length);
+      },
+      nullptr);
   allocated_data_ = nullptr;
   data_ = nullptr;
   size_ = 0;
+  if (!ptr) THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
   return ptr;
 }
 
@@ -1193,17 +1173,6 @@ namespace {
 // initialized, SecureBuffer will automatically use it.
 void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
-#ifdef V8_ENABLE_SANDBOX
-  // The v8 sandbox is enabled, so we cannot use the secure heap because
-  // the sandbox requires that all array buffers be allocated via the isolate.
-  // That is fundamentally incompatible with the secure heap which allocates
-  // in openssl's secure heap area. Instead we'll just throw an error here.
-  //
-  // That said, we really shouldn't get here in the first place since the
-  // option to enable the secure heap is only available when the sandbox
-  // is disabled.
-  UNREACHABLE();
-#else
   CHECK(args[0]->IsUint32());
   uint32_t len = args[0].As<Uint32>()->Value();
 
@@ -1213,7 +1182,10 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
   }
   auto released = data.release();
 
-  std::shared_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
+  // Under V8_ENABLE_SANDBOX this ends up as a plain copy, which is fine:
+  // --secure-heap is unavailable there, so SecureAlloc() is OPENSSL_malloc().
+  std::shared_ptr<BackingStore> store = AdoptIntoBackingStore(
+      env->isolate(),
       released.data,
       released.len,
       [](void* data, size_t len, void* deleter_data) {
@@ -1227,10 +1199,12 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
             true);
       },
       nullptr);
+  if (!store) {
+    return THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+  }
 
   Local<ArrayBuffer> buffer = ArrayBuffer::New(env->isolate(), store);
   args.GetReturnValue().Set(Uint8Array::New(buffer, 0, len));
-#endif  // V8_ENABLE_SANDBOX
 }
 
 void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index aafdd3bf273b..00ac9f6703aa 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -227,6 +227,15 @@ class ByteSource final {
     return ncrypto::BignumPointer(data<unsigned char>(), size());
   }
 
+  inline ByteSource ToCopy() const {
+    if (empty()) return {};
+    CHECK_NOT_NULL(data_);
+    auto data = MallocOpenSSL<char>(size());
+    CHECK_NOT_NULL(data);
+    memcpy(data, data_, size());
+    return ByteSource::Allocated(data, size());
+  }
+
   // Creates a v8::BackingStore that takes over responsibility for
   // any allocated data. The ByteSource will be reset with size = 0
   // after being called.
diff --git a/src/crypto/crypto_x509.cc b/src/crypto/crypto_x509.cc
index b81141e1a915..14825742e986 100644
--- a/src/crypto/crypto_x509.cc
+++ b/src/crypto/crypto_x509.cc
@@ -27,8 +27,6 @@ using ncrypto::X509View;
 using v8::Array;
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
-using v8::BackingStoreInitializationMode;
-using v8::BackingStoreOnFailureMode;
 using v8::Boolean;
 using v8::Context;
 using v8::Date;
@@ -140,29 +138,18 @@ MaybeLocal<Value> ToBuffer(Environment* env, BIOPointer* bio) {
   BUF_MEM* mem = *bio;
   if (!mem) [[unlikely]]
     return {};
-#ifdef V8_ENABLE_SANDBOX
-  // If the v8 sandbox is enabled, then all array buffers must be allocated
-  // via the isolate. External buffers are not allowed. So, instead of wrapping
-  // the BIOPointer we'll copy it instead.
-  auto backing = ArrayBuffer::NewBackingStore(
+  auto backing = AdoptIntoBackingStore(
       env->isolate(),
-      mem->length,
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
-  if (!backing) {
-    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
-    return MaybeLocal<Value>();
-  }
-  memcpy(backing->Data(), mem->data, mem->length);
-#else
-  auto backing = ArrayBuffer::NewBackingStore(
       mem->data,
       mem->length,
       [](void*, size_t, void* data) {
         BIOPointer free_me(static_cast<BIO*>(data));
       },
       bio->release());
-#endif  // V8_ENABLE_SANDBOX
+  if (!backing) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<Value>();
+  }
   auto ab = ArrayBuffer::New(env->isolate(), std::move(backing));
   Local<Value> ret;
   if (!Buffer::New(env, ab, 0, ab->ByteLength()).ToLocal(&ret)) return {};
diff --git a/src/env.cc b/src/env.cc
index 57e2849b25aa..d35c28fcf7ed 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -600,10 +600,8 @@ IsolateData* IsolateData::CreateIsolateData(
     uv_loop_t* loop,
     MultiIsolatePlatform* platform,
     ArrayBufferAllocator* allocator,
-    const EmbedderSnapshotData* embedder_snapshot_data,
+    const SnapshotData* snapshot_data,
     std::shared_ptr<PerIsolateOptions> options) {
-  const SnapshotData* snapshot_data =
-      SnapshotData::FromEmbedderWrapper(embedder_snapshot_data);
   if (options == nullptr) {
     options = per_process::cli_options->per_isolate->Clone();
   }
@@ -822,6 +820,105 @@ void Environment::recycle_managed_buffer(std::unique_ptr<BackingStore> bs) {
     managed_buffer_cache_ = std::move(bs);
 }
 
+uv_buf_t StreamReadSlab::Allocate(Isolate* isolate, size_t suggested) {
+  DCHECK_GT(suggested, 0);
+  // Reads always get the full `suggested` size: handing out a smaller
+  // remainder would shrink the read() buffer and fragment large reads into
+  // more system calls, which costs more than the slab tail it saves.
+  size_t remaining = current_.bs ? current_.size() - current_.offset : 0;
+  if (remaining < suggested) {
+    // Retire the current slab; it stays alive through `retired_` if reads
+    // are still pending on it, or through JS views over it otherwise.
+    if (current_.bs && current_.pending > 0)
+      retired_.push_back(std::move(current_));
+    current_ = Slab();
+    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+        isolate,
+        std::max(kSlabSize, suggested),
+        BackingStoreInitializationMode::kUninitialized);
+    current_.bs = std::move(bs);
+  }
+  char* base = current_.data() + current_.offset;
+  current_.offset += suggested;
+  current_.last_base = base;
+  current_.last_end = current_.offset;
+  current_.pending++;
+  return uv_buf_init(base, suggested);
+}
+
+StreamReadSlab::Slab* StreamReadSlab::FindSlab(const char* base) {
+  if (current_.Contains(base)) return &current_;
+  for (Slab& slab : retired_)
+    if (slab.Contains(base)) return &slab;
+  return nullptr;
+}
+
+void StreamReadSlab::CompleteReservation(Slab* slab,
+                                         const uv_buf_t& buf,
+                                         size_t used) {
+  DCHECK_GT(slab->pending, 0);
+  slab->pending--;
+  if (buf.base == slab->last_base && slab->offset == slab->last_end) {
+    // This was the most recent reservation and nothing was reserved after
+    // it: rewind the unused remainder so it can be reserved again.
+    slab->offset = (buf.base - slab->data()) + used;
+    slab->last_end = slab->offset;
+  }
+  if (slab != &current_ && slab->pending == 0) {
+    for (auto it = retired_.begin(); it != retired_.end(); ++it) {
+      if (&*it == slab) {
+        retired_.erase(it);
+        break;
+      }
+    }
+  }
+}
+
+bool StreamReadSlab::Commit(Isolate* isolate,
+                            const uv_buf_t& buf,
+                            size_t nread,
+                            Local<ArrayBuffer>* ab,
+                            size_t* offset) {
+  Slab* slab = FindSlab(buf.base);
+  if (slab == nullptr) return false;
+  DCHECK_LE(nread, buf.len);
+
+  // A partial read would leave the rest of its reservation as waste once
+  // the slab retires - memory that counts towards V8's external memory and
+  // drives up GC frequency. If most of the reservation would be wasted,
+  // give the read a right-sized copy instead (as if it had never been read
+  // into the slab) and return its reservation in full. Reads that (mostly)
+  // fill their reservation get a zero-copy view into the slab.
+  if (nread < buf.len - buf.len / 4 && buf.base == slab->last_base &&
+      slab->offset == slab->last_end) {
+    std::unique_ptr<BackingStore> bs = ArrayBuffer::NewBackingStore(
+        isolate, nread, BackingStoreInitializationMode::kUninitialized);
+    memcpy(bs->Data(), buf.base, nread);
+    *ab = ArrayBuffer::New(isolate, std::move(bs));
+    *offset = 0;
+    CompleteReservation(slab, buf, 0);
+    return true;
+  }
+
+  *offset = buf.base - slab->data();
+  if (slab->ab.IsEmpty()) {
+    *ab = ArrayBuffer::New(isolate, slab->bs);
+    slab->ab.Reset(isolate, *ab);
+  } else {
+    *ab = slab->ab.Get(isolate);
+  }
+  CompleteReservation(slab, buf, nread);
+  return true;
+}
+
+bool StreamReadSlab::Release(const uv_buf_t& buf) {
+  if (buf.base == nullptr) return true;
+  Slab* slab = FindSlab(buf.base);
+  if (slab == nullptr) return false;
+  CompleteReservation(slab, buf, 0);
+  return true;
+}
+
 std::string Environment::GetExecPath(const std::vector<std::string>& argv) {
   char exec_path_buf[2 * PATH_MAX];
   size_t exec_path_len = sizeof(exec_path_buf);
@@ -909,6 +1006,9 @@ Environment::Environment(IsolateData* isolate_data,
           isolate_data->snapshot_data()->code_cache);
     }
   }
+  if (is_main_thread() && !isolate_data->builtin_code_cache().empty()) {
+    builtin_loader()->RefreshCodeCache(isolate_data->builtin_code_cache());
+  }
 
   // Compile builtins eagerly when building the snapshot so that inner functions
   // of essential builtins that are loaded in the snapshot can have faster first
@@ -989,7 +1089,12 @@ Environment::Environment(IsolateData* isolate_data,
     // spawn/worker nor use addons or enable inspector
     // unless explicitly allowed by the user
     if (!options_->allow_addons) {
-      options_->allow_native_addons = false;
+      // In audit mode addon loading must stay enabled: the denial is
+      // published through the diagnostics channel by the permission
+      // check in DLOpen() instead of being rejected upfront.
+      if (!options_->permission_audit) {
+        options_->allow_native_addons = false;
+      }
       permission()->Apply(this, args, permission::PermissionScope::kAddon);
     }
     if (!options_->allow_inspector) {
diff --git a/src/env.h b/src/env.h
index a866604cdda8..29754ddb6371 100644
--- a/src/env.h
+++ b/src/env.h
@@ -143,7 +143,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
       uv_loop_t* event_loop,
       MultiIsolatePlatform* platform = nullptr,
       ArrayBufferAllocator* node_allocator = nullptr,
-      const EmbedderSnapshotData* embedder_snapshot_data = nullptr,
+      const SnapshotData* snapshot_data = nullptr,
       std::shared_ptr<PerIsolateOptions> options = nullptr);
   ~IsolateData();
 
@@ -168,6 +168,13 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   inline uv_loop_t* event_loop() const;
   inline MultiIsolatePlatform* platform() const;
   inline const SnapshotData* snapshot_data() const;
+  // See node::SetBuiltinCodeCache().
+  const std::vector<builtins::CodeCacheInfo>& builtin_code_cache() const {
+    return builtin_code_cache_;
+  }
+  void set_builtin_code_cache(std::vector<builtins::CodeCacheInfo> entries) {
+    builtin_code_cache_ = std::move(entries);
+  }
   inline std::shared_ptr<PerIsolateOptions> options();
 
   inline NodeArrayBufferAllocator* node_allocator() const;
@@ -257,6 +264,7 @@ class NODE_EXTERN_PRIVATE IsolateData : public MemoryRetainer {
   MultiIsolatePlatform* platform_;
 
   const SnapshotData* snapshot_data_;
+  std::vector<builtins::CodeCacheInfo> builtin_code_cache_;
   std::optional<SnapshotConfig> snapshot_config_;
 
   std::shared_ptr<PerIsolateOptions> options_;
@@ -279,6 +287,63 @@ struct ContextInfo {
 
 class EnabledDebugList;
 
+// A bump allocator for stream read buffers. Reads reserve a chunk of the
+// current slab and, once completed, are handed to JS as a view (ArrayBuffer +
+// offset) over the slab, so that no per-read allocation or copy is needed.
+// Unused reservation space is rewound when a read returns fewer bytes than
+// were reserved. Slabs with reads still pending when a new slab is started
+// (possible when multiple reads are in flight, e.g. on Windows) are kept
+// alive in `retired_` until those reads complete.
+class StreamReadSlab {
+ public:
+  // Sized to match the read buffer size that libuv suggests for stream
+  // reads: a slab typically serves a single large read (still avoiding the
+  // copy that right-sizing the buffer would need), or many small ones.
+  // Larger slabs amortize allocations further, but stay alive (pinned by
+  // chunk views) long enough to be promoted to V8's old generation, where
+  // their external memory is only reclaimed by major GCs.
+  static constexpr size_t kSlabSize = 64 * 1024;
+
+  // Reserve `suggested` bytes. Starts a new slab if the current one does
+  // not have enough space left.
+  uv_buf_t Allocate(v8::Isolate* isolate, size_t suggested);
+  // Commit a completed read of `nread` bytes into the buffer previously
+  // returned by Allocate(), rewinding the unused remainder of the
+  // reservation if possible. Returns the slab's ArrayBuffer and the offset
+  // of `buf.base` within it. Returns false if the buffer was not allocated
+  // from this slab (e.g. reads rerouted from another stream listener).
+  bool Commit(v8::Isolate* isolate,
+              const uv_buf_t& buf,
+              size_t nread,
+              v8::Local<v8::ArrayBuffer>* ab,
+              size_t* offset);
+  // Return an unused reservation (failed or empty read). Returns false if
+  // the buffer was not allocated from this slab.
+  bool Release(const uv_buf_t& buf);
+
+ private:
+  struct Slab {
+    std::shared_ptr<v8::BackingStore> bs;
+    v8::Global<v8::ArrayBuffer> ab;
+    size_t offset = 0;          // Bump pointer.
+    size_t pending = 0;         // Reservations not yet committed/released.
+    char* last_base = nullptr;  // Most recent reservation...
+    size_t last_end = 0;        // ...and the bump pointer after it.
+
+    char* data() const { return static_cast<char*>(bs->Data()); }
+    size_t size() const { return bs->ByteLength(); }
+    bool Contains(const char* p) const {
+      return bs && p >= data() && p < data() + size();
+    }
+  };
+
+  Slab* FindSlab(const char* base);
+  void CompleteReservation(Slab* slab, const uv_buf_t& buf, size_t used);
+
+  Slab current_;
+  std::vector<Slab> retired_;
+};
+
 namespace per_process {
 extern std::shared_ptr<KVStore> system_environment;
 }
@@ -597,7 +662,6 @@ struct SnapshotData {
   static bool FromBlob(SnapshotData* out, std::string_view in);
   static const SnapshotData* FromEmbedderWrapper(
       const EmbedderSnapshotData* data);
-  EmbedderSnapshotData::Pointer AsEmbedderWrapper() const;
 
   ~SnapshotData();
 };
@@ -1074,6 +1138,10 @@ class Environment final : public MemoryRetainer {
   // Only buffers that were not exposed externally may be recycled.
   void recycle_managed_buffer(std::unique_ptr<v8::BackingStore> bs);
 
+  StreamReadSlab& stream_read_slab() {
+    return stream_read_slab_;
+  }
+
   void AddUnmanagedFd(int fd);
   void RemoveUnmanagedFd(int fd);
 
@@ -1301,6 +1369,9 @@ class Environment final : public MemoryRetainer {
       released_allocated_buffers_;
   std::unique_ptr<v8::BackingStore> managed_buffer_cache_;
 
+  // Used by EmitToJSStreamListener to allocate stream read buffers.
+  StreamReadSlab stream_read_slab_;
+
   v8::CpuProfiler* cpu_profiler_ = nullptr;
   std::vector<v8::ProfilerId> pending_profiles_;
 };
diff --git a/src/env_properties.h b/src/env_properties.h
index 3eb1db96940b..bfb981d1c89b 100644
--- a/src/env_properties.h
+++ b/src/env_properties.h
@@ -240,12 +240,15 @@
   V(jwk_n_string, "n")                                                         \
   V(jwk_oct_string, "oct")                                                     \
   V(jwk_okp_string, "OKP")                                                     \
+  V(jwk_oth_string, "oth")                                                     \
   V(jwk_p_string, "p")                                                         \
   V(jwk_priv_string, "priv")                                                   \
   V(jwk_pub_string, "pub")                                                     \
   V(jwk_q_string, "q")                                                         \
   V(jwk_qi_string, "qi")                                                       \
+  V(jwk_r_string, "r")                                                         \
   V(jwk_rsa_string, "RSA")                                                     \
+  V(jwk_t_string, "t")                                                         \
   V(jwk_x_string, "x")                                                         \
   V(jwk_y_string, "y")                                                         \
   V(kill_signal_string, "killSignal")                                          \
@@ -404,6 +407,7 @@
   V(writable_string, "writable")                                               \
   V(write_host_object_string, "_writeHostObject")                              \
   V(write_queue_size_string, "writeQueueSize")                                 \
+  V(write_status_string, "writeStatus")                                        \
   V(zlib_string, "zlib")                                                       \
   V(zstd_string, "zstd")
 
diff --git a/src/ffi/data.cc b/src/ffi/data.cc
index 308bde60cae2..2aa68ce8c0a3 100644
--- a/src/ffi/data.cc
+++ b/src/ffi/data.cc
@@ -163,8 +163,7 @@ Maybe<void> ValidateStringLength(Environment* env, size_t len) {
 Maybe<std::pair<uint8_t*, size_t>> GetValidatedPointerAndOffset(
     Environment* env, const FunctionCallbackInfo<Value>& args) {
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -204,8 +203,7 @@ Maybe<PointerOffsetAndValue> GetValidatedPointerOffsetAndValue(
   size_t offset;
   Local<Value> value;
   uintptr_t raw_ptr;
-  if (args.Length() < 1 ||
-      !GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
+  if (!GetValidatedPointerAddress(env, args[0], "pointer").To(&raw_ptr)) {
     return {};
   }
 
@@ -535,6 +533,17 @@ void ToString(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(out);
 }
 
+// Foreign memory lies outside the V8 sandbox and cannot back an ArrayBuffer.
+static bool ZeroCopyUnavailable(Environment* env) {
+#ifdef V8_ENABLE_SANDBOX
+  THROW_ERR_OPERATION_FAILED(
+      env, "Zero-copy views are not available when the V8 sandbox is enabled");
+  return true;
+#else
+  return false;
+#endif
+}
+
 void ToBuffer(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
@@ -556,7 +565,7 @@ void ToBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -580,9 +589,12 @@ void ToBuffer(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
+  bool copy = args.Length() < 3 || args[2]->IsUndefined() ||
+              args[2]->BooleanValue(isolate);
+  if (!copy && ZeroCopyUnavailable(env)) return;
+
   Local<Object> buf;
-  if (args.Length() < 3 || args[2]->IsUndefined() ||
-      args[2]->BooleanValue(isolate)) {
+  if (copy) {
     if (!Buffer::Copy(env, reinterpret_cast<char*>(ptr), len).ToLocal(&buf)) {
       return;
     }
@@ -618,7 +630,7 @@ void ToArrayBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   size_t len;
-  if (args.Length() < 2 || !GetValidatedSize(env, args[1], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[1], "length").To(&len)) {
     return;
   }
 
@@ -642,10 +654,12 @@ void ToArrayBuffer(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  Local<ArrayBuffer> ab;
+  bool copy = args.Length() < 3 || args[2]->IsUndefined() ||
+              args[2]->BooleanValue(isolate);
+  if (!copy && ZeroCopyUnavailable(env)) return;
 
-  if (args.Length() < 3 || args[2]->IsUndefined() ||
-      args[2]->BooleanValue(isolate)) {
+  Local<ArrayBuffer> ab;
+  if (copy) {
     std::unique_ptr<BackingStore> store =
         ArrayBuffer::NewBackingStore(isolate, len);
     memcpy(store->Data(), reinterpret_cast<void*>(ptr), len);
@@ -671,7 +685,8 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   if (args.Length() < 1) {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
@@ -689,18 +704,18 @@ void ExportBytes(const FunctionCallbackInfo<Value>& args) {
   } else {
     THROW_ERR_INVALID_ARG_TYPE(
         env,
-        "The first argument must be a Buffer, ArrayBuffer, or ArrayBufferView");
+        "The first argument must be a Buffer, ArrayBuffer, SharedArrayBuffer, "
+        "or ArrayBufferView");
     return;
   }
 
   uintptr_t ptr;
-  if (args.Length() < 2 ||
-      !GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
+  if (!GetValidatedPointerAddress(env, args[1], "pointer").To(&ptr)) {
     return;
   }
 
   size_t len;
-  if (args.Length() < 3 || !GetValidatedSize(env, args[2], "length").To(&len)) {
+  if (!GetValidatedSize(env, args[2], "length").To(&len)) {
     return;
   }
 
diff --git a/src/histogram.cc b/src/histogram.cc
index 1a852dcf3f88..f2b93d3b8be4 100644
--- a/src/histogram.cc
+++ b/src/histogram.cc
@@ -298,28 +298,29 @@ static double NormalCdf(double x) {
 
 // Student's t-distribution CDF: P(T <= t) for df degrees of freedom.
 static double StudentTCdf(double t, double df) {
-  double x = df / (df + t * t);
-  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
-  if (t >= 0.0) {
-    return 1.0 - 0.5 * ibeta;
+  double squared = t * t;
+  double denominator = df + squared;
+  if (squared < df) {
+    double x = squared / denominator;
+    double ibeta = RegularizedIncompleteBeta(0.5, df / 2.0, x);
+    return t >= 0.0 ? 0.5 + 0.5 * ibeta : 0.5 - 0.5 * ibeta;
   }
-  return 0.5 * ibeta;
+
+  double x = df / denominator;
+  double ibeta = RegularizedIncompleteBeta(df / 2.0, 0.5, x);
+  return t >= 0.0 ? 1.0 - 0.5 * ibeta : 0.5 * ibeta;
 }
 
-// Student's t-distribution quantile (inverse CDF) using bisection.
-// Returns the value t such that P(T <= t) = p.
-static double StudentTQuantile(double p, double df) {
-  if (p <= 0.0) return -std::numeric_limits<double>::infinity();
-  if (p >= 1.0) return std::numeric_limits<double>::infinity();
-  if (p == 0.5) return 0.0;
+// Positive Student's t-distribution quantile for an upper-tail probability.
+// Using the lower tail avoids loss of precision for probabilities near 1.
+static double StudentTUpperQuantile(double p, double df) {
+  double lo = 0.0;
+  double hi = 1.0;
+  while (StudentTCdf(-hi, df) > p) hi *= 2.0;
 
-  // Bisection search. The range [-1e6, 1e6] is sufficient for any
-  // practical confidence level and degrees of freedom.
-  double lo = -1e6;
-  double hi = 1e6;
   for (int i = 0; i < 100; i++) {
     double mid = (lo + hi) / 2.0;
-    if (StudentTCdf(mid, df) < p) {
+    if (StudentTCdf(-mid, df) > p) {
       lo = mid;
     } else {
       hi = mid;
@@ -482,6 +483,30 @@ constexpr uint64_t kEwmaErrorRate = 3;
 constexpr uint64_t kEwmaThreshold = 4;
 }  // namespace
 
+Histogram::MeanCIResult Histogram::MeanCI(double confidence) const {
+  RwLock::ScopedReadLock lock(mutex_);
+  int64_t count = histogram_->total_count;
+  double mean = hdr_mean(histogram_.get());
+  if (count < 2) {
+    double nan = std::numeric_limits<double>::quiet_NaN();
+    return {mean, nan, nan};
+  }
+
+  double stddev = hdr_stddev(histogram_.get());
+  if (stddev == 0.0) return {mean, mean, mean};
+
+  // HdrHistogram computes population stddev (divides by N). The confidence
+  // interval requires sample variance (divides by N-1).
+  double variance = stddev * stddev * static_cast<double>(count) /
+                    static_cast<double>(count - 1);
+  double standard_error = std::sqrt(variance / static_cast<double>(count));
+  double alpha = 1.0 - confidence;
+  double t_crit =
+      StudentTUpperQuantile(alpha / 2.0, static_cast<double>(count - 1));
+  double margin = t_crit * standard_error;
+  return {mean, mean - margin, mean + margin};
+}
+
 Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
                                                 double confidence) const {
   auto do_welch = [&]() -> WelchTestResult {
@@ -517,7 +542,7 @@ Histogram::WelchTestResult Histogram::WelchTest(const Histogram& other,
 
     // Confidence interval on the difference of means.
     double alpha = 1.0 - confidence;
-    double t_crit = StudentTQuantile(1.0 - alpha / 2.0, df);
+    double t_crit = StudentTUpperQuantile(alpha / 2.0, df);
     double margin = t_crit * std::sqrt(se_sum);
     double diff = mean1 - mean2;
 
@@ -1133,6 +1158,7 @@ void HistogramImpl::AddMethods(Isolate* isolate, Local<FunctionTemplate> tmpl) {
   SetProtoMethodNoSideEffect(isolate, tmpl, "percentilesAt", GetPercentilesAt);
   SetProtoMethodNoSideEffect(isolate, tmpl, "linearBuckets", GetLinearBuckets);
   SetProtoMethodNoSideEffect(isolate, tmpl, "logBuckets", GetLogBuckets);
+  SetProtoMethodNoSideEffect(isolate, tmpl, "meanCI", GetMeanCI);
   SetProtoMethodNoSideEffect(isolate, tmpl, "welchTest", GetWelchTest);
   SetProtoMethodNoSideEffect(
       isolate, tmpl, "mannWhitneyTest", GetMannWhitneyTest);
@@ -1187,6 +1213,7 @@ void HistogramImpl::RegisterExternalReferences(
   registry->Register(GetPercentilesAt);
   registry->Register(GetLinearBuckets);
   registry->Register(GetLogBuckets);
+  registry->Register(GetMeanCI);
   registry->Register(GetWelchTest);
   registry->Register(GetMannWhitneyTest);
   registry->Register(GetCohensD);
@@ -1895,6 +1922,21 @@ void HistogramImpl::GetKsTest(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set((*histogram)->KsTest(*(other->histogram())));
 }
 
+void HistogramImpl::GetMeanCI(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
+  CHECK(args[0]->IsNumber());
+  double confidence = args[0].As<Number>()->Value();
+
+  auto result = (*histogram)->MeanCI(confidence);
+
+  Local<Value> values[] = {Number::New(isolate, result.mean),
+                           Number::New(isolate, result.lower),
+                           Number::New(isolate, result.upper)};
+  Local<Array> arr = Array::New(isolate, &values[0], arraysize(values));
+  args.GetReturnValue().Set(arr);
+}
+
 void HistogramImpl::GetWelchTest(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   HistogramImpl* histogram = HistogramImpl::FromJSObject(args.This());
diff --git a/src/histogram.h b/src/histogram.h
index 05d6003c25cc..2af0e4a4f82e 100644
--- a/src/histogram.h
+++ b/src/histogram.h
@@ -80,7 +80,13 @@ class Histogram : public MemoryRetainer {
                      int64_t* values,
                      size_t length) const;
 
-  // Statistical hypothesis testing
+  // Statistical analysis
+  struct MeanCIResult {
+    double mean;
+    double lower;
+    double upper;
+  };
+
   struct WelchTestResult {
     double t_statistic;
     double degrees_of_freedom;
@@ -101,6 +107,7 @@ class Histogram : public MemoryRetainer {
     int64_t upper;
   };
 
+  MeanCIResult MeanCI(double confidence = 0.95) const;
   WelchTestResult WelchTest(const Histogram& other,
                             double confidence = 0.95) const;
   MannWhitneyResult MannWhitneyTest(const Histogram& other) const;
@@ -189,6 +196,7 @@ class HistogramImpl {
   static void GetPercentilesAt(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLinearBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetLogBuckets(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetMeanCI(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetWelchTest(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetMannWhitneyTest(
       const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/src/inspector_agent.cc b/src/inspector_agent.cc
index 4bb34e56bcbf..dcec24c16dba 100644
--- a/src/inspector_agent.cc
+++ b/src/inspector_agent.cc
@@ -808,7 +808,9 @@ class NodeInspectorClient : public V8InspectorClient {
   }
 
   double currentTimeMS() override {
-    return env_->isolate_data()->platform()->CurrentClockTimeMillis();
+    MultiIsolatePlatform* platform = env_->isolate_data()->platform();
+    if (platform == nullptr) return GetCurrentTimeInMicroseconds() / 1000;
+    return platform->CurrentClockTimeMillis();
   }
 
   std::unique_ptr<StringBuffer> resourceNameToUrl(
diff --git a/src/node.cc b/src/node.cc
index e1a8ed517c05..2ae48af4e355 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -49,6 +49,9 @@
 
 #if HAVE_OPENSSL
 #include "ncrypto.h"
+#if OPENSSL_VERSION_MAJOR >= 3
+#include <openssl/provider.h>
+#endif
 #include "node_crypto.h"
 #if OPENSSL_VERSION_MAJOR >= 3 && !defined(CONF_MFLAGS_IGNORE_MISSING_FILE)
 // OpenSSL hides this deprecated macro under OPENSSL_NO_DEPRECATED, but the
@@ -384,6 +387,10 @@ MaybeLocal<Value> StartExecution(Environment* env,
     return StartExecution(env, "internal/main/check_syntax");
   }
 
+  if (env->options()->bench_runner) {
+    return StartExecution(env, "internal/main/bench_runner");
+  }
+
   if (env->options()->test_runner) {
     return StartExecution(env, "internal/main/test_runner");
   }
@@ -1255,15 +1262,36 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     }
     crypto::InstallFipsIndicatorCallback();
 
-    // Ensure CSPRNG is properly seeded.
-    CHECK(ncrypto::CSPRNG(nullptr, 0));
+    // Activating the default provider here keeps --openssl-legacy-provider
+    // working. Its explicit load disables OpenSSL's fallback, and the eager
+    // CSPRNG check used to activate the provider as a side effect. Only
+    // check the seeding when that provider is missing or FIPS is on, so a
+    // configuration without a DRBG still aborts at startup instead of
+    // hanging at the first crypto call. Otherwise the DRBG is instantiated
+    // on first use.
+#if OPENSSL_VERSION_MAJOR >= 3
+    const bool check_csprng = ncrypto::isFipsEnabled() ||
+                              !OSSL_PROVIDER_available(nullptr, "default");
+#else
+    const bool check_csprng = true;
+#endif
+    if (check_csprng) {
+      CHECK(ncrypto::CSPRNG(nullptr, 0));
+    }
 
+    // V8 uses the entropy for hash seeds, ASLR and Math.random(), none of
+    // it cryptographic. Going through OpenSSL would instantiate the DRBG
+    // and build the default provider's algorithm tables on every startup.
+    // V8 falls back to very weak entropy when the source fails, so abort
+    // instead.
     V8::SetEntropySource([](unsigned char* buffer, size_t length) {
-      // V8 falls back to very weak entropy when this function fails
-      // and /dev/urandom isn't available. That wouldn't be so bad if
-      // the entropy was only used for Math.random() but it's also used for
-      // hash table and address space layout randomization. Better to abort.
+#ifdef _AIX
+      // uv_random() reads /dev/random on AIX, which blocks. OpenSSL seeds
+      // from /dev/urandom there.
       CHECK(ncrypto::CSPRNG(buffer, length));
+#else
+      CHECK_EQ(uv_random(nullptr, nullptr, buffer, length, 0, nullptr), 0);
+#endif
       return true;
     });
 #endif  // !defined(OPENSSL_IS_BORINGSSL)
@@ -1290,6 +1318,10 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     cppgc::InitializeProcess(allocator);
   }
 
+  if (flags & ProcessInitializationFlags::kNoHarvestBuiltinCodeCache) {
+    builtins::BuiltinLoader::SetHarvestCodeCache(false);
+  }
+
   if (!(flags & ProcessInitializationFlags::kNoInitializeV8)) {
     V8::Initialize();
 
diff --git a/src/node.h b/src/node.h
index e827a46e14dd..33b85611c0d2 100644
--- a/src/node.h
+++ b/src/node.h
@@ -234,6 +234,11 @@ enum Flags : uint32_t {
   kNoInitializeCppgc = 1 << 13,
   // Initialize the process for predictable snapshot generation.
   kGeneratePredictableSnapshot = 1 << 14,
+  // Do not serialize a code cache for builtins that had to be compiled without
+  // one. By default such caches are kept so that worker threads created later
+  // start faster; an embedder that supplies an EmbedderBuiltinCodeCache or
+  // never creates workers only pays for the serialization.
+  kNoHarvestBuiltinCodeCache = 1 << 15,
 
   // Emulate the behavior of InitializeNodeWithArgs() when passing
   // a flags argument to the InitializeOncePerProcess() replacement
@@ -686,6 +691,43 @@ struct InspectorParentHandle {
   virtual ~InspectorParentHandle() = default;
 };
 
+// Code cache for the built-in JavaScript of Environments that are bootstrapped
+// rather than deserialized from a snapshot; see SetBuiltinCodeCache().
+class NODE_EXTERN EmbedderBuiltinCodeCache {
+ public:
+  struct Entry {
+    std::string id;  // e.g. "internal/bootstrap/node"
+    std::unique_ptr<v8::ScriptCompiler::CachedData> data;
+  };
+  explicit EmbedderBuiltinCodeCache(std::vector<Entry> entries);
+  ~EmbedderBuiltinCodeCache();
+
+  // Compiles every built-in module in `context`, which must come from
+  // NewContext(), and returns their code caches; empty on failure.
+  static std::vector<Entry> Generate(v8::Local<v8::Context> context);
+
+  v8::ScriptCompiler::CachedData::CompatibilityCheckResult CompatibilityCheck(
+      v8::Isolate* isolate) const;
+
+  EmbedderBuiltinCodeCache(const EmbedderBuiltinCodeCache&) = delete;
+  EmbedderBuiltinCodeCache& operator=(const EmbedderBuiltinCodeCache&) = delete;
+
+  struct Impl;
+
+ private:
+  std::unique_ptr<Impl> impl_;
+  friend NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+  SetBuiltinCodeCache(IsolateData*, const EmbedderBuiltinCodeCache*);
+};
+
+// Environments created from `isolate_data` afterwards start with `cache`'s
+// entries (they share its buffers; `cache` itself may be freed after the call);
+// nullptr clears it. Returns the result of `cache->CompatibilityCheck()` and
+// leaves `isolate_data` unchanged unless that is kSuccess.
+NODE_EXTERN v8::ScriptCompiler::CachedData::CompatibilityCheckResult
+SetBuiltinCodeCache(IsolateData* isolate_data,
+                    const EmbedderBuiltinCodeCache* cache);
+
 // TODO(addaleax): Maybe move per-Environment options parsing here.
 // Returns nullptr when the Environment cannot be created e.g. there are
 // pending JavaScript exceptions.
@@ -838,6 +880,9 @@ NODE_EXTERN v8::MaybeLocal<v8::Value> LoadEnvironment(
     const ModuleData* entry_point,
     EmbedderPreloadCallback preload = nullptr);
 
+// Runs `env`'s event loop until its handles have closed, with JavaScript
+// execution disallowed on the isolate; see doc/api/embedding.md if that loop
+// is shared with other Environments.
 NODE_EXTERN void FreeEnvironment(Environment* env);
 
 // Set a callback that is called when process.exit() is called from JS,
diff --git a/src/node_binding.cc b/src/node_binding.cc
index 26f8d046f6da..0437f59ca60e 100644
--- a/src/node_binding.cc
+++ b/src/node_binding.cc
@@ -9,6 +9,20 @@
 #include "util.h"
 
 #include <string>
+#include <vector>
+
+#ifdef _WIN32
+#include <windows.h>
+#else
+#include <fcntl.h>
+#include <unistd.h>
+#include <cerrno>
+#include <cstdlib>
+#if defined(__linux__)
+#include <sys/mman.h>
+#include <sys/syscall.h>
+#endif
+#endif
 
 #if HAVE_OPENSSL
 #define NODE_BUILTIN_OPENSSL_BINDINGS(V) V(crypto) V(tls_wrap)
@@ -438,13 +452,295 @@ inline node_api_addon_get_api_version_func GetNapiAddonGetApiVersionCallback(
       dlib->GetSymbolAddress(STRINGIFY(NODE_API_MODULE_GET_API_VERSION)));
 }
 
-// DLOpen is process.dlopen(module, filename, flags).
-// Used to load 'module.node' dynamically shared objects.
+namespace {
+
+#ifndef _WIN32
+// Write the whole buffer to `fd`, retrying partial writes and EINTR.
+bool WriteAllToFd(int fd, const char* data, size_t len) {
+  size_t off = 0;
+  while (off < len) {
+    ssize_t n = write(fd, data + off, len - off);
+    if (n < 0) {
+      if (errno == EINTR) continue;
+      return false;
+    }
+    off += static_cast<size_t>(n);
+  }
+  return true;
+}
+
+#if defined(__linux__)
+int NodeMemfdCreate(const char* name, unsigned int flags) {
+  return static_cast<int>(syscall(SYS_memfd_create, name, flags));
+}
+#endif  // __linux__
+#endif  // !_WIN32
+
+// Materializes native-addon bytes into a form dlopen()/LoadLibrary() can load,
+// with the smallest, most private on-disk footprint each platform allows:
+//   Linux:        an anonymous in-memory memfd, loaded via /proc/self/fd/N -
+//                 the bytes never touch the filesystem.
+//   other POSIX:  a 0700 mkdtemp() directory plus an O_EXCL|O_NOFOLLOW file,
+//                 unlink()ed right after the load (the mapping keeps it alive).
+//   Windows:      a temp file opened FILE_FLAG_DELETE_ON_CLOSE; its handle is
+//                 retained for the process lifetime so the file is removed
+//                 automatically once the process (and the loaded DLL) exit.
+// Used for an addon that lives somewhere dlopen() cannot open by path, such as
+// a virtual file system.
+class AddonImage {
+ public:
+  AddonImage() = default;
+  ~AddonImage();
+  AddonImage(const AddonImage&) = delete;
+  AddonImage& operator=(const AddonImage&) = delete;
+
+  // The directory a temporary image would be written to, with a trailing
+  // separator; empty when it cannot be determined. Names the resource for the
+  // file-system permission check.
+  static std::string TempDir();
+
+  // On success sets path() to a real, loadable path for `data`.
+  bool Materialize(const char* data, size_t len);
+  const std::string& path() const { return path_; }
+  const std::string& errmsg() const { return errmsg_; }
+
+  // Call exactly once, right after DLib::Open(); `opened` says whether the load
+  // succeeded. Releases the transient resources that are no longer needed (a
+  // successful load holds its own mapping): on POSIX closes the memfd or
+  // unlinks the temp file; on Windows retains the delete-on-close handle for
+  // the process lifetime when opened, or closes it (deleting the file) on
+  // failure.
+  void AfterOpen(bool opened);
+
+ private:
+  std::string path_;
+  std::string errmsg_;
+  bool consumed_ = false;
+#ifdef _WIN32
+  HANDLE handle_ = INVALID_HANDLE_VALUE;
+#else
+  bool MaterializeTempFile(const char* data, size_t len);
+  int fd_ = -1;
+  std::string temp_dir_;  // non-empty only for the temp-file (non-memfd) path
+#endif
+};
+
+#ifdef _WIN32
+
+// Delete-on-close handles kept alive until process exit so their temp files
+// outlive the loaded DLLs and are removed once the process ends.
+Mutex g_retained_addon_handles_mutex;
+std::vector<HANDLE>* g_retained_addon_handles = nullptr;
+
+// static
+std::string AddonImage::TempDir() {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) return std::string();
+  int size = WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, nullptr, 0, nullptr, nullptr);
+  if (size <= 0) return std::string();
+  std::string out(size, '\0');
+  WideCharToMultiByte(
+      CP_UTF8, 0, dir, dir_len, out.data(), size, nullptr, nullptr);
+  return out;
+}
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+  wchar_t dir[MAX_PATH + 1];
+  DWORD dir_len = GetTempPathW(MAX_PATH + 1, dir);
+  if (dir_len == 0 || dir_len > MAX_PATH) {
+    errmsg_ = "could not locate the temporary directory";
+    return false;
+  }
+  wchar_t file[MAX_PATH + 1];
+  if (GetTempFileNameW(dir, L"nod", 0, file) == 0) {
+    errmsg_ = "could not create a temporary file name";
+    return false;
+  }
+  // Reopen the just-created file delete-on-close, sharing delete so the loader
+  // can map it while it is delete-pending; the file is removed when this handle
+  // and the loader's section are both released (i.e. at process exit).
+  handle_ = CreateFileW(file,
+                        GENERIC_READ | GENERIC_WRITE,
+                        FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
+                        nullptr,
+                        CREATE_ALWAYS,
+                        FILE_ATTRIBUTE_TEMPORARY | FILE_FLAG_DELETE_ON_CLOSE,
+                        nullptr);
+  if (handle_ == INVALID_HANDLE_VALUE) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    return false;
+  }
+  size_t off = 0;
+  while (off < len) {
+    DWORD chunk =
+        len - off > MAXDWORD ? MAXDWORD : static_cast<DWORD>(len - off);
+    DWORD written = 0;
+    if (!WriteFile(handle_, data + off, chunk, &written, nullptr)) {
+      errmsg_ = "could not write the native addon to a temporary file";
+      CloseHandle(handle_);
+      handle_ = INVALID_HANDLE_VALUE;
+      return false;
+    }
+    off += written;
+  }
+  int utf8_len =
+      WideCharToMultiByte(CP_UTF8, 0, file, -1, nullptr, 0, nullptr, nullptr);
+  if (utf8_len <= 0) {
+    errmsg_ = "could not encode the temporary file path";
+    CloseHandle(handle_);
+    handle_ = INVALID_HANDLE_VALUE;
+    return false;
+  }
+  path_.resize(utf8_len - 1);
+  WideCharToMultiByte(
+      CP_UTF8, 0, file, -1, path_.data(), utf8_len, nullptr, nullptr);
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  if (handle_ == INVALID_HANDLE_VALUE) return;
+  if (!opened) {
+    CloseHandle(handle_);  // delete-on-close removes the file
+    handle_ = INVALID_HANDLE_VALUE;
+    return;
+  }
+  Mutex::ScopedLock lock(g_retained_addon_handles_mutex);
+  if (g_retained_addon_handles == nullptr) {
+    g_retained_addon_handles = new std::vector<HANDLE>();
+  }
+  g_retained_addon_handles->push_back(handle_);
+  handle_ = INVALID_HANDLE_VALUE;
+}
+
+AddonImage::~AddonImage() {
+  // Materialized but Open() was never reached (e.g. an exception in between):
+  // closing the delete-on-close handle removes the file.
+  if (!consumed_ && handle_ != INVALID_HANDLE_VALUE) CloseHandle(handle_);
+}
+
+#else  // !_WIN32
+
+bool AddonImage::Materialize(const char* data, size_t len) {
+#if defined(__linux__)
+  // Prefer an anonymous in-memory fd, loaded through /proc/self/fd: nothing
+  // reaches the filesystem, so there is no temp file to secure, unlink, or
+  // leak, and no noexec-mount problem. Request an executable memfd (MFD_EXEC,
+  // Linux 6.3+); retry without it on older kernels that reject the flag, then
+  // fall back to a temp file if memfd is unavailable entirely.
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 0x0001U
+#endif
+#ifndef MFD_EXEC
+#define MFD_EXEC 0x0010U
+#endif
+  fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC | MFD_EXEC);
+  if (fd_ == -1 && errno == EINVAL) {
+    fd_ = NodeMemfdCreate("node-addon", MFD_CLOEXEC);
+  }
+  if (fd_ != -1) {
+    if (!WriteAllToFd(fd_, data, len)) {
+      errmsg_ = "could not write the native addon to an in-memory file";
+      close(fd_);
+      fd_ = -1;
+      return false;
+    }
+    path_ = "/proc/self/fd/" + std::to_string(fd_);
+    return true;
+  }
+#endif  // __linux__
+  return MaterializeTempFile(data, len);
+}
+
+// static
+std::string AddonImage::TempDir() {
+  const char* env_tmp = getenv("TMPDIR");
+  std::string tmpdir =
+      (env_tmp != nullptr && *env_tmp != '\0') ? env_tmp : "/tmp";
+  if (tmpdir.back() != '/') tmpdir.push_back('/');
+  return tmpdir;
+}
+
+bool AddonImage::MaterializeTempFile(const char* data, size_t len) {
+  // A private 0700 directory (mkdtemp) so no other user can pre-create the path
+  // as a symlink or swap the file between the write and the load; O_EXCL and
+  // O_NOFOLLOW harden the create against a race inside it.
+  std::string tmpl = TempDir() + "node-addon-XXXXXX";
+  std::vector<char> buf(tmpl.begin(), tmpl.end());
+  buf.push_back('\0');
+  if (mkdtemp(buf.data()) == nullptr) {
+    errmsg_ = "could not create a temporary directory for the native addon";
+    return false;
+  }
+  temp_dir_ = buf.data();
+  std::string file = temp_dir_ + "/addon.node";
+  fd_ = open(
+      file.c_str(), O_WRONLY | O_CREAT | O_EXCL | O_NOFOLLOW | O_CLOEXEC, 0600);
+  if (fd_ == -1) {
+    errmsg_ = "could not create a temporary file for the native addon";
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  if (!WriteAllToFd(fd_, data, len)) {
+    errmsg_ = "could not write the native addon to a temporary file";
+    close(fd_);
+    fd_ = -1;
+    unlink(file.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+    return false;
+  }
+  // dlopen() reopens by path; the post-open mapping keeps the inode alive.
+  close(fd_);
+  fd_ = -1;
+  path_ = file;
+  return true;
+}
+
+void AddonImage::AfterOpen(bool opened) {
+  consumed_ = true;
+  // The right cleanup is the same whether or not the load worked.
+  (void)opened;
+  // memfd: the load's mapping (or nothing, on failure) owns it from here.
+  if (fd_ != -1) {
+    close(fd_);
+    fd_ = -1;
+    return;
+  }
+  if (!temp_dir_.empty()) {
+    // On success the mapping keeps the inode alive, so unlinking now leaves no
+    // on-disk trace; on failure this just cleans up.
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+    temp_dir_.clear();
+  }
+}
+
+AddonImage::~AddonImage() {
+  if (consumed_) return;
+  if (fd_ != -1) close(fd_);
+  if (!temp_dir_.empty()) {
+    unlink(path_.c_str());
+    rmdir(temp_dir_.c_str());
+  }
+}
+
+#endif  // _WIN32
+
+}  // namespace
+
+// Shared by process.dlopen() and the internal dlopenBinary(). `allow_binary`
+// says whether args[3] may carry the addon's bytes; it is false for
+// process.dlopen(), whose signature stays (module, filename[, flags]).
 //
 // FIXME(bnoordhuis) Not multi-context ready. TBD how to resolve the conflict
 // when two contexts try to load the same shared object. Maybe have a shadow
 // cache that's a plain C list or hash table that's shared across contexts?
-void DLOpen(const FunctionCallbackInfo<Value>& args) {
+static void DLOpenImpl(const FunctionCallbackInfo<Value>& args,
+                       bool allow_binary) {
   Environment* env = Environment::GetCurrent(args);
 
   if (env->no_native_addons()) {
@@ -464,7 +760,11 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   }
 
   int32_t flags = DLib::kDefaultFlags;
-  if (args.Length() > 2 && !args[2]->Int32Value(context).To(&flags)) {
+  // On the internal path an undefined flags argument keeps the default, so a
+  // caller can pass the bytes without choosing flags. process.dlopen() keeps
+  // its original behaviour of rejecting any non-integer that is present.
+  if (args.Length() > 2 && !(allow_binary && args[2]->IsUndefined()) &&
+      !args[2]->Int32Value(context).To(&flags)) {
     return THROW_ERR_INVALID_ARG_TYPE(env, "flag argument must be an integer.");
   }
 
@@ -477,12 +777,44 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
     return;  // Exception pending.
   }
 
-  node::Utf8Value filename(env->isolate(), args[1]);  // Cast
-  env->TryLoadAddon(*filename, flags, [&](DLib* dlib) {
+  node::Utf8Value filename(env->isolate(), args[1]);  // The addon's path,
+                                                      // used for diagnostics.
+
+  // On the internal path args[3] carries the addon's bytes, for an addon that
+  // lives somewhere dlopen() cannot open by path (e.g. a virtual file system).
+  // Materialize them into a private, self-cleaning image and load that, while
+  // still reporting `filename` in any error.
+  AddonImage image;
+  const char* load_path = *filename;
+  if (allow_binary && args.Length() > 3 && !args[3]->IsUndefined()) {
+    if (!args[3]->IsArrayBufferView()) {
+      return THROW_ERR_INVALID_ARG_TYPE(
+          env, "binary must be a Buffer, TypedArray, or DataView");
+    }
+    // Loading from bytes materializes them into an image in the temporary
+    // directory, so this needs write access there on top of the addon
+    // permission checked above. The check does not depend on whether the image
+    // actually reaches the file system on this platform (Linux uses an
+    // anonymous memfd): what a program must be granted should not vary by
+    // platform.
+    THROW_IF_INSUFFICIENT_PERMISSIONS(
+        env,
+        permission::PermissionScope::kFileSystemWrite,
+        AddonImage::TempDir());
+    ArrayBufferViewContents<char> binary(args[3]);
+    if (!image.Materialize(binary.data(), binary.length())) {
+      return THROW_ERR_DLOPEN_FAILED(
+          env, "%s: %s", image.errmsg().c_str(), *filename);
+    }
+    load_path = image.path().c_str();
+  }
+
+  env->TryLoadAddon(load_path, flags, [&](DLib* dlib) {
     static Mutex dlib_load_mutex;
     Mutex::ScopedLock lock(dlib_load_mutex);
 
     const bool is_opened = dlib->Open();
+    image.AfterOpen(is_opened);
 
     // Objects containing v14 or later modules will have registered themselves
     // on the pending list.  Activate all of them now.  At present, only one
@@ -582,6 +914,20 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
   // coverity[leaked_storage]
 }
 
+// process.dlopen(module, filename[, flags]). Used to load 'module.node'
+// dynamically shared objects.
+void DLOpen(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, false);
+}
+
+// Internal only, reached through the process_methods binding rather than the
+// process object: dlopenBinary(module, filename, flags, binary) loads an addon
+// from bytes already in memory. Used for addons served by a virtual file
+// system, which the dynamic loader cannot open by path.
+void DLOpenBinary(const FunctionCallbackInfo<Value>& args) {
+  DLOpenImpl(args, true);
+}
+
 inline struct node_module* FindModule(struct node_module* list,
                                       const char* name,
                                       int flag) {
diff --git a/src/node_binding.h b/src/node_binding.h
index b05c68ad0726..c200cc0d0c8a 100644
--- a/src/node_binding.h
+++ b/src/node_binding.h
@@ -168,6 +168,7 @@ void CreateInternalBindingTemplates(IsolateData* isolate_data);
 void GetInternalBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void GetLinkedBinding(const v8::FunctionCallbackInfo<v8::Value>& args);
 void DLOpen(const v8::FunctionCallbackInfo<v8::Value>& args);
+void DLOpenBinary(const v8::FunctionCallbackInfo<v8::Value>& args);
 
 }  // namespace binding
 
diff --git a/src/node_buffer.cc b/src/node_buffer.cc
index a0453800d84a..99fb37ef186b 100644
--- a/src/node_buffer.cc
+++ b/src/node_buffer.cc
@@ -88,7 +88,7 @@ namespace {
 
 class CallbackInfo : public Cleanable {
  public:
-  static inline Local<ArrayBuffer> CreateTrackedArrayBuffer(
+  static inline MaybeLocal<ArrayBuffer> CreateTrackedArrayBuffer(
       Environment* env,
       char* data,
       size_t length,
@@ -114,7 +114,7 @@ class CallbackInfo : public Cleanable {
   Environment* const env_;
 };
 
-Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
+MaybeLocal<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
     Environment* env,
     char* data,
     size_t length,
@@ -124,10 +124,18 @@ Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
   CHECK_IMPLIES(data == nullptr, length == 0);
 
   CallbackInfo* self = new CallbackInfo(env, callback, data, hint);
-  std::unique_ptr<BackingStore> bs =
-      ArrayBuffer::NewBackingStore(data, length, [](void*, size_t, void* arg) {
+  std::unique_ptr<BackingStore> bs = AdoptIntoBackingStore(
+      env->isolate(),
+      data,
+      length,
+      [](void*, size_t, void* arg) {
         static_cast<CallbackInfo*>(arg)->OnBackingStoreFree();
-      }, self);
+      },
+      self);
+  if (!bs) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<ArrayBuffer>();
+  }
   Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(bs));
 
   // V8 simply ignores the BackingStore deleter callback if data == nullptr,
@@ -135,7 +143,7 @@ Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
   if (data == nullptr) {
     ab->Detach(Local<Value>()).Check();
     self->OnBackingStoreFree();  // This calls `callback` asynchronously.
-  } else {
+  } else if (ab->Data() == data) {
     // Store the ArrayBuffer so that we can detach it later.
     self->persistent_.Reset(env->isolate(), ab);
     self->persistent_.SetWeak();
@@ -144,7 +152,6 @@ Local<ArrayBuffer> CallbackInfo::CreateTrackedArrayBuffer(
   return ab;
 }
 
-
 CallbackInfo::CallbackInfo(Environment* env,
                            FreeCallback callback,
                            char* data,
@@ -481,11 +488,13 @@ MaybeLocal<Object> New(Environment* env,
     return Local<Object>();
   }
 
-  Local<ArrayBuffer> ab =
-      CallbackInfo::CreateTrackedArrayBuffer(env, data, length, callback, hint);
-  if (ab->SetPrivate(env->context(),
+  Local<ArrayBuffer> ab;
+  if (!CallbackInfo::CreateTrackedArrayBuffer(env, data, length, callback, hint)
+           .ToLocal(&ab) ||
+      ab->SetPrivate(env->context(),
                      env->untransferable_object_private_symbol(),
-                     True(env->isolate())).IsNothing()) {
+                     True(env->isolate()))
+          .IsNothing()) {
     return Local<Object>();
   }
   MaybeLocal<Uint8Array> maybe_ui = Buffer::New(env, ab, 0, length);
@@ -529,32 +538,24 @@ MaybeLocal<Object> New(Environment* env,
     }
   }
 
-#if defined(V8_ENABLE_SANDBOX)
-  // When v8 sandbox is enabled, external backing stores are not supported
-  // since all arraybuffer allocations are expected to be done by the isolate.
-  // Since this violates the contract of this function, let's free the data and
-  // throw an error.
-  free(data);
-  THROW_ERR_OPERATION_FAILED(
-      env->isolate(),
-      "Wrapping external data is not supported when the v8 sandbox is enabled");
-  return MaybeLocal<Object>();
-#else
   EscapableHandleScope handle_scope(env->isolate());
 
-  auto free_callback = [](void* data, size_t length, void* deleter_data) {
-    free(data);
-  };
-  std::unique_ptr<BackingStore> bs =
-      ArrayBuffer::NewBackingStore(data, length, free_callback, nullptr);
-
+  std::unique_ptr<BackingStore> bs = AdoptIntoBackingStore(
+      env->isolate(),
+      data,
+      length,
+      [](void* data, size_t, void*) { free(data); },
+      nullptr);
+  if (!bs) {
+    THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
+    return MaybeLocal<Object>();
+  }
   Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(bs));
 
   Local<Object> obj;
   if (Buffer::New(env, ab, 0, length).ToLocal(&obj))
     return handle_scope.Escape(obj);
   return Local<Object>();
-#endif
 }
 
 namespace {
@@ -1608,11 +1609,7 @@ inline size_t CheckNumberToSize(Local<Value> number) {
   // See v8::internal::TryNumberToSize on this (and on < comparison)
   double maxSize = static_cast<double>(std::numeric_limits<size_t>::max());
   CHECK(value >= 0 && value < maxSize);
-  size_t size = static_cast<size_t>(value);
-#ifdef V8_ENABLE_SANDBOX
-  CHECK_LE(size, kMaxSafeBufferSizeForSandbox);
-#endif
-  return size;
+  return static_cast<size_t>(value);
 }
 
 // Allocates an ArrayBuffer of `size` bytes. Its contents are left
@@ -1661,9 +1658,9 @@ void CreateUnsafeArrayBuffer(const FunctionCallbackInfo<Value>& args) {
 // Returns the offset of the first byte of `arrayBuffer` that is located at a
 // memory address which is a multiple of `alignment`. V8 does not let us choose
 // the address of a backing store, so an aligned view is obtained by
-// over-allocating `alignment - 1` bytes and skipping to that offset. The
-// backing store of a non-resizable ArrayBuffer never moves, so the offset stays
-// aligned for the lifetime of the ArrayBuffer.
+// over-allocating and skipping to that offset. The backing store of a
+// non-resizable ArrayBuffer never moves, so the offset stays aligned for the
+// lifetime of the ArrayBuffer.
 void ArrayBufferAlignedOffset(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   CHECK_EQ(args.Length(), 2);
diff --git a/src/node_buffer.h b/src/node_buffer.h
index 81ed9481db65..d5a111ede004 100644
--- a/src/node_buffer.h
+++ b/src/node_buffer.h
@@ -53,14 +53,16 @@ NODE_EXTERN v8::MaybeLocal<v8::Object> New(v8::Isolate* isolate,
                                            v8::Local<v8::String> string,
                                            enum encoding enc = UTF8);
 
-// public constructor - data is used, callback is passed data on object gc
+// public constructor - data is used, callback is passed data on object gc.
+// If V8 is built with its sandbox, data is copied instead and callback runs
+// on the next turn of the event loop.
 NODE_EXTERN v8::MaybeLocal<v8::Object> New(v8::Isolate* isolate,
                                            char* data,
                                            size_t length,
                                            FreeCallback callback,
                                            void* hint);
 
-// public constructor - data is used.
+// public constructor - data is used, or copied and freed under the V8 sandbox.
 NODE_EXTERN v8::MaybeLocal<v8::Object> New(v8::Isolate* isolate,
                                            char* data,
                                            size_t len);
diff --git a/src/node_builtins.cc b/src/node_builtins.cc
index 43a9a388c2ba..2cefc8d74e1a 100644
--- a/src/node_builtins.cc
+++ b/src/node_builtins.cc
@@ -1,4 +1,6 @@
 #include "node_builtins.h"
+#include <atomic>
+#include <cstring>
 #include "debug_utils-inl.h"
 #include "env-inl.h"
 #include "module_wrap.h"
@@ -12,7 +14,6 @@
 #include "v8-value.h"
 
 namespace node {
-namespace builtins {
 
 using loader::HostDefinedOptions;
 using v8::Boolean;
@@ -44,6 +45,16 @@ using v8::TryCatch;
 using v8::Undefined;
 using v8::Value;
 
+namespace builtins {
+
+namespace {
+std::atomic<bool> harvest_code_cache{true};
+}  // namespace
+
+void BuiltinLoader::SetHarvestCodeCache(bool on) {
+  harvest_code_cache = on;
+}
+
 BuiltinLoader::BuiltinLoader()
     : config_(GetConfig()), code_cache_(std::make_shared<BuiltinCodeCache>()) {
   LoadJavaScriptSource();
@@ -422,6 +433,7 @@ MaybeLocal<Data> BuiltinLoader::LookupAndCompile(
   }
 
   if (result == Result::kWithoutCache && optional_realm != nullptr &&
+      harvest_code_cache &&
       !optional_realm->env()->isolate_data()->is_building_snapshot()) {
     // We failed to accept this cache, maybe because it was rejected, maybe
     // because it wasn't present. Either way, we'll attempt to replace this
@@ -593,12 +605,13 @@ bool BuiltinLoader::CompileAllBuiltinsAndCopyCodeCache(
 
 void BuiltinLoader::RefreshCodeCache(const std::vector<CodeCacheInfo>& in) {
   RwLock::ScopedLock lock(code_cache_->mutex);
-  code_cache_->map.reserve(in.size());
-  DCHECK(code_cache_->map.empty());
+  // May be called more than once, e.g. first with the code cache carried by
+  // the snapshot and then by an embedder with caches it built for additional
+  // (or the same) builtin ids against this isolate: merge, and let the entry
+  // supplied last win for an id present in both.
+  code_cache_->map.reserve(code_cache_->map.size() + in.size());
   for (auto const& [id, data] : in) {
-    auto result = code_cache_->map.emplace(id, data);
-    USE(result.second);
-    DCHECK(result.second);
+    code_cache_->map.insert_or_assign(id, data);
   }
   code_cache_->has_code_cache = true;
 }
@@ -918,6 +931,76 @@ void BuiltinLoader::RegisterExternalReferences(
 }
 
 }  // namespace builtins
+
+struct EmbedderBuiltinCodeCache::Impl {
+  std::vector<builtins::CodeCacheInfo> entries;
+};
+
+EmbedderBuiltinCodeCache::EmbedderBuiltinCodeCache(std::vector<Entry> entries)
+    : impl_(std::make_unique<Impl>()) {
+  impl_->entries.reserve(entries.size());
+  for (Entry& e : entries) {
+    impl_->entries.push_back(
+        {std::move(e.id),
+         builtins::BuiltinCodeCacheData(
+             std::shared_ptr<ScriptCompiler::CachedData>(std::move(e.data)))});
+  }
+}
+
+EmbedderBuiltinCodeCache::~EmbedderBuiltinCodeCache() = default;
+
+ScriptCompiler::CachedData::CompatibilityCheckResult
+EmbedderBuiltinCodeCache::CompatibilityCheck(Isolate* isolate) const {
+  for (const builtins::CodeCacheInfo& info : impl_->entries) {
+    ScriptCompiler::CachedData probe(
+        info.data.data,
+        static_cast<int>(info.data.length),
+        ScriptCompiler::CachedData::BufferNotOwned);
+    auto result = probe.CompatibilityCheck(isolate);
+    if (result != ScriptCompiler::CachedData::kSuccess) return result;
+  }
+  return ScriptCompiler::CachedData::kSuccess;
+}
+
+std::vector<EmbedderBuiltinCodeCache::Entry> EmbedderBuiltinCodeCache::Generate(
+    Local<Context> context) {
+  std::vector<Entry> out;
+  builtins::BuiltinLoader loader;
+  loader.SetEagerCompile();
+  std::vector<builtins::CodeCacheInfo> infos;
+  if (!loader.CompileAllBuiltinsAndCopyCodeCache(context, {}, &infos)) {
+    return out;
+  }
+  out.reserve(infos.size());
+  for (const builtins::CodeCacheInfo& info : infos) {
+    uint8_t* copy = new uint8_t[info.data.length];
+    memcpy(copy, info.data.data, info.data.length);
+    out.push_back({info.id,
+                   std::make_unique<ScriptCompiler::CachedData>(
+                       copy,
+                       static_cast<int>(info.data.length),
+                       ScriptCompiler::CachedData::BufferOwned)});
+  }
+  return out;
+}
+
+ScriptCompiler::CachedData::CompatibilityCheckResult SetBuiltinCodeCache(
+    IsolateData* isolate_data, const EmbedderBuiltinCodeCache* cache) {
+  if (cache == nullptr) {
+    isolate_data->set_builtin_code_cache({});
+    return ScriptCompiler::CachedData::kSuccess;
+  }
+  auto check = cache->CompatibilityCheck(isolate_data->isolate());
+  if (check == ScriptCompiler::CachedData::kSuccess) {
+    isolate_data->set_builtin_code_cache(cache->impl_->entries);
+  } else {
+    per_process::Debug(DebugCategory::CODE_CACHE,
+                       "EmbedderBuiltinCodeCache rejected: %d\n",
+                       static_cast<int>(check));
+  }
+  return check;
+}
+
 }  // namespace node
 
 NODE_BINDING_PER_ISOLATE_INIT(
diff --git a/src/node_builtins.h b/src/node_builtins.h
index b51b85ff6f23..89fe7f5c1aa7 100644
--- a/src/node_builtins.h
+++ b/src/node_builtins.h
@@ -125,8 +125,16 @@ class NODE_EXTERN_PRIVATE BuiltinLoader {
       v8::Local<v8::Context> context,
       const std::vector<std::string>& lazy_builtins,
       std::vector<CodeCacheInfo>* out);
+  // Adds the given code cache entries, replacing existing entries with the
+  // same id. Can be called more than once (e.g. with the snapshot's code cache
+  // and then with caches an embedder built for further builtin ids).
   void RefreshCodeCache(const std::vector<CodeCacheInfo>& in);
 
+  // Whether builtins compiled without a cache serialize one for later
+  // consumers (worker threads copy it). See
+  // ProcessInitializationFlags::kNoHarvestBuiltinCodeCache.
+  static void SetHarvestCodeCache(bool on);
+
   void CopySourceAndCodeCacheReferenceFrom(const BuiltinLoader* other);
 
   [[nodiscard]] std::ranges::keys_view<
diff --git a/src/node_config_file.cc b/src/node_config_file.cc
index 68c13ad881fc..73d2342d81f1 100644
--- a/src/node_config_file.cc
+++ b/src/node_config_file.cc
@@ -451,7 +451,7 @@ ParseResult ConfigReader::ParseConfigObject(
     }
   }
 
-  // Add implicit flags for namespaces (--test, --permission, --watch)
+  // Add implicit flags for namespaces (--bench, --test, --permission, --watch)
   // These flags are automatically enabled when their namespace is present
   for (const auto& ns : namespaces_with_implicit_flags) {
     std::string flag = "--" + ns;
diff --git a/src/node_file.cc b/src/node_file.cc
index 8a09b656e5a1..0179ad12c9d8 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -64,6 +64,8 @@ namespace node {
 namespace fs {
 
 using v8::Array;
+using v8::ArrayBuffer;
+using v8::ArrayBufferView;
 using v8::BigInt;
 using v8::Context;
 using v8::EscapableHandleScope;
@@ -86,6 +88,8 @@ using v8::ObjectTemplate;
 using v8::Promise;
 using v8::String;
 using v8::TryCatch;
+using v8::Uint32Array;
+using v8::Uint8Array;
 using v8::Undefined;
 using v8::Value;
 
@@ -1759,6 +1763,41 @@ static void RMDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+#ifdef _WIN32
+static void ClearReadOnlyAttributeWHelper(const wchar_t* path) {
+  DWORD attrs = GetFileAttributesW(path);
+  if (attrs != INVALID_FILE_ATTRIBUTES && (attrs & FILE_ATTRIBUTE_READONLY)) {
+    SetFileAttributesW(path, attrs & ~FILE_ATTRIBUTE_READONLY);
+  }
+}
+
+static void ClearReadOnlyAttributeW(const std::filesystem::path& path,
+                                    bool recursive) {
+  std::error_code ec;
+  auto file_status = std::filesystem::symlink_status(path, ec);
+  if (ec) return;
+
+  if (recursive &&
+      file_status.type() == std::filesystem::file_type::directory) {
+    for (const auto& entry : std::filesystem::recursive_directory_iterator(
+             path,
+             std::filesystem::directory_options::skip_permission_denied,
+             ec)) {
+      std::error_code entry_ec;
+      auto entry_status = entry.symlink_status(entry_ec);
+      if (entry_ec) continue;
+      if (entry_status.type() != std::filesystem::file_type::symlink) {
+        ClearReadOnlyAttributeWHelper(entry.path().c_str());
+      }
+    }
+  }
+
+  if (file_status.type() != std::filesystem::file_type::symlink) {
+    ClearReadOnlyAttributeWHelper(path.c_str());
+  }
+}
+#endif
+
 static void RmSync(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
@@ -1806,6 +1845,9 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
   };
 
   int i = 1;
+#ifdef _WIN32
+  bool cleared_readonly = false;
+#endif
 
   while (maxRetries >= 0) {
     if (recursive) {
@@ -1814,6 +1856,22 @@ static void RmSync(const FunctionCallbackInfo<Value>& args) {
       std::filesystem::remove(file_path, error);
     }
 
+#ifdef _WIN32
+    // On Windows, libc++ does not clear the read-only attribute before
+    // removing a file (unlike MSVC STL which does). Attempt to clear it
+    // manually when we get EPERM (operation_not_permitted) so that read-only
+    // files can be deleted, matching the behavior of official Node.js builds.
+    if (error == std::errc::operation_not_permitted && !cleared_readonly) {
+      cleared_readonly = true;
+      ClearReadOnlyAttributeW(file_path, recursive);
+      if (recursive) {
+        std::filesystem::remove_all(file_path, error);
+      } else {
+        std::filesystem::remove(file_path, error);
+      }
+    }
+#endif  // _WIN32
+
     if (!error || error == std::errc::no_such_file_or_directory) {
       return;
     } else if (!can_omit_error(error)) {
@@ -2258,6 +2316,486 @@ static void ReadDir(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+namespace {
+
+// Recursive readdir.
+//
+// The result is breadth-first: every entry of the root, then every entry of
+// the first subdirectory, and so on, each directory's entries in the order
+// uv_fs_scandir() reports them. Symbolic links to directories are followed,
+// see https://github.com/nodejs/node/issues/52663.
+//
+// The tree is walked by one or more threads that share a queue of
+// directories, and the breadth-first order is derived from the tree
+// afterwards, so it does not depend on which thread scanned what. The walk
+// does not touch the Environment; lib does not use it when the permission
+// model is enabled, as every directory would need a check on the main thread.
+
+// Maps an st_mode to the uv_dirent_type_t that uv_fs_scandir would report.
+uv_dirent_type_t DirentTypeFromMode(uint64_t mode) {
+  switch (mode & S_IFMT) {
+    case S_IFREG:
+      return UV_DIRENT_FILE;
+    case S_IFDIR:
+      return UV_DIRENT_DIR;
+    case S_IFLNK:
+      return UV_DIRENT_LINK;
+    case S_IFCHR:
+      return UV_DIRENT_CHAR;
+#ifdef S_IFIFO
+    case S_IFIFO:
+      return UV_DIRENT_FIFO;
+#endif
+#ifdef S_IFSOCK
+    case S_IFSOCK:
+      return UV_DIRENT_SOCKET;
+#endif
+#ifdef S_IFBLK
+    case S_IFBLK:
+      return UV_DIRENT_BLOCK;
+#endif
+    default:
+      return UV_DIRENT_UNKNOWN;
+  }
+}
+
+// Appends `name` to `path`, with a separator unless `path` already ends in
+// one (so that a root of "dir/" does not turn into "dir//name").
+void AppendPathComponent(std::string* path, std::string_view name) {
+  if (name.empty()) return;
+  if (!path->empty()) {
+#ifdef _WIN32
+    const bool has_separator = path->back() == '\\' || path->back() == '/';
+    if (!has_separator) *path += '\\';
+#else
+    const bool has_separator = path->back() == '/';
+    if (!has_separator) *path += '/';
+#endif
+  }
+  path->append(name);
+}
+
+struct ReadDirEntry {
+  // Offset and length of the name within ScannedDirectory::names.
+  uint32_t name_offset;
+  uint32_t name_length;
+  uint8_t type;  // A uv_dirent_type_t.
+  // Whether the walk descends into this entry (a directory, or a symbolic
+  // link to one).
+  bool is_dir = false;
+};
+
+// One directory of the tree.
+struct ScannedDirectory {
+  explicit ScannedDirectory(std::string relative)
+      : relative(std::move(relative)) {}
+
+  std::string_view name(const ReadDirEntry& entry) const {
+    return std::string_view(names).substr(entry.name_offset, entry.name_length);
+  }
+
+  // Path relative to the root; empty for the root itself.
+  const std::string relative;
+  // The entry names, concatenated.
+  std::string names;
+  std::vector<ReadDirEntry> entries;
+  // Indices (into RecursiveReadDir::dirs()) of the subdirectories, in entry
+  // order.
+  std::vector<uint32_t> subdirs;
+};
+
+class RecursiveReadDir {
+ public:
+  explicit RecursiveReadDir(std::string root) : root_(std::move(root)) {
+    dirs_.push_back(std::make_unique<ScannedDirectory>(""));
+  }
+
+  // Scans directories until none are left or an error occurred. May be
+  // called from several threads at once, which then share the work.
+  void Run();
+  void RunWithHelpers(int max_helpers);
+
+  // The following are only valid once every Run() has returned.
+
+  // 0 or a uv error code; error_path() is then the directory that failed.
+  int error() const { return error_; }
+  const std::string& error_path() const { return error_path_; }
+
+  const std::vector<std::unique_ptr<ScannedDirectory>>& dirs() const {
+    return dirs_;
+  }
+
+  // The indices of dirs() in breadth-first order.
+  std::vector<uint32_t> BreadthFirstOrder() const {
+    std::vector<uint32_t> order;
+    order.reserve(dirs_.size());
+    order.push_back(0);
+    for (size_t i = 0; i < order.size(); i++) {
+      for (uint32_t subdir : dirs_[order[i]]->subdirs) order.push_back(subdir);
+    }
+    return order;
+  }
+
+ private:
+  // Reads the directory at `path` into `dir`, resolving the type of entries
+  // where needed, and creates the ScannedDirectory of each subdirectory.
+  static int Scan(const std::string& path,
+                  ScannedDirectory* dir,
+                  std::vector<std::unique_ptr<ScannedDirectory>>* subdirs);
+
+  // Called with the lock held.
+  void MaybeStartHelper();
+
+  // The number of entries a walk has to have seen, with directories still
+  // to scan, before RunWithHelpers() starts a helper thread.
+  static constexpr size_t kHelperThreshold = 1024;
+
+  const std::string root_;
+
+  Mutex mutex_;
+  ConditionVariable cv_;
+  // Directories in the order they were found; the first next_ have been or
+  // are being scanned by one of the active_ threads.
+  std::vector<std::unique_ptr<ScannedDirectory>> dirs_;
+  size_t next_ = 0;
+  size_t active_ = 0;
+  size_t entries_seen_ = 0;
+  int error_ = 0;
+  std::string error_path_;
+  size_t max_helpers_ = 0;
+  std::vector<uv_thread_t> helpers_;
+};
+
+void RecursiveReadDir::RunWithHelpers(int max_helpers) {
+  max_helpers_ = max_helpers;
+  Run();
+  for (uv_thread_t& helper : helpers_) CHECK_EQ(uv_thread_join(&helper), 0);
+}
+
+void RecursiveReadDir::Run() {
+  std::vector<std::unique_ptr<ScannedDirectory>> subdirs;
+  std::string path;
+  Mutex::ScopedLock lock(mutex_);
+  for (;;) {
+    while (next_ == dirs_.size() && active_ > 0 && error_ == 0) {
+      cv_.Wait(lock);
+    }
+    if (next_ == dirs_.size() || error_ != 0) return;
+
+    ScannedDirectory* dir = dirs_[next_++].get();
+    active_++;
+    int r;
+    {
+      Mutex::ScopedUnlock unlock(lock);
+      path = root_;
+      AppendPathComponent(&path, dir->relative);
+      r = Scan(path, dir, &subdirs);
+    }
+    active_--;
+
+    if (r != 0) {
+      if (error_ == 0) {
+        error_ = r;
+        error_path_ = std::move(path);
+      }
+    } else {
+      for (std::unique_ptr<ScannedDirectory>& subdir : subdirs) {
+        dir->subdirs.push_back(static_cast<uint32_t>(dirs_.size()));
+        dirs_.push_back(std::move(subdir));
+      }
+      entries_seen_ += dir->entries.size();
+    }
+    // Wake the others if there is new work, or nothing left to wait for.
+    if (!subdirs.empty() || active_ == 0 || error_ != 0) cv_.Broadcast(lock);
+    subdirs.clear();
+    MaybeStartHelper();
+  }
+}
+
+void RecursiveReadDir::MaybeStartHelper() {
+  if (helpers_.size() >= max_helpers_ || entries_seen_ < kHelperThreshold ||
+      dirs_.size() - next_ < 2) {
+    return;
+  }
+  uv_thread_t helper;
+  int r = uv_thread_create(
+      &helper,
+      [](void* arg) { static_cast<RecursiveReadDir*>(arg)->Run(); },
+      this);
+  if (r == 0) {
+    helpers_.push_back(helper);
+  } else {
+    max_helpers_ = 0;  // Carry on alone.
+  }
+}
+
+int RecursiveReadDir::Scan(
+    const std::string& path,
+    ScannedDirectory* dir,
+    std::vector<std::unique_ptr<ScannedDirectory>>* subdirs) {
+  uv_fs_t req;
+  int r = uv_fs_scandir(nullptr, &req, path.c_str(), 0, nullptr);
+  if (r >= 0) {
+    dir->entries.reserve(r);
+    uv_dirent_t ent;
+    while ((r = uv_fs_scandir_next(&req, &ent)) == 0) {
+      const size_t length = strlen(ent.name);
+      dir->entries.push_back({static_cast<uint32_t>(dir->names.size()),
+                              static_cast<uint32_t>(length),
+                              static_cast<uint8_t>(ent.type)});
+      dir->names.append(ent.name, length);
+    }
+    if (r == UV_EOF) r = 0;
+  }
+  uv_fs_req_cleanup(&req);
+  if (r != 0) return r;
+
+  std::string child;
+  for (ReadDirEntry& entry : dir->entries) {
+    const std::string_view name = dir->name(entry);
+    if (entry.type == UV_DIRENT_UNKNOWN || entry.type == UV_DIRENT_LINK) {
+      // The file system did not report a type, or the entry is a symbolic
+      // link that may point at a directory.
+      child = path;
+      AppendPathComponent(&child, name);
+      if (entry.type == UV_DIRENT_UNKNOWN) {
+        if (uv_fs_lstat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.type = DirentTypeFromMode(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+      if (entry.type == UV_DIRENT_LINK) {
+        if (uv_fs_stat(nullptr, &req, child.c_str(), nullptr) == 0) {
+          entry.is_dir = S_ISDIR(req.statbuf.st_mode);
+        }
+        uv_fs_req_cleanup(&req);
+      }
+    }
+    if (entry.type == UV_DIRENT_DIR) entry.is_dir = true;
+
+    if (entry.is_dir) {
+      std::string relative = dir->relative;
+      AppendPathComponent(&relative, name);
+      subdirs->push_back(
+          std::make_unique<ScannedDirectory>(std::move(relative)));
+    }
+  }
+  return 0;
+}
+
+// Without file types the result is an array of paths relative to the root.
+// With file types it is [names, types, counts, dirs]: `types` is a
+// Uint8Array with the uv_dirent_type_t of every entry, `dirs` the relative
+// path of every directory in the order their entries appear, and `counts` a
+// Uint32Array with the number of entries in each of those directories. See
+// getRecursiveDirents() in lib/internal/fs/utils.js.
+MaybeLocal<Value> MarshalRecursiveReadDir(Isolate* isolate,
+                                          const RecursiveReadDir& walk,
+                                          enum encoding encoding,
+                                          bool with_types) {
+  EscapableHandleScope scope(isolate);
+  const std::vector<uint32_t> order = walk.BreadthFirstOrder();
+
+  LocalVector<Value> names(isolate);
+  LocalVector<Value> dirs(isolate);
+  std::vector<uint8_t> types;
+  std::vector<uint32_t> counts;
+  std::string path;
+  for (uint32_t index : order) {
+    const ScannedDirectory& dir = *walk.dirs()[index];
+    for (const ReadDirEntry& entry : dir.entries) {
+      std::string_view data = dir.name(entry);
+      if (!with_types) {
+        path = dir.relative;
+        AppendPathComponent(&path, data);
+        data = path;
+      }
+      Local<Value> name;
+      if (!StringBytes::Encode(isolate, data.data(), data.size(), encoding)
+               .ToLocal(&name)) {
+        return MaybeLocal<Value>();
+      }
+      names.push_back(name);
+      types.push_back(entry.type);
+    }
+    if (!with_types) continue;
+    counts.push_back(static_cast<uint32_t>(dir.entries.size()));
+    Local<Value> relative;
+    if (!StringBytes::Encode(
+             isolate, dir.relative.data(), dir.relative.size(), encoding)
+             .ToLocal(&relative)) {
+      return MaybeLocal<Value>();
+    }
+    dirs.push_back(relative);
+  }
+
+  if (!with_types) {
+    return scope.Escape(Array::New(isolate, names.data(), names.size()));
+  }
+
+  // One ArrayBuffer holding the types, then (4-byte aligned) the counts.
+  const size_t counts_offset = (types.size() + 3) & ~static_cast<size_t>(3);
+  Local<ArrayBuffer> ab = ArrayBuffer::New(
+      isolate, counts_offset + counts.size() * sizeof(uint32_t));
+  char* bytes = static_cast<char*>(ab->Data());
+  memcpy(bytes, types.data(), types.size());
+  memcpy(
+      bytes + counts_offset, counts.data(), counts.size() * sizeof(uint32_t));
+
+  Local<Value> parts[] = {
+      Array::New(isolate, names.data(), names.size()),
+      Uint8Array::New(ab, 0, types.size()),
+      Uint32Array::New(ab, counts_offset, counts.size()),
+      Array::New(isolate, dirs.data(), dirs.size()),
+  };
+  return scope.Escape(Array::New(isolate, parts, arraysize(parts)));
+}
+
+// The number of thread pool work items that share an asynchronous walk, and
+// the number of helper threads a synchronous walk may start.
+constexpr int kReadDirRecursiveWorkers = 4;
+constexpr int kReadDirRecursiveSyncHelpers = kReadDirRecursiveWorkers - 1;
+
+// An asynchronous recursive readdir: the walk, and the request it settles
+// once every worker has finished.
+class ReadDirRecursiveRequest {
+ public:
+  ReadDirRecursiveRequest(Environment* env,
+                          FSReqBase* req_wrap,
+                          std::string path,
+                          enum encoding encoding,
+                          bool with_types,
+                          int workers)
+      : env_(env),
+        req_wrap_(req_wrap),
+        walk_(std::move(path)),
+        encoding_(encoding),
+        with_types_(with_types),
+        pending_(workers) {}
+
+  RecursiveReadDir* walk() { return &walk_; }
+
+  // Called on the main thread when a worker is done.
+  void OnWorkerDone(int status) {
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED) cancelled_ = true;
+    if (--pending_ > 0) return;
+
+    Isolate* isolate = env_->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env_->context());
+
+    // Release the request even if the environment is shutting down.
+    BaseObjectPtr<FSReqBase> req_wrap = std::move(req_wrap_);
+    req_wrap->Detach();
+
+    FS_ASYNC_TRACE_END1(UV_FS_SCANDIR, req_wrap.get(), "result", walk_.error())
+    if (cancelled_ || !env_->can_call_into_js()) return;
+
+    if (walk_.error() != 0) {
+      return req_wrap->Reject(UVException(isolate,
+                                          walk_.error(),
+                                          "scandir",
+                                          nullptr,
+                                          walk_.error_path().c_str()));
+    }
+
+    Local<Value> value;
+    TryCatch try_catch(isolate);
+    if (!MarshalRecursiveReadDir(isolate, walk_, encoding_, with_types_)
+             .ToLocal(&value)) {
+      CHECK(try_catch.CanContinue());
+      return req_wrap->Reject(try_catch.Exception());
+    }
+    req_wrap->Resolve(value);
+  }
+
+ private:
+  Environment* const env_;
+  BaseObjectPtr<FSReqBase> req_wrap_;
+  RecursiveReadDir walk_;
+  const enum encoding encoding_;
+  const bool with_types_;
+  int pending_;
+  bool cancelled_ = false;
+};
+
+class ReadDirRecursiveWork final : public ThreadPoolWork {
+ public:
+  ReadDirRecursiveWork(Environment* env,
+                       std::shared_ptr<ReadDirRecursiveRequest> request)
+      : ThreadPoolWork(env, "readdir_recursive"),
+        request_(std::move(request)) {}
+
+  void DoThreadPoolWork() override { request_->walk()->Run(); }
+
+  void AfterThreadPoolWork(int status) override {
+    std::unique_ptr<ReadDirRecursiveWork> self(this);
+    request_->OnWorkerDone(status);
+  }
+
+ private:
+  std::shared_ptr<ReadDirRecursiveRequest> request_;
+};
+
+}  // namespace
+
+// readdirRecursive(path, encoding, withTypes[, req])
+static void ReadDirRecursive(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  const int argc = args.Length();
+  CHECK_GE(argc, 3);
+
+  BufferValue path(isolate, args[0]);
+  CHECK_NOT_NULL(*path);
+  ToNamespacedPath(env, &path);
+
+  const enum encoding encoding = ParseEncoding(isolate, args[1], UTF8);
+
+  bool with_types = args[2]->IsTrue();
+
+  // Every directory would need a permission check, and only the main thread
+  // can do those: lib walks the tree in JS when the permission model is on.
+  CHECK(!env->permission()->enabled());
+
+  if (argc > 3) {  // readdirRecursive(path, encoding, withTypes, req)
+    FSReqBase* req_wrap_async = GetReqWrap(args, 3);
+    CHECK_NOT_NULL(req_wrap_async);
+    req_wrap_async->Init("scandir", nullptr, 0, encoding);
+    FS_ASYNC_TRACE_BEGIN1(
+        UV_FS_SCANDIR, req_wrap_async, "path", TRACE_STR_COPY(*path))
+    auto request =
+        std::make_shared<ReadDirRecursiveRequest>(env,
+                                                  req_wrap_async,
+                                                  path.ToString(),
+                                                  encoding,
+                                                  with_types,
+                                                  kReadDirRecursiveWorkers);
+    for (int i = 0; i < kReadDirRecursiveWorkers; i++) {
+      (new ReadDirRecursiveWork(env, request))->ScheduleWork();
+    }
+  } else {  // readdirRecursive(path, encoding, withTypes)
+    env->PrintSyncTrace();
+    FS_SYNC_TRACE_BEGIN(readdir);
+    RecursiveReadDir walk(path.ToString());
+    walk.RunWithHelpers(kReadDirRecursiveSyncHelpers);
+    FS_SYNC_TRACE_END(readdir);
+
+    if (walk.error() != 0) {
+      return env->ThrowUVException(
+          walk.error(), "scandir", nullptr, walk.error_path().c_str());
+    }
+
+    Local<Value> value;
+    if (MarshalRecursiveReadDir(isolate, walk, encoding, with_types)
+            .ToLocal(&value)) {
+      args.GetReturnValue().Set(value);
+    }
+  }
+}
+
 static inline Maybe<void> AsyncCheckOpenPermissions(Environment* env,
                                                     FSReqBase* req_wrap,
                                                     const BufferValue& path,
@@ -3220,6 +3758,7 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   SET_SELF_SIZE(ReadFileJob)
 
  private:
+  friend class WriteFileJob;
   static constexpr size_t kUnknownSizeChunk = 64 * 1024;
   static constexpr size_t kMaxReadChunk = 256 * 1024 * 1024;
 
@@ -3303,6 +3842,162 @@ class ReadFileJob final : public AsyncWrap, public ThreadPoolWork {
   int fd_ = -1;
 };
 
+// Writes a whole buffer to a file in ONE thread pool round trip -- open +
+// write (until everything is written) + close -- for fs.writeFile() and
+// fs.promises.writeFile() with a path, which otherwise pay one round trip per
+// step.
+//
+// JS: const job = new WriteFileJob(path, flags, mode, buffer);
+//     job.ondone = (err) => {...}; job.run(path);
+// `err` carries the syscall that failed ('open', 'write' or 'close'); the file
+// descriptor opened here is always closed.
+class WriteFileJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_GE(args.Length(), 4);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    CHECK(args[1]->IsInt32());
+    CHECK(args[2]->IsInt32());
+    CHECK(args[3]->IsArrayBufferView());
+    new WriteFileJob(env,
+                     args.This(),
+                     path.ToString(),
+                     args[1].As<Int32>()->Value(),
+                     args[2].As<Int32>()->Value(),
+                     args[3].As<ArrayBufferView>());
+  }
+
+  // Returns undefined when the job was scheduled, or the ERR_ACCESS_DENIED
+  // error the asynchronous open() would have delivered (nothing is scheduled).
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    WriteFileJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    Environment* env = job->AsyncWrap::env();
+    CHECK(!job->scheduled_);
+    BufferValue path(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*path);
+    ToNamespacedPath(env, &path);
+    Local<Value> access_error;
+    if (ReadFileJob::OpenPermissionError(env, path, job->flags_)
+            .ToLocal(&access_error)) {
+      args.GetReturnValue().Set(access_error);
+      return;
+    }
+    job->scheduled_ = true;
+    job->ClearWeak();
+    FS_ASYNC_TRACE_BEGIN0(UV_FS_WRITE, job)
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    uv_fs_t req;
+    int fd = uv_fs_open(nullptr, &req, path_.c_str(), flags_, mode_, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (fd < 0) return Fail("open", fd);
+
+    size_t written = 0;
+    while (written < length_) {
+      uv_buf_t buf = uv_buf_init(data_ + written,
+                                 static_cast<unsigned int>(std::min<size_t>(
+                                     length_ - written, kMaxWriteChunk)));
+      int r = uv_fs_write(nullptr, &req, fd, &buf, 1, -1, nullptr);
+      uv_fs_req_cleanup(&req);
+      if (r < 0) {
+        Fail("write", r);
+        break;
+      }
+      written += static_cast<size_t>(r);
+    }
+
+    int rc = uv_fs_close(nullptr, &req, fd, nullptr);
+    uv_fs_req_cleanup(&req);
+    if (rc < 0 && error_ == 0) Fail("close", rc);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<WriteFileJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    FS_ASYNC_TRACE_END0(UV_FS_WRITE, this)
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    HandleScope handle_scope(env->isolate());
+    Context::Scope context_scope(env->context());
+    Isolate* isolate = env->isolate();
+    Local<Value> argv[1] = {Null(isolate)};
+    if (error_ != 0) {
+      argv[0] = UVException(isolate,
+                            error_,
+                            syscall_,
+                            nullptr,
+                            syscall_ == kOpen ? path_.c_str() : nullptr);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  void MemoryInfo(MemoryTracker* tracker) const override {
+    tracker->TrackField("buffer", buffer_);
+    if (copy_) tracker->TrackFieldWithSize("copy", length_);
+  }
+  SET_MEMORY_INFO_NAME(WriteFileJob)
+  SET_SELF_SIZE(WriteFileJob)
+
+ private:
+  static constexpr size_t kMaxWriteChunk = 256 * 1024 * 1024;
+  static constexpr const char* kOpen = "open";
+
+  WriteFileJob(Environment* env,
+               Local<Object> object,
+               std::string&& path,
+               int flags,
+               int mode,
+               Local<ArrayBufferView> view)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.writefile"),
+        path_(std::move(path)),
+        flags_(flags),
+        mode_(mode) {
+    // Holding the backing store keeps the memory valid even if the buffer is
+    // detached or collected meanwhile; a resizable buffer can still have its
+    // pages decommitted by a shrink, so its contents are copied instead.
+    length_ = view->ByteLength();
+    backing_store_ = view->Buffer()->GetBackingStore();
+    if (backing_store_->IsResizableByUserJavaScript()) {
+      copy_.reset(new char[length_]);
+      memcpy(copy_.get(),
+             static_cast<char*>(backing_store_->Data()) + view->ByteOffset(),
+             length_);
+      data_ = copy_.get();
+      backing_store_.reset();
+    } else {
+      buffer_.Reset(env->isolate(), view);
+      data_ = static_cast<char*>(backing_store_->Data()) + view->ByteOffset();
+    }
+    MakeWeak();
+  }
+
+  void Fail(const char* syscall, int error) {
+    syscall_ = syscall;
+    error_ = error;
+  }
+
+  const std::string path_;
+  v8::Global<v8::ArrayBufferView> buffer_;
+  std::shared_ptr<v8::BackingStore> backing_store_;
+  std::unique_ptr<char[]> copy_;
+  char* data_ = nullptr;
+  size_t length_ = 0;
+  const int flags_;
+  const int mode_;
+  bool scheduled_ = false;
+  int error_ = 0;
+  const char* syscall_ = nullptr;
+};
+
 // Wrapper for readv(2).
 //
 // bytesRead = fs.readv(fd, buffers[, position], callback)
@@ -3948,96 +4643,12 @@ static void CpSyncCheckPaths(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
-static bool CopyUtimes(const std::filesystem::path& src,
-                       const std::filesystem::path& dest,
-                       Environment* env) {
-  uv_fs_t req;
-  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-
-  auto src_path_str = ConvertPathToUTF8(src);
-  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
-  if (is_uv_error(result)) {
-    env->ThrowUVException(result, "stat", nullptr, src_path_str.c_str());
-    return false;
-  }
-
-  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
-  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
-  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
-
-  auto dest_file_path_str = ConvertPathToUTF8(dest);
-  int utime_result = uv_fs_utime(nullptr,
-                                 &req,
-                                 dest_file_path_str.c_str(),
-                                 source_atime,
-                                 source_mtime,
-                                 nullptr);
-  if (is_uv_error(utime_result)) {
-    env->ThrowUVException(
-        utime_result, "utime", nullptr, dest_file_path_str.c_str());
-    return false;
-  }
-  return true;
-}
-
-static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
-
-  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
-
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
-
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
-
-  int mode;
-  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
-    return;
-  }
-
-  bool preserve_timestamps = args[3]->IsTrue();
-
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
-
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
-
-  std::error_code error;
-
-  if (!std::filesystem::remove(dest_path, error)) {
-    return env->ThrowStdErrException(error, "unlink", *dest);
-  }
-
-  if (mode == 0) {
-    // if no mode is specified use the faster std::filesystem API
-    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
-      return env->ThrowStdErrException(error, "cp", *dest);
-    }
-  } else {
-    uv_fs_t req;
-    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
-    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
-    if (is_uv_error(result)) {
-      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
-    }
-  }
-
-  if (preserve_timestamps) {
-    CopyUtimes(src_path, dest_path, env);
-  }
-}
-
 std::vector<std::string> normalizePathToArray(
     const std::filesystem::path& path) {
   std::vector<std::string> parts;
-  std::filesystem::path absPath = std::filesystem::absolute(path);
+  std::error_code error;
+  std::filesystem::path absPath = std::filesystem::absolute(path, error);
+  if (error) absPath = path;
 #ifdef _WIN32
   auto wstr = absPath.wstring();
   if (wstr.starts_with(L"\\\\?\\")) {
@@ -4058,107 +4669,240 @@ bool isInsideDir(const std::filesystem::path& src,
   return std::equal(srcArr.begin(), srcArr.end(), destArr.begin());
 }
 
-static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
-  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
-                               // verbatimSymlinks, preserveTimestamps
+namespace {
 
-  Environment* env = Environment::GetCurrent(args);
-  Isolate* isolate = env->isolate();
+// An fs.cp error recorded on whatever thread performed the copy; Throw() /
+// ToException() turn it into the error the JavaScript caller sees.
+struct CpError {
+  enum Kind {
+    kNone,
+    kErrno,
+    kUv,
+    kEinval,
+    kSymlinkToSubdirectory,
+    kEexist,
+    kSocket,
+    kFifo,
+    kUnknown
+  };
+  Kind kind = kNone;
+  int code = 0;
+  const char* syscall = "cp";
+  std::string message;
+  std::string path;
 
-  BufferValue src(isolate, args[0]);
-  CHECK_NOT_NULL(*src);
-  ToNamespacedPath(env, &src);
+  static CpError Std(const std::error_code& error, const std::string& path) {
+    return {kErrno, error.value(), "cp", error.message(), path};
+  }
+  static CpError Uv(int code, const char* syscall, const std::string& path) {
+    return {kUv, code, syscall, {}, path};
+  }
 
-  BufferValue dest(isolate, args[1]);
-  CHECK_NOT_NULL(*dest);
-  ToNamespacedPath(env, &dest);
+  Local<Value> ToException(Environment* env) const {
+    Isolate* isolate = env->isolate();
+    switch (kind) {
+      case kErrno:
+        return ErrnoException(
+            isolate, code, syscall, message.c_str(), path.c_str());
+      case kUv:
+        return UVException(isolate, code, syscall, nullptr, path.c_str());
+      case kEinval:
+        return ERR_FS_CP_EINVAL(isolate, "%s", message);
+      case kSymlinkToSubdirectory:
+        return ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(isolate, "%s", message);
+      case kEexist:
+        return ERR_FS_CP_EEXIST(isolate, "%s", message);
+      // Sockets, FIFOs and unknown entries are reported to JS by kind and
+      // path (see CpDirJob), cpSync skips them; neither builds an error here.
+      case kSocket:
+      case kFifo:
+      case kUnknown:
+      case kNone:
+        break;
+    }
+    UNREACHABLE();
+  }
 
-  bool force = args[2]->IsTrue();
-  bool dereference = args[3]->IsTrue();
-  bool error_on_exist = args[4]->IsTrue();
-  bool verbatim_symlinks = args[5]->IsTrue();
-  bool preserve_timestamps = args[6]->IsTrue();
+  void Throw(Environment* env) const {
+    env->isolate()->ThrowException(ToException(env));
+  }
+};
 
-  auto src_path = src.ToPath();
-  auto dest_path = dest.ToPath();
+CpError CopyUtimes(const std::filesystem::path& src,
+                   const std::filesystem::path& dest) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+
+  auto src_path_str = ConvertPathToUTF8(src);
+  int result = uv_fs_stat(nullptr, &req, src_path_str.c_str(), nullptr);
+  if (is_uv_error(result)) {
+    return CpError::Uv(result, "stat", src_path_str);
+  }
+
+  const uv_stat_t* const s = static_cast<const uv_stat_t*>(req.ptr);
+  const double source_atime = s->st_atim.tv_sec + s->st_atim.tv_nsec / 1e9;
+  const double source_mtime = s->st_mtim.tv_sec + s->st_mtim.tv_nsec / 1e9;
+
+  auto dest_file_path_str = ConvertPathToUTF8(dest);
+  int utime_result = uv_fs_utime(nullptr,
+                                 &req,
+                                 dest_file_path_str.c_str(),
+                                 source_atime,
+                                 source_mtime,
+                                 nullptr);
+  if (is_uv_error(utime_result)) {
+    return CpError::Uv(utime_result, "utime", dest_file_path_str);
+  }
+  return {};
+}
 
+struct CpDirOptions {
+  bool force;
+  bool dereference;
+  bool error_on_exist;
+  bool verbatim_symlinks;
+  bool preserve_timestamps;
+  // Set for fs.cp(), which only takes this path for a destination that did
+  // not exist: nothing already present is ever opened for writing or
+  // followed. Directories are created with mkdir() and files with an
+  // exclusive uv_fs_copyfile(), so anything that appears in their place
+  // (a symbolic link included) is EEXIST; sockets, FIFOs and unknown
+  // entries are rejected as the JavaScript walk does; relative link targets
+  // are resolved lexically, as path.resolve() would. fs.cpSync() merges
+  // into existing directories, skips those entries and canonicalizes link
+  // targets.
+  bool fresh_destination;
+  // fs.copyFile() mode flags (COPYFILE_FICLONE etc.) for fresh_destination.
+  int copyfile_flags;
+};
+
+CpError CopyFileFresh(const std::filesystem::path& src,
+                      const std::filesystem::path& dest,
+                      int flags) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto src_str = ConvertPathToUTF8(src);
+  auto dest_str = ConvertPathToUTF8(dest);
+  int rc = uv_fs_copyfile(nullptr,
+                          &req,
+                          src_str.c_str(),
+                          dest_str.c_str(),
+                          flags | UV_FS_COPYFILE_EXCL,
+                          nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "copyfile", dest_str);
+  }
+  return {};
+}
+
+// mkdir() that does not follow or accept anything already at `path`.
+CpError MakeFreshDirectory(const std::filesystem::path& path) {
+  uv_fs_t req;
+  auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+  auto path_str = ConvertPathToUTF8(path);
+  int rc = uv_fs_mkdir(nullptr, &req, path_str.c_str(), 0777, nullptr);
+  if (rc < 0) {
+    return CpError::Uv(rc, "mkdir", path_str);
+  }
+  return {};
+}
+
+// The recursive directory copy behind fs.cpSync() and, on the thread pool,
+// fs.cp()/fsPromises.cp() when no filter function is involved. Runs on any
+// thread; touches no JS.
+CpError CopyDirRecursive(const std::filesystem::path& src_path,
+                         const std::filesystem::path& dest_path,
+                         const std::string& dest_display,
+                         const CpDirOptions& options) {
   std::error_code error;
-  std::filesystem::create_directories(dest_path, error);
-  if (error) {
-    return env->ThrowStdErrException(error, "cp", *dest);
+  bool dest_existed = false;
+  if (options.fresh_destination) {
+    CpError made = MakeFreshDirectory(dest_path);
+    if (made.kind != CpError::kNone) return made;
+  } else {
+    dest_existed = std::filesystem::exists(dest_path, error);
+    std::filesystem::create_directories(dest_path, error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
   }
 
   auto file_copy_opts = std::filesystem::copy_options::recursive;
-  if (force) {
+  if (options.force) {
     file_copy_opts |= std::filesystem::copy_options::overwrite_existing;
-  } else if (error_on_exist) {
+  } else if (options.error_on_exist) {
     file_copy_opts |= std::filesystem::copy_options::none;
   } else {
     file_copy_opts |= std::filesystem::copy_options::skip_existing;
   }
 
-  std::function<bool(std::filesystem::path, std::filesystem::path)>
+  std::function<CpError(std::filesystem::path, std::filesystem::path)>
       copy_dir_contents;
-  copy_dir_contents = [verbatim_symlinks,
-                       &copy_dir_contents,
-                       &env,
-                       file_copy_opts,
-                       preserve_timestamps,
-                       force,
-                       error_on_exist,
-                       dereference,
-                       &isolate](std::filesystem::path src,
-                                 std::filesystem::path dest) {
+  copy_dir_contents = [&options, &copy_dir_contents, file_copy_opts](
+                          std::filesystem::path src,
+                          std::filesystem::path dest) -> CpError {
     std::error_code error;
-    for (auto dir_entry : std::filesystem::directory_iterator(src)) {
+    // Only the error_code overloads are used from here on: this runs on a
+    // thread pool thread and exceptions are disabled.
+    auto it = std::filesystem::directory_iterator(src, error);
+    if (error) {
+      return CpError::Std(error, ConvertPathToUTF8(src));
+    }
+    for (const auto end = std::filesystem::directory_iterator(); it != end;
+         it.increment(error)) {
+      if (error) {
+        return CpError::Std(error, ConvertPathToUTF8(src));
+      }
+      const auto& dir_entry = *it;
       auto dest_file_path = dest / dir_entry.path().filename();
       auto dest_str = ConvertPathToUTF8(dest);
 
-      if (dir_entry.is_symlink()) {
-        if (verbatim_symlinks) {
+      if (dir_entry.is_symlink(error)) {
+        if (options.verbatim_symlinks) {
           std::filesystem::copy_symlink(
               dir_entry.path(), dest_file_path, error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         } else {
           auto symlink_target =
               std::filesystem::read_symlink(dir_entry.path().c_str(), error);
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
 
-          if (std::filesystem::exists(dest_file_path)) {
-            if (std::filesystem::is_symlink((dest_file_path.c_str()))) {
+          if (std::filesystem::exists(dest_file_path, error)) {
+            if (std::filesystem::is_symlink(dest_file_path, error)) {
               auto current_dest_symlink_target =
                   std::filesystem::read_symlink(dest_file_path.c_str(), error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
 
-              if (!dereference &&
-                  std::filesystem::is_directory(symlink_target) &&
+              if (!options.dereference &&
+                  std::filesystem::is_directory(symlink_target, error) &&
                   isInsideDir(symlink_target, current_dest_symlink_target)) {
-                static constexpr const char* message =
-                    "Cannot copy %s to a subdirectory of self %s";
-                THROW_ERR_FS_CP_EINVAL(
-                    env, message, symlink_target, current_dest_symlink_target);
-                return false;
+                return {CpError::kEinval,
+                        0,
+                        "cp",
+                        SPrintF("Cannot copy %s to a subdirectory of self %s",
+                                symlink_target,
+                                current_dest_symlink_target),
+                        {}};
               }
 
               // Prevent copy if src is a subdir of dest since unlinking
               // dest in this case would result in removing src contents
               // and therefore a broken symlink would be created.
-              if (std::filesystem::is_directory(dest_file_path) &&
+              if (std::filesystem::is_directory(dest_file_path, error) &&
                   isInsideDir(current_dest_symlink_target, symlink_target)) {
-                static constexpr const char* message =
-                    "cannot overwrite %s with %s";
-                THROW_ERR_FS_CP_SYMLINK_TO_SUBDIRECTORY(
-                    env, message, current_dest_symlink_target, symlink_target);
-                return false;
+                return {CpError::kSymlinkToSubdirectory,
+                        0,
+                        "cp",
+                        SPrintF("cannot overwrite %s with %s",
+                                current_dest_symlink_target,
+                                symlink_target),
+                        {}};
               }
 
               // symlinks get overridden by cp even if force: false, this is
@@ -4166,29 +4910,40 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
               // correct? or is it a bug?
               std::filesystem::remove(dest_file_path, error);
               if (error) {
-                env->ThrowStdErrException(error, "cp", dest_str.c_str());
-                return false;
+                return CpError::Std(error, dest_str);
               }
-            } else if (std::filesystem::is_regular_file(dest_file_path)) {
-              if (!dereference || (!force && error_on_exist)) {
-                auto dest_file_path_str = ConvertPathToUTF8(dest_file_path);
-                env->ThrowStdErrException(
+            } else if (std::filesystem::is_regular_file(dest_file_path,
+                                                        error)) {
+              if (!options.dereference ||
+                  (!options.force && options.error_on_exist)) {
+                return CpError::Std(
                     std::make_error_code(std::errc::file_exists),
-                    "cp",
-                    dest_file_path_str.c_str());
-                return false;
+                    ConvertPathToUTF8(dest_file_path));
               }
             }
           }
-          auto symlink_target_absolute = std::filesystem::weakly_canonical(
-              std::filesystem::absolute(src / symlink_target));
+          std::filesystem::path symlink_target_absolute;
+          if (options.fresh_destination) {
+            // As path.resolve() does: lexical only, absolute targets verbatim.
+            symlink_target_absolute =
+                symlink_target.is_absolute()
+                    ? symlink_target
+                    : std::filesystem::absolute(src / symlink_target, error)
+                          .lexically_normal();
+          } else {
+            symlink_target_absolute = std::filesystem::weakly_canonical(
+                std::filesystem::absolute(src / symlink_target, error), error);
+          }
+          if (error) {
+            return CpError::Std(error, dest_str);
+          }
 #ifdef _WIN32
           auto wstr = symlink_target_absolute.wstring();
           if (wstr.starts_with(L"\\\\?\\")) {
             symlink_target_absolute = std::filesystem::path(wstr.substr(4));
           }
 #endif
-          if (dir_entry.is_directory()) {
+          if (dir_entry.is_directory(error)) {
             std::filesystem::create_directory_symlink(
                 symlink_target_absolute, dest_file_path, error);
           } else {
@@ -4196,44 +4951,297 @@ static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
                 symlink_target_absolute, dest_file_path, error);
           }
           if (error) {
-            env->ThrowStdErrException(error, "cp", dest_str.c_str());
-            return false;
+            return CpError::Std(error, dest_str);
           }
         }
-      } else if (dir_entry.is_directory()) {
+      } else if (dir_entry.is_directory(error)) {
         auto entry_dir_path = src / dir_entry.path().filename();
-        std::filesystem::create_directory(dest_file_path);
-        auto success = copy_dir_contents(entry_dir_path, dest_file_path);
-        if (!success) {
-          return false;
+        bool created = true;
+        if (options.fresh_destination) {
+          CpError made = MakeFreshDirectory(dest_file_path);
+          if (made.kind != CpError::kNone) return made;
+        } else {
+          created = std::filesystem::create_directory(dest_file_path, error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+        CpError inner = copy_dir_contents(entry_dir_path, dest_file_path);
+        if (inner.kind != CpError::kNone) {
+          return inner;
+        }
+        // A directory created by the copy gets the mode of its source once
+        // its contents are in (the source may be read-only).
+        if (created) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+        if (options.preserve_timestamps) {
+          CpError stamped = CopyUtimes(entry_dir_path, dest_file_path);
+          if (stamped.kind != CpError::kNone) return stamped;
+        }
+      } else if (dir_entry.is_regular_file(error)) {
+        bool copied = true;
+        if (options.fresh_destination) {
+          CpError fresh = CopyFileFresh(
+              dir_entry.path(), dest_file_path, options.copyfile_flags);
+          if (fresh.kind != CpError::kNone) return fresh;
+        } else {
+          copied = std::filesystem::copy_file(
+              dir_entry.path(), dest_file_path, file_copy_opts, error);
         }
-      } else if (dir_entry.is_regular_file()) {
-        std::filesystem::copy_file(
-            dir_entry.path(), dest_file_path, file_copy_opts, error);
         if (error) {
           if (error == std::errc::file_exists) {
-            THROW_ERR_FS_CP_EEXIST(isolate,
-                                   "[ERR_FS_CP_EEXIST]: Target already exists: "
-                                   "cp returned EEXIST (%s already exists)",
-                                   dest_file_path);
-            return false;
+            return {CpError::kEexist,
+                    0,
+                    "cp",
+                    SPrintF("[ERR_FS_CP_EEXIST]: Target already exists: "
+                            "cp returned EEXIST (%s already exists)",
+                            dest_file_path),
+                    {}};
           }
-          env->ThrowStdErrException(error, "cp", dest_str.c_str());
-          return false;
+          return CpError::Std(error, dest_str);
         }
 
-        if (preserve_timestamps &&
-            !CopyUtimes(dir_entry.path(), dest_file_path, env)) {
-          return false;
+        if (options.preserve_timestamps) {
+          CpError utimes = CopyUtimes(dir_entry.path(), dest_file_path);
+          if (utimes.kind != CpError::kNone) {
+            return utimes;
+          }
         }
+        // Both copies set the mode before writing the data, which clears
+        // setuid/setgid; put the source mode back once the data is in.
+        if (copied) {
+          std::filesystem::permissions(
+              dest_file_path, dir_entry.status(error).permissions(), error);
+          if (error) {
+            return CpError::Std(error, ConvertPathToUTF8(dest_file_path));
+          }
+        }
+      } else if (options.fresh_destination) {
+        CpError::Kind kind = dir_entry.is_socket(error) ? CpError::kSocket
+                             : dir_entry.is_fifo(error) ? CpError::kFifo
+                                                        : CpError::kUnknown;
+        return {kind, UV_EINVAL, "cp", {}, ConvertPathToUTF8(dest_file_path)};
       }
     }
-    return true;
+    return {};
   };
 
-  copy_dir_contents(src_path, dest_path);
+  CpError result = copy_dir_contents(src_path, dest_path);
+  if (result.kind != CpError::kNone) return result;
+  if (!dest_existed) {
+    std::filesystem::permissions(
+        dest_path,
+        std::filesystem::status(src_path, error).permissions(),
+        error);
+    if (error) {
+      return CpError::Std(error, dest_display);
+    }
+  }
+  if (options.preserve_timestamps) return CopyUtimes(src_path, dest_path);
+  return {};
 }
 
+}  // namespace
+
+static void CpSyncOverrideFile(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  CHECK_EQ(args.Length(), 4);  // src, dest, mode, preserveTimestamps
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  int mode;
+  if (!GetValidFileMode(env, args[2], UV_FS_COPYFILE).To(&mode)) {
+    return;
+  }
+
+  bool preserve_timestamps = args[3]->IsTrue();
+
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemRead, src.ToStringView());
+  THROW_IF_INSUFFICIENT_PERMISSIONS(
+      env, permission::PermissionScope::kFileSystemWrite, dest.ToStringView());
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  std::error_code error;
+
+  if (!std::filesystem::remove(dest_path, error)) {
+    return env->ThrowStdErrException(error, "unlink", *dest);
+  }
+
+  if (mode == 0) {
+    // if no mode is specified use the faster std::filesystem API
+    if (!std::filesystem::copy_file(src_path, dest_path, error)) {
+      return env->ThrowStdErrException(error, "cp", *dest);
+    }
+  } else {
+    uv_fs_t req;
+    auto cleanup = OnScopeLeave([&req]() { uv_fs_req_cleanup(&req); });
+    auto result = uv_fs_copyfile(nullptr, &req, *src, *dest, mode, nullptr);
+    if (is_uv_error(result)) {
+      return env->ThrowUVException(result, "cp", nullptr, *src, *dest);
+    }
+  }
+
+  if (preserve_timestamps) {
+    CpError error = CopyUtimes(src_path, dest_path);
+    if (error.kind != CpError::kNone) {
+      error.Throw(env);
+    }
+  }
+}
+
+static void CpSyncCopyDir(const FunctionCallbackInfo<Value>& args) {
+  CHECK_EQ(args.Length(), 7);  // src, dest, force, dereference, errorOnExist,
+                               // verbatimSymlinks, preserveTimestamps
+
+  Environment* env = Environment::GetCurrent(args);
+  Isolate* isolate = env->isolate();
+
+  BufferValue src(isolate, args[0]);
+  CHECK_NOT_NULL(*src);
+  ToNamespacedPath(env, &src);
+
+  BufferValue dest(isolate, args[1]);
+  CHECK_NOT_NULL(*dest);
+  ToNamespacedPath(env, &dest);
+
+  bool force = args[2]->IsTrue();
+  bool dereference = args[3]->IsTrue();
+  bool error_on_exist = args[4]->IsTrue();
+  bool verbatim_symlinks = args[5]->IsTrue();
+  bool preserve_timestamps = args[6]->IsTrue();
+
+  auto src_path = src.ToPath();
+  auto dest_path = dest.ToPath();
+
+  CpError error = CopyDirRecursive(src_path,
+                                   dest_path,
+                                   dest.ToString(),
+                                   {force,
+                                    dereference,
+                                    error_on_exist,
+                                    verbatim_symlinks,
+                                    preserve_timestamps,
+                                    false,
+                                    0});
+  if (error.kind != CpError::kNone) {
+    error.Throw(env);
+  }
+}
+
+// JS: const job = new CpDirJob(src, dest, force, dereference, errorOnExist,
+//                              verbatimSymlinks, preserveTimestamps);
+//     job.ondone = (err) => {...}; job.run();
+// Runs CopyDirRecursive() on the thread pool for fs.cp()/fsPromises.cp().
+class CpDirJob final : public AsyncWrap, public ThreadPoolWork {
+ public:
+  static void New(const FunctionCallbackInfo<Value>& args) {
+    CHECK(args.IsConstructCall());
+    Environment* env = Environment::GetCurrent(args);
+    CHECK_EQ(args.Length(), 8);
+    CHECK(args[7]->IsInt32());
+    BufferValue src(env->isolate(), args[0]);
+    CHECK_NOT_NULL(*src);
+    ToNamespacedPath(env, &src);
+    BufferValue dest(env->isolate(), args[1]);
+    CHECK_NOT_NULL(*dest);
+    ToNamespacedPath(env, &dest);
+    new CpDirJob(env,
+                 args.This(),
+                 src.ToPath(),
+                 dest.ToPath(),
+                 dest.ToString(),
+                 {args[2]->IsTrue(),
+                  args[3]->IsTrue(),
+                  args[4]->IsTrue(),
+                  args[5]->IsTrue(),
+                  args[6]->IsTrue(),
+                  true,
+                  args[7].As<Int32>()->Value()});
+  }
+
+  static void Run(const FunctionCallbackInfo<Value>& args) {
+    CpDirJob* job;
+    ASSIGN_OR_RETURN_UNWRAP(&job, args.This());
+    CHECK(!job->scheduled_);
+    job->scheduled_ = true;
+    job->ClearWeak();
+    job->ScheduleWork();
+  }
+
+  void DoThreadPoolWork() override {
+    error_ = CopyDirRecursive(src_, dest_, dest_display_, options_);
+  }
+
+  void AfterThreadPoolWork(int status) override {
+    Environment* env = AsyncWrap::env();
+    std::unique_ptr<CpDirJob> self(this);
+    CHECK(status == 0 || status == UV_ECANCELED);
+    if (status == UV_ECANCELED || !env->can_call_into_js()) return;
+    Isolate* isolate = env->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env->context());
+    Local<Value> argv[] = {
+        Null(isolate), Undefined(isolate), Undefined(isolate)};
+    const char* special = error_.kind == CpError::kSocket    ? "socket"
+                          : error_.kind == CpError::kFifo    ? "fifo"
+                          : error_.kind == CpError::kUnknown ? "unknown"
+                                                             : nullptr;
+    if (special != nullptr) {
+      Local<Value> path;
+      if (!ToV8Value(env->context(), error_.path).ToLocal(&path)) return;
+      argv[1] = OneByteString(isolate, special);
+      argv[2] = path;
+    } else if (error_.kind != CpError::kNone) {
+      argv[0] = error_.ToException(env);
+    }
+    MakeCallback(env->ondone_string(), arraysize(argv), argv);
+  }
+
+  bool IsNotIndicativeOfMemoryLeakAtExit() const override { return true; }
+  SET_NO_MEMORY_INFO()
+  SET_MEMORY_INFO_NAME(CpDirJob)
+  SET_SELF_SIZE(CpDirJob)
+
+ private:
+  CpDirJob(Environment* env,
+           Local<Object> object,
+           std::filesystem::path&& src,
+           std::filesystem::path&& dest,
+           std::string&& dest_display,
+           CpDirOptions options)
+      : AsyncWrap(env, object, AsyncWrap::PROVIDER_FSREQCALLBACK),
+        ThreadPoolWork(env, "fs.cp"),
+        src_(std::move(src)),
+        dest_(std::move(dest)),
+        dest_display_(std::move(dest_display)),
+        options_(options) {
+    MakeWeak();
+  }
+
+  const std::filesystem::path src_;
+  const std::filesystem::path dest_;
+  const std::string dest_display_;
+  const CpDirOptions options_;
+  CpError error_;
+  bool scheduled_ = false;
+};
+
 BindingData::FilePathIsFileReturnType BindingData::FilePathIsFile(
     Environment* env, const std::string& file_path) {
   THROW_IF_INSUFFICIENT_PERMISSIONS(
@@ -4566,6 +5574,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "rmSync", RmSync);
   SetMethod(isolate, target, "mkdir", MKDir);
   SetMethod(isolate, target, "readdir", ReadDir);
+  SetMethod(isolate, target, "readdirRecursive", ReadDirRecursive);
   SetMethod(isolate, target, "internalModuleStat", InternalModuleStat);
   SetMethod(isolate, target, "stat", Stat);
   SetMethod(isolate, target, "lstat", LStat);
@@ -4603,6 +5612,12 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetMethod(isolate, target, "cpSyncOverrideFile", CpSyncOverrideFile);
   SetMethod(isolate, target, "cpSyncCopyDir", CpSyncCopyDir);
 
+  Local<FunctionTemplate> cpj = NewFunctionTemplate(isolate, CpDirJob::New);
+  cpj->InstanceTemplate()->SetInternalFieldCount(CpDirJob::kInternalFieldCount);
+  cpj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, cpj, "run", CpDirJob::Run);
+  SetConstructorFunction(isolate, target, "CpDirJob", cpj);
+
   StatWatcher::CreatePerIsolateProperties(isolate_data, target);
   BindingData::CreatePerIsolateProperties(isolate_data, target);
 
@@ -4619,6 +5634,13 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
   SetProtoMethod(isolate, rfj, "run", ReadFileJob::Run);
   SetConstructorFunction(isolate, target, "ReadFileJob", rfj);
 
+  Local<FunctionTemplate> wfj = NewFunctionTemplate(isolate, WriteFileJob::New);
+  wfj->InstanceTemplate()->SetInternalFieldCount(
+      WriteFileJob::kInternalFieldCount);
+  wfj->Inherit(AsyncWrap::GetConstructorTemplate(isolate_data));
+  SetProtoMethod(isolate, wfj, "run", WriteFileJob::Run);
+  SetConstructorFunction(isolate, target, "WriteFileJob", wfj);
+
   // Create FunctionTemplate for FSReqCallback
   Local<FunctionTemplate> fst = NewFunctionTemplate(isolate, NewFSReqCallback);
   fst->InstanceTemplate()->SetInternalFieldCount(
@@ -4693,6 +5715,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(Open);
   registry->Register(ReadFileJob::New);
   registry->Register(ReadFileJob::Run);
+  registry->Register(WriteFileJob::New);
+  registry->Register(WriteFileJob::Run);
   registry->Register(OpenFileHandle);
   registry->Register(Read);
   registry->Register(ReadFileUtf8);
@@ -4705,6 +5729,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(RmSync);
   registry->Register(MKDir);
   registry->Register(ReadDir);
+  registry->Register(ReadDirRecursive);
   registry->Register(InternalModuleStat);
   registry->Register(Stat);
   registry->Register(LStat);
@@ -4724,6 +5749,8 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(CpSyncCheckPaths);
   registry->Register(CpSyncOverrideFile);
   registry->Register(CpSyncCopyDir);
+  registry->Register(CpDirJob::New);
+  registry->Register(CpDirJob::Run);
 
   registry->Register(Chmod);
   registry->Register(FChmod);
diff --git a/src/node_http2.cc b/src/node_http2.cc
index 4ce35dc37c23..f5018d10d7ee 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -217,6 +217,11 @@ Http2Options::Http2Options(Http2State* http2_state, SessionType type) {
         static_cast<size_t>(buffer[IDX_OPTIONS_MAX_SETTINGS]));
   }
 
+  if (flags & (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE)) {
+    set_connection_window_size(
+        static_cast<int32_t>(buffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE]));
+  }
+
   if ((flags & (1 << IDX_OPTIONS_STREAM_RESET_BURST)) &&
       (flags & (1 << IDX_OPTIONS_STREAM_RESET_RATE))) {
     nghttp2_option_set_stream_reset_rate_limit(
@@ -612,15 +617,13 @@ Http2Session::Http2Session(Http2State* http2_state,
       &alloc_info), 0);
   session_.reset(session);
 
-  // Increase the default local connection window to improve throughput
-  // on high-latency connections. The default 64KB window limits throughput
-  // to window_size / RTT. With a 32MB connection window, throughput is
-  // significantly improved. See https://github.com/nodejs/node/issues/38426
+  // The default connection window is larger than the 64KB required by the
+  // spec to improve throughput on high-latency connections, where throughput
+  // is limited to window_size / RTT. User settings have to be applied here
+  // initially rather than updating later as windows cannot be shrunk after
+  // they've been advertised.
   CHECK_EQ(nghttp2_session_set_local_window_size(
-               session,
-               NGHTTP2_FLAG_NONE,
-               0,
-               DEFAULT_SETTINGS_LOCAL_CONNECTION_WINDOW_SIZE),
+               session, NGHTTP2_FLAG_NONE, 0, opts.connection_window_size()),
            0);
 
   outgoing_storage_.reserve(1024);
diff --git a/src/node_http2.h b/src/node_http2.h
index f3edcf658f80..c042c46ab595 100644
--- a/src/node_http2.h
+++ b/src/node_http2.h
@@ -39,6 +39,10 @@ constexpr size_t kDefaultMaxSettings = 10;
 // Default maximum total memory cap for Http2Session.
 constexpr uint64_t kDefaultMaxSessionMemory = 10000000;
 
+// Default connection-level flow control window (32MB) to improve throughput
+// on high-latency connections. See https://github.com/nodejs/node/issues/38426
+constexpr int32_t kDefaultConnectionWindowSize = 33554432;
+
 // These are the standard HTTP/2 defaults as specified by the RFC
 constexpr uint32_t DEFAULT_SETTINGS_HEADER_TABLE_SIZE = 4096;
 constexpr uint32_t DEFAULT_SETTINGS_ENABLE_PUSH = 1;
@@ -51,10 +55,6 @@ constexpr uint32_t MAX_MAX_FRAME_SIZE = 16777215;
 constexpr uint32_t MIN_MAX_FRAME_SIZE = DEFAULT_SETTINGS_MAX_FRAME_SIZE;
 constexpr uint32_t MAX_INITIAL_WINDOW_SIZE = 2147483647;
 
-// Default local connection window size (32MB) to improve throughput
-// on high-latency connections. See https://github.com/nodejs/node/issues/38426
-constexpr uint32_t DEFAULT_SETTINGS_LOCAL_CONNECTION_WINDOW_SIZE = 33554432;
-
 // Stream is not going to have any DATA frames
 constexpr int STREAM_OPTION_EMPTY_PAYLOAD = 0x1;
 
@@ -245,9 +245,16 @@ class Http2Options {
     return max_session_memory_;
   }
 
+  void set_connection_window_size(int32_t size) {
+    connection_window_size_ = size;
+  }
+
+  int32_t connection_window_size() const { return connection_window_size_; }
+
  private:
   Nghttp2OptionPointer options_;
   uint64_t max_session_memory_ = kDefaultMaxSessionMemory;
+  int32_t connection_window_size_ = kDefaultConnectionWindowSize;
   uint32_t max_header_pairs_ = DEFAULT_MAX_HEADER_LIST_PAIRS;
   PaddingStrategy padding_strategy_ = PADDING_STRATEGY_NONE;
   size_t max_outstanding_pings_ = kDefaultMaxPings;
diff --git a/src/node_http2_state.h b/src/node_http2_state.h
index 914ad011e021..33fe342fd0b7 100644
--- a/src/node_http2_state.h
+++ b/src/node_http2_state.h
@@ -61,6 +61,7 @@ namespace http2 {
     IDX_OPTIONS_STREAM_RESET_RATE,
     IDX_OPTIONS_STREAM_RESET_BURST,
     IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION,
+    IDX_OPTIONS_CONNECTION_WINDOW_SIZE,
     IDX_OPTIONS_FLAGS
   };
 
diff --git a/src/node_main_instance.cc b/src/node_main_instance.cc
index 6f674df3ed0d..bc07d6aaf426 100644
--- a/src/node_main_instance.cc
+++ b/src/node_main_instance.cc
@@ -51,11 +51,11 @@ NodeMainInstance::NodeMainInstance(const SnapshotData* snapshot_data,
 
   // If the indexes are not nullptr, we are not deserializing
   isolate_data_.reset(
-      CreateIsolateData(isolate_,
-                        event_loop,
-                        platform,
-                        array_buffer_allocator_.get(),
-                        snapshot_data->AsEmbedderWrapper().get()));
+      IsolateData::CreateIsolateData(isolate_,
+                                     event_loop,
+                                     platform,
+                                     array_buffer_allocator_.get(),
+                                     snapshot_data));
 
   isolate_data_->max_young_gen_size =
       isolate_params_->constraints.max_young_generation_size_in_bytes();
diff --git a/src/node_options-inl.h b/src/node_options-inl.h
index 933311c70ea8..dac206791c35 100644
--- a/src/node_options-inl.h
+++ b/src/node_options-inl.h
@@ -4,6 +4,7 @@
 #if defined(NODE_WANT_INTERNALS) && NODE_WANT_INTERNALS
 
 #include <algorithm>
+#include <charconv>
 #include <cstdlib>
 #include <ranges>
 #include <type_traits>
@@ -52,7 +53,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                                        const char* help_text,
                                        uint64_t Options::*field,
                                        OptionEnvvarSettings env_setting,
-                                       OptionNamespaces namespace_id) {
+                                       OptionNamespaces namespace_id,
+                                       bool strict) {
   options_.emplace(
       name,
       OptionInfo{kUInteger,
@@ -60,7 +62,8 @@ void OptionsParser<Options>::AddOption(const char* name,
                  env_setting,
                  help_text,
                  false,
-                 NamespaceEnumToString(namespace_id)});
+                 NamespaceEnumToString(namespace_id),
+                 strict});
 }
 
 template <typename Options>
@@ -239,7 +242,8 @@ auto OptionsParser<Options>::Convert(
                     original.env_setting,
                     original.help_text,
                     original.default_is_true,
-                    original.namespace_id};
+                    original.namespace_id,
+                    original.strict};
 }
 
 template <typename Options>
@@ -502,10 +506,22 @@ void OptionsParser<Options>::Parse(
         *Lookup<int64_t>(info.field, options) = std::atoll(value.c_str());
         break;
       }
-      case kUInteger:
-        *Lookup<uint64_t>(info.field, options) =
-            std::strtoull(value.c_str(), nullptr, 10);
+      case kUInteger: {
+        if (!info.strict) {
+          *Lookup<uint64_t>(info.field, options) =
+              std::strtoull(value.c_str(), nullptr, 10);
+          break;
+        }
+        uint64_t parsed;
+        const char* end = value.data() + value.size();
+        const auto result = std::from_chars(value.data(), end, parsed);
+        if (result.ec != std::errc() || result.ptr != end) {
+          errors->push_back("invalid value for " + name);
+          break;
+        }
+        *Lookup<uint64_t>(info.field, options) = parsed;
         break;
+      }
       case kString:
         *Lookup<std::string>(info.field, options) = value;
         break;
diff --git a/src/node_options.cc b/src/node_options.cc
index 4665f1faeda7..9077325e393d 100644
--- a/src/node_options.cc
+++ b/src/node_options.cc
@@ -39,6 +39,8 @@ using v8::Undefined;
 using v8::Value;
 namespace node {
 
+constexpr bool kStrictOptionParsing = true;
+
 namespace per_process {
 Mutex cli_options_mutex;
 std::shared_ptr<PerProcessOptions> cli_options{new PerProcessOptions()};
@@ -241,6 +243,38 @@ void EnvironmentOptions::CheckOptions(std::vector<std::string>* errors,
     errors->push_back("invalid value for --trace-require-module");
   }
 
+  if (bench_runner && test_runner) {
+    errors->push_back("either --bench or --test can be used, not both");
+  }
+
+  if (bench_runner) {
+    if (bench_isolation == "none") {
+      debug_options_.allow_attaching_debugger = true;
+    } else {
+      if (bench_isolation != "process") {
+        errors->push_back("invalid value for --bench-isolation");
+      }
+
+      debug_options_.allow_attaching_debugger = false;
+    }
+    if (has_bench_samples && bench_samples == 0) {
+      errors->push_back("--bench-samples must be greater than 0");
+    }
+    if (syntax_check_only) {
+      errors->push_back("either --bench or --check can be used, not both");
+    }
+    if (has_eval_string) {
+      errors->push_back("either --bench or --eval can be used, not both");
+    }
+    if (force_repl) {
+      errors->push_back(
+          "either --bench or --interactive can be used, not both");
+    }
+    if (watch_mode || !watch_mode_paths.empty()) {
+      errors->push_back("either --bench or --watch can be used, not both");
+    }
+  }
+
   if (test_runner) {
     if (test_isolation == "none") {
       debug_options_.allow_attaching_debugger = true;
@@ -704,6 +738,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             &EnvironmentOptions::allow_fs_write,
             kAllowedInEnvvar,
             OptionNamespaces::kPermissionNamespace);
+  AddOption("--allow-fs-vfs",
+            "allow mounting a virtual file system when any permissions are set",
+            BOOL_FIELD(allow_fs_vfs),
+            kAllowedInEnvvar,
+            false,
+            OptionNamespaces::kPermissionNamespace);
   AddOption("--allow-addons",
             "allow use of addons when any permissions are set",
             BOOL_FIELD(allow_addons),
@@ -945,6 +985,49 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
             "use the specified file for package map resolution",
             &EnvironmentOptions::experimental_package_map_path,
             kAllowedInEnvvar);
+  AddOption("--bench",
+            "launch benchmark runner on startup",
+            BOOL_FIELD(bench_runner),
+            kDisallowedInEnvvar,
+            false,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-isolation",
+            "configures the type of benchmark isolation used in the benchmark "
+            "runner",
+            &EnvironmentOptions::bench_isolation,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-name-pattern",
+            "run benchmarks whose name matches this regular expression",
+            &EnvironmentOptions::bench_name_pattern,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-reporter",
+            "report benchmark output using the given reporter",
+            &EnvironmentOptions::bench_reporter,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("--bench-reporter-destination",
+            "report the given benchmark reporter to the given destination",
+            &EnvironmentOptions::bench_reporter_destination,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace);
+  AddOption("[has_bench_samples]", "", BOOL_FIELD(has_bench_samples));
+  AddOption("--bench-samples",
+            "specify the number of measured benchmark samples",
+            &EnvironmentOptions::bench_samples,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-samples", "[has_bench_samples]");
+  AddOption("[has_bench_warmup]", "", BOOL_FIELD(has_bench_warmup));
+  AddOption("--bench-warmup",
+            "specify the number of unreported benchmark warmup samples",
+            &EnvironmentOptions::bench_warmup,
+            kAllowedInEnvvar,
+            OptionNamespaces::kBenchRunnerNamespace,
+            kStrictOptionParsing);
+  Implies("--bench-warmup", "[has_bench_warmup]");
   AddOption("--test",
             "launch test runner on startup",
             BOOL_FIELD(test_runner),
@@ -1289,6 +1372,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
 
 PerIsolateOptionsParser::PerIsolateOptionsParser(
   const EnvironmentOptionsParser& eop) {
+  AddOption("--worker-snapshot",
+            "start worker threads from the bootstrapped context in the "
+            "built-in startup snapshot",
+            BOOL_FIELD(worker_snapshot),
+            kAllowedInEnvvar,
+            true);
   AddOption("--track-heap-objects",
             "track heap object allocations for heap snapshots",
             BOOL_FIELD(track_heap_objects),
diff --git a/src/node_options.h b/src/node_options.h
index 322955cc38a9..ffd76d70526c 100644
--- a/src/node_options.h
+++ b/src/node_options.h
@@ -139,6 +139,8 @@ class EnvironmentOptions : public Options {
   std::string heap_snapshot_signal;
   std::string redirect_warnings;
   std::string diagnostic_dir;
+  std::string bench_isolation = "process";
+  std::string bench_name_pattern;
   std::string test_rerun_failures_path;
   std::string test_global_setup_path;
   std::string test_isolation = "process";
@@ -161,6 +163,8 @@ class EnvironmentOptions : public Options {
   std::vector<std::string> allow_fs_read;
   std::vector<std::string> allow_fs_write;
   std::vector<std::string> disable_warnings;
+  std::vector<std::string> bench_reporter;
+  std::vector<std::string> bench_reporter_destination;
   std::vector<std::string> env_file;
   std::vector<std::string> optional_env_file;
   std::vector<std::string> test_name_pattern;
@@ -179,6 +183,8 @@ class EnvironmentOptions : public Options {
   int64_t heap_snapshot_near_heap_limit = 0;
   uint64_t network_family_autoselection_attempt_timeout = 500;
   uint64_t max_http_header_size = 16 * 1024;
+  uint64_t bench_samples = 0;
+  uint64_t bench_warmup = 0;
   uint64_t test_runner_concurrency = 0;
   uint64_t test_runner_timeout = 0;
   uint64_t test_coverage_branches = 0;
@@ -219,6 +225,7 @@ class EnvironmentOptions : public Options {
   DEFINE_BOOL_FIELD(permission) = false;
   DEFINE_BOOL_FIELD(permission_audit) = false;
   DEFINE_BOOL_FIELD(allow_addons) = false;
+  DEFINE_BOOL_FIELD(allow_fs_vfs) = false;
   DEFINE_BOOL_FIELD(allow_inspector) = false;
   DEFINE_BOOL_FIELD(allow_child_process) = false;
   DEFINE_BOOL_FIELD(allow_net) = false;
@@ -243,6 +250,9 @@ class EnvironmentOptions : public Options {
   DEFINE_BOOL_FIELD(preserve_symlinks_main) = false;
   DEFINE_BOOL_FIELD(prof_process) = false;
   DEFINE_BOOL_FIELD(has_env_file_string) = false;
+  DEFINE_BOOL_FIELD(bench_runner) = false;
+  DEFINE_BOOL_FIELD(has_bench_samples) = false;
+  DEFINE_BOOL_FIELD(has_bench_warmup) = false;
   DEFINE_BOOL_FIELD(test_runner) = false;
   DEFINE_BOOL_FIELD(test_runner_coverage) = false;
   DEFINE_BOOL_FIELD(test_runner_force_exit) = false;
@@ -310,6 +320,7 @@ class EnvironmentOptions : public Options {
 
 class PerIsolateOptions : public Options {
  public:
+  bool worker_snapshot = true;  // --[no-]worker-snapshot
   PerIsolateOptions() = default;
   PerIsolateOptions(PerIsolateOptions&&) = default;
 
@@ -467,6 +478,7 @@ std::vector<std::string> MapAvailableNamespaces();
 // Define all namespace entries
 #define OPTION_NAMESPACE_LIST(V)                                               \
   V(kNoNamespace, "")                                                          \
+  V(kBenchRunnerNamespace, "bench")                                            \
   V(kTestRunnerNamespace, "test")                                              \
   V(kWatchNamespace, "watch")                                                  \
   V(kPermissionNamespace, "permission")
@@ -522,12 +534,12 @@ class OptionsParser {
       OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
       bool default_is_true = false,
       OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
-  void AddOption(
-      const char* name,
-      const char* help_text,
-      uint64_t Options::*field,
-      OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
-      OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace);
+  void AddOption(const char* name,
+                 const char* help_text,
+                 uint64_t Options::*field,
+                 OptionEnvvarSettings env_setting = kDisallowedInEnvvar,
+                 OptionNamespaces namespace_id = OptionNamespaces::kNoNamespace,
+                 bool strict = false);
   void AddOption(
       const char* name,
       const char* help_text,
@@ -693,6 +705,7 @@ class OptionsParser {
     std::string help_text;
     bool default_is_true = false;
     std::string namespace_id;
+    bool strict = false;
   };
 
   // An implied option is composed of the information on where to store a
diff --git a/src/node_process_methods.cc b/src/node_process_methods.cc
index 8f800be35431..6a35e5c5e4c4 100644
--- a/src/node_process_methods.cc
+++ b/src/node_process_methods.cc
@@ -807,6 +807,7 @@ static void CreatePerIsolateProperties(IsolateData* isolate_data,
 
   SetMethodNoSideEffect(isolate, target, "cwd", Cwd);
   SetMethod(isolate, target, "dlopen", binding::DLOpen);
+  SetMethod(isolate, target, "dlopenBinary", binding::DLOpenBinary);
   SetMethod(isolate, target, "reallyExit", ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
@@ -854,6 +855,7 @@ void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
 
   registry->Register(Cwd);
   registry->Register(binding::DLOpen);
+  registry->Register(binding::DLOpenBinary);
   registry->Register(ReallyExit);
 
 #if defined __POSIX__ && !defined(__PASE__)
diff --git a/src/node_sea.cc b/src/node_sea.cc
index 03d487f1dba7..a988de5ed095 100644
--- a/src/node_sea.cc
+++ b/src/node_sea.cc
@@ -263,6 +263,15 @@ void IsSea(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(IsSingleExecutable());
 }
 
+void IsVfsEnabled(const FunctionCallbackInfo<Value>& args) {
+  bool enabled = false;
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    enabled = static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs);
+  }
+  args.GetReturnValue().Set(enabled);
+}
+
 void IsExperimentalSeaWarningNeeded(const FunctionCallbackInfo<Value>& args) {
   bool is_building_sea =
       !per_process::cli_options->experimental_sea_config.empty();
@@ -447,6 +456,16 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
       if (use_code_cache_value) {
         result.flags |= SeaFlags::kUseCodeCache;
       }
+    } else if (key == "useVfs") {
+      bool use_vfs;
+      if (field.value().get_bool().get(use_vfs)) {
+        FPrintF(
+            stderr, "\"useVfs\" field of %s is not a Boolean\n", config_path);
+        return std::nullopt;
+      }
+      if (use_vfs) {
+        result.flags |= SeaFlags::kEnableVfs;
+      }
     } else if (key == "assets") {
       simdjson::ondemand::object assets_object;
       if (field.value().get_object().get(assets_object)) {
@@ -565,6 +584,19 @@ std::optional<SeaConfig> ParseSingleExecutableConfig(
     return std::nullopt;
   }
 
+  if (static_cast<bool>(result.flags & SeaFlags::kEnableVfs)) {
+    if (static_cast<bool>(result.flags & SeaFlags::kUseSnapshot)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useSnapshot\" is true\n");
+      return std::nullopt;
+    }
+    if (static_cast<bool>(result.flags & SeaFlags::kUseCodeCache)) {
+      FPrintF(stderr,
+              "\"useVfs\" is not supported when \"useCodeCache\" is true\n");
+      return std::nullopt;
+    }
+  }
+
   if (result.main_path.empty()) {
     FPrintF(stderr,
             "\"main\" field of %s is not a non-empty string\n",
@@ -846,11 +878,13 @@ void GetAsset(const FunctionCallbackInfo<Value>& args) {
   }
   // We cast away the constness here, the JS land should ensure that
   // the data is not mutated.
-  std::unique_ptr<v8::BackingStore> store = ArrayBuffer::NewBackingStore(
+  std::unique_ptr<v8::BackingStore> store = AdoptIntoBackingStore(
+      args.GetIsolate(),
       const_cast<char*>(it->second.data()),
       it->second.size(),
       [](void*, size_t, void*) {},
       nullptr);
+  CHECK(store);
   Local<ArrayBuffer> ab = ArrayBuffer::New(args.GetIsolate(), std::move(store));
   args.GetReturnValue().Set(ab);
 }
@@ -924,7 +958,31 @@ void Initialize(Local<Object> target,
                 Local<Value> unused,
                 Local<Context> context,
                 void* priv) {
+  Environment* env = Environment::GetCurrent(context);
+  Isolate* isolate = env->isolate();
+
+  if (IsSingleExecutable()) {
+    SeaResource sea_resource = FindSingleExecutableResource();
+    // Expose the main script path recorded in the SEA config so the VFS
+    // integration can place the main script at the mount point root.
+    if (static_cast<bool>(sea_resource.flags & SeaFlags::kEnableVfs)) {
+      Local<String> code_path_str;
+      if (String::NewFromUtf8(isolate,
+                              sea_resource.code_path.data(),
+                              NewStringType::kNormal,
+                              sea_resource.code_path.length())
+              .ToLocal(&code_path_str)) {
+        target
+            ->Set(context,
+                  FIXED_ONE_BYTE_STRING(isolate, "mainCodePath"),
+                  code_path_str)
+            .Check();
+      }
+    }
+  }
+
   SetMethod(context, target, "isSea", IsSea);
+  SetMethod(context, target, "isVfsEnabled", IsVfsEnabled);
   SetMethod(context,
             target,
             "isExperimentalSeaWarningNeeded",
@@ -935,6 +993,7 @@ void Initialize(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(IsSea);
+  registry->Register(IsVfsEnabled);
   registry->Register(IsExperimentalSeaWarningNeeded);
   registry->Register(GetAsset);
   registry->Register(GetAssetKeys);
diff --git a/src/node_sea.h b/src/node_sea.h
index b147caefa5e5..cd633c2f43b7 100644
--- a/src/node_sea.h
+++ b/src/node_sea.h
@@ -30,6 +30,7 @@ enum class SeaFlags : uint32_t {
   kUseCodeCache = 1 << 2,
   kIncludeAssets = 1 << 3,
   kIncludeExecArgv = 1 << 4,
+  kEnableVfs = 1 << 5,
 };
 
 enum class SeaExecArgvExtension : uint8_t {
diff --git a/src/node_snapshotable.cc b/src/node_snapshotable.cc
index e861e499534c..37123682dd16 100644
--- a/src/node_snapshotable.cc
+++ b/src/node_snapshotable.cc
@@ -628,10 +628,6 @@ const SnapshotData* SnapshotData::FromEmbedderWrapper(
   return data != nullptr ? data->impl_ : nullptr;
 }
 
-EmbedderSnapshotData::Pointer SnapshotData::AsEmbedderWrapper() const {
-  return EmbedderSnapshotData::Pointer{new EmbedderSnapshotData(this, false)};
-}
-
 bool SnapshotData::FromFile(SnapshotData* out, FILE* in) {
   return FromBlob(out, ReadFileSync(in));
 }
diff --git a/src/node_snapshotable.h b/src/node_snapshotable.h
index 18ef5fbd43fd..a9050877a04d 100644
--- a/src/node_snapshotable.h
+++ b/src/node_snapshotable.h
@@ -44,8 +44,11 @@ struct InternalFieldInfoBase {
   template <std::derived_from<InternalFieldInfoBase> T>
   static T* New(EmbedderObjectType type) {
     void* buf = ::operator new[](sizeof(T));
-    memset(buf, 0, sizeof(T));  // Make the padding reproducible.
     T* result = new (buf) T;
+    // Zero the padding to make the bytes handed to V8 reproducible. Must come
+    // after the placement new, or -flifetime-dse drops it as a dead store.
+    // https://gcc.gnu.org/onlinedocs/gcc/Optimize-Options.html#index-fno-lifetime-dse
+    memset(static_cast<void*>(result), 0, sizeof(T));
     result->type = type;
     result->length = sizeof(T);
     return result;
diff --git a/src/node_sqlite.cc b/src/node_sqlite.cc
index 9ae07441917c..9ad04eae0878 100644
--- a/src/node_sqlite.cc
+++ b/src/node_sqlite.cc
@@ -404,7 +404,13 @@ class CustomAggregate {
         start_(env->isolate(), start),
         step_fn_(env->isolate(), step_fn),
         inverse_fn_(env->isolate(), inverse_fn),
-        result_fn_(env->isolate(), result_fn) {}
+        result_fn_(env->isolate(), result_fn) {
+    db_->user_defined_functions_.insert(this);
+  }
+
+  ~CustomAggregate() {
+    if (db_) db_->user_defined_functions_.erase(this);
+  }
 
   static void xStep(sqlite3_context* ctx, int argc, sqlite3_value** argv) {
     xStepBase(ctx, argc, argv, &CustomAggregate::step_fn_);
@@ -635,9 +641,13 @@ class BackupJob : public ThreadPoolWork {
   }
 
   void AfterThreadPoolWork(int status) override {
-    HandleScope handle_scope(env()->isolate());
+    Isolate* isolate = env()->isolate();
+    HandleScope handle_scope(isolate);
+    Context::Scope context_scope(env()->context());
+    InternalCallbackScope callback_scope(
+        env(), Object::New(isolate), {0, 0}, InternalCallbackScope::kNoFlags);
     Local<Promise::Resolver> resolver =
-        Local<Promise::Resolver>::New(env()->isolate(), resolver_);
+        Local<Promise::Resolver>::New(isolate, resolver_);
 
     if (!(backup_status_ == SQLITE_OK || backup_status_ == SQLITE_DONE ||
           backup_status_ == SQLITE_BUSY || backup_status_ == SQLITE_LOCKED)) {
@@ -768,9 +778,13 @@ UserDefinedFunction::UserDefinedFunction(Environment* env,
     : env_(env),
       fn_(env->isolate(), fn),
       db_(std::move(db)),
-      use_bigint_args_(use_bigint_args) {}
+      use_bigint_args_(use_bigint_args) {
+  db_->user_defined_functions_.insert(this);
+}
 
-UserDefinedFunction::~UserDefinedFunction() {}
+UserDefinedFunction::~UserDefinedFunction() {
+  if (db_) db_->user_defined_functions_.erase(this);
+}
 
 void UserDefinedFunction::xFunc(sqlite3_context* ctx,
                                 int argc,
@@ -1067,6 +1081,8 @@ DatabaseSync::~DatabaseSync() {
 }
 
 void DatabaseSync::MemoryInfo(MemoryTracker* tracker) const {
+  tracker->TrackFieldWithSize("user_defined_functions",
+                              user_defined_functions_.size() * sizeof(void*));
   // TODO(tniessen): more accurately track the size of all fields
   tracker->TrackFieldWithSize(
       "open_config", sizeof(open_config_), "DatabaseOpenConfiguration");
@@ -1611,6 +1627,8 @@ void DatabaseSync::Close(const FunctionCallbackInfo<Value>& args) {
   int r = sqlite3_close_v2(db->connection_.get());
   CHECK_ERROR_OR_THROW(env->isolate(), db, r, SQLITE_OK, void());
   db->connection_.release();
+  // Backups can defer SQLite destruction until after the connection is closed.
+  db->user_defined_functions_.clear();
 }
 
 void DatabaseSync::Dispose(const v8::FunctionCallbackInfo<v8::Value>& args) {
@@ -1738,6 +1756,10 @@ void DatabaseSync::Prepare(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Utf8Value sql(env->isolate(), args[0].As<String>());
   sqlite3_stmt* s = nullptr;
 
@@ -1925,9 +1947,22 @@ void DatabaseSync::CustomFunction(const FunctionCallbackInfo<Value>& args) {
     if (!fn->Get(env->context(), env->length_string()).ToLocal(&js_len)) {
       return;
     }
+
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"function.length\" property must be an integer.");
+      return;
+    }
+
     argc = js_len.As<Int32>()->Value();
   }
 
+  // Reading the options bag and "function.length" above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   UserDefinedFunction* user_data = new UserDefinedFunction(
       env, fn, BaseObjectWeakPtr<DatabaseSync>(db), use_bigint_args);
   int text_rep = SQLITE_UTF8;
@@ -2013,27 +2048,17 @@ void DatabaseSync::Serialize(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  // V8 sandbox forbids external backing stores so allocate inside the
-  // sandbox and copy. Without sandbox wrap the output directly using
-  // sqlite3_free as the destructor to avoid the copy.
-#ifdef V8_ENABLE_SANDBOX
-  auto free_data = OnScopeLeave([&] { sqlite3_free(data); });
-  auto store = ArrayBuffer::NewBackingStore(
+  auto store = AdoptIntoBackingStore(
       env->isolate(),
+      data,
       size,
-      BackingStoreInitializationMode::kUninitialized,
-      BackingStoreOnFailureMode::kReturnNull);
+      [](void* ptr, size_t, void*) { sqlite3_free(ptr); },
+      nullptr);
   if (!store) {
     THROW_ERR_MEMORY_ALLOCATION_FAILED(env);
     return;
   }
-  memcpy(store->Data(), data, size);
   Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(store));
-#else
-  auto store = ArrayBuffer::NewBackingStore(
-      data, size, [](void* ptr, size_t, void*) { sqlite3_free(ptr); }, nullptr);
-  Local<ArrayBuffer> ab = ArrayBuffer::New(env->isolate(), std::move(store));
-#endif
 
   args.GetReturnValue().Set(Uint8Array::New(ab, 0, size));
 }
@@ -2090,6 +2115,10 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   // sqlite3_malloc64 is required because SQLITE_DESERIALIZE_FREEONCLOSE
   // transfers ownership to SQLite, which calls sqlite3_free() on close.
   // See: https://www.sqlite.org/c3ref/deserialize.html
@@ -2100,7 +2129,16 @@ void DatabaseSync::Deserialize(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  input->CopyContents(buf, byte_length);
+  // The same user JavaScript may also have shrunk or detached the backing
+  // store, in which case byte_length is stale and CopyContents() leaves the
+  // remainder of buf uninitialized. Handing that to SQLite would disclose it
+  // through serialize().
+  if (input->CopyContents(buf, byte_length) != byte_length) {
+    sqlite3_free(buf);
+    THROW_ERR_INVALID_STATE(
+        env, "The \"buffer\" argument was resized while reading \"options\"");
+    return;
+  }
 
   db->FinalizeStatements();
 
@@ -2238,17 +2276,37 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
       return;
     }
 
+    if (!js_len->IsInt32()) {
+      THROW_ERR_INVALID_ARG_TYPE(
+          env->isolate(),
+          "The \"options.step.length\" property must be an integer.");
+      return;
+    }
+
     // Subtract 1 because the first argument is the aggregate value.
     argc = js_len.As<Int32>()->Value() - 1;
-    if (!inverseFunc.IsEmpty() &&
-        !inverseFunc->Get(env->context(), env->length_string())
-             .ToLocal(&js_len)) {
-      return;
+    if (!inverseFunc.IsEmpty()) {
+      if (!inverseFunc->Get(env->context(), env->length_string())
+               .ToLocal(&js_len)) {
+        return;
+      }
+
+      if (!js_len->IsInt32()) {
+        THROW_ERR_INVALID_ARG_TYPE(
+            env->isolate(),
+            "The \"options.inverse.length\" property must be an integer.");
+        return;
+      }
     }
 
     argc = std::max({argc, js_len.As<Int32>()->Value() - 1, 0});
   }
 
+  // Reading the options bag and the step/inverse "length" properties above can
+  // run user JavaScript through a property getter, which may have closed the
+  // database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   int text_rep = SQLITE_UTF8;
   if (direct_only) {
     text_rep |= SQLITE_DIRECTONLY;
@@ -2277,10 +2335,15 @@ void DatabaseSync::AggregateFunction(const FunctionCallbackInfo<Value>& args) {
 }
 
 void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
+  DatabaseSync* db;
+  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  Environment* env = Environment::GetCurrent(args);
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
+
   std::string table;
   std::string db_name = "main";
 
-  Environment* env = Environment::GetCurrent(args);
   if (args.Length() > 0) {
     if (!args[0]->IsObject()) {
       THROW_ERR_INVALID_ARG_TYPE(env->isolate(),
@@ -2331,10 +2394,9 @@ void DatabaseSync::CreateSession(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  DatabaseSync* db;
-  ASSIGN_OR_RETURN_UNWRAP(&db, args.This());
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
   THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
-  THROW_AND_RETURN_IF_IN_AUTHORIZER(env, db);
 
   sqlite3_session* pSession;
   int r =
@@ -2461,6 +2523,11 @@ void Backup(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the destination path and the options bag above can run user
+  // JavaScript through a property getter, which may have closed the database
+  // since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   Local<Promise::Resolver> resolver;
   if (!Promise::Resolver::New(env->context()).ToLocal(&resolver)) {
     return;
@@ -2604,6 +2671,10 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
+  // Reading the options bag above can run user JavaScript through a property
+  // getter, which may have closed the database since it was checked.
+  THROW_AND_RETURN_ON_BAD_STATE(env, !db->IsOpen(), "database is not open");
+
   // Keep the database alive in case a callback drops all references to it,
   // which could otherwise let it be garbage-collected mid-callback.
   BaseObjectPtr<DatabaseSync> guard(db);
@@ -2614,12 +2685,11 @@ void DatabaseSync::ApplyChangeset(const FunctionCallbackInfo<Value>& args) {
     return;
   }
 
-  // A callback may detach/modify the input buffer mid-apply, so copy it.
-  // With no callbacks, no JS runs during sqlite3changeset_apply(), so no
-  // copy is needed.
+  // SQLite may invoke JavaScript through explicit callbacks or user-defined
+  // SQL functions while applying the changeset. Copy the input so JavaScript
+  // cannot detach or modify the memory while SQLite is still reading it.
   std::unique_ptr<BackingStore> changeset;
-  if (buf.length() > 0 &&
-      (context.filterCallback || context.conflictCallback)) {
+  if (buf.length() > 0) {
     changeset = ArrayBuffer::NewBackingStore(
         env->isolate(),
         buf.length(),
@@ -3101,7 +3171,8 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
   // Dates could be supported by converting them to numbers. However, there
   // would not be a good way to read the values back from SQLite with the
   // original type. JS Boolean binds to 1 and 0 because SQLite maps true and
-  // false keywords to 1 and 0.
+  // false keywords to 1 and 0. JS undefined binds to NULL so that passing it
+  // explicitly matches omitting the parameter altogether.
   Isolate* isolate = env()->isolate();
   int r;
   if (value->IsNumber()) {
@@ -3125,7 +3196,7 @@ bool StatementSync::BindValue(const Local<Value>& value, const int index) {
                               SQLITE_TRANSIENT,
                               SQLITE_UTF8);
     }
-  } else if (value->IsNull()) {
+  } else if (value->IsNullOrUndefined()) {
     r = sqlite3_bind_null(statement_.get(), index);
   } else if (value->IsArrayBufferView() || value->IsArrayBuffer() ||
              value->IsSharedArrayBuffer()) {
diff --git a/src/node_sqlite.h b/src/node_sqlite.h
index 306a47f6c47f..5b91e27d5736 100644
--- a/src/node_sqlite.h
+++ b/src/node_sqlite.h
@@ -266,6 +266,10 @@ class DatabaseSync : public BaseObject {
   void FinalizeBackups();
   void UntrackStatement(StatementSync* statement);
   bool IsOpen();
+  // SQL functions are one of several paths by which SQLite can invoke JS.
+  size_t GetUserDefinedFunctionCount() const {
+    return user_defined_functions_.size();
+  }
   bool use_big_ints() const { return open_config_.get_use_big_ints(); }
   bool return_arrays() const { return open_config_.get_return_arrays(); }
   bool allow_bare_named_params() const {
@@ -340,11 +344,16 @@ class DatabaseSync : public BaseObject {
   int trace_suppression_depth_ = 0;
   std::vector<sqlite3_stmt*> stepping_statements_;
 
+  // SQLite owns these scalar and aggregate/window function registrations. Its
+  // destroy callbacks untrack replaced functions and failed registrations.
+  std::unordered_set<const void*> user_defined_functions_;
   std::set<BackupJob*> backups_;
   std::unordered_set<Session*> sessions_;
   std::unordered_set<StatementSync*> statements_;
   BaseObjectPtr<diagnostics_channel::Channel> trace_channel_;
 
+  friend class UserDefinedFunction;
+  friend class CustomAggregate;
   friend class DatabaseSyncLimits;
   friend class Session;
   friend class SQLTagStore;
diff --git a/src/node_trace_events.cc b/src/node_trace_events.cc
index fec72919eb83..db0a37b85e13 100644
--- a/src/node_trace_events.cc
+++ b/src/node_trace_events.cc
@@ -133,7 +133,9 @@ static void SetTraceCategoryStateUpdateHandler(
 
 static void GetCategoryEnabledBuffer(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsString());
-
+  // The flag lives outside the V8 sandbox and cannot back an ArrayBuffer
+  // there; lib/internal/trace_events.js falls back to isTraceCategoryEnabled().
+#ifndef V8_ENABLE_SANDBOX
   Isolate* isolate = args.GetIsolate();
   node::Utf8Value category_name(isolate, args[0]);
 
@@ -150,6 +152,7 @@ static void GetCategoryEnabledBuffer(const FunctionCallbackInfo<Value>& args) {
   v8::Local<Uint8Array> u8 = v8::Uint8Array::New(ab, 0, 1);
 
   args.GetReturnValue().Set(u8);
+#endif
 }
 
 void NodeCategorySet::Initialize(Local<Object> target,
diff --git a/src/node_util.cc b/src/node_util.cc
index 6d3373caae6c..39523bd256c8 100644
--- a/src/node_util.cc
+++ b/src/node_util.cc
@@ -18,15 +18,18 @@ using v8::CFunction;
 using v8::Context;
 using v8::DictionaryTemplate;
 using v8::External;
+using v8::Function;
 using v8::FunctionCallbackInfo;
 using v8::IndexFilter;
 using v8::Integer;
 using v8::Isolate;
 using v8::KeyCollectionMode;
+using v8::kPromiseHandlerAddedAfterReject;
 using v8::Local;
 using v8::LocalVector;
 using v8::MaybeLocal;
 using v8::Name;
+using v8::Number;
 using v8::Object;
 using v8::ObjectTemplate;
 using v8::ONLY_CONFIGURABLE;
@@ -467,6 +470,26 @@ void MarkPromiseAsHandled(const FunctionCallbackInfo<Value>& args) {
   Local<Promise> promise = args[0].As<Promise>();
   promise->MarkAsHandled();
   promise->MarkAsSilent();
+
+  // If the promise is already rejected, then it may have already been
+  // reported to the unhandled rejection handler. Marking it as handled
+  // above does not trigger the v8 callback that updates it's status.
+  // So to avoid the notification we call out manually.
+  if (promise->State() == v8::Promise::kRejected) {
+    Environment* env = Environment::GetCurrent(args);
+    Local<Function> callback = env->promise_reject_callback();
+    CHECK(!callback.IsEmpty());
+
+    Local<Value> type =
+        Number::New(env->isolate(), kPromiseHandlerAddedAfterReject);
+    Local<Value> vargs[] = {type, promise, Undefined(env->isolate())};
+
+    USE(callback->Call(
+        env->context(), Undefined(env->isolate()), arraysize(vargs), vargs));
+
+    // Note that if callback->Call throws here, we go ahead and let that
+    // propagate.
+  }
 }
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
@@ -497,6 +520,25 @@ void Initialize(Local<Object> target,
   Environment* env = Environment::GetCurrent(context);
   Isolate* isolate = env->isolate();
 
+  {
+    const Local<Object> prototype =
+        SharedArrayBuffer::New(isolate, 0)->GetPrototypeV2().As<Object>();
+    const Local<Object> descriptor =
+        prototype
+            ->GetOwnPropertyDescriptor(
+                context, FIXED_ONE_BYTE_STRING(isolate, "growable"))
+            .ToLocalChecked()
+            .As<Object>();
+    const Local<Value> getter =
+        descriptor->Get(context, env->get_string()).ToLocalChecked();
+    CHECK(getter->IsFunction());
+    target
+        ->Set(context,
+              FIXED_ONE_BYTE_STRING(isolate, "getSharedArrayBufferGrowable"),
+              getter)
+        .Check();
+  }
+
   {
     Local<ObjectTemplate> tmpl = ObjectTemplate::New(isolate);
 #define V(PropertyName, _)                                                     \
diff --git a/src/node_worker.cc b/src/node_worker.cc
index 10386498e7df..e69c4d2d4247 100644
--- a/src/node_worker.cc
+++ b/src/node_worker.cc
@@ -16,6 +16,7 @@
 #include "v8-profiler.h"
 
 #include <memory>
+#include <optional>
 #include <string>
 #include <vector>
 
@@ -203,13 +204,13 @@ class WorkerThreadData {
       isolate->SetStackLimit(w->stack_base_);
 
       HandleScope handle_scope(isolate);
-      isolate_data_.reset(IsolateData::CreateIsolateData(
-          isolate,
-          &loop_,
-          w_->platform_,
-          allocator.get(),
-          w->snapshot_data()->AsEmbedderWrapper().get(),
-          std::move(w_->per_isolate_opts_)));
+      isolate_data_.reset(
+          IsolateData::CreateIsolateData(isolate,
+                                         &loop_,
+                                         w_->platform_,
+                                         allocator.get(),
+                                         w->snapshot_data(),
+                                         std::move(w_->per_isolate_opts_)));
       CHECK(isolate_data_);
       CHECK(!isolate_data_->is_building_snapshot());
       isolate_data_->set_worker_context(w_);
@@ -292,6 +293,18 @@ size_t Worker::NearHeapLimit(void* data, size_t current_heap_limit,
   return new_limit;
 }
 
+// Can this worker start by deserializing the bootstrapped principal context
+// from the embedded snapshot (plus the worker-side switches) instead of
+// bootstrapping from scratch? Only that snapshot qualifies: an embedder's own
+// or a --snapshot-blob one has run application code in its main context.
+// --no-worker-snapshot opts out; kNoBrowserGlobals changes the bootstrap.
+bool Worker::UseWorkerContextSnapshot() const {
+  return snapshot_data_ != nullptr &&
+         snapshot_data_ == SnapshotBuilder::GetEmbeddedSnapshotData() &&
+         !(environment_flags_ & EnvironmentFlags::kNoBrowserGlobals) &&
+         per_process::cli_options->per_isolate->worker_snapshot;
+}
+
 void Worker::Run() {
   std::string trace_name = "[worker " + std::to_string(thread_id_.id) + "]" +
                            (name_ == "" ? "" : " " + name_);
@@ -313,11 +326,6 @@ void Worker::Run() {
 
     DeleteFnPtr<Environment, FreeEnvironment> env_;
     auto cleanup_env = OnScopeLeave([&]() {
-      // TODO(addaleax): This call is harmless but should not be necessary.
-      // Figure out why V8 is raising a DCHECK() here without it
-      // (in test/parallel/test-async-hooks-worker-asyncfn-terminate-4.js).
-      isolate_->CancelTerminateExecution();
-
       if (!env_) return;
       env_->set_can_call_into_js(false);
 
@@ -340,7 +348,15 @@ void Worker::Run() {
         // resource constraints, we need something in place to handle it,
         // though.
         TryCatch try_catch(isolate_);
-        if (snapshot_data_ != nullptr) {
+        if (UseWorkerContextSnapshot()) {
+          // Leave `context` empty: CreateEnvironment() deserializes the
+          // bootstrapped principal context (kNodeMainContextIndex) and the
+          // Environment state that goes with it, applies the worker-side
+          // switches, and skips RunBootstrapping().
+          Debug(this,
+                "Worker %llu deserializes the bootstrapped context\n",
+                thread_id_.id);
+        } else if (snapshot_data_ != nullptr) {
           Debug(this,
                 "Worker %llu uses context from snapshot %d\n",
                 thread_id_.id,
@@ -357,7 +373,7 @@ void Worker::Run() {
               this, "Worker %llu builds context from scratch\n", thread_id_.id);
           context = NewContext(isolate_);
         }
-        if (context.IsEmpty()) {
+        if (context.IsEmpty() && !UseWorkerContextSnapshot()) {
           // TODO(joyeecheung): maybe this should be kBootstrapFailure instead?
           Exit(ExitCode::kGenericUserError,
                "ERR_WORKER_INIT_FAILED",
@@ -367,8 +383,8 @@ void Worker::Run() {
       }
 
       if (is_stopped()) return;
-      CHECK(!context.IsEmpty());
-      Context::Scope context_scope(context);
+      std::optional<Context::Scope> context_scope;
+      if (!context.IsEmpty()) context_scope.emplace(context);
       {
 #if HAVE_INSPECTOR
         environment_flags_ |= EnvironmentFlags::kNoWaitForInspectorFrontend;
@@ -384,6 +400,7 @@ void Worker::Run() {
             name_));
         if (is_stopped()) return;
         CHECK_NOT_NULL(env_);
+        if (!context_scope) context_scope.emplace(env_->context());
         env_->set_env_vars(std::move(env_vars_));
         SetProcessExitHandler(env_.get(), [this](Environment*, int exit_code) {
           Exit(static_cast<ExitCode>(exit_code));
@@ -1416,8 +1433,70 @@ void GetEnvMessagePort(const FunctionCallbackInfo<Value>& args) {
   }
 }
 
+// Per-thread values of the `worker` binding are lazy properties of the
+// per-isolate template, so that a bootstrapped context carries none of them
+// and can be deserialized by any thread.
+void ThreadIdGetter(Local<v8::Name>,
+                    const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  info.GetReturnValue().Set(static_cast<double>(env->thread_id()));
+}
+
+void ThreadNameGetter(Local<v8::Name>,
+                      const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  Local<String> name;
+  if (String::NewFromUtf8(info.GetIsolate(),
+                          env->thread_name().data(),
+                          NewStringType::kNormal,
+                          env->thread_name().size())
+          .ToLocal(&name)) {
+    info.GetReturnValue().Set(name);
+  }
+}
+
+void IsMainThreadGetter(Local<v8::Name>,
+                        const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(Environment::GetCurrent(info)->is_main_thread());
+}
+
+void IsInternalThreadGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  Worker* worker =
+      Environment::GetCurrent(info)->isolate_data()->worker_context();
+  info.GetReturnValue().Set(worker != nullptr && worker->is_internal());
+}
+
+void OwnsProcessStateGetter(Local<v8::Name>,
+                            const v8::PropertyCallbackInfo<Value>& info) {
+  info.GetReturnValue().Set(
+      Environment::GetCurrent(info)->owns_process_state());
+}
+
+void ResourceLimitsGetter(Local<v8::Name>,
+                          const v8::PropertyCallbackInfo<Value>& info) {
+  Environment* env = Environment::GetCurrent(info);
+  if (env->worker_context() != nullptr) {
+    info.GetReturnValue().Set(
+        env->worker_context()->GetResourceLimits(info.GetIsolate()));
+  }
+}
+
 void CreateWorkerPerIsolateProperties(IsolateData* isolate_data,
                                       Local<ObjectTemplate> target) {
+  {
+    Isolate* isolate = isolate_data->isolate();
+    auto lazy = [&](const char* name, v8::AccessorNameGetterCallback getter) {
+      target->SetLazyDataProperty(OneByteString(isolate, name), getter);
+    };
+    lazy("threadId", ThreadIdGetter);
+    lazy("threadName", ThreadNameGetter);
+    lazy("isMainThread", IsMainThreadGetter);
+    lazy("isInternalThread", IsInternalThreadGetter);
+    lazy("ownsProcessState", OwnsProcessStateGetter);
+    lazy("resourceLimits", ResourceLimitsGetter);
+  }
+
   Isolate* isolate = isolate_data->isolate();
 
   {
@@ -1522,55 +1601,9 @@ void CreateWorkerPerContextProperties(Local<Object> target,
                                       Local<Value> unused,
                                       Local<Context> context,
                                       void* priv) {
-  Environment* env = Environment::GetCurrent(context);
-  Isolate* isolate = env->isolate();
-
-  target
-      ->Set(env->context(),
-            env->thread_id_string(),
-            Number::New(isolate, static_cast<double>(env->thread_id())))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            env->thread_name_string(),
-            String::NewFromUtf8(isolate,
-                                env->thread_name().data(),
-                                NewStringType::kNormal,
-                                env->thread_name().size())
-                .ToLocalChecked())
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isMainThread"),
-            Boolean::New(isolate, env->is_main_thread()))
-      .Check();
-
-  Worker* worker = env->isolate_data()->worker_context();
-  bool is_internal = worker != nullptr && worker->is_internal();
-
-  // Set the is_internal property
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "isInternalThread"),
-            Boolean::New(isolate, is_internal))
-      .Check();
-
-  target
-      ->Set(env->context(),
-            FIXED_ONE_BYTE_STRING(isolate, "ownsProcessState"),
-            Boolean::New(isolate, env->owns_process_state()))
-      .Check();
-
-  if (!env->is_main_thread()) {
-    target
-        ->Set(env->context(),
-              FIXED_ONE_BYTE_STRING(isolate, "resourceLimits"),
-              env->worker_context()->GetResourceLimits(isolate))
-        .Check();
-  }
-
+  // threadId, threadName, isMainThread, isInternalThread, ownsProcessState
+  // and resourceLimits are lazy properties of the per-isolate template (see
+  // CreateWorkerPerIsolateProperties).
   NODE_DEFINE_CONSTANT(target, kMaxYoungGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kMaxOldGenerationSizeMb);
   NODE_DEFINE_CONSTANT(target, kCodeRangeSizeMb);
@@ -1580,6 +1613,12 @@ void CreateWorkerPerContextProperties(Local<Object> target,
 
 void RegisterExternalReferences(ExternalReferenceRegistry* registry) {
   registry->Register(GetEnvMessagePort);
+  registry->Register(ThreadIdGetter);
+  registry->Register(ThreadNameGetter);
+  registry->Register(IsMainThreadGetter);
+  registry->Register(IsInternalThreadGetter);
+  registry->Register(OwnsProcessStateGetter);
+  registry->Register(ResourceLimitsGetter);
   registry->Register(Worker::New);
   registry->Register(Worker::StartThread);
   registry->Register(Worker::StopThread);
diff --git a/src/node_worker.h b/src/node_worker.h
index fd02b1d381ed..894256053dc0 100644
--- a/src/node_worker.h
+++ b/src/node_worker.h
@@ -42,6 +42,7 @@ class Worker : public AsyncWrap {
 
   // Run the worker. This is only called from the worker thread.
   void Run();
+  bool UseWorkerContextSnapshot() const;
 
   // Forcibly exit the thread with a specified exit code. This may be called
   // from any thread. `error_code` and `error_message` can be used to create
diff --git a/src/node_zlib.cc b/src/node_zlib.cc
index af82aa2ae73b..c74e98c9cd11 100644
--- a/src/node_zlib.cc
+++ b/src/node_zlib.cc
@@ -336,7 +336,8 @@ class ZstdCompressContext final : public ZstdContext {
 
   // Zstd specific:
   CompressionError Init(uint64_t pledged_src_size,
-                        std::string_view dictionary = {});
+                        std::string_view dictionary = {},
+                        bool reject_garbage_after_end = false);
   CompressionError SetParameter(int key, int value);
 
   // Wrap ZSTD_freeCCtx to remove the return type.
@@ -365,7 +366,8 @@ class ZstdDecompressContext final : public ZstdContext {
 
   // Zstd specific:
   CompressionError Init(uint64_t pledged_src_size,
-                        std::string_view dictionary = {});
+                        std::string_view dictionary = {},
+                        bool reject_garbage_after_end = false);
 
   CompressionError SetParameter(int key, int value);
 
@@ -379,6 +381,11 @@ class ZstdDecompressContext final : public ZstdContext {
  private:
   DeleteFnPtr<ZSTD_DCtx, ZstdDecompressContext::FreeZstd> dctx_;
   bool frame_complete_ = false;
+  bool decoding_frame_after_complete_ = false;
+  bool reject_garbage_after_end_ = false;
+  bool ignoring_trailing_input_ = false;
+  size_t frame_prefix_size_ = 0;
+  uint8_t possible_frame_types_ = 0;
 };
 
 class CompressionStreamMemoryOwner {
@@ -947,9 +954,9 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
   }
 
   static void Init(const FunctionCallbackInfo<Value>& args) {
-    CHECK((args.Length() == 4 || args.Length() == 5) &&
+    CHECK((args.Length() >= 4 && args.Length() <= 6) &&
           "init(params, pledgedSrcSize, writeResult, writeCallback[, "
-          "dictionary])");
+          "dictionary[, rejectGarbageAfterEnd]])");
 
     ZstdStream* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
@@ -986,7 +993,7 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
     AllocScope alloc_scope(wrap);
     std::string_view dictionary;
     ArrayBufferViewContents<char> contents;
-    if (args.Length() == 5 && !args[4]->IsUndefined()) {
+    if (args.Length() >= 5 && !args[4]->IsUndefined()) {
       if (!args[4]->IsArrayBufferView()) {
         THROW_ERR_INVALID_ARG_TYPE(
             wrap->env(), "dictionary must be an ArrayBufferView if provided");
@@ -996,7 +1003,14 @@ class ZstdStream final : public CompressionStream<CompressionContext> {
       dictionary = std::string_view(contents.data(), contents.length());
     }
 
-    CompressionError err = wrap->context()->Init(pledged_src_size, dictionary);
+    bool reject_garbage_after_end = false;
+    if (args.Length() == 6) {
+      CHECK(args[5]->IsBoolean());
+      reject_garbage_after_end = args[5]->IsTrue();
+    }
+
+    CompressionError err = wrap->context()->Init(
+        pledged_src_size, dictionary, reject_garbage_after_end);
     if (err.IsError()) {
       wrap->EmitError(err);
       THROW_ERR_ZLIB_INITIALIZATION_FAILED(wrap->env(), err.message);
@@ -1661,7 +1675,8 @@ void ZstdCompressContext::Close() {
 }
 
 CompressionError ZstdCompressContext::Init(uint64_t pledged_src_size,
-                                           std::string_view dictionary) {
+                                           std::string_view dictionary,
+                                           bool) {
   pledged_src_size_ = pledged_src_size;
   if (pledged_src_size == ZSTD_CONTENTSIZE_UNKNOWN) {
     consumed_src_size_.reset();
@@ -1745,8 +1760,14 @@ void ZstdDecompressContext::Close() {
 }
 
 CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
-                                             std::string_view dictionary) {
+                                             std::string_view dictionary,
+                                             bool reject_garbage_after_end) {
   frame_complete_ = false;
+  decoding_frame_after_complete_ = false;
+  reject_garbage_after_end_ = reject_garbage_after_end;
+  ignoring_trailing_input_ = false;
+  frame_prefix_size_ = 0;
+  possible_frame_types_ = 0;
 
 #ifdef NODE_BUNDLED_ZSTD
   ZSTD_customMem custom_mem = {
@@ -1779,10 +1800,14 @@ CompressionError ZstdDecompressContext::Init(uint64_t pledged_src_size,
 CompressionError ZstdDecompressContext::ResetStream() {
   // We pass ZSTD_CONTENTSIZE_UNKNOWN because the argument is ignored for
   // decompression.
-  return Init(ZSTD_CONTENTSIZE_UNKNOWN);
+  return Init(ZSTD_CONTENTSIZE_UNKNOWN, {}, reject_garbage_after_end_);
 }
 
 void ZstdDecompressContext::DoThreadPoolWork() {
+  if (ignoring_trailing_input_) {
+    return;
+  }
+
   // The JavaScript processing loop retries with an empty input buffer when the
   // previous call filled the output buffer. Avoid interpreting that retry as
   // the beginning of a new, incomplete frame.
@@ -1790,15 +1815,64 @@ void ZstdDecompressContext::DoThreadPoolWork() {
     return;
   }
 
-  size_t const ret = ZSTD_decompressStream(dctx_.get(), &output_, &input_);
-  if (ZSTD_isError(ret)) {
-    frame_complete_ = false;
-    error_ = ZSTD_getErrorCode(ret);
-    error_code_string_ = ZstdStrerror(error_);
-    error_string_ = ZSTD_getErrorString(error_);
-  } else {
+  do {
+    if (frame_complete_) {
+      decoding_frame_after_complete_ = true;
+      frame_prefix_size_ = 0;
+      possible_frame_types_ = 0b11;
+    }
+
+    if (decoding_frame_after_complete_ && frame_prefix_size_ < 4) {
+      static constexpr uint8_t zstd_magic[] = {0x28, 0xb5, 0x2f, 0xfd};
+      static constexpr uint8_t skippable_magic[] = {0x50, 0x2a, 0x4d, 0x18};
+      const auto* data = static_cast<const uint8_t*>(input_.src);
+      size_t input_prefix_offset = 0;
+
+      while (frame_prefix_size_ < 4 &&
+             input_.pos + input_prefix_offset < input_.size) {
+        const size_t index = frame_prefix_size_;
+        const uint8_t byte = data[input_.pos + input_prefix_offset];
+        if (byte != zstd_magic[index]) {
+          possible_frame_types_ &= ~0b01;
+        }
+        if ((index == 0 && (byte & 0xf0) != skippable_magic[0]) ||
+            (index != 0 && byte != skippable_magic[index])) {
+          possible_frame_types_ &= ~0b10;
+        }
+        frame_prefix_size_++;
+        input_prefix_offset++;
+      }
+
+      if (possible_frame_types_ == 0) {
+        frame_complete_ = true;
+        decoding_frame_after_complete_ = false;
+        if (reject_garbage_after_end_) {
+          error_ = ZSTD_error_GENERIC;
+          error_code_string_ = "ERR_TRAILING_JUNK_AFTER_STREAM_END";
+          error_string_ =
+              "Trailing junk found after the end of the compressed stream";
+        } else {
+          ignoring_trailing_input_ = true;
+        }
+        return;
+      }
+    }
+
+    const size_t ret = ZSTD_decompressStream(dctx_.get(), &output_, &input_);
+    if (ZSTD_isError(ret)) {
+      frame_complete_ = false;
+      error_ = ZSTD_getErrorCode(ret);
+      error_code_string_ = ZstdStrerror(error_);
+      error_string_ = ZSTD_getErrorString(error_);
+      return;
+    }
+
     frame_complete_ = ret == 0;
-  }
+    if (frame_complete_) {
+      decoding_frame_after_complete_ = false;
+    }
+  } while (frame_complete_ && input_.pos < input_.size &&
+           output_.pos < output_.size);
 }
 
 CompressionError ZstdDecompressContext::GetErrorInfo() const {
@@ -1809,6 +1883,17 @@ CompressionError ZstdDecompressContext::GetErrorInfo() const {
 
   if (flush_ == ZSTD_e_end && !frame_complete_ && input_.pos == input_.size &&
       output_.pos < output_.size) {
+    if (decoding_frame_after_complete_) {
+      if (frame_prefix_size_ < 4) {
+        if (reject_garbage_after_end_) {
+          return CompressionError(
+              "Trailing junk found after the end of the compressed stream",
+              "ERR_TRAILING_JUNK_AFTER_STREAM_END",
+              -1);
+        }
+        return {};
+      }
+    }
     return CompressionError(
         "unexpected end of file", "Z_BUF_ERROR", Z_BUF_ERROR);
   }
diff --git a/src/quic/application.cc b/src/quic/application.cc
index f83b64bad49e..1e78b7931ce1 100644
--- a/src/quic/application.cc
+++ b/src/quic/application.cc
@@ -117,7 +117,7 @@ Maybe<Session::Application_Options> Session::Application_Options::From(
 
   // Ensure the advertised max_field_section_size in SETTINGS is at least
   // as large as max_header_length. Otherwise the peer would be told to
-  // restrict headers to a smaller size than what CanAddHeader accepts.
+  // restrict headers to a smaller size than what the HTTP/3 stream accepts.
   if (options.max_field_section_size < options.max_header_length) {
     options.max_field_section_size = options.max_header_length;
   }
diff --git a/src/quic/application.h b/src/quic/application.h
index df472e0a9fd7..0ae4ab53ab7e 100644
--- a/src/quic/application.h
+++ b/src/quic/application.h
@@ -11,6 +11,17 @@
 
 namespace node::quic {
 
+enum class HeadersKind : uint8_t {
+  HINTS,
+  INITIAL,
+  TRAILING,
+};
+
+enum class HeadersFlags : uint8_t {
+  NONE,
+  TERMINAL,
+};
+
 // An Application implements the ALPN-protocol specific semantics on behalf
 // of a QUIC Session.
 class Session::Application : public MemoryRetainer {
@@ -95,13 +106,10 @@ class Session::Application : public MemoryRetainer {
   // Application.
   virtual bool AcknowledgeStreamData(stream_id id, size_t datalen);
 
-  // Called to determine if a Header can be added to this application.
-  // Applications that do not support headers will always return false.
-  virtual bool CanAddHeader(size_t current_count,
-                            size_t current_headers_length,
-                            size_t this_header_length) {
-    return false;
-  }
+  // Called when a pending transport stream receives its stream ID. Protocols
+  // can use this to flush operations that require an opened stream. Returns
+  // false if deferred application data could not be submitted.
+  virtual bool StreamOpened(Stream& stream) { return true; }
 
   // Called when ngtcp2 reports NGTCP2_ERR_STREAM_SHUT_WR for a stream.
   // Applications that manage their own framing (e.g., HTTP/3) must inform
@@ -173,13 +181,19 @@ class Session::Application : public MemoryRetainer {
   // Submits an outbound block of headers for the given stream. Not all
   // Application types will support headers, in which case this function
   // should return false.
-  virtual bool SendHeaders(const Stream& stream,
+  virtual bool SendHeaders(Stream& stream,
                            HeadersKind kind,
                            const v8::Local<v8::Array>& headers,
                            HeadersFlags flags = HeadersFlags::NONE) {
     return false;
   }
 
+  // Updates JavaScript callback interest for an application's stream header
+  // events. Applications without header semantics ignore this.
+  virtual void SetHeadersInterest(Stream& stream,
+                                  bool wants_headers,
+                                  bool wants_trailers) {}
+
   // Returns true if the application protocol supports sending and
   // receiving headers on streams (e.g. HTTP/3). Applications that
   // do not support headers should return false (the default).
diff --git a/src/quic/bindingdata.cc b/src/quic/bindingdata.cc
index 31467a8477a7..d5711d88cb92 100644
--- a/src/quic/bindingdata.cc
+++ b/src/quic/bindingdata.cc
@@ -1,6 +1,7 @@
 #if HAVE_OPENSSL && HAVE_QUIC
 #include "guard.h"
 #ifndef OPENSSL_NO_QUIC
+#include <async_wrap-inl.h>
 #include <base_object-inl.h>
 #include <env-inl.h>
 #include <memory_tracker-inl.h>
@@ -13,13 +14,16 @@
 #include <node_realm-inl.h>
 #include <node_sockaddr-inl.h>
 #include <v8.h>
+#include "application.h"
 #include "bindingdata.h"
 #include "session.h"
 #include "session_manager.h"
+#include "streams.h"
 
 namespace node {
 
 using mem::kReserveSizeAndAlign;
+using v8::Array;
 using v8::DictionaryTemplate;
 using v8::Function;
 using v8::FunctionTemplate;
@@ -288,6 +292,26 @@ void nghttp3_debug_log(const char* fmt, va_list args) {
 void BindingData::InitPerContext(Realm* realm, Local<Object> target) {
   nghttp3_set_debug_vprintf_callback(nghttp3_debug_log);
   SetMethod(realm->context(), target, "setCallbacks", SetCallbacks);
+  SetMethod(realm->context(), target, "sendHeaders", SendHeaders);
+  SetMethod(realm->context(), target, "setHeadersInterest", SetHeadersInterest);
+
+  constexpr int QUIC_STREAM_HEADERS_KIND_HINTS =
+      static_cast<uint8_t>(HeadersKind::HINTS);
+  constexpr int QUIC_STREAM_HEADERS_KIND_INITIAL =
+      static_cast<uint8_t>(HeadersKind::INITIAL);
+  constexpr int QUIC_STREAM_HEADERS_KIND_TRAILING =
+      static_cast<uint8_t>(HeadersKind::TRAILING);
+  constexpr int QUIC_STREAM_HEADERS_FLAGS_NONE =
+      static_cast<uint8_t>(HeadersFlags::NONE);
+  constexpr int QUIC_STREAM_HEADERS_FLAGS_TERMINAL =
+      static_cast<uint8_t>(HeadersFlags::TERMINAL);
+
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_HINTS);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_INITIAL);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_TRAILING);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_NONE);
+  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_TERMINAL);
+
   Realm::GetCurrent(realm->context())->AddBindingData<BindingData>(target);
 }
 
@@ -295,6 +319,32 @@ void BindingData::RegisterExternalReferences(
     ExternalReferenceRegistry* registry) {
   registry->Register(IllegalConstructor);
   registry->Register(SetCallbacks);
+  registry->Register(SendHeaders);
+  registry->Register(SetHeadersInterest);
+}
+
+JS_METHOD_IMPL(BindingData::SendHeaders) {
+  Stream* stream;
+  ASSIGN_OR_RETURN_UNWRAP(&stream, args[0]);
+  CHECK(args[1]->IsUint32());  // Kind
+  CHECK(args[2]->IsArray());   // Headers
+  CHECK(args[3]->IsUint32());  // Flags
+
+  HeadersKind kind = FromV8Value<HeadersKind>(args[1]);
+  Local<Array> headers = args[2].As<Array>();
+  HeadersFlags flags = FromV8Value<HeadersFlags>(args[3]);
+
+  args.GetReturnValue().Set(stream->session().application().SendHeaders(
+      *stream, kind, headers, flags));
+}
+
+JS_METHOD_IMPL(BindingData::SetHeadersInterest) {
+  Stream* stream;
+  ASSIGN_OR_RETURN_UNWRAP(&stream, args[0]);
+  CHECK(args[1]->IsBoolean());
+  CHECK(args[2]->IsBoolean());
+  stream->session().application().SetHeadersInterest(
+      *stream, args[1]->IsTrue(), args[2]->IsTrue());
 }
 
 BindingData::BindingData(Realm* realm, Local<Object> object)
diff --git a/src/quic/bindingdata.h b/src/quic/bindingdata.h
index e4763b5b0d3e..e56c861261ad 100644
--- a/src/quic/bindingdata.h
+++ b/src/quic/bindingdata.h
@@ -294,6 +294,8 @@ class BindingData final
   // Installs the set of JavaScript callback functions that are used to
   // bridge out to the JS API.
   JS_METHOD(SetCallbacks);
+  JS_METHOD(SendHeaders);
+  JS_METHOD(SetHeadersInterest);
 
   // Lazily-created per-Realm SessionManager. Centralizes CID -> Session
   // routing so that any endpoint can route packets to any session.
diff --git a/src/quic/defs.h b/src/quic/defs.h
index 5184288475b1..32b3a10d7b80 100644
--- a/src/quic/defs.h
+++ b/src/quic/defs.h
@@ -300,17 +300,6 @@ enum class Direction : uint8_t {
   UNIDIRECTIONAL,
 };
 
-enum class HeadersKind : uint8_t {
-  HINTS,
-  INITIAL,
-  TRAILING,
-};
-
-enum class HeadersFlags : uint8_t {
-  NONE,
-  TERMINAL,
-};
-
 enum class StreamPriority : uint8_t {
   DEFAULT = NGHTTP3_DEFAULT_URGENCY,
   LOW = NGHTTP3_URGENCY_LOW,
diff --git a/src/quic/endpoint.cc b/src/quic/endpoint.cc
index a6a4109509ae..8a92986c5a9c 100644
--- a/src/quic/endpoint.cc
+++ b/src/quic/endpoint.cc
@@ -249,6 +249,17 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
     return Nothing<Options>();
   }
 
+  // SocketAddressLRU::Upsert requires a positive capacity. With max_size_ ==
+  // 0, the newly inserted entry is immediately evicted, and the final
+  // map_[address] creates a default list iterator that is then
+  // dereferenced, causing UB (observed as a SIGSEGV in Endpoint::Receive on
+  // the first accepted connection).
+  if (options.address_lru_size == 0) {
+    THROW_ERR_INVALID_ARG_VALUE(
+        env, "The addressLRUSize option must be greater than 0");
+    return Nothing<Options>();
+  }
+
   Local<Value> address;
   if (!params->Get(env->context(), env->address_string()).ToLocal(&address)) {
     return Nothing<Options>();
diff --git a/src/quic/http3.cc b/src/quic/http3.cc
index 8cbd2341e466..43ead1b8164e 100644
--- a/src/quic/http3.cc
+++ b/src/quic/http3.cc
@@ -22,7 +22,11 @@
 namespace node {
 
 using v8::Array;
+using v8::Global;
+using v8::Integer;
 using v8::Local;
+using v8::LocalVector;
+using v8::Value;
 
 namespace quic {
 
@@ -138,6 +142,25 @@ struct Http3HeaderTraits {
 
 using Http3Header = NgHeader<Http3HeaderTraits>;
 
+struct Http3StreamState final : public StreamApplicationState {
+  struct PendingHeaders final {
+    HeadersKind kind;
+    Global<Array> headers;
+    HeadersFlags flags;
+
+    PendingHeaders(HeadersKind kind, Global<Array> headers, HeadersFlags flags)
+        : kind(kind), headers(std::move(headers)), flags(flags) {}
+    DISALLOW_COPY_AND_MOVE(PendingHeaders)
+  };
+
+  std::vector<std::unique_ptr<PendingHeaders>> pending_headers;
+  std::vector<std::unique_ptr<Http3Header>> headers;
+  HeadersKind headers_kind = HeadersKind::INITIAL;
+  size_t headers_length = 0;
+  bool wants_headers = false;
+  bool wants_trailers = false;
+};
+
 // Implements the low-level HTTP/3 Application semantics.
 class Http3ApplicationImpl final : public Session::Application {
  public:
@@ -334,17 +357,6 @@ class Http3ApplicationImpl final : public Session::Application {
     return nghttp3_conn_add_ack_offset(*this, id, datalen) == 0;
   }
 
-  bool CanAddHeader(size_t current_count,
-                    size_t current_headers_length,
-                    size_t this_header_length) override {
-    // We cannot add the header if we've either reached
-    // * the max number of header pairs or
-    // * the max number of header bytes (name + value combined)
-    return (current_count < options_.max_header_pairs) &&
-           (current_headers_length + this_header_length) <=
-               options_.max_header_length;
-  }
-
   bool stream_fin_managed_by_application() const override { return true; }
 
   void StreamWriteShut(stream_id id) override {
@@ -537,75 +549,49 @@ class Http3ApplicationImpl final : public Session::Application {
     Application::ReceiveStreamStopSending(stream, std::move(error));
   }
 
-  bool SendHeaders(const Stream& stream,
-                   HeadersKind kind,
-                   const Local<Array>& headers,
-                   HeadersFlags flags = HeadersFlags::NONE) override {
-    Session::SendPendingDataScope send_scope(&session());
-    Http3Headers nva(env(), headers);
+  bool StreamOpened(Stream& stream) override {
+    auto* state = GetStreamState(stream);
+    if (state == nullptr || state->pending_headers.empty()) return true;
 
-    switch (kind) {
-      case HeadersKind::HINTS: {
-        if (!session().is_server()) {
-          // Client side cannot send hints
-          return false;
-        }
-        Debug(&session(),
-              "Submitting %" PRIu64 " early hints for stream %" PRIu64,
-              stream.id());
-        return nghttp3_conn_submit_info(
-                   *this, stream.id(), nva.data(), nva.length()) == 0;
-        break;
+    decltype(state->pending_headers) pending;
+    state->pending_headers.swap(pending);
+    Session::SendPendingDataScope send_scope(&session());
+    for (auto& headers : pending) {
+      if (!SubmitHeaders(stream,
+                         headers->kind,
+                         headers->headers.Get(env()->isolate()),
+                         headers->flags)) {
+        return false;
       }
-      case HeadersKind::INITIAL: {
-        static constexpr nghttp3_data_reader reader = {on_read_data_callback};
-        const nghttp3_data_reader* reader_ptr = nullptr;
-
-        // If the terminal flag is set, that means that we know we're only
-        // sending headers and no body and the stream writable side should be
-        // closed immediately because there is no nghttp3_data_reader provided.
-        if (flags != HeadersFlags::TERMINAL) {
-          reader_ptr = &reader;
-        }
+    }
+    return true;
+  }
 
-        if (session().is_server()) {
-          // If this is a server, we're submitting a response...
-          Debug(&session(),
-                "Submitting %" PRIu64 " response headers for stream %" PRIu64,
-                nva.length(),
-                stream.id());
-          return nghttp3_conn_submit_response(*this,
-                                              stream.id(),
-                                              nva.data(),
-                                              nva.length(),
-                                              reader_ptr) == 0;
-        } else {
-          // Otherwise we're submitting a request...
-          Debug(&session(),
-                "Submitting %" PRIu64 " request headers for stream %" PRIu64,
-                nva.length(),
-                stream.id());
-          return nghttp3_conn_submit_request(*this,
-                                             stream.id(),
-                                             nva.data(),
-                                             nva.length(),
-                                             reader_ptr,
-                                             const_cast<Stream*>(&stream)) == 0;
-        }
-        break;
-      }
-      case HeadersKind::TRAILING: {
-        Debug(&session(),
-              "Submitting %" PRIu64 " trailing headers for stream %" PRIu64,
-              nva.length(),
-              stream.id());
-        return nghttp3_conn_submit_trailers(
-                   *this, stream.id(), nva.data(), nva.length()) == 0;
-        break;
-      }
+  bool SendHeaders(Stream& stream,
+                   HeadersKind kind,
+                   const Local<Array>& headers,
+                   HeadersFlags flags = HeadersFlags::NONE) override {
+    if (kind == HeadersKind::HINTS && !session().is_server()) return false;
+
+    if (stream.is_pending()) {
+      Debug(&session(), "Enqueuing headers for pending HTTP/3 stream");
+      auto& state = GetOrCreateStreamState(stream);
+      state.pending_headers.push_back(
+          std::make_unique<Http3StreamState::PendingHeaders>(
+              kind, Global<Array>(env()->isolate(), headers), flags));
+      return true;
     }
 
-    return false;
+    Session::SendPendingDataScope send_scope(&session());
+    return SubmitHeaders(stream, kind, headers, flags);
+  }
+
+  void SetHeadersInterest(Stream& stream,
+                          bool wants_headers,
+                          bool wants_trailers) override {
+    auto& state = GetOrCreateStreamState(stream);
+    state.wants_headers = wants_headers;
+    state.wants_trailers = wants_trailers;
   }
 
   void SetStreamPriority(const Stream& stream,
@@ -642,8 +628,7 @@ class Http3ApplicationImpl final : public Session::Application {
     // PRIORITY_UPDATE frames). Client-side priority is tracked by the
     // Stream itself and returned directly from GetPriority in streams.cc.
     if (!session().is_server()) {
-      auto& stored = stream.stored_priority();
-      return {stored.priority, stored.flags};
+      return {stream.priority(), stream.priority_flags()};
     }
     nghttp3_pri pri;
     if (nghttp3_conn_get_stream_priority(*this, &pri, stream.id()) == 0) {
@@ -730,7 +715,7 @@ class Http3ApplicationImpl final : public Session::Application {
     // for the next writev_stream in the send loop.
     if (pending_trailers_stream_ == data->id) {
       pending_trailers_stream_ = -1;
-      if (data->stream) data->stream->EmitWantTrailers();
+      if (data->stream) EmitWantTrailers(*data->stream);
     }
     return true;
   }
@@ -750,6 +735,137 @@ class Http3ApplicationImpl final : public Session::Application {
            id == qpack_enc_stream_id_;
   }
 
+  bool SubmitHeaders(Stream& stream,
+                     HeadersKind kind,
+                     const Local<Array>& headers,
+                     HeadersFlags flags) {
+    Http3Headers nva(env(), headers);
+
+    switch (kind) {
+      case HeadersKind::HINTS: {
+        if (!session().is_server()) return false;
+        Debug(&session(),
+              "Submitting %" PRIu64 " early hints for stream %" PRIu64,
+              stream.id());
+        return nghttp3_conn_submit_info(
+                   *this, stream.id(), nva.data(), nva.length()) == 0;
+      }
+      case HeadersKind::INITIAL: {
+        static constexpr nghttp3_data_reader reader = {on_read_data_callback};
+        const nghttp3_data_reader* reader_ptr = nullptr;
+        if (flags != HeadersFlags::TERMINAL) reader_ptr = &reader;
+
+        if (session().is_server()) {
+          Debug(&session(),
+                "Submitting %" PRIu64 " response headers for stream %" PRIu64,
+                nva.length(),
+                stream.id());
+          return nghttp3_conn_submit_response(*this,
+                                              stream.id(),
+                                              nva.data(),
+                                              nva.length(),
+                                              reader_ptr) == 0;
+        }
+
+        Debug(&session(),
+              "Submitting %" PRIu64 " request headers for stream %" PRIu64,
+              nva.length(),
+              stream.id());
+        return nghttp3_conn_submit_request(*this,
+                                           stream.id(),
+                                           nva.data(),
+                                           nva.length(),
+                                           reader_ptr,
+                                           &stream) == 0;
+      }
+      case HeadersKind::TRAILING: {
+        Debug(&session(),
+              "Submitting %" PRIu64 " trailing headers for stream %" PRIu64,
+              nva.length(),
+              stream.id());
+        return nghttp3_conn_submit_trailers(
+                   *this, stream.id(), nva.data(), nva.length()) == 0;
+      }
+    }
+
+    return false;
+  }
+
+  Http3StreamState* GetStreamState(Stream& stream) const {
+    return static_cast<Http3StreamState*>(stream.application_state());
+  }
+
+  Http3StreamState& GetOrCreateStreamState(Stream& stream) {
+    if (stream.application_state() == nullptr) {
+      stream.set_application_state(std::make_unique<Http3StreamState>());
+    }
+    return *GetStreamState(stream);
+  }
+
+  void BeginHeaders(Stream& stream, HeadersKind kind) {
+    auto& state = GetOrCreateStreamState(stream);
+    state.headers_length = 0;
+    state.headers.clear();
+    state.headers_kind = kind;
+  }
+
+  bool AddHeader(Stream& stream, std::unique_ptr<Http3Header> header) {
+    auto& state = GetOrCreateStreamState(stream);
+    size_t length = header->length();
+    if (state.headers.size() >= options_.max_header_pairs ||
+        state.headers_length + length > options_.max_header_length) {
+      return false;
+    }
+    state.headers_length += length;
+    state.headers.push_back(std::move(header));
+    return true;
+  }
+
+  void EmitHeaders(Stream& stream) {
+    auto& state = GetOrCreateStreamState(stream);
+    stream.RecordReceivedActivity();
+    if (!env()->can_call_into_js() || !state.wants_headers) {
+      state.headers.clear();
+      return;
+    }
+
+    CallbackScope<Stream> cb_scope(&stream);
+    auto& binding = BindingData::Get(env());
+    size_t count = state.headers.size() * 2;
+    LocalVector<Value> values(env()->isolate(), count);
+
+    for (size_t i = 0; i < state.headers.size(); i++) {
+      Local<Value> name;
+      Local<Value> value;
+      if (!state.headers[i]->GetName(&binding).ToLocal(&name) ||
+          !state.headers[i]->GetValue(&binding).ToLocal(&value)) [[unlikely]] {
+        state.headers.clear();
+        return;
+      }
+      values[i * 2] = name;
+      values[i * 2 + 1] = value;
+    }
+
+    state.headers.clear();
+    Local<Value> argv[] = {
+        Array::New(env()->isolate(), values.data(), count),
+        Integer::NewFromUnsigned(env()->isolate(),
+                                 static_cast<uint32_t>(state.headers_kind))};
+    stream.MakeCallback(
+        binding.stream_headers_callback(), arraysize(argv), argv);
+  }
+
+  void EmitWantTrailers(Stream& stream) {
+    auto* state = GetStreamState(stream);
+    if (!env()->can_call_into_js() || state == nullptr ||
+        !state->wants_trailers) {
+      return;
+    }
+    CallbackScope<Stream> cb_scope(&stream);
+    stream.MakeCallback(
+        BindingData::Get(env()).stream_trailers_callback(), 0, nullptr);
+  }
+
   void BuildOriginPayload() {
     // Build the serialized ORIGIN frame payload from the SNI configuration.
     // Each origin entry is: 2-byte BE length + origin string.
@@ -831,7 +947,7 @@ class Http3ApplicationImpl final : public Session::Application {
           "HTTP/3 application beginning initial block of headers for stream "
           "%" PRIi64,
           id);
-    stream->BeginHeaders(HeadersKind::INITIAL);
+    BeginHeaders(*stream, HeadersKind::INITIAL);
   }
 
   void OnReceiveHeader(stream_id id, std::unique_ptr<Http3Header> header) {
@@ -843,7 +959,7 @@ class Http3ApplicationImpl final : public Session::Application {
       Debug(&session(),
             "HTTP/3 application switching to hints headers for stream %" PRIi64,
             stream->id());
-      stream->set_headers_kind(HeadersKind::HINTS);
+      GetOrCreateStreamState(*stream).headers_kind = HeadersKind::HINTS;
     }
     IF_QUIC_DEBUG(env()) {
       Debug(&session(),
@@ -851,7 +967,7 @@ class Http3ApplicationImpl final : public Session::Application {
             header->name(),
             header->value());
     }
-    stream->AddHeader(std::move(header));
+    AddHeader(*stream, std::move(header));
   }
 
   void OnEndHeaders(stream_id id, int fin) {
@@ -861,8 +977,8 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application received end of headers for stream %" PRIi64,
           id);
-    stream->EmitHeaders();
-    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    EmitHeaders(*stream);
+    // EmitHeaders calls into JavaScript, which can synchronously destroy the
     // stream. Its arena-backed state is released by Destroy(), so do not touch
     // the stream again if that happened.
     if (stream->is_destroyed()) return;
@@ -884,7 +1000,7 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application beginning block of trailers for stream %" PRIi64,
           id);
-    stream->BeginHeaders(HeadersKind::TRAILING);
+    BeginHeaders(*stream, HeadersKind::TRAILING);
   }
 
   void OnReceiveTrailer(stream_id id, std::unique_ptr<Http3Header> header) {
@@ -897,7 +1013,7 @@ class Http3ApplicationImpl final : public Session::Application {
             header->name(),
             header->value());
     }
-    stream->AddHeader(std::move(header));
+    AddHeader(*stream, std::move(header));
   }
 
   void OnEndTrailers(stream_id id, int fin) {
@@ -907,8 +1023,8 @@ class Http3ApplicationImpl final : public Session::Application {
     Debug(&session(),
           "HTTP/3 application received end of trailers for stream %" PRIi64,
           id);
-    stream->EmitHeaders();
-    // EmitHeaders() calls into JavaScript, which can synchronously destroy the
+    EmitHeaders(*stream);
+    // EmitHeaders calls into JavaScript, which can synchronously destroy the
     // stream. Its arena-backed state is released by Destroy(), so do not touch
     // the stream again if that happened.
     if (stream->is_destroyed()) return;
@@ -1112,7 +1228,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
     if (stream->is_eos()) {
       *pflags |= NGHTTP3_DATA_FLAG_EOF;
-      if (stream->wants_trailers()) {
+      if (app.GetOrCreateStreamState(*stream).wants_trailers) {
         *pflags |= NGHTTP3_DATA_FLAG_NO_END_STREAM;
         app.pending_trailers_stream_ = id;
       }
@@ -1131,7 +1247,7 @@ class Http3ApplicationImpl final : public Session::Application {
               return;
             case bob::Status::STATUS_EOS:
               *pflags |= NGHTTP3_DATA_FLAG_EOF;
-              if (stream->wants_trailers()) {
+              if (app.GetOrCreateStreamState(*stream).wants_trailers) {
                 *pflags |= NGHTTP3_DATA_FLAG_NO_END_STREAM;
                 app.pending_trailers_stream_ = id;
               }
@@ -1430,7 +1546,7 @@ class Http3ApplicationImpl final : public Session::Application {
 
   static constexpr nghttp3_callbacks kCallbacks = {
       on_acked_stream_data,
-      nullptr,  // nghttp3_stream_close (deprecated)
+      nullptr,  // stream_close (deprecated, use v2 below)
       on_receive_data,
       on_deferred_consume,
       on_begin_headers,
@@ -1443,7 +1559,7 @@ class Http3ApplicationImpl final : public Session::Application {
       on_end_stream,
       on_do_reset_stream,
       on_shutdown,
-      nullptr,  // recv_settings (deprecated)
+      nullptr,  // recv_settings (deprecated, use v2 below)
       on_receive_origin,
       on_end_origin,
       on_rand,
diff --git a/src/quic/session.cc b/src/quic/session.cc
index 4a35666e34ad..1c159d763521 100644
--- a/src/quic/session.cc
+++ b/src/quic/session.cc
@@ -1653,7 +1653,7 @@ struct Session::Impl final : public MemoryRetainer {
 
   static constexpr ngtcp2_callbacks CLIENT = {
       ngtcp2_crypto_client_initial_cb,
-      nullptr,  // stream_stop_sending
+      nullptr,  // recv_client_initial
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
       on_receive_version_negotiation,
@@ -1687,7 +1687,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
       on_receive_rx_key,
       on_receive_tx_key,
@@ -1697,20 +1697,18 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 
   static constexpr ngtcp2_callbacks SERVER = {
-      nullptr,  // stream_stop_sending
+      nullptr,  // client_initial
       ngtcp2_crypto_recv_client_initial_cb,
       ngtcp2_crypto_recv_crypto_data_cb,
       on_handshake_completed,
-      nullptr,
+      nullptr,  // recv_version_negotiation
       ngtcp2_crypto_encrypt_cb,
       ngtcp2_crypto_decrypt_cb,
       ngtcp2_crypto_hp_mask_cb,
@@ -1719,7 +1717,7 @@ struct Session::Impl final : public MemoryRetainer {
       on_stream_open,
       on_stream_close,
       nullptr,  // recv_stateless_reset (deprecated, use v2 below)
-      nullptr,
+      nullptr,  // recv_retry
       on_extend_max_streams_bidi,
       on_extend_max_streams_uni,
       on_rand,
@@ -1727,23 +1725,23 @@ struct Session::Impl final : public MemoryRetainer {
       on_remove_connection_id,
       ngtcp2_crypto_update_key_cb,
       on_path_validation,
-      nullptr,
+      nullptr,  // select_preferred_addr
       on_stream_reset,
       on_extend_max_remote_streams_bidi,
       on_extend_max_remote_streams_uni,
       on_extend_max_stream_data,
       nullptr,  // dcid_status (deprecated, use v2 below)
-      nullptr,
-      nullptr,
+      nullptr,  // handshake_confirmed
+      nullptr,  // recv_new_token
       ngtcp2_crypto_delete_crypto_aead_ctx_cb,
       ngtcp2_crypto_delete_crypto_cipher_ctx_cb,
       on_receive_datagram,
       on_acknowledge_datagram,
       on_lost_datagram,
       nullptr,  // get_path_challenge_data (deprecated, use v2 below)
-      nullptr,  // stream_stop_sending
+      nullptr,  // stream_stop_sending (deprecated, use v2 below)
       ngtcp2_crypto_version_negotiation_cb,
-      nullptr,
+      nullptr,  // recv_rx_key
       on_receive_tx_key,
       on_early_data_rejected,
       on_begin_path_validation,
@@ -1751,12 +1749,10 @@ struct Session::Impl final : public MemoryRetainer {
       on_get_new_cid,
       on_cid_status,
       ngtcp2_crypto_get_path_challenge_data2_cb,
-#ifdef NGTCP2_CALLBACKS_V4
       on_receive_stream_stop_sending,
 #ifdef NGTCP2_CALLBACKS_V5
-      nullptr,
-#endif  // NGTCP2_CALLBACKS_V5
-#endif  // NGTCP2_CALLBACKS_V4
+      nullptr,  // stream_close2
+#endif
   };
 };
 
diff --git a/src/quic/streams.cc b/src/quic/streams.cc
index 1f8761c75049..9a11bb4d591e 100644
--- a/src/quic/streams.cc
+++ b/src/quic/streams.cc
@@ -26,12 +26,10 @@ using v8::BackingStore;
 using v8::BackingStoreInitializationMode;
 using v8::BigInt;
 using v8::FunctionCallbackInfo;
-using v8::Global;
 using v8::HandleScope;
 using v8::Integer;
 using v8::Just;
 using v8::Local;
-using v8::LocalVector;
 using v8::Maybe;
 using v8::Nothing;
 using v8::Object;
@@ -57,14 +55,10 @@ namespace quic {
   V(HAS_READER, has_reader, uint8_t)                                           \
   /* Set when the stream has a block event handler */                          \
   V(WANTS_BLOCK, wants_block, uint8_t)                                         \
-  /* Set when the stream has a headers event handler */                        \
-  V(WANTS_HEADERS, wants_headers, uint8_t)                                     \
   /* Set when the stream has a reset event handler */                          \
   V(WANTS_RESET, wants_reset, uint8_t)                                         \
   /* Set when the stream has a stop sending event handler */                   \
   V(WANTS_STOP_SENDING, wants_stop_sending, uint8_t)                           \
-  /* Set when the stream has a trailers event handler */                       \
-  V(WANTS_TRAILERS, wants_trailers, uint8_t)                                   \
   /* True when 0-RTT early data was received */                                \
   V(RECEIVED_EARLY_DATA, received_early_data, uint8_t)                         \
   V(WRITE_DESIRED_SIZE, write_desired_size, uint32_t)                          \
@@ -98,7 +92,6 @@ namespace quic {
 #define STREAM_JS_METHODS(V)                                                   \
   V(AttachSource, attachSource, false)                                         \
   V(Destroy, destroy, false)                                                   \
-  V(SendHeaders, sendHeaders, false)                                           \
   V(StopSending, stopSending, false)                                           \
   V(ResetStream, resetStream, false)                                           \
   V(SetPriority, setPriority, false)                                           \
@@ -227,17 +220,6 @@ void PendingStream::reject(QuicError error) {
   stream_->Destroy(error);
 }
 
-struct Stream::PendingHeaders {
-  HeadersKind kind;
-  Global<Array> headers;
-  HeadersFlags flags;
-  PendingHeaders(HeadersKind kind_, Global<Array> headers_, HeadersFlags flags_)
-      : kind(kind_), headers(std::move(headers_)), flags(flags_) {}
-  DISALLOW_COPY_AND_MOVE(PendingHeaders)
-};
-
-// ============================================================================
-
 struct Stream::State {
 #define V(_, name, type) type name;
   STREAM_STATE(V)
@@ -445,37 +427,6 @@ struct Stream::Impl {
     }
   }
 
-  // Sends a block of headers to the peer. If the stream is not yet open,
-  // the headers will be queued and sent immediately when the stream is
-  // opened. Returns false if the application does not support headers.
-  JS_METHOD(SendHeaders) {
-    Stream* stream;
-    ASSIGN_OR_RETURN_UNWRAP(&stream, args.This());
-    CHECK(args[0]->IsUint32());  // Kind
-    CHECK(args[1]->IsArray());   // Headers
-    CHECK(args[2]->IsUint32());  // Flags
-
-    HeadersKind kind = FromV8Value<HeadersKind>(args[0]);
-    Local<Array> headers = args[1].As<Array>();
-    HeadersFlags flags = FromV8Value<HeadersFlags>(args[2]);
-
-    // If the stream is pending, the headers will be queued until the
-    // stream is opened, at which time the queued header block will be
-    // immediately sent when the stream is opened. If we already know
-    // that the application does not support headers, return false
-    // immediately so the JS side can throw an appropriate error.
-    if (stream->is_pending()) {
-      if (!stream->session().application().SupportsHeaders()) {
-        return args.GetReturnValue().Set(false);
-      }
-      stream->EnqueuePendingHeaders(kind, headers, flags);
-      return args.GetReturnValue().Set(true);
-    }
-
-    args.GetReturnValue().Set(stream->session().application().SendHeaders(
-        *stream, kind, headers, flags));
-  }
-
   // Tells the peer to stop sending data for this stream. This has the effect
   // of shutting down the readable side of the stream for this peer. Any data
   // that has already been received is still readable.
@@ -1057,25 +1008,6 @@ void Stream::InitPerContext(Realm* realm, Local<Object> target) {
 #undef V
 
   NODE_DEFINE_CONSTANT(target, IDX_STATS_STREAM_COUNT);
-
-  constexpr int QUIC_STREAM_HEADERS_KIND_HINTS =
-      static_cast<uint8_t>(HeadersKind::HINTS);
-  constexpr int QUIC_STREAM_HEADERS_KIND_INITIAL =
-      static_cast<uint8_t>(HeadersKind::INITIAL);
-  constexpr int QUIC_STREAM_HEADERS_KIND_TRAILING =
-      static_cast<uint8_t>(HeadersKind::TRAILING);
-
-  constexpr int QUIC_STREAM_HEADERS_FLAGS_NONE =
-      static_cast<uint8_t>(HeadersFlags::NONE);
-  constexpr int QUIC_STREAM_HEADERS_FLAGS_TERMINAL =
-      static_cast<uint8_t>(HeadersFlags::TERMINAL);
-
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_HINTS);
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_INITIAL);
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_KIND_TRAILING);
-
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_NONE);
-  NODE_DEFINE_CONSTANT(target, QUIC_STREAM_HEADERS_FLAGS_TERMINAL);
 }
 
 Stream* Stream::From(void* stream_user_data) {
@@ -1243,25 +1175,6 @@ void Stream::NotifyStreamOpened(stream_id id) {
         *this, priority_.priority, priority_.flags);
     priority_.pending = false;
   }
-  if (!pending_headers_queue_.empty()) {
-    if (!session().application().SupportsHeaders()) {
-      // Headers were enqueued while the application was not yet known
-      // (headers_supported == 0), and the negotiated application does
-      // not support headers. This is a fatal mismatch.
-      Destroy(QuicError::ForApplication(
-          session().application().GetInternalErrorCode()));
-      return;
-    }
-    decltype(pending_headers_queue_) queue;
-    pending_headers_queue_.swap(queue);
-    for (auto& headers : queue) {
-      session().application().SendHeaders(
-          *this,
-          headers->kind,
-          headers->headers.Get(env()->isolate()),
-          headers->flags);
-    }
-  }
   // If the stream is not a local unidirectional stream and is_readable is
   // false, then we should shutdown the streams readable side now.
   if (!is_local_unidirectional() && !is_readable()) {
@@ -1277,6 +1190,15 @@ void Stream::NotifyStreamOpened(stream_id id) {
   // since the stream likely hasn't had any opporunity to get blocked
   // yet, but just for completeness, let's make sure.
   if (outbound_) session().ResumeStream(id);
+
+  // This may make application data sendable, so keep it as the final action:
+  // sending can eventually call into JavaScript and destroy the stream.
+  BaseObjectPtr<Stream> self(this);
+  auto& application = session().application();
+  error_code internal_error = application.GetInternalErrorCode();
+  if (!application.StreamOpened(*this) && !is_destroyed()) {
+    Destroy(QuicError::ForApplication(internal_error));
+  }
 }
 
 void Stream::NotifyReadableEnded(error_code code) {
@@ -1291,14 +1213,6 @@ void Stream::NotifyWritableEnded(error_code code) {
   ngtcp2_conn_shutdown_stream_write(session(), 0, id(), code);
 }
 
-void Stream::EnqueuePendingHeaders(HeadersKind kind,
-                                   Local<Array> headers,
-                                   HeadersFlags flags) {
-  Debug(this, "Enqueuing headers for pending stream");
-  pending_headers_queue_.push_back(std::make_unique<PendingHeaders>(
-      kind, Global<Array>(env()->isolate(), headers), flags));
-}
-
 bool Stream::is_pending() const {
   return state()->pending;
 }
@@ -1336,6 +1250,10 @@ uint64_t Stream::last_activity_timestamp() const {
   return ts != 0 ? ts : stats()->created_at;
 }
 
+void Stream::RecordReceivedActivity() {
+  STAT_RECORD_TIMESTAMP(Stats, received_at);
+}
+
 bool Stream::is_local_unidirectional() const {
   return direction() == Direction::UNIDIRECTIONAL &&
          ngtcp2_conn_is_local_stream(*session_, id());
@@ -1350,10 +1268,6 @@ bool Stream::is_eos() const {
   return state()->fin_sent;
 }
 
-bool Stream::wants_trailers() const {
-  return state()->wants_trailers;
-}
-
 void Stream::set_early() {
   state()->received_early_data = 1;
 }
@@ -1587,28 +1501,6 @@ int Stream::DoPull(bob::Next<ngtcp2_vec> next,
   return outbound_->Pull(std::move(next), options, data, count, max_count_hint);
 }
 
-void Stream::BeginHeaders(HeadersKind kind) {
-  headers_length_ = 0;
-  headers_.clear();
-  set_headers_kind(kind);
-}
-
-void Stream::set_headers_kind(HeadersKind kind) {
-  headers_kind_ = kind;
-}
-
-bool Stream::AddHeader(std::unique_ptr<Header> header) {
-  size_t len = header->length();
-  if (!session_->application().CanAddHeader(
-          headers_.size(), headers_length_, len)) {
-    return false;
-  }
-
-  headers_length_ += len;
-  headers_.push_back(std::move(header));
-  return true;
-}
-
 void Stream::Acknowledge(size_t datalen) {
   if (outbound_ == nullptr) return;
 
@@ -1680,6 +1572,7 @@ void Stream::Destroy(QuicError error) {
 
   // We are going to release our reference to the outbound_ queue here.
   outbound_.reset();
+  application_state_.reset();
 
   // EndReadable() above already flushed accumulated data. Just release
   // the ring buffer memory.
@@ -1959,42 +1852,6 @@ void Stream::EmitClose(const QuicError& error) {
   MakeCallback(BindingData::Get(env()).stream_close_callback(), 1, &err);
 }
 
-void Stream::EmitHeaders() {
-  STAT_RECORD_TIMESTAMP(Stats, received_at);
-  // state()->wants_headers will be set from the javascript side if the
-  // stream object has a handler for the headers event.
-  if (!env()->can_call_into_js() || !state()->wants_headers) {
-    headers_.clear();
-    return;
-  }
-  CallbackScope<Stream> cb_scope(this);
-
-  auto& binding = BindingData::Get(env());
-  size_t count = headers_.size() * 2;
-  LocalVector<Value> values(env()->isolate(), count);
-
-  for (size_t i = 0; i < headers_.size(); i++) {
-    Local<Value> name;
-    Local<Value> value;
-    if (!headers_[i]->GetName(&binding).ToLocal(&name) ||
-        !headers_[i]->GetValue(&binding).ToLocal(&value)) [[unlikely]] {
-      headers_.clear();
-      return;
-    }
-    values[i * 2] = name;
-    values[i * 2 + 1] = value;
-  }
-
-  headers_.clear();
-
-  Local<Value> argv[] = {
-      Array::New(env()->isolate(), values.data(), count),
-      Integer::NewFromUnsigned(env()->isolate(),
-                               static_cast<uint32_t>(headers_kind_))};
-
-  MakeCallback(binding.stream_headers_callback(), arraysize(argv), argv);
-}
-
 void Stream::EmitReset(const QuicError& error) {
   // state()->wants_reset will be set from the javascript side if the
   // stream object has a handler for the reset event.
@@ -2019,16 +1876,6 @@ void Stream::EmitStopSending(const QuicError& error) {
   MakeCallback(BindingData::Get(env()).stream_stop_sending_callback(), 1, &err);
 }
 
-void Stream::EmitWantTrailers() {
-  // state()->wants_trailers will be set from the javascript side if the
-  // stream object has a handler for the trailers event.
-  if (!env()->can_call_into_js() || !state()->wants_trailers) {
-    return;
-  }
-  CallbackScope<Stream> cb_scope(this);
-  MakeCallback(BindingData::Get(env()).stream_trailers_callback(), 0, nullptr);
-}
-
 // ============================================================================
 
 void Stream::Schedule(Queue* queue) {
diff --git a/src/quic/streams.h b/src/quic/streams.h
index cd4849aae277..1ea85f216524 100644
--- a/src/quic/streams.h
+++ b/src/quic/streams.h
@@ -10,7 +10,6 @@
 #include <memory_tracker.h>
 #include <node_blob.h>
 #include <node_bob.h>
-#include <node_http_common.h>
 #include <util.h>
 #include "bindingdata.h"
 #include "data.h"
@@ -22,6 +21,14 @@ namespace node::quic {
 class Session;
 class Stream;
 
+// Optional per-stream state owned by the negotiated application protocol.
+// Stream deliberately treats this as opaque so protocol semantics do not
+// become part of the transport stream abstraction.
+class StreamApplicationState {
+ public:
+  virtual ~StreamApplicationState() = default;
+};
+
 // An elastic ring buffer used by Stream to coalesce received data before
 // flushing it into the DataQueue. This avoids creating many small V8
 // BackingStore allocations from per-QUIC-frame ngtcp2 callbacks. Data is
@@ -179,11 +186,6 @@ class PendingStream final {
 // that the stream is gone. Any data that has already been received and is in
 // the inbound queue is preserved and may be read by the application.
 //
-// QUIC streams in general do not have headers. Some QUIC applications, however,
-// may associate headers with the stream (HTTP/3 for instance). As a
-// convenience, the Stream class will hold onto these headers for the
-// application.
-//
 // Streams may be created in a pending state. This means that while the Stream
 // object is created, it has not yet been opened in ngtcp2 and therefore has
 // no official status yet. Certain operations can still be performed on the
@@ -202,8 +204,6 @@ class Stream final : public AsyncWrap,
                      public Ngtcp2Source,
                      public DataQueue::BackpressureListener {
  public:
-  using Header = NgHeaderBase<BindingData>;
-
   // Acquire a DataQueue from the given value if it is valid. The return
   // follows the typical V8 rules for Maybe types. If an error occurs,
   // the Maybe will be empty and an exception will be set on the isolate.
@@ -263,6 +263,10 @@ class Stream final : public AsyncWrap,
   // otherwise falls back to created_at. Returns 0 if neither is set.
   uint64_t last_activity_timestamp() const;
 
+  // Records protocol-level receive activity that does not pass through
+  // ReceiveData(), such as application framing metadata.
+  void RecordReceivedActivity();
+
   // True if this stream was created in a pending state and is still waiting
   // to be created.
   bool is_pending() const;
@@ -276,9 +280,6 @@ class Stream final : public AsyncWrap,
   // data to be acknowledged by the remote peer.
   bool is_eos() const;
 
-  // True if the stream wants to send trailing headers after the body.
-  bool wants_trailers() const;
-
   // Marks this stream as having received 0-RTT early data.
   void set_early();
 
@@ -297,6 +298,17 @@ class Stream final : public AsyncWrap,
   // Returns the Blob::Reader for the inbound data, or nullptr.
   Blob::Reader* reader() const;
 
+  StreamApplicationState* application_state() const {
+    return application_state_.get();
+  }
+  void set_application_state(
+      std::unique_ptr<StreamApplicationState> application_state) {
+    application_state_ = std::move(application_state);
+  }
+
+  StreamPriority priority() const { return priority_.priority; }
+  StreamPriorityFlags priority_flags() const { return priority_.flags; }
+
   // Called by the session/application to indicate that the specified number
   // of bytes have been acknowledged by the peer.
   void Acknowledge(size_t datalen);
@@ -308,6 +320,10 @@ class Stream final : public AsyncWrap,
   // acknowledged to have been received by the peer.
   void Commit(size_t datalen, bool fin = false);
 
+  // Updates the write_desired_size state field based on current flow control
+  // and outbound buffer state. Emits drain if transitioning from 0 to > 0.
+  void UpdateWriteDesiredSize();
+
   void EndWritable();
   void EndReadable(std::optional<uint64_t> maybe_final_size = std::nullopt);
   void EntryRead(size_t amount) override;
@@ -355,18 +371,8 @@ class Stream final : public AsyncWrap,
   // that has already been received is still readable.
   void SendStopSending(error_code code);
 
-  // Currently, only HTTP/3 streams support headers. These methods are here
-  // to support that. They are not used when using any other QUIC application.
-
-  void BeginHeaders(HeadersKind kind);
-  void set_headers_kind(HeadersKind kind);
-  // Returns false if the header cannot be added. This will typically happen
-  // if the application does not support headers, a maximum number of headers
-  // have already been added, or the maximum total header length is reached.
-  bool AddHeader(std::unique_ptr<Header> header);
-
   // TODO(@jasnell): Implement MemoryInfo to track outbound_, inbound_,
-  // reader_, headers_, and pending_headers_queue_.
+  // reader_, and application_state_.
   SET_NO_MEMORY_INFO()
   SET_MEMORY_INFO_NAME(Stream)
   SET_SELF_SIZE(Stream)
@@ -387,7 +393,6 @@ class Stream final : public AsyncWrap,
 
  private:
   struct Impl;
-  struct PendingHeaders;
 
   class Outbound;
 
@@ -437,11 +442,6 @@ class Stream final : public AsyncWrap,
   // Notifies the JavaScript side that the peer asked it to stop sending.
   void EmitStopSending(const QuicError& error);
 
-  // Notifies the JavaScript side that the application is ready to receive
-  // trailing headers. Any trailing headers must be sent immediately, and
-  // synchronously when this callback is triggered.
-  void EmitWantTrailers();
-
   // Notifies the JavaScript side that sending data on the stream has been
   // blocked because of flow control restriction.
   void EmitBlocked();
@@ -450,23 +450,12 @@ class Stream final : public AsyncWrap,
   // for more data. Fires when write_desired_size transitions from 0 to > 0.
   void EmitDrain();
 
-  // Updates the write_desired_size state field based on current flow control
-  // and outbound buffer state. Emits drain if transitioning from 0 to > 0.
-  void UpdateWriteDesiredSize();
-
-  // Delivers the set of inbound headers that have been collected.
-  void EmitHeaders();
-
   void NotifyReadableEnded(error_code code);
   void NotifyWritableEnded(error_code code);
 
   // When a pending stream is finally opened, the NotifyStreamOpened method
   // will be called and the id will be assigned.
   void NotifyStreamOpened(stream_id id);
-  void EnqueuePendingHeaders(HeadersKind kind,
-                             v8::Local<v8::Array> headers,
-                             HeadersFlags flags);
-
   ArenaSlotBase stats_slot_;
   ArenaSlotBase state_slot_;
   BaseObjectWeakPtr<Session> session_;
@@ -474,6 +463,7 @@ class Stream final : public AsyncWrap,
   std::shared_ptr<DataQueue> inbound_;
   BaseObjectWeakPtr<Blob::Reader> reader_;
   std::unique_ptr<RecvAccumulator> recv_accumulator_;
+  std::unique_ptr<StreamApplicationState> application_state_;
 
   // Bytes delivered to ReceiveData() that still hold inbound flow control
   // credit. Returned incrementally as the consumer reads them, and in bulk
@@ -488,7 +478,6 @@ class Stream final : public AsyncWrap,
   // and the stream id will be assigned.
   std::optional<std::unique_ptr<PendingStream>> maybe_pending_stream_ =
       std::nullopt;
-  std::vector<std::unique_ptr<PendingHeaders>> pending_headers_queue_;
   error_code pending_close_read_code_ = 0;
   error_code pending_close_write_code_ = 0;
 
@@ -499,26 +488,8 @@ class Stream final : public AsyncWrap,
   };
   StoredPriority priority_;
 
-  const StoredPriority& stored_priority() const { return priority_; }
-
-  // The headers_ field holds a block of headers that have been received and
-  // are being buffered for delivery to the JavaScript side. Headers are
-  // stored as C++ objects during collection (AddHeader) and converted to
-  // V8 strings only when emitted (EmitHeaders), avoiding StrongRootAllocator
-  // mutex contention on the per-header hot path.
-  std::vector<std::unique_ptr<Header>> headers_;
-
-  // The headers_kind_ field indicates the kind of headers that are being
-  // buffered.
-  HeadersKind headers_kind_ = HeadersKind::INITIAL;
-
-  // The headers_length_ field holds the total length of the headers that have
-  // been buffered.
-  size_t headers_length_ = 0;
-
   friend struct Impl;
   friend class PendingStream;
-  friend class Http3ApplicationImpl;
   friend class DefaultApplication;
 
  public:
diff --git a/src/stream_base.cc b/src/stream_base.cc
index 688e2edb4557..e0f3b941ae67 100644
--- a/src/stream_base.cc
+++ b/src/stream_base.cc
@@ -175,6 +175,23 @@ int StreamBase::Shutdown(const FunctionCallbackInfo<Value>& args) {
 void StreamBase::SetWriteResult(const StreamWriteResult& res) {
   env_->stream_base_state()[kBytesWritten] = res.bytes;
   env_->stream_base_state()[kLastWriteWasAsync] = res.async;
+  env_->stream_base_state()[kLastWriteErr] = res.err;
+}
+
+// Finish a JS-initiated write. When the caller did not pass a request
+// object (`lazy_req`), the write wrap object exists only if the write did
+// not complete synchronously; hand it to JS so that it can attach its
+// completion callback. Otherwise the numeric error code (via JSMethod) is
+// all JS needs.
+int StreamBase::FinishWrite(const v8::FunctionCallbackInfo<v8::Value>& args,
+                            const StreamWriteResult& res,
+                            bool lazy_req) {
+  SetWriteResult(res);
+  if (lazy_req && res.wrap_obj) {
+    args.GetReturnValue().Set(res.wrap_obj->object());
+    return kReturnValueSet;
+  }
+  return res.err;
 }
 
 int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
@@ -182,10 +199,13 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = env->isolate();
   Local<Context> context = env->context();
 
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsArray());
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  // When no request object is passed in, one is created by Write() only if
+  // the write does not complete synchronously; see FinishWrite().
+  const bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   Local<Array> chunks = args[1].As<Array>();
   bool all_buffers = args[2]->IsTrue();
 
@@ -287,20 +307,19 @@ int StreamBase::Writev(const FunctionCallbackInfo<Value>& args) {
   }
 
   StreamWriteResult res = Write(*bufs, count, nullptr, req_wrap_obj);
-  SetWriteResult(res);
   if (res.wrap != nullptr && storage_size > 0)
     res.wrap->SetBackingStore(std::move(bs));
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
-
 int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsUint8Array());
 
   Environment* env = Environment::GetCurrent(args);
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   uv_buf_t buf;
   buf.base = Buffer::Data(args[1]);
   buf.len = Buffer::Length(args[1]);
@@ -310,6 +329,16 @@ int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   if (args[2]->IsObject() && IsIPCPipe()) {
     Local<Object> send_handle_obj = args[2].As<Object>();
 
+    if (lazy_req) {
+      // Sending a handle requires a request object up front to reference it.
+      if (!env->write_wrap_template()
+               ->NewInstance(env->context())
+               .ToLocal(&req_wrap_obj)) {
+        return UV_EBUSY;
+      }
+      StreamReq::ResetObject(req_wrap_obj);
+    }
+
     HandleWrap* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, send_handle_obj, UV_EINVAL);
     send_handle = reinterpret_cast<uv_stream_t*>(wrap->GetHandle());
@@ -323,20 +352,18 @@ int StreamBase::WriteBuffer(const FunctionCallbackInfo<Value>& args) {
   }
 
   StreamWriteResult res = Write(&buf, 1, send_handle, req_wrap_obj);
-  SetWriteResult(res);
-
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
-
 template <enum encoding enc>
 int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
-  CHECK(args[0]->IsObject());
   CHECK(args[1]->IsString());
 
-  Local<Object> req_wrap_obj = args[0].As<Object>();
+  const bool lazy_req = !args[0]->IsObject();
+  Local<Object> req_wrap_obj;
+  if (!lazy_req) req_wrap_obj = args[0].As<Object>();
   Local<String> string = args[1].As<String>();
   Local<Object> send_handle_obj;
   if (args[2]->IsObject())
@@ -417,6 +444,16 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   uv_stream_t* send_handle = nullptr;
 
   if (IsIPCPipe() && !send_handle_obj.IsEmpty()) {
+    if (lazy_req && req_wrap_obj.IsEmpty()) {
+      // Sending a handle requires a request object up front to reference it.
+      if (!env->write_wrap_template()
+               ->NewInstance(env->context())
+               .ToLocal(&req_wrap_obj)) {
+        return UV_EBUSY;
+      }
+      StreamReq::ResetObject(req_wrap_obj);
+    }
+
     HandleWrap* wrap;
     ASSIGN_OR_RETURN_UNWRAP(&wrap, send_handle_obj, UV_EINVAL);
     send_handle = reinterpret_cast<uv_stream_t*>(wrap->GetHandle());
@@ -432,11 +469,10 @@ int StreamBase::WriteString(const FunctionCallbackInfo<Value>& args) {
   StreamWriteResult res = Write(&buf, 1, send_handle, req_wrap_obj, try_write);
   res.bytes += synchronously_written;
 
-  SetWriteResult(res);
   if (res.wrap != nullptr)
     res.wrap->SetBackingStore(std::move(bs));
 
-  return res.err;
+  return FinishWrite(args, res, lazy_req);
 }
 
 
@@ -662,7 +698,8 @@ void StreamBase::JSMethod(const FunctionCallbackInfo<Value>& args) {
   if (!wrap->IsAlive()) return args.GetReturnValue().Set(UV_EINVAL);
 
   AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(wrap->GetAsyncWrap());
-  args.GetReturnValue().Set((wrap->*Method)(args));
+  int ret = (wrap->*Method)(args);
+  if (ret != kReturnValueSet) args.GetReturnValue().Set(ret);
 }
 
 int StreamResource::DoTryWrite(uv_buf_t** bufs, size_t* count) {
@@ -684,7 +721,7 @@ void StreamResource::ClearError() {
 uv_buf_t EmitToJSStreamListener::OnStreamAlloc(size_t suggested_size) {
   CHECK_NOT_NULL(stream_);
   Environment* env = static_cast<StreamBase*>(stream_)->stream_env();
-  return env->allocate_managed_buffer(suggested_size);
+  return env->stream_read_slab().Allocate(env->isolate(), suggested_size);
 }
 
 void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
@@ -694,25 +731,34 @@ void EmitToJSStreamListener::OnStreamRead(ssize_t nread, const uv_buf_t& buf_) {
   Isolate* isolate = env->isolate();
   HandleScope handle_scope(isolate);
   Context::Scope context_scope(env->context());
-  std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
 
   if (nread <= 0)  {
-    env->recycle_managed_buffer(std::move(bs));
+    if (!env->stream_read_slab().Release(buf_))
+      env->recycle_managed_buffer(env->release_managed_buffer(buf_));
     if (nread < 0)
       stream->CallJSOnreadMethod(nread, Local<ArrayBuffer>());
     return;
   }
 
-  CHECK_LE(static_cast<size_t>(nread), bs->ByteLength());
-  if (static_cast<size_t>(nread) != bs->ByteLength()) {
-    std::unique_ptr<BackingStore> old_bs = std::move(bs);
-    bs = ArrayBuffer::NewBackingStore(
-        isolate, nread, BackingStoreInitializationMode::kUninitialized);
-    memcpy(bs->Data(), old_bs->Data(), nread);
-    env->recycle_managed_buffer(std::move(old_bs));
+  CHECK_LE(static_cast<size_t>(nread), buf_.len);
+  size_t offset = 0;
+  Local<ArrayBuffer> ab;
+  if (!env->stream_read_slab().Commit(isolate, buf_, nread, &ab, &offset)) {
+    // The buffer was allocated through allocate_managed_buffer() by another
+    // stream listener (e.g. StreamPipe's) whose read was rerouted here after
+    // that listener was removed.
+    std::unique_ptr<BackingStore> bs = env->release_managed_buffer(buf_);
+    CHECK_LE(static_cast<size_t>(nread), bs->ByteLength());
+    if (static_cast<size_t>(nread) != bs->ByteLength()) {
+      std::unique_ptr<BackingStore> old_bs = std::move(bs);
+      bs = ArrayBuffer::NewBackingStore(
+          isolate, nread, BackingStoreInitializationMode::kUninitialized);
+      memcpy(bs->Data(), old_bs->Data(), nread);
+      env->recycle_managed_buffer(std::move(old_bs));
+    }
+    ab = ArrayBuffer::New(isolate, std::move(bs));
   }
-
-  stream->CallJSOnreadMethod(nread, ArrayBuffer::New(isolate, std::move(bs)));
+  stream->CallJSOnreadMethod(nread, ab, offset);
 }
 
 
@@ -764,20 +810,50 @@ void ReportWritesToJSStreamListener::OnStreamAfterReqFinished(
   CHECK(!async_wrap->persistent().IsEmpty());
   Local<Object> req_wrap_obj = async_wrap->object();
 
+  Local<Value> oncomplete;
+  if (!req_wrap_obj->Get(env->context(), env->oncomplete_string())
+           .ToLocal(&oncomplete)) {
+    return;
+  }
+
+  const char* msg = stream->Error();
+
+  if (!oncomplete->IsFunction()) {
+    // The completion callback has not been attached yet: the write finished
+    // synchronously inside the JS write call, before the request object was
+    // returned to JS. Record the status so that JS can replay the callback.
+    if (req_wrap_obj
+            ->Set(env->context(),
+                  env->write_status_string(),
+                  Integer::New(env->isolate(), status))
+            .IsNothing()) {
+      return;
+    }
+    if (msg != nullptr) {
+      if (req_wrap_obj
+              ->Set(env->context(),
+                    env->error_string(),
+                    OneByteString(env->isolate(), msg))
+              .IsNothing()) {
+        return;
+      }
+      stream->ClearError();
+    }
+    return;
+  }
+
   Local<Value> argv[] = {
     Integer::New(env->isolate(), status),
     stream->GetObject(),
     Undefined(env->isolate())
   };
 
-  const char* msg = stream->Error();
   if (msg != nullptr) {
     argv[2] = OneByteString(env->isolate(), msg);
     stream->ClearError();
   }
 
-  if (req_wrap_obj->Has(env->context(), env->oncomplete_string()).FromJust())
-    async_wrap->MakeCallback(env->oncomplete_string(), arraysize(argv), argv);
+  async_wrap->MakeCallback(oncomplete.As<Function>(), arraysize(argv), argv);
 }
 
 void ReportWritesToJSStreamListener::OnStreamAfterWrite(
diff --git a/src/stream_base.h b/src/stream_base.h
index cb795a541297..450205a1b863 100644
--- a/src/stream_base.h
+++ b/src/stream_base.h
@@ -10,6 +10,8 @@
 
 #include "v8.h"
 
+#include <climits>  // INT_MIN
+
 namespace node {
 
 // Forward declarations
@@ -405,14 +407,22 @@ class StreamBase : public StreamResource {
     kArrayBufferOffset,
     kBytesWritten,
     kLastWriteWasAsync,
+    kLastWriteErr,
     kNumStreamBaseStateFields
   };
 
  private:
+  // Sentinel return value for JS methods that have set their own (object)
+  // return value and must not have it overwritten by JSMethod().
+  static constexpr int kReturnValueSet = INT_MIN;
+
   Environment* env_;
   EmitToJSStreamListener default_listener_;
 
   void SetWriteResult(const StreamWriteResult& res);
+  int FinishWrite(const v8::FunctionCallbackInfo<v8::Value>& args,
+                  const StreamWriteResult& res,
+                  bool lazy_req);
   static void AddAccessor(v8::Isolate* isolate,
                           v8::Local<v8::Signature> sig,
                           enum v8::PropertyAttribute attributes,
diff --git a/src/stream_wrap.cc b/src/stream_wrap.cc
index 6b85d6533879..c7d3c4745511 100644
--- a/src/stream_wrap.cc
+++ b/src/stream_wrap.cc
@@ -95,6 +95,20 @@ void LibuvStreamWrap::Initialize(Local<Object> target,
   Local<FunctionTemplate> ww =
       FunctionTemplate::New(isolate, IsConstructCallCallback);
   ww->InstanceTemplate()->SetInternalFieldCount(WriteWrap::kInternalFieldCount);
+  // Pre-create the fields that JS attaches to write requests, so that they
+  // are in-object properties and the object shape stays monomorphic.
+  ww->InstanceTemplate()->Set(env->oncomplete_string(), v8::Null(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "callback"),
+                              v8::Null(isolate));
+  ww->InstanceTemplate()->Set(env->handle_string(), v8::Null(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "async"),
+                              v8::False(isolate));
+  ww->InstanceTemplate()->Set(FIXED_ONE_BYTE_STRING(isolate, "bytes"),
+                              v8::Integer::New(isolate, 0));
+  ww->InstanceTemplate()->Set(env->buffer_string(), v8::Null(isolate));
+  // Slot for a completion that fires before JS attaches `oncomplete`; see
+  // ReportWritesToJSStreamListener::OnStreamAfterReqFinished().
+  ww->InstanceTemplate()->Set(env->write_status_string(), v8::Null(isolate));
   ww->Inherit(AsyncWrap::GetConstructorTemplate(env));
   SetConstructorFunction(context, target, "WriteWrap", ww);
   env->set_write_wrap_template(ww->InstanceTemplate());
@@ -103,6 +117,7 @@ void LibuvStreamWrap::Initialize(Local<Object> target,
   NODE_DEFINE_CONSTANT(target, kArrayBufferOffset);
   NODE_DEFINE_CONSTANT(target, kBytesWritten);
   NODE_DEFINE_CONSTANT(target, kLastWriteWasAsync);
+  NODE_DEFINE_CONSTANT(target, kLastWriteErr);
   target
       ->Set(context,
             FIXED_ONE_BYTE_STRING(isolate, "streamBaseState"),
diff --git a/src/string_bytes.cc b/src/string_bytes.cc
index 6e628b907e66..94b579b6984d 100644
--- a/src/string_bytes.cc
+++ b/src/string_bytes.cc
@@ -751,8 +751,8 @@ MaybeLocal<Value> StringBytes::Encode(Isolate* isolate,
       }
       if (reinterpret_cast<uintptr_t>(buf) % 2 != 0) {
         return EncodeTwoByteString(
-            isolate, str_len, [buf, buflen](uint16_t* dst) {
-              memcpy(dst, buf, buflen);
+            isolate, str_len, [buf, str_len](uint16_t* dst) {
+              memcpy(dst, buf, str_len * sizeof(*dst));
             });
       }
       return ExternTwoByteString::NewFromCopy(
diff --git a/src/undici_version.h b/src/undici_version.h
index 8afd91ad6f9a..3dd10c8a2aa7 100644
--- a/src/undici_version.h
+++ b/src/undici_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-undici.sh
 #ifndef SRC_UNDICI_VERSION_H_
 #define SRC_UNDICI_VERSION_H_
-#define UNDICI_VERSION "8.10.0"
+#define UNDICI_VERSION "8.10.2"
 #endif  // SRC_UNDICI_VERSION_H_
diff --git a/src/util.cc b/src/util.cc
index 15cbb202c9a6..179474928626 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -87,6 +87,7 @@ namespace node {
 
 using v8::ArrayBuffer;
 using v8::ArrayBufferView;
+using v8::BackingStore;
 using v8::Context;
 using v8::FunctionTemplate;
 using v8::Isolate;
@@ -677,6 +678,26 @@ Local<String> UnionBytes::ToStringChecked(Isolate* isolate) const {
   }
 }
 
+std::unique_ptr<BackingStore> AdoptIntoBackingStore(
+    Isolate* isolate,
+    void* data,
+    size_t byte_length,
+    BackingStore::DeleterCallback deleter,
+    void* deleter_data) {
+#ifdef V8_ENABLE_SANDBOX
+  std::unique_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
+      isolate,
+      byte_length,
+      v8::BackingStoreInitializationMode::kUninitialized,
+      v8::BackingStoreOnFailureMode::kReturnNull);
+  if (store && byte_length > 0) memcpy(store->Data(), data, byte_length);
+  if (data != nullptr) deleter(data, byte_length, deleter_data);
+  return store;
+#else
+  return ArrayBuffer::NewBackingStore(data, byte_length, deleter, deleter_data);
+#endif
+}
+
 RAIIIsolateWithoutEntering::RAIIIsolateWithoutEntering(const SnapshotData* data)
     : allocator_{ArrayBuffer::Allocator::NewDefaultAllocator()} {
   isolate_ = Isolate::Allocate();
diff --git a/src/util.h b/src/util.h
index 621d2fbf4ee6..ec7fbad43798 100644
--- a/src/util.h
+++ b/src/util.h
@@ -641,6 +641,18 @@ class ArrayBufferViewContents {
   bool was_detached_ = false;
 };
 
+// Creates a BackingStore with the contents of |data|. |deleter| runs once V8
+// no longer needs |data|: on release of the store when it can reference
+// |data| directly, or before this returns when V8 requires backing stores
+// inside its sandbox and |data| was copied. Returns nullptr if that copy
+// could not be allocated; |deleter| has run in that case too.
+std::unique_ptr<v8::BackingStore> AdoptIntoBackingStore(
+    v8::Isolate* isolate,
+    void* data,
+    size_t byte_length,
+    v8::BackingStore::DeleterCallback deleter,
+    void* deleter_data);
+
 class Utf8Value : public MaybeStackBuffer<char> {
  public:
   explicit Utf8Value(v8::Isolate* isolate, v8::Local<v8::Value> value);
diff --git a/src/zlib_version.h b/src/zlib_version.h
index a9d28e3a7cd4..42c81bc0ae5d 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.2.1-motley-5eb4d7e"
+#define ZLIB_VERSION "1.3.2.1-motley-285e94b"
 #endif  // SRC_ZLIB_VERSION_H_
diff --git a/test/addons/openssl-binding/binding.gyp b/test/addons/openssl-binding/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-binding/binding.gyp
+++ b/test/addons/openssl-binding/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-get-ssl-ctx/binding.gyp b/test/addons/openssl-get-ssl-ctx/binding.gyp
index 46a558e12030..a405ba25bbe7 100644
--- a/test/addons/openssl-get-ssl-ctx/binding.gyp
+++ b/test/addons/openssl-get-ssl-ctx/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/binding.gyp b/test/addons/openssl-providers/binding.gyp
index e1dc611d78ed..9d2f9bfd34fb 100644
--- a/test/addons/openssl-providers/binding.gyp
+++ b/test/addons/openssl-providers/binding.gyp
@@ -12,6 +12,9 @@
                 'aix_variant_name': '<!(uname -s)',
               },
               'conditions': [
+                [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+                  'type': 'none',
+                }],
                 [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
                   'sources': ['binding.cc'],
                   'include_dirs': ['../../../deps/openssl/openssl/include'],
diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index fc0f93ef45c8..7e7a958b9005 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -4,9 +4,9 @@ const common = require('../../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../../common/crypto');
+const { hasOpenSSL } = require('../../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 const assert = require('node:assert');
diff --git a/test/addons/openssl-providers/test-legacy-provider-option.js b/test/addons/openssl-providers/test-legacy-provider-option.js
index 5ad60dac9b86..1f01ce55a8f2 100644
--- a/test/addons/openssl-providers/test-legacy-provider-option.js
+++ b/test/addons/openssl-providers/test-legacy-provider-option.js
@@ -22,3 +22,6 @@ if (getFips()) {
   common.skip('this test cannot be run in FIPS mode');
 }
 providers.testProviderPresent('legacy');
+// The explicit legacy load disables OpenSSL's provider fallback, so the
+// default provider has to be active before it runs.
+providers.testProviderPresent('default');
diff --git a/test/addons/zlib-binding/binding.gyp b/test/addons/zlib-binding/binding.gyp
index f6a822d47e9c..5bd4f999218b 100644
--- a/test/addons/zlib-binding/binding.gyp
+++ b/test/addons/zlib-binding/binding.gyp
@@ -9,6 +9,9 @@
             'aix_variant_name': '<!(uname -s)',
           },
           'conditions': [
+            [ '"<(aix_variant_name)"=="OS400"', { # OS400 (IBM i): no sources, skip link
+              'type': 'none',
+            }],
             [ '"<(aix_variant_name)"!="OS400"', { # Not `OS400`(IBM i)
               'sources': ['binding.cc'],
               'include_dirs': ['../../../deps/zlib'],
diff --git a/test/cctest/test_dataqueue.cc b/test/cctest/test_dataqueue.cc
index 7c75bf9bfc42..785c6b906ba6 100644
--- a/test/cctest/test_dataqueue.cc
+++ b/test/cctest/test_dataqueue.cc
@@ -10,12 +10,27 @@ using node::DataQueue;
 using v8::ArrayBuffer;
 using v8::BackingStore;
 
+// Backing stores must lie inside V8's sandbox when it is enabled, so copy
+// the test data into memory from the default allocator rather than wrap it.
+static std::shared_ptr<BackingStore> MakeStore(const char* data) {
+  static ArrayBuffer::Allocator* const allocator =
+      ArrayBuffer::Allocator::NewDefaultAllocator();
+  size_t len = strlen(data);
+  void* copy = allocator->AllocateUninitialized(len);
+  CHECK_NOT_NULL(copy);
+  memcpy(copy, data, len);
+  return ArrayBuffer::NewBackingStore(
+      copy,
+      len,
+      [](void* p, size_t n, void*) { allocator->Free(p, n); },
+      nullptr);
+}
+
 TEST(DataQueue, InMemoryEntry) {
   char buffer[] = "hello world";
   size_t len = strlen(buffer);
 
-  std::shared_ptr<BackingStore> store = ArrayBuffer::NewBackingStore(
-      &buffer, len, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store = MakeStore(buffer);
 
   // We can create an InMemoryEntry from a v8::BackingStore.
   std::unique_ptr<DataQueue::Entry> entry =
@@ -87,11 +102,9 @@ TEST(DataQueue, IdempotentDataQueue) {
   size_t len2 = strlen(buffer2);
   size_t len3 = strlen(buffer3);
 
-  std::shared_ptr<BackingStore> store1 = ArrayBuffer::NewBackingStore(
-      &buffer1, len1, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store1 = MakeStore(buffer1);
 
-  std::shared_ptr<BackingStore> store2 = ArrayBuffer::NewBackingStore(
-      &buffer2, len2, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store2 = MakeStore(buffer2);
 
   std::vector<std::unique_ptr<DataQueue::Entry>> list;
   list.push_back(
@@ -124,8 +137,7 @@ TEST(DataQueue, IdempotentDataQueue) {
   // The size is known to be the sum of the in memory-entries.
   CHECK_EQ(data_queue->size().value(), len1 + len2);
 
-  std::shared_ptr<BackingStore> store3 = ArrayBuffer::NewBackingStore(
-      &buffer3, len3, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store3 = MakeStore(buffer3);
 
   // Trying to append a new entry does not crash, but returns std::nullopt.
   CHECK(!data_queue
@@ -416,14 +428,11 @@ TEST(DataQueue, NonIdempotentDataQueue) {
   size_t len2 = strlen(buffer2);
   size_t len3 = strlen(buffer3);
 
-  std::shared_ptr<BackingStore> store1 = ArrayBuffer::NewBackingStore(
-      &buffer1, len1, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store1 = MakeStore(buffer1);
 
-  std::shared_ptr<BackingStore> store2 = ArrayBuffer::NewBackingStore(
-      &buffer2, len2, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store2 = MakeStore(buffer2);
 
-  std::shared_ptr<BackingStore> store3 = ArrayBuffer::NewBackingStore(
-      &buffer3, len3, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store3 = MakeStore(buffer3);
 
   // We can create an non-idempotent DataQueue from a list of entries.
   std::shared_ptr<DataQueue> data_queue = DataQueue::Create();
@@ -550,11 +559,9 @@ TEST(DataQueue, DataQueueEntry) {
   size_t len1 = strlen(buffer1);
   size_t len2 = strlen(buffer2);
 
-  std::shared_ptr<BackingStore> store1 = ArrayBuffer::NewBackingStore(
-      &buffer1, len1, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store1 = MakeStore(buffer1);
 
-  std::shared_ptr<BackingStore> store2 = ArrayBuffer::NewBackingStore(
-      &buffer2, len2, [](void*, size_t, void*) {}, nullptr);
+  std::shared_ptr<BackingStore> store2 = MakeStore(buffer2);
 
   std::vector<std::unique_ptr<DataQueue::Entry>> list;
   list.push_back(
diff --git a/test/cctest/test_environment.cc b/test/cctest/test_environment.cc
index 109e224f788d..6dfd1a10a16d 100644
--- a/test/cctest/test_environment.cc
+++ b/test/cctest/test_environment.cc
@@ -1,6 +1,7 @@
 #include "libplatform/libplatform.h"
 #include "node_buffer.h"
 #include "node_internals.h"
+#include "node_realm-inl.h"
 #include "node_url.h"
 #include "util.h"
 
@@ -28,6 +29,12 @@ static void at_exit_callback_ordered2(void* arg);
 static void at_exit_js(void* arg);
 static std::string cb_1_arg;  // NOLINT(runtime/string)
 
+struct SelfRemovingCleanupHookState {
+  v8::Isolate* isolate;
+  bool ran = false;
+};
+static void self_removing_cleanup_hook(void* arg);
+
 class EnvironmentTest : public EnvironmentTestFixture {
  private:
   void TearDown() override {
@@ -310,6 +317,27 @@ TEST_F(EnvironmentTest, AtExitRunsJS) {
   EXPECT_TRUE(called_at_exit_js);
 }
 
+// A cleanup hook that removes itself while the environment cleanup queue is
+// being drained must not cause a use-after-free. This registers such a hook
+// directly rather than through node::ObjectWrap, whose destructor removes
+// its own hook and is what makes this reachable for addons since #63642.
+// The use-after-free is silent in ordinary builds; it is caught by the
+// ASan/Valgrind CI, which is also how the original assertion (#63923)
+// surfaced. Regression test for https://github.com/nodejs/node/issues/65195.
+TEST_F(EnvironmentTest, RemoveEnvironmentCleanupHookDuringCleanup) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  SelfRemovingCleanupHookState state{isolate_};
+  {
+    Env env{handle_scope, argv};
+    node::AddEnvironmentCleanupHook(
+        isolate_, self_removing_cleanup_hook, &state);
+    // Destroying `env` runs FreeEnvironment() -> RunCleanup(), which drains
+    // the cleanup queue and invokes CleanupHookThunkRun() for the hook above.
+  }
+  EXPECT_TRUE(state.ran);
+}
+
 TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   const v8::HandleScope handle_scope(isolate_);
   const Argv argv;
@@ -327,6 +355,39 @@ TEST_F(EnvironmentTest, MultipleEnvironmentsPerIsolate) {
   EXPECT_TRUE(called_cb_2);
 }
 
+TEST_F(EnvironmentTest, WorkerInEnvironmentWithoutSnapshot) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  Env env{handle_scope, argv};
+  CHECK_NULL(isolate_data_->snapshot_data());
+  node::LoadEnvironment(*env,
+                        "const { Worker } = require('worker_threads');"
+                        "new Worker('process.exit(0)', { eval: true });")
+      .ToLocalChecked();
+  EXPECT_EQ(node::SpinEventLoop(*env).FromJust(), 0);
+}
+
+TEST_F(EnvironmentTest, StopFromExitHandlerDoesNotLeakIntoNextEnvironment) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  {
+    Env env{handle_scope, argv};
+    node::SetProcessExitHandler(
+        *env, [](node::Environment* env_, int) { node::Stop(env_); });
+    // The uncaught exception runs the exit handler from C++ and does not
+    // re-enter JS afterwards, so nothing consumes the termination request.
+    EXPECT_TRUE(
+        node::LoadEnvironment(*env, "throw new Error('uncaught')").IsEmpty());
+    EXPECT_TRUE(node::SpinEventLoop(*env).IsNothing());
+  }
+  {
+    Env env{handle_scope, argv, node::EnvironmentFlags::kNoCreateInspector};
+    v8::Local<v8::Value> result =
+        node::LoadEnvironment(*env, "return 42;").ToLocalChecked();
+    EXPECT_EQ(result->Int32Value(env.context()).FromJust(), 42);
+  }
+}
+
 TEST_F(EnvironmentTest, NoEnvironmentSanity) {
   const v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = v8::Context::New(isolate_);
@@ -393,6 +454,19 @@ static void at_exit_js(void* arg) {
   called_at_exit_js = true;
 }
 
+// Reproduces the sequence node::ObjectWrap performs since
+// https://github.com/nodejs/node/pull/63642, without using ObjectWrap
+// itself: the hook removes its own environment cleanup hook. When that runs
+// while the cleanup queue is being drained, CleanupHookThunkRun() must not
+// read the CleanupHookThunk after invoking the hook -- the hook has already
+// erased and freed it. See https://github.com/nodejs/node/issues/65195.
+static void self_removing_cleanup_hook(void* arg) {
+  auto* state = static_cast<SelfRemovingCleanupHookState*>(arg);
+  state->ran = true;
+  node::RemoveEnvironmentCleanupHook(
+      state->isolate, self_removing_cleanup_hook, state);
+}
+
 TEST_F(EnvironmentTest, SetImmediateCleanup) {
   int called = 0;
   int called_unref = 0;
@@ -513,7 +587,11 @@ TEST_F(EnvironmentTest, BufferWithFreeCallbackIsDetached) {
   }
 
   CHECK_EQ(callback_calls, 1);
+#ifdef V8_ENABLE_SANDBOX
+  CHECK_EQ(ab->ByteLength(), sizeof(hello));
+#else
   CHECK_EQ(ab->ByteLength(), 0);
+#endif
 }
 
 #if HAVE_INSPECTOR
@@ -657,6 +735,34 @@ TEST_F(EnvironmentTest, InspectorMultipleEmbeddedEnvironments) {
   CHECK_EQ(data.extracted_value, 42);
   CHECK_EQ(from_inspector->IntegerValue(context).FromJust(), 42);
 }
+
+TEST_F(EnvironmentTest, InspectorWithoutPlatform) {
+  const v8::HandleScope handle_scope(isolate_);
+  const Argv argv;
+  node::IsolateData* isolate_data = node::CreateIsolateData(
+      isolate_, &NodeTestFixture::current_loop, nullptr);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+  std::vector<std::string> args(*argv, *argv + 1);
+  node::Environment* env =
+      node::CreateEnvironment(isolate_data, context, args, args);
+  CHECK_NOT_NULL(env);
+
+  v8::Local<v8::Value> result =
+      node::LoadEnvironment(env,
+                            "const { Session } = require('inspector');\n"
+                            "const session = new Session();\n"
+                            "session.connect();\n"
+                            "console.time('t'); console.timeEnd('t');\n"
+                            "session.disconnect();\n"
+                            "return 42;")
+          .ToLocalChecked();
+  EXPECT_EQ(result->Int32Value(context).FromJust(), 42);
+
+  node::FreeEnvironment(env);
+  node::FreeIsolateData(isolate_data);
+}
+
 #endif  // HAVE_INSPECTOR
 
 TEST_F(EnvironmentTest, ExitHandlerTest) {
@@ -869,6 +975,41 @@ TEST_F(EnvironmentTest, RequestInterruptAtExit) {
   context->Exit();
 }
 
+TEST_F(EnvironmentTest, EmbedderBuiltinCodeCache) {
+  v8::HandleScope handle_scope(isolate_);
+  v8::Local<v8::Context> context = node::NewContext(isolate_);
+  v8::Context::Scope context_scope(context);
+
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> entries =
+      node::EmbedderBuiltinCodeCache::Generate(context);
+  ASSERT_GT(entries.size(), 100u);
+  {
+    node::EmbedderBuiltinCodeCache cache(std::move(entries));
+    EXPECT_EQ(node::SetBuiltinCodeCache(isolate_data_, &cache),
+              v8::ScriptCompiler::CachedData::kSuccess);
+  }
+  std::unique_ptr<node::Environment, decltype(&node::FreeEnvironment)> env(
+      node::CreateEnvironment(isolate_data_, context, {}, {}),
+      node::FreeEnvironment);
+  node::Realm* realm = env->principal_realm();
+  EXPECT_EQ(realm->builtins_with_cache.count("internal/bootstrap/node"), 1u);
+  for (const std::string& id : realm->builtins_without_cache) {
+    EXPECT_EQ(id.rfind("internal/per_context/", 0), 0u) << id;
+  }
+
+  uint8_t* bytes = new uint8_t[64]();
+  std::vector<node::EmbedderBuiltinCodeCache::Entry> bad;
+  bad.push_back({"internal/bootstrap/node",
+                 std::make_unique<v8::ScriptCompiler::CachedData>(
+                     bytes, 64, v8::ScriptCompiler::CachedData::BufferOwned)});
+  node::EmbedderBuiltinCodeCache bad_cache(std::move(bad));
+  EXPECT_NE(node::SetBuiltinCodeCache(isolate_data_, &bad_cache),
+            v8::ScriptCompiler::CachedData::kSuccess);
+  EXPECT_FALSE(isolate_data_->builtin_code_cache().empty());
+  node::SetBuiltinCodeCache(isolate_data_, nullptr);
+  EXPECT_TRUE(isolate_data_->builtin_code_cache().empty());
+}
+
 TEST_F(EnvironmentTest, EmbedderPreload) {
   v8::HandleScope handle_scope(isolate_);
   v8::Local<v8::Context> context = node::NewContext(isolate_);
diff --git a/test/cctest/test_linked_binding.cc b/test/cctest/test_linked_binding.cc
index 10507950becf..be097abd90bb 100644
--- a/test/cctest/test_linked_binding.cc
+++ b/test/cctest/test_linked_binding.cc
@@ -250,8 +250,8 @@ napi_value NapiLinkedWithInstanceData(napi_env env, napi_value exports) {
   napi_value key, value;
   CHECK_EQ(napi_create_string_utf8(env, "hello", NAPI_AUTO_LENGTH, &key),
            napi_ok);
-  CHECK_EQ(napi_create_external_arraybuffer(
-               env, instance_data, 1, nullptr, nullptr, &value),
+  CHECK_EQ(napi_create_bigint_uint64(
+               env, reinterpret_cast<uint64_t>(instance_data), &value),
            napi_ok);
   CHECK_EQ(napi_set_property(env, exports, key, value), napi_ok);
   return nullptr;
@@ -290,9 +290,9 @@ TEST_F(LinkedBindingTest, LocallyDefinedLinkedBindingNapiInstanceDataTest) {
             .ToLocalChecked();
     v8::Local<v8::Value> completion_value =
         script->Run(context).ToLocalChecked();
-    CHECK(completion_value->IsArrayBuffer());
-    instance_data =
-        static_cast<int*>(completion_value.As<v8::ArrayBuffer>()->Data());
+    CHECK(completion_value->IsBigInt());
+    instance_data = reinterpret_cast<int*>(
+        completion_value.As<v8::BigInt>()->Uint64Value());
     CHECK_NE(instance_data, nullptr);
     CHECK_EQ(*instance_data, 0);
   }
@@ -328,9 +328,9 @@ TEST_F(LinkedBindingTest,
             .ToLocalChecked();
     v8::Local<v8::Value> completion_value =
         script->Run(context).ToLocalChecked();
-    CHECK(completion_value->IsArrayBuffer());
-    instance_data =
-        static_cast<int*>(completion_value.As<v8::ArrayBuffer>()->Data());
+    CHECK(completion_value->IsBigInt());
+    instance_data = reinterpret_cast<int*>(
+        completion_value.As<v8::BigInt>()->Uint64Value());
     CHECK_NE(instance_data, nullptr);
     CHECK_EQ(*instance_data, 0);
   }
diff --git a/test/cctest/test_per_process.cc b/test/cctest/test_per_process.cc
index 7a6f53d56222..937e9cab54dd 100644
--- a/test/cctest/test_per_process.cc
+++ b/test/cctest/test_per_process.cc
@@ -4,18 +4,45 @@
 #include "gtest/gtest.h"
 #include "node_test_fixture.h"
 
+#include <algorithm>
+#include <memory>
 #include <string>
+#include <vector>
 
+using node::builtins::BuiltinCodeCacheData;
 using node::builtins::BuiltinLoader;
 using node::builtins::BuiltinSourceMap;
+using node::builtins::CodeCacheInfo;
 
 class PerProcessTest : public ::testing::Test {
  protected:
   static const BuiltinSourceMap get_sources_for_test() {
     return *BuiltinLoader().source_.read();
   }
+
+  // id -> first byte of the cached data, after feeding `batches` in order.
+  static std::vector<std::pair<std::string, uint8_t>> RefreshCodeCacheWith(
+      const std::vector<std::vector<CodeCacheInfo>>& batches) {
+    BuiltinLoader loader;
+    for (const auto& batch : batches) loader.RefreshCodeCache(batch);
+    std::vector<std::pair<std::string, uint8_t>> out;
+    node::RwLock::ScopedReadLock lock(loader.code_cache_->mutex);
+    EXPECT_TRUE(loader.code_cache_->has_code_cache);
+    for (const auto& [id, data] : loader.code_cache_->map) {
+      out.emplace_back(id, data.data[0]);
+    }
+    std::sort(out.begin(), out.end());
+    return out;
+  }
 };
 
+CodeCacheInfo MakeCodeCacheInfo(const std::string& id, uint8_t marker) {
+  auto* bytes = new uint8_t[4]{marker, marker, marker, marker};
+  auto cached_data = std::make_shared<v8::ScriptCompiler::CachedData>(
+      bytes, 4, v8::ScriptCompiler::CachedData::BufferOwned);
+  return CodeCacheInfo{id, BuiltinCodeCacheData(std::move(cached_data))};
+}
+
 namespace {
 
 TEST_F(PerProcessTest, EmbeddedSources) {
@@ -29,4 +56,22 @@ TEST_F(PerProcessTest, EmbeddedSources) {
   })) << "BuiltinLoader::source_ should have some 16bit items";
 }
 
+// RefreshCodeCache() merges: it can be fed the snapshot's code cache and then
+// an embedder's, and the entry supplied last wins for a shared id.
+TEST_F(PerProcessTest, RefreshCodeCacheMerges) {
+  const auto merged = PerProcessTest::RefreshCodeCacheWith({
+      {MakeCodeCacheInfo("internal/a", 1), MakeCodeCacheInfo("internal/b", 1)},
+      {MakeCodeCacheInfo("internal/b", 2), MakeCodeCacheInfo("embedder/c", 2)},
+  });
+  const std::vector<std::pair<std::string, uint8_t>> expected = {
+      {"embedder/c", 2}, {"internal/a", 1}, {"internal/b", 2}};
+  EXPECT_EQ(merged, expected);
+
+  // A single call still behaves as before.
+  const auto single = PerProcessTest::RefreshCodeCacheWith(
+      {{MakeCodeCacheInfo("internal/a", 7)}});
+  ASSERT_EQ(single.size(), 1u);
+  EXPECT_EQ(single[0].second, 7);
+}
+
 }  // end namespace
diff --git a/test/client-proxy/test-https-proxy-request-header-overflow.mjs b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
new file mode 100644
index 000000000000..2ffc215bafa9
--- /dev/null
+++ b/test/client-proxy/test-https-proxy-request-header-overflow.mjs
@@ -0,0 +1,45 @@
+// This tests that the proxy server cannot send unbounded incomplete headers
+// while establishing a CONNECT tunnel.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import http from 'node:http';
+import { runProxiedRequest } from '../common/proxy-server.js';
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const proxy = http.createServer();
+proxy.on('connect', common.mustCall((req, socket) => {
+  socket.write('HTTP/1.1 200 Connection Established\r\n');
+
+  const interval = setInterval(() => {
+    if (socket.destroyed) {
+      clearInterval(interval);
+      return;
+    }
+    socket.write('x'.repeat(100));
+  }, 10);
+  socket.on('close', () => clearInterval(interval));
+  socket.on('error', () => clearInterval(interval));
+}, 1));
+proxy.listen(0);
+await once(proxy, 'listening');
+
+const { code, signal, stderr, stdout } = await runProxiedRequest({
+  NODE_USE_ENV_PROXY: 1,
+  REQUEST_URL: 'https://localhost:1/test',
+  HTTPS_PROXY: `http://localhost:${proxy.address().port}`,
+}, ['--max-http-header-size=1024']);
+
+assert.match(
+  stderr,
+  /ERR_PROXY_TUNNEL.*Proxy response headers exceeded 1024 bytes/,
+);
+assert.doesNotMatch(stderr, /MaxListenersExceededWarning/);
+assert.strictEqual(stdout.trim(), '');
+assert.strictEqual(code, 0);
+assert.strictEqual(signal, null);
+
+proxy.close();
diff --git a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
index 888137b9a5a6..6f27f0775aee 100644
--- a/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
+++ b/test/client-proxy/test-https-proxy-request-invalid-char-in-url.mjs
@@ -83,7 +83,9 @@ for (const testCase of testCases) {
           server.close();
           assert.deepStrictEqual(requests, expectedUrls);
           const requestLogs = logs.filter((log) => !('error' in log));
-          const errors = logs.filter((log) => 'error' in log);
+          // The client may reset a tunnel while the proxy is still relaying
+          // the upstream's TLS shutdown; that says nothing about the URLs.
+          const errors = logs.filter((log) => 'error' in log && log.error.code !== 'ECONNRESET');
           assert.deepStrictEqual(new Set(requestLogs), expectedProxyLogs);
           assert.deepStrictEqual(errors, []);
         }));
diff --git a/test/common/README.md b/test/common/README.md
index 6c8fcf42847a..bc27da028c46 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -28,6 +28,7 @@ several other tasks:
 ## Table of contents
 
 * [ArrayStream module](#arraystream-module)
+* [Bench module](#bench-module)
 * [Benchmark module](#benchmark-module)
 * [Child process module](#child-process-module)
 * [Common module API](#common-module-api)
@@ -49,6 +50,21 @@ several other tasks:
 * [UDP pair helper](#udp-pair-helper)
 * [WPT module](#wpt-module)
 
+## Bench module
+
+The `bench` module has helpers for tests of `node:bench`.
+
+### `completeSample(b[, operations[, options]])`
+
+* `b` The `BenchContext` passed to a `node:bench` benchmark function.
+* `operations` [\<number>][<number>] Passed to `b.end()`. **Default:** `1`.
+* `options` [\<Object>][<Object>] Passed to `b.end()`.
+* return the sample returned by `b.end()`.
+
+Calls `b.start()` and `b.end()` with at least one `process.hrtime.bigint()`
+tick in between, so the sample has a non-zero duration on hosts whose
+monotonic clock is coarse.
+
 ## Benchmark module
 
 The `benchmark` module is used by tests to run benchmarks.
@@ -257,6 +273,13 @@ Indicates if [internationalization][] is supported.
 
 Indicates whether `IPv6` is supported on this platform.
 
+### `hasV8Sandbox`
+
+* [\<boolean>][<boolean>]
+
+Indicates whether V8 was built with its sandbox enabled, in which case
+`ArrayBuffer`s cannot reference memory outside of it.
+
 ### `hasSQLite`
 
 * [\<boolean>][<boolean>]
diff --git a/test/common/bench.js b/test/common/bench.js
new file mode 100644
index 000000000000..25d67e3a17b2
--- /dev/null
+++ b/test/common/bench.js
@@ -0,0 +1,13 @@
+'use strict';
+
+// Records a sample with start()/end() and at least one hrtime tick in
+// between, so its duration is non-zero even on hosts with a coarse clock.
+function completeSample(b, operations = 1, options = undefined) {
+  b.start();
+  const started = process.hrtime.bigint();
+  let now = started;
+  while (now === started) now = process.hrtime.bigint();
+  return b.end(operations, options);
+}
+
+module.exports = { completeSample };
diff --git a/test/common/child_process.js b/test/common/child_process.js
index c74154bb084f..59505e5824dd 100644
--- a/test/common/child_process.js
+++ b/test/common/child_process.js
@@ -15,12 +15,12 @@ function cleanupStaleProcess(filename) {
   process.once('beforeExit', () => {
     const basename = filename.replace(/.*[/\\]/g, '');
     try {
-      execFileSync(`${process.env.SystemRoot}\\System32\\wbem\\WMIC.exe`, [
-        'process',
-        'where',
-        `commandline like '%${basename}%child'`,
-        'delete',
-        '/nointeractive',
+      execFileSync(`${process.env.SystemRoot}\\System32\\WindowsPowerShell\\v1.0\\powershell.exe`, [
+        '-NoProfile',
+        '-NonInteractive',
+        '-Command',
+        `Get-CimInstance Win32_Process -Filter "CommandLine LIKE '%${basename}%child'" | ` +
+        'ForEach-Object { Stop-Process -Id $_.ProcessId -Force }',
       ]);
     } catch {
       // Ignore failures, there might not be any stale process to clean up.
diff --git a/test/common/crypto.js b/test/common/crypto.js
index 63f7487f15d3..49678e0de43a 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -123,6 +123,8 @@ const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
   return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
 };
 
+const isBoringSSL = process.features.openssl_is_boringssl;
+
 const hasFIPS = (major = 0, minor = 0, patch = 0) => {
   return crypto.getFips() === 1 && hasOpenSSL(major, minor, patch);
 };
@@ -144,6 +146,7 @@ module.exports = {
   sec1EncExp,
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
   get hasOpenSSL3() {
     return hasOpenSSL(3);
   },
diff --git a/test/common/index.js b/test/common/index.js
index e37b354f8259..ce083ee7294e 100755
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -36,6 +36,7 @@ const bits = ['arm64', 'loong64', 'mips', 'mipsel', 'ppc64', 'riscv64', 's390x',
   .includes(process.arch) ? 64 : 32;
 const hasIntl = !!process.config.variables.v8_enable_i18n_support;
 const hasTemporal = !!process.config.variables.v8_enable_temporal_support;
+const hasV8Sandbox = !!process.config.variables.v8_enable_sandbox;
 
 // small-icu doesn't support non-English locales
 const hasFullICU = (() => {
@@ -855,8 +856,9 @@ function invalidArgTypeHelper(input) {
     return ` Received function ${input.name}`;
   }
   if (typeof input === 'object') {
-    if (input.constructor?.name) {
-      return ` Received an instance of ${input.constructor.name}`;
+    const name = input.constructor?.name;
+    if (typeof name === 'string' && name !== '') {
+      return ` Received an instance of ${name}`;
     }
     return ` Received ${inspect(input, { depth: -1 })}`;
   }
@@ -1018,6 +1020,7 @@ const common = {
   getTTYfd,
   hasIntl,
   hasTemporal,
+  hasV8Sandbox,
   hasFullICU,
   hasCrypto,
   hasDtls,
diff --git a/test/common/index.mjs b/test/common/index.mjs
index 108cae290999..9f81a2b920ee 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -24,6 +24,7 @@ const {
   hasLocalStorage,
   hasIntl,
   hasTemporal,
+  hasV8Sandbox,
   hasIPv6,
   isAIX,
   isAlive,
@@ -83,6 +84,7 @@ export {
   hasLocalStorage,
   hasIntl,
   hasTemporal,
+  hasV8Sandbox,
   hasIPv6,
   isAIX,
   isAlive,
diff --git a/test/embedding/embedtest.cc b/test/embedding/embedtest.cc
index b3225e5d3ae4..007781754ab9 100644
--- a/test/embedding/embedtest.cc
+++ b/test/embedding/embedtest.cc
@@ -85,19 +85,24 @@ NODE_MAIN(int argc, node::argv_type raw_argv[]) {
   node::FixupMain(argc, raw_argv, &argv);
 
   std::vector<std::string> args(argv, argv + argc);
+  uint32_t flags =
+      node::ProcessInitializationFlags::kNoInitializeV8 |
+      node::ProcessInitializationFlags::kNoInitializeNodeV8Platform |
+      // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
+      // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
+      // support in the future, split this configuration out as a
+      // command line option.
+      node::ProcessInitializationFlags::kDisableNodeOptionsEnv |
+      node::ProcessInitializationFlags::kNoInitializeCppgc;
+  auto it =
+      std::find(args.begin(), args.end(), "--no-harvest-builtin-code-cache");
+  if (it != args.end()) {
+    args.erase(it);
+    flags |= node::ProcessInitializationFlags::kNoHarvestBuiltinCodeCache;
+  }
   std::shared_ptr<node::InitializationResult> result =
       node::InitializeOncePerProcess(
-          args,
-          {
-              node::ProcessInitializationFlags::kNoInitializeV8,
-              node::ProcessInitializationFlags::kNoInitializeNodeV8Platform,
-              // This is used to test NODE_REPL_EXTERNAL_MODULE is disabled with
-              // kDisableNodeOptionsEnv. If other tests need NODE_OPTIONS
-              // support in the future, split this configuration out as a
-              // command line option.
-              node::ProcessInitializationFlags::kDisableNodeOptionsEnv,
-              node::ProcessInitializationFlags::kNoInitializeCppgc,
-          });
+          args, static_cast<node::ProcessInitializationFlags::Flags>(flags));
 
   for (const std::string& error : result->errors())
     fprintf(stderr, "%s: %s\n", args[0].c_str(), error.c_str());
diff --git a/test/embedding/test-embedding-builtin-code-cache-harvest.js b/test/embedding/test-embedding-builtin-code-cache-harvest.js
new file mode 100644
index 000000000000..19cdd499c6ea
--- /dev/null
+++ b/test/embedding/test-embedding-builtin-code-cache-harvest.js
@@ -0,0 +1,25 @@
+'use strict';
+// By default a builtin compiled without a code cache serializes one that worker
+// threads then start from; with kNoHarvestBuiltinCodeCache it does not.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+tmpdir.refresh();
+const embedtest = common.resolveBuiltBinary('embedtest');
+const workerScript = 'new (require("worker_threads").Worker)("", { eval: true })';
+
+function workerCompileLog(args) {
+  let log;
+  spawnSyncAndAssert(
+    embedtest, ['--', ...args, workerScript],
+    { cwd: tmpdir.path, env: { ...process.env, NODE_DEBUG_NATIVE: 'CODE_CACHE' } },
+    { stderr(output) { log = output; return true; } });
+  const worker = log.slice(log.lastIndexOf('Compiling internal/bootstrap/realm'));
+  assert.notStrictEqual(worker, log);
+  return worker;
+}
+assert.match(workerCompileLog([]), /Code cache of internal\/bootstrap\/node \(\w+\) is accepted/);
+assert.match(workerCompileLog(['--no-harvest-builtin-code-cache']),
+             /Compiling internal\/bootstrap\/node without code cache/);
diff --git a/test/ffi/test-ffi-memory.js b/test/ffi/test-ffi-memory.js
index 5e667af2eb13..ba4a341688ff 100644
--- a/test/ffi/test-ffi-memory.js
+++ b/test/ffi/test-ffi-memory.js
@@ -76,7 +76,9 @@ test('ffi supports unaligned memory access', () => {
   }));
 });
 
-test('ffi toBuffer supports copy and zero-copy views', () => {
+const zeroCopy = { skip: common.hasV8Sandbox && 'zero-copy views are unavailable with the V8 sandbox' };
+
+test('ffi toBuffer supports copy and zero-copy views', zeroCopy, () => {
   withAllocations(common.mustCall((alloc) => {
     const ptr = alloc(8);
     ffi.exportBuffer(Buffer.from([1, 2, 3, 4]), ptr, 4);
@@ -98,7 +100,7 @@ test('ffi toBuffer supports copy and zero-copy views', () => {
   }));
 });
 
-test('ffi toArrayBuffer supports copy and zero-copy views', () => {
+test('ffi toArrayBuffer supports copy and zero-copy views', zeroCopy, () => {
   withAllocations(common.mustCall((alloc) => {
     const ptr = alloc(4);
     ffi.exportBuffer(Buffer.from([10, 20, 30, 40]), ptr, 4);
@@ -120,6 +122,16 @@ test('ffi toArrayBuffer supports copy and zero-copy views', () => {
   }));
 });
 
+test('ffi zero-copy views throw with the V8 sandbox', { skip: !common.hasV8Sandbox }, () => {
+  withAllocations(common.mustCall((alloc) => {
+    const ptr = alloc(4);
+    ffi.exportBuffer(Buffer.from([1, 2, 3, 4]), ptr, 4);
+    assert.deepStrictEqual([...ffi.toBuffer(ptr, 4)], [1, 2, 3, 4]);
+    assert.throws(() => ffi.toBuffer(ptr, 4, false), { code: 'ERR_OPERATION_FAILED' });
+    assert.throws(() => ffi.toArrayBuffer(ptr, 4, false), { code: 'ERR_OPERATION_FAILED' });
+  }));
+});
+
 test('ffi getRawPointer returns raw addresses for byte sources', () => {
   const buffer = Buffer.from([1, 2, 3]);
   const arrayBuffer = new Uint8Array([4, 5, 6, 7]).buffer;
@@ -318,3 +330,23 @@ test('ffi validates memory access arguments', () => {
     }
   }));
 });
+
+test('ffi memory helpers reject missing required arguments', () => {
+  const widths = ['Int8', 'Uint8', 'Int16', 'Uint16', 'Int32', 'Uint32',
+                  'Int64', 'Uint64', 'Float32', 'Float64'];
+
+  // Calling a helper with no arguments must report the missing pointer the
+  // same way an explicitly passed `undefined` does, instead of returning
+  // `undefined` as if the read or the write had succeeded.
+  for (const width of widths) {
+    for (const name of [`get${width}`, `set${width}`]) {
+      assert.throws(() => ffi[name](), { code: 'ERR_INVALID_ARG_VALUE' });
+      assert.throws(() => ffi[name](undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+    }
+  }
+
+  assert.throws(() => ffi.toBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n), { code: 'ERR_INVALID_ARG_VALUE' });
+  assert.throws(() => ffi.toArrayBuffer(1n, undefined), { code: 'ERR_INVALID_ARG_VALUE' });
+});
diff --git a/test/fixtures/bench-runner/a.cjs b/test/fixtures/bench-runner/a.cjs
new file mode 100644
index 000000000000..3edaf85ad856
--- /dev/null
+++ b/test/fixtures/bench-runner/a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('alpha', {
+  params: { file: 'a', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/abrupt-exit.cjs b/test/fixtures/bench-runner/abrupt-exit.cjs
new file mode 100644
index 000000000000..3489f424b8da
--- /dev/null
+++ b/test/fixtures/bench-runner/abrupt-exit.cjs
@@ -0,0 +1,16 @@
+'use strict';
+
+const mode = process.env.NODE_BENCH_EXIT_MODE;
+
+if (mode === 'code') process.exit(2);
+if (mode === 'signal') process.kill(process.pid, 'SIGTERM');
+
+const { bench } = require('node:bench');
+
+if (mode === 'late') {
+  process.on('beforeExit', () => { process.exitCode = 2; });
+}
+
+bench('abrupt exit', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/acknowledged-records.mjs b/test/fixtures/bench-runner/acknowledged-records.mjs
new file mode 100644
index 000000000000..633f3412eaaf
--- /dev/null
+++ b/test/fixtures/bench-runner/acknowledged-records.mjs
@@ -0,0 +1,41 @@
+import common from '../../common/index.js';
+
+const pending = new Map();
+const onMessage = (message) => {
+  if (message?.type !== 'node:bench:ack') return;
+  pending.get(message.id)?.();
+  pending.delete(message.id);
+};
+process.on('message', onMessage);
+
+const timeout = setTimeout(() => {
+  throw new Error('benchmark record was not acknowledged');
+}, common.platformTimeout(10_000));
+
+function sendDiagnostic(id) {
+  return new Promise((resolve, reject) => {
+    pending.set(id, resolve);
+    process.send({
+      id,
+      type: 'node:bench:record',
+      record: {
+        type: 'bench:diagnostic',
+        data: {
+          runId: process.env.NODE_BENCH_RUN_ID,
+          fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+          entryFile: process.argv[1],
+          message: `acknowledged ${id}`,
+          level: 'info',
+          file: process.argv[1],
+        },
+      },
+    }, (error) => {
+      if (error) reject(error);
+    });
+  });
+}
+
+for (let i = 0; i < 32; i++) await sendDiagnostic(10_000 + i);
+
+clearTimeout(timeout);
+process.off('message', onMessage);
diff --git a/test/fixtures/bench-runner/b.mjs b/test/fixtures/bench-runner/b.mjs
new file mode 100644
index 000000000000..ca35178ecf79
--- /dev/null
+++ b/test/fixtures/bench-runner/b.mjs
@@ -0,0 +1,8 @@
+import { bench } from 'node:bench';
+
+bench('beta', {
+  params: { file: 'b', pid: process.pid },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/destroying-reporter.cjs b/test/fixtures/bench-runner/destroying-reporter.cjs
new file mode 100644
index 000000000000..8a2a2406f932
--- /dev/null
+++ b/test/fixtures/bench-runner/destroying-reporter.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+module.exports = async function* destroyingReporter(source) {
+  source.once('bench:plan', () => {
+    source.destroy(new Error('benchmark reporter closed the stream'));
+  });
+  yield* source;
+};
diff --git a/test/fixtures/bench-runner/diagnostic.cjs b/test/fixtures/bench-runner/diagnostic.cjs
new file mode 100644
index 000000000000..9e413e943dd7
--- /dev/null
+++ b/test/fixtures/bench-runner/diagnostic.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+const { channel } = require('diagnostics_channel');
+
+const channelName = 'node:bench:test:diagnostic';
+const diagnosticChannel = channel(channelName);
+
+bench('diagnostic relay', {
+  diagnosticChannels: [channelName],
+  samples: 1,
+}, (b) => {
+  const message = { value: 42n };
+  diagnosticChannel.publish(message);
+  message.value = 0n;
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/error.cjs b/test/fixtures/bench-runner/error.cjs
new file mode 100644
index 000000000000..cf1db903e2b7
--- /dev/null
+++ b/test/fixtures/bench-runner/error.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('failure', {
+  params: { kind: 'structured-error' },
+  samples: 1,
+}, () => {
+  const error = new Error('benchmark fixture failed', {
+    cause: { value: 42n },
+  });
+  error.code = 'ERR_BENCHMARK_FIXTURE';
+  throw error;
+});
diff --git a/test/fixtures/bench-runner/exit-code.cjs b/test/fixtures/bench-runner/exit-code.cjs
new file mode 100644
index 000000000000..67f065fea7eb
--- /dev/null
+++ b/test/fixtures/bench-runner/exit-code.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('sets exit code', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  process.exitCode = 2;
+});
diff --git a/test/fixtures/bench-runner/failing-reporter.cjs b/test/fixtures/bench-runner/failing-reporter.cjs
new file mode 100644
index 000000000000..da1299fd17d5
--- /dev/null
+++ b/test/fixtures/bench-runner/failing-reporter.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { Transform } = require('stream');
+
+module.exports = new Transform({
+  writableObjectMode: true,
+  transform(_record, _encoding, callback) {
+    callback(new Error('benchmark reporter failed'));
+  },
+});
diff --git a/test/fixtures/bench-runner/fake-ipc.cjs b/test/fixtures/bench-runner/fake-ipc.cjs
new file mode 100644
index 000000000000..7b2afa8dda93
--- /dev/null
+++ b/test/fixtures/bench-runner/fake-ipc.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+process.send = () => {};
diff --git a/test/fixtures/bench-runner/identity-child-a.cjs b/test/fixtures/bench-runner/identity-child-a.cjs
new file mode 100644
index 000000000000..ae7824d0ab7d
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function declareChildA() {
+  bench('child a', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-child-b.cjs b/test/fixtures/bench-runner/identity-child-b.cjs
new file mode 100644
index 000000000000..2841a98055e0
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-child-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function declareChildB() {
+  bench('child b', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-entry-a.cjs b/test/fixtures/bench-runner/identity-entry-a.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-a.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-entry-b.cjs b/test/fixtures/bench-runner/identity-entry-b.cjs
new file mode 100644
index 000000000000..2892ea3f3eca
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-entry-b.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+const registerSharedIdentity = require('./identity-shared.cjs');
+
+suite('shared suite', async () => {
+  await setImmediate();
+  registerSharedIdentity();
+});
diff --git a/test/fixtures/bench-runner/identity-hook.cjs b/test/fixtures/bench-runner/identity-hook.cjs
new file mode 100644
index 000000000000..14c4cacd9cdc
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-hook.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { before, bench } = require('node:bench');
+
+before(() => {
+  throw new Error('scoped hook failed');
+});
+
+bench('scoped hook benchmark', { samples: 1 }, () => {});
diff --git a/test/fixtures/bench-runner/identity-preload.cjs b/test/fixtures/bench-runner/identity-preload.cjs
new file mode 100644
index 000000000000..bcc9df72c410
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-preload.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+bench('preload identity', { samples: 1 }, (b) => {
+  completeSample(b);
+});
diff --git a/test/fixtures/bench-runner/identity-shared.cjs b/test/fixtures/bench-runner/identity-shared.cjs
new file mode 100644
index 000000000000..c47bcc954745
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-shared.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+module.exports = function registerSharedIdentity() {
+  bench('shared identity', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+};
diff --git a/test/fixtures/bench-runner/identity-suite.cjs b/test/fixtures/bench-runner/identity-suite.cjs
new file mode 100644
index 000000000000..53c5982ce1a9
--- /dev/null
+++ b/test/fixtures/bench-runner/identity-suite.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { suite } = require('node:bench');
+const declareChildA = require('./identity-child-a.cjs');
+const declareChildB = require('./identity-child-b.cjs');
+
+suite('cross-module suite', () => {
+  declareChildA();
+  declareChildB();
+});
diff --git a/test/fixtures/bench-runner/import.mjs b/test/fixtures/bench-runner/import.mjs
new file mode 100644
index 000000000000..e027d905eec0
--- /dev/null
+++ b/test/fixtures/bench-runner/import.mjs
@@ -0,0 +1 @@
+globalThis.benchImport = 'loaded';
diff --git a/test/fixtures/bench-runner/imported.cjs b/test/fixtures/bench-runner/imported.cjs
new file mode 100644
index 000000000000..9a5fb24bb33d
--- /dev/null
+++ b/test/fixtures/bench-runner/imported.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('imported', {
+  samples: 1,
+  params: { imported: globalThis.benchImport },
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/inspector.cjs b/test/fixtures/bench-runner/inspector.cjs
new file mode 100644
index 000000000000..d357b54f864e
--- /dev/null
+++ b/test/fixtures/bench-runner/inspector.cjs
@@ -0,0 +1,13 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+const inspectPort = process.execArgv.filter(
+  (arg) => arg.startsWith('--inspect-port=')).at(-1);
+
+bench('inspector option', {
+  params: { inspectPort },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/ipc.cjs b/test/fixtures/bench-runner/ipc.cjs
new file mode 100644
index 000000000000..e6b9ceb49823
--- /dev/null
+++ b/test/fixtures/bench-runner/ipc.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.send?.({ type: 'user-message' });
+
+bench('user IPC', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/load-error-after-declaration.cjs b/test/fixtures/bench-runner/load-error-after-declaration.cjs
new file mode 100644
index 000000000000..6f2cf085742c
--- /dev/null
+++ b/test/fixtures/bench-runner/load-error-after-declaration.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+bench('declared before load error', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+
+throw new Error('load failed after declaration');
diff --git a/test/fixtures/bench-runner/malformed-plan-order.mjs b/test/fixtures/bench-runner/malformed-plan-order.mjs
new file mode 100644
index 000000000000..80c8cdf4cd8f
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-plan-order.mjs
@@ -0,0 +1,34 @@
+import { bench } from 'node:bench';
+import common from '../../common/index.js';
+
+await new Promise((resolve, reject) => {
+  const timeout = setTimeout(() => {
+    reject(new Error('benchmark summary was not acknowledged'));
+  }, common.platformTimeout(10_000));
+  process.on('message', (message) => {
+    if (message?.type === 'node:bench:ack' && message.id === 0) {
+      clearTimeout(timeout);
+      resolve();
+    }
+  });
+  process.send?.({
+    id: 0,
+    type: 'node:bench:record',
+    record: {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 0, failed: 0, skipped: 0, total: 0 },
+        duration_ns: 1n,
+        entryFile: import.meta.filename,
+        fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+        file: import.meta.filename,
+        runId: process.env.NODE_BENCH_RUN_ID,
+        success: true,
+      },
+    },
+  });
+});
+
+bench('late plan', { samples: 1 }, () => {
+  throw new Error('late plan benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/malformed-record.cjs b/test/fixtures/bench-runner/malformed-record.cjs
new file mode 100644
index 000000000000..3550694532f5
--- /dev/null
+++ b/test/fixtures/bench-runner/malformed-record.cjs
@@ -0,0 +1,81 @@
+'use strict';
+
+const common = require('../../common');
+
+const kind = process.env.NODE_BENCH_MALFORMED_RECORD;
+const id = kind === 'sequence' ? null : 0;
+const benchmarkData = {
+  __proto__: null,
+  benchId: 'invalid plan',
+  column: 1,
+  entryFile: __filename,
+  file: __filename,
+  fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+  line: 1,
+  name: 'invalid plan',
+  namePath: ['invalid plan'],
+  params: {},
+  parentId: null,
+  runId: process.env.NODE_BENCH_RUN_ID,
+  tags: [],
+};
+const plan = {
+  type: 'bench:plan',
+  data: {
+    __proto__: null,
+    ...benchmarkData,
+    samples: 1,
+    selected: true,
+    timeout: null,
+    warmup: 0,
+    yieldBetweenSamples: true,
+  },
+};
+const record = kind === 'summary' ? {
+  type: 'bench:summary',
+  data: {
+    counts: { completed: 0, failed: 0, skipped: 0, total: -1 },
+    duration_ns: 1n,
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+    success: true,
+  },
+} : kind === 'name-path' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    namePath: [1],
+  },
+} : kind === 'plan' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    samples: 0,
+  },
+} : kind === 'timeout' ? {
+  ...plan,
+  data: {
+    ...plan.data,
+    timeout: -1,
+  },
+} : kind === 'identity' ? {
+  type: 'bench:complete',
+  data: {
+    entryFile: __filename,
+    fileRunId: process.env.NODE_BENCH_FILE_RUN_ID,
+    runId: process.env.NODE_BENCH_RUN_ID,
+  },
+} : kind === 'diagnostic' || kind === 'diagnostic-order' ? {
+  type: 'bench:diagnostic',
+  data: {
+    ...benchmarkData,
+    index: 0,
+    level: kind === 'diagnostic' ? 'error' : 'warning',
+    message: 'invalid diagnostic',
+    phase: 'measurement',
+  },
+} : null;
+
+process.send?.({ id, type: 'node:bench:record', record });
+setTimeout(() => process.exit(2), common.platformTimeout(10_000));
diff --git a/test/fixtures/bench-runner/many-records.cjs b/test/fixtures/bench-runner/many-records.cjs
new file mode 100644
index 000000000000..aacb17821035
--- /dev/null
+++ b/test/fixtures/bench-runner/many-records.cjs
@@ -0,0 +1,8 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('many records', { samples: 30 }, (b) => {
+  process.stdout.write(`${b.index}\n`);
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/node.config.json b/test/fixtures/bench-runner/node.config.json
new file mode 100644
index 000000000000..0344e2a4b7f4
--- /dev/null
+++ b/test/fixtures/bench-runner/node.config.json
@@ -0,0 +1,7 @@
+{
+  "bench": {
+    "bench-isolation": "none",
+    "bench-reporter": ["json"],
+    "bench-samples": 1
+  }
+}
diff --git a/test/fixtures/bench-runner/options.cjs b/test/fixtures/bench-runner/options.cjs
new file mode 100644
index 000000000000..e9a1bcde9af3
--- /dev/null
+++ b/test/fixtures/bench-runner/options.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+let invocations = 0;
+bench('selected', {
+  params: { boolean: true, number: 42, string: 'value' },
+  samples: 8,
+  warmup: 8,
+}, (b) => {
+  invocations++;
+  b.record({ duration_ns: 1n, operations: invocations });
+});
+
+bench('filtered out', { samples: 1 }, () => {
+  throw new Error('filtered benchmark ran');
+});
diff --git a/test/fixtures/bench-runner/output.cjs b/test/fixtures/bench-runner/output.cjs
new file mode 100644
index 000000000000..3500f2a23383
--- /dev/null
+++ b/test/fixtures/bench-runner/output.cjs
@@ -0,0 +1,10 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+process.stdout.write('benchmark stdout\n');
+process.stderr.write('benchmark stderr\n');
+
+bench('output', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/preload.cjs b/test/fixtures/bench-runner/preload.cjs
new file mode 100644
index 000000000000..1b03dcbf65cf
--- /dev/null
+++ b/test/fixtures/bench-runner/preload.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+globalThis.benchRunnerPreloaded = true;
diff --git a/test/fixtures/bench-runner/preloaded.cjs b/test/fixtures/bench-runner/preloaded.cjs
new file mode 100644
index 000000000000..b141b49e9695
--- /dev/null
+++ b/test/fixtures/bench-runner/preloaded.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+if (globalThis.benchRunnerPreloaded !== true) {
+  throw new Error('benchmark preload did not run');
+}
+
+bench('preloaded', {
+  params: { preloaded: true },
+  samples: 1,
+}, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/recorded-detail.cjs b/test/fixtures/bench-runner/recorded-detail.cjs
new file mode 100644
index 000000000000..1643783225d0
--- /dev/null
+++ b/test/fixtures/bench-runner/recorded-detail.cjs
@@ -0,0 +1,17 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('recorded detail', { samples: 3 }, (b) => {
+  b.record({
+    __proto__: null,
+    detail: {
+      index: b.index,
+      phase: b.phase,
+      value: 42n,
+    },
+    duration_ns: 4n,
+    operations: 2,
+  });
+  b.done();
+});
diff --git a/test/fixtures/bench-runner/run-file-blocked.cjs b/test/fixtures/bench-runner/run-file-blocked.cjs
new file mode 100644
index 000000000000..9298d0dccc4b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-blocked.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('blocked run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file-lingering.cjs b/test/fixtures/bench-runner/run-file-lingering.cjs
new file mode 100644
index 000000000000..954bc108d01d
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-lingering.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+setInterval(() => {}, 1_000);
+if (process.platform !== 'win32') process.on('SIGTERM', () => {});
+process.on('disconnect', () => process.stdout.write('child disconnected\n'));
+
+bench('lingering run file', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/run-file-partial.cjs b/test/fixtures/bench-runner/run-file-partial.cjs
new file mode 100644
index 000000000000..9e3019e94e62
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file-partial.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('completed before abort', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+bench('aborted run file', { samples: 1 }, async () => {
+  await new Promise(() => {});
+});
diff --git a/test/fixtures/bench-runner/run-file.cjs b/test/fixtures/bench-runner/run-file.cjs
new file mode 100644
index 000000000000..436665074b6b
--- /dev/null
+++ b/test/fixtures/bench-runner/run-file.cjs
@@ -0,0 +1,22 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('run file', {
+  samples: 1,
+  params: {
+    context: process.env.NODE_BENCH_CONTEXT,
+    exposed: typeof globalThis.gc === 'function',
+    omitted: process.env.NODE_BENCH_OMITTED === undefined,
+    value: process.env.NODE_BENCH_RUN_FILE ?? 'unset',
+  },
+}, (b) => {
+  b.record({
+    duration_ns: 1n,
+    operations: 1,
+    detail: {
+      execArgv: process.execArgv,
+      pid: process.pid,
+    },
+  });
+});
diff --git a/test/fixtures/bench-runner/run.cjs b/test/fixtures/bench-runner/run.cjs
new file mode 100644
index 000000000000..4064dc1c9797
--- /dev/null
+++ b/test/fixtures/bench-runner/run.cjs
@@ -0,0 +1,9 @@
+'use strict';
+
+const { bench, run } = require('node:bench');
+
+bench('declared before run', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+
+run();
diff --git a/test/fixtures/bench-runner/send-error.cjs b/test/fixtures/bench-runner/send-error.cjs
new file mode 100644
index 000000000000..9e1df941dfeb
--- /dev/null
+++ b/test/fixtures/bench-runner/send-error.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+if (process.env.NODE_BENCH_SEND_ERROR === 'callback') {
+  process.send = (_message, _handle, _options, callback) => {
+    callback(new Error('benchmark send callback failed'));
+  };
+} else {
+  process.send = () => { throw new Error('benchmark send threw'); };
+}
+
+const { bench } = require('node:bench');
+
+bench('send error', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/serial-a.cjs b/test/fixtures/bench-runner/serial-a.cjs
new file mode 100644
index 000000000000..02ea8d8d972a
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-a.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial a');
diff --git a/test/fixtures/bench-runner/serial-b.cjs b/test/fixtures/bench-runner/serial-b.cjs
new file mode 100644
index 000000000000..58f87d933473
--- /dev/null
+++ b/test/fixtures/bench-runner/serial-b.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+require('./serial')('serial b');
diff --git a/test/fixtures/bench-runner/serial.js b/test/fixtures/bench-runner/serial.js
new file mode 100644
index 000000000000..4e6f44c3b679
--- /dev/null
+++ b/test/fixtures/bench-runner/serial.js
@@ -0,0 +1,17 @@
+'use strict';
+
+const fs = require('fs');
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+module.exports = function register(name) {
+  const lock = process.env.NODE_BENCH_LOCK;
+  fs.writeFileSync(lock, `${process.pid}`, { flag: 'wx' });
+  process.on('exit', () => fs.unlinkSync(lock));
+
+  bench(name, { samples: 1 }, async (b) => {
+    b.start();
+    await setTimeout(25);
+    b.end(1);
+  });
+};
diff --git a/test/fixtures/bench-runner/slow-reporter.cjs b/test/fixtures/bench-runner/slow-reporter.cjs
new file mode 100644
index 000000000000..7832bd94cd49
--- /dev/null
+++ b/test/fixtures/bench-runner/slow-reporter.cjs
@@ -0,0 +1,36 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+
+module.exports = async function* slowReporter(source) {
+  const { promise, resolve } = Promise.withResolvers();
+  let emitted = 0;
+  const onRecord = () => {
+    if (++emitted === source.readableHighWaterMark) resolve();
+  };
+  for (const type of [
+    'bench:plan',
+    'bench:start',
+    'bench:sample',
+    'bench:complete',
+    'bench:diagnostic',
+    'bench:summary',
+  ]) {
+    source.on(type, onRecord);
+  }
+  await promise;
+
+  let samples = 0;
+  let stdout = '';
+  for await (const record of source) {
+    await setTimeout(2);
+    if (record.type === 'bench:sample') samples++;
+    if (record.type === 'bench:diagnostic' &&
+        record.data.stream === 'stdout') {
+      stdout += record.data.message;
+    }
+    if (record.type === 'bench:summary') {
+      yield `${JSON.stringify({ samples, stdout })}\n`;
+    }
+  }
+};
diff --git a/test/fixtures/bench-runner/throws-null.cjs b/test/fixtures/bench-runner/throws-null.cjs
new file mode 100644
index 000000000000..562e969ac350
--- /dev/null
+++ b/test/fixtures/bench-runner/throws-null.cjs
@@ -0,0 +1,3 @@
+'use strict';
+
+throw null;
diff --git a/test/fixtures/bench-runner/tools-collision.cjs b/test/fixtures/bench-runner/tools-collision.cjs
new file mode 100644
index 000000000000..40ab0a4d4a50
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-collision.cjs
@@ -0,0 +1,12 @@
+'use strict';
+
+const { bench, suite } = require('node:bench');
+
+function register(name) {
+  bench(name, { params: { size: 1 } }, (b) => {
+    b.record({ duration_ns: 1n, operations: 1 });
+  });
+}
+
+suite('first', () => register('same'));
+suite('second', () => register('same'));
diff --git a/test/fixtures/bench-runner/tools-no-params.cjs b/test/fixtures/bench-runner/tools-no-params.cjs
new file mode 100644
index 000000000000..182a7886286e
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-no-params.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/no-params.js', (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/tools-reserved-param.cjs b/test/fixtures/bench-runner/tools-reserved-param.cjs
new file mode 100644
index 000000000000..8084d6c33f81
--- /dev/null
+++ b/test/fixtures/bench-runner/tools-reserved-param.cjs
@@ -0,0 +1,7 @@
+'use strict';
+
+const { bench } = require('node:bench');
+
+bench('tools/reserved.js', { params: { rate: 'parameter' } }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/tools.cjs b/test/fixtures/bench-runner/tools.cjs
new file mode 100644
index 000000000000..073a090d8829
--- /dev/null
+++ b/test/fixtures/bench-runner/tools.cjs
@@ -0,0 +1,15 @@
+'use strict';
+
+const { completeSample } = require('../../common/bench');
+const { bench } = require('node:bench');
+
+if (process.env.NODE_BENCH_PID_LOG !== undefined) {
+  require('fs').appendFileSync(
+    process.env.NODE_BENCH_PID_LOG, `${process.pid}\n`);
+}
+
+for (const size of [1, 2]) {
+  bench('tools/simple.js', {
+    params: { method: 'loop', size },
+  }, (b) => completeSample(b, 1_000));
+}
diff --git a/test/fixtures/bench-runner/utf8-output.cjs b/test/fixtures/bench-runner/utf8-output.cjs
new file mode 100644
index 000000000000..7dab41cd7c22
--- /dev/null
+++ b/test/fixtures/bench-runner/utf8-output.cjs
@@ -0,0 +1,14 @@
+'use strict';
+
+const { setTimeout } = require('timers/promises');
+const { bench } = require('node:bench');
+
+const output = Buffer.from('split:\u20ac\n');
+process.stdout.write(output.subarray(0, 7));
+
+bench('UTF-8 output', { samples: 1 }, async (b) => {
+  b.start();
+  await setTimeout(20);
+  process.stdout.write(output.subarray(7));
+  b.end(1);
+});
diff --git a/test/fixtures/bench-runner/v8-option.cjs b/test/fixtures/bench-runner/v8-option.cjs
new file mode 100644
index 000000000000..833024161c50
--- /dev/null
+++ b/test/fixtures/bench-runner/v8-option.cjs
@@ -0,0 +1,11 @@
+'use strict';
+
+const assert = require('assert');
+const { bench } = require('node:bench');
+
+assert.strictEqual(Error.stackTraceLimit, 17);
+assert(process.execArgv.includes('--random-seed=17'));
+
+bench('V8 option', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+});
diff --git a/test/fixtures/bench-runner/verifying-reporter.cjs b/test/fixtures/bench-runner/verifying-reporter.cjs
new file mode 100644
index 000000000000..2dd467e12597
--- /dev/null
+++ b/test/fixtures/bench-runner/verifying-reporter.cjs
@@ -0,0 +1,21 @@
+'use strict';
+
+const assert = require('assert');
+
+module.exports = async function* verify(source) {
+  for await (const { type, data } of source) {
+    if (type === 'bench:sample') {
+      assert.strictEqual(typeof data.duration_ns, 'bigint');
+      assert.strictEqual(typeof data.rate, 'number');
+    }
+    if (type === 'bench:complete' && data.error !== undefined) {
+      assert(data.error instanceof Error);
+      assert.strictEqual(data.error.code, 'ERR_BENCHMARK_FIXTURE');
+      assert.deepStrictEqual(data.error.cause, { value: 42n });
+    }
+    if (type === 'bench:complete' && data.summary !== undefined) {
+      assert(Number.isFinite(data.summary.medianConfidenceInterval.lower));
+    }
+    if (type === 'bench:summary') yield 'verified\n';
+  }
+};
diff --git a/test/fixtures/crypto/ecdsa.js b/test/fixtures/crypto/ecdsa.js
index c3545fb20ec7..6da56a0601ff 100644
--- a/test/fixtures/crypto/ecdsa.js
+++ b/test/fixtures/crypto/ecdsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = {
     'P-256': Buffer.from(
@@ -72,7 +74,7 @@ module.exports = function() {
         'b6a0a14d7e4bc6dd2eda82c9234f174b670b60c8f7d101f68fdf5889e02373b025' +
         'dcbc4c82f2929b8e06c68535da98e38fe399c53a814b097935581ef21535eb',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           'f6a48eb5557f484ed0c3e4b5c78a3cf497cbd346db06a4165d429248aa2cc51a69' +
           '747d09f57af145469a8b607a9b8b9709629d74e8f5ca337c6ddc581b6f6103',
@@ -104,7 +106,7 @@ module.exports = function() {
         '72fbdb369fd34c1c54264d07f4facd69b02e4206f8a8bb259b882a305c56fde2d3' +
         '5107e493c53cd6b4af0b31306f4d03fd43cfc762a1030e17a3d775453a1212b142' +
         '9f7b3d93066a5f42a10b138cd177dc09616e827d598822d78d4627b754e6', 'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '0b07c078be30fa5925a307d6fc559c5f398e63fb5d007d6b24a834847f2d3d18d5' +
           'b5e840711c52a7bc6626c3ced93301e873c013a706f6b297c12cc6d47a71e0529e' +
@@ -144,7 +146,7 @@ module.exports = function() {
         '01f0071e6a32867fa70f695cd39c4e87e142b9e4134d38740bd6fee354a575167e' +
         '13524e94832637910fe11e53a85fb21b91adb81bb1779c4e2b8bc87c717dc35084',
         'hex'),
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': Buffer.from(
           '00463679f47a4c705e03447360dcf34d1743e0d4b2591cc66832a6bc80d92e538c' +
           '169a1fd330f98e7235ca7fec7e16ac44fb13095b8edf2c76b75c4845177d59e425' +
@@ -170,7 +172,7 @@ module.exports = function() {
   const curves = ['P-256', 'P-384', 'P-521'];
   const hashes = ['SHA-1', 'SHA-256', 'SHA-384', 'SHA-512'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     hashes.push('SHA3-256', 'SHA3-384', 'SHA3-512');
   }
 
diff --git a/test/fixtures/crypto/eddsa.js b/test/fixtures/crypto/eddsa.js
index a5382219f4f3..4c91b044d72f 100644
--- a/test/fixtures/crypto/eddsa.js
+++ b/test/fixtures/crypto/eddsa.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 const common = require('../../common');
 
 module.exports = function() {
@@ -46,7 +48,7 @@ module.exports = function() {
   const algorithms = ['Ed25519'];
   const contexts = [new Uint8Array(0), new Uint8Array(32), new Uint8Array(255)];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     algorithms.push('Ed448')
   } else {
     common.printSkipMessage(`Skipping unsupported Ed448 test cases`);
diff --git a/test/fixtures/crypto/hmac.js b/test/fixtures/crypto/hmac.js
index acdf3229a4bc..55376a1299d8 100644
--- a/test/fixtures/crypto/hmac.js
+++ b/test/fixtures/crypto/hmac.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const plaintext = Buffer.from(
     '5f4dba4f320c0ce876725afce5fbd25bf83e5a7125a08cafe73c3ebac421779df9d55d' +
@@ -22,7 +24,7 @@ module.exports = function () {
       '5dcc359443aaf652fa1375d6b3e61fdcf29bb4a28bd5d3dcfa40f82f906bb280' +
       '0455db03b5d31fb972a15a6d0103a24e56d156a119c0e5a1e92a44c3c5657cf9',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'e588ec0811463d767241df1074b47ae4071b51f2ce36537ba69ccdc3fdc2b7a8',
         'hex'),
@@ -48,7 +50,7 @@ module.exports = function () {
       '61fb278c3ffb0cce2bf1cf723ddfd8ef1f931c0c618c25907324605939e3f9a2' +
       'c6f4af690bda3407dc2f5770f6a0a44b954d64a332e3ee0821abf82b7f3e99c1',
       'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'SHA3-256': Buffer.from(
         'c1ac5e11fcd50c48bf567f6e296632f5801c4eb07a8a47579b41dee971a3099b',
         'hex'),
diff --git a/test/fixtures/crypto/rsa_pkcs.js b/test/fixtures/crypto/rsa_pkcs.js
index d54c44b6d820..74a8c0512ef4 100644
--- a/test/fixtures/crypto/rsa_pkcs.js
+++ b/test/fixtures/crypto/rsa_pkcs.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function () {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a50201000282' +
@@ -97,7 +99,7 @@ module.exports = function () {
       '7a6335c70e193235dcda48add6858626bd96311e60f7e5ea4491b6c1e6248afe12b' +
       'bbd54f8869b043a5b0444562813f0a98b300356f306e6b783a29f3bec97ca40ea20' +
       '062cab8926ec5d96aa387cc84821a6d72b8ea126e7d', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-256': Buffer.from(
         'be1b476c1911a01d71710fd8a2f3158d6f7839e91443b01bed30dfdd04336d80c6b' +
         'f692c06fad254877901c10a73853e8fb202a29cddefdf16c3adcda1fc123625897d' +
@@ -161,7 +163,7 @@ module.exports = function () {
       plaintext,
       signature: signatures['sha-512']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,
diff --git a/test/fixtures/crypto/rsa_pss.js b/test/fixtures/crypto/rsa_pss.js
index 423f2c4d77bf..4aeaf3330e78 100644
--- a/test/fixtures/crypto/rsa_pss.js
+++ b/test/fixtures/crypto/rsa_pss.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { isBoringSSL } = require('../../common/crypto');
+
 module.exports = function() {
   const pkcs8 = Buffer.from(
     '308204bf020100300d06092a864886f70d0101010500048204a9308204a5020100028' +
@@ -150,7 +152,7 @@ module.exports = function() {
       'b68c04bfe452c3adc6c10066a915231b7b404727eb6201b4921eb96d9407de2b963' +
       '3879ceb71d759d9828d7b4d062f6ef100757d8328187caf57dfb859d1555345207c' +
       '1cce7905c3564c08fec78867a53d5a2cf84810e1ffa', 'hex'),
-    ...(!process.features.openssl_is_boringssl ? {
+    ...(!isBoringSSL ? {
       'sha3-512, no salt': Buffer.from(
         'd2430dc87abeaa7d13f7cec8510f1a296e1c608f44b1696829c59a99e8eefe9b2ee' +
         '6ee8ad6fdc93c24fcba2f04d1da195924b6209717e1992c10ed9f4783478765fe34' +
@@ -255,7 +257,7 @@ module.exports = function() {
       plaintext,
       signature: signatures['sha-512, salted']
     },
-    ...(!process.features.openssl_is_boringssl ? [
+    ...(!isBoringSSL ? [
       {
         publicKeyBuffer: spki,
         privateKeyBuffer: pkcs8,
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index 3ef61d00afff..0960e69f36fd 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -70,6 +70,7 @@ all: \
   rsa_spkac.spkac \
   rsa_spkac_invalid.spkac \
   rsa_private_2048.pem \
+  rsa_private_2048_3_primes.pem \
   rsa_private_4096.pem \
   rsa_public_2048.pem \
   rsa_public_4096.pem \
@@ -927,6 +928,13 @@ rsa_spkac_invalid.spkac: rsa_spkac.spkac
 rsa_private_2048.pem:
 	openssl genrsa -out rsa_private_2048.pem 2048
 
+rsa_private_2048_3_primes.pem:
+	openssl genpkey \
+		-algorithm RSA \
+		-pkeyopt rsa_keygen_bits:2048 \
+		-pkeyopt rsa_keygen_primes:3 \
+		-out rsa_private_2048_3_primes.pem
+
 rsa_private_4096.pem:
 	openssl genrsa -out rsa_private_4096.pem 4096
 
diff --git a/test/fixtures/keys/rsa_private_2048_3_primes.pem b/test/fixtures/keys/rsa_private_2048_3_primes.pem
new file mode 100644
index 000000000000..49535f2cd7f7
--- /dev/null
+++ b/test/fixtures/keys/rsa_private_2048_3_primes.pem
@@ -0,0 +1,29 @@
+-----BEGIN PRIVATE KEY-----
+MIIE8wIBADANBgkqhkiG9w0BAQEFAASCBN0wggTZAgEBAoIBAQC1Lu9a9Hlj8/OA
+J3I2h/1aFYV59SxWb1KzbuRb2nAoOVWCqG8ettkT7kGN6qva3C/oCw2pYPIlRxpX
+0Vve0fNRqpSCCXcnN9vlKpU0BrHfpIHuXSleT7vwSq70UV5YwjFhL+g5wcCUVCuz
+Fkd8dYb0keqVApSKkcydepk5/BwBwQdkfibs3RuIjROkgIbDKSXrm1lFinqyCBTG
+umLcaL9XMhaJRxsVIVqkCM6hs+kEXhIBvlFIqcycECKEV3l71nV0VM3RwlbORIjx
+iHpSvNEUixGR0Rwx4WdJNU4GiUJGZACKj+RrLX+mh0odOl5r8Up9TkTgWp4UEdUx
+GHbQ6lIrAgMBAAECggEAA8mZY1Nc/kPpQTKR5qXtG+b7RVNku+HT3sBgsbLdSVn5
+eaO/vuqfmxUN9cOEGC0mKzmf7XyDU1grKs7LltrYtUpVlGpSPVWjmSTMvauuKDiu
+Jqd35+irM+pQerj/AYOs9Lv2lLzzA1ivcSmB0uR2gNyiVvVxBAxydNXiBwCn+v8M
++qosREPVN9eEQ+1j+ZWvZ2j/AkT6EDdOl0qbhkLDkaLgDkO4uhAZfNKjwmuVkBoW
+BI9bUiQv9vzsSp7AIVXwd8D+NaX0VuDpbcIq/tIfrl2OxwUDuTkYYsvwlIwvAkZ4
+yMl57x2YjRJu2u4f4t+fuagqCisbbbE+LywM5r+YEQJWB/Z/lOoAXXCRSBSGhI29
+zI+pXWiK4UneitEKTJpdR7i38Var03aciK+q64z4gWDNSBRzYq5eyVWosv0f9WkO
+lQFRfOy0HM68dg2KYDCIVnquCwwgaDcCVgZ7lxyKqwirCDYL9VFxRNiBIOXuMLdl
+6c4YNpdPTrp/AILBeINJYKBYjpro6fPe0YHcxJpMNf5Izaow17VVAqJKDmXbca7y
+SclsgBR6mAnFf6WfFM5rAlYBe2nHp74lphwEVH2tEkyvVFXrotemkv8uyzWliF2w
+SbtC2iTlGQCNmFSxvu1J92B9+AB574aI5r6dget+2+zw4uvt2oizi+8b8e09dgsK
+PY9DUyB9BQJWBTsT4uPAvW3DYlijyOMsOcV3Vg+rH1AMJ09CPTSwwapYLykMpGJA
+pSDPcA8fNrdDNRV9TULRDiyQRhLC+n1tcqVumKFISXEWOIBjmCKTKs9A/9IsZ6EC
+VgQG607Arq/ztxJFVKHY4RW0v8Ofx9Q0h+GDcKqqxDlymZfrDsdKJjC1QTofRUR+
+JJiwshahF2jBtlsPwEjX8/InboaF2f2VlIxzxe2+GpzWeRgzIN9yMIIBDDCCAQgC
+VgOChKyWwWrVMfjdfwtFnMA/OjwK4KBtR8VWwAapaiJPFhZRM0jh8EMsC03X7xm9
+AbL3hfE3eLU2mRLxw1pPh0RfK2xtKTCZWjgnQDhPznMUUvF+FYxHAlYCZbRvGa1U
+Zffy7n7m2Q4+tTD2b8uLZ/jcjess4awvcOs6JQ4tWr07dCroaXPTlahCcBRZdLUK
+uRcGvIDc/3L5vTMwpMK8ghIARrbzf3cYXSpl7eOT4wJWAuPXcrk1PE1YuMidPa2v
+3OshgH2no6BeVW2vChBDnK9IBstWII/AhjQzDHjbj9S8xjLZA6bqHH89uXc+0Z/2
+hF8lLDsruEceLVckmk7wb1eFAvns/XA=
+-----END PRIVATE KEY-----
diff --git a/test/fixtures/openssl3-conf/random_unavailable.cnf b/test/fixtures/openssl3-conf/random_unavailable.cnf
new file mode 100644
index 000000000000..a2dc8d2c9ffa
--- /dev/null
+++ b/test/fixtures/openssl3-conf/random_unavailable.cnf
@@ -0,0 +1,7 @@
+nodejs_conf = nodejs_init
+
+[nodejs_init]
+random = random_sect
+
+[random_sect]
+random = NO-SUCH-DRBG
diff --git a/test/fixtures/sea/vfs-esm/calculator.cjs b/test/fixtures/sea/vfs-esm/calculator.cjs
new file mode 100644
index 000000000000..3499fb2cad12
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/calculator.cjs
@@ -0,0 +1,5 @@
+'use strict';
+// CommonJS module imported from the ESM main to test interop inside the VFS.
+module.exports = {
+  sum: (a, b) => a + b,
+};
diff --git a/test/fixtures/sea/vfs-esm/config.json b/test/fixtures/sea/vfs-esm/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs-esm/greeting.txt b/test/fixtures/sea/vfs-esm/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs-esm/main.mjs b/test/fixtures/sea/vfs-esm/main.mjs
new file mode 100644
index 000000000000..24ae629a5bce
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/main.mjs
@@ -0,0 +1,63 @@
+// The ESM SEA main script runs from inside the VFS mount: import.meta
+// reflects the mount, and static imports, dynamic imports, and bare
+// specifier lookups all resolve against the bundled assets.
+import fs from 'node:fs';
+import path from 'node:path';
+import assert from 'node:assert';
+import { createRequire } from 'node:module';
+
+// Static import of a relative ESM module from the VFS.
+import { add, multiply } from './modules/math.mjs';
+
+// Static import of a CommonJS module from the VFS (interop).
+import calculator from './modules/calculator.cjs';
+
+// Static import of a bare specifier resolved via the in-VFS node_modules.
+import { name as pkgName, greet } from 'test-esm-pkg';
+
+// The main script runs from inside the VFS, not from the executable.
+assert.ok(import.meta.url.startsWith('file:'));
+assert.strictEqual(path.basename(import.meta.filename), 'main.mjs');
+assert.notStrictEqual(import.meta.filename, process.execPath);
+console.log('main module runs from', import.meta.url);
+
+// import.meta.dirname is the root of the mounted assets.
+const config = JSON.parse(
+  fs.readFileSync(path.join(import.meta.dirname, 'config.json'), 'utf8'));
+assert.strictEqual(config.name, 'test-app');
+const greeting = fs.readFileSync(
+  path.join(import.meta.dirname, 'data', 'greeting.txt'), 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!');
+console.log('fs access through import.meta.dirname passed');
+
+// Static ESM import from the VFS.
+assert.strictEqual(add(2, 3), 5);
+assert.strictEqual(multiply(4, 5), 20);
+console.log('static relative import passed');
+
+// CommonJS interop from the VFS.
+assert.strictEqual(calculator.sum(10, 20), 30);
+console.log('static import of CommonJS module passed');
+
+// Bare specifier resolution confined to the in-VFS node_modules.
+assert.strictEqual(pkgName, 'test-esm-pkg');
+assert.strictEqual(greet('World'), 'Hello, World!');
+console.log('bare specifier import passed');
+
+// Dynamic import from the VFS.
+const dynamicMath = await import('./modules/math.mjs');
+assert.strictEqual(dynamicMath.add(1, 1), 2);
+console.log('dynamic import passed');
+
+// createRequire against the VFS main URL.
+const require = createRequire(import.meta.url);
+const requiredCalculator = require('./modules/calculator.cjs');
+assert.strictEqual(requiredCalculator.sum(3, 4), 7);
+console.log('createRequire from import.meta.url passed');
+
+// node:sea and the VFS serve the same content.
+const { getAsset } = await import('node:sea');
+assert.strictEqual(getAsset('data/greeting.txt', 'utf8'), greeting);
+console.log('node:sea API and VFS coexistence passed');
+
+console.log('All SEA VFS ESM tests passed!');
diff --git a/test/fixtures/sea/vfs-esm/math.mjs b/test/fixtures/sea/vfs-esm/math.mjs
new file mode 100644
index 000000000000..acc4868a6f6e
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/math.mjs
@@ -0,0 +1,6 @@
+export function add(a, b) {
+  return a + b;
+}
+export function multiply(a, b) {
+  return a * b;
+}
diff --git a/test/fixtures/sea/vfs-esm/sea-config.json b/test/fixtures/sea/vfs-esm/sea-config.json
new file mode 100644
index 000000000000..c17694a412fa
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/sea-config.json
@@ -0,0 +1,14 @@
+{
+  "main": "main.mjs",
+  "mainFormat": "module",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.mjs": "math.mjs",
+    "modules/calculator.cjs": "calculator.cjs",
+    "node_modules/test-esm-pkg/package.json": "test-esm-pkg-package.json",
+    "node_modules/test-esm-pkg/index.mjs": "test-esm-pkg-index.mjs"
+  }
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
new file mode 100644
index 000000000000..1cc3c9c7fa55
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-index.mjs
@@ -0,0 +1,4 @@
+export const name = 'test-esm-pkg';
+export function greet(who) {
+  return `Hello, ${who}!`;
+}
diff --git a/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
new file mode 100644
index 000000000000..ee0ab8500ba1
--- /dev/null
+++ b/test/fixtures/sea/vfs-esm/test-esm-pkg-package.json
@@ -0,0 +1,6 @@
+{
+  "name": "test-esm-pkg",
+  "version": "1.0.0",
+  "type": "module",
+  "exports": { ".": "./index.mjs" }
+}
diff --git a/test/fixtures/sea/vfs/calculator.js b/test/fixtures/sea/vfs/calculator.js
new file mode 100644
index 000000000000..dc8e496a85ee
--- /dev/null
+++ b/test/fixtures/sea/vfs/calculator.js
@@ -0,0 +1,9 @@
+'use strict';
+// This module tests transitive requires - it requires math.js using a
+// relative path, which tests that module hooks resolve correctly.
+const math = require('./math.js');
+
+module.exports = {
+  sum: (a, b) => math.add(a, b),
+  product: (a, b) => math.multiply(a, b),
+};
diff --git a/test/fixtures/sea/vfs/config.json b/test/fixtures/sea/vfs/config.json
new file mode 100644
index 000000000000..8dd57a1d1fdf
--- /dev/null
+++ b/test/fixtures/sea/vfs/config.json
@@ -0,0 +1 @@
+{"name":"test-app","version":"1.0.0"}
diff --git a/test/fixtures/sea/vfs/greeting.txt b/test/fixtures/sea/vfs/greeting.txt
new file mode 100644
index 000000000000..cbfbb578572c
--- /dev/null
+++ b/test/fixtures/sea/vfs/greeting.txt
@@ -0,0 +1 @@
+Hello from SEA VFS!
\ No newline at end of file
diff --git a/test/fixtures/sea/vfs/math.js b/test/fixtures/sea/vfs/math.js
new file mode 100644
index 000000000000..26be73d850ac
--- /dev/null
+++ b/test/fixtures/sea/vfs/math.js
@@ -0,0 +1,4 @@
+module.exports = {
+  add: (a, b) => a + b,
+  multiply: (a, b) => a * b,
+};
diff --git a/test/fixtures/sea/vfs/sea-config.json b/test/fixtures/sea/vfs/sea-config.json
new file mode 100644
index 000000000000..767e778ea26e
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea-config.json
@@ -0,0 +1,15 @@
+{
+  "main": "sea.js",
+  "output": "sea-prep.blob",
+  "useVfs": true,
+  "assets": {
+    "config.json": "config.json",
+    "data/greeting.txt": "greeting.txt",
+    "modules/math.js": "math.js",
+    "modules/calculator.js": "calculator.js",
+    "node_modules/test-pkg/package.json": "test-pkg-package.json",
+    "node_modules/test-pkg/index.js": "test-pkg-index.js",
+    "node_modules/test-exports-pkg/package.json": "test-exports-pkg-package.json",
+    "node_modules/test-exports-pkg/lib/entry.js": "test-exports-pkg-entry.js"
+  }
+}
diff --git a/test/fixtures/sea/vfs/sea.js b/test/fixtures/sea/vfs/sea.js
new file mode 100644
index 000000000000..59989390c7d1
--- /dev/null
+++ b/test/fixtures/sea/vfs/sea.js
@@ -0,0 +1,106 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const assert = require('assert');
+
+// The SEA VFS never shadows the real file system: the assets are mounted at
+// a reserved mount point and the main script runs from inside the mount, so
+// everything is reachable through __dirname-relative paths and relative
+// requires.
+
+// The main script runs from inside the VFS, not from the executable.
+assert.notStrictEqual(__filename, process.execPath);
+assert.strictEqual(path.basename(__filename), 'sea.js');
+assert.strictEqual(require.main, module);
+console.log('main script runs from', __filename);
+
+// The main script itself is readable through fs.
+assert.strictEqual(fs.existsSync(__filename), true);
+
+// Read the config file through standard fs (via VFS hooks)
+const configContent = fs.readFileSync(path.join(__dirname, 'config.json'), 'utf8');
+const config = JSON.parse(configContent);
+assert.strictEqual(config.name, 'test-app', 'config.name should match');
+assert.strictEqual(config.version, '1.0.0', 'config.version should match');
+console.log('Read config.json:', config);
+
+// Read a text file
+const greetingPath = path.join(__dirname, 'data', 'greeting.txt');
+const greeting = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(greeting, 'Hello from SEA VFS!', 'greeting should match');
+console.log('Read greeting.txt:', greeting);
+
+// Test existsSync
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'config.json')), true);
+assert.strictEqual(fs.existsSync(greetingPath), true);
+assert.strictEqual(fs.existsSync(path.join(__dirname, 'nonexistent.txt')), false);
+console.log('existsSync tests passed');
+
+// Test statSync
+const configStat = fs.statSync(path.join(__dirname, 'config.json'));
+assert.strictEqual(configStat.isFile(), true);
+assert.strictEqual(configStat.isDirectory(), false);
+const dirStat = fs.statSync(path.join(__dirname, 'data'));
+assert.strictEqual(dirStat.isDirectory(), true);
+console.log('statSync tests passed');
+
+// Test readdirSync - the mount root lists the assets and the main script
+const entries = fs.readdirSync(__dirname);
+assert.ok(entries.includes('config.json'), 'Should include config.json');
+assert.ok(entries.includes('data'), 'Should include data directory');
+assert.ok(entries.includes('sea.js'), 'Should include the main script');
+console.log('readdirSync tests passed, entries:', entries);
+
+// The VFS is read-only
+assert.throws(() => {
+  fs.writeFileSync(path.join(__dirname, 'new-file.txt'), 'nope');
+}, { code: 'EROFS' });
+console.log('read-only test passed');
+
+// Test relative require from main script - __filename is inside the mount so
+// relative paths resolve against the bundled assets via module hooks
+const mathModule = require('./modules/math.js');
+assert.strictEqual(mathModule.add(2, 3), 5, 'math.add should work');
+assert.strictEqual(mathModule.multiply(4, 5), 20, 'math.multiply should work');
+console.log('relative require from main script passed');
+
+// Test transitive requires: calculator.js requires ./math.js internally
+const calculator = require('./modules/calculator.js');
+assert.strictEqual(calculator.sum(10, 20), 30, 'calculator.sum should work');
+assert.strictEqual(calculator.product(3, 7), 21, 'calculator.product should work');
+console.log('transitive require from VFS tests passed');
+
+// Module lookup paths are confined to the mount
+assert.deepStrictEqual(module.paths, [path.join(__dirname, 'node_modules')]);
+console.log('module.paths confinement test passed');
+
+// Test that node:sea API and VFS can load the same asset
+const sea = require('node:sea');
+const seaAsset = sea.getAsset('data/greeting.txt', 'utf8');
+const vfsAsset = fs.readFileSync(greetingPath, 'utf8');
+assert.strictEqual(seaAsset, vfsAsset, 'node:sea and VFS should return the same content');
+console.log('node:sea API and VFS coexistence test passed');
+
+// Test buffer independence: multiple reads return independent copies
+const buf1 = fs.readFileSync(greetingPath);
+const buf2 = fs.readFileSync(greetingPath);
+const original = buf1[0];
+buf1[0] = 0xFF;
+assert.strictEqual(buf2[0], original, 'buf2 should be unaffected by buf1 mutation');
+assert.strictEqual(buf1[0], 0xFF, 'buf1 mutation should persist');
+console.log('buffer independence test passed');
+
+// Test node_modules package lookup via VFS (resolved through "exports" field)
+const testPkg = require('test-pkg');
+assert.strictEqual(testPkg.name, 'test-pkg', 'package name should match');
+assert.strictEqual(testPkg.greet('World'), 'Hello, World!', 'package function should work');
+console.log('node_modules package lookup test passed');
+
+// Test exports-only package (no "main" field, entry in subdirectory)
+// This proves the package.json reader is VFS-aware - without it,
+// "exports" would not be consulted and resolution would fail.
+const exportsPkg = require('test-exports-pkg');
+assert.strictEqual(exportsPkg.fromExports, true, 'exports-only package should resolve');
+console.log('exports-only package lookup test passed');
+
+console.log('All SEA VFS tests passed!');
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-entry.js b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
new file mode 100644
index 000000000000..3ef6bdcadc7a
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-entry.js
@@ -0,0 +1,2 @@
+'use strict';
+module.exports = { fromExports: true };
diff --git a/test/fixtures/sea/vfs/test-exports-pkg-package.json b/test/fixtures/sea/vfs/test-exports-pkg-package.json
new file mode 100644
index 000000000000..86f62f622da5
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-exports-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-exports-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./lib/entry.js" }
+}
diff --git a/test/fixtures/sea/vfs/test-pkg-index.js b/test/fixtures/sea/vfs/test-pkg-index.js
new file mode 100644
index 000000000000..e6c2ee94611c
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-index.js
@@ -0,0 +1,5 @@
+'use strict';
+module.exports = {
+  name: 'test-pkg',
+  greet: (name) => `Hello, ${name}!`,
+};
diff --git a/test/fixtures/sea/vfs/test-pkg-package.json b/test/fixtures/sea/vfs/test-pkg-package.json
new file mode 100644
index 000000000000..bc4109d609ae
--- /dev/null
+++ b/test/fixtures/sea/vfs/test-pkg-package.json
@@ -0,0 +1,5 @@
+{
+  "name": "test-pkg",
+  "version": "1.0.0",
+  "exports": { ".": "./index.js" }
+}
diff --git a/test/fixtures/sqlite/backup-last-request.mjs b/test/fixtures/sqlite/backup-last-request.mjs
new file mode 100644
index 000000000000..91ad84e77ed5
--- /dev/null
+++ b/test/fixtures/sqlite/backup-last-request.mjs
@@ -0,0 +1,34 @@
+import { backup, DatabaseSync } from 'node:sqlite';
+
+const source = new DatabaseSync(':memory:');
+source.exec(`
+  CREATE TABLE data(value);
+  INSERT INTO data VALUES (zeroblob(1048576));
+`);
+
+let keepAlive = setInterval(() => {}, 1_000);
+let settled = false;
+
+process.once('beforeExit', () => {
+  if (!settled) {
+    process.stderr.write('backup promise did not settle before the event loop became idle\n');
+    process.exit(1);
+  }
+});
+
+backup(source, process.argv[2], {
+  rate: 1,
+  progress() {
+    if (keepAlive !== undefined) {
+      clearInterval(keepAlive);
+      keepAlive = undefined;
+    }
+  },
+}).then(() => {
+  settled = true;
+  source.close();
+}, (error) => {
+  settled = true;
+  process.stderr.write(`${error.stack ?? error}\n`);
+  process.exitCode = 1;
+});
diff --git a/test/fixtures/wasi-preview-1.js b/test/fixtures/wasi-preview-1.js
index 535bc3e5ec18..3fde5a30b759 100644
--- a/test/fixtures/wasi-preview-1.js
+++ b/test/fixtures/wasi-preview-1.js
@@ -68,6 +68,9 @@ assert.strictEqual(wasiPreview1.wasiImport,
       const name = `pthread-${tid}`;
       const sab = new SharedArrayBuffer(8 + 8192);
       const result = new Int32Array(sab);
+      // The thread stores 0 once it has loaded or 1 with an error; wait on a
+      // value neither of them writes so an early notify cannot be missed.
+      Atomics.store(result, 0, -1);
 
       const workerData = {
         name,
@@ -106,7 +109,7 @@ assert.strictEqual(wasiPreview1.wasiImport,
         throw new Error(e);
       });
 
-      const r = Atomics.wait(result, 0, 0, 1000);
+      const r = Atomics.wait(result, 0, -1, common.platformTimeout(30_000));
       if (r === 'timed-out') {
         workers[tid].terminate();
         delete workers[tid];
diff --git a/test/fixtures/webcrypto/supports-level-2.mjs b/test/fixtures/webcrypto/supports-level-2.mjs
index 3d0f8a630394..b07ce9097bb7 100644
--- a/test/fixtures/webcrypto/supports-level-2.mjs
+++ b/test/fixtures/webcrypto/supports-level-2.mjs
@@ -13,8 +13,6 @@ const [ECDH, X25519] = await Promise.all([
   subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']),
 ]);
 
-const boringSSL = process.features.openssl_is_boringssl;
-
 export const vectors = {
   'encrypt': [
     [false, 'Invalid'],
@@ -124,6 +122,9 @@ export const vectors = {
     [true,
      { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 },
      { name: 'HMAC', hash: 'SHA-256' }],
+    [false,
+     { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 2 ** 31 },
+     { name: 'AES-CBC', length: 128 }],
     [false,
      { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 },
      'HKDF'],
@@ -183,6 +184,7 @@ export const vectors = {
     [true, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 8],
     [true, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 0],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 0 }, 8],
+    [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 2 ** 31 }, 8],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, null],
     [false, { name: 'PBKDF2', hash: 'SHA-256', salt: Buffer.alloc(0), iterations: 1 }, 7],
     [false, { name: 'PBKDF2', hash: 'Invalid', salt: Buffer.alloc(0), iterations: 1 }, 8],
diff --git a/test/fixtures/webcrypto/supports-modern-algorithms.mjs b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
index 4b44e02d479d..67fad15f7f39 100644
--- a/test/fixtures/webcrypto/supports-modern-algorithms.mjs
+++ b/test/fixtures/webcrypto/supports-modern-algorithms.mjs
@@ -1,14 +1,16 @@
 import * as crypto from 'node:crypto'
 
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 const pqc = hasOpenSSL(3, 5) || boringSSL;
 const argon2 = hasOpenSSL(3, 2);
 const shake128 = crypto.getHashes().includes('shake128');
 const shake256 = crypto.getHashes().includes('shake256');
+const sha3 = crypto.getHashes().includes('sha3-256');
 const ocb = hasOpenSSL(3);
 const kmac = hasOpenSSL(3);
+const hybridKems = pqc && (!boringSSL || (sha3 && shake256));
 
 const { subtle } = globalThis.crypto;
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
@@ -94,6 +96,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -115,6 +120,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, { name: 'AES-OCB', length: 128 }],
     [argon2, 'Argon2d'],
     [argon2, 'Argon2i'],
@@ -136,6 +144,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
     [true, 'ChaCha20-Poly1305'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [ocb, 'AES-OCB'],
     [false, 'Argon2d'],
     [false, 'Argon2i'],
@@ -159,6 +170,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
     [false, 'AES-CTR'],
     [false, 'AES-CBC'],
     [false, 'AES-GCM'],
@@ -218,6 +232,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'encapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -233,6 +250,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
@@ -244,6 +264,9 @@ export const vectors = {
     [pqc && !boringSSL, 'ML-KEM-512'],
     [pqc, 'ML-KEM-768'],
     [pqc, 'ML-KEM-1024'],
+    [hybridKems, 'MLKEM768-P256'],
+    [hybridKems, 'MLKEM768-X25519'],
+    [hybridKems, 'MLKEM1024-P384'],
   ],
   'decapsulateKey': [
     [pqc && !boringSSL, 'ML-KEM-512', 'AES-KW'],
@@ -259,6 +282,9 @@ export const vectors = {
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 255 }],
     [pqc, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 249 }],
     [pqc && kmac, 'ML-KEM-768', { name: 'KMAC128', length: 255 }],
+    [hybridKems, 'MLKEM768-P256', 'HKDF'],
+    [hybridKems, 'MLKEM768-X25519', 'HKDF'],
+    [hybridKems, 'MLKEM1024-P384', 'HKDF'],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 128 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 248 }],
     [false, 'ML-KEM-768', { name: 'HMAC', hash: 'SHA-256', length: 512 }],
diff --git a/test/fixtures/webcrypto/supports-secure-curves.mjs b/test/fixtures/webcrypto/supports-secure-curves.mjs
index a3a84f6c9f9a..fa3f1d365213 100644
--- a/test/fixtures/webcrypto/supports-secure-curves.mjs
+++ b/test/fixtures/webcrypto/supports-secure-curves.mjs
@@ -1,10 +1,10 @@
-import { hasOpenSSL } from '../../common/crypto.js'
+import { hasOpenSSL, isBoringSSL } from '../../common/crypto.js'
 
 const supportsContext = hasOpenSSL(3, 2);
 
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const X25519 = await subtle.generateKey('X25519', false, ['deriveBits', 'deriveKey']);
 let X448;
diff --git a/test/fixtures/webcrypto/supports-sha3.mjs b/test/fixtures/webcrypto/supports-sha3.mjs
index 73f5b778eeb9..fe256dcfb168 100644
--- a/test/fixtures/webcrypto/supports-sha3.mjs
+++ b/test/fixtures/webcrypto/supports-sha3.mjs
@@ -1,6 +1,8 @@
+import { isBoringSSL } from '../../common/crypto.js'
+
 const { subtle } = globalThis.crypto;
 
-const boringSSL = process.features.openssl_is_boringssl;
+const boringSSL = isBoringSSL;
 
 const RSA_KEY_GEN = {
   modulusLength: 2048,
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
index ffb78f7e5348..c0afb698e0a2 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_bits.tentative.https.any.js
@@ -1,13 +1,23 @@
-// META: title=WebCryptoAPI: ML-KEM encapsulateBits() and decapsulateBits() tests
-// META: script=ml_kem_vectors.js
+// META: title=WebCryptoAPI: KEM encapsulateBits() and decapsulateBits() tests
 // META: script=../util/helpers.js
+// META: script=ml_kem_vectors.js
+// META: script=hybrid_kem_vectors.js
 // META: timeout=long
 
 function define_bits_tests() {
   var subtle = self.crypto.subtle;
-  var variants = ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024'];
+  var variants = [
+    { name: 'ML-KEM-512', ciphertextLength: 768 },
+    { name: 'ML-KEM-768', ciphertextLength: 1088 },
+    { name: 'ML-KEM-1024', ciphertextLength: 1568 },
+    { name: 'MLKEM768-P256', ciphertextLength: 1153 },
+    { name: 'MLKEM768-X25519', ciphertextLength: 1120 },
+    { name: 'MLKEM1024-P384', ciphertextLength: 1665 },
+  ];
+
+  variants.forEach(function (variant) {
+    var algorithmName = variant.name;
 
-  variants.forEach(function (algorithmName) {
     // Test encapsulateBits operation
     promise_test(async function (test) {
       // Generate a key pair for testing
@@ -50,24 +60,11 @@ function define_bits_tests() {
         'Shared key should be 32 bytes'
       );
 
-      // Verify ciphertext length based on algorithm variant
-      var expectedCiphertextLength;
-      switch (algorithmName) {
-        case 'ML-KEM-512':
-          expectedCiphertextLength = 768;
-          break;
-        case 'ML-KEM-768':
-          expectedCiphertextLength = 1088;
-          break;
-        case 'ML-KEM-1024':
-          expectedCiphertextLength = 1568;
-          break;
-      }
       assert_equals(
         encapsulatedBits.ciphertext.byteLength,
-        expectedCiphertextLength,
+        variant.ciphertextLength,
         'Ciphertext should be ' +
-          expectedCiphertextLength +
+          variant.ciphertextLength +
           ' bytes for ' +
           algorithmName
       );
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
index a482eafbb610..e978fe497e63 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/encap_decap_keys.tentative.https.any.js
@@ -1,11 +1,19 @@
-// META: title=WebCryptoAPI: ML-KEM encapsulateKey() and decapsulateKey() tests
-// META: script=ml_kem_vectors.js
+// META: title=WebCryptoAPI: KEM encapsulateKey() and decapsulateKey() tests
 // META: script=../util/helpers.js
+// META: script=ml_kem_vectors.js
+// META: script=hybrid_kem_vectors.js
 // META: timeout=long
 
 function define_key_tests() {
   var subtle = self.crypto.subtle;
-  var variants = ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024'];
+  var variants = [
+    { name: 'ML-KEM-512', ciphertextLength: 768 },
+    { name: 'ML-KEM-768', ciphertextLength: 1088 },
+    { name: 'ML-KEM-1024', ciphertextLength: 1568 },
+    { name: 'MLKEM768-P256', ciphertextLength: 1153 },
+    { name: 'MLKEM768-X25519', ciphertextLength: 1120 },
+    { name: 'MLKEM1024-P384', ciphertextLength: 1665 },
+  ];
 
   // Test various 256-bit shared key algorithms
   var sharedKeyConfigs = [
@@ -36,7 +44,9 @@ function define_key_tests() {
     },
   ];
 
-  variants.forEach(function (algorithmName) {
+  variants.forEach(function (variant) {
+    var algorithmName = variant.name;
+
     sharedKeyConfigs.forEach(function (config) {
       [true, false].forEach(function (extractable) {
         // Test encapsulateKey operation
@@ -115,24 +125,11 @@ function define_key_tests() {
             );
           }
 
-          // Verify ciphertext length based on algorithm variant
-          var expectedCiphertextLength;
-          switch (algorithmName) {
-            case 'ML-KEM-512':
-              expectedCiphertextLength = 768;
-              break;
-            case 'ML-KEM-768':
-              expectedCiphertextLength = 1088;
-              break;
-            case 'ML-KEM-1024':
-              expectedCiphertextLength = 1568;
-              break;
-          }
           assert_equals(
             encapsulatedKey.ciphertext.byteLength,
-            expectedCiphertextLength,
+            variant.ciphertextLength,
             'Ciphertext should be ' +
-              expectedCiphertextLength +
+              variant.ciphertextLength +
               ' bytes for ' +
               algorithmName
           );
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js
new file mode 100644
index 000000000000..751d192cbd42
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/hybrid_kem_vectors.js
@@ -0,0 +1,50 @@
+// Test vectors from draft-irtf-cfrg-concrete-hybrid-kems-03, Appendix A.
+
+// MLKEM768-P256 test vectors
+ml_kem_vectors['MLKEM768-P256'] = {
+  publicKey: hexStringToUint8Array(
+    '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220d422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '0000000000000000000000000000000000000000000000000000000000000000'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4efca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35d4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e443f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe334e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6dad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c87e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f276356fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796bd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853fc4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498cfd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab376f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa66491ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd81319a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274aca2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad493c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e602877037de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc04428a824ea7cf56ad2a64ed368b71315d80cee846007cff1d2eea2c3f0f921537304ae598f98dd10d1f102811a4e2d161c3fd8bbb193d4b25bee950ac839c0f9d'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '9bd018e869bb01b63fb8f5da374a73d347ea14cb2bc570b13d0908e2288ec456'
+  ),
+};
+
+// MLKEM768-X25519 test vectors
+ml_kem_vectors['MLKEM768-X25519'] = {
+  publicKey: hexStringToUint8Array(
+    '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '0000000000000000000000000000000000000000000000000000000000000000'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4efca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35d4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e443f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe334e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6dad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c87e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f276356fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796bd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853fc4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498cfd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab376f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa66491ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd81319a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274aca2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad493c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e602877037de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc6b3d57762f8badb69433f9c6d060f85f5e5c6b6803a816d141c075f63541ad10'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    'e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a'
+  ),
+};
+
+// MLKEM1024-P384 test vectors
+ml_kem_vectors['MLKEM1024-P384'] = {
+  publicKey: hexStringToUint8Array(
+    'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d677d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c749c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b04d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e6853453b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e298c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cbaa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c5938258c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec06746749473e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed77cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865ab22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db657460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b510b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e78544887f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b388725758a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1adde369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a875d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a7372632ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a306e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e370941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da896133272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa702265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '0000000000000000000000000000000000000000000000000000000000000000'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'dc63d18bb9715fb6e3ba71cb439fcd3377a75305cc9b144e6758bf5794a272e6b4a0da33234c0ac1bb5b4e60e4c82eb1fb780d59e4e4616641a0595ba031e3ae69d971dcd5fff14e21731a8e1a221f46c7820d214630b707fa1b0de3a484698f3d49e0a75f1212b8c42d330dd909f15eac0402f19ee77fba9447e1c44304b0d8c371c17c5549fdbdec1e0a2e7be9f577d7a4b5b2618d9ba67ab95a0297cd5c5a13c89cc5a57cbd9a8ae38d66455c9a3d2bc55b498775fee2f6dc224d376d5f526a8354c8ed724f60337e900b85627972383e1fd987d407a8834005814a4fdc94c947e5f3471459288cfb127952b3208f10c914200bbaac5fcebd2bc9e2848492bab17b9288ca8b81d1c2ac9522dcc0b6d5f51e10f3afbb5d65fbf919edef6323c4e92c6b0690c10db25a9182de9e919ea1b3e65ae6150635d5180ebd7d23a2264828bc3ee1fd34dba1924ad0db30c747e05baa9148f1a032769c685e04665fd802a79c4624f69a9198a426eac1b217d903cdacf8844e73365f3a219a700dda27edf6bea33602617c5fd105b301b884bfaaa1163b791ec09f82523fef65c87b75ed063ceb127729b82c8712e1f41b547d095f55ee71f3f8b47a306cb5d9bdd817854c74a42eebf934a1136dea3fbc546ad8ce51b3171913722f08b0261d197590342bfe4108dcb08c62a98610cbfb8d3b2831f56dcac2220e29a5811f38f0824f21a6cbebc64fd89a09b110dffbe03799ffc74fe565c80dbf6a66acd7bfd14cb90acba03405a7982d4c1c68caa75f8b72e4dd6401d7dce4db4f6b820a7886a604b66b4e5b9eea5e5eddc2bca458a25977bd1f02874c5d9daf2baf56b3040f24ce7fe14cc14d61c7960db4decb37d9779c8e36d69a7763066d8c1149312d26887a693dc222daa892dd00cd8f3a558cf605e4c65c011c2e9f0d671ba10af2bb90ee0351ae5078eb7878399ec9eb4ace87a68269618bda12a7aed6fda0385496c5d10ac36b35255f4a31edfa8a2c516b65c63431013ed4909ec7a787a5efb9d3c3887b80ac18a44934b6559bd8a84b18e86fa1b0b9e1d9f92ba495ba5595d82e5095612b79e805154bf428a7071662c7cefb6450165c6f8f6954c37219bff4a49894a8aa37f940a40f4ec942c281e6c47ea408199927a724ff1c7460fc8fd47a98d0c9d4d1f07994d8084f6e084935ad7c2985282fabd5ca13b942e10d35278f4ff4cb1cb96f3c862410e79144a46b4db1a3c3d4d63018ec5c01ca48cb67081482e7d434b4abe5fa3071f2fbb533f745602b0da6183b28e6c5dfa42dab7ae0bbbf7638e106be1bd7312cba399e08c96dbd69a128a2face2d4a02951533a25e82fe63d0aaaa2e8c75150215c93ab06c22f9cab8d1cae7424f8baa09b3260ecfa3c7c8d55a276b4b317f72ec86b1b145a63aca83ef8c1204d8ab0c96ea3f742de39db47020616e139285814f188029ace4587f14cf12b5ed81086d8213cf8cb578341e04e16f519b77ff4c2644a5732639d658d0c4eaf992bd7dbd5011b700a5fa63dc1b24a84a3c80656bab5705dc3a74312c80e8bdb24a7ac6e27bcb8c07ece62c6e5777dd3dc0657181f440c7524d907dd27950bcb252aef7f8cbf453cee3fe3143a665072c787cea76de323aa41537df2f3a40a518a694b918953bde8d57084e32d3b1fdcf9d153e73f02624beaf6ebe23e6828a6a489583494f3cd790fc96bb6f5d8b198402965e2e668e6581e7cf1c8a47a92198388f2b4cd38df660f0ddd48ad126819c4435af3a12c89113d778ac544fd8079cb8aaa97d2ff1b608da574c4dcd87f4979390de3be405f0e47788dd0b01662805079fd73c64e9278c036544add3694c838bfcfb08c8a5efb09549442123eaa59fa30fbb9198105f6be00163bac076193f6721c539714108bbfae167f5db8085c5838618f32a968bbb25c40645a17c17b9bec64aea45832eec5adc25b53e677f67566fbf5ce2d9193a06bd9b477e601d589b25f422defc49105252cd9ca6adcbb36be8a01a8472b4d463f655be14ccff9b0571a2048e31c14b9b23e2d43fafa3f85ece6fd41896cc5c68993dbaa926f285ec94c72887de9564881d735c05f83aa474b3d4cd133a630ac63850771cb5270f6cb7a391170d66af3e4901b6eb0253f3f34ef57d6babd97aa99ce718c3bcb53ff13d4028a0c943bb9681106ce176242cccb75df1d3f8d3706e5b068b042c3154d5e6292581b36499e6b069b9a490aa67f0675390539da8555e6a4e8a35a86fdfea83e1387bf4acc650ec1edae7c99aa3a48306ee1d1a5e513c0c6901f64d0a3ee285de3c11d49f90cd4323dafda14832f0d8b760c0e5a48633c967cfaf'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '8c028c6ea72a1c59408e2b15dd8fed8008517e861cd2329b159bda1919ea656c'
+  ),
+};
+
diff --git a/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js b/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js
index 3e04fda6a3b3..a3cd8a2a749e 100644
--- a/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js
+++ b/test/fixtures/wpt/WebCryptoAPI/encap_decap/ml_kem_vectors.js
@@ -2,658 +2,48 @@ var ml_kem_vectors = {};
 
 // ML-KEM-512 test vectors
 ml_kem_vectors['ML-KEM-512'] = {
-  // 800-byte publicKey
-  publicKey: new Uint8Array([
-    0xce, 0xcb, 0x75, 0x1f, 0x32, 0x67, 0x09, 0xb4, 0x9e, 0x14, 0xca, 0xa4,
-    0xbe, 0x30, 0x95, 0xee, 0xe9, 0x85, 0x58, 0x86, 0x2b, 0x83, 0xb9, 0x33,
-    0x56, 0x86, 0x4e, 0xad, 0x05, 0xcb, 0x38, 0x26, 0x95, 0x4c, 0xdb, 0xb2,
-    0x1d, 0xc4, 0x52, 0x44, 0x60, 0x36, 0xdd, 0x77, 0x82, 0x30, 0x09, 0x4f,
-    0xe3, 0xb8, 0x14, 0xc7, 0x99, 0x8f, 0x94, 0x45, 0x82, 0xd3, 0x89, 0xcc,
-    0xc7, 0x38, 0x97, 0x4e, 0x39, 0x49, 0x6d, 0xb5, 0x34, 0xd4, 0xdb, 0x78,
-    0x4b, 0x65, 0x44, 0x6e, 0xa9, 0xbc, 0x59, 0xe8, 0x96, 0xa3, 0x39, 0xbe,
-    0x6c, 0x13, 0x46, 0x3a, 0xb7, 0x4a, 0xe2, 0x02, 0x8a, 0x12, 0x69, 0x5c,
-    0x5b, 0x12, 0xc1, 0xc9, 0xd5, 0x70, 0x06, 0x58, 0x19, 0xf6, 0x82, 0x3b,
-    0x53, 0x3b, 0x29, 0xbb, 0xc8, 0x93, 0x8b, 0xc0, 0xaa, 0x74, 0x52, 0x77,
-    0xe7, 0x33, 0x57, 0xd9, 0x52, 0x5c, 0xec, 0x0c, 0xaf, 0xe1, 0xf0, 0x8a,
-    0x1b, 0x9b, 0x11, 0xa2, 0xf8, 0xaa, 0xc1, 0xf5, 0xab, 0xb2, 0xa6, 0xb4,
-    0x5f, 0x10, 0x95, 0x69, 0xb2, 0x0c, 0xfe, 0xba, 0xaf, 0x32, 0xb4, 0x90,
-    0x64, 0x4c, 0x18, 0x84, 0xd7, 0x7f, 0xe3, 0x88, 0xa1, 0x20, 0xb0, 0x85,
-    0x14, 0xc9, 0x6e, 0xeb, 0xb3, 0xbc, 0x0c, 0xd9, 0x77, 0x06, 0x76, 0x9f,
-    0x70, 0xf0, 0x48, 0x47, 0x09, 0x8a, 0xbf, 0x62, 0x82, 0xac, 0x00, 0x2f,
-    0xa0, 0x15, 0x84, 0xab, 0x96, 0x76, 0x0b, 0xdc, 0x46, 0x57, 0x09, 0x3b,
-    0xb6, 0x97, 0x9e, 0x0a, 0xf8, 0x54, 0x0b, 0xb7, 0x20, 0x72, 0x2a, 0x6c,
-    0xbb, 0xb8, 0x48, 0x1f, 0xd0, 0x36, 0xf5, 0xd3, 0x64, 0xc5, 0x64, 0xc9,
-    0x6f, 0x4a, 0xa6, 0xbe, 0xb2, 0x40, 0x86, 0xb3, 0xb1, 0x04, 0xe0, 0xaf,
-    0x59, 0x10, 0x63, 0x8b, 0x66, 0x7d, 0x7d, 0x29, 0xb3, 0x2e, 0x93, 0xad,
-    0xdb, 0xa0, 0x54, 0x37, 0x82, 0x38, 0x58, 0xf7, 0xcf, 0xc6, 0x9a, 0xcd,
-    0xaa, 0x94, 0xba, 0x74, 0x90, 0x29, 0x73, 0xb8, 0x8a, 0x9b, 0x08, 0xce,
-    0x2f, 0xb1, 0x09, 0xb2, 0xa1, 0x6d, 0x31, 0xf1, 0x0d, 0x8b, 0xb4, 0x52,
-    0xa0, 0x89, 0x96, 0xb9, 0x54, 0x78, 0x49, 0x90, 0x8a, 0x61, 0xba, 0x0d,
-    0x92, 0xf3, 0x6f, 0x46, 0x7a, 0xa5, 0x22, 0x4c, 0xb9, 0x2c, 0xaa, 0x17,
-    0xab, 0xc9, 0x37, 0x84, 0x2a, 0x4f, 0xac, 0xf6, 0x4a, 0xf4, 0xe2, 0x81,
-    0x12, 0x78, 0x49, 0x6d, 0xac, 0xa6, 0xe1, 0xa9, 0x89, 0x8a, 0x5c, 0x02,
-    0x8e, 0xa4, 0x6a, 0x64, 0xe5, 0x67, 0x84, 0xc5, 0xbe, 0x7e, 0xf9, 0x39,
-    0x60, 0xa9, 0x10, 0xd7, 0x01, 0x1e, 0x03, 0xb1, 0x7c, 0xaf, 0x42, 0xce,
-    0x3e, 0xc2, 0x13, 0x75, 0x96, 0x93, 0x32, 0x0b, 0x2c, 0x96, 0xb2, 0x2a,
-    0xef, 0x80, 0x10, 0xa3, 0x82, 0x5d, 0x60, 0xbc, 0xc0, 0xe9, 0x15, 0x1a,
-    0x0f, 0xa4, 0x3d, 0xf1, 0x0c, 0xa3, 0xa3, 0xcc, 0x6b, 0x6d, 0x6b, 0xb6,
-    0xa2, 0xf6, 0x03, 0x5f, 0xe3, 0xc0, 0x23, 0x62, 0xae, 0x07, 0xe5, 0xa9,
-    0x79, 0x28, 0x69, 0x24, 0xd0, 0x5a, 0x54, 0xc5, 0x13, 0x7b, 0x46, 0xb3,
-    0x99, 0x85, 0x74, 0xa7, 0x3c, 0xc0, 0x09, 0x87, 0x5d, 0xd5, 0x66, 0xbe,
-    0xae, 0x6b, 0x4d, 0x47, 0xa2, 0x79, 0xf5, 0x85, 0xaf, 0x8e, 0xc5, 0x7c,
-    0xfc, 0xa2, 0x81, 0x16, 0xa9, 0x54, 0x03, 0xfa, 0x6e, 0x49, 0xe7, 0xa4,
-    0x11, 0x16, 0x89, 0xf2, 0x34, 0x0f, 0xe9, 0x08, 0x8e, 0x07, 0x43, 0xa2,
-    0x6e, 0x06, 0xbc, 0x6c, 0x54, 0xb0, 0x12, 0x61, 0x76, 0x69, 0x05, 0xcf,
-    0xb2, 0x78, 0x5e, 0xf5, 0xd5, 0xc9, 0x86, 0xec, 0xc9, 0xd7, 0x4c, 0x66,
-    0xef, 0xec, 0x57, 0x69, 0xa9, 0x2c, 0x8a, 0x03, 0x48, 0x90, 0x30, 0x0f,
-    0x2b, 0x7c, 0x7d, 0x20, 0xa8, 0x0f, 0xfb, 0x73, 0x1c, 0xe4, 0x19, 0x2c,
-    0xec, 0x02, 0x1a, 0xd9, 0xb9, 0xac, 0x25, 0xdc, 0x99, 0x46, 0x00, 0x4c,
-    0xcd, 0xcc, 0xa5, 0xf4, 0xb2, 0x95, 0x81, 0xf2, 0x7e, 0xb3, 0xe7, 0x24,
-    0x50, 0x4a, 0xc3, 0x6e, 0x95, 0xae, 0xb7, 0xbc, 0x49, 0xc6, 0x5a, 0x78,
-    0x3a, 0xb8, 0xc2, 0xd1, 0x69, 0xcc, 0xc0, 0x11, 0x3b, 0x18, 0x26, 0x30,
-    0x7e, 0x51, 0xb3, 0xc5, 0x73, 0x07, 0xa6, 0x8a, 0xc3, 0xe6, 0x18, 0xba,
-    0x22, 0x39, 0x28, 0xd6, 0x33, 0x61, 0x51, 0x28, 0x92, 0xbf, 0x93, 0xb1,
-    0x52, 0x68, 0xae, 0x54, 0xea, 0xc4, 0x4f, 0x62, 0x1d, 0x82, 0x94, 0x39,
-    0xe2, 0x98, 0x7c, 0x1b, 0xea, 0x13, 0x26, 0x92, 0x6a, 0xb1, 0x1c, 0x59,
-    0x11, 0x47, 0x7c, 0x7b, 0xeb, 0x28, 0x2a, 0xe8, 0x81, 0x0b, 0x55, 0x14,
-    0x53, 0x80, 0x28, 0xb8, 0x58, 0x8b, 0x1c, 0xa5, 0x91, 0x4e, 0x55, 0x9e,
-    0x68, 0x32, 0x5d, 0x5f, 0x94, 0x87, 0x83, 0x73, 0x3f, 0xfc, 0x8b, 0xb4,
-    0x8c, 0xd9, 0x52, 0xf8, 0x74, 0x5f, 0x76, 0xc2, 0x63, 0x9a, 0x87, 0x54,
-    0x10, 0x47, 0x1e, 0x83, 0x82, 0x31, 0x6d, 0x22, 0x26, 0x16, 0x32, 0xb1,
-    0xa1, 0x78, 0x09, 0xd5, 0x8b, 0xbb, 0x75, 0xd7, 0x8b, 0xa2, 0x99, 0xcf,
-    0xde, 0x2a, 0x73, 0x0f, 0x80, 0x91, 0xdc, 0x44, 0xb8, 0xaa, 0x73, 0x69,
-    0x55, 0xfa, 0x23, 0xb8, 0x16, 0xb1, 0xd7, 0x78, 0x4d, 0x97, 0xab, 0xcb,
-    0x0c, 0xf4, 0xcb, 0xb7, 0xc8, 0x36, 0x4e, 0xf1, 0x2a, 0x82, 0xb0, 0x09,
-    0x10, 0x3c, 0x8f, 0x7a, 0x76, 0xc6, 0xac, 0x08, 0x6a, 0xe1, 0x0a, 0x3e,
-    0x6b, 0x06, 0x39, 0xcb, 0x35, 0xce, 0x10, 0xc3, 0x1f, 0xaa, 0xaa, 0x26,
-    0xfc, 0x22, 0xb9, 0xd5, 0x12, 0xcc, 0xa8, 0x48, 0x0a, 0x61, 0xac, 0x3a,
-    0xa1, 0x87, 0xbf, 0xea, 0x79, 0x11, 0x7d, 0xfb, 0xc4, 0xfe, 0x0b, 0x4f,
-    0x94, 0x57, 0xd8, 0x7b, 0xa4, 0x91, 0x4e, 0xe5, 0x5a, 0x4b, 0xaa, 0x94,
-    0x6e, 0x91, 0x55, 0xe9, 0x9b, 0xae, 0xac, 0xe9, 0x52, 0x2c, 0xc6, 0x4b,
-    0xee, 0x7b, 0xd7, 0xfa, 0x45, 0xeb, 0x2f, 0x6b,
-  ]),
-  // 64-byte privateSeed
-  privateSeed: new Uint8Array([
-    0x3e, 0x42, 0x62, 0xca, 0xd1, 0x44, 0x02, 0x6d, 0xe9, 0xbd, 0x35, 0xbf,
-    0x20, 0x3f, 0xfb, 0x40, 0x26, 0x3c, 0x8c, 0x76, 0x5d, 0x05, 0xd2, 0xa4,
-    0xd0, 0x0a, 0x8a, 0xe9, 0x25, 0x07, 0xd2, 0xd2, 0xc5, 0x60, 0xb8, 0x43,
-    0x5a, 0x05, 0x4d, 0x81, 0x6e, 0x5f, 0x25, 0x35, 0xa3, 0xdf, 0x91, 0x83,
-    0x3c, 0xca, 0xd2, 0x63, 0xe5, 0x8e, 0x3c, 0x34, 0x55, 0x5c, 0xd8, 0xc5,
-    0x73, 0x25, 0xad, 0x9d,
-  ]),
-  // 768-byte sampleCiphertext
-  sampleCiphertext: new Uint8Array([
-    0x0e, 0x48, 0x87, 0x58, 0xdc, 0xd4, 0x55, 0x52, 0x56, 0x5b, 0xec, 0xe5,
-    0xb8, 0xbd, 0xa4, 0x52, 0x35, 0x44, 0xde, 0x14, 0xee, 0xd1, 0x3f, 0xec,
-    0x29, 0xcf, 0x92, 0x60, 0x16, 0x15, 0x89, 0x13, 0x14, 0x32, 0x24, 0xdb,
-    0x55, 0x5a, 0x2d, 0x6d, 0x42, 0xc2, 0xce, 0x30, 0xf6, 0x3b, 0x72, 0x34,
-    0xb8, 0x25, 0xab, 0x11, 0xb6, 0xb1, 0x0b, 0xba, 0xc1, 0x98, 0x35, 0xc2,
-    0x3c, 0xac, 0x07, 0xe3, 0xb3, 0x7f, 0xed, 0x08, 0xa1, 0xeb, 0x88, 0x61,
-    0x99, 0xee, 0x2d, 0xb9, 0x5e, 0x01, 0x35, 0xaf, 0x1c, 0x21, 0xd3, 0x75,
-    0xed, 0xd0, 0xc1, 0x34, 0x66, 0x17, 0xb6, 0x6c, 0xfc, 0xd9, 0xcd, 0xa8,
-    0x5a, 0x80, 0x28, 0xda, 0x74, 0x5d, 0x9d, 0x36, 0x53, 0xfc, 0x5b, 0x80,
-    0xc6, 0xd2, 0x9b, 0x4c, 0xd9, 0xb0, 0x2d, 0x6c, 0x5a, 0xc8, 0xe7, 0xc0,
-    0x27, 0xa7, 0x02, 0x58, 0x57, 0x31, 0x98, 0xbc, 0x72, 0x40, 0x4a, 0x31,
-    0xde, 0x1f, 0x44, 0x38, 0x54, 0xe7, 0xbe, 0xcb, 0x3b, 0xcf, 0x39, 0x0a,
-    0x6f, 0xe7, 0xc8, 0x6c, 0x3a, 0x0b, 0x14, 0x9e, 0x51, 0xa5, 0x10, 0x3b,
-    0x2d, 0xd8, 0x4b, 0x96, 0xd2, 0x0d, 0x1f, 0x3b, 0x1a, 0x53, 0x08, 0xdd,
-    0x94, 0x11, 0xfa, 0x87, 0x75, 0x4d, 0x7d, 0x85, 0x72, 0xad, 0x58, 0x36,
-    0x27, 0xdb, 0x9a, 0xa9, 0x8d, 0x2f, 0xe0, 0x9b, 0x6f, 0xdd, 0xca, 0x3c,
-    0xa8, 0xf9, 0x4e, 0x64, 0x3b, 0x56, 0xd9, 0x2b, 0xab, 0xaf, 0x10, 0x5e,
-    0x52, 0xba, 0x70, 0x82, 0xe3, 0x34, 0xf7, 0xb8, 0xe4, 0x86, 0x6f, 0x45,
-    0xf4, 0x15, 0xa1, 0xd4, 0x69, 0x01, 0xba, 0x93, 0x2c, 0x29, 0x8d, 0xcd,
-    0xb0, 0xe9, 0x64, 0xd1, 0x8a, 0x0b, 0x72, 0x5a, 0xd0, 0x58, 0xc2, 0xd5,
-    0xea, 0x72, 0x13, 0xff, 0x7f, 0x44, 0xaf, 0xea, 0xcf, 0x1b, 0x6a, 0x10,
-    0x29, 0xfd, 0x93, 0xce, 0x50, 0xa6, 0xb3, 0x4b, 0xf5, 0x1e, 0x83, 0x23,
-    0xc7, 0xda, 0x58, 0x60, 0x06, 0xd3, 0xc1, 0xf7, 0x8c, 0x98, 0xca, 0x79,
-    0xcc, 0xbc, 0xff, 0x1c, 0x14, 0xa0, 0x30, 0x94, 0x96, 0xbf, 0xb4, 0xf4,
-    0xbc, 0x24, 0x40, 0x2a, 0x47, 0x91, 0x2f, 0x98, 0x00, 0x5d, 0xef, 0xbc,
-    0x08, 0x2b, 0x96, 0xc2, 0x06, 0xdc, 0xa0, 0x2c, 0x93, 0x27, 0xd7, 0xa4,
-    0x16, 0x6b, 0x9c, 0xcf, 0xea, 0x2c, 0x45, 0x32, 0x6a, 0x98, 0xa1, 0xab,
-    0x84, 0xdc, 0xac, 0x0e, 0xa3, 0x5a, 0x2b, 0x1a, 0x2c, 0x40, 0x1b, 0x91,
-    0x1c, 0xdf, 0x27, 0x65, 0x23, 0x38, 0xe7, 0x4b, 0xea, 0xfa, 0xb4, 0xd9,
-    0x45, 0xc3, 0xf1, 0x3c, 0xa2, 0x96, 0x50, 0x7c, 0x87, 0xf7, 0x3e, 0x34,
-    0x8b, 0xb4, 0x43, 0xb7, 0xfa, 0x7e, 0xc0, 0x5f, 0xa0, 0xe3, 0x5b, 0x9f,
-    0x19, 0x1e, 0xc8, 0xba, 0xde, 0x96, 0x60, 0x92, 0x74, 0x8c, 0xda, 0x72,
-    0x9e, 0x25, 0xa4, 0xcf, 0x8d, 0x9f, 0x8f, 0xc0, 0x6d, 0xaf, 0x4a, 0x60,
-    0xf3, 0xb9, 0x85, 0x30, 0x28, 0x2e, 0xab, 0xbf, 0x57, 0x67, 0x4d, 0x34,
-    0xf9, 0x6c, 0xf5, 0x37, 0x63, 0x96, 0x95, 0x35, 0x78, 0x25, 0x11, 0x1e,
-    0x0c, 0xa9, 0xaf, 0xc0, 0x4a, 0x78, 0x9d, 0xf2, 0x83, 0xb1, 0x25, 0xd9,
-    0xf9, 0xf1, 0xb5, 0x59, 0x27, 0xc9, 0x3b, 0xd4, 0x8e, 0x1b, 0xcc, 0x62,
-    0xf3, 0x6e, 0x76, 0x28, 0xea, 0x8b, 0xdd, 0xf4, 0x48, 0xae, 0x0c, 0xe2,
-    0x98, 0x44, 0x2f, 0x1a, 0x8c, 0x8d, 0x31, 0xdc, 0x23, 0xb9, 0x68, 0x32,
-    0x60, 0x3c, 0xf2, 0x03, 0x6f, 0xba, 0xe9, 0x6f, 0xc0, 0xfb, 0xd2, 0x57,
-    0x0a, 0xa5, 0xd6, 0x51, 0x7c, 0xc3, 0x52, 0xdd, 0xdf, 0xa9, 0x44, 0x52,
-    0x4a, 0x4c, 0xa6, 0xc5, 0xc7, 0x6d, 0xb9, 0x8c, 0xc7, 0x96, 0xc8, 0xf9,
-    0xcf, 0xe3, 0x92, 0x74, 0x8c, 0xb3, 0xb2, 0x2e, 0xaf, 0x58, 0x43, 0x45,
-    0x77, 0x29, 0xa7, 0xb6, 0xa8, 0x01, 0xca, 0x0c, 0xa9, 0xb4, 0x65, 0x6a,
-    0xbc, 0x9d, 0xf0, 0x91, 0x1a, 0x3d, 0x1a, 0x11, 0xc8, 0x5b, 0xe1, 0xf4,
-    0x13, 0x60, 0xe8, 0x5a, 0x47, 0xe7, 0x66, 0xdc, 0xd9, 0x9c, 0xd0, 0xa3,
-    0x5f, 0x1f, 0xa6, 0xc0, 0x94, 0x58, 0x05, 0xc8, 0x46, 0xd2, 0xa0, 0x86,
-    0x55, 0x36, 0x34, 0x01, 0xae, 0x98, 0x86, 0xd4, 0x26, 0xc3, 0xa1, 0x5a,
-    0xef, 0xd0, 0x98, 0x4d, 0x5a, 0x12, 0x8c, 0x03, 0x18, 0xf1, 0x81, 0x8d,
-    0x73, 0x4f, 0x62, 0x4b, 0xc6, 0xe7, 0x3a, 0x5d, 0x42, 0xf8, 0x13, 0x29,
-    0x76, 0x4c, 0x3b, 0x51, 0x86, 0xe7, 0xd6, 0x87, 0x2e, 0x9e, 0x3e, 0x22,
-    0xde, 0x4f, 0xae, 0xf9, 0x6a, 0xe1, 0xa7, 0x72, 0xfa, 0x1e, 0x8f, 0xc1,
-    0x95, 0xe8, 0x60, 0x1d, 0xd5, 0x46, 0x8a, 0xcb, 0x80, 0x61, 0x9c, 0x65,
-    0x8e, 0x06, 0xe7, 0x89, 0xfa, 0xb5, 0xfd, 0x68, 0x8f, 0x8c, 0x08, 0xc3,
-    0x6a, 0xc8, 0x84, 0x13, 0x52, 0x32, 0xce, 0x83, 0x2e, 0x68, 0xa0, 0xc1,
-    0x5f, 0x01, 0x65, 0xb8, 0x4c, 0x38, 0x82, 0xaf, 0xac, 0x0b, 0xbe, 0x4e,
-    0xef, 0x7a, 0x42, 0xde, 0x92, 0x17, 0x4a, 0xf0, 0xf6, 0x85, 0xfe, 0x47,
-    0xba, 0xf2, 0xbc, 0x79, 0x7c, 0xed, 0x19, 0xdf, 0x18, 0x08, 0x72, 0x8a,
-    0xce, 0x57, 0x86, 0xcf, 0xc5, 0x54, 0x17, 0x19, 0xab, 0x0c, 0xeb, 0xa5,
-    0x44, 0x33, 0x5c, 0x1f, 0x02, 0xec, 0x8b, 0x80, 0xdd, 0xe7, 0x50, 0x74,
-    0x97, 0x43, 0xa8, 0xa3, 0xb9, 0x1a, 0x8e, 0x1d, 0x21, 0x97, 0x95, 0x6c,
-    0x96, 0xa0, 0x2d, 0xc5, 0x1b, 0xad, 0xed, 0x9d, 0x88, 0x46, 0x89, 0x9d,
-    0xbd, 0x4a, 0xc5, 0x57, 0xa7, 0x4c, 0x4e, 0x78, 0x43, 0xa4, 0xc3, 0x43,
-    0x11, 0x32, 0xde, 0xaf, 0xa3, 0xf4, 0x18, 0xd7, 0xc3, 0x9d, 0x52, 0x76,
-  ]),
-  // 32-byte expectedSharedSecret
-  expectedSharedSecret: new Uint8Array([
-    0x6b, 0x15, 0xad, 0xd5, 0xb3, 0x66, 0xb2, 0x2c, 0x66, 0x8a, 0x1d, 0x81,
-    0x90, 0x1d, 0x2e, 0xe2, 0x11, 0x33, 0x03, 0xb6, 0xaf, 0xa8, 0x2e, 0xaf,
-    0x67, 0x64, 0xdb, 0xea, 0xd7, 0x66, 0xb8, 0xfc,
-  ]),
+  publicKey: hexStringToUint8Array(
+    'cecb751f326709b49e14caa4be3095eee98558862b83b93356864ead05cb3826954cdbb21dc452446036dd778230094fe3b814c7998f944582d389ccc738974e39496db534d4db784b65446ea9bc59e896a339be6c13463ab74ae2028a12695c5b12c1c9d570065819f6823b533b29bbc8938bc0aa745277e73357d9525cec0cafe1f08a1b9b11a2f8aac1f5abb2a6b45f109569b20cfebaaf32b490644c1884d77fe388a120b08514c96eebb3bc0cd97706769f70f04847098abf6282ac002fa01584ab96760bdc4657093bb6979e0af8540bb720722a6cbbb8481fd036f5d364c564c96f4aa6beb24086b3b104e0af5910638b667d7d29b32e93addba05437823858f7cfc69acdaa94ba74902973b88a9b08ce2fb109b2a16d31f10d8bb452a08996b9547849908a61ba0d92f36f467aa5224cb92caa17abc937842a4facf64af4e2811278496daca6e1a9898a5c028ea46a64e56784c5be7ef93960a910d7011e03b17caf42ce3ec213759693320b2c96b22aef8010a3825d60bcc0e9151a0fa43df10ca3a3cc6b6d6bb6a2f6035fe3c02362ae07e5a979286924d05a54c5137b46b3998574a73cc009875dd566beae6b4d47a279f585af8ec57cfca28116a95403fa6e49e7a4111689f2340fe9088e0743a26e06bc6c54b01261766905cfb2785ef5d5c986ecc9d74c66efec5769a92c8a034890300f2b7c7d20a80ffb731ce4192cec021ad9b9ac25dc9946004ccdcca5f4b29581f27eb3e724504ac36e95aeb7bc49c65a783ab8c2d169ccc0113b1826307e51b3c57307a68ac3e618ba223928d63361512892bf93b15268ae54eac44f621d829439e2987c1bea1326926ab11c5911477c7beb282ae8810b5514538028b8588b1ca5914e559e68325d5f948783733ffc8bb48cd952f8745f76c2639a875410471e8382316d22261632b1a17809d58bbb75d78ba299cfde2a730f8091dc44b8aa736955fa23b816b1d7784d97abcb0cf4cbb7c8364ef12a82b009103c8f7a76c6ac086ae10a3e6b0639cb35ce10c31faaaa26fc22b9d512cca8480a61ac3aa187bfea79117dfbc4fe0b4f9457d87ba4914ee55a4baa946e9155e99baeace9522cc64bee7bd7fa45eb2f6b'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '3e4262cad144026de9bd35bf203ffb40263c8c765d05d2a4d00a8ae92507d2d2c560b8435a054d816e5f2535a3df91833ccad263e58e3c34555cd8c57325ad9d'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    '0e488758dcd45552565bece5b8bda4523544de14eed13fec29cf926016158913143224db555a2d6d42c2ce30f63b7234b825ab11b6b10bbac19835c23cac07e3b37fed08a1eb886199ee2db95e0135af1c21d375edd0c1346617b66cfcd9cda85a8028da745d9d3653fc5b80c6d29b4cd9b02d6c5ac8e7c027a70258573198bc72404a31de1f443854e7becb3bcf390a6fe7c86c3a0b149e51a5103b2dd84b96d20d1f3b1a5308dd9411fa87754d7d8572ad583627db9aa98d2fe09b6fddca3ca8f94e643b56d92babaf105e52ba7082e334f7b8e4866f45f415a1d46901ba932c298dcdb0e964d18a0b725ad058c2d5ea7213ff7f44afeacf1b6a1029fd93ce50a6b34bf51e8323c7da586006d3c1f78c98ca79ccbcff1c14a0309496bfb4f4bc24402a47912f98005defbc082b96c206dca02c9327d7a4166b9ccfea2c45326a98a1ab84dcac0ea35a2b1a2c401b911cdf27652338e74beafab4d945c3f13ca296507c87f73e348bb443b7fa7ec05fa0e35b9f191ec8bade966092748cda729e25a4cf8d9f8fc06daf4a60f3b98530282eabbf57674d34f96cf537639695357825111e0ca9afc04a789df283b125d9f9f1b55927c93bd48e1bcc62f36e7628ea8bddf448ae0ce298442f1a8c8d31dc23b96832603cf2036fbae96fc0fbd2570aa5d6517cc352dddfa944524a4ca6c5c76db98cc796c8f9cfe392748cb3b22eaf5843457729a7b6a801ca0ca9b4656abc9df0911a3d1a11c85be1f41360e85a47e766dcd99cd0a35f1fa6c0945805c846d2a08655363401ae9886d426c3a15aefd0984d5a128c0318f1818d734f624bc6e73a5d42f81329764c3b5186e7d6872e9e3e22de4faef96ae1a772fa1e8fc195e8601dd5468acb80619c658e06e789fab5fd688f8c08c36ac884135232ce832e68a0c15f0165b84c3882afac0bbe4eef7a42de92174af0f685fe47baf2bc797ced19df1808728ace5786cfc5541719ab0ceba544335c1f02ec8b80dde750749743a8a3b91a8e1d2197956c96a02dc51baded9d8846899dbd4ac557a74c4e7843a4c3431132deafa3f418d7c39d5276'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '6b15add5b366b22c668a1d81901d2ee2113303b6afa82eaf6764dbead766b8fc'
+  ),
 };
 
 // ML-KEM-768 test vectors
 ml_kem_vectors['ML-KEM-768'] = {
-  // 1184-byte publicKey
-  publicKey: new Uint8Array([
-    0x0f, 0x61, 0x02, 0x18, 0x60, 0x7b, 0xac, 0x16, 0x36, 0xd1, 0x2a, 0x24,
-    0x50, 0x79, 0x65, 0xbc, 0x4b, 0x6f, 0x39, 0x75, 0x69, 0x9e, 0x24, 0xba,
-    0x48, 0x9a, 0xb0, 0x0e, 0xb8, 0xbb, 0x94, 0xc4, 0x16, 0xe0, 0x9b, 0x5b,
-    0x3c, 0x22, 0x05, 0xda, 0x71, 0xa4, 0x0a, 0xf3, 0x8b, 0x10, 0x95, 0xb9,
-    0x98, 0xb7, 0x34, 0x46, 0x2a, 0x0c, 0xdf, 0x33, 0x7b, 0xe7, 0x85, 0x25,
-    0xfb, 0xd9, 0x84, 0x54, 0x7a, 0x98, 0x1e, 0x11, 0x9a, 0x10, 0xa1, 0x9b,
-    0xb6, 0x22, 0x21, 0xf7, 0x17, 0x60, 0xf4, 0x71, 0x1b, 0x3d, 0x88, 0x31,
-    0x7e, 0xf7, 0x83, 0x84, 0xd5, 0x20, 0x28, 0xa9, 0x49, 0x77, 0xa7, 0x59,
-    0x96, 0x10, 0xb3, 0x4b, 0xc3, 0x39, 0x4b, 0x90, 0x9c, 0xcc, 0x3a, 0xbf,
-    0x62, 0xfb, 0xc2, 0xcc, 0x66, 0xae, 0xc6, 0x17, 0xcd, 0xc9, 0x09, 0x17,
-    0xc1, 0x80, 0xba, 0x14, 0x81, 0x68, 0x64, 0xf5, 0x41, 0xc4, 0x3a, 0x1f,
-    0x29, 0x98, 0x77, 0xfa, 0x28, 0x4a, 0xca, 0x65, 0x5b, 0xd5, 0xa7, 0xb5,
-    0xda, 0x3b, 0x77, 0xe4, 0x86, 0x96, 0xbf, 0xf7, 0x25, 0x25, 0x10, 0x59,
-    0x34, 0x26, 0x9f, 0xef, 0x4c, 0x0b, 0xb4, 0x83, 0xce, 0x3d, 0x8c, 0x12,
-    0x6f, 0xa4, 0xc0, 0xe4, 0x4a, 0x18, 0x1f, 0x97, 0x31, 0xbe, 0x18, 0x39,
-    0xad, 0x08, 0x95, 0xe2, 0x7b, 0x1b, 0xf2, 0xe5, 0x89, 0xf3, 0x08, 0x60,
-    0x6c, 0x50, 0xc5, 0x2d, 0x2c, 0x0c, 0x15, 0x78, 0x58, 0x88, 0x65, 0x5e,
-    0x72, 0x18, 0x25, 0xd1, 0xa4, 0xb5, 0x25, 0x65, 0x51, 0x85, 0x59, 0xc3,
-    0xf2, 0xa7, 0xb4, 0xb5, 0x86, 0x18, 0xe6, 0xe6, 0x91, 0x49, 0xb0, 0x29,
-    0x62, 0x21, 0x73, 0x96, 0x89, 0x7e, 0xb7, 0x42, 0x12, 0xb1, 0x07, 0x0d,
-    0x9f, 0xb0, 0x9d, 0x0c, 0xf3, 0x93, 0x75, 0x08, 0x9b, 0xf3, 0x25, 0x1e,
-    0xf9, 0x92, 0xb2, 0x55, 0xb1, 0x5b, 0x83, 0xc9, 0xb4, 0x75, 0x15, 0x1b,
-    0x93, 0x22, 0x83, 0xfc, 0xd9, 0x43, 0xee, 0x7a, 0x2e, 0x7c, 0xb2, 0x48,
-    0xdf, 0xb8, 0x32, 0x5d, 0xc0, 0xc7, 0x0d, 0x55, 0x71, 0x31, 0xcc, 0x69,
-    0x66, 0x46, 0xa2, 0x31, 0x75, 0x5b, 0xe2, 0x0a, 0x9c, 0xee, 0x44, 0x15,
-    0xde, 0x08, 0x5d, 0xf3, 0xa4, 0x16, 0x65, 0x56, 0x0a, 0x59, 0xc1, 0x5a,
-    0x95, 0x60, 0x87, 0x96, 0x96, 0xc0, 0xbb, 0x34, 0x4a, 0x27, 0x87, 0x91,
-    0x6c, 0xb7, 0x77, 0x3a, 0xf0, 0x5c, 0x65, 0xbb, 0x79, 0xcd, 0xf9, 0x24,
-    0x75, 0x1b, 0xcb, 0x4d, 0x8a, 0x20, 0xae, 0x59, 0xa6, 0x09, 0xc1, 0x58,
-    0xb1, 0x41, 0x9c, 0x83, 0x64, 0x9a, 0x74, 0xe1, 0x7e, 0x69, 0x76, 0x5a,
-    0xd4, 0xf5, 0x28, 0xac, 0x66, 0xc9, 0x81, 0x19, 0xc6, 0x20, 0xa3, 0x18,
-    0xc8, 0x17, 0x98, 0x14, 0xc2, 0x57, 0x58, 0x43, 0x2a, 0x5c, 0xb6, 0x73,
-    0x4e, 0x31, 0xa0, 0x2a, 0xa9, 0xc8, 0xba, 0x14, 0x88, 0xa1, 0x1a, 0x9c,
-    0xf3, 0x69, 0x29, 0xe2, 0x12, 0x8d, 0xb8, 0x76, 0x6d, 0x95, 0xb2, 0xab,
-    0x22, 0xb1, 0x15, 0x5a, 0x22, 0x53, 0xe4, 0x27, 0x7d, 0xc7, 0x80, 0xb0,
-    0x10, 0xe5, 0x9a, 0x42, 0xea, 0x95, 0xc6, 0xa9, 0xa0, 0xd6, 0xf9, 0x45,
-    0xd5, 0x73, 0x45, 0xe5, 0x55, 0xc9, 0xf3, 0x39, 0x80, 0x8a, 0xe0, 0x0a,
-    0xa5, 0x47, 0x5e, 0xc6, 0xc4, 0x52, 0x6b, 0xb0, 0x10, 0xfc, 0xac, 0x24,
-    0x47, 0x5a, 0x21, 0x8a, 0x75, 0x8e, 0x62, 0xf9, 0x20, 0x56, 0x77, 0x11,
-    0xc0, 0x38, 0x19, 0x6c, 0xd0, 0x37, 0xab, 0xb5, 0x7a, 0xd1, 0x32, 0xad,
-    0x62, 0x2a, 0x2e, 0x3e, 0x39, 0x61, 0x7c, 0xf3, 0x66, 0xa3, 0x98, 0x56,
-    0x4f, 0x31, 0xad, 0xb5, 0x40, 0x5f, 0xf6, 0xa9, 0x20, 0xc5, 0x32, 0x6e,
-    0xc7, 0x26, 0xa3, 0x97, 0xfc, 0x11, 0xcf, 0x79, 0x25, 0x9e, 0x48, 0x62,
-    0xe6, 0xd3, 0x39, 0x48, 0x29, 0x9e, 0x55, 0xf5, 0x68, 0x93, 0xea, 0xcd,
-    0x10, 0xdc, 0x9f, 0x89, 0x98, 0x47, 0xac, 0x12, 0x7c, 0xb8, 0xb5, 0x52,
-    0x7c, 0xaa, 0x9e, 0x8c, 0xf4, 0xaf, 0x1b, 0xf5, 0xc5, 0x06, 0x01, 0x4c,
-    0x76, 0x05, 0x8b, 0x1e, 0xd1, 0x0f, 0xa0, 0xf6, 0x09, 0xb7, 0x78, 0xaa,
-    0x26, 0xca, 0xcc, 0x3b, 0xb0, 0x3e, 0x04, 0xb4, 0x9e, 0x99, 0xfa, 0x7a,
-    0xc0, 0x33, 0x0e, 0xf2, 0x92, 0x55, 0x38, 0x80, 0x4e, 0xbc, 0x24, 0x53,
-    0x00, 0x03, 0xcf, 0x08, 0x17, 0x3a, 0x4b, 0x5a, 0x78, 0x7b, 0xcb, 0x3b,
-    0xb0, 0x6b, 0x6b, 0x7d, 0xe1, 0x7a, 0x7a, 0xd7, 0x4b, 0xc3, 0x12, 0x5b,
-    0x9f, 0xa0, 0xcb, 0x46, 0x55, 0x0c, 0xfd, 0xc9, 0xa9, 0xa8, 0x40, 0x0a,
-    0x8f, 0xe5, 0x1f, 0x9f, 0x39, 0xa2, 0x8a, 0xa2, 0xa7, 0x52, 0xc1, 0x61,
-    0x19, 0xf9, 0x25, 0xe4, 0xdb, 0x6a, 0x4a, 0x37, 0xb2, 0x6e, 0x85, 0xc7,
-    0x80, 0x22, 0xb8, 0x95, 0x2b, 0x30, 0x59, 0x98, 0x33, 0xbf, 0x18, 0x96,
-    0xba, 0x1a, 0x16, 0xfd, 0xb7, 0x1e, 0x4a, 0x30, 0x31, 0x05, 0x85, 0x00,
-    0xc8, 0x5a, 0x05, 0xfd, 0x36, 0xb9, 0x97, 0x41, 0xca, 0xc7, 0x90, 0x24,
-    0x3a, 0xf9, 0x4c, 0xfb, 0xe2, 0x5d, 0xec, 0x58, 0x08, 0xfa, 0x43, 0xcf,
-    0xc7, 0x92, 0xa9, 0xfc, 0xc1, 0xad, 0xf9, 0x62, 0x07, 0x98, 0x32, 0x89,
-    0x70, 0x49, 0xb9, 0x99, 0x9a, 0x71, 0x85, 0x72, 0x88, 0xa0, 0xea, 0x84,
-    0x23, 0xe1, 0x7e, 0x1d, 0x50, 0xc8, 0xa5, 0x6a, 0x97, 0xfb, 0xfc, 0x0c,
-    0xa4, 0x19, 0x5f, 0xc9, 0xd2, 0x0d, 0x6b, 0x7b, 0xbf, 0x62, 0x55, 0x91,
-    0xa6, 0x85, 0x8f, 0x75, 0xca, 0x79, 0x1b, 0x65, 0x57, 0x58, 0x5b, 0x4f,
-    0x23, 0x86, 0x8a, 0x38, 0x7a, 0xbd, 0x20, 0x08, 0x51, 0x1c, 0xbb, 0x4b,
-    0x68, 0x1c, 0x3f, 0x90, 0x49, 0x9c, 0x53, 0xc1, 0x6e, 0x8a, 0x35, 0x22,
-    0x49, 0x58, 0x48, 0xc5, 0x0a, 0x0e, 0x37, 0x92, 0x67, 0xd0, 0xb9, 0xbc,
-    0xce, 0x9b, 0x84, 0x6b, 0x34, 0x15, 0xbe, 0x0b, 0xa2, 0xa9, 0x52, 0xc3,
-    0x7d, 0xfc, 0x68, 0x10, 0xc4, 0x72, 0x6d, 0x01, 0x97, 0x4e, 0xba, 0x5d,
-    0x4c, 0x8a, 0xb5, 0x9a, 0x99, 0xb7, 0x5b, 0x7b, 0x9c, 0x6b, 0x86, 0x6d,
-    0xe4, 0xc3, 0x87, 0xed, 0x58, 0x4b, 0xf3, 0x91, 0xb7, 0x0c, 0xa8, 0x7a,
-    0x37, 0x47, 0x85, 0x44, 0x03, 0x2e, 0x00, 0xcb, 0xbf, 0xf4, 0xd7, 0x4a,
-    0x1b, 0x42, 0x99, 0x1e, 0x72, 0x9c, 0x8c, 0x4b, 0xcb, 0x98, 0x0a, 0x48,
-    0x7c, 0x55, 0x4b, 0xb7, 0x55, 0x6a, 0x24, 0x23, 0x83, 0xca, 0xb9, 0x36,
-    0x36, 0x63, 0x44, 0xe7, 0xe3, 0x3c, 0x8c, 0x91, 0x6d, 0x64, 0xb4, 0x6e,
-    0xc2, 0x99, 0x35, 0xbc, 0xa6, 0x5c, 0x8e, 0xda, 0x3f, 0x67, 0x55, 0x9e,
-    0xda, 0xda, 0x07, 0x30, 0x16, 0x44, 0xfb, 0xc4, 0x64, 0x3f, 0x9c, 0x2f,
-    0xea, 0x45, 0x19, 0x5d, 0x8c, 0x67, 0xce, 0x56, 0x87, 0xff, 0xd0, 0x64,
-    0xd2, 0x82, 0xca, 0x82, 0x3b, 0x44, 0x9f, 0x9b, 0x2e, 0xe5, 0x96, 0x29,
-    0x7f, 0xf6, 0xa3, 0x4d, 0x38, 0x54, 0xb5, 0x87, 0xc5, 0x96, 0xe3, 0xbc,
-    0x2f, 0x7c, 0x4e, 0x91, 0x33, 0x39, 0xbe, 0xc8, 0x54, 0x35, 0xb7, 0x83,
-    0x21, 0xb1, 0x23, 0xa8, 0x93, 0x56, 0x44, 0x41, 0xc5, 0x15, 0xa2, 0x80,
-    0x56, 0x31, 0x50, 0xd3, 0xf8, 0x0f, 0xfc, 0x68, 0x86, 0x74, 0x34, 0x61,
-    0x59, 0x46, 0x1d, 0x17, 0x6c, 0x77, 0xa4, 0xcc, 0xc0, 0x52, 0x73, 0x57,
-    0xc9, 0xd0, 0x0d, 0x17, 0x23, 0x73, 0x4e, 0x78, 0xb5, 0xb3, 0x74, 0xb2,
-    0xd8, 0x95, 0xb0, 0xe0, 0x8b, 0x33, 0xe9, 0x7b, 0x2d, 0x73, 0xa6, 0xb9,
-    0x94, 0xf9, 0x0e, 0x89, 0xbc, 0xab, 0xea, 0xc2, 0xbe, 0xe4, 0x98, 0xbb,
-    0x09, 0xc4, 0xbc, 0x03, 0xca, 0x2c, 0x8e, 0x00, 0xce, 0x99, 0xfa, 0x04,
-    0xfb, 0x04, 0x8d, 0x86, 0x4c, 0x3b, 0xb6, 0xe1, 0x23, 0x6e, 0x5c, 0xac,
-    0x3d, 0xe3, 0x04, 0x07, 0xc3, 0x28, 0x4b, 0x2c, 0x64, 0x3f, 0xe0, 0x2c,
-    0x6e, 0xfa, 0x02, 0x4d, 0x96, 0x40, 0x1f, 0x1b, 0xc4, 0x63, 0xe5, 0xbb,
-    0xd9, 0xc0, 0x8c, 0x81, 0x79, 0x2d, 0xba, 0xe5, 0x10, 0xf1, 0xb7, 0x27,
-    0xf3, 0xa1, 0xb5, 0x30, 0x40, 0x2b, 0x47, 0xc6, 0xb6, 0xdb, 0xd5, 0x14,
-    0x75, 0x79, 0x93, 0x8f, 0xa9, 0x72, 0xaf, 0xc4, 0x6e, 0x74, 0x26, 0x78,
-    0x2e, 0x26, 0xa9, 0xc8, 0xe2, 0xc5, 0x70, 0x45, 0x48, 0x2a, 0xdc, 0x10,
-    0x03, 0x17, 0x17, 0x3e, 0xe5, 0x1d, 0x03, 0xf3, 0x19, 0x7a, 0x10, 0x2c,
-    0x9f, 0xd7, 0xb6, 0x07, 0x35, 0x1b, 0x4a, 0xd5, 0xb6, 0xbd, 0xe4, 0x51,
-    0x13, 0xd6, 0x37, 0x33, 0x2a, 0x28, 0x8e, 0x4f, 0x6b, 0xb6, 0x7e, 0x44,
-    0x4c, 0x32, 0x3e, 0xe8, 0x21, 0x8b, 0x5c, 0x1d, 0x15, 0x99, 0xb5, 0x8d,
-    0xde, 0x35, 0x2f, 0xd6, 0xcd, 0x64, 0x7a, 0x52,
-  ]),
-  // 64-byte privateSeed
-  privateSeed: new Uint8Array([
-    0x46, 0x97, 0x3b, 0x12, 0xa0, 0x54, 0xa8, 0x9f, 0x47, 0xd5, 0x3a, 0xf5,
-    0x83, 0xad, 0x94, 0x67, 0x6b, 0xbe, 0x8a, 0xc1, 0x04, 0x6b, 0x07, 0x1d,
-    0x66, 0x6f, 0x55, 0x81, 0x3b, 0x68, 0x98, 0xaa, 0xaa, 0xcb, 0x55, 0x59,
-    0xd0, 0x07, 0xea, 0x68, 0x14, 0x68, 0x3b, 0x49, 0x9d, 0x8b, 0xe1, 0xa0,
-    0xf5, 0xbd, 0xf0, 0x52, 0x7a, 0xd9, 0xdf, 0xa8, 0x66, 0x90, 0x38, 0xfb,
-    0x33, 0xbe, 0x26, 0xc5,
-  ]),
-  // 1088-byte sampleCiphertext
-  sampleCiphertext: new Uint8Array([
-    0x1a, 0xd4, 0x01, 0xa3, 0xc4, 0x3e, 0x18, 0xa5, 0x80, 0x8d, 0x49, 0xbc,
-    0xfa, 0x19, 0x13, 0x2e, 0x0a, 0x3c, 0x0a, 0x55, 0x13, 0x79, 0x16, 0x9c,
-    0x07, 0x70, 0x37, 0x6a, 0x12, 0xd2, 0xdd, 0x49, 0x9e, 0xfb, 0xc8, 0x60,
-    0xe5, 0x06, 0x77, 0x07, 0xde, 0x7b, 0xe9, 0xb1, 0x64, 0x18, 0x5a, 0x46,
-    0x12, 0xdc, 0x88, 0xef, 0x8c, 0xc7, 0x55, 0xf2, 0x53, 0xfe, 0x90, 0x81,
-    0xb9, 0xfb, 0x25, 0x82, 0x7f, 0x2e, 0x31, 0x6a, 0x09, 0xae, 0x62, 0xeb,
-    0xf8, 0x5d, 0x97, 0x45, 0x46, 0x93, 0xfb, 0x22, 0x04, 0x22, 0xee, 0xc6,
-    0xd3, 0xa1, 0x78, 0x21, 0x84, 0x97, 0x7f, 0xce, 0xd1, 0x95, 0x1a, 0xd0,
-    0xa8, 0xb7, 0xea, 0xc8, 0x97, 0xf4, 0xe8, 0xe3, 0xbb, 0x7d, 0x15, 0xfd,
-    0x3f, 0x78, 0xed, 0x8d, 0x37, 0xea, 0xd1, 0xa5, 0x4e, 0xbf, 0xa2, 0x30,
-    0xaf, 0x95, 0xf3, 0x32, 0x6f, 0xbb, 0x05, 0x57, 0xbc, 0x55, 0x8a, 0x8b,
-    0x19, 0x50, 0xd9, 0xe5, 0x46, 0x3a, 0x4d, 0x2c, 0xea, 0xaa, 0x1f, 0x7a,
-    0x67, 0xf8, 0xd6, 0x25, 0xc9, 0x86, 0x40, 0xa8, 0x9e, 0xd4, 0xee, 0xc2,
-    0xe6, 0x3d, 0x34, 0xc0, 0x6d, 0x7b, 0x31, 0xff, 0xe8, 0x3f, 0x86, 0x1a,
-    0x3a, 0x7e, 0x50, 0xfe, 0x64, 0x4b, 0x6b, 0xc7, 0x2e, 0x78, 0xce, 0xb7,
-    0x73, 0x83, 0x1d, 0x1d, 0x90, 0x5f, 0x7a, 0x34, 0x08, 0xac, 0xb0, 0x73,
-    0xac, 0x81, 0xbf, 0x40, 0xed, 0x37, 0x66, 0xf2, 0x83, 0xa5, 0xbc, 0x07,
-    0xd2, 0x06, 0xa8, 0x26, 0x4a, 0xfd, 0xef, 0x77, 0x1a, 0xdc, 0xe3, 0x87,
-    0x8f, 0x8d, 0x1d, 0x34, 0x6f, 0x92, 0x92, 0xd6, 0xbb, 0xb8, 0xb9, 0xc6,
-    0xcb, 0x8e, 0x85, 0x7e, 0xd0, 0x47, 0x98, 0x52, 0x82, 0x89, 0x35, 0xbb,
-    0x68, 0xaa, 0x04, 0x69, 0x82, 0x84, 0x34, 0x06, 0x2a, 0xa5, 0xea, 0x49,
-    0x30, 0x7a, 0x80, 0xf1, 0x10, 0xff, 0xc1, 0x43, 0xac, 0x86, 0x44, 0xe5,
-    0xaa, 0x3a, 0x74, 0xe5, 0x85, 0x39, 0x86, 0xce, 0x97, 0xa2, 0xe6, 0x99,
-    0xad, 0xd9, 0xcb, 0x77, 0x53, 0xa1, 0x98, 0x3d, 0x08, 0xd2, 0x53, 0xfd,
-    0x5e, 0x25, 0xef, 0xc8, 0xd9, 0xf1, 0x10, 0xe2, 0xbb, 0xf8, 0x9b, 0x31,
-    0x95, 0x7f, 0xe0, 0xd3, 0xcd, 0xf5, 0xb1, 0xf6, 0x25, 0x6f, 0xf8, 0x8d,
-    0x7a, 0xa4, 0xec, 0xb6, 0xb5, 0xf9, 0x1d, 0x66, 0x20, 0xe2, 0xc8, 0x61,
-    0xdc, 0x87, 0x0a, 0x90, 0x38, 0x34, 0xb4, 0xf1, 0xb6, 0x08, 0xac, 0x90,
-    0x40, 0x43, 0xea, 0x5c, 0x5c, 0x0a, 0x1f, 0x8e, 0xc4, 0x4f, 0x91, 0xc5,
-    0x1c, 0x9a, 0x2e, 0x5f, 0xb8, 0x79, 0xd7, 0xdb, 0xfb, 0x9f, 0x94, 0x8c,
-    0x19, 0x17, 0xca, 0x60, 0x7c, 0xa1, 0x03, 0xa1, 0xbf, 0xea, 0xcc, 0xfa,
-    0xd2, 0xef, 0x34, 0xa8, 0x79, 0x9f, 0x39, 0x26, 0x13, 0x04, 0xd6, 0x77,
-    0x29, 0x38, 0xb5, 0x82, 0xa2, 0xea, 0x94, 0x8a, 0x28, 0x39, 0xff, 0xb4,
-    0x3d, 0xc3, 0x15, 0xd0, 0xae, 0x31, 0x1f, 0x1e, 0x54, 0x29, 0x4c, 0xb6,
-    0xdb, 0xc1, 0xef, 0xa9, 0x04, 0xa6, 0x66, 0xb0, 0xa3, 0x81, 0xc8, 0xb5,
-    0x28, 0xd1, 0x0a, 0x56, 0x26, 0x41, 0xea, 0xd9, 0x52, 0x93, 0xb7, 0x4e,
-    0xcc, 0x78, 0xc2, 0xe6, 0x4a, 0xf9, 0x8b, 0xa6, 0x38, 0x82, 0x78, 0xb5,
-    0x09, 0x1e, 0xf2, 0x9f, 0x8b, 0x50, 0x6e, 0x7e, 0xa4, 0xe2, 0xb8, 0x59,
-    0x1c, 0xca, 0x61, 0x45, 0x20, 0x5e, 0xfc, 0x91, 0xf9, 0xde, 0x7e, 0x28,
-    0x60, 0xd7, 0xe2, 0x89, 0x3c, 0x88, 0x88, 0x07, 0xbe, 0x0b, 0x76, 0x5a,
-    0x12, 0xa8, 0x56, 0x3c, 0xe0, 0x4f, 0xcb, 0x99, 0xd6, 0x85, 0x10, 0x31,
-    0x2f, 0x77, 0x4f, 0xcc, 0xcd, 0x4c, 0x5d, 0x0f, 0x87, 0x64, 0xcf, 0xb9,
-    0xff, 0xff, 0xfd, 0x67, 0xb2, 0xdc, 0x3f, 0xf5, 0xb4, 0xb4, 0x7d, 0xa0,
-    0x66, 0x54, 0x09, 0xd3, 0xdc, 0x4e, 0xc4, 0xda, 0x3e, 0x36, 0xb9, 0x91,
-    0xf9, 0xf3, 0xea, 0x2c, 0xc0, 0x1e, 0x34, 0x7d, 0x69, 0x25, 0x6f, 0xf7,
-    0x05, 0x7b, 0x20, 0x1f, 0x3e, 0x04, 0x34, 0x3b, 0x2b, 0xc8, 0x1e, 0x67,
-    0x00, 0x9e, 0xa6, 0x59, 0xc1, 0x20, 0xe0, 0xc6, 0x06, 0xed, 0x2a, 0xeb,
-    0xe8, 0xa6, 0x71, 0x96, 0x48, 0x1e, 0xf3, 0xc5, 0x30, 0x1b, 0xc1, 0x73,
-    0xa3, 0x3c, 0x61, 0xed, 0x93, 0x19, 0x16, 0xd2, 0x1a, 0x0e, 0x6d, 0x9a,
-    0xe7, 0x39, 0x81, 0xdd, 0x3e, 0xb2, 0xa3, 0x3b, 0x33, 0xa8, 0x4e, 0xce,
-    0xbf, 0xbe, 0x42, 0x24, 0x9f, 0x54, 0xa3, 0xd8, 0x17, 0x03, 0x8e, 0xc6,
-    0xc6, 0x0e, 0x89, 0x98, 0xdc, 0x9e, 0xbd, 0x17, 0xb9, 0x68, 0x87, 0xbd,
-    0x3c, 0x69, 0xc7, 0xb4, 0x54, 0x7f, 0x40, 0x2f, 0x24, 0x98, 0x1f, 0x52,
-    0x93, 0xe0, 0xce, 0x5e, 0x77, 0x07, 0xaa, 0xf3, 0x33, 0xb9, 0xbd, 0x98,
-    0x21, 0x95, 0xaf, 0xff, 0xab, 0x10, 0xa8, 0x0d, 0x53, 0xa9, 0xec, 0xca,
-    0x12, 0x95, 0x79, 0xd5, 0xf5, 0xfd, 0xdd, 0x6d, 0xc5, 0x24, 0x56, 0x40,
-    0xf8, 0x3c, 0xf3, 0xbf, 0x9a, 0xe7, 0xf8, 0x39, 0x45, 0x5a, 0x14, 0xae,
-    0xaf, 0xfc, 0x2a, 0x17, 0x7d, 0x7a, 0x5e, 0x93, 0x11, 0x0f, 0x74, 0xf9,
-    0xea, 0x27, 0xed, 0x22, 0x4d, 0xf2, 0x58, 0x68, 0x17, 0x53, 0x68, 0x3a,
-    0xe1, 0x75, 0x5a, 0xe4, 0xa8, 0xd6, 0x16, 0xfb, 0xae, 0x8c, 0xc6, 0x86,
-    0xea, 0x06, 0xa3, 0x1b, 0x39, 0xdf, 0x7a, 0x56, 0x37, 0x35, 0x83, 0x9a,
-    0xad, 0xc4, 0xac, 0x05, 0xf7, 0xf4, 0xb9, 0xed, 0xc6, 0xb1, 0x73, 0x57,
-    0x6f, 0xdc, 0xc7, 0xce, 0x30, 0x72, 0xdc, 0xed, 0x29, 0xde, 0xe8, 0x35,
-    0x59, 0x66, 0xdb, 0x7d, 0x25, 0xbb, 0x2f, 0x61, 0x3e, 0xa6, 0xe3, 0x2a,
-    0x7c, 0x51, 0x3c, 0xc2, 0x47, 0x4b, 0x71, 0xb3, 0xdb, 0x7d, 0x5f, 0x8a,
-    0x64, 0xc6, 0x6f, 0x7c, 0xbe, 0xad, 0xf3, 0x41, 0x7d, 0x7b, 0x7f, 0x60,
-    0xf2, 0x7e, 0x23, 0x56, 0x6a, 0xdb, 0x11, 0xda, 0x10, 0xc7, 0x04, 0x9c,
-    0xe1, 0x29, 0xfe, 0x55, 0xa6, 0x5a, 0xd1, 0x6f, 0x60, 0xdf, 0xec, 0xaa,
-    0x1f, 0xaa, 0x05, 0x36, 0xc5, 0x4f, 0x66, 0xa3, 0xa0, 0xe4, 0x1e, 0x04,
-    0x00, 0x10, 0xc2, 0x8b, 0x2c, 0xe6, 0xc5, 0xe5, 0xc9, 0xc0, 0x93, 0x59,
-    0x9b, 0x1b, 0xcb, 0x0d, 0xdd, 0x4d, 0x23, 0xef, 0x4a, 0x6a, 0x49, 0x13,
-    0x6a, 0x31, 0xd7, 0x69, 0xec, 0xd1, 0x4c, 0xa4, 0xdd, 0x83, 0xe6, 0x6d,
-    0x90, 0xa9, 0x3a, 0xc1, 0x01, 0x94, 0x88, 0x75, 0xb7, 0x84, 0xa3, 0x94,
-    0x0b, 0x02, 0x4e, 0x3f, 0x8c, 0xe2, 0xd0, 0x45, 0x42, 0xfe, 0x67, 0x14,
-    0xcb, 0xf0, 0x05, 0x39, 0xf6, 0x50, 0x00, 0x5b, 0xa5, 0x8e, 0xba, 0x04,
-    0x37, 0x7e, 0x37, 0x34, 0xbf, 0xe9, 0xff, 0x99, 0xb6, 0xca, 0xbf, 0xa0,
-    0x87, 0x43, 0x36, 0x9e, 0x48, 0x47, 0xe3, 0xb1, 0x54, 0x45, 0x25, 0x1a,
-    0x94, 0xb6, 0x42, 0x70, 0xf6, 0x18, 0xa5, 0x96, 0xce, 0x94, 0xe2, 0x2c,
-    0x1f, 0x71, 0xe4, 0x0f, 0xd1, 0x97, 0x65, 0x49, 0x8b, 0xc2, 0x1c, 0x9a,
-    0x59, 0xab, 0x7e, 0xb7, 0x7c, 0xae, 0xe8, 0x1e, 0xaf, 0xed, 0x0d, 0xe8,
-    0xd5, 0x42, 0x4e, 0xe3, 0xce, 0xff, 0x86, 0x0e, 0xab, 0xb3, 0xb1, 0x38,
-    0x1f, 0xa5, 0x28, 0x76, 0x42, 0xec, 0x50, 0xea, 0x9e, 0xe9, 0x57, 0x8a,
-    0x8b, 0x7a, 0xbc, 0x00, 0xeb, 0x18, 0x7b, 0x15, 0x8c, 0x75, 0x66, 0x9c,
-    0x17, 0x5d, 0x50, 0xe3, 0x00, 0xa4, 0xe0, 0x0b, 0xae, 0x5a, 0x53, 0x33,
-    0xa7, 0x59, 0x33, 0x93, 0x86, 0x01, 0x18, 0x3f, 0x8a, 0x69, 0xbf, 0x54,
-    0x7d, 0x5b, 0xe4, 0x9b, 0x7f, 0xae, 0xa3, 0x91, 0xbd, 0x2a, 0x4f, 0x5c,
-    0xab, 0x05, 0x76, 0x42, 0x20, 0x5b, 0x55, 0x43, 0x7f, 0x99, 0xcc, 0x81,
-    0x14, 0xcc, 0x21, 0xba, 0x9e, 0x9f, 0x16, 0xe8, 0x84, 0x4c, 0xf9, 0xda,
-    0xd5, 0x39, 0x31, 0x40, 0x9c, 0xf4, 0xef, 0x6c, 0x6e, 0x65, 0xe7, 0x7f,
-    0x21, 0xee, 0x2b, 0x3e, 0x70, 0x92, 0x71, 0x29, 0xa4, 0xb5, 0xd7, 0x80,
-    0x44, 0xea, 0x70, 0x31, 0x26, 0x4b, 0xce, 0x6a,
-  ]),
-  // 32-byte expectedSharedSecret
-  expectedSharedSecret: new Uint8Array([
-    0x53, 0x2e, 0x3b, 0x9a, 0xf0, 0x8e, 0x5f, 0x55, 0x28, 0x92, 0x9b, 0x76,
-    0x2f, 0xb6, 0xe4, 0xd3, 0x0b, 0x28, 0x86, 0xf0, 0x18, 0xf9, 0x70, 0x78,
-    0x41, 0x99, 0xf3, 0x15, 0xe3, 0xf5, 0xcf, 0xc3,
-  ]),
+  publicKey: hexStringToUint8Array(
+    '0f610218607bac1636d12a24507965bc4b6f3975699e24ba489ab00eb8bb94c416e09b5b3c2205da71a40af38b1095b998b734462a0cdf337be78525fbd984547a981e119a10a19bb62221f71760f4711b3d88317ef78384d52028a94977a7599610b34bc3394b909ccc3abf62fbc2cc66aec617cdc90917c180ba14816864f541c43a1f299877fa284aca655bd5a7b5da3b77e48696bff72525105934269fef4c0bb483ce3d8c126fa4c0e44a181f9731be1839ad0895e27b1bf2e589f308606c50c52d2c0c15785888655e721825d1a4b52565518559c3f2a7b4b58618e6e69149b02962217396897eb74212b1070d9fb09d0cf39375089bf3251ef992b255b15b83c9b475151b932283fcd943ee7a2e7cb248dfb8325dc0c70d557131cc696646a231755be20a9cee4415de085df3a41665560a59c15a9560879696c0bb344a2787916cb7773af05c65bb79cdf924751bcb4d8a20ae59a609c158b1419c83649a74e17e69765ad4f528ac66c98119c620a318c8179814c25758432a5cb6734e31a02aa9c8ba1488a11a9cf36929e2128db8766d95b2ab22b1155a2253e4277dc780b010e59a42ea95c6a9a0d6f945d57345e555c9f339808ae00aa5475ec6c4526bb010fcac24475a218a758e62f920567711c038196cd037abb57ad132ad622a2e3e39617cf366a398564f31adb5405ff6a920c5326ec726a397fc11cf79259e4862e6d33948299e55f56893eacd10dc9f899847ac127cb8b5527caa9e8cf4af1bf5c506014c76058b1ed10fa0f609b778aa26cacc3bb03e04b49e99fa7ac0330ef2925538804ebc24530003cf08173a4b5a787bcb3bb06b6b7de17a7ad74bc3125b9fa0cb46550cfdc9a9a8400a8fe51f9f39a28aa2a752c16119f925e4db6a4a37b26e85c78022b8952b30599833bf1896ba1a16fdb71e4a3031058500c85a05fd36b99741cac790243af94cfbe25dec5808fa43cfc792a9fcc1adf962079832897049b9999a71857288a0ea8423e17e1d50c8a56a97fbfc0ca4195fc9d20d6b7bbf625591a6858f75ca791b6557585b4f23868a387abd2008511cbb4b681c3f90499c53c16e8a3522495848c50a0e379267d0b9bcce9b846b3415be0ba2a952c37dfc6810c4726d01974eba5d4c8ab59a99b75b7b9c6b866de4c387ed584bf391b70ca87a37478544032e00cbbff4d74a1b42991e729c8c4bcb980a487c554bb7556a242383cab936366344e7e33c8c916d64b46ec29935bca65c8eda3f67559edada07301644fbc4643f9c2fea45195d8c67ce5687ffd064d282ca823b449f9b2ee596297ff6a34d3854b587c596e3bc2f7c4e913339bec85435b78321b123a893564441c515a280563150d3f80ffc688674346159461d176c77a4ccc0527357c9d00d1723734e78b5b374b2d895b0e08b33e97b2d73a6b994f90e89bcabeac2bee498bb09c4bc03ca2c8e00ce99fa04fb048d864c3bb6e1236e5cac3de30407c3284b2c643fe02c6efa024d96401f1bc463e5bbd9c08c81792dbae510f1b727f3a1b530402b47c6b6dbd5147579938fa972afc46e7426782e26a9c8e2c57045482adc100317173ee51d03f3197a102c9fd7b607351b4ad5b6bde45113d637332a288e4f6bb67e444c323ee8218b5c1d1599b58dde352fd6cd647a52'
+  ),
+  privateSeed: hexStringToUint8Array(
+    '46973b12a054a89f47d53af583ad94676bbe8ac1046b071d666f55813b6898aaaacb5559d007ea6814683b499d8be1a0f5bdf0527ad9dfa8669038fb33be26c5'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    '1ad401a3c43e18a5808d49bcfa19132e0a3c0a551379169c0770376a12d2dd499efbc860e5067707de7be9b164185a4612dc88ef8cc755f253fe9081b9fb25827f2e316a09ae62ebf85d97454693fb220422eec6d3a1782184977fced1951ad0a8b7eac897f4e8e3bb7d15fd3f78ed8d37ead1a54ebfa230af95f3326fbb0557bc558a8b1950d9e5463a4d2ceaaa1f7a67f8d625c98640a89ed4eec2e63d34c06d7b31ffe83f861a3a7e50fe644b6bc72e78ceb773831d1d905f7a3408acb073ac81bf40ed3766f283a5bc07d206a8264afdef771adce3878f8d1d346f9292d6bbb8b9c6cb8e857ed0479852828935bb68aa0469828434062aa5ea49307a80f110ffc143ac8644e5aa3a74e5853986ce97a2e699add9cb7753a1983d08d253fd5e25efc8d9f110e2bbf89b31957fe0d3cdf5b1f6256ff88d7aa4ecb6b5f91d6620e2c861dc870a903834b4f1b608ac904043ea5c5c0a1f8ec44f91c51c9a2e5fb879d7dbfb9f948c1917ca607ca103a1bfeaccfad2ef34a8799f39261304d6772938b582a2ea948a2839ffb43dc315d0ae311f1e54294cb6dbc1efa904a666b0a381c8b528d10a562641ead95293b74ecc78c2e64af98ba6388278b5091ef29f8b506e7ea4e2b8591cca6145205efc91f9de7e2860d7e2893c888807be0b765a12a8563ce04fcb99d68510312f774fcccd4c5d0f8764cfb9fffffd67b2dc3ff5b4b47da0665409d3dc4ec4da3e36b991f9f3ea2cc01e347d69256ff7057b201f3e04343b2bc81e67009ea659c120e0c606ed2aebe8a67196481ef3c5301bc173a33c61ed931916d21a0e6d9ae73981dd3eb2a33b33a84ecebfbe42249f54a3d817038ec6c60e8998dc9ebd17b96887bd3c69c7b4547f402f24981f5293e0ce5e7707aaf333b9bd982195afffab10a80d53a9ecca129579d5f5fddd6dc5245640f83cf3bf9ae7f839455a14aeaffc2a177d7a5e93110f74f9ea27ed224df258681753683ae1755ae4a8d616fbae8cc686ea06a31b39df7a563735839aadc4ac05f7f4b9edc6b173576fdcc7ce3072dced29dee8355966db7d25bb2f613ea6e32a7c513cc2474b71b3db7d5f8a64c66f7cbeadf3417d7b7f60f27e23566adb11da10c7049ce129fe55a65ad16f60dfecaa1faa0536c54f66a3a0e41e040010c28b2ce6c5e5c9c093599b1bcb0ddd4d23ef4a6a49136a31d769ecd14ca4dd83e66d90a93ac101948875b784a3940b024e3f8ce2d04542fe6714cbf00539f650005ba58eba04377e3734bfe9ff99b6cabfa08743369e4847e3b15445251a94b64270f618a596ce94e22c1f71e40fd19765498bc21c9a59ab7eb77caee81eafed0de8d5424ee3ceff860eabb3b1381fa5287642ec50ea9ee9578a8b7abc00eb187b158c75669c175d50e300a4e00bae5a5333a75933938601183f8a69bf547d5be49b7faea391bd2a4f5cab057642205b55437f99cc8114cc21ba9e9f16e8844cf9dad53931409cf4ef6c6e65e77f21ee2b3e70927129a4b5d78044ea7031264bce6a'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '532e3b9af08e5f5528929b762fb6e4d30b2886f018f970784199f315e3f5cfc3'
+  ),
 };
 
 // ML-KEM-1024 test vectors
 ml_kem_vectors['ML-KEM-1024'] = {
-  // 1568-byte publicKey
-  publicKey: new Uint8Array([
-    0x51, 0xe6, 0x70, 0x71, 0x69, 0x47, 0x5b, 0x3a, 0x30, 0x8f, 0x01, 0x40,
-    0x59, 0x58, 0x3b, 0x83, 0x04, 0xcd, 0x2d, 0x93, 0x68, 0x7e, 0x53, 0x15,
-    0x83, 0x46, 0x44, 0x79, 0x35, 0x10, 0xd8, 0xbc, 0xb4, 0x6d, 0x90, 0x53,
-    0xaf, 0xe0, 0xcb, 0x91, 0x09, 0x5f, 0x39, 0xac, 0x78, 0x2b, 0x8a, 0x61,
-    0x27, 0x81, 0xc9, 0xff, 0x6a, 0x4e, 0xf7, 0xb1, 0x7b, 0xb7, 0x62, 0xc1,
-    0x38, 0xb5, 0x43, 0xf4, 0x86, 0x54, 0xe6, 0x79, 0x70, 0x66, 0xec, 0xce,
-    0x85, 0xd4, 0x3d, 0x42, 0xe7, 0x93, 0x44, 0x6b, 0x74, 0xe3, 0x49, 0x29,
-    0x6b, 0x44, 0x5a, 0xfd, 0x2c, 0x9f, 0x45, 0x64, 0x64, 0x97, 0xd1, 0x08,
-    0x3f, 0x32, 0x9b, 0xc5, 0x72, 0x3b, 0x3b, 0x62, 0x56, 0x39, 0x6a, 0x13,
-    0x5c, 0x31, 0x03, 0x00, 0x41, 0x1b, 0xfb, 0x17, 0x45, 0x03, 0x50, 0xb7,
-    0xe1, 0x80, 0x83, 0x2c, 0x00, 0x38, 0xe2, 0x45, 0x0e, 0x78, 0xf5, 0x18,
-    0xee, 0x31, 0x84, 0x42, 0xcc, 0xa1, 0x36, 0xab, 0x93, 0x8e, 0xf8, 0x79,
-    0x75, 0x25, 0x8b, 0xf2, 0xcc, 0x51, 0x62, 0xb1, 0xa9, 0x3d, 0x8a, 0x51,
-    0xea, 0x52, 0xa1, 0xa8, 0xd4, 0xca, 0x23, 0xb9, 0xb6, 0x0b, 0xd6, 0x8c,
-    0x7f, 0x41, 0x86, 0xa9, 0x80, 0x69, 0x99, 0xcc, 0x88, 0x6f, 0xa3, 0x69,
-    0x2f, 0xfc, 0xbb, 0x46, 0xaa, 0xa2, 0x8f, 0x85, 0x6f, 0x9a, 0x77, 0x43,
-    0x57, 0x40, 0x2f, 0xb0, 0xa5, 0xce, 0x80, 0xf6, 0x96, 0x31, 0xe5, 0x23,
-    0x36, 0x72, 0x9e, 0x04, 0x38, 0xa1, 0xe9, 0x3a, 0x21, 0x4a, 0xe9, 0x9f,
-    0x15, 0x26, 0x3e, 0xff, 0x13, 0x5d, 0xe0, 0xa9, 0x42, 0xd8, 0xb3, 0xc2,
-    0x61, 0xb4, 0x22, 0xc0, 0x34, 0xb1, 0xbe, 0xc7, 0x90, 0x36, 0xb0, 0xa0,
-    0x41, 0xc3, 0x7b, 0xe0, 0x33, 0x34, 0xae, 0x42, 0xcf, 0x86, 0x13, 0x28,
-    0x3e, 0xe8, 0x0e, 0x69, 0x31, 0x49, 0x89, 0xf3, 0x69, 0x6f, 0x18, 0x25,
-    0xbc, 0x53, 0xc8, 0x94, 0x32, 0x3e, 0x17, 0x75, 0xc7, 0x2f, 0x77, 0x94,
-    0x15, 0xb8, 0x84, 0x87, 0xec, 0x26, 0xf4, 0xb1, 0x64, 0x46, 0xa0, 0xaa,
-    0xb0, 0xe5, 0x22, 0x6b, 0x83, 0x7b, 0x8d, 0x13, 0x29, 0x7e, 0x31, 0xb4,
-    0x7b, 0x4b, 0x41, 0xa4, 0x9b, 0x82, 0x3f, 0x69, 0x64, 0xe5, 0x37, 0x8a,
-    0x78, 0x06, 0x3a, 0xfa, 0x24, 0xb5, 0xe6, 0x29, 0x4f, 0x27, 0x0b, 0xba,
-    0x5a, 0x7b, 0x90, 0xe4, 0x2a, 0x2d, 0x6b, 0xa4, 0x41, 0x9f, 0x85, 0x8a,
-    0xdb, 0xb1, 0x8f, 0x90, 0x1c, 0x37, 0xa0, 0xf2, 0x78, 0xbf, 0x6c, 0x46,
-    0x8e, 0x72, 0x3f, 0x00, 0xbc, 0xba, 0x37, 0x10, 0x80, 0x9b, 0xd5, 0x5e,
-    0x35, 0xbb, 0xb5, 0x20, 0xdc, 0x9f, 0x44, 0x61, 0x46, 0x65, 0x00, 0x6f,
-    0x71, 0x3b, 0x5b, 0xa2, 0x64, 0xbb, 0x26, 0xb7, 0x10, 0x6d, 0x89, 0xbb,
-    0x71, 0x4c, 0x65, 0xc0, 0xf3, 0x78, 0xdf, 0x16, 0x51, 0xa5, 0x75, 0xcd,
-    0x63, 0x77, 0xa2, 0x83, 0x74, 0xb7, 0x66, 0x8b, 0xb6, 0xb1, 0x43, 0x66,
-    0x12, 0xa3, 0x9c, 0x71, 0xea, 0xa4, 0x82, 0xeb, 0x78, 0xb7, 0xd0, 0x7d,
-    0x49, 0x14, 0x87, 0x3e, 0x36, 0x38, 0x42, 0x90, 0xa7, 0xc4, 0x47, 0x86,
-    0xe9, 0xb3, 0x7b, 0x8b, 0x42, 0x78, 0x82, 0x06, 0x9f, 0x0a, 0x90, 0x18,
-    0xb4, 0x87, 0xa5, 0xff, 0xa8, 0xbc, 0x83, 0xd5, 0x2a, 0xab, 0x57, 0x95,
-    0x63, 0x97, 0xac, 0x60, 0x56, 0x31, 0x3b, 0x94, 0xb5, 0x3c, 0xe1, 0xc3,
-    0x9b, 0x71, 0x7e, 0x9b, 0xe2, 0x8b, 0xc7, 0xca, 0x12, 0xc4, 0x93, 0x8e,
-    0x48, 0xbb, 0x03, 0x1a, 0x56, 0x39, 0x62, 0xc0, 0x5f, 0x25, 0xa4, 0x06,
-    0xda, 0x2b, 0x7c, 0x1b, 0x98, 0x3a, 0x55, 0x5c, 0x5a, 0xe7, 0x93, 0x62,
-    0x2c, 0x31, 0x93, 0xc4, 0xc1, 0x75, 0xfe, 0x0a, 0x8d, 0xfe, 0x20, 0xc1,
-    0xcb, 0xb9, 0x4d, 0x96, 0x97, 0x16, 0x01, 0x60, 0x87, 0x8c, 0x67, 0x20,
-    0xee, 0xf4, 0x4f, 0x8c, 0x22, 0x54, 0x9c, 0xf6, 0x2a, 0x2b, 0x4c, 0xbf,
-    0xfc, 0x11, 0x9b, 0xd1, 0xc4, 0x6a, 0x10, 0xd0, 0x66, 0x1d, 0x5c, 0x4b,
-    0x1a, 0x92, 0x77, 0xaa, 0x31, 0x00, 0xd8, 0xe3, 0x63, 0x68, 0x99, 0xbe,
-    0xe5, 0x43, 0x12, 0x7c, 0xbb, 0x2a, 0x8c, 0x70, 0xb6, 0x76, 0x8c, 0xc5,
-    0x1a, 0xa4, 0x39, 0x93, 0x87, 0x25, 0x87, 0x71, 0x87, 0xaa, 0x25, 0x3e,
-    0xea, 0x51, 0xc6, 0x78, 0x4c, 0x29, 0xb3, 0x65, 0x07, 0xe4, 0x03, 0x9c,
-    0x37, 0xb8, 0x45, 0xee, 0x4b, 0x05, 0x81, 0x55, 0xa3, 0xb8, 0x51, 0xca,
-    0x68, 0x5c, 0x05, 0x4f, 0x80, 0x86, 0xca, 0x95, 0x58, 0x24, 0xab, 0x41,
-    0x44, 0xc4, 0x36, 0x8d, 0xdc, 0x70, 0x76, 0x4a, 0x18, 0x4c, 0x2a, 0x2a,
-    0xbe, 0xcc, 0x84, 0xad, 0xd7, 0x65, 0x07, 0x36, 0xa0, 0xf8, 0x86, 0x5e,
-    0xc0, 0xc6, 0xb4, 0xbe, 0x22, 0x34, 0x5c, 0xeb, 0xc6, 0xed, 0x7a, 0x27,
-    0xd5, 0x61, 0x61, 0xf3, 0x50, 0xa6, 0x05, 0xeb, 0x4b, 0x3f, 0x18, 0xa6,
-    0x85, 0xdb, 0x16, 0x06, 0x35, 0x2e, 0x05, 0x2a, 0x97, 0xe9, 0xa5, 0xcf,
-    0xb3, 0xb1, 0xc9, 0x09, 0xf5, 0x54, 0x5c, 0xe0, 0xa4, 0x19, 0xc6, 0x05,
-    0xb7, 0x85, 0x94, 0x0f, 0x32, 0xc6, 0x22, 0xe3, 0x17, 0x87, 0xc5, 0xa3,
-    0x61, 0xf4, 0x5e, 0xcd, 0xa5, 0x0b, 0x4b, 0x75, 0x46, 0xe7, 0x55, 0xaa,
-    0x62, 0x67, 0x9f, 0x13, 0xea, 0xaa, 0x78, 0x75, 0x5f, 0x31, 0x18, 0x99,
-    0x1b, 0x0a, 0x57, 0x92, 0x49, 0x59, 0x9a, 0x39, 0x21, 0x47, 0x11, 0x52,
-    0x63, 0x4b, 0x4f, 0xe4, 0x01, 0xb1, 0x1c, 0xe7, 0x18, 0x2c, 0x54, 0xa3,
-    0x21, 0x89, 0x9a, 0x94, 0xb4, 0x45, 0xb7, 0xca, 0x32, 0xbe, 0x5c, 0x13,
-    0x02, 0xf7, 0x7e, 0x51, 0xdc, 0x86, 0xfc, 0xf3, 0x61, 0x59, 0x3b, 0x13,
-    0xeb, 0x9c, 0xb0, 0x1d, 0xf3, 0xb1, 0x69, 0x93, 0xc1, 0x57, 0xc5, 0x66,
-    0xac, 0x0b, 0xbc, 0xe3, 0x10, 0x83, 0xcb, 0xb1, 0x49, 0x53, 0x5b, 0x05,
-    0xfd, 0xc8, 0x66, 0x55, 0xa5, 0x76, 0x65, 0x42, 0x34, 0x1f, 0x99, 0xb9,
-    0xf2, 0x74, 0x77, 0x18, 0xfb, 0x58, 0xef, 0x1c, 0x00, 0x11, 0x18, 0x4c,
-    0x21, 0xe3, 0xca, 0x80, 0xb1, 0xb9, 0x12, 0x8b, 0x79, 0x6b, 0x16, 0x9c,
-    0x2b, 0x0a, 0xad, 0x8e, 0xbb, 0x2d, 0xa5, 0x36, 0x9f, 0x44, 0xdb, 0x2c,
-    0x99, 0x5c, 0xa5, 0x67, 0x56, 0xc6, 0x68, 0xe4, 0xbd, 0xfe, 0x38, 0x86,
-    0x2c, 0xc7, 0xba, 0xe4, 0xd1, 0xae, 0x50, 0x5c, 0x6e, 0x93, 0x6c, 0xba,
-    0xae, 0x9b, 0x42, 0xe5, 0xbb, 0x28, 0x68, 0xc1, 0x41, 0xc2, 0x5b, 0x81,
-    0xed, 0x7c, 0xc7, 0x06, 0x84, 0x6e, 0xa9, 0xa0, 0x59, 0xea, 0x65, 0x96,
-    0x02, 0xb4, 0x29, 0xdc, 0x91, 0x11, 0xf1, 0xb0, 0xb3, 0x18, 0xf7, 0x40,
-    0x2f, 0xe2, 0x06, 0x98, 0xa9, 0x3b, 0x77, 0x09, 0x78, 0xd6, 0x03, 0x5d,
-    0xb8, 0xd4, 0x06, 0x5c, 0x49, 0x27, 0x5f, 0xfa, 0xbe, 0x68, 0x75, 0xc6,
-    0x62, 0x15, 0x6d, 0x2a, 0x07, 0xbd, 0x3d, 0x91, 0xcc, 0x9a, 0x70, 0x3f,
-    0x0f, 0x1b, 0x63, 0x99, 0x03, 0x63, 0xe4, 0x9b, 0xbf, 0xb6, 0x7c, 0x86,
-    0x78, 0x27, 0x59, 0xf1, 0xe3, 0xaf, 0xd1, 0x09, 0x4d, 0x66, 0xb6, 0x10,
-    0x0d, 0x87, 0x2b, 0x72, 0x54, 0xbd, 0xa0, 0xb1, 0x7b, 0x17, 0xb9, 0xcd,
-    0x15, 0x44, 0x50, 0x9f, 0x9a, 0x72, 0xb7, 0x9c, 0x21, 0x96, 0x92, 0x54,
-    0x82, 0x3c, 0x50, 0x13, 0x24, 0x4c, 0x68, 0x1a, 0x77, 0x28, 0x29, 0x78,
-    0x69, 0xbb, 0x7c, 0xae, 0x71, 0x6f, 0x9d, 0x59, 0x86, 0x8d, 0x0c, 0x2a,
-    0xef, 0x98, 0x21, 0x53, 0xe2, 0x18, 0xab, 0x55, 0xb8, 0xce, 0x96, 0x9f,
-    0x31, 0x85, 0x26, 0x8a, 0x88, 0x0c, 0x31, 0x98, 0x87, 0x38, 0x58, 0x9d,
-    0x42, 0xb8, 0x1b, 0xbc, 0xe5, 0xae, 0xdb, 0x29, 0xb0, 0xe9, 0x93, 0x37,
-    0xf2, 0x38, 0x9a, 0xa5, 0x43, 0x50, 0x28, 0x97, 0x42, 0x45, 0x63, 0x84,
-    0x66, 0x91, 0x87, 0xd2, 0xc6, 0x91, 0x8c, 0x59, 0x03, 0x3c, 0x92, 0x49,
-    0x69, 0xa3, 0x67, 0x51, 0xb1, 0x01, 0x34, 0x54, 0x99, 0x75, 0xb2, 0x77,
-    0xaf, 0xd9, 0x03, 0x3f, 0x50, 0xce, 0x65, 0xdc, 0x63, 0x3e, 0x5a, 0x1d,
-    0x01, 0xa3, 0xb6, 0x13, 0x8c, 0x6f, 0x01, 0xf7, 0xae, 0xa1, 0x79, 0xc7,
-    0xc8, 0xc7, 0x9e, 0x4b, 0xfb, 0x20, 0x3f, 0xd9, 0xb2, 0x8f, 0xa2, 0x3c,
-    0x14, 0xe6, 0x55, 0xba, 0x77, 0x91, 0x92, 0x8a, 0xc4, 0x6f, 0xe1, 0xa6,
-    0xb8, 0xb9, 0x36, 0x58, 0x09, 0x27, 0x68, 0xe6, 0x5e, 0x85, 0xc5, 0xae,
-    0xd9, 0xe8, 0x97, 0xdd, 0x8a, 0x45, 0x71, 0x2a, 0xab, 0xcb, 0x7c, 0x19,
-    0x19, 0x07, 0x65, 0x68, 0x49, 0x55, 0x9e, 0xd8, 0x4d, 0x40, 0x77, 0xc1,
-    0x14, 0xd9, 0x11, 0xf9, 0xe8, 0x26, 0x70, 0x28, 0xa5, 0x85, 0x6a, 0x90,
-    0x23, 0xba, 0x51, 0x08, 0x67, 0x86, 0x68, 0x92, 0x67, 0xa5, 0x6b, 0x06,
-    0xe6, 0x28, 0x1f, 0x1b, 0xc3, 0x43, 0x4b, 0x01, 0xbf, 0x96, 0xb0, 0x24,
-    0x3e, 0x08, 0x86, 0xd7, 0xf4, 0x37, 0x25, 0xf9, 0xaa, 0x59, 0x8b, 0x51,
-    0x5c, 0xea, 0x40, 0x1b, 0x77, 0x51, 0xe1, 0xa2, 0x59, 0x81, 0x65, 0x26,
-    0x23, 0x2a, 0x75, 0xd0, 0x72, 0x74, 0xf6, 0xbc, 0x4b, 0xd0, 0xd1, 0xa6,
-    0x1e, 0xbb, 0x11, 0x80, 0x4a, 0xa7, 0x9f, 0x09, 0x40, 0x08, 0xe5, 0xa1,
-    0x90, 0x85, 0x43, 0x1a, 0xc1, 0x1c, 0x50, 0x8a, 0x6f, 0xbd, 0x50, 0x26,
-    0x8a, 0x8c, 0x80, 0x21, 0xc4, 0xb1, 0x9b, 0xfa, 0x56, 0x90, 0x97, 0x20,
-    0xbf, 0xb7, 0x26, 0xca, 0xe9, 0xa7, 0xb7, 0x73, 0x6f, 0xaf, 0x17, 0xcf,
-    0xba, 0x9b, 0x3b, 0x4a, 0x32, 0xad, 0xbb, 0x04, 0x50, 0xe9, 0x00, 0x24,
-    0xbb, 0xe8, 0x2c, 0xdb, 0xb0, 0x2f, 0x62, 0x00, 0x5e, 0xf3, 0x34, 0x79,
-    0x8c, 0xb3, 0xbd, 0x7f, 0xda, 0xa7, 0xfa, 0x63, 0x5f, 0xe3, 0xa6, 0x43,
-    0xef, 0x74, 0x5f, 0x10, 0x37, 0xcb, 0x6b, 0x82, 0x4b, 0x7c, 0x60, 0x85,
-    0x15, 0xe3, 0x7f, 0x5b, 0x73, 0xa4, 0x88, 0x24, 0x8d, 0xe1, 0x7c, 0x66,
-    0x5d, 0x3b, 0xb4, 0xd9, 0x25, 0x75, 0x26, 0x6a, 0x0f, 0x65, 0x65, 0x26,
-    0x4e, 0xb6, 0xa4, 0x64, 0x3b, 0x52, 0xb3, 0xd2, 0x3a, 0x80, 0x25, 0x46,
-    0x10, 0x58, 0x5c, 0x22, 0xc3, 0x30, 0xa1, 0xe2, 0x35, 0xeb, 0xc7, 0x3d,
-    0xe0, 0xba, 0xbf, 0x9b, 0x39, 0xa9, 0xc5, 0xf4, 0x8e, 0xf0, 0xac, 0x06,
-    0x0f, 0xe9, 0x6a, 0x00, 0xfa, 0x4b, 0xe7, 0x6b, 0xbc, 0x47, 0x28, 0x37,
-    0x1d, 0xe9, 0x64, 0x6d, 0xfa, 0x7d, 0x5c, 0x83, 0x3d, 0xe1, 0xf6, 0x46,
-    0x28, 0x76, 0x33, 0xde, 0xb4, 0x1f, 0x46, 0x76, 0xc7, 0x44, 0x72, 0x25,
-    0x07, 0xf1, 0xc3, 0x53, 0xa8, 0x5e, 0x85, 0xea, 0x10, 0xb3, 0xd4, 0x3e,
-    0x8a, 0x78, 0x4c, 0x3e, 0xf2, 0x62, 0xf2, 0x81, 0xbd, 0xd5, 0xdb, 0x44,
-    0xe0, 0x3c, 0x4e, 0xca, 0xd2, 0xa0, 0x5b, 0x48, 0x0b, 0xa1, 0x99, 0xbb,
-    0x32, 0xbb, 0x07, 0xaf, 0xc4, 0x62, 0x57, 0xf9, 0x5b, 0xdf, 0x51, 0x6f,
-    0xea, 0x63, 0xc6, 0x6c, 0xc4, 0x84, 0x26, 0xfa, 0xca, 0xcc, 0x06, 0x56,
-    0xb7, 0xf6, 0x01, 0x79, 0xf7, 0x92, 0xb7, 0xd6, 0x86, 0xdf, 0xe7, 0x07,
-    0xd7, 0xb9, 0x16, 0xb1, 0xe8, 0xb2, 0x49, 0x50, 0xc7, 0x4b, 0x9b, 0x60,
-    0x01, 0x60, 0x4e, 0x5d, 0x33, 0x3a, 0x35, 0x99, 0x2a, 0x7c, 0xc4, 0x4c,
-    0xe3, 0xbc, 0x1b, 0xbd, 0xb8, 0xc7, 0x2f, 0x08, 0x42, 0x8d, 0x8a, 0x6e,
-    0x59, 0x20, 0x61, 0x9d, 0x81, 0x96, 0xa7, 0xd3, 0x26, 0x95, 0x33, 0xbd,
-    0xcd, 0x34, 0x35, 0x18, 0x3b, 0x5d, 0x6e, 0x98,
-  ]),
-  // 64-byte privateSeed
-  privateSeed: new Uint8Array([
-    0xd7, 0x10, 0xa2, 0xbc, 0x47, 0x89, 0x36, 0x8c, 0xf2, 0x0a, 0xf5, 0xfe,
-    0xee, 0xdc, 0x8b, 0x9a, 0x8d, 0x0a, 0x88, 0xeb, 0xd7, 0x70, 0xf9, 0x1e,
-    0x9a, 0x44, 0x11, 0x46, 0x52, 0x6f, 0x6b, 0x0e, 0x71, 0x1d, 0x94, 0x5a,
-    0x87, 0x86, 0xbd, 0xce, 0x9f, 0x16, 0x7d, 0xdc, 0x5d, 0xa8, 0xc7, 0xab,
-    0x96, 0xdc, 0x30, 0x5d, 0x6a, 0x36, 0x63, 0x19, 0xd5, 0xf8, 0xa6, 0x92,
-    0x4f, 0x18, 0x39, 0x59,
-  ]),
-  // 1568-byte sampleCiphertext
-  sampleCiphertext: new Uint8Array([
-    0xd5, 0x4d, 0xf4, 0xd6, 0x79, 0x31, 0x4c, 0xfd, 0x6f, 0x32, 0x91, 0xcb,
-    0x64, 0x4b, 0x99, 0x73, 0x14, 0x5a, 0x78, 0x8c, 0x98, 0xef, 0x94, 0xe6,
-    0x8e, 0x9f, 0x8d, 0x1f, 0x92, 0xeb, 0x84, 0x23, 0x96, 0x84, 0x9e, 0x69,
-    0x14, 0xd8, 0xcf, 0x53, 0x09, 0x02, 0x57, 0x88, 0x2f, 0x26, 0xb1, 0xfb,
-    0x4c, 0x07, 0xa2, 0xb6, 0xad, 0xea, 0xf3, 0xbd, 0x56, 0x8c, 0x5d, 0x3c,
-    0x5b, 0x54, 0x32, 0x0d, 0x95, 0x0f, 0xa5, 0x59, 0x80, 0xaf, 0x8d, 0x96,
-    0xfd, 0x7d, 0x49, 0x65, 0x82, 0x5b, 0x63, 0x88, 0x42, 0x92, 0x9f, 0x7b,
-    0x6a, 0xcf, 0x5d, 0xfd, 0x30, 0x33, 0xf3, 0xf3, 0x45, 0xaf, 0x31, 0x32,
-    0x80, 0xe0, 0x10, 0x5f, 0xaa, 0xdd, 0x42, 0x71, 0x5f, 0xff, 0x55, 0x55,
-    0x0c, 0xaa, 0x64, 0x36, 0x89, 0x67, 0xf1, 0x58, 0xca, 0x3a, 0x7d, 0x00,
-    0xae, 0xb4, 0xdf, 0x1e, 0xcc, 0xde, 0x24, 0x0f, 0x5b, 0x21, 0x10, 0xef,
-    0xe6, 0x5f, 0x58, 0xe9, 0xb3, 0xee, 0x54, 0x98, 0x7e, 0x07, 0xea, 0xe1,
-    0x95, 0x27, 0x9a, 0xfa, 0x37, 0x3d, 0x74, 0x62, 0xa4, 0x8d, 0x9c, 0x79,
-    0xb7, 0xc8, 0xa3, 0xf8, 0x16, 0x2d, 0x84, 0x30, 0xbd, 0x0d, 0x97, 0xbd,
-    0x90, 0x14, 0x36, 0x29, 0x7c, 0x12, 0x3e, 0x41, 0xf7, 0x40, 0x96, 0x06,
-    0x54, 0x69, 0xd5, 0x87, 0xb9, 0xe7, 0x42, 0x77, 0x3f, 0xfe, 0xf9, 0x13,
-    0x46, 0xe3, 0x51, 0xbb, 0x95, 0xb4, 0x3b, 0x8c, 0x08, 0x2a, 0x28, 0x7b,
-    0x97, 0x98, 0x91, 0x17, 0x4e, 0x71, 0x86, 0xdc, 0x8c, 0xf2, 0xd6, 0x4a,
-    0x07, 0x71, 0x1f, 0x6e, 0x9f, 0x17, 0xcf, 0x02, 0xad, 0xdc, 0xc3, 0xb8,
-    0x03, 0xfd, 0xc2, 0xe3, 0xee, 0xc9, 0xd3, 0x91, 0x84, 0x1f, 0x0b, 0x38,
-    0x5e, 0x2d, 0x3e, 0x09, 0x08, 0xab, 0x84, 0x18, 0x82, 0x67, 0xce, 0xdd,
-    0xcf, 0xb6, 0x9d, 0x2f, 0x44, 0x4f, 0x69, 0x00, 0x88, 0x16, 0x45, 0x8d,
-    0xa4, 0xda, 0xd5, 0x9a, 0x79, 0xe3, 0x37, 0x83, 0x33, 0x9c, 0xcc, 0xeb,
-    0x55, 0x24, 0xa0, 0x22, 0x7f, 0x11, 0x4a, 0x23, 0x67, 0xdb, 0xcc, 0x5f,
-    0x97, 0x85, 0xef, 0x15, 0x66, 0x5e, 0x92, 0x1e, 0x87, 0x7b, 0x24, 0x05,
-    0x87, 0x67, 0x43, 0xec, 0xed, 0x6d, 0x76, 0xaf, 0x9d, 0x4a, 0xa6, 0xa6,
-    0x80, 0x33, 0xc2, 0x43, 0x51, 0x58, 0xd7, 0xb0, 0x10, 0x60, 0x58, 0xef,
-    0x98, 0x52, 0xa8, 0x1a, 0x46, 0x2b, 0xfb, 0x3c, 0xf8, 0xb1, 0x60, 0x27,
-    0xe5, 0xe0, 0x82, 0x50, 0xc1, 0x2c, 0xb1, 0xe4, 0x13, 0x06, 0x68, 0x17,
-    0x36, 0x23, 0x35, 0x6f, 0x97, 0x93, 0xdb, 0x05, 0xbd, 0x06, 0x5e, 0xa3,
-    0x6a, 0x61, 0x32, 0x6c, 0xca, 0xf5, 0x3d, 0x2e, 0xc0, 0xa1, 0x34, 0xdc,
-    0x1f, 0xc6, 0xc7, 0x2a, 0x40, 0x3d, 0x27, 0x46, 0x30, 0xb7, 0x34, 0x64,
-    0xaa, 0xa1, 0x6b, 0x46, 0xa7, 0x1c, 0x82, 0xd8, 0xa0, 0x27, 0xcb, 0x50,
-    0x05, 0xf2, 0x24, 0x26, 0xc0, 0xb5, 0x31, 0x4b, 0x04, 0xb7, 0x08, 0xd7,
-    0xac, 0xa3, 0xf4, 0xb8, 0x53, 0x8e, 0xc1, 0x92, 0x53, 0xf9, 0x40, 0xb4,
-    0xb8, 0x15, 0xaf, 0x22, 0xce, 0x82, 0xbd, 0xcd, 0x7d, 0xa8, 0x5a, 0x61,
-    0xac, 0x18, 0x7c, 0x92, 0xef, 0x38, 0xc8, 0xc2, 0x99, 0x00, 0x51, 0x91,
-    0x64, 0x82, 0x37, 0x47, 0xea, 0xa5, 0xf6, 0x8b, 0xea, 0x24, 0xe8, 0x7e,
-    0x62, 0x3c, 0xb7, 0x4d, 0xac, 0x2c, 0x7b, 0x57, 0xfa, 0x1f, 0x28, 0x53,
-    0x16, 0xfd, 0x74, 0x4b, 0x83, 0x80, 0x0e, 0xf3, 0x66, 0x36, 0xcd, 0xf5,
-    0x29, 0x23, 0x0d, 0xc6, 0x9e, 0x7b, 0xb2, 0x8b, 0xc5, 0xc6, 0x48, 0xdb,
-    0x1d, 0xbb, 0x61, 0x48, 0xae, 0x05, 0x10, 0x99, 0x9b, 0x48, 0x23, 0x8c,
-    0x10, 0x50, 0xee, 0x5e, 0xa0, 0x49, 0x86, 0x27, 0x4e, 0xfe, 0xa8, 0x63,
-    0xde, 0x71, 0xf5, 0x52, 0x8c, 0xef, 0xcc, 0xd3, 0x9e, 0x0e, 0x17, 0x9b,
-    0x57, 0x49, 0xb7, 0x27, 0x29, 0x01, 0x3c, 0xbb, 0x1e, 0x85, 0xb9, 0x6a,
-    0x13, 0x47, 0x59, 0xd8, 0x0b, 0xca, 0xb2, 0xa5, 0xe4, 0xeb, 0x93, 0xfd,
-    0x7e, 0xef, 0x26, 0xae, 0x23, 0xed, 0x1e, 0x07, 0xd5, 0x91, 0x72, 0xa4,
-    0x8d, 0x09, 0xae, 0xef, 0xfa, 0xfe, 0x12, 0xad, 0x46, 0xd7, 0x91, 0xbf,
-    0xc6, 0xa7, 0x13, 0x30, 0x7d, 0xad, 0x2b, 0x8e, 0xd4, 0x14, 0x87, 0xf2,
-    0x89, 0xeb, 0x2c, 0xca, 0xb8, 0x36, 0x12, 0xb0, 0xec, 0x61, 0xc8, 0xdc,
-    0x32, 0x80, 0xae, 0x89, 0x9a, 0x4b, 0x57, 0xe2, 0xe1, 0x33, 0xb5, 0xdb,
-    0x0d, 0x89, 0x6a, 0xd4, 0x18, 0xa5, 0xaf, 0xef, 0x5d, 0xab, 0x36, 0xf8,
-    0x7c, 0x64, 0x79, 0x32, 0x39, 0x67, 0x2d, 0x50, 0xa6, 0x7b, 0x6a, 0xc1,
-    0x6d, 0x6f, 0xcb, 0xac, 0x5d, 0x3e, 0x71, 0x1d, 0x48, 0x7c, 0xcd, 0x0e,
-    0x4a, 0xc1, 0xc9, 0x64, 0xaa, 0x51, 0x55, 0xcc, 0x3b, 0xa0, 0x10, 0xb5,
-    0x78, 0x3d, 0xcd, 0xd0, 0xef, 0x10, 0x56, 0x7e, 0x7c, 0xf1, 0x98, 0x62,
-    0xc0, 0x0d, 0x71, 0x23, 0x02, 0x41, 0xef, 0x13, 0x29, 0xc5, 0x21, 0x3d,
-    0x09, 0x83, 0xa5, 0x8f, 0x56, 0x5c, 0x12, 0xdd, 0x78, 0x6d, 0x68, 0xd8,
-    0xbc, 0x31, 0x15, 0x8d, 0xe6, 0xcd, 0x02, 0x73, 0xbd, 0xfd, 0x8e, 0x58,
-    0xf2, 0x16, 0x48, 0x96, 0x00, 0x57, 0x5b, 0x9f, 0x37, 0x34, 0xcf, 0xde,
-    0x2a, 0x22, 0xc6, 0xf3, 0x30, 0x17, 0x56, 0x28, 0x50, 0x19, 0xc7, 0x77,
-    0xf2, 0x3e, 0xed, 0x8f, 0x10, 0x11, 0x09, 0xe9, 0xff, 0xbd, 0x75, 0x65,
-    0x52, 0x3b, 0x5c, 0x0f, 0xb4, 0x95, 0x09, 0xe6, 0x6a, 0x28, 0x91, 0x5e,
-    0x26, 0xbf, 0xce, 0xfc, 0x75, 0x5c, 0xc0, 0x2d, 0xc8, 0x63, 0x7f, 0x31,
-    0xd3, 0x59, 0xf0, 0xe2, 0xa7, 0xe8, 0x21, 0x4c, 0x99, 0xd5, 0x2f, 0x29,
-    0x9f, 0x8c, 0x1f, 0x2c, 0xba, 0x34, 0xff, 0x1e, 0x96, 0x74, 0x58, 0x17,
-    0x1a, 0x40, 0xe3, 0xc4, 0x46, 0xf0, 0xfd, 0x2b, 0x44, 0x3a, 0x06, 0x03,
-    0x9f, 0x30, 0xac, 0xe8, 0xa0, 0x7e, 0xc9, 0xf1, 0x57, 0x7d, 0xb6, 0xf9,
-    0x52, 0x4f, 0x1e, 0x70, 0x5e, 0xd7, 0x97, 0xe4, 0xa6, 0xf9, 0x9f, 0xed,
-    0xa6, 0x05, 0x72, 0x1e, 0xbc, 0x68, 0x8f, 0x1a, 0x72, 0xe0, 0xb2, 0x67,
-    0xe9, 0xcc, 0x4f, 0x26, 0x4f, 0x5a, 0x6c, 0x46, 0xda, 0x62, 0x0a, 0x47,
-    0xf5, 0x89, 0xab, 0x0f, 0x80, 0x49, 0x3e, 0x18, 0xe5, 0xc0, 0x55, 0x9f,
-    0x97, 0x18, 0xcc, 0x99, 0xb3, 0xb2, 0xa9, 0xb8, 0xdb, 0xfe, 0x0d, 0x94,
-    0x16, 0xec, 0xe2, 0x62, 0x26, 0x5e, 0x93, 0x18, 0x09, 0x4a, 0x24, 0xf9,
-    0xc0, 0x10, 0x3c, 0xcd, 0xcf, 0x77, 0xd7, 0xcd, 0x00, 0xde, 0xcd, 0x22,
-    0x01, 0x60, 0x2b, 0x8f, 0x49, 0x86, 0x40, 0x70, 0x21, 0xee, 0x68, 0x3e,
-    0x1a, 0x1e, 0x21, 0x58, 0x7a, 0xff, 0x70, 0x52, 0xd3, 0x0f, 0x76, 0x97,
-    0x1e, 0x9c, 0x34, 0x86, 0xa4, 0x81, 0xdf, 0x81, 0xb2, 0x24, 0xc1, 0x69,
-    0x56, 0x52, 0x37, 0x46, 0x4e, 0xee, 0xa0, 0xd0, 0xc6, 0xb2, 0xe9, 0x3f,
-    0x35, 0xbd, 0xe3, 0xd0, 0x87, 0x36, 0xce, 0x85, 0xb8, 0xac, 0x48, 0xec,
-    0xf4, 0x9d, 0xa7, 0x90, 0xed, 0x8b, 0x26, 0xff, 0x13, 0x1e, 0x55, 0xa3,
-    0x81, 0x74, 0x03, 0xf5, 0x85, 0x03, 0xa2, 0x28, 0x43, 0x16, 0x55, 0xc2,
-    0x8b, 0xb5, 0x84, 0x32, 0x3e, 0xd0, 0x2b, 0xde, 0x2f, 0x70, 0x0c, 0x96,
-    0x4e, 0x59, 0x51, 0xb7, 0x19, 0x10, 0xdd, 0x19, 0x0d, 0x71, 0xfc, 0x37,
-    0xa1, 0xfd, 0x19, 0x31, 0xe7, 0xa6, 0x52, 0x5c, 0x23, 0x1d, 0xf5, 0xe0,
-    0x69, 0xe0, 0x2d, 0xb1, 0x76, 0xf2, 0xe0, 0xcf, 0xf5, 0x68, 0x33, 0x9d,
-    0x05, 0x0e, 0x7c, 0x76, 0x7a, 0x4a, 0xf8, 0x54, 0x09, 0xb6, 0x0f, 0x9a,
-    0x36, 0xba, 0x25, 0x26, 0x01, 0x57, 0xe4, 0x32, 0xc4, 0xa5, 0xe6, 0x57,
-    0x18, 0xe4, 0x74, 0xa2, 0xfd, 0xee, 0x8e, 0x95, 0x4f, 0x35, 0x33, 0x3c,
-    0xb0, 0x03, 0x5f, 0x65, 0xc8, 0x65, 0x59, 0x38, 0x9e, 0x98, 0x5f, 0x63,
-    0x3d, 0x13, 0xa6, 0x19, 0x3c, 0x6f, 0x81, 0x40, 0x27, 0x5a, 0x30, 0x5c,
-    0xbe, 0x67, 0x59, 0x96, 0xf6, 0x83, 0x53, 0x2f, 0xed, 0x01, 0x30, 0xb4,
-    0xae, 0x13, 0x0c, 0xee, 0xc7, 0x47, 0x6b, 0xa0, 0xb7, 0x9e, 0xf0, 0xc3,
-    0x60, 0x6e, 0x07, 0x88, 0x49, 0x47, 0xc1, 0x8f, 0x39, 0x20, 0xa3, 0x2a,
-    0x3b, 0x39, 0xf6, 0x6c, 0xcd, 0xa8, 0x2c, 0x15, 0x9b, 0x37, 0x18, 0xf2,
-    0x66, 0xd9, 0x0d, 0xe8, 0x31, 0xc9, 0x01, 0xcc, 0x75, 0x8c, 0xd0, 0xdf,
-    0xe4, 0xa4, 0xaf, 0xfb, 0x4d, 0xe7, 0x7a, 0xad, 0x1e, 0x8f, 0x9d, 0xdf,
-    0x5a, 0xcf, 0x39, 0xcb, 0x65, 0x94, 0xb5, 0x00, 0x99, 0x49, 0xe5, 0xbc,
-    0xa5, 0x02, 0x98, 0xd9, 0xad, 0x8b, 0xc7, 0xae, 0x02, 0x1c, 0x48, 0x9b,
-    0x30, 0x4d, 0x7b, 0xe8, 0xfc, 0xde, 0x0e, 0x18, 0xbf, 0x4a, 0x81, 0x7d,
-    0x79, 0xf7, 0xb5, 0x12, 0xd6, 0x2b, 0x30, 0xaf, 0xf6, 0xd2, 0xbc, 0x31,
-    0xa2, 0x94, 0x0d, 0x07, 0x4e, 0x6f, 0x78, 0xc0, 0x13, 0xc8, 0x22, 0x06,
-    0x96, 0xcf, 0xd0, 0x2e, 0xc8, 0x31, 0x45, 0xe7, 0xb9, 0x80, 0x2a, 0x97,
-    0x04, 0x2c, 0x28, 0xe9, 0xe6, 0x19, 0x57, 0xca, 0xfb, 0x7d, 0xc4, 0x5d,
-    0x2b, 0xa1, 0x29, 0x72, 0x23, 0xdb, 0x25, 0x3a, 0xd5, 0xc1, 0x7a, 0x71,
-    0xc7, 0xde, 0x34, 0xb6, 0x77, 0x27, 0xbf, 0xff, 0xb6, 0xea, 0x54, 0x24,
-    0x72, 0x58, 0x55, 0x0a, 0xf9, 0x63, 0x75, 0x1a, 0xe4, 0x3e, 0x2a, 0x24,
-    0x09, 0xb6, 0x35, 0x95, 0xe8, 0x23, 0x90, 0xfc, 0x24, 0xc6, 0x71, 0x82,
-    0xb5, 0x74, 0xad, 0xc1, 0x4c, 0xc7, 0xf6, 0x53, 0x64, 0x28, 0xad, 0x93,
-    0xee, 0x47, 0xe9, 0x1a, 0x58, 0x9a, 0x51, 0x96, 0x3d, 0xe7, 0x3a, 0xee,
-    0x5b, 0x8b, 0x05, 0x0e, 0x37, 0xda, 0x2c, 0x89, 0x9b, 0x0a, 0x7b, 0x67,
-    0xe5, 0x86, 0xc2, 0x5e, 0xfa, 0x76, 0xa2, 0x38, 0x91, 0xec, 0x12, 0xf9,
-    0x35, 0x47, 0x8c, 0x99, 0x70, 0xf7, 0xce, 0xe6, 0xac, 0xf9, 0x2e, 0x3f,
-    0x45, 0x7c, 0x35, 0xe6, 0x33, 0xbf, 0x2a, 0xcf, 0x08, 0x7b, 0xd0, 0xab,
-    0x5a, 0xc2, 0x7a, 0x6d, 0xf9, 0xfe, 0x09, 0x7a, 0x29, 0xe0, 0xcf, 0x38,
-    0x93, 0xdf, 0xe4, 0xda, 0x6b, 0x66, 0x0c, 0xe2, 0x83, 0x64, 0xa6, 0xfb,
-    0x74, 0x25, 0x78, 0x9b, 0x74, 0xf7, 0x05, 0xd8, 0xe1, 0x39, 0x48, 0x1b,
-    0x60, 0x06, 0x16, 0xc9, 0xc3, 0xa9, 0xc2, 0xad, 0xd0, 0xf8, 0x86, 0x2b,
-    0x44, 0xe4, 0xc1, 0x4e, 0xd4, 0x26, 0x8f, 0x8e, 0xd9, 0xa6, 0xa1, 0xef,
-    0xbb, 0xac, 0x2c, 0x98, 0x82, 0xba, 0xdd, 0x14, 0x8d, 0x14, 0xe0, 0x09,
-    0xd1, 0x50, 0x44, 0xcc, 0x4e, 0x03, 0x59, 0x92, 0x00, 0x9a, 0x60, 0x36,
-    0xba, 0xd6, 0xa9, 0xae, 0x75, 0xfd, 0x36, 0x59, 0x87, 0x7c, 0xd3, 0x47,
-    0xa4, 0x5d, 0x99, 0xe9, 0x9d, 0xb2, 0x17, 0x55, 0x83, 0xed, 0x3c, 0xeb,
-    0x25, 0x60, 0xa8, 0xfd, 0xcf, 0xa3, 0x5c, 0x15, 0x09, 0x31, 0x5d, 0x4c,
-    0x8f, 0xb0, 0xe4, 0xa0, 0xac, 0x29, 0x81, 0x13, 0x28, 0x56, 0x29, 0x26,
-    0x1d, 0xd9, 0xb2, 0xb3, 0x8f, 0xee, 0x18, 0x1c, 0xc9, 0x57, 0xa1, 0xcb,
-    0x58, 0x24, 0x71, 0x1a, 0x67, 0xb1, 0xdc, 0xe4, 0x0d, 0x99, 0xca, 0x28,
-    0xf9, 0x23, 0xb2, 0xf9, 0x9f, 0x2b, 0x38, 0x30, 0x96, 0x43, 0xb1, 0x4c,
-    0x01, 0x41, 0x35, 0x02, 0x12, 0x47, 0xb6, 0xe8, 0xd1, 0x15, 0xb2, 0x4b,
-    0xed, 0xf9, 0xbb, 0x20, 0x6c, 0x7e, 0xe1, 0xf9, 0x2a, 0xa6, 0x2c, 0xb9,
-    0x78, 0xc1, 0xb8, 0xdb, 0x4f, 0x25, 0x9a, 0x9c,
-  ]),
-  // 32-byte expectedSharedSecret
-  expectedSharedSecret: new Uint8Array([
-    0x2f, 0x52, 0x11, 0x10, 0xa9, 0xe8, 0x53, 0x86, 0x70, 0x13, 0xce, 0xe3,
-    0x4a, 0x38, 0xf1, 0x07, 0xbe, 0xa1, 0xc4, 0x68, 0x90, 0x67, 0x16, 0x08,
-    0xe4, 0xec, 0xa1, 0x13, 0xed, 0xe9, 0x09, 0x7e,
-  ]),
+  publicKey: hexStringToUint8Array(
+    '51e6707169475b3a308f014059583b8304cd2d93687e5315834644793510d8bcb46d9053afe0cb91095f39ac782b8a612781c9ff6a4ef7b17bb762c138b543f48654e6797066ecce85d43d42e793446b74e349296b445afd2c9f45646497d1083f329bc5723b3b6256396a135c310300411bfb17450350b7e180832c0038e2450e78f518ee318442cca136ab938ef87975258bf2cc5162b1a93d8a51ea52a1a8d4ca23b9b60bd68c7f4186a9806999cc886fa3692ffcbb46aaa28f856f9a774357402fb0a5ce80f69631e52336729e0438a1e93a214ae99f15263eff135de0a942d8b3c261b422c034b1bec79036b0a041c37be03334ae42cf8613283ee80e69314989f3696f1825bc53c894323e1775c72f779415b88487ec26f4b16446a0aab0e5226b837b8d13297e31b47b4b41a49b823f6964e5378a78063afa24b5e6294f270bba5a7b90e42a2d6ba4419f858adbb18f901c37a0f278bf6c468e723f00bcba3710809bd55e35bbb520dc9f44614665006f713b5ba264bb26b7106d89bb714c65c0f378df1651a575cd6377a28374b7668bb6b1436612a39c71eaa482eb78b7d07d4914873e36384290a7c44786e9b37b8b427882069f0a9018b487a5ffa8bc83d52aab57956397ac6056313b94b53ce1c39b717e9be28bc7ca12c4938e48bb031a563962c05f25a406da2b7c1b983a555c5ae793622c3193c4c175fe0a8dfe20c1cbb94d9697160160878c6720eef44f8c22549cf62a2b4cbffc119bd1c46a10d0661d5c4b1a9277aa3100d8e3636899bee543127cbb2a8c70b6768cc51aa439938725877187aa253eea51c6784c29b36507e4039c37b845ee4b058155a3b851ca685c054f8086ca955824ab4144c4368ddc70764a184c2a2abecc84add7650736a0f8865ec0c6b4be22345cebc6ed7a27d56161f350a605eb4b3f18a685db1606352e052a97e9a5cfb3b1c909f5545ce0a419c605b785940f32c622e31787c5a361f45ecda50b4b7546e755aa62679f13eaaa78755f3118991b0a579249599a3921471152634b4fe401b11ce7182c54a321899a94b445b7ca32be5c1302f77e51dc86fcf361593b13eb9cb01df3b16993c157c566ac0bbce31083cbb149535b05fdc86655a5766542341f99b9f2747718fb58ef1c0011184c21e3ca80b1b9128b796b169c2b0aad8ebb2da5369f44db2c995ca56756c668e4bdfe38862cc7bae4d1ae505c6e936cbaae9b42e5bb2868c141c25b81ed7cc706846ea9a059ea659602b429dc9111f1b0b318f7402fe20698a93b770978d6035db8d4065c49275ffabe6875c662156d2a07bd3d91cc9a703f0f1b63990363e49bbfb67c86782759f1e3afd1094d66b6100d872b7254bda0b17b17b9cd1544509f9a72b79c21969254823c5013244c681a7728297869bb7cae716f9d59868d0c2aef982153e218ab55b8ce969f3185268a880c31988738589d42b81bbce5aedb29b0e99337f2389aa54350289742456384669187d2c6918c59033c924969a36751b10134549975b277afd9033f50ce65dc633e5a1d01a3b6138c6f01f7aea179c7c8c79e4bfb203fd9b28fa23c14e655ba7791928ac46fe1a6b8b93658092768e65e85c5aed9e897dd8a45712aabcb7c191907656849559ed84d4077c114d911f9e8267028a5856a9023ba51086786689267a56b06e6281f1bc3434b01bf96b0243e0886d7f43725f9aa598b515cea401b7751e1a259816526232a75d07274f6bc4bd0d1a61ebb11804aa79f094008e5a19085431ac11c508a6fbd50268a8c8021c4b19bfa56909720bfb726cae9a7b7736faf17cfba9b3b4a32adbb0450e90024bbe82cdbb02f62005ef334798cb3bd7fdaa7fa635fe3a643ef745f1037cb6b824b7c608515e37f5b73a488248de17c665d3bb4d92575266a0f6565264eb6a4643b52b3d23a80254610585c22c330a1e235ebc73de0babf9b39a9c5f48ef0ac060fe96a00fa4be76bbc4728371de9646dfa7d5c833de1f646287633deb41f4676c744722507f1c353a85e85ea10b3d43e8a784c3ef262f281bdd5db44e03c4ecad2a05b480ba199bb32bb07afc46257f95bdf516fea63c66cc48426facacc0656b7f60179f792b7d686dfe707d7b916b1e8b24950c74b9b6001604e5d333a35992a7cc44ce3bc1bbdb8c72f08428d8a6e5920619d8196a7d3269533bdcd3435183b5d6e98'
+  ),
+  privateSeed: hexStringToUint8Array(
+    'd710a2bc4789368cf20af5feeedc8b9a8d0a88ebd770f91e9a441146526f6b0e711d945a8786bdce9f167ddc5da8c7ab96dc305d6a366319d5f8a6924f183959'
+  ),
+  sampleCiphertext: hexStringToUint8Array(
+    'd54df4d679314cfd6f3291cb644b9973145a788c98ef94e68e9f8d1f92eb842396849e6914d8cf53090257882f26b1fb4c07a2b6adeaf3bd568c5d3c5b54320d950fa55980af8d96fd7d4965825b638842929f7b6acf5dfd3033f3f345af313280e0105faadd42715fff55550caa64368967f158ca3a7d00aeb4df1eccde240f5b2110efe65f58e9b3ee54987e07eae195279afa373d7462a48d9c79b7c8a3f8162d8430bd0d97bd901436297c123e41f74096065469d587b9e742773ffef91346e351bb95b43b8c082a287b979891174e7186dc8cf2d64a07711f6e9f17cf02addcc3b803fdc2e3eec9d391841f0b385e2d3e0908ab84188267ceddcfb69d2f444f69008816458da4dad59a79e33783339ccceb5524a0227f114a2367dbcc5f9785ef15665e921e877b2405876743eced6d76af9d4aa6a68033c2435158d7b0106058ef9852a81a462bfb3cf8b16027e5e08250c12cb1e4130668173623356f9793db05bd065ea36a61326ccaf53d2ec0a134dc1fc6c72a403d274630b73464aaa16b46a71c82d8a027cb5005f22426c0b5314b04b708d7aca3f4b8538ec19253f940b4b815af22ce82bdcd7da85a61ac187c92ef38c8c29900519164823747eaa5f68bea24e87e623cb74dac2c7b57fa1f285316fd744b83800ef36636cdf529230dc69e7bb28bc5c648db1dbb6148ae0510999b48238c1050ee5ea04986274efea863de71f5528cefccd39e0e179b5749b72729013cbb1e85b96a134759d80bcab2a5e4eb93fd7eef26ae23ed1e07d59172a48d09aeeffafe12ad46d791bfc6a713307dad2b8ed41487f289eb2ccab83612b0ec61c8dc3280ae899a4b57e2e133b5db0d896ad418a5afef5dab36f87c64793239672d50a67b6ac16d6fcbac5d3e711d487ccd0e4ac1c964aa5155cc3ba010b5783dcdd0ef10567e7cf19862c00d71230241ef1329c5213d0983a58f565c12dd786d68d8bc31158de6cd0273bdfd8e58f216489600575b9f3734cfde2a22c6f3301756285019c777f23eed8f101109e9ffbd7565523b5c0fb49509e66a28915e26bfcefc755cc02dc8637f31d359f0e2a7e8214c99d52f299f8c1f2cba34ff1e967458171a40e3c446f0fd2b443a06039f30ace8a07ec9f1577db6f9524f1e705ed797e4a6f99feda605721ebc688f1a72e0b267e9cc4f264f5a6c46da620a47f589ab0f80493e18e5c0559f9718cc99b3b2a9b8dbfe0d9416ece262265e9318094a24f9c0103ccdcf77d7cd00decd2201602b8f4986407021ee683e1a1e21587aff7052d30f76971e9c3486a481df81b224c169565237464eeea0d0c6b2e93f35bde3d08736ce85b8ac48ecf49da790ed8b26ff131e55a3817403f58503a228431655c28bb584323ed02bde2f700c964e5951b71910dd190d71fc37a1fd1931e7a6525c231df5e069e02db176f2e0cff568339d050e7c767a4af85409b60f9a36ba25260157e432c4a5e65718e474a2fdee8e954f35333cb0035f65c86559389e985f633d13a6193c6f8140275a305cbe675996f683532fed0130b4ae130ceec7476ba0b79ef0c3606e07884947c18f3920a32a3b39f66ccda82c159b3718f266d90de831c901cc758cd0dfe4a4affb4de77aad1e8f9ddf5acf39cb6594b5009949e5bca50298d9ad8bc7ae021c489b304d7be8fcde0e18bf4a817d79f7b512d62b30aff6d2bc31a2940d074e6f78c013c8220696cfd02ec83145e7b9802a97042c28e9e61957cafb7dc45d2ba1297223db253ad5c17a71c7de34b67727bfffb6ea54247258550af963751ae43e2a2409b63595e82390fc24c67182b574adc14cc7f6536428ad93ee47e91a589a51963de73aee5b8b050e37da2c899b0a7b67e586c25efa76a23891ec12f935478c9970f7cee6acf92e3f457c35e633bf2acf087bd0ab5ac27a6df9fe097a29e0cf3893dfe4da6b660ce28364a6fb7425789b74f705d8e139481b600616c9c3a9c2add0f8862b44e4c14ed4268f8ed9a6a1efbbac2c9882badd148d14e009d15044cc4e035992009a6036bad6a9ae75fd3659877cd347a45d99e99db2175583ed3ceb2560a8fdcfa35c1509315d4c8fb0e4a0ac298113285629261dd9b2b38fee181cc957a1cb5824711a67b1dce40d99ca28f923b2f99f2b38309643b14c014135021247b6e8d115b24bedf9bb206c7ee1f92aa62cb978c1b8db4f259a9c'
+  ),
+  expectedSharedSecret: hexStringToUint8Array(
+    '2f521110a9e853867013cee34a38f107bea1c46890671608e4eca113ede9097e'
+  ),
 };
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
index 2c7493dfffd6..41512090f573 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/algorithm_registry.js
@@ -20,6 +20,9 @@ const generateKeyTestVectors = [
     {name: "ML-KEM-512", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
     {name: "ML-KEM-768", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
     {name: "ML-KEM-1024", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "MLKEM768-P256", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "MLKEM768-X25519", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
+    {name: "MLKEM1024-P384", resultType: "CryptoKeyPair", usages: ["decapsulateBits", "decapsulateKey", "encapsulateBits", "encapsulateKey"], mandatoryUsages: ["decapsulateBits", "decapsulateKey"]},
     {name: "X25519", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
     {name: "X448", resultType: "CryptoKeyPair", usages: ["deriveKey", "deriveBits"], mandatoryUsages: ["deriveKey", "deriveBits"]},
     {name: "KMAC128", resultType: CryptoKey, usages: ["sign", "verify"], mandatoryUsages: []},
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js
new file mode 100644
index 000000000000..40c69270c9a9
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/failures_Hybrid-KEM.tentative.https.any.js
@@ -0,0 +1,6 @@
+// META: title=WebCryptoAPI: generateKey() for Failures
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=algorithm_registry.js
+// META: script=failures.js
+run_test(["MLKEM768-P256", "MLKEM768-X25519", "MLKEM1024-P384"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
index c70ecb331873..894da971d898 100644
--- a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes.js
@@ -47,23 +47,22 @@ function run_test(algorithmNames, slowTest) {
                 assert_unreached("generateKey threw an unexpected error: " + err.toString());
             })
             .then(async function (result) {
-                // TODO: remove this block to enable ML-KEM JWK when its definition is done in IETF JOSE WG
-                if (result.publicKey?.algorithm.name.startsWith('ML-KEM')) {
-                    const promises = [
-                        subtle.exportKey('spki', result.publicKey),
-                        extractable ? subtle.exportKey('pkcs8', result.privateKey) : undefined,
-                        subtle.exportKey('raw-public', result.publicKey),
-                    ];
-                    if (extractable)
-                        promises.push(subtle.exportKey('raw-seed', result.privateKey));
-                    await Promise.all(promises);
-                } else if (resultType === "CryptoKeyPair") {
-                    const promises = [
-                        subtle.exportKey('jwk', result.publicKey),
-                        extractable ? subtle.exportKey('jwk', result.privateKey) : undefined,
-                        subtle.exportKey('spki', result.publicKey),
-                        extractable ? subtle.exportKey('pkcs8', result.privateKey) : undefined,
-                    ];
+                if (resultType === "CryptoKeyPair") {
+                    // TODO: enable ML-KEM JWK when its definition is done in IETF JOSE WG.
+                    const isMlKem = result.publicKey.algorithm.name.startsWith('ML-KEM');
+                    const isHybridKem = result.publicKey.algorithm.name.startsWith('MLKEM');
+                    const promises = [];
+
+                    if (!isMlKem) {
+                        promises.push(subtle.exportKey('jwk', result.publicKey));
+                        promises.push(extractable ? subtle.exportKey('jwk', result.privateKey) : undefined);
+                    }
+
+                    if (!isHybridKem) {
+                        promises.push(subtle.exportKey('spki', result.publicKey));
+                        if (extractable)
+                            promises.push(subtle.exportKey('pkcs8', result.privateKey));
+                    }
 
                     switch (result.publicKey.algorithm.name.substring(0, 2)) {
                         case 'ML':
@@ -90,7 +89,7 @@ function run_test(algorithmNames, slowTest) {
 
                     const [jwkPub, jwkPriv] = await Promise.all(promises);
 
-                    if (extractable) {
+                    if (extractable && !isMlKem) {
                         // Test that the JWK public key is a superset of the JWK private key.
                         for (const [prop, value] of Object.entries(jwkPub)) {
                             if (prop !== 'key_ops') {
diff --git a/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js
new file mode 100644
index 000000000000..bca75d4b6d71
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/generateKey/successes_Hybrid-KEM.tentative.https.any.js
@@ -0,0 +1,7 @@
+// META: title=WebCryptoAPI: generateKey() Successful Calls
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=/common/subset-tests.js
+// META: script=algorithm_registry.js
+// META: script=successes.js
+run_test(["MLKEM768-P256", "MLKEM768-X25519", "MLKEM1024-P384"]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js
index f67b11a47e63..c85d2a9e02ba 100644
--- a/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/getPublicKey.tentative.https.any.js
@@ -109,6 +109,24 @@ const algorithms = [
         generateKeyParams: { name: "ML-KEM-1024" },
         usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
         publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
+    },
+    {
+        name: "MLKEM768-P256",
+        generateKeyParams: { name: "MLKEM768-P256" },
+        usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
+        publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
+    },
+    {
+        name: "MLKEM768-X25519",
+        generateKeyParams: { name: "MLKEM768-X25519" },
+        usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
+        publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
+    },
+    {
+        name: "MLKEM1024-P384",
+        generateKeyParams: { name: "MLKEM1024-P384" },
+        usages: ["encapsulateBits", "encapsulateKey", "decapsulateBits", "decapsulateKey"],
+        publicKeyUsages: ["encapsulateBits", "encapsulateKey"]
     }
 ];
 
@@ -145,8 +163,9 @@ algorithms.forEach(function(algorithm) {
 
         // Verify that the derived public key matches the original public key
         // by comparing their exported forms
-        const originalExported = await crypto.subtle.exportKey("spki", keyPair.publicKey);
-        const derivedExported = await crypto.subtle.exportKey("spki", publicKey);
+        const exportFormat = algorithm.name.startsWith("MLKEM") ? "raw-public" : "spki";
+        const originalExported = await crypto.subtle.exportKey(exportFormat, keyPair.publicKey);
+        const derivedExported = await crypto.subtle.exportKey(exportFormat, publicKey);
 
         assert_array_equals(
             new Uint8Array(originalExported),
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js
new file mode 100644
index 000000000000..3227434ed449
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey.tentative.https.any.js
@@ -0,0 +1,11 @@
+// META: title=WebCryptoAPI: importKey() for Hybrid KEM keys
+// META: timeout=long
+// META: script=../util/helpers.js
+// META: script=Hybrid-KEM_importKey_fixtures.js
+// META: script=ml_importKey.js
+
+var keyData = hybridKemKeyData;
+
+runTests("MLKEM768-P256");
+runTests("MLKEM768-X25519");
+runTests("MLKEM1024-P384");
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js
new file mode 100644
index 000000000000..50b656c284c7
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/Hybrid-KEM_importKey_fixtures.js
@@ -0,0 +1,56 @@
+var hybridKemKeyData = {
+  'MLKEM768-P256': {
+    privateUsages: ['decapsulateBits', 'decapsulateKey'],
+    publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['jwk', 'raw-public'],
+    privateFormats: ['jwk', 'raw-seed'],
+    'raw-public': hexStringToUint8Array(
+      '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220d422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf'
+    ),
+    'raw-seed': hexStringToUint8Array(
+      '0000000000000000000000000000000000000000000000000000000000000000'
+    ),
+    jwk: {
+      priv: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      kty: 'AKP',
+      alg: 'MLKEM768-P256',
+      pub: 'PSCfcWdS9kCOf4m87vl6w4hTAEU3eSdkTvBGwKfK6XjIhBoBM6rE8eGnAnJ39nEhnPWLhdKcj-wI7dQy54ejz5k2_gAmoRPLnvsdchQElSe_4hQeoXCwKUpZQDqwzhZ2Couqlbgjy7iqzcwX7zJ3UiPHkeN0AWOUH5uz9jNGvvHAUMMfkyxicZQpr_FMK9Q4qxNb7WktVsd8BMu__WM1tXgxi1E3cehLFOqCEmIUHKAGzLi_JQCqEAiXDyFv5_GuNBJaopBJLAaaGJIircMi-XZJx2LH0xKK07smZ5cdB0QBS8O2dEXLzQs-fqafscufnDMfl0h5IBhykpJtBKJaJlCrvUSYK7DDxjAf5qYTMNJNijxwIdw-M5LHmhObN2E7umeimEKYUHuEpNYe7xis-5ea8tOcqkwNtFE4FTWddvw3jGOn9PMFOxcWjQIhzwwu7FUUuiNfgdBNZ8O1xRgJSRdnHCanwEZFdTPMMoRFgSd6A-sGXEUpp3mppYePKqw_gdue09jJNFaXBYy7mdN5vKFtj9th0SmWA5BSR5G50-UBuQC9HlAC4JW-BsI_H7IS9YAfJLayjAxUk9JG0Cqin6Os--FaxOIS6wtvaeu-olmicDqkwwgiS9t0HGXHpdS_94gnlQe7_lE9eqVpTns832KrNkMnQtSgyps1cLp0L6gDtGmJyFJupYbMT8MoZhQ7eWAXJfpUX9KAtARTAxi7wzcRlHELbXS-qmKesYo2qVO3WRWulpmbpciM3FakaGHFADLJtjC8wURaMIeJebxVosCVW_OZsjEgO5DGUbav4OJCtaVDJQsUL3KR7XU9gWCY95EzAqjOkWQXFmI9T8KsZ3KqXzZ0BCt8ShiiGGKJpKxOIAd0WWygPmeYx1BrmEmZ22rBQlhrrgeZ8ed2-fUkfcV02FVt35u7xMo2QyY0V_dCSAENYtQxEmg2Cuy0kCtFC_IFDsuLp6koINIz9aFO0xIlodF8pvGegliUz7GAfZIsvWB2ETS-QZFEvPcgBjZqRGATetkTbBE_BetUxAlSDtxy5BUMw6JLD4Ge7BG70ZypZFsIEKYLSoqenDlVOWoWU5VbBHvPT5hDPCcjbFcNdfgJ5EqvLcM2ZYJjUYcsKTNQqzJFGMjAyAtSHIDIGla9yWilZQMVqDDIuxdTLGLMwjsdRkEsJWsiT9RnRJGANQHQFDElx1dyOWiZZbaYnKVheTwPhcYqnhNIfaF2YqcYjHCxBApn7Uw_hedONpGCL7ljFNYTT-amJrPL4UYdYqe1c7LMdVef-iKWfjbOsqGqC3GHWiJ1HXBrcsqezQyBAK0KpYAJpcg__-kXWea6oKk0Wvmf47aVCdvIQDKGiESrP2W7Hfi-rfNkQuSOM5yWcCOlJUEVRMeJovBNrNBv_veDAiEEULkx9rTDKqs0o_UmC4EPTJqUb8ItO6q6qAuo2ZVdbcNehgm0JWtILNydiXfBpHo1TnxSf9sWcuFmkXuVzWNRggJh2qs2H4oty7JAxVq9aoEF5SkbQntWbXMea3BHGJz_INixIOCz5yRy0bAIaBIgD9NpjiPwbk9OCLu1TMIEnAOchFvmWZmcj6SNf2IyfBRs8bwLC7G5GzAXS3vCINQiAjv_aw3uJjUyxQPzmC5NPicHG4VVeKmpqmO4qMM5vw',
+    },
+  },
+  'MLKEM768-X25519': {
+    privateUsages: ['decapsulateBits', 'decapsulateKey'],
+    publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['jwk', 'raw-public'],
+    privateFormats: ['jwk', 'raw-seed'],
+    'raw-public': hexStringToUint8Array(
+      '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aac4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d7214049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c791e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c77c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b67445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c6301fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a5878f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b900bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88cdc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e242b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f3674042b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be419144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bbd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44aaf2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d8977c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062'
+    ),
+    'raw-seed': hexStringToUint8Array(
+      '0000000000000000000000000000000000000000000000000000000000000000'
+    ),
+    jwk: {
+      priv: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      kty: 'AKP',
+      alg: 'MLKEM768-X25519',
+      pub: 'PSCfcWdS9kCOf4m87vl6w4hTAEU3eSdkTvBGwKfK6XjIhBoBM6rE8eGnAnJ39nEhnPWLhdKcj-wI7dQy54ejz5k2_gAmoRPLnvsdchQElSe_4hQeoXCwKUpZQDqwzhZ2Couqlbgjy7iqzcwX7zJ3UiPHkeN0AWOUH5uz9jNGvvHAUMMfkyxicZQpr_FMK9Q4qxNb7WktVsd8BMu__WM1tXgxi1E3cehLFOqCEmIUHKAGzLi_JQCqEAiXDyFv5_GuNBJaopBJLAaaGJIircMi-XZJx2LH0xKK07smZ5cdB0QBS8O2dEXLzQs-fqafscufnDMfl0h5IBhykpJtBKJaJlCrvUSYK7DDxjAf5qYTMNJNijxwIdw-M5LHmhObN2E7umeimEKYUHuEpNYe7xis-5ea8tOcqkwNtFE4FTWddvw3jGOn9PMFOxcWjQIhzwwu7FUUuiNfgdBNZ8O1xRgJSRdnHCanwEZFdTPMMoRFgSd6A-sGXEUpp3mppYePKqw_gdue09jJNFaXBYy7mdN5vKFtj9th0SmWA5BSR5G50-UBuQC9HlAC4JW-BsI_H7IS9YAfJLayjAxUk9JG0Cqin6Os--FaxOIS6wtvaeu-olmicDqkwwgiS9t0HGXHpdS_94gnlQe7_lE9eqVpTns832KrNkMnQtSgyps1cLp0L6gDtGmJyFJupYbMT8MoZhQ7eWAXJfpUX9KAtARTAxi7wzcRlHELbXS-qmKesYo2qVO3WRWulpmbpciM3FakaGHFADLJtjC8wURaMIeJebxVosCVW_OZsjEgO5DGUbav4OJCtaVDJQsUL3KR7XU9gWCY95EzAqjOkWQXFmI9T8KsZ3KqXzZ0BCt8ShiiGGKJpKxOIAd0WWygPmeYx1BrmEmZ22rBQlhrrgeZ8ed2-fUkfcV02FVt35u7xMo2QyY0V_dCSAENYtQxEmg2Cuy0kCtFC_IFDsuLp6koINIz9aFO0xIlodF8pvGegliUz7GAfZIsvWB2ETS-QZFEvPcgBjZqRGATetkTbBE_BetUxAlSDtxy5BUMw6JLD4Ge7BG70ZypZFsIEKYLSoqenDlVOWoWU5VbBHvPT5hDPCcjbFcNdfgJ5EqvLcM2ZYJjUYcsKTNQqzJFGMjAyAtSHIDIGla9yWilZQMVqDDIuxdTLGLMwjsdRkEsJWsiT9RnRJGANQHQFDElx1dyOWiZZbaYnKVheTwPhcYqnhNIfaF2YqcYjHCxBApn7Uw_hedONpGCL7ljFNYTT-amJrPL4UYdYqe1c7LMdVef-iKWfjbOsqGqC3GHWiJ1HXBrcsqezQyBAK0KpYAJpcg__-kXWea6oKk0Wvmf47aVCdvIQDKGiESrP2W7Hfi-rfNkQuSOM5yWcCOlJUEVRMeJovBNrNBv_veDAiEEULkx9rTDKqs0o_UmC4EPTJqUb8ItO6q6qAuo2ZVdbcNehgm0JWtILNydiXfBpHo1TnxSf9sWcuFmkXuVzWNRggJh2qs2H4oty7JAxVq9aoEF5SkbQntWbXMea3BHGJz_INixIOCz5yRy0bAIaBIgD9NpjiPwbk9OCLu1TML2NgG3-FrM_uotF5ZMZrUZSw8I4YUZ-q7hlOPBAoIwYg',
+    },
+  },
+  'MLKEM1024-P384': {
+    privateUsages: ['decapsulateBits', 'decapsulateKey'],
+    publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['jwk', 'raw-public'],
+    privateFormats: ['jwk', 'raw-seed'],
+    'raw-public': hexStringToUint8Array(
+      'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d677d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c749c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b04d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e6853453b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e298c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cbaa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c5938258c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec06746749473e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed77cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865ab22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db657460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b510b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e78544887f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b388725758a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1adde369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a875d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a7372632ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a306e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e370941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da896133272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa702265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f'
+    ),
+    'raw-seed': hexStringToUint8Array(
+      '0000000000000000000000000000000000000000000000000000000000000000'
+    ),
+    jwk: {
+      priv: 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA',
+      kty: 'AKP',
+      alg: 'MLKEM1024-P384',
+      pub: 'oQvItVTNUZgM27zMMEFCD9Mg_ot0x6hCeMY8FwcNwjG2GrJpudZ32SAmEYZlS0Vx9ReX1cNCuAcLxskryhat7MYx5OlMdQixEXMMdJxz4tam-XFVyyaczAanGiG-89JpRjyTUEin9GNsezIAc3CQI_ewTQUwVxqab3GCgIcLtjh10_WZvCKblYac1btdJmQIVtQLgoGY_fLAmZmP_fdy5GIzbFIc0ya15Jl72VwTXFe9AsevqAopI9UQlRd47lElsqoY-QRFRTuFeJIkclslknlpislCbIgrqrw41Ps6P2gxGAkYuYJeDkGBVNeK66tefnBm5pslZ0dr8Rd_4Hmjgpi-bwGwmMM4UaslMStS4ypXUMK3PSk8C4EEc7MQqvBi8ZkUxzd7LpA4j1db9eaFNFO5WnSqGNYtSuN-aZakirUhdIipLXsB4xXFC2ggQUN5KvxPg2fAzgZasyAUvbVRX-BZRgiq0SGJlHJK-qqi3wNV9GZmtuAqOHttPaRxPtthC7BIw6IHi4AOnqSD8gCcltJMcbLLyOEgDAJ3ODxcJ4leKYw2B3Ac5YcCqRkDJ0oEFAgjTLACHvKxxRMUGbRE3IS4nRR9H-Q8Q_Z22QZzXZyipZwiMtl_1Koa4rs9GxcMpVPLJXSVT9xmifrGI8uqMZgtgkJNWlZP73qLpRtE3xUFOytFvsSqHtSZKRI9r3VBdcWTgljGCLJNBiBCq0u-5eVTpepidSFziuWrLga9mLAgeHsvX6UetMRsK_kOVaSVYDQGZ_iKxBQyt_VR39mMA3x595tBuYWosfUTRVUM2BZxQ2IEB3jEPjeKKIOUvQKMjDG1qQS8SlZIpZYDXLOPDiduEsmpb4QlBWsFoTZkLdLLdUYwNkhboaUFOeQg4eMd-sUpytbGjsBnRnSUc-BQpKyStxmb7Osjm2wSyOcWtmYHrspkpYULAfmdCxdqd1l4Htd8sbpA0XrFxssGyULAAsLPbvyxIfEK0qRf94FCbnEEy9ynO4GGWrIrALqDQ1WuSFomLzVCSJMsK-F4Npo91-JCj9w3k0arK3VMQ9tldGDLCcXEi1gQy3pcYVbPh0QMnjakhpqKxFizgvwXiRWpzhvN2nxIgHwgfmVv-4C_M-MryMeyDvYFcmEs6sma0cVs5adkspt0wXpbUQsa_LGKGvw1wSrCE3JTJfm3ouszj-TACAwxpYqZXbcCfZAOeFRIh_kK2kZ9Djg8EZxTmTELxnNYdOiAT_bCuuV_LDNXy2JwM8EqWSSyDOWr8RMXK9K3cIbKxUOBF5O7pxc0yfAFrCZWRgvDCkQrOIcldYpiPje6bik6v7hPNEIp83PCFMp3anwFrcRl_tk7nPd_ACKrcfGt3jad2PQgpYwFfBTMGNxH2nwSsIZHPqtBllKWcAHE5Co4HIulOah10hqZRRM7q5vB5TpgDed8v7Kuq2sZztTG6qiZjuahV3JV9xMtgKMtbAxuxEycSyhpmmRbsLyVjgAnUHeSUwlRmwgkxwAN-mGRLsBJBjoGfQCwWQU-UIpb_uY0c4acioUQr4mM11coVPXDivlvX5enNyYy6nu0tvuDHGEq9xGR_5gGs3m81DxgWbex-VN0FESvcTwVXZYnIrlHqiOjKomzVqanUIqtY5aMHep4_xiqwnqJqntCsNdIHdPMZJQh5ROXeCIYrFRBdgulGgMo1mtDb-wy16pNaODK0bwU9yQckDSA-AmYP8LDDZMTjPY7WbxzesCBkok9A5GHqBG-89Mgnre40eBbWyUc73YKIQsnMoZ6syBJujw1TjhYrue3HfeSkkcw2OhC5IQSK1BnewowbmHPIbYgkdoYuTcZKTagnlpBjPeLZmFX3Ud68cNqEjIBKVIoQONwlBFXgIeCpTNbCsENcOG-r9QBB0uEuYJsxYqtIXuuD0GbLaiWEzJy2PIsb0IPzHOPzMEIL8k8ffCZTGvPLMiikDe2uytLzvSw7oyvhQa8XsuggqVoBsHO3guUQzimmmaCVMEVCuBQMOJWsrZ2YboCfZdXbaYTrIx8KQUfEkC5awwSfiZNXh27_pVhpWfVyRA2c7RGs8zqbF9_NPCTSKXUpYsEmIcdyUDul7UMAzb5pgwymfmVYKxwZXonvvpwImXOWQWD4EooMmCS096iEY3R316B19MBTsS1zmfctF7wAXad1dWtp2k00410CSRxK_rmchadj4dEwVE0bShfu2U_g6oP',
+    },
+  },
+};
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
index abccc10c63fb..463213a80147 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-DSA_importKey_fixtures.js
@@ -4,6 +4,8 @@ var keyData = {
   'ML-DSA-44': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-44'],
     spki: mldsaKeyFixtures.spki['ML-DSA-44'],
     'raw-public': hexStringToUint8Array(
@@ -23,6 +25,8 @@ var keyData = {
   'ML-DSA-65': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-65'],
     spki: mldsaKeyFixtures.spki['ML-DSA-65'],
     'raw-public': hexStringToUint8Array(
@@ -42,6 +46,8 @@ var keyData = {
   'ML-DSA-87': {
     privateUsages: ['sign'],
     publicUsages: ['verify'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: mldsaKeyFixtures.pkcs8['ML-DSA-87'],
     spki: mldsaKeyFixtures.spki['ML-DSA-87'],
     'raw-public': hexStringToUint8Array(
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js
index f3a5f6687dc5..3adec94ec410 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ML-KEM_importKey_fixtures.js
@@ -2,6 +2,8 @@ var keyData = {
   'ML-KEM-512': {
     privateUsages: ['decapsulateBits', 'decapsulateKey'],
     publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: new Uint8Array([
       48, 84, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 4, 1, 4, 66,
       128, 64, 165, 38, 193, 164, 132, 122, 104, 173, 83, 214, 227, 31, 231,
@@ -33,6 +35,8 @@ var keyData = {
   'ML-KEM-768': {
     privateUsages: ['decapsulateBits', 'decapsulateKey'],
     publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: new Uint8Array([
       48, 84, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 4, 2, 4, 66,
       128, 64, 166, 200, 29, 100, 198, 48, 80, 164, 143, 215, 2, 108, 106, 162,
@@ -63,6 +67,8 @@ var keyData = {
   'ML-KEM-1024': {
     privateUsages: ['decapsulateBits', 'decapsulateKey'],
     publicUsages: ['encapsulateBits', 'encapsulateKey'],
+    publicFormats: ['spki', 'jwk', 'raw-public'],
+    privateFormats: ['pkcs8', 'jwk', 'raw-seed'],
     pkcs8: new Uint8Array([
       48, 84, 2, 1, 0, 48, 11, 6, 9, 96, 134, 72, 1, 101, 3, 4, 4, 3, 4, 66,
       128, 64, 152, 117, 178, 230, 181, 134, 244, 129, 167, 125, 166, 8, 181,
diff --git a/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js b/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
index a33c3a85b912..545cec51b59f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
+++ b/test/fixtures/wpt/WebCryptoAPI/import_export/ml_importKey.js
@@ -11,7 +11,7 @@ function runTests(algorithmName) {
   [true, false].forEach(function (extractable) {
     // Test public keys first
     allValidUsages(data.publicUsages, true).forEach(function (usages) {
-      ['spki', 'jwk', 'raw-public'].forEach(function (format) {
+      data.publicFormats.forEach(function (format) {
         if (format === 'jwk') {
           // Not all fields used for public keys
           testFormat(
@@ -37,7 +37,7 @@ function runTests(algorithmName) {
 
     // Next, test private keys
     allValidUsages(data.privateUsages).forEach(function (usages) {
-      ['pkcs8', 'jwk', 'raw-seed'].forEach(function (format) {
+      data.privateFormats.forEach(function (format) {
         testFormat(format, algorithm, data, algorithmName, usages, extractable);
       });
     });
diff --git a/test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js b/test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js
new file mode 100644
index 000000000000..465f86df55a8
--- /dev/null
+++ b/test/fixtures/wpt/WebCryptoAPI/serialization/hybridkem.tentative.https.window.js
@@ -0,0 +1,32 @@
+// META: title=WebCryptoAPI: Hybrid KEM CryptoKey serialization
+// META: script=../util/helpers.js
+// META: script=serialization.js
+run_test([
+  {
+    name: 'MLKEM768-P256',
+    resultType: 'CryptoKeyPair',
+    usages: [
+      'decapsulateBits', 'decapsulateKey', 'encapsulateBits', 'encapsulateKey'
+    ],
+    publicFormat: 'raw-public',
+    privateFormat: 'raw-seed'
+  },
+  {
+    name: 'MLKEM768-X25519',
+    resultType: 'CryptoKeyPair',
+    usages: [
+      'decapsulateBits', 'decapsulateKey', 'encapsulateBits', 'encapsulateKey'
+    ],
+    publicFormat: 'raw-public',
+    privateFormat: 'raw-seed'
+  },
+  {
+    name: 'MLKEM1024-P384',
+    resultType: 'CryptoKeyPair',
+    usages: [
+      'decapsulateBits', 'decapsulateKey', 'encapsulateBits', 'encapsulateKey'
+    ],
+    publicFormat: 'raw-public',
+    privateFormat: 'raw-seed'
+  },
+]);
diff --git a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
index a8f730e9bfc4..5c4699dcfb7f 100644
--- a/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
+++ b/test/fixtures/wpt/WebCryptoAPI/supports-modern.tentative.https.any.js
@@ -33,6 +33,24 @@ const modernAlgorithms = {
       'decapsulateKey', 'decapsulateBits', 'getPublicKey'
     ],
   },
+  'MLKEM768-P256': {
+    operations: [
+      'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
+      'decapsulateKey', 'decapsulateBits', 'getPublicKey'
+    ],
+  },
+  'MLKEM768-X25519': {
+    operations: [
+      'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
+      'decapsulateKey', 'decapsulateBits', 'getPublicKey'
+    ],
+  },
+  'MLKEM1024-P384': {
+    operations: [
+      'generateKey', 'importKey', 'encapsulateKey', 'encapsulateBits',
+      'decapsulateKey', 'decapsulateBits', 'getPublicKey'
+    ],
+  },
 
   // Symmetric algorithms
   'ChaCha20-Poly1305': {
diff --git a/test/fixtures/wpt/WebCryptoAPI/util/helpers.js b/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
index cc44dd16b1c9..86a4a79f0b9d 100644
--- a/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
+++ b/test/fixtures/wpt/WebCryptoAPI/util/helpers.js
@@ -31,6 +31,9 @@ var registeredAlgorithmNames = [
     "ML-KEM-512",
     "ML-KEM-768",
     "ML-KEM-1024",
+    "MLKEM768-P256",
+    "MLKEM768-X25519",
+    "MLKEM1024-P384",
     "ChaCha20-Poly1305",
     "Argon2i",
     "Argon2d",
diff --git a/test/fixtures/wpt/interfaces/FileAPI.idl b/test/fixtures/wpt/interfaces/FileAPI.idl
index 49219fce277f..4a711a684459 100644
--- a/test/fixtures/wpt/interfaces/FileAPI.idl
+++ b/test/fixtures/wpt/interfaces/FileAPI.idl
@@ -20,6 +20,7 @@ interface Blob {
   [NewObject] ReadableStream stream();
   [NewObject] Promise<USVString> text();
   [NewObject] Promise<ArrayBuffer> arrayBuffer();
+  [NewObject] ReadableStream textStream();
   [NewObject] Promise<Uint8Array> bytes();
 };
 
diff --git a/test/fixtures/wpt/interfaces/compression.idl b/test/fixtures/wpt/interfaces/compression.idl
index defe4ba55cdf..6e44b4ad6dd9 100644
--- a/test/fixtures/wpt/interfaces/compression.idl
+++ b/test/fixtures/wpt/interfaces/compression.idl
@@ -4,6 +4,7 @@
 // Source: Compression Standard (https://compression.spec.whatwg.org/)
 
 enum CompressionFormat {
+  "brotli",
   "deflate",
   "deflate-raw",
   "gzip",
diff --git a/test/fixtures/wpt/interfaces/dom.idl b/test/fixtures/wpt/interfaces/dom.idl
index 1ddc084b949d..f61580f43a90 100644
--- a/test/fixtures/wpt/interfaces/dom.idl
+++ b/test/fixtures/wpt/interfaces/dom.idl
@@ -328,7 +328,7 @@ interface DOMImplementation {
   [NewObject] XMLDocument createDocument(DOMString? namespace, [LegacyNullToEmptyString] DOMString qualifiedName, optional DocumentType? doctype = null);
   [NewObject] Document createHTMLDocument(optional DOMString title);
 
-  boolean hasFeature(); // useless; always returns true
+  boolean hasFeature(); // historical; always returns true
 };
 
 [Exposed=Window]
@@ -347,9 +347,9 @@ interface DocumentFragment : Node {
 interface ShadowRoot : DocumentFragment {
   readonly attribute ShadowRootMode mode;
   readonly attribute boolean delegatesFocus;
+  readonly attribute boolean serializable;
   readonly attribute SlotAssignmentMode slotAssignment;
   readonly attribute boolean clonable;
-  readonly attribute boolean serializable;
   readonly attribute Element host;
 
   attribute EventHandler onslotchange;
@@ -409,9 +409,9 @@ interface Element : Node {
 dictionary ShadowRootInit {
   required ShadowRootMode mode;
   boolean delegatesFocus = false;
+  boolean serializable = false;
   SlotAssignmentMode slotAssignment = "named";
   boolean clonable = false;
-  boolean serializable = false;
   CustomElementRegistry? customElementRegistry;
 };
 
@@ -438,7 +438,7 @@ interface Attr : Node {
 
   readonly attribute Element? ownerElement;
 
-  readonly attribute boolean specified; // useless; always returns true
+  readonly attribute boolean specified; // historical; always returns true
 };
 [Exposed=Window]
 interface CharacterData : Node {
@@ -464,7 +464,17 @@ interface CDATASection : Text {
 };
 [Exposed=Window]
 interface ProcessingInstruction : CharacterData {
+  constructor(DOMString target, optional DOMString data = "");
+
   readonly attribute DOMString target;
+
+  boolean hasAttributes();
+  sequence<DOMString> getAttributeNames();
+  DOMString? getAttribute(DOMString name);
+  undefined setAttribute(DOMString name, DOMString value);
+  undefined removeAttribute(DOMString name);
+  boolean toggleAttribute(DOMString name, optional boolean force);
+  boolean hasAttribute(DOMString name);
 };
 [Exposed=Window]
 interface Comment : CharacterData {
diff --git a/test/fixtures/wpt/interfaces/html.idl b/test/fixtures/wpt/interfaces/html.idl
index 567e5a79a36a..e5ce24af481a 100644
--- a/test/fixtures/wpt/interfaces/html.idl
+++ b/test/fixtures/wpt/interfaces/html.idl
@@ -48,7 +48,8 @@ typedef (HTMLScriptElement or SVGScriptElement) HTMLOrSVGScriptElement;
 
 [LegacyOverrideBuiltIns]
 partial interface Document {
-  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html);
+  static Document parseHTMLUnsafe((TrustedHTML or DOMString) html, optional ParseHTMLUnsafeOptions options = {});
+  static Document parseHTML(DOMString html, optional SetHTMLOptions options = {});
 
   // resource metadata management
   [PutForwards=href, LegacyUnforgeable] readonly attribute Location? location;
@@ -152,14 +153,14 @@ dictionary TogglePopoverOptions : ShowPopoverOptions {
 
 HTMLElement includes GlobalEventHandlers;
 HTMLElement includes ElementContentEditable;
-HTMLElement includes HTMLOrSVGElement;
+HTMLElement includes HTMLOrSVGOrMathMLElement;
 
 [Exposed=Window]
 interface HTMLUnknownElement : HTMLElement {
   // Note: intentionally no [HTMLConstructor]
 };
 
-interface mixin HTMLOrSVGElement {
+interface mixin HTMLOrSVGOrMathMLElement {
   [SameObject] readonly attribute DOMStringMap dataset;
   attribute DOMString nonce; // intentionally no [CEReactions]
 
@@ -349,13 +350,10 @@ interface HTMLDivElement : HTMLElement {
 interface HTMLAnchorElement : HTMLElement {
   [HTMLConstructor] constructor();
 
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
   [SameObject, PutForwards=value, Reflect="rel"] readonly attribute DOMTokenList relList;
-  [CEReactions, Reflect] attribute DOMString hreflang;
-  [CEReactions, Reflect] attribute DOMString type;
 
   [CEReactions] attribute DOMString text;
 
@@ -403,10 +401,14 @@ interface mixin HyperlinkElementUtils {
   [CEReactions] attribute USVString pathname;
   [CEReactions] attribute USVString search;
   [CEReactions] attribute USVString hash;
+
+  [CEReactions, Reflect] attribute DOMString hreflang;
+  [CEReactions, Reflect] attribute DOMString type;
 };
 
 interface mixin HTMLHyperlinkElementUtils {
   [CEReactions, ReflectSetter] stringifier attribute USVString href;
+  [CEReactions, Reflect] attribute DOMString target;
 };
 
 [Exposed=Window]
@@ -447,6 +449,7 @@ interface HTMLImageElement : HTMLElement {
   [CEReactions] attribute DOMString? crossOrigin;
   [CEReactions, Reflect] attribute DOMString useMap;
   [CEReactions, Reflect] attribute boolean isMap;
+  [CEReactions, Reflect] attribute boolean controls;
   [CEReactions, ReflectSetter] attribute unsigned long width;
   [CEReactions, ReflectSetter] attribute unsigned long height;
   readonly attribute unsigned long naturalWidth;
@@ -531,6 +534,7 @@ interface HTMLVideoElement : HTMLMediaElement {
   readonly attribute unsigned long videoHeight;
   [CEReactions, ReflectURL] attribute USVString poster;
   [CEReactions, Reflect] attribute boolean playsInline;
+
 };
 
 [Exposed=Window,
@@ -613,6 +617,7 @@ interface HTMLMediaElement : HTMLElement {
   attribute double volume;
   attribute boolean muted;
   [CEReactions, Reflect="muted"] attribute boolean defaultMuted;
+  [CEReactions] attribute DOMString loading;
 
   // tracks
   [SameObject] readonly attribute AudioTrackList audioTracks;
@@ -760,7 +765,6 @@ interface HTMLAreaElement : HTMLElement {
   [CEReactions, Reflect] attribute DOMString alt;
   [CEReactions, Reflect] attribute DOMString coords;
   [CEReactions, Reflect] attribute DOMString shape;
-  [CEReactions, Reflect] attribute DOMString target;
   [CEReactions, Reflect] attribute DOMString download;
   [CEReactions, Reflect] attribute USVString ping;
   [CEReactions, Reflect] attribute DOMString rel;
@@ -966,7 +970,7 @@ interface HTMLButtonElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   [CEReactions, ReflectSetter] attribute DOMString command;
-  [CEReactions, Reflect] attribute Element? commandForElement;
+  [CEReactions, Reflect="commandfor"] attribute Element? commandForElement;
   [CEReactions, Reflect] attribute boolean disabled;
   readonly attribute HTMLFormElement? form;
   [CEReactions, ReflectSetter] attribute USVString formAction;
@@ -1271,10 +1275,12 @@ interface HTMLTemplateElement : HTMLElement {
   [HTMLConstructor] constructor();
 
   readonly attribute DocumentFragment content;
+  [CEReactions, Reflect="for"] attribute DOMString htmlFor;
   [CEReactions] attribute DOMString shadowRootMode;
   [CEReactions, Reflect] attribute boolean shadowRootDelegatesFocus;
-  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute boolean shadowRootSerializable;
+  [CEReactions] attribute DOMString shadowRootSlotAssignment;
+  [CEReactions, Reflect] attribute boolean shadowRootClonable;
   [CEReactions, Reflect] attribute DOMString shadowRootCustomElementRegistry;
 };
 
@@ -1808,7 +1814,7 @@ dictionary DragEventInit : MouseEventInit {
 };
 
 interface mixin PopoverTargetAttributes {
-  [CEReactions, Reflect] attribute Element? popoverTargetElement;
+  [CEReactions, Reflect="popovertarget"] attribute Element? popoverTargetElement;
   [CEReactions] attribute DOMString popoverTargetAction;
 };
 
@@ -2357,7 +2363,8 @@ Window includes WindowOrWorkerGlobalScope;
 WorkerGlobalScope includes WindowOrWorkerGlobalScope;
 
 partial interface Element {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
@@ -2366,12 +2373,25 @@ partial interface Element {
 };
 
 partial interface ShadowRoot {
-  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html);
+  [CEReactions] undefined setHTML(DOMString html, optional SetHTMLOptions options = {});
+  [CEReactions] undefined setHTMLUnsafe((TrustedHTML or DOMString) html, optional SetHTMLUnsafeOptions options = {});
   DOMString getHTML(optional GetHTMLOptions options = {});
 
   [CEReactions] attribute (TrustedHTML or [LegacyNullToEmptyString] DOMString) innerHTML;
 };
 
+enum SanitizerPresets { "default" };
+dictionary SetHTMLOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = "default";
+};
+dictionary SetHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+  boolean runScripts = false;
+};
+dictionary ParseHTMLUnsafeOptions {
+  (Sanitizer or SanitizerConfig or SanitizerPresets) sanitizer = {};
+};
+
 dictionary GetHTMLOptions {
   boolean serializableShadowRoots = false;
   sequence<ShadowRoot> shadowRoots = [];
@@ -2403,6 +2423,68 @@ interface XMLSerializer {
   DOMString serializeToString(Node root);
 };
 
+[Exposed=Window]
+interface Sanitizer {
+  constructor(optional (SanitizerConfig or SanitizerPresets) configuration = "default");
+
+  // Query configuration:
+  SanitizerConfig get();
+
+  // Modify a Sanitizer's lists and fields:
+  boolean allowElement(SanitizerElementWithAttributes element);
+  boolean removeElement(SanitizerElement element);
+  boolean replaceElementWithChildren(SanitizerElement element);
+  boolean allowProcessingInstruction(SanitizerPI pi);
+  boolean removeProcessingInstruction(SanitizerPI pi);
+  boolean allowAttribute(SanitizerAttribute attribute);
+  boolean removeAttribute(SanitizerAttribute attribute);
+  boolean setComments(boolean allow);
+  boolean setDataAttributes(boolean allow);
+
+  // Remove markup that executes script.
+  boolean removeUnsafe();
+};
+
+dictionary SanitizerElementNamespace {
+  required DOMString name;
+  DOMString? _namespace = "http://www.w3.org/1999/xhtml";
+};
+
+// Used by "elements"
+dictionary SanitizerElementNamespaceWithAttributes : SanitizerElementNamespace {
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+};
+
+dictionary SanitizerAttributeNamespace {
+  required DOMString name;
+  DOMString? _namespace = null;
+};
+
+dictionary SanitizerProcessingInstruction {
+  required DOMString target;
+};
+
+typedef (DOMString or SanitizerElementNamespace) SanitizerElement;
+typedef (DOMString or SanitizerElementNamespaceWithAttributes) SanitizerElementWithAttributes;
+typedef (DOMString or SanitizerProcessingInstruction) SanitizerPI;
+typedef (DOMString or SanitizerAttributeNamespace) SanitizerAttribute;
+
+dictionary SanitizerConfig {
+  sequence<SanitizerElementWithAttributes> elements;
+  sequence<SanitizerElement> removeElements;
+  sequence<SanitizerElement> replaceWithChildrenElements;
+
+  sequence<SanitizerPI> processingInstructions;
+  sequence<SanitizerPI> removeProcessingInstructions;
+
+  sequence<SanitizerAttribute> attributes;
+  sequence<SanitizerAttribute> removeAttributes;
+
+  boolean comments;
+  boolean dataAttributes;
+};
+
 [Exposed=Window]
 interface Navigator {
   // objects implementing this interface also implement the interfaces given below
diff --git a/test/fixtures/wpt/interfaces/resource-timing.idl b/test/fixtures/wpt/interfaces/resource-timing.idl
index ba8e3953b497..1391b09022e1 100644
--- a/test/fixtures/wpt/interfaces/resource-timing.idl
+++ b/test/fixtures/wpt/interfaces/resource-timing.idl
@@ -41,7 +41,8 @@ enum RenderBlockingStatusType {
     "non-blocking"
 };
 
-partial interface Performance {  undefined clearResourceTimings ();
-  undefined setResourceTimingBufferSize (unsigned long maxSize);
-  attribute EventHandler onresourcetimingbufferfull;
-};
+partial interface Performance {
+      undefined clearResourceTimings ();
+      undefined setResourceTimingBufferSize (unsigned long maxSize);
+      attribute EventHandler onresourcetimingbufferfull;
+    };
diff --git a/test/fixtures/wpt/interfaces/streams.idl b/test/fixtures/wpt/interfaces/streams.idl
index 8abc8f5cfda9..a0de8b89aa46 100644
--- a/test/fixtures/wpt/interfaces/streams.idl
+++ b/test/fixtures/wpt/interfaces/streams.idl
@@ -7,7 +7,7 @@
 interface ReadableStream {
   constructor(optional object underlyingSource, optional QueuingStrategy strategy = {});
 
-  static ReadableStream from(any asyncIterable);
+  static ReadableStream from(async_sequence<any> asyncIterable);
 
   readonly attribute boolean locked;
 
@@ -114,7 +114,7 @@ interface ReadableByteStreamController {
 
 [Exposed=*]
 interface ReadableStreamBYOBRequest {
-  readonly attribute ArrayBufferView? view;
+  readonly attribute Uint8Array? view;
 
   undefined respond([EnforceRange] unsigned long long bytesWritten);
   undefined respondWithNewView(ArrayBufferView view);
diff --git a/test/fixtures/wpt/interfaces/web-locks.idl b/test/fixtures/wpt/interfaces/web-locks.idl
index 00648cc3b1e5..d79e404b983f 100644
--- a/test/fixtures/wpt/interfaces/web-locks.idl
+++ b/test/fixtures/wpt/interfaces/web-locks.idl
@@ -10,7 +10,7 @@ interface mixin NavigatorLocks {
 Navigator includes NavigatorLocks;
 WorkerNavigator includes NavigatorLocks;
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface LockManager {
   Promise<any> request(DOMString name,
                        LockGrantedCallback callback);
@@ -43,7 +43,7 @@ dictionary LockInfo {
   DOMString clientId;
 };
 
-[SecureContext, Exposed=(Window,Worker,SharedStorageWorklet)]
+[SecureContext, Exposed=(Window,Worker)]
 interface Lock {
   readonly attribute DOMString name;
   readonly attribute LockMode mode;
diff --git a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
index aeb1d650b7d7..00df80f74ccf 100644
--- a/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto-modern-algos.idl
@@ -38,7 +38,7 @@ partial interface SubtleCrypto {
 
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
-                   optional unsigned long? length = null);
+                   optional [EnforceRange] unsigned long? length = null);
   static boolean supports(DOMString operation,
                    AlgorithmIdentifier algorithm,
                    AlgorithmIdentifier additionalAlgorithm);
@@ -59,7 +59,7 @@ dictionary EncapsulatedBits {
 };
 
 partial dictionary JsonWebKey {
-  // The following fields are defined in draft-ietf-cose-dilithium-08
+  // The following fields are defined in RFC 9964
   DOMString pub;
   DOMString priv;
 };
@@ -99,7 +99,7 @@ dictionary KmacImportParams : Algorithm {
 };
 
 dictionary KmacKeyAlgorithm : KeyAlgorithm {
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary KmacParams : Algorithm {
diff --git a/test/fixtures/wpt/interfaces/webcrypto.idl b/test/fixtures/wpt/interfaces/webcrypto.idl
index ebb9cf5718b9..7599a1a994aa 100644
--- a/test/fixtures/wpt/interfaces/webcrypto.idl
+++ b/test/fixtures/wpt/interfaces/webcrypto.idl
@@ -79,7 +79,7 @@ interface SubtleCrypto {
   Promise<ArrayBuffer> deriveBits(
     AlgorithmIdentifier algorithm,
     CryptoKey baseKey,
-    optional unsigned long? length = null
+    optional [EnforceRange] unsigned long? length = null
   );
 
   Promise<CryptoKey> importKey(
@@ -161,7 +161,7 @@ dictionary RsaHashedKeyGenParams : RsaKeyGenParams {
 };
 
 dictionary RsaKeyAlgorithm : KeyAlgorithm {
-  required unsigned long modulusLength;
+  required [EnforceRange] unsigned long modulusLength;
   required BigInteger publicExponent;
 };
 
@@ -209,7 +209,7 @@ dictionary AesCtrParams : Algorithm {
 };
 
 dictionary AesKeyAlgorithm : KeyAlgorithm {
-  required unsigned short length;
+  required [EnforceRange] unsigned short length;
 };
 
 dictionary AesKeyGenParams : Algorithm {
@@ -237,7 +237,7 @@ dictionary HmacImportParams : Algorithm {
 
 dictionary HmacKeyAlgorithm : KeyAlgorithm {
   required KeyAlgorithm hash;
-  required unsigned long length;
+  required [EnforceRange] unsigned long length;
 };
 
 dictionary HmacKeyGenParams : Algorithm {
diff --git a/test/fixtures/wpt/versions.json b/test/fixtures/wpt/versions.json
index 2481ba0cee5d..9e7979e55460 100644
--- a/test/fixtures/wpt/versions.json
+++ b/test/fixtures/wpt/versions.json
@@ -52,7 +52,7 @@
     "path": "html/webappapis/timers"
   },
   "interfaces": {
-    "commit": "a8392bd0210378dda13278eeccf2c2602278e214",
+    "commit": "3f15e5c09448b8e917c9128d3b07cc78f044c83a",
     "path": "interfaces"
   },
   "performance-timeline": {
@@ -100,11 +100,11 @@
     "path": "web-locks"
   },
   "WebCryptoAPI": {
-    "commit": "e235e089b4e44a598f2d61e93732e0c4d9f03e04",
+    "commit": "55ce71bb9deaf4b8a30fe80f95558a10699fb433",
     "path": "WebCryptoAPI"
   },
   "webidl": {
-    "commit": "63ca529a021fec15b2996db82fd7dd04c11abe85",
+    "commit": "65bbe07908e5c19e8a6c7ff8701cc2a722cd215e",
     "path": "webidl"
   },
   "webidl/ecmascript-binding/es-exceptions": {
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
new file mode 100644
index 000000000000..b4cd1e37fd94
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/allow-shared.https.html
@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<meta charset="utf-8">
+<title>WebIDL [AllowShared] semantics</title>
+<link rel="help" href="https://webidl.spec.whatwg.org/#AllowShared">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/common/sab.js"></script>
+<script>
+  "use strict";
+
+  test(t => {
+    // Create a standard SharedArrayBuffer (safe even without COOP/COEP headers)
+    const sab = createBuffer('SharedArrayBuffer', 128);
+    const arr = new Uint8Array(sab);
+    arr.fill(42);
+    assert_equals(sab.constructor.name, 'SharedArrayBuffer');
+    new ImageDecoder({
+      data: arr,
+      // We don't really need encoding to succeed, just for argument conversion before the native call.
+      type: "invalid"
+    });
+
+    assert_throws_js(TypeError, () => {
+      new MIDIMessageEvent('message', { data: arr });
+    }, "An attempt to pass a view backed by a shared array buffer should throw");
+
+  }, "APIs without [AllowShared] do not accept SharedArrayBuffer-backed views with pre-existing wrapper");
+
+</script>
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
index 9b6978783723..856d13681e60 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constants.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
index 011521652654..ca0fc84fc66a 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-and-prototype.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 test(function() {
     assert_own_property(self, "DOMException", "property of global");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
index c4ddabdafd45..10aad220b917 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-constructor-behavior.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
index d1c86930d4cd..467bf054c3a9 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-custom-bindings.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
index 6f3097b222ed..dc39c978217b 100644
--- a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-is-error.any.js
@@ -1,4 +1,4 @@
-// META: global=window,dedicatedworker,shadowrealm
+// META: global=window,dedicatedworker
 
 'use strict';
 
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
new file mode 100644
index 000000000000..24f6fd486bdc
--- /dev/null
+++ b/test/fixtures/wpt/webidl/ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js
@@ -0,0 +1,80 @@
+// META: global=window,dedicatedworker
+
+// https://tc39.es/proposal-error-stack-accessor/
+// https://github.com/whatwg/webidl/pull/1421
+
+"use strict";
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() has a stack property that is a string");
+
+test(() => {
+  const e = new DOMException();
+  assert_equals(typeof e.stack, "string", "stack must be a string");
+}, "new DOMException() with no arguments has a stack property that is a string");
+
+if (typeof document !== "undefined") {
+  test(() => {
+    let caught;
+    try {
+      document.createElement("");
+    } catch (e) {
+      caught = e;
+    }
+    assert_true(caught instanceof DOMException, "must be a DOMException");
+    assert_equals(typeof caught.stack, "string", "stack must be a string");
+  }, "thrown DOMException from DOM API has a stack property that is a string");
+}
+
+test(() => {
+  const e = new DOMException("some message", "SyntaxError");
+  assert_false(e.hasOwnProperty("stack"), "stack must not be an own property of the instance");
+}, "DOMException instance does not have an own stack property");
+
+test(() => {
+  assert_false(DOMException.prototype.hasOwnProperty("stack"),
+    "DOMException.prototype must not have an own stack property");
+}, "DOMException.prototype does not have an own stack property");
+
+test(() => {
+  const desc = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_not_equals(desc, undefined, "Error.prototype must have a stack property descriptor");
+  assert_equals(typeof desc.get, "function", "stack must have a getter");
+  assert_equals(typeof desc.set, "function", "stack must have a setter");
+  assert_false(desc.enumerable, "stack must not be enumerable");
+  assert_true(desc.configurable, "stack must be configurable");
+}, "Error.prototype.stack is an accessor property with correct attributes");
+
+test(() => {
+  const getter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").get;
+  const e = new DOMException("some message", "SyntaxError");
+  const stack = getter.call(e);
+  assert_equals(typeof stack, "string", "getter must return a string for DOMException");
+  assert_equals(stack, e.stack, "getter result must match e.stack");
+}, "Error.prototype.stack getter works on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  const e = new DOMException("some message", "SyntaxError");
+  setter.call(e, "custom stack");
+  assert_true(e.hasOwnProperty("stack"), "after setter, stack must be an own property");
+  assert_equals(e.stack, "custom stack", "own stack property must have the set value");
+
+  const desc = Object.getOwnPropertyDescriptor(e, "stack");
+  assert_equals(desc.value, "custom stack", "must be a data property");
+  assert_true(desc.writable, "must be writable");
+  assert_true(desc.enumerable, "must be enumerable");
+  assert_true(desc.configurable, "must be configurable");
+}, "Error.prototype.stack setter installs own data property on DOMException instances");
+
+test(() => {
+  const setter = Object.getOwnPropertyDescriptor(Error.prototype, "stack").set;
+  // SetterThatIgnoresPrototypeProperties should not install a property on Error.prototype itself
+  const originalStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  setter.call(Error.prototype, "custom stack");
+  const afterStack = Object.getOwnPropertyDescriptor(Error.prototype, "stack");
+  assert_equals(typeof afterStack.get, "function",
+    "Error.prototype.stack must still be an accessor after calling setter on it");
+}, "Error.prototype.stack setter ignores Error.prototype itself");
diff --git a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js b/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
deleted file mode 100644
index eba96e9adf46..000000000000
--- a/test/fixtures/wpt/webidl/ecmascript-binding/global-mutable-prototype.any.js
+++ /dev/null
@@ -1,27 +0,0 @@
-// META: global=shadowrealm
-// META: title=Mutability of the global prototype chain
-
-const objects = [];
-setup(() => {
-  for (let object = self; object; object = Object.getPrototypeOf(object)) {
-    objects.push(object);
-  }
-});
-
-test(() => {
-  for (const object of objects) {
-    const proto = Object.getPrototypeOf(object);
-    const plainObject = {};
-    Object.setPrototypeOf(object, plainObject);
-    assert_equals(Object.getPrototypeOf(object), plainObject);
-    Object.setPrototypeOf(object, proto);
-  }
-}, "Setting to a different prototype");
-
-test(() => {
-  for (const object of objects) {
-    const expected = Object.getPrototypeOf(object);
-    Object.setPrototypeOf(object, expected);
-    assert_equals(Object.getPrototypeOf(object), expected);
-  }
-}, "Setting to the same prototype");
diff --git a/test/fixtures/wpt/webidl/idlharness.any.js b/test/fixtures/wpt/webidl/idlharness.any.js
index f8b285c485c4..164fa0e65c8d 100644
--- a/test/fixtures/wpt/webidl/idlharness.any.js
+++ b/test/fixtures/wpt/webidl/idlharness.any.js
@@ -1,6 +1,6 @@
 // META: script=/resources/WebIDLParser.js
 // META: script=/resources/idlharness.js
-// META: global=window,dedicatedworker,shadowrealm-in-window
+// META: global=window,dedicatedworker
 
 "use strict";
 
diff --git a/test/module-hooks/test-module-hooks-builtin-require.js b/test/module-hooks/test-module-hooks-builtin-require.js
index 2086cbe062b0..e1e137ce1169 100644
--- a/test/module-hooks/test-module-hooks-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-builtin-require.js
@@ -11,6 +11,8 @@ const assert = require('assert');
 const { registerHooks } = require('module');
 
 const schemelessBlockList = new Set([
+  'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/module-hooks/test-module-hooks-load-builtin-require.js b/test/module-hooks/test-module-hooks-load-builtin-require.js
index 962080b3c2c8..946fc1e48766 100644
--- a/test/module-hooks/test-module-hooks-load-builtin-require.js
+++ b/test/module-hooks/test-module-hooks-load-builtin-require.js
@@ -35,6 +35,8 @@ hook.deregister();
 // the one with the `node:` prefix. The one with the prefix
 // stripped for internal lookups should not get passed into the hooks.
 const schemelessBlockList = new Set([
+  'bench',
+  'bench/reporters',
   'sea',
   'test',
   'test/reporters',
diff --git a/test/parallel/parallel.status b/test/parallel/parallel.status
index 5f45d1ecdccd..d8fba447e96e 100644
--- a/test/parallel/parallel.status
+++ b/test/parallel/parallel.status
@@ -20,8 +20,6 @@ test-fs-read-stream-concurrent-reads: PASS, FLAKY
 test-snapshot-incompatible: SKIP
 
 [$system==win32]
-# https://github.com/nodejs/node/issues/55154#issuecomment-5423571475
-test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/59090
 test-inspector-network-fetch: PASS, FLAKY
 # https://github.com/nodejs/node/issues/59636
@@ -38,8 +36,6 @@ test-performance-function: PASS, FLAKY
 test-esm-loader-hooks-inspect-wait: PASS, FLAKY
 
 [$system==linux && $arch==s390x]
-# https://github.com/nodejs/node/issues/55154#issuecomment-5423571475
-test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/58353
 test-http2-debug: PASS, FLAKY
 
@@ -101,12 +97,8 @@ test-fs-watch-ignore-mixed: SKIP
 test-fs-watch-ignore-regexp: SKIP
 
 [$system==aix]
-# https://github.com/nodejs/node/issues/55154#issuecomment-5423571475
-test-runner-coverage: PASS, FLAKY
 # https://github.com/nodejs/node/issues/54346
 test-esm-loader-hooks-inspect-wait: PASS, FLAKY
-# https://github.com/nodejs/node/issues/65697
-test-fs-watch-recursive-delete-race: SKIP
 
 [$system==ibmi]
 # https://github.com/nodejs/node/pull/30819
diff --git a/test/parallel/test-bench-auto-run.js b/test/parallel/test-bench-auto-run.js
new file mode 100644
index 000000000000..6baf7b327cdc
--- /dev/null
+++ b/test/parallel/test-bench-auto-run.js
@@ -0,0 +1,26 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { bench } = require('node:bench');
+
+const child = spawnSync(process.execPath, [
+  '--no-warnings',
+  '-e',
+  'require("node:bench").bench("failure", () => { throw new Error(); })',
+]);
+assert.strictEqual(child.status, 1);
+
+const completion = bench('automatic execution', common.mustCall((b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+}, 30));
+
+completion.then(common.mustCall((result) => {
+  assert.strictEqual(result.name, 'automatic execution');
+  assert.strictEqual(result.samples.length, 30);
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.skip, undefined);
+  assert.strictEqual(result.summary.mean > 0, true);
+}));
diff --git a/test/parallel/test-bench-cli-arguments.js b/test/parallel/test-bench-cli-arguments.js
new file mode 100644
index 000000000000..81093284e312
--- /dev/null
+++ b/test/parallel/test-bench-cli-arguments.js
@@ -0,0 +1,78 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
+}
+
+for (const { args, message } of [
+  {
+    args: ['--bench-isolation=invalid', 'unused.js'],
+    message: /invalid value for --bench-isolation/,
+  },
+  {
+    args: ['--bench-samples=0', 'unused.js'],
+    message: /--bench-samples must be greater than 0/,
+  },
+  {
+    args: ['--bench-warmup=4294967296', 'unused.js'],
+    message: /--bench-warmup.*out of range/,
+  },
+  {
+    args: ['--bench-samples=2x', 'unused.js'],
+    message: /invalid value for --bench-samples/,
+  },
+  {
+    args: ['--bench-warmup=abc', 'unused.js'],
+    message: /invalid value for --bench-warmup/,
+  },
+  {
+    args: ['--bench-name-pattern=[', 'unused.js'],
+    message: /invalid regular expression/,
+  },
+  {
+    args: ['--eval=1', 'unused.js'],
+    message: /either --bench or --eval can be used, not both/,
+  },
+  {
+    args: ['--interactive', 'unused.js'],
+    message: /either --bench or --interactive can be used, not both/,
+  },
+  {
+    args: ['--watch', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--watch-path=.', 'unused.js'],
+    message: /either --bench or --watch can be used, not both/,
+  },
+  {
+    args: ['--check', 'unused.js'],
+    message: /either --bench or --check can be used, not both/,
+  },
+  {
+    args: ['--test', 'unused.js'],
+    message: /either --bench or --test can be used, not both/,
+  },
+]) {
+  const result = spawnBench(args);
+  assert.notStrictEqual(result.status, 0);
+  assert.match(result.stderr, message);
+}
diff --git a/test/parallel/test-bench-cli-backpressure.js b/test/parallel/test-bench-cli-backpressure.js
new file mode 100644
index 000000000000..0c885ccaeaec
--- /dev/null
+++ b/test/parallel/test-bench-cli-backpressure.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/slow-reporter.cjs')}`,
+    fixtures.path('bench-runner/many-records.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const report = JSON.parse(result.stdout);
+  assert.strictEqual(report.samples, 30);
+  assert.strictEqual(report.stdout,
+                     Array.from({ length: 30 }, (_, i) => `${i}\n`).join(''));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/acknowledged-records.mjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(diagnostics.every(
+    ({ data }) => /^acknowledged 10\d{3}$/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, true);
+}
diff --git a/test/parallel/test-bench-cli-lifecycle.js b/test/parallel/test-bench-cli-lifecycle.js
new file mode 100644
index 000000000000..64130e1467bf
--- /dev/null
+++ b/test/parallel/test-bench-cli-lifecycle.js
@@ -0,0 +1,258 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fixtures = require('../common/fixtures');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/error.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const failure = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(failure.params, { kind: 'structured-error' });
+  assert.strictEqual(failure.error.name, 'Error');
+  assert.strictEqual(failure.error.message, 'benchmark fixture failed');
+  assert.strictEqual(failure.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(failure.error.cause, { value: '42' });
+  assert.match(failure.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/throws-null.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.message, 'null');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/load-error-after-declaration.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'declared before load error');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(completion.name, plan.name);
+  assert.strictEqual(completion.error, undefined);
+  assert.strictEqual(completion.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/recorded-detail.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.samples.length, 1);
+  const { rate, ...sample } = completion.samples[0];
+  assert.deepStrictEqual(sample, {
+    detail: { index: 0, phase: 'measurement', value: '42' },
+    duration_ns: '4',
+    operations: 2,
+  });
+  assert(Math.abs(rate - 500_000_000) < 1);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/diagnostic.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.deepStrictEqual(diagnostic.message, {
+    name: 'node:bench:test:diagnostic',
+    message: { value: '42' },
+  });
+  assert.strictEqual(diagnostic.level, 'info');
+  assert.strictEqual(diagnostic.phase, 'measurement');
+  assert.strictEqual(diagnostic.index, 0);
+  assert.strictEqual(diagnostic.detail, undefined);
+  assert.strictEqual(diagnostic.benchId, completion.benchId);
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+  assert.strictEqual(completion.error, undefined);
+}
+
+for (const { kind, message } of [
+  { kind: 'sequence', message: /valid record sequence/ },
+  { kind: 'record', message: /not a valid benchmark record/ },
+  { kind: 'identity', message: /not a valid benchmark record/ },
+  { kind: 'name-path', message: /not a valid benchmark record/ },
+  { kind: 'plan', message: /not a valid benchmark plan/ },
+  { kind: 'timeout', message: /not a valid benchmark plan/ },
+  { kind: 'diagnostic', message: /not a valid benchmark diagnostic/ },
+  { kind: 'diagnostic-order', message: /valid lifecycle sequence/ },
+  { kind: 'summary', message: /not a valid benchmark summary/ },
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-record.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_MALFORMED_RECORD: kind,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/malformed-plan-order.mjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => /valid lifecycle sequence/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)).data;
+  assert.strictEqual(diagnostic.entryFile, null);
+  assert.strictEqual(diagnostic.fileRunId, null);
+  assert.strictEqual(diagnostic.file, null);
+}
+
+for (const { mode, message } of [
+  { mode: 'code', message: /failed with exit code 2/ },
+  { mode: 'late', message: /failed with exit code 2/ },
+  ...common.isWindows ? [] : [
+    { mode: 'signal', message: /failed with signal SIGTERM/ },
+  ],
+]) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/abrupt-exit.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_EXIT_MODE: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(({ data }) => message.test(data.message)));
+}
+
+for (const mode of ['callback', 'throw']) {
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/send-error.cjs'),
+  ], {
+    env: {
+      __proto__: null,
+      ...process.env,
+      NODE_BENCH_SEND_ERROR: mode,
+    },
+  });
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const messages = diagnostics.map(({ data }) => data.message).join('');
+  assert.match(messages, /benchmark send/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/run.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.match(diagnostic.data.message,
+               /run\(\) cannot be called from a file run with --bench/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/exit-code.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
diff --git a/test/parallel/test-bench-cli-reporters.js b/test/parallel/test-bench-cli-reporters.js
new file mode 100644
index 000000000000..204e0d446b14
--- /dev/null
+++ b/test/parallel/test-bench-cli-reporters.js
@@ -0,0 +1,149 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const spawnTimeout = common.platformTimeout(30_000);
+
+tmpdir.refresh();
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+for (const { file, status } of [
+  { file: 'a.cjs', status: 0 },
+  { file: 'error.cjs', status: 1 },
+]) {
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/verifying-reporter.cjs')}`,
+    fixtures.path(`bench-runner/${file}`),
+  ]);
+  assert.strictEqual(result.status, status);
+  assert.strictEqual(result.stderr, '');
+  assert.strictEqual(result.stdout, 'verified\n');
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stdout, '');
+  const records = parseOutput(result.stderr);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert.deepStrictEqual(diagnostics.map(({ data }) => data.stream).sort(), [
+    'stderr',
+    'stdout',
+  ]);
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stdout\n'));
+  assert(diagnostics.some(
+    ({ data }) => data.message === 'benchmark stderr\n'));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/utf8-output.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const output = records.filter(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.stream === 'stdout').map(({ data }) => data.message).join('');
+  assert.strictEqual(output, 'split:\u20ac\n');
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/failing-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter failed/);
+}
+
+{
+  const result = spawnBench([
+    `--bench-reporter=${fixtures.fileURL('bench-runner/destroying-reporter.cjs')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /benchmark reporter closed the stream/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=data:text/javascript,export default 0',
+    '--bench-reporter-destination=stderr',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /is not a valid reporter/);
+}
+
+{
+  const destination = tmpdir.resolve('bench.txt');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter-destination=stdout',
+    '--bench-reporter=spec',
+    `--bench-reporter-destination=${destination}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  parseRecords(result);
+  assert.match(fs.readFileSync(destination, 'utf8'),
+               /^benchmark \| samples \| mean rate/);
+}
+
+{
+  const result = spawnBench([fixtures.path('bench-runner/a.cjs')]);
+  assert.strictEqual(result.status, 0);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /^benchmark \| samples \| mean rate/);
+  assert.match(result.stdout, /1 completed, 0 failed, 0 skipped/);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-reporter=spec',
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr,
+               /must match the number of specified '.*destination'/);
+}
diff --git a/test/parallel/test-bench-cli.js b/test/parallel/test-bench-cli.js
new file mode 100644
index 000000000000..e52530754000
--- /dev/null
+++ b/test/parallel/test-bench-cli.js
@@ -0,0 +1,417 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const basicPattern = fixtures.path('bench-runner/[ab].*');
+const spawnTimeout = common.platformTimeout(30_000);
+
+tmpdir.refresh();
+
+function spawnNode(args, options = undefined) {
+  const result = spawnSync(process.execPath, args, {
+    __proto__: null,
+    encoding: 'utf8',
+    timeout: spawnTimeout,
+    ...options,
+  });
+  assert.ifError(result.error);
+  assert.strictEqual(result.signal, null);
+  return result;
+}
+
+function spawnBench(args, options = undefined) {
+  return spawnNode(['--no-warnings', '--bench', ...args], options);
+}
+
+function parseRecords(result) {
+  assert.strictEqual(result.stderr, '');
+  return parseOutput(result.stdout);
+}
+
+function parseOutput(output) {
+  return output.trim().split('\n').map((line) => JSON.parse(line));
+}
+
+{
+  const result = spawnBench([]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /--bench requires at least one file or glob/);
+}
+
+{
+  const result = spawnBench(['does-not-exist-*.js']);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+if (common.canCreateSymLink()) {
+  const dangling = tmpdir.resolve('dangling.cjs');
+  fs.symlinkSync(tmpdir.resolve('missing.cjs'), dangling);
+  const result = spawnBench([dangling]);
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, /^Could not find/);
+}
+
+for (const { patterns, message } of [
+  {
+    patterns: [
+      fixtures.path('bench-runner/a.cjs'),
+      fixtures.path('bench-runner/b.mjs'),
+    ],
+    message: /benchmark child process requires exactly one file/,
+  },
+  {
+    patterns: [fixtures.path('bench-runner/missing.cjs')],
+    message: /^Could not find/,
+  },
+]) {
+  const result = spawnNode([
+    '--no-warnings',
+    '--require', fixtures.path('bench-runner/fake-ipc.cjs'),
+    '--bench',
+    ...patterns,
+  ], {
+    __proto__: null,
+    env: { __proto__: null, ...process.env, NODE_BENCH_CONTEXT: 'child' },
+  });
+  assert.strictEqual(result.status, 1);
+  assert.strictEqual(result.stdout, '');
+  assert.match(result.stderr, message);
+}
+
+{
+  const result = spawnBench(['--bench-reporter=json', basicPattern]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+
+  assert.deepStrictEqual(plans.map(({ name }) => name), ['alpha', 'beta']);
+  assert.deepStrictEqual(completions.map(({ data }) => data.name), [
+    'alpha',
+    'beta',
+  ]);
+  assert.notStrictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.deepStrictEqual(completions.map(({ data }) => data.params.file), [
+    'a',
+    'b',
+  ]);
+  assert.match(completions[0].data.samples[0].duration_ns, /^\d+$/);
+  assert(Number.isFinite(completions[0].data.summary.mean));
+
+  const summaries = records.filter(
+    ({ type }) => type === 'bench:summary');
+  assert.strictEqual(summaries.length, 1);
+  assert.strictEqual(summaries[0].data.file, null);
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    completed: 2,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(plans.length, 2);
+  for (const plan of plans) {
+    const planIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:plan' && data.fileRunId === plan.fileRunId);
+    const startIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:start' && data.fileRunId === plan.fileRunId);
+    assert(planIndex < startIndex);
+  }
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(completions[0].benchId, completions[1].benchId);
+  assert.strictEqual(completions[0].runId, completions[1].runId);
+  assert.strictEqual(completions[0].runId, summary.runId);
+  assert.notStrictEqual(
+    completions[0].fileRunId, completions[1].fileRunId);
+  assert.deepStrictEqual(completions.map(({ entryFile }) => entryFile), [
+    fixtures.path('bench-runner/identity-entry-a.cjs'),
+    fixtures.path('bench-runner/identity-entry-b.cjs'),
+  ]);
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['shared suite', 'shared identity'],
+    ['shared suite', 'shared identity'],
+  ]);
+  assert.strictEqual(summary.fileRunId, null);
+  assert.strictEqual(summary.entryFile, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-suite.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const parentId = JSON.stringify([
+    fixtures.path('bench-runner/identity-suite.cjs'),
+    ['cross-module suite'],
+  ]);
+
+  assert.deepStrictEqual(completions.map(({ name }) => name), [
+    'child a',
+    'child b',
+  ]);
+  assert(completions.every((completion) =>
+    completion.parentId === parentId));
+  assert.deepStrictEqual(completions.map(({ namePath }) => namePath), [
+    ['cross-module suite', 'child a'],
+    ['cross-module suite', 'child b'],
+  ]);
+  assert(completions.every(({ entryFile }) =>
+    entryFile === fixtures.path('bench-runner/identity-suite.cjs')));
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    '--require', fixtures.path('bench-runner/identity-preload.cjs'),
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/identity-entry-*.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const preloads = records.filter(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'preload identity').map(({ data }) => data);
+  assert.strictEqual(preloads.length, isolation === 'process' ? 2 : 1);
+  assert.strictEqual(
+    new Set(preloads.map(({ fileRunId }) => fileRunId)).size,
+    preloads.length,
+  );
+  assert(preloads.every(({ entryFile }) => entryFile === null));
+  assert(preloads.every(
+    ({ runId }) => runId === records.at(-1).data.runId));
+}
+
+{
+  const result = spawnBench([
+    '--bench-isolation=none',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/a.cjs'),
+    fixtures.path('bench-runner/identity-hook.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  const records = parseRecords(result);
+  const diagnostic = records.find(
+    ({ type, data }) => type === 'bench:diagnostic' &&
+      data.message === 'scoped hook failed').data;
+  const completion = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'scoped hook benchmark').data;
+  assert.strictEqual(diagnostic.entryFile,
+                     fixtures.path('bench-runner/identity-hook.cjs'));
+  assert.strictEqual(diagnostic.fileRunId, completion.fileRunId);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-isolation=none',
+    basicPattern,
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(completions.length, 2);
+  assert.strictEqual(
+    completions[0].data.params.pid,
+    completions[1].data.params.pid,
+  );
+  assert.strictEqual(records.at(-1).data.file, null);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--bench-name-pattern=selected',
+    '--bench-samples=2',
+    '--bench-warmup=3',
+    fixtures.path('bench-runner/options.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const plans = records.filter(
+    ({ type }) => type === 'bench:plan').map(({ data }) => data);
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  assert.deepStrictEqual(samples.map(({ data }) => data.operations), [4, 5]);
+  assert.deepStrictEqual(plans.map((plan) => ({
+    name: plan.name,
+    samples: plan.samples,
+    selected: plan.selected,
+    skip: plan.skip,
+    timeout: plan.timeout,
+    warmup: plan.warmup,
+    yieldBetweenSamples: plan.yieldBetweenSamples,
+  })), [
+    {
+      name: 'selected',
+      samples: 2,
+      selected: true,
+      skip: undefined,
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+    {
+      name: 'filtered out',
+      samples: 2,
+      selected: false,
+      skip: 'name pattern',
+      timeout: null,
+      warmup: 3,
+      yieldBetweenSamples: true,
+    },
+  ]);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const selected = completions.find(({ data }) => data.name === 'selected').data;
+  assert.deepStrictEqual(selected.params, {
+    boolean: true,
+    number: 42,
+    string: 'value',
+  });
+  assert.strictEqual(selected.samples.length, 2);
+  assert.strictEqual(
+    selected.summary.mean,
+    (selected.samples[0].rate + selected.samples[1].rate) / 2,
+  );
+  assert(Number.isFinite(selected.summary.medianConfidenceInterval.lower));
+
+  const filtered = completions.find(
+    ({ data }) => data.name === 'filtered out').data;
+  assert.strictEqual(filtered.skip, 'name pattern');
+}
+
+{
+  const result = spawnBench([
+    '--require',
+    fixtures.path('bench-runner/preload.cjs'),
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/preloaded.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { preloaded: true });
+}
+
+for (const isolation of ['process', 'none']) {
+  const result = spawnBench([
+    `--bench-isolation=${isolation}`,
+    '--bench-reporter=json',
+    '--import', fixtures.fileURL('bench-runner/import.mjs'),
+    fixtures.path('bench-runner/imported.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete');
+  assert.deepStrictEqual(completion.data.params, { imported: 'loaded' });
+}
+
+{
+  const lock = tmpdir.resolve('serial.lock');
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/serial-[ab].cjs'),
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_LOCK: lock },
+  });
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.deepStrictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data.name), [
+    'serial a',
+    'serial b',
+  ]);
+  assert.strictEqual(fs.existsSync(lock), false);
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/ipc.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'user IPC');
+  assert.strictEqual(records.at(-1).data.file,
+                     fixtures.path('bench-runner/ipc.cjs'));
+}
+
+{
+  const result = spawnBench([
+    '--bench-reporter=json',
+    '--random-seed=17',
+    '--stack-trace-limit=17',
+    fixtures.path('bench-runner/v8-option.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.name, 'V8 option');
+}
+
+if (common.hasInspector) {
+  const result = spawnBench([
+    '--inspect=0',
+    '--bench-reporter=json',
+    fixtures.path('bench-runner/inspector.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic')
+    .map(({ data }) => data.message).join('');
+  assert.match(diagnostics, /Debugger listening on ws:\/\//);
+  const completion = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(completion.params.inspectPort, '--inspect-port=0');
+}
+
+{
+  const result = spawnNode([
+    '--no-warnings',
+    `--experimental-config-file=${fixtures.path('bench-runner/node.config.json')}`,
+    fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0);
+  const records = parseRecords(result);
+  assert.strictEqual(records.find(
+    ({ type }) => type === 'bench:complete').data.samples.length, 1);
+}
diff --git a/test/parallel/test-bench-clock-precision.js b/test/parallel/test-bench-clock-precision.js
new file mode 100644
index 000000000000..93158e51319b
--- /dev/null
+++ b/test/parallel/test-bench-clock-precision.js
@@ -0,0 +1,22 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+
+const originalHrtimeBigint = process.hrtime.bigint;
+process.hrtime.bigint = () => 1n;
+const { bench, run } = require('node:bench');
+process.hrtime.bigint = originalHrtimeBigint;
+
+const completion = bench('zero duration', { samples: 1 }, (b) => {
+  b.start();
+  b.end(1);
+});
+
+(async () => {
+  await run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_INVALID_STATE');
+  assert.match(result.error.message, /insufficient clock precision/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-control.js b/test/parallel/test-bench-context-control.js
new file mode 100644
index 000000000000..6ee095f94eae
--- /dev/null
+++ b/test/parallel/test-bench-context-control.js
@@ -0,0 +1,106 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const invocations = [];
+  let closedContext;
+
+  const controlledCompletion = runner.bench('controlled', {
+    samples: 5,
+    warmup: 2,
+  }, common.mustCall((b) => {
+    invocations.push(`${b.phase}:${b.index}`);
+    const detail = { index: b.index, phase: b.phase };
+    const sample = completeSample(b, 2, { detail });
+    detail.index = -1;
+
+    assert.strictEqual(sample.operations, 2);
+    assert.strictEqual(typeof sample.duration_ns, 'bigint');
+    assert.strictEqual(sample.rate > 0, true);
+    assert.notStrictEqual(sample.detail, detail);
+    assert.notStrictEqual(sample.detail.index, -1);
+    sample.operations = 0;
+    sample.rate = NaN;
+    sample.detail.index = -2;
+
+    if (b.phase === 'measurement' && b.index === 1) {
+      b.done();
+      closedContext = b;
+    }
+  }, 4));
+
+  const recordedCompletion = runner.bench(
+    'recorded', { samples: 3 }, common.mustCall((b) => {
+      const detail = { source: 'worker', value: 1n };
+      const sample = b.record({
+        __proto__: null,
+        detail,
+        duration_ns: 20n,
+        operations: 5,
+      });
+      detail.source = 'changed';
+      assert.deepStrictEqual(sample, {
+        __proto__: null,
+        detail: { source: 'worker', value: 1n },
+        duration_ns: 20n,
+        operations: 5,
+        rate: 250_000_000,
+      });
+      sample.operations = 0;
+      sample.rate = NaN;
+      sample.detail.source = 'returned value changed';
+      b.done();
+    }));
+
+  const variableSamples = [
+    { __proto__: null, duration_ns: 1_000_000_000n, operations: 1 },
+    { __proto__: null, duration_ns: 100_000_000n, operations: 100 },
+  ];
+  const variableCompletion = runner.bench('variable batch', {
+    samples: variableSamples.length,
+  }, common.mustCall((b) => {
+    b.record(variableSamples[b.index]);
+  }, variableSamples.length));
+
+  const records = await runner.run().toArray();
+  const [controlled, recorded, variable] = await Promise.all([
+    controlledCompletion,
+    recordedCompletion,
+    variableCompletion,
+  ]);
+
+  assert.deepStrictEqual(invocations, [
+    'warmup:0',
+    'warmup:1',
+    'measurement:0',
+    'measurement:1',
+  ]);
+  assert.strictEqual(controlled.samples.length, 2);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ operations }) => operations), [2, 2]);
+  assert.deepStrictEqual(
+    controlled.samples.map(({ detail }) => detail.index), [0, 1]);
+  assert.strictEqual(controlled.samples.every(({ rate }) => rate > 0), true);
+  assert.strictEqual(recorded.samples.length, 1);
+  assert.deepStrictEqual(recorded.samples[0].detail,
+                         { source: 'worker', value: 1n });
+  assert.deepStrictEqual(variable.samples.map(({ rate }) => rate), [1, 1000]);
+  assert.strictEqual(variable.summary.mean, 500.5);
+  const pooledRate = 1_000_000_000 * 101 / 1_100_000_000;
+  assert.notStrictEqual(variable.summary.mean, pooledRate);
+  assert.strictEqual(
+    records.filter(({ type }) => type === 'bench:sample').length, 5);
+  assert.throws(() => closedContext.start(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.end(1), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.record({
+    duration_ns: 1n,
+    operations: 1,
+  }), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => closedContext.done(), { code: 'ERR_INVALID_STATE' });
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-context-errors.js b/test/parallel/test-bench-context-errors.js
new file mode 100644
index 000000000000..995330c5faef
--- /dev/null
+++ b/test/parallel/test-bench-context-errors.js
@@ -0,0 +1,125 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+
+const runner = createRunner({ yieldBetweenSamples: false });
+
+runner.bench('done during warmup', { samples: 1, warmup: 1 }, (b) => {
+  completeSample(b);
+  b.done();
+});
+runner.bench('invalid record', { samples: 1 }, (b) => b.record(null));
+runner.bench('invalid duration type', { samples: 1 }, (b) => b.record({
+  duration_ns: 1,
+  operations: 1,
+}));
+runner.bench('invalid duration value', { samples: 1 }, (b) => b.record({
+  duration_ns: 0n,
+  operations: 1,
+}));
+runner.bench('duration too large', { samples: 1 }, (b) => b.record({
+  duration_ns: 9_007_199_254_740_992n,
+  operations: 1,
+}));
+runner.bench('invalid operations', { samples: 1 }, (b) => b.record({
+  duration_ns: 1n,
+  operations: 0,
+}));
+runner.bench('mixed timing', { samples: 1 }, (b) => {
+  b.start();
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('start after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.start();
+});
+runner.bench('end after record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.end(1);
+});
+runner.bench('duplicate record', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1 });
+  b.record({ duration_ns: 1n, operations: 1 });
+});
+runner.bench('reentrant record', { samples: 1 }, (b) => {
+  const sample = { duration_ns: 1n };
+  Object.defineProperty(sample, 'operations', {
+    get() {
+      b.record({ duration_ns: 1n, operations: 1 });
+      return 1;
+    },
+  });
+  b.record(sample);
+});
+runner.bench('uncloneable detail', { samples: 1 }, (b) => {
+  b.record({ duration_ns: 1n, operations: 1, detail: () => {} });
+});
+runner.bench('uncloneable diagnostic message', { samples: 1 }, (b) => {
+  b.diagnostic(() => {});
+});
+runner.bench('invalid diagnostic level', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { level: 'error' });
+});
+runner.bench('uncloneable diagnostic detail', { samples: 1 }, (b) => {
+  b.diagnostic('invalid', { detail: () => {} });
+});
+runner.bench('caught contract violation', { samples: 1 },
+             common.mustCall((b) => {
+               b.start();
+               assert.throws(() => b.start(), { code: 'ERR_INVALID_STATE' });
+               b.end(1);
+             }));
+runner.bench('caught diagnostic violation', { samples: 1 },
+             common.mustCall((b) => {
+               assert.throws(() => b.diagnostic('invalid', {
+                 level: 'error',
+               }), { code: 'ERR_INVALID_ARG_VALUE' });
+               b.record({ duration_ns: 1n, operations: 1 });
+             }));
+
+(async () => {
+  const records = await runner.run().toArray();
+  const completions = records
+    .filter(({ type }) => type === 'bench:complete')
+    .map(({ data }) => data);
+  const byName = new Map(completions.map((result) => [result.name, result]));
+
+  assert.strictEqual(byName.get('done during warmup').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid record').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration type').error.code,
+                     'ERR_INVALID_ARG_TYPE');
+  assert.strictEqual(byName.get('invalid duration value').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('duration too large').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('invalid operations').error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('mixed timing').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('start after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('end after record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('reentrant record').error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('uncloneable detail').error.name,
+                     'DataCloneError');
+  assert.strictEqual(byName.get('uncloneable diagnostic message').error.name,
+                     'DataCloneError');
+  assert.strictEqual(byName.get('invalid diagnostic level').error.code,
+                     'ERR_INVALID_ARG_VALUE');
+  assert.strictEqual(byName.get('uncloneable diagnostic detail').error.name,
+                     'DataCloneError');
+  assert.match(byName.get('caught contract violation').error.message,
+               /violated the context method contract/);
+  assert.match(byName.get('caught diagnostic violation').error.message,
+               /violated the context method contract/);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-create-runner.js b/test/parallel/test-bench-create-runner.js
new file mode 100644
index 000000000000..51474af3d99c
--- /dev/null
+++ b/test/parallel/test-bench-create-runner.js
@@ -0,0 +1,100 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+(async () => {
+  const first = createRunner({ yieldBetweenSamples: false });
+  const second = createRunner({ yieldBetweenSamples: false });
+  let firstCalls = 0;
+  let secondCalls = 0;
+
+  first.before(common.mustCall());
+  second.before(common.mustCall());
+
+  const firstCompletion = first.bench(
+    'same name', { samples: 2 }, common.mustCall((b) => {
+      firstCalls++;
+      completeSample(b);
+    }, 2));
+  const secondCompletion = second.bench(
+    'same name', { samples: 1 }, common.mustCall((b) => {
+      secondCalls++;
+      completeSample(b);
+    }));
+
+  await setImmediate();
+  assert.strictEqual(firstCalls, 0);
+  assert.strictEqual(secondCalls, 0);
+
+  const firstStream = first.run();
+  const secondStream = second.run();
+  assert.throws(() => first.run(), { code: 'ERR_INVALID_STATE' });
+  assert.throws(() => first.bench('late', common.mustNotCall()),
+                { code: 'ERR_INVALID_STATE' });
+  const [firstRecords, secondRecords] = await Promise.all([
+    firstStream.toArray(),
+    secondStream.toArray(),
+  ]);
+  const [firstResult, secondResult] = await Promise.all([
+    firstCompletion,
+    secondCompletion,
+  ]);
+
+  assert.strictEqual(firstCalls, 2);
+  assert.strictEqual(secondCalls, 1);
+  assert.strictEqual(firstResult.samples.length, 2);
+  assert.strictEqual(secondResult.samples.length, 1);
+  assert.strictEqual(firstResult.error, undefined);
+  assert.strictEqual(secondResult.error, undefined);
+  assert.strictEqual(firstResult.benchId, secondResult.benchId);
+  assert.notStrictEqual(firstResult.runId, secondResult.runId);
+  assert.strictEqual(firstResult.fileRunId, firstResult.runId);
+  assert.strictEqual(secondResult.fileRunId, secondResult.runId);
+  assert.strictEqual(firstResult.entryFile, process.argv[1]);
+  assert.strictEqual(secondResult.entryFile, process.argv[1]);
+  assert.deepStrictEqual(firstResult.namePath, ['same name']);
+  assert.deepStrictEqual(secondResult.namePath, ['same name']);
+  assert(firstRecords.every(({ data }) => data.runId === firstResult.runId));
+  assert(secondRecords.every(({ data }) => data.runId === secondResult.runId));
+  assert.strictEqual(
+    firstRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(
+    secondRecords.filter(({ type }) => type === 'bench:summary').length, 1);
+  assert.strictEqual(typeof first.bench.skip, 'function');
+  assert.strictEqual(typeof first.bench.only, 'function');
+  assert.strictEqual(first.describe, first.suite);
+
+  const retry = createRunner({ yieldBetweenSamples: false });
+  retry.bench('not filtered', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+  assert.throws(() => retry.run({
+    namePattern: 'filtered',
+    samples: 0,
+  }), { code: 'ERR_OUT_OF_RANGE' });
+  const retryRecords = await retry.run().toArray();
+  const retryResult = retryRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(retryResult.skip, undefined);
+  assert.strictEqual(retryResult.samples.length, 1);
+
+  const reentrant = createRunner({ yieldBetweenSamples: false });
+  reentrant.bench('reentrant options', { samples: 1 }, (b) => {
+    completeSample(b);
+  });
+  const reentrantOptions = {};
+  Object.defineProperty(reentrantOptions, 'samples', {
+    get: common.mustCall(() => reentrant.run()),
+  });
+  assert.throws(() => reentrant.run(reentrantOptions),
+                { code: 'ERR_INVALID_STATE' });
+  const reentrantRecords = await reentrant.run().toArray();
+  const reentrantResult = reentrantRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(reentrantResult.samples.length, 1);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-custom-reporter.js b/test/parallel/test-bench-custom-reporter.js
new file mode 100644
index 000000000000..1d4ec8bed191
--- /dev/null
+++ b/test/parallel/test-bench-custom-reporter.js
@@ -0,0 +1,36 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { Writable } = require('stream');
+const { finished } = require('stream/promises');
+const { bench, run } = require('node:bench');
+
+bench('completed', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+
+async function* customReporter(source) {
+  for await (const { type, data } of source) {
+    if (type !== 'bench:complete') continue;
+    yield `${data.name}:${data.skip === undefined ? 'completed' : 'skipped'}\n`;
+  }
+}
+
+let output = '';
+const destination = new Writable({
+  write(chunk, _encoding, callback) {
+    output += chunk;
+    callback();
+  },
+});
+
+run().compose(customReporter).pipe(destination);
+
+(async () => {
+  await finished(destination);
+  assert.strictEqual(output, 'completed:completed\nskipped:skipped\n');
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostic-channels.js b/test/parallel/test-bench-diagnostic-channels.js
new file mode 100644
index 000000000000..9e1bb2a07024
--- /dev/null
+++ b/test/parallel/test-bench-diagnostic-channels.js
@@ -0,0 +1,119 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const dc = require('diagnostics_channel');
+const { createRunner } = require('node:bench');
+
+const prefix = `node:bench:test:${process.pid}`;
+const inheritedName = `${prefix}:inherited`;
+const nestedName = `${prefix}:nested`;
+const benchmarkName = `${prefix}:benchmark`;
+const unlistedName = `${prefix}:unlisted`;
+const symbolName = Symbol(`${prefix}:symbol`);
+const inheritedChannel = dc.channel(inheritedName);
+const nestedChannel = dc.channel(nestedName);
+const benchmarkChannel = dc.channel(benchmarkName);
+const unlistedChannel = dc.channel(unlistedName);
+const symbolChannel = dc.channel(symbolName);
+
+function recordSample(context) {
+  context.record({ duration_ns: 1n, operations: 1 });
+}
+
+async function testCapture() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.suite('outer', {
+    diagnosticChannels: [inheritedName, symbolName, inheritedName],
+  }, common.mustCall(() => {
+    runner.suite('inner', {
+      diagnosticChannels: [nestedName],
+    }, common.mustCall(() => {
+      runner.bench('captured', {
+        diagnosticChannels: [benchmarkName, nestedName],
+        samples: 1,
+      }, common.mustCall((context) => {
+        const message = { value: 1 };
+        inheritedChannel.publish(message);
+        message.value = 0;
+        nestedChannel.publish({ value: 2 });
+        benchmarkChannel.publish({ value: 3 });
+        unlistedChannel.publish({ value: 4 });
+        symbolChannel.publish({ value: 5 });
+        recordSample(context);
+      }));
+    }));
+  }));
+  runner.bench('not captured', { samples: 1 }, common.mustCall((context) => {
+    inheritedChannel.publish({ value: 6 });
+    recordSample(context);
+  }));
+
+  const records = await runner.run().toArray();
+  const plan = records.find(
+    ({ type, data }) => type === 'bench:plan' && data.name === 'captured').data;
+  assert.deepStrictEqual(plan.diagnosticChannels, [
+    inheritedName,
+    nestedName,
+    benchmarkName,
+  ]);
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic').map(({ data }) => data);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { name: inheritedName, message: { value: 1 } },
+    { name: nestedName, message: { value: 2 } },
+    { name: benchmarkName, message: { value: 3 } },
+  ]);
+  assert(diagnostics.every(({ level }) => level === 'info'));
+  assert.strictEqual(inheritedChannel.hasSubscribers, false);
+  assert.strictEqual(nestedChannel.hasSubscribers, false);
+  assert.strictEqual(benchmarkChannel.hasSubscribers, false);
+  assert.strictEqual(symbolChannel.hasSubscribers, false);
+}
+
+async function testUncloneableMessage() {
+  const name = `${prefix}:uncloneable`;
+  const channel = dc.channel(name);
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('uncloneable', {
+    diagnosticChannels: [name],
+    samples: 1,
+  }, common.mustCall((context) => {
+    channel.publish(() => {});
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.name, 'DataCloneError');
+  assert.strictEqual(channel.hasSubscribers, false);
+}
+
+async function testAbortCleanup() {
+  const name = `${prefix}:abort`;
+  const channel = dc.channel(name);
+  const controller = new AbortController();
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('abort', {
+    diagnosticChannels: [name],
+    samples: 1,
+    signal: controller.signal,
+  }, common.mustCall((context) => {
+    controller.abort(new Error('stop'));
+    assert.strictEqual(channel.hasSubscribers, false);
+    channel.publish({ ignored: true });
+    recordSample(context);
+  }));
+  const records = await runner.run().toArray();
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:diagnostic'),
+    false,
+  );
+}
+
+(async () => {
+  await testCapture();
+  await testUncloneableMessage();
+  await testAbortCleanup();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-diagnostics.js b/test/parallel/test-bench-diagnostics.js
new file mode 100644
index 000000000000..9e33fd56323f
--- /dev/null
+++ b/test/parallel/test-bench-diagnostics.js
@@ -0,0 +1,177 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    duration_ns: 1n,
+    operations: 1,
+  });
+}
+
+async function testListenerFailure(callbackError) {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const listenerError = new Error('diagnostic listener failed');
+  const completion = runner.bench('listener failure', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('listener failure');
+    if (callbackError !== undefined) throw callbackError;
+    recordSample(b);
+  }));
+  const stream = runner.run();
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw listenerError;
+  }));
+  await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error, callbackError ?? listenerError);
+  assert.strictEqual(result.samples.length, callbackError === undefined ? 1 : 0);
+}
+
+async function testAbortDuringDiagnosticDelivery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const abortReason = new Error('stop diagnostic delivery');
+  const controller = new AbortController();
+  const completion = runner.bench('abort diagnostics', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    for (let i = 0; i < 32; i++) b.diagnostic(`diagnostic ${i}`);
+    recordSample(b);
+  }));
+  const stream = runner.run({ signal: controller.signal });
+  const iterator = stream[Symbol.asyncIterator]();
+  const records = [];
+  records.push((await iterator.next()).value);
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+  controller.abort(abortReason);
+  while (true) {
+    const { done, value } = await iterator.next();
+    if (done) break;
+    records.push(value);
+  }
+
+  const result = await completion;
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const completeIndex = records.findIndex(
+    ({ type }) => type === 'bench:complete');
+  assert.strictEqual(diagnostics.length, 32);
+  assert(records.indexOf(diagnostics.at(-1)) < completeIndex);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, abortReason);
+  assert.strictEqual(result.samples.length, 1);
+}
+
+async function testAfterEachFailurePrecedence() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const callbackError = new Error('callback failed');
+  const afterEachError = new Error('afterEach failed');
+  runner.afterEach(common.mustCall(() => {
+    throw afterEachError;
+  }));
+  const completion = runner.bench('afterEach precedence', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failures');
+    throw callbackError;
+  }));
+  await runner.run().toArray();
+  assert.strictEqual((await completion).error, afterEachError);
+}
+
+(async () => {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let finalContext;
+  const completed = runner.bench('diagnostics', {
+    samples: 2,
+    warmup: 1,
+  }, common.mustCall((b) => {
+    finalContext = b;
+    const detail = { index: b.index };
+    const message = { index: b.index, phase: b.phase };
+    const level = b.phase === 'warmup' ? 'info' : 'warning';
+    assert.strictEqual(b.diagnostic(message, {
+      detail,
+      level,
+    }), undefined);
+    detail.index = -1;
+    message.index = -1;
+    recordSample(b);
+  }, 3));
+  const expectedError = new Error('benchmark failed');
+  const failed = runner.bench('failed diagnostic', {
+    samples: 1,
+  }, common.mustCall((b) => {
+    b.diagnostic('before failure', {
+      detail: { retained: true },
+      level: 'warning',
+    });
+    throw expectedError;
+  }));
+
+  const namedDiagnostics = [];
+  const stream = runner.run();
+  stream.on('bench:diagnostic', (diagnostic) => {
+    namedDiagnostics.push(diagnostic);
+  });
+  const records = await stream.toArray();
+  const completedResult = await completed;
+  const failedResult = await failed;
+  const diagnosticRecords = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  const diagnostics = diagnosticRecords.map(({ data }) => data);
+
+  assert.strictEqual(completedResult.error, undefined);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(diagnostics.length, 4);
+  assert.strictEqual(namedDiagnostics.length, diagnostics.length);
+  assert.deepStrictEqual(diagnostics.map(({ message }) => message), [
+    { index: 0, phase: 'warmup' },
+    { index: 0, phase: 'measurement' },
+    { index: 1, phase: 'measurement' },
+    'before failure',
+  ]);
+  assert.deepStrictEqual(diagnostics.map(({ phase, index, level }) => ({
+    phase,
+    index,
+    level,
+  })), [
+    { phase: 'warmup', index: 0, level: 'info' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+    { phase: 'measurement', index: 1, level: 'warning' },
+    { phase: 'measurement', index: 0, level: 'warning' },
+  ]);
+  assert.deepStrictEqual(
+    diagnostics.map(({ detail }) => detail),
+    [{ index: 0 }, { index: 0 }, { index: 1 }, { retained: true }]);
+  assert(diagnostics.slice(0, 3).every(
+    ({ benchId }) => benchId === completedResult.benchId));
+  assert.strictEqual(diagnostics[3].benchId, failedResult.benchId);
+  assert.notStrictEqual(namedDiagnostics[0], diagnostics[0]);
+
+  for (let i = 0; i < 2; i++) {
+    const diagnosticIndex = records.indexOf(diagnosticRecords[i + 1]);
+    const sampleIndex = records.findIndex(({ type, data }) =>
+      type === 'bench:sample' && data.benchId === completedResult.benchId &&
+      data.index === i);
+    assert(diagnosticIndex < sampleIndex);
+  }
+  assert.throws(() => finalContext.diagnostic('too late'), {
+    code: 'ERR_INVALID_STATE',
+  });
+  await testListenerFailure(undefined);
+  await testListenerFailure(new Error('callback failed'));
+  await testAbortDuringDiagnosticDelivery();
+  await testAfterEachFailurePrecedence();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-errors.js b/test/parallel/test-bench-errors.js
new file mode 100644
index 000000000000..e540d5d847c5
--- /dev/null
+++ b/test/parallel/test-bench-errors.js
@@ -0,0 +1,121 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+const { setTimeout } = require('timers/promises');
+
+const options = { samples: 1 };
+
+bench('missing start', options, () => {});
+bench('missing end', options, (b) => b.start());
+bench('end before start', options, (b) => b.end(1));
+bench('duplicate start', options, (b) => {
+  b.start();
+  b.start();
+});
+bench('duplicate end', options, (b) => {
+  b.start();
+  b.end(1);
+  b.end(1);
+});
+bench('invalid operations', options, (b) => {
+  b.start();
+  b.end(0);
+});
+bench('throws', options, () => {
+  throw new Error('benchmark failure');
+});
+let lateTimeoutActive = false;
+bench('late timeout', { samples: 1, timeout: 5 }, async (b) => {
+  lateTimeoutActive = true;
+  try {
+    b.start();
+    await setTimeout(30);
+    b.end(1);
+  } finally {
+    lateTimeoutActive = false;
+  }
+});
+bench('after late timeout', options, common.mustCall((b) => {
+  assert.strictEqual(lateTimeoutActive, false);
+  completeSample(b);
+}));
+
+const signal = AbortSignal.abort(new Error('stop'));
+bench('aborted', { samples: 1, signal }, () => {});
+
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('duplicate', { samples: 1, params: { value: 1 } }, completeSample);
+bench('continues', options, completeSample);
+bench('timeout', { samples: 1, timeout: 10 }, async () => {
+  await new Promise(() => {});
+});
+const suiteCompletion = suite('after unsettled timeout suite', () => {
+  bench('after unsettled timeout', options, common.mustNotCall());
+  bench.skip('skipped after unsettled timeout', options, common.mustNotCall());
+});
+suiteCompletion.then(common.mustCall());
+
+const completions = [];
+const sampleNames = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:sample', (sample) => sampleNames.push(sample.name));
+stream.on('bench:summary', (result) => { summary = result; });
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(completions.length, 16);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 3,
+    failed: 12,
+    skipped: 1,
+    total: 16,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map();
+  for (const result of completions) {
+    const values = byName.get(result.name) ?? [];
+    values.push(result);
+    byName.set(result.name, values);
+  }
+
+  assert.match(byName.get('missing start')[0].error.message,
+               /did not call start/);
+  assert.match(byName.get('missing end')[0].error.message,
+               /did not call end/);
+  assert.match(byName.get('end before start')[0].error.message,
+               /before start/);
+  assert.strictEqual(byName.get('duplicate start')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('duplicate end')[0].error.code,
+                     'ERR_INVALID_STATE');
+  assert.strictEqual(byName.get('invalid operations')[0].error.code,
+                     'ERR_OUT_OF_RANGE');
+  assert.strictEqual(byName.get('throws')[0].error.message,
+                     'benchmark failure');
+  assert.strictEqual(byName.get('timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('late timeout')[0].error.code,
+                     'ERR_OPERATION_FAILED');
+  assert.strictEqual(byName.get('after late timeout')[0].error, undefined);
+  assert.strictEqual(byName.get('aborted')[0].error.code, 'ABORT_ERR');
+
+  const duplicates = byName.get('duplicate');
+  assert.strictEqual(duplicates[0].error, undefined);
+  assert.match(duplicates[1].error.message, /duplicate benchmark identity/);
+  assert.strictEqual(byName.get('continues')[0].error, undefined);
+  const unsettled = byName.get('after unsettled timeout')[0].error;
+  assert.strictEqual(unsettled.code, 'ABORT_ERR');
+  assert.strictEqual(unsettled.cause.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(
+    byName.get('skipped after unsettled timeout')[0].skip, true);
+  setTimeout(40).then(common.mustCall(() => {
+    assert.strictEqual(sampleNames.includes('late timeout'), false);
+  }));
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-filtering.js b/test/parallel/test-bench-filtering.js
new file mode 100644
index 000000000000..da580dcdafc0
--- /dev/null
+++ b/test/parallel/test-bench-filtering.js
@@ -0,0 +1,61 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run, suite } = require('node:bench');
+
+const calls = [];
+
+function complete(name) {
+  return (b) => {
+    calls.push(name);
+    completeSample(b);
+  };
+}
+
+suite('selected', { only: true }, () => {
+  bench('included', { samples: 1 }, complete('included'));
+  bench.skip('explicitly skipped', { samples: 1 },
+             common.mustNotCall());
+  bench('pattern filtered', { samples: 1 },
+        common.mustNotCall());
+});
+bench('only filtered', { samples: 1 }, common.mustNotCall());
+
+const results = [];
+const plans = [];
+const namePattern = /^selected (included|explicitly skipped)$/;
+let patternMutated = false;
+const stream = run({ namePattern });
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan);
+  if (!patternMutated) {
+    patternMutated = true;
+    namePattern.compile('only filtered');
+  }
+}, 4));
+stream.on('bench:complete', (result) => results.push(result));
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(calls, ['included']);
+  assert.strictEqual(results.length, 4);
+
+  const byName = new Map(results.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('included').error, undefined);
+  assert.strictEqual(byName.get('explicitly skipped').skip, true);
+  assert.strictEqual(byName.get('pattern filtered').skip, 'name pattern');
+  assert.strictEqual(byName.get('only filtered').skip, 'only');
+  assert.deepStrictEqual(plans.map(({ name, selected, skip }) => ({
+    name,
+    selected,
+    skip,
+  })), [
+    { name: 'included', selected: true, skip: undefined },
+    { name: 'explicitly skipped', selected: false, skip: true },
+    { name: 'pattern filtered', selected: false, skip: 'name pattern' },
+    { name: 'only filtered', selected: false, skip: 'only' },
+  ]);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-harness-errors.js b/test/parallel/test-bench-harness-errors.js
new file mode 100644
index 000000000000..4fd6ec739488
--- /dev/null
+++ b/test/parallel/test-bench-harness-errors.js
@@ -0,0 +1,141 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+async function testSynchronousSuiteFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completion = runner.suite('outer', () => {
+    runner.suite('nested', () => {
+      runner.bench('blocked', { samples: 1 }, common.mustNotCall());
+    });
+    throw new Error('synchronous suite failure');
+  });
+  const records = await runner.run().toArray();
+  await completion;
+  const plan = records.find(
+    ({ type }) => type === 'bench:plan').data;
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(plan.name, 'blocked');
+  assert.strictEqual(plan.selected, true);
+  assert.strictEqual(
+    records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(result.name, 'blocked');
+  assert.strictEqual(result.error.message, 'synchronous suite failure');
+}
+
+async function testRunSignal() {
+  const runner = createRunner();
+  const controller = new AbortController();
+  let invocations = 0;
+  let abortPromise;
+  const completion = runner.bench('aborted between samples', {
+    samples: 3,
+  }, (b) => {
+    invocations++;
+    completeSample(b);
+    if (b.index === 0) {
+      abortPromise = setImmediate().then(() => {
+        controller.abort(new Error('run aborted'));
+      });
+    }
+  });
+  await runner.run({ signal: controller.signal }).toArray();
+  const result = await completion;
+  await abortPromise;
+  await setImmediate();
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause.message, 'run aborted');
+  assert.strictEqual(invocations, 1);
+}
+
+async function testRunSignalAfterSample() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const controller = new AbortController();
+  const reason = new Error('sample aborted');
+  const completion = runner.bench('aborted after sample', {
+    samples: 2,
+  }, completeSample);
+  const stream = runner.run({ signal: controller.signal });
+  stream.once('bench:sample', common.mustCall(() => {
+    controller.abort(reason);
+  }));
+  const records = await stream.toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ABORT_ERR');
+  assert.strictEqual(result.error.cause, reason);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStringNamePattern() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.bench('included', { samples: 1 }, completeSample);
+  runner.bench('excluded', { samples: 1 }, common.mustNotCall());
+  const records = await runner.run({ namePattern: 'included' }).toArray();
+  const excluded = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'excluded').data;
+  const included = records.find(
+    ({ type, data }) => type === 'bench:complete' &&
+      data.name === 'included').data;
+  assert.strictEqual(included.error, undefined);
+  assert.strictEqual(included.samples.length, 1);
+  assert.strictEqual(excluded.skip, 'name pattern');
+}
+
+async function testTopLevelRecovery() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const suiteCompletion = runner.suite('nested', () => {
+    runner.bench('listener failure', { samples: 1 }, completeSample);
+  });
+  const stream = runner.run();
+  const failure = new Error();
+  failure.message = undefined;
+  stream.on('bench:start', common.mustCall(() => { throw failure; }));
+  const records = await stream.toArray();
+  await suiteCompletion;
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  const summary = records.find(({ type }) => type === 'bench:summary').data;
+  assert.strictEqual(diagnostic.message, 'Error');
+  assert.strictEqual(diagnostic.file, undefined);
+  assert.strictEqual(diagnostic.line, undefined);
+  assert.strictEqual(diagnostic.column, undefined);
+  assert.strictEqual(summary.duration_ns, 0n);
+  assert.strictEqual(summary.success, false);
+}
+
+async function testRepeatedReportingFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const original = new Error('start listener failed');
+  const diagnostic = new Error('diagnostic listener failed');
+  const summary = new Error('summary listener failed');
+  const completion = runner.bench('reporting failures', {
+    samples: 1,
+  }, completeSample);
+  const stream = runner.run();
+  stream.on('bench:start', common.mustCall(() => { throw original; }));
+  stream.on('bench:diagnostic', common.mustCall(() => {
+    throw diagnostic;
+  }, 2));
+  stream.on('bench:summary', common.mustCall(() => { throw summary; }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+  await ended;
+  assert.strictEqual((await completion).error, original);
+}
+
+(async () => {
+  await testSynchronousSuiteFailure();
+  await testRunSignal();
+  await testRunSignalAfterSample();
+  await testStringNamePattern();
+  await testTopLevelRecovery();
+  await testRepeatedReportingFailure();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-hook-errors.js b/test/parallel/test-bench-hook-errors.js
new file mode 100644
index 000000000000..f2977f241deb
--- /dev/null
+++ b/test/parallel/test-bench-hook-errors.js
@@ -0,0 +1,80 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { setImmediate } = require('timers/promises');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+suite('before failure', () => {
+  before(() => { throw new Error('before failure'); });
+  after(common.mustCall());
+  bench('blocked by before', { samples: 1 }, common.mustNotCall());
+});
+
+suite('beforeEach failure', () => {
+  beforeEach(() => { throw new Error('beforeEach failure'); });
+  afterEach(common.mustCall());
+  bench('blocked by beforeEach', { samples: 1 }, common.mustNotCall());
+});
+
+suite('after failure', () => {
+  after(() => { throw new Error('after failure'); });
+  bench('completes before after', { samples: 1 }, completeSample);
+});
+
+suite('build failure', async () => {
+  await setImmediate();
+  throw new Error('build failure');
+});
+
+bench('continues after suite failures', { samples: 1 }, completeSample);
+
+const completions = [];
+const diagnostics = [];
+let summary;
+const stream = run();
+stream.on('bench:complete', (result) => completions.push(result));
+stream.on('bench:diagnostic', (diagnostic) => {
+  diagnostics.push(diagnostic);
+});
+stream.on('bench:summary', (value) => { summary = value; });
+stream.on('end', common.mustCall(() => {
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 2,
+    skipped: 0,
+    total: 4,
+  });
+  assert.strictEqual(summary.success, false);
+
+  const byName = new Map(completions.map((result) => [result.name, result]));
+  assert.strictEqual(byName.get('blocked by before').error.message,
+                     'before failure');
+  assert.strictEqual(byName.get('blocked by beforeEach').error.message,
+                     'beforeEach failure');
+  assert.strictEqual(byName.get('completes before after').error, undefined);
+  assert.strictEqual(
+    byName.get('continues after suite failures').error, undefined);
+
+  assert.deepStrictEqual(
+    diagnostics.map(({ message }) => message).sort(),
+    ['after failure', 'before failure', 'build failure'],
+  );
+  for (const diagnostic of diagnostics) {
+    assert.strictEqual(typeof diagnostic.file, 'string');
+    assert.strictEqual(typeof diagnostic.line, 'number');
+    assert.strictEqual(typeof diagnostic.column, 'number');
+  }
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-module.mjs b/test/parallel/test-bench-module.mjs
new file mode 100644
index 000000000000..3efe9a1f6151
--- /dev/null
+++ b/test/parallel/test-bench-module.mjs
@@ -0,0 +1,54 @@
+// Flags: --no-warnings
+
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { createRequire, builtinModules, isBuiltin } from 'node:module';
+import benchDefault, {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  describe,
+  run,
+  suite,
+} from 'node:bench';
+import { json, spec } from 'node:bench/reporters';
+
+assert.strictEqual(benchDefault, bench);
+assert.strictEqual(describe, suite);
+for (const value of [
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+]) {
+  assert.strictEqual(typeof value, 'function');
+}
+assert.strictEqual(typeof bench.skip, 'function');
+assert.strictEqual(typeof bench.only, 'function');
+assert.strictEqual(typeof json, 'function');
+assert.strictEqual(typeof spec, 'function');
+
+assert.strictEqual(isBuiltin('node:bench'), true);
+assert.strictEqual(isBuiltin('node:bench/reporters'), true);
+assert.strictEqual(isBuiltin('bench'), false);
+assert.strictEqual(isBuiltin('bench/reporters'), false);
+assert.strictEqual(builtinModules.includes('node:bench'), true);
+assert.strictEqual(builtinModules.includes('node:bench/reporters'), true);
+assert.strictEqual(process.getBuiltinModule('node:bench'), benchDefault);
+assert.strictEqual(process.getBuiltinModule('bench'), undefined);
+
+const require = createRequire(import.meta.url);
+const reporters = require('node:bench/reporters');
+assert.strictEqual(reporters.json, json);
+assert.strictEqual(reporters.spec, spec);
+assert.throws(() => require('bench'), { code: 'MODULE_NOT_FOUND' });
+assert.throws(() => require('bench/reporters'), { code: 'MODULE_NOT_FOUND' });
+await assert.rejects(import('bench'), { code: 'ERR_MODULE_NOT_FOUND' });
+await assert.rejects(import('bench/reporters'), {
+  code: 'ERR_MODULE_NOT_FOUND',
+});
diff --git a/test/parallel/test-bench-reporters.js b/test/parallel/test-bench-reporters.js
new file mode 100644
index 000000000000..f383e2cf5213
--- /dev/null
+++ b/test/parallel/test-bench-reporters.js
@@ -0,0 +1,177 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { Readable } = require('stream');
+const { bench, run } = require('node:bench');
+const { json, spec } = require('node:bench/reporters');
+
+bench('json completed', {
+  params: { size: 'small' },
+  samples: 1,
+}, (b) => {
+  completeSample(b);
+});
+
+bench('json failed', { samples: 1 }, () => {
+  const error = new Error('benchmark failed', { cause: 7n });
+  error.code = 'ERR_BENCHMARK_EXAMPLE';
+  throw error;
+});
+
+(async () => {
+  const chunks = await run().compose(json).toArray();
+  const lines = chunks.join('').trim().split('\n');
+  const records = lines.map((line) => JSON.parse(line));
+
+  assert.strictEqual(records.length, 8);
+  const plans = records.filter(({ type }) => type === 'bench:plan');
+  assert.deepStrictEqual(plans.map(({ data }) => data.selected), [true, true]);
+  const sample = records.find(({ type }) => type === 'bench:sample');
+  assert.match(sample.data.duration_ns, /^\d+$/);
+
+  const completions = records.filter(
+    ({ type }) => type === 'bench:complete');
+  const completed = completions.find(
+    ({ data }) => data.name === 'json completed').data;
+  assert.match(completed.samples[0].duration_ns, /^\d+$/);
+
+  const failed = completions.find(
+    ({ data }) => data.name === 'json failed').data;
+  assert.strictEqual(failed.error.name, 'Error');
+  assert.strictEqual(failed.error.message, 'benchmark failed');
+  assert.strictEqual(failed.error.code, 'ERR_BENCHMARK_EXAMPLE');
+  assert.strictEqual(failed.error.cause, '7');
+  assert.match(failed.error.stack, /benchmark failed/);
+
+  const summary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+  assert.match(summary.duration_ns, /^\d+$/);
+  assert.deepStrictEqual(summary.counts, {
+    completed: 1,
+    failed: 1,
+    skipped: 0,
+    total: 2,
+  });
+
+  const synthetic = [
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'fast',
+        params: { size: 'small' },
+        samples: [{}, {}],
+        summary: {
+          mean: 1500,
+          median: 1400,
+          coefficientOfVariation: 0.1,
+          confidenceInterval: { lower: 1000, upper: 2000 },
+          skewness: 2,
+        },
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'later',
+        params: {},
+        samples: [],
+        skip: 'not supported',
+      },
+    },
+    {
+      type: 'bench:complete',
+      data: {
+        name: 'broken',
+        params: {},
+        samples: [],
+        error: new Error('boom'),
+      },
+    },
+    {
+      type: 'bench:diagnostic',
+      data: { message: 'suite problem' },
+    },
+    {
+      type: 'bench:summary',
+      data: {
+        counts: { completed: 1, failed: 1, skipped: 1, total: 3 },
+      },
+    },
+  ];
+  const specChunks = await Readable.from(synthetic).compose(spec).toArray();
+  assert.strictEqual(specChunks.join(''),
+                     'benchmark | samples | mean rate | 95% CI | ' +
+                     'median rate | warning\n' +
+                     'fast [size="small"] | 2 | 1.50k ops/s | ' +
+                     '[1.00k ops/s, 2.00k ops/s] | 1.40k ops/s | ' +
+                     'noisy, skewed\n' +
+                     'later | 0 | - | - | - | skipped: not supported\n' +
+                     'broken | 0 | - | - | - | error: boom\n' +
+                     'diagnostic: suite problem\n\n' +
+                     '1 completed, 1 failed, 1 skipped\n');
+
+  const circular = {};
+  circular.self = circular;
+  const aggregate = new AggregateError([1n], 'aggregate failure');
+  const jsonEdgeChunks = await Readable.from([{
+    type: 'bench:diagnostic',
+    data: { aggregate, circular },
+  }]).compose(json).toArray();
+  const jsonEdge = JSON.parse(jsonEdgeChunks.join(''));
+  assert.deepStrictEqual(jsonEdge.data.aggregate.errors, ['1']);
+  assert.strictEqual(jsonEdge.data.circular.self, '[Circular]');
+
+  async function* undefinedRecord() {
+    yield undefined;
+  }
+  const undefinedChunks = [];
+  for await (const chunk of json(undefinedRecord())) {
+    undefinedChunks.push(chunk);
+  }
+  assert.strictEqual(undefinedChunks.join(''), 'null\n');
+
+  function result(name, rate) {
+    return {
+      type: 'bench:complete',
+      data: {
+        name,
+        params: {},
+        samples: [{}],
+        summary: {
+          mean: rate,
+          median: rate,
+          coefficientOfVariation: 0,
+          confidenceInterval: { lower: rate, upper: rate },
+          skewness: 0,
+        },
+      },
+    };
+  }
+
+  const specEdgeChunks = await Readable.from([
+    result('giga', 1_500_000_000),
+    result('mega', 1_500_000),
+    result('fractional', 0.5),
+    {
+      type: 'bench:complete',
+      data: { name: 'skip', params: {}, samples: [], skip: true },
+    },
+    {
+      type: 'bench:complete',
+      data: { name: 'error', params: {}, samples: [], error: 'failure' },
+    },
+  ]).compose(spec).toArray();
+  const specEdgeOutput = specEdgeChunks.join('');
+  assert.match(specEdgeOutput, /giga \| 1 \| 1\.50G ops\/s/);
+  assert.match(specEdgeOutput, /mega \| 1 \| 1\.50M ops\/s/);
+  assert.match(specEdgeOutput, /fractional \| 1 \| 0\.500 ops\/s/);
+  assert.match(specEdgeOutput, /skip \| 0 \| - \| - \| - \| skipped\n/);
+  assert.match(specEdgeOutput,
+               /error \| 0 \| - \| - \| - \| error: failure/);
+
+  const emptySpecChunks = await Readable.from([]).compose(spec).toArray();
+  assert.deepStrictEqual(emptySpecChunks, []);
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-file.js b/test/parallel/test-bench-run-file.js
new file mode 100644
index 000000000000..ec0265ab162c
--- /dev/null
+++ b/test/parallel/test-bench-run-file.js
@@ -0,0 +1,430 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const fixtures = require('../common/fixtures');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { once } = require('events');
+const path = require('path');
+const { runFile } = require('node:bench');
+
+const fixture = fixtures.path('bench-runner/run-file.cjs');
+const relativeFixture = path.relative(process.cwd(), fixture);
+
+assert.throws(() => runFile(null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => runFile(fixture, { execArgv: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [1] }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--bench'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [fixture] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e', '0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['-e0'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require', ''] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--require='] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: [`-r=${fixture}`] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof-process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { execArgv: ['--prof_process'] }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, {
+  execArgv: ['--bench_name_pattern=run'],
+}), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => runFile(`${fixture}\0`), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(Buffer.from(`${fixture}\0`)), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: null }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { env: { INVALID: 'x\0' } }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+});
+assert.throws(() => runFile(fixture, { env: { NODE_CHANNEL_FD: 1 } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: {} }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+assert.throws(() => runFile(fixture, { signal: { aborted: false } }), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
+
+async function testRunFile() {
+  const execArgv = ['--expose-gc', '--no-warnings', '-r', 'fs'];
+  const env = {
+    __proto__: null,
+    ...process.env,
+    NODE_BENCH_CONTEXT: 'not-a-child',
+    NODE_BENCH_OMITTED: undefined,
+    NODE_BENCH_RUN_FILE: 'original',
+    NODE_CHANNEL_FD: '999',
+    NODE_CHANNEL_SERIALIZATION_MODE: 'json',
+  };
+  const stream = runFile(relativeFixture, { env, execArgv });
+  execArgv.length = 0;
+  env.NODE_BENCH_RUN_FILE = 'mutated';
+  const records = await stream.toArray();
+  const plan = records.find(({ type }) => type === 'bench:plan').data;
+  const result = records.find(({ type }) => type === 'bench:complete').data;
+  const summary = records.at(-1).data;
+
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(plan.params.context, 'child');
+  assert.strictEqual(plan.params.exposed, true);
+  assert.strictEqual(plan.params.omitted, true);
+  assert.strictEqual(plan.params.value, 'original');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 1);
+  assert.strictEqual(typeof result.samples[0].duration_ns, 'bigint');
+  assert.notStrictEqual(result.samples[0].detail.pid, process.pid);
+  assert(result.samples[0].detail.execArgv.includes('--expose-gc'));
+  assert(result.samples[0].detail.execArgv.includes('--no-warnings'));
+  assert(result.samples[0].detail.execArgv.includes('-r'));
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(summary.file, fixture);
+  assert.strictEqual(summary.entryFile, fixture);
+  assert.strictEqual(summary.fileRunId, result.fileRunId);
+  assert.strictEqual(summary.runId, result.runId);
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:summary').length, 1);
+}
+
+async function testConcurrentCalls() {
+  const [cjsRecords, esmRecords] = await Promise.all([
+    runFile(fixtures.fileURL('bench-runner/a.cjs')).toArray(),
+    runFile(Buffer.from(path.relative(
+      process.cwd(),
+      fixtures.path('bench-runner/b.mjs'),
+    ))).toArray(),
+  ]);
+  const cjsResult = cjsRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  const esmResult = esmRecords.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(cjsResult.name, 'alpha');
+  assert.strictEqual(esmResult.name, 'beta');
+  assert.notStrictEqual(cjsResult.params.pid, esmResult.params.pid);
+  assert.notStrictEqual(cjsResult.runId, esmResult.runId);
+  assert.strictEqual(
+    cjsRecords.at(-1).data.file,
+    fixtures.path('bench-runner/a.cjs'),
+  );
+  assert.strictEqual(
+    esmRecords.at(-1).data.file,
+    fixtures.path('bench-runner/b.mjs'),
+  );
+}
+
+async function testLoadFailure() {
+  const missing = path.resolve(fixtures.fixturesDir, 'does-not-exist.cjs');
+  const records = await runFile(missing).toArray();
+  const diagnostics = records.filter(
+    ({ type }) => type === 'bench:diagnostic');
+  assert(diagnostics.some(
+    ({ data }) => data.level === 'error' && /failed with exit code/.test(
+      data.message)));
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testEvaluationFailure() {
+  const records = await runFile(fixtures.path(
+    'bench-runner/load-error-after-declaration.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    data.message === 'load failed after declaration'));
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.name, 'declared before load error');
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testStructuredError() {
+  const records = await runFile(
+    fixtures.path('bench-runner/error.cjs')).toArray();
+  const result = records.find(
+    ({ type }) => type === 'bench:complete').data;
+  assert.strictEqual(result.error.code, 'ERR_BENCHMARK_FIXTURE');
+  assert.deepStrictEqual(result.error.cause, { value: 42n });
+  assert.match(result.error.stack, /error\.cjs/);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testAbort() {
+  const controller = new AbortController();
+  const reason = new Error('cancel run file');
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'),
+    { signal: controller.signal });
+  stream.once('bench:start', common.mustCall(() => controller.abort(reason)));
+  const records = await stream.toArray();
+  const diagnostic = records.find(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR').data;
+  assert.strictEqual(diagnostic.error.cause.message, reason.message);
+  assert.strictEqual(records.some(
+    ({ type }) => type === 'bench:complete'), false);
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+  assert.deepStrictEqual(records.at(-1).data.counts, {
+    __proto__: null,
+    completed: 0,
+    failed: 0,
+    skipped: 0,
+    total: 1,
+  });
+}
+
+async function testPartialAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-partial.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:start', ({ name }) => {
+    if (name === 'aborted run file') controller.abort();
+  });
+  const records = await stream.toArray();
+  const summary = records.at(-1).data;
+  assert.strictEqual(records.filter(
+    ({ type }) => type === 'bench:complete').length, 1);
+  assert.deepStrictEqual(summary.counts, {
+    __proto__: null,
+    completed: 1,
+    failed: 0,
+    skipped: 0,
+    total: 2,
+  });
+  assert.strictEqual(summary.success, false);
+}
+
+async function testPostSummaryAbort() {
+  const controller = new AbortController();
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-lingering.cjs'),
+    { signal: controller.signal });
+  stream.on('bench:diagnostic', common.mustCall(({ message, stream }) => {
+    if (stream === 'stdout' && /child disconnected/.test(message)) {
+      controller.abort(new Error('stop lingering child'));
+    }
+  }, 2));
+  const records = await stream.toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' && data.error?.code === 'ABORT_ERR'));
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.counts.completed, 1);
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testExitCode() {
+  const records = await runFile(
+    fixtures.path('bench-runner/exit-code.cjs')).toArray();
+  assert(records.some(({ type, data }) =>
+    type === 'bench:diagnostic' &&
+    /set exit code/.test(data.message)));
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testParentExitCode() {
+  process.exitCode = 42;
+  try {
+    const records = await runFile(fixture).toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.exitCode = undefined;
+  }
+}
+
+async function testDefaultExecArgvSnapshot() {
+  const original = Array.from(process.execArgv);
+  try {
+    process.execArgv.push('--bench', '--eval', 'throw new Error()');
+    const stream = runFile(fixture);
+    process.execArgv.push('--require=/does/not/exist.cjs');
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execArgv.length = 0;
+    process.execArgv.push(...original);
+  }
+}
+
+async function testExecPathSnapshot() {
+  const stream = runFile(fixture);
+  const execPath = process.execPath;
+  process.execPath = '/does/not/exist';
+  try {
+    const records = await stream.toArray();
+    assert.strictEqual(records.at(-1).data.success, true);
+  } finally {
+    process.execPath = execPath;
+  }
+}
+
+async function testSpawnFailure() {
+  const execPath = process.execPath;
+  let stream;
+  try {
+    process.execPath = fixtures.path('does-not-exist-node');
+    stream = runFile(fixture);
+  } finally {
+    process.execPath = execPath;
+  }
+  const records = await stream.toArray();
+  const diagnostic = records.find(
+    ({ type }) => type === 'bench:diagnostic').data;
+  assert.strictEqual(diagnostic.error.code, 'ENOENT');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+function testEvalParent() {
+  const script = `
+    require('node:bench').runFile(${JSON.stringify(fixture)})
+      .on('bench:summary', (summary) => console.log(summary.success));
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '-e',
+    script,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stdout, 'true\n');
+}
+
+function testPermissions() {
+  const fsReadScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const { pathToFileURL } = require('url');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('child'), true);
+    assert.strictEqual(process.permission.has('fs.read', target), false);
+    Promise.all([
+      target,
+      Buffer.from(target),
+      pathToFileURL(target),
+    ].map(async (input) => {
+      const records = await runFile(input).toArray();
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'FileSystemRead');
+      assert.strictEqual(diagnostic.data.error.resource, target);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    })).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const result = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--permission',
+    '--allow-child-process',
+    '-e',
+    fsReadScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(result.status, 0, result.stderr);
+
+  const childProcessScript = `
+    const assert = require('assert');
+    const { runFile } = require('node:bench');
+    const target = ${JSON.stringify(fixture)};
+    assert.strictEqual(process.permission.has('fs.read', target), true);
+    assert.strictEqual(process.permission.has('child'), false);
+    runFile(target).toArray().then((records) => {
+      const diagnostic = records.find(({ type, data }) =>
+        type === 'bench:diagnostic' &&
+        data.error?.code === 'ERR_ACCESS_DENIED');
+      assert.strictEqual(diagnostic.data.error.permission, 'ChildProcess');
+      assert.strictEqual(diagnostic.data.error.resource, process.execPath);
+      assert.strictEqual(records.at(-1).type, 'bench:summary');
+      assert.strictEqual(records.at(-1).data.success, false);
+    }).catch((error) => {
+      console.error(error);
+      process.exitCode = 1;
+    });
+  `;
+  const childProcessResult = spawnSync(process.execPath, [
+    '--no-warnings',
+    '--permission',
+    `--allow-fs-read=${fixture}`,
+    '-e',
+    childProcessScript,
+  ], { encoding: 'utf8' });
+  assert.strictEqual(
+    childProcessResult.status,
+    0,
+    childProcessResult.stderr,
+  );
+}
+
+async function testPreAborted() {
+  const records = await runFile(fixture, {
+    signal: AbortSignal.abort(new Error('already cancelled')),
+  }).toArray();
+  assert.strictEqual(records.some(({ type }) => type === 'bench:start'), false);
+  assert.strictEqual(records.find(({ type }) =>
+    type === 'bench:diagnostic').data.error.code, 'ABORT_ERR');
+  assert.strictEqual(records.at(-1).type, 'bench:summary');
+  assert.strictEqual(records.at(-1).data.success, false);
+}
+
+async function testDestroy() {
+  const stream = runFile(
+    fixtures.path('bench-runner/run-file-blocked.cjs'));
+  stream.once('bench:start', common.mustCall(() => stream.destroy()));
+  await once(stream, 'close');
+  assert.strictEqual(stream.destroyed, true);
+}
+
+(async () => {
+  await testRunFile();
+  await testConcurrentCalls();
+  await testLoadFailure();
+  await testEvaluationFailure();
+  await testStructuredError();
+  await testAbort();
+  await testPartialAbort();
+  await testPostSummaryAbort();
+  await testExitCode();
+  await testParentExitCode();
+  await testDefaultExecArgvSnapshot();
+  await testExecPathSnapshot();
+  await testSpawnFailure();
+  await testPreAborted();
+  await testDestroy();
+  testEvalParent();
+  testPermissions();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-run-options.js b/test/parallel/test-bench-run-options.js
new file mode 100644
index 000000000000..bbb89f5fdc99
--- /dev/null
+++ b/test/parallel/test-bench-run-options.js
@@ -0,0 +1,47 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, run } = require('node:bench');
+
+let invocations = 0;
+const timeout = common.platformTimeout(1000);
+bench('overridden', { samples: 8, timeout, warmup: 8 }, (b) => {
+  invocations++;
+  completeSample(b, invocations);
+});
+
+const plans = [];
+const samples = [];
+const types = [];
+const stream = run({
+  samples: 2,
+  warmup: 3,
+  yieldBetweenSamples: false,
+});
+stream.on('bench:plan', (plan) => plans.push(plan));
+stream.on('bench:sample', ({ operations }) => samples.push(operations));
+stream.on('data', ({ type }) => types.push(type));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(plans.length, 1);
+  assert.deepStrictEqual({
+    samples: plans[0].samples,
+    selected: plans[0].selected,
+    skip: plans[0].skip,
+    timeout: plans[0].timeout,
+    warmup: plans[0].warmup,
+    yieldBetweenSamples: plans[0].yieldBetweenSamples,
+  }, {
+    samples: 2,
+    selected: true,
+    skip: undefined,
+    timeout,
+    warmup: 3,
+    yieldBetweenSamples: false,
+  });
+  assert.deepStrictEqual(samples, [4, 5]);
+  assert.deepStrictEqual(types.slice(0, 2), ['bench:plan', 'bench:start']);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-run.js b/test/parallel/test-bench-run.js
new file mode 100644
index 000000000000..e79411f83e1d
--- /dev/null
+++ b/test/parallel/test-bench-run.js
@@ -0,0 +1,143 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { setImmediate } = require('timers/promises');
+const {
+  after,
+  afterEach,
+  before,
+  beforeEach,
+  bench,
+  run,
+  suite,
+} = require('node:bench');
+
+const calls = [];
+const contexts = new Set();
+let active = false;
+
+before(() => calls.push('root before'));
+after(() => calls.push('root after'));
+beforeEach(() => calls.push('root beforeEach'));
+afterEach(() => calls.push('root afterEach'));
+
+const suiteCompletion = suite('group', { tags: ['Group'] }, async () => {
+  await setImmediate();
+
+  before(() => calls.push('suite before'));
+  after(() => calls.push('suite after'));
+  beforeEach(() => calls.push('suite beforeEach'));
+  afterEach(() => calls.push('suite afterEach'));
+
+  bench('sync', {
+    params: { z: 2, a: true },
+    samples: 2,
+    tags: ['SYNC'],
+    warmup: 1,
+  }, common.mustCall((b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('sync sample');
+    assert.deepStrictEqual(b.params, { __proto__: null, a: true, z: 2 });
+    completeSample(b);
+    active = false;
+  }, 3));
+
+  bench('async', { samples: 2 }, common.mustCall(async (b) => {
+    assert.strictEqual(active, false);
+    active = true;
+    contexts.add(b);
+    calls.push('async sample');
+    await setImmediate();
+    completeSample(b);
+    await setImmediate();
+    active = false;
+  }, 2));
+
+  bench.skip('skipped', { samples: 1 }, common.mustNotCall());
+});
+
+const records = [];
+const plans = [];
+const stream = run();
+stream.on('bench:plan', common.mustCall((plan) => {
+  assert.deepStrictEqual(calls, []);
+  plans.push(plan.name);
+}, 3));
+stream.on('data', (record) => records.push(record));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(active, false);
+  assert.strictEqual(contexts.size, 5);
+
+  const starts = records.filter(({ type }) => type === 'bench:start');
+  const samples = records.filter(({ type }) => type === 'bench:sample');
+  const completions = records.filter(({ type }) => type === 'bench:complete');
+  const summaries = records.filter(({ type }) => type === 'bench:summary');
+
+  assert.strictEqual(starts.length, 2);
+  assert.strictEqual(samples.length, 4);
+  assert.strictEqual(completions.length, 3);
+  assert.strictEqual(summaries.length, 1);
+  assert.deepStrictEqual(plans, ['sync', 'async', 'skipped']);
+
+  const sync = completions.find(({ data }) => data.name === 'sync').data;
+  assert.strictEqual(sync.error, undefined);
+  assert.strictEqual(sync.skip, undefined);
+  assert.strictEqual(sync.samples.length, 2);
+  assert.strictEqual(Object.getPrototypeOf(sync), null);
+  assert.strictEqual(Object.getPrototypeOf(sync.params), null);
+  assert.deepStrictEqual(sync.tags, ['group', 'sync']);
+  assert.match(sync.benchId, /\{"a":true,"z":2\}/);
+  assert.notStrictEqual(sync.parentId, null);
+  assert.strictEqual(sync.summary.mean > 0, true);
+  assert.strictEqual(sync.summary.min <= sync.summary.mean, true);
+  assert.strictEqual(sync.summary.mean <= sync.summary.max, true);
+  assert.strictEqual(typeof sync.summary.confidenceInterval.lower, 'number');
+  assert.strictEqual(typeof sync.samples[0].duration_ns, 'bigint');
+
+  const asyncResult = completions.find(
+    ({ data }) => data.name === 'async').data;
+  assert.strictEqual(asyncResult.error, undefined);
+  assert.strictEqual(asyncResult.skip, undefined);
+  assert.strictEqual(asyncResult.samples.length, 2);
+
+  const skipped = completions.find(
+    ({ data }) => data.name === 'skipped').data;
+  assert.strictEqual(skipped.skip, true);
+  assert.deepStrictEqual(skipped.samples, []);
+
+  assert.deepStrictEqual(summaries[0].data.counts, {
+    __proto__: null,
+    completed: 2,
+    failed: 0,
+    skipped: 1,
+    total: 3,
+  });
+  assert.strictEqual(summaries[0].data.success, true);
+
+  assert.deepStrictEqual(calls, [
+    'root before',
+    'suite before',
+    'root beforeEach',
+    'suite beforeEach',
+    'sync sample',
+    'sync sample',
+    'sync sample',
+    'suite afterEach',
+    'root afterEach',
+    'root beforeEach',
+    'suite beforeEach',
+    'async sample',
+    'async sample',
+    'suite afterEach',
+    'root afterEach',
+    'suite after',
+    'root after',
+  ]);
+}));
+
+suiteCompletion.then(common.mustCall());
diff --git a/test/parallel/test-bench-stream.js b/test/parallel/test-bench-stream.js
new file mode 100644
index 000000000000..115364c7db5e
--- /dev/null
+++ b/test/parallel/test-bench-stream.js
@@ -0,0 +1,388 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+function recordSample(b) {
+  b.record({
+    __proto__: null,
+    operations: 1,
+    duration_ns: 1n,
+  });
+}
+
+async function testReadableBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('bounded stream', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert(calls < sampleCount);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  const result = await completion;
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(records[1].type, 'bench:start');
+  assert.strictEqual(records.length, sampleCount + 4);
+}
+
+async function testPlanBackpressure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const benchmarkCount = 32;
+  const completions = [];
+  let calls = 0;
+  for (let i = 0; i < benchmarkCount; i++) {
+    completions.push(runner.bench(`planned ${i}`, { samples: 1 }, (b) => {
+      calls++;
+      recordSample(b);
+    }));
+  }
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+  const first = await iterator.next();
+
+  assert.strictEqual(first.value.type, 'bench:plan');
+  await setImmediate();
+  assert.strictEqual(calls, 0);
+  assert(stream.readableLength <= stream.readableHighWaterMark);
+  const records = [first.value];
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+    records.push(next.value);
+  }
+
+  await Promise.all(completions);
+  assert.strictEqual(calls, benchmarkCount);
+  assert.strictEqual(
+    records.slice(0, benchmarkCount).every(({ type }) => type === 'bench:plan'),
+    true,
+  );
+}
+
+async function testDestroyWhileBlocked() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const completions = [];
+  for (let i = 0; i < 32; i++) {
+    completions.push(runner.bench(`destroyed ${i}`, {
+      samples: 1,
+    }, recordSample));
+  }
+  const stream = runner.run();
+  const unblocked = stream.waitForDrain();
+  const iterator = stream[Symbol.asyncIterator]();
+  await iterator.next();
+  await unblocked;
+  for (let i = 0; i < 100 &&
+       stream.readableLength < stream.readableHighWaterMark; i++) {
+    await setImmediate();
+  }
+  assert.strictEqual(stream.readableLength, stream.readableHighWaterMark);
+
+  const draining = stream.waitForDrain();
+  const closed = new Promise((resolve) => stream.once('close', resolve));
+  stream.destroy();
+  await assert.rejects(draining, { code: 'ERR_INVALID_STATE' });
+  await assert.rejects(stream.waitForDrain(), { code: 'ERR_INVALID_STATE' });
+  await closed;
+  await Promise.all(completions);
+}
+
+async function testNamedEventsWithoutReading() {
+  const runner = createRunner();
+  const sampleCount = 64;
+  let calls = 0;
+  const completion = runner.bench('named events', {
+    samples: sampleCount,
+  }, (b) => {
+    calls++;
+    recordSample(b);
+  });
+  const stream = runner.run();
+  const summary = await new Promise((resolve) => {
+    stream.once('bench:summary', resolve);
+  });
+  const result = await completion;
+
+  assert.strictEqual(calls, sampleCount);
+  assert.strictEqual(result.samples.length, sampleCount);
+  assert.strictEqual(summary.success, true);
+  assert.strictEqual(stream.readableLength, sampleCount + 4);
+  assert(stream.readableLength > stream.readableHighWaterMark);
+  stream.destroy();
+}
+
+async function testCancellationCompletesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const first = runner.bench('cancelled stream', { samples: 64 }, recordSample);
+  const second = runner.bench('continues headlessly', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await iterator.return();
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].samples.length, 64);
+  assert.strictEqual(results[1].samples.length, 1);
+}
+
+async function testDeliveryDoesNotConsumeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  // The timeout only has to cover the benchmark's own work, which is 32 samples
+  // that do nothing but record a fixed value. Keep it generous so that a loaded
+  // machine cannot exhaust it on its own, and keep the consumer stalled for
+  // longer than the timeout so that the benchmark can only complete when the
+  // time spent delivering records is excluded from the timeout.
+  const timeout = common.platformTimeout(500);
+  const completion = runner.bench('slow consumer', {
+    samples: 32,
+    timeout,
+  }, recordSample);
+  const stream = runner.run();
+  const iterator = stream[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await setImmediate();
+  for (;;) {
+    const next = await iterator.next();
+    if (next.done) break;
+  }
+
+  const result = await completion;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(result.samples.length, 32);
+}
+
+async function testReportingFailureSettlesBenchmarks() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('record listener failed');
+  const first = runner.bench('reported', { samples: 1 }, recordSample);
+  const second = runner.bench('settled', { samples: 1 }, recordSample);
+  const stream = runner.run();
+  stream.once('bench:complete', common.mustCall(() => {
+    throw failure;
+  }));
+  stream.resume();
+
+  const results = await Promise.all([first, second]);
+  assert.strictEqual(results[0].error, undefined);
+  assert.strictEqual(results[1].error, failure);
+  await setImmediate();
+}
+
+async function testSummaryListenerFailure() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const failure = new Error('summary listener failed');
+  const completion = runner.bench('summary failure', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  const diagnostics = [];
+  stream.on('bench:diagnostic', (diagnostic) => {
+    diagnostics.push(diagnostic);
+  });
+  stream.once('bench:summary', common.mustCall(() => {
+    throw failure;
+  }));
+  const ended = new Promise((resolve) => stream.once('end', resolve));
+  stream.resume();
+
+  const result = await completion;
+  await ended;
+  assert.strictEqual(result.error, undefined);
+  assert.strictEqual(diagnostics.length, 1);
+  assert.strictEqual(diagnostics[0].error.message, failure.message);
+}
+
+async function testRecordOwnership() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  const expectedError = new Error('expected failure');
+  expectedError.code = 'ERR_EXPECTED';
+  expectedError.cause = expectedError;
+  expectedError.uncloneable = new WeakMap();
+  expectedError.context = {
+    note: 'preserved',
+    callback() {},
+    get accessor() { return 'value'; },
+  };
+  expectedError.customContext = {
+    __proto__: {},
+    note: 'preserved',
+  };
+  expectedError.arrayPayload = [new WeakMap()];
+  const innerError = new Error('inner failure');
+  innerError.code = 'ERR_INNER';
+  const aggregate = new AggregateError([innerError], 'aggregate failure');
+  aggregate.code = 'ERR_AGGREGATE';
+  const causedError = new Error('caused failure', { cause: aggregate });
+  causedError.references = new Map([['self', causedError]]);
+  causedError.members = new Set([causedError]);
+  const measured = runner.bench('owned result', {
+    params: { kind: 'original' },
+    samples: 1,
+  }, (b) => {
+    b.record({
+      __proto__: null,
+      operations: 1,
+      duration_ns: 1n,
+      detail: { value: 'original' },
+    });
+  });
+  const failed = runner.bench('owned error', { samples: 1 }, () => {
+    throw expectedError;
+  });
+  const caused = runner.bench('owned cause', { samples: 1 }, () => {
+    throw causedError;
+  });
+  const throwingNameError = new Error('throwing name');
+  Object.defineProperty(throwingNameError, 'name', {
+    configurable: true,
+    get() { throw new Error('name getter'); },
+  });
+  const throwingName = runner.bench('throwing name', {
+    samples: 1,
+  }, () => {
+    throw throwingNameError;
+  });
+  const thrownValue = new WeakMap();
+  const uncloneable = runner.bench('uncloneable error', {
+    samples: 1,
+  }, () => {
+    throw thrownValue;
+  });
+  const proxyError = new Proxy({}, {
+    getPrototypeOf() {
+      throw new Error('prototype trap');
+    },
+  });
+  const trapped = runner.bench('trapping error', { samples: 1 }, () => {
+    throw proxyError;
+  });
+  const afterTrap = runner.bench('after trapping error', {
+    samples: 1,
+  }, recordSample);
+  const stream = runner.run();
+  let eventSample;
+  let eventComplete;
+  let eventError;
+  let eventSummary;
+
+  stream.on('bench:sample', (sample) => {
+    if (sample.name !== 'owned result') return;
+    eventSample = sample;
+    sample.name = 'changed by event';
+    sample.detail.value = 'changed by event';
+  });
+  stream.on('bench:complete', (result) => {
+    if (result.name === 'owned result') {
+      eventComplete = result;
+      result.params.kind = 'changed by event';
+      result.samples[0].detail.value = 'changed by event';
+    } else if (result.name === 'owned error') {
+      eventError = result.error;
+      result.error.code = 'ERR_CHANGED';
+    }
+  });
+  stream.on('bench:summary', (summary) => {
+    eventSummary = summary;
+    summary.counts.total = 100;
+  });
+
+  const records = await stream.toArray();
+  const measuredResult = await measured;
+  const failedResult = await failed;
+  await caused;
+  const throwingNameResult = await throwingName;
+  const uncloneableResult = await uncloneable;
+  const trappedResult = await trapped;
+  const afterTrapResult = await afterTrap;
+  const streamSample = records.find(
+    ({ type }) => type === 'bench:sample').data;
+  const streamResults = records.filter(
+    ({ type }) => type === 'bench:complete').map(({ data }) => data);
+  const streamMeasured = streamResults.find(
+    ({ name }) => name === 'owned result');
+  const streamFailed = streamResults.find(
+    ({ name }) => name === 'owned error');
+  const streamCaused = streamResults.find(
+    ({ name }) => name === 'owned cause');
+  const streamThrowingName = streamResults.find(
+    ({ name }) => name === 'throwing name');
+  const streamSummary = records.find(
+    ({ type }) => type === 'bench:summary').data;
+
+  assert.notStrictEqual(eventSample, streamSample);
+  assert.notStrictEqual(eventComplete, streamMeasured);
+  assert.notStrictEqual(streamMeasured, measuredResult);
+  assert.strictEqual(streamSample.name, 'owned result');
+  assert.strictEqual(streamSample.detail.value, 'original');
+  assert.strictEqual(streamMeasured.params.kind, 'original');
+  assert.strictEqual(streamMeasured.samples[0].detail.value, 'original');
+  assert.strictEqual(measuredResult.params.kind, 'original');
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+
+  streamMeasured.samples[0].detail.value = 'changed by stream';
+  assert.strictEqual(measuredResult.samples[0].detail.value, 'original');
+  assert.notStrictEqual(eventError, streamFailed.error);
+  assert.notStrictEqual(streamFailed.error, expectedError);
+  assert.strictEqual(streamFailed.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(streamFailed.error.cause, streamFailed.error);
+  assert.strictEqual(streamFailed.error.context.note, 'preserved');
+  assert.strictEqual(streamFailed.error.context.callback, undefined);
+  assert.strictEqual(streamFailed.error.context.accessor, undefined);
+  assert.strictEqual(streamFailed.error.customContext.note, 'preserved');
+  assert.deepStrictEqual(streamFailed.error.arrayPayload, [undefined]);
+  assert.strictEqual(failedResult.error, expectedError);
+  assert.strictEqual(failedResult.error.code, 'ERR_EXPECTED');
+  assert.strictEqual(failedResult.error.cause, failedResult.error);
+  assert.strictEqual(uncloneableResult.error, thrownValue);
+  assert.strictEqual(trappedResult.error, proxyError);
+  assert.strictEqual(afterTrapResult.error, undefined);
+  assert.strictEqual(throwingNameResult.error, throwingNameError);
+  assert.strictEqual(streamThrowingName.error.name, 'Error');
+  assert.strictEqual(streamThrowingName.error.message, 'throwing name');
+  assert(streamCaused.error.cause instanceof AggregateError);
+  assert.strictEqual(streamCaused.error.cause.name, 'AggregateError');
+  assert.strictEqual(streamCaused.error.cause.code, 'ERR_AGGREGATE');
+  assert.strictEqual(streamCaused.error.cause.errors[0].code, 'ERR_INNER');
+  assert.strictEqual(
+    streamCaused.error.references.get('self'), streamCaused.error);
+  assert.strictEqual(streamCaused.error.members.has(streamCaused.error), true);
+  assert.notStrictEqual(eventSummary, streamSummary);
+  assert.strictEqual(streamSummary.counts.total, 7);
+}
+
+(async () => {
+  await testReadableBackpressure();
+  await testPlanBackpressure();
+  await testDestroyWhileBlocked();
+  await testNamedEventsWithoutReading();
+  await testCancellationCompletesBenchmarks();
+  await testDeliveryDoesNotConsumeTimeout();
+  await testReportingFailureSettlesBenchmarks();
+  await testSummaryListenerFailure();
+  await testRecordOwnership();
+})().then(common.mustCall());
diff --git a/test/parallel/test-bench-validation.js b/test/parallel/test-bench-validation.js
new file mode 100644
index 000000000000..39edc5d411cc
--- /dev/null
+++ b/test/parallel/test-bench-validation.js
@@ -0,0 +1,80 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { bench, createRunner, run } = require('node:bench');
+
+const noop = () => {};
+let functionOverloadCalls = 0;
+let objectOverloadCalls = 0;
+
+function functionOverload(b) {
+  functionOverloadCalls++;
+  completeSample(b);
+  b.done();
+}
+
+function objectOverload(b) {
+  objectOverloadCalls++;
+  completeSample(b);
+}
+
+assert.throws(() => bench('', noop), { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', null), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { samples: 0 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { warmup: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { timeout: -1 }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { signal: {} }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: 'channel' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { diagnosticChannels: [1] }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: 'fast' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { tags: [''] }, noop),
+              { code: 'ERR_INVALID_ARG_VALUE' });
+assert.throws(() => bench('name', { params: { value: null } }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { params: { value: NaN } }, noop),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => bench('name', { only: 'yes' }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => bench('name', { skip: 1 }, noop),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ namePattern: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => run({ samples: 0 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ warmup: -1 }),
+              { code: 'ERR_OUT_OF_RANGE' });
+assert.throws(() => run({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner(null),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: 1 }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => createRunner({ yieldBetweenSamples: null }),
+              { code: 'ERR_INVALID_ARG_TYPE' });
+
+bench(functionOverload);
+bench({ samples: 1 }, objectOverload);
+
+bench('valid', { samples: 1 }, (b) => {
+  completeSample(b);
+});
+
+const stream = run();
+stream.on('bench:start', common.mustCall(() => {
+  assert.throws(() => bench('late', noop), { code: 'ERR_INVALID_STATE' });
+}, 3));
+stream.on('end', common.mustCall(() => {
+  assert.strictEqual(functionOverloadCalls, 1);
+  assert.strictEqual(objectOverloadCalls, 1);
+}));
+stream.resume();
diff --git a/test/parallel/test-bench-yield-between-samples.js b/test/parallel/test-bench-yield-between-samples.js
new file mode 100644
index 000000000000..aceb381d1a57
--- /dev/null
+++ b/test/parallel/test-bench-yield-between-samples.js
@@ -0,0 +1,76 @@
+// Flags: --no-warnings
+'use strict';
+
+const common = require('../common');
+const { completeSample } = require('../common/bench');
+const assert = require('assert');
+const { createRunner } = require('node:bench');
+const { setImmediate } = require('timers/promises');
+
+async function observe(factoryOptions, runOptions) {
+  const runner = createRunner(factoryOptions);
+  const observed = [];
+  let turnOccurred = false;
+  const turn = setImmediate().then(() => {
+    turnOccurred = true;
+  });
+
+  runner.bench('yielding', { samples: 2 }, (b) => {
+    observed.push(turnOccurred);
+    completeSample(b);
+  });
+
+  await runner.run(runOptions).toArray();
+  await turn;
+  return observed;
+}
+
+async function observeTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  let invocations = 0;
+  const completion = runner.bench('timeout', {
+    samples: 10,
+    timeout: 5,
+  }, (b) => {
+    invocations++;
+    const until = process.hrtime.bigint() + 2_000_000n;
+    b.start();
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+    b.end(1);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+  assert.strictEqual(invocations < 10, true);
+}
+
+async function observeAfterEachTimeout() {
+  const runner = createRunner({ yieldBetweenSamples: false });
+  runner.afterEach(common.mustCall(() => {
+    const until = process.hrtime.bigint() + 10_000_000n;
+    while (process.hrtime.bigint() < until) { /* Busy loop. */ }
+  }));
+  const completion = runner.bench('afterEach timeout', {
+    samples: 1,
+    timeout: 5,
+  }, (b) => {
+    completeSample(b);
+  });
+  await runner.run().toArray();
+  const result = await completion;
+  assert.strictEqual(result.error.code, 'ERR_OPERATION_FAILED');
+}
+
+(async () => {
+  assert.deepStrictEqual(await observe(undefined, undefined), [false, true]);
+  assert.deepStrictEqual(
+    await observe({ yieldBetweenSamples: false }, undefined), [false, false]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: false },
+    { yieldBetweenSamples: true }), [false, true]);
+  assert.deepStrictEqual(await observe(
+    { yieldBetweenSamples: true },
+    { yieldBetweenSamples: false }), [false, false]);
+  await observeTimeout();
+  await observeAfterEachTimeout();
+})().then(common.mustCall());
diff --git a/test/parallel/test-benchmark-node-bench-tools.js b/test/parallel/test-benchmark-node-bench-tools.js
new file mode 100644
index 000000000000..3d248b45c0e3
--- /dev/null
+++ b/test/parallel/test-benchmark-node-bench-tools.js
@@ -0,0 +1,305 @@
+// Flags: --no-warnings
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+const {
+  analyzeCompare,
+  analyzeScatter,
+  holmAdjust,
+  isRegressionFailure,
+} = require('../../benchmark/_node-bench-analysis.js');
+const { csvEncode } = require('../../benchmark/_node-bench.js');
+
+const compare = path.resolve(__dirname, '../../benchmark/compare-node-bench.js');
+const legacyScatter = path.resolve(__dirname, '../../benchmark/scatter.js');
+const scatter = path.resolve(__dirname, '../../benchmark/scatter-node-bench.js');
+const benchmark = fixtures.path('bench-runner/tools.cjs');
+
+tmpdir.refresh();
+
+assert.strictEqual(csvEncode(true), 'true');
+assert.deepStrictEqual(holmAdjust([0.01, 0.03, 0.04]), [0.03, 0.06, 0.06]);
+assert.strictEqual(isRegressionFailure({
+  ci95: 3,
+  improvement: -12,
+  pThresholdAdjusted: 0.01,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pThresholdAdjusted: 0.06,
+}, 10), false);
+assert.strictEqual(isRegressionFailure({
+  ci95: 1,
+  improvement: -12,
+  pThresholdAdjusted: 0.01,
+}, 10), true);
+
+function comparisonSamples(oldRates, newRates) {
+  const create = (binary, rate) => ({
+    binary,
+    configuration: '',
+    identity: 'comparison',
+    name: 'comparison',
+    rate,
+  });
+  return [
+    ...oldRates.map((rate) => create('old', rate)),
+    ...newRates.map((rate) => create('new', rate)),
+  ];
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [48, 49, 50, 50, 51, 52],
+  ), 1000, 0);
+  assert.strictEqual(result.failed, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted < 0.05, true);
+}
+
+{
+  const result = analyzeCompare(comparisonSamples(
+    [98, 99, 100, 100, 101, 102],
+    [93, 94, 95, 95, 96, 97],
+  ), 1000, 10);
+  assert.strictEqual(result.rows[0].pAdjusted < 0.05, true);
+  assert.strictEqual(result.rows[0].pThresholdAdjusted > 0.05, true);
+  assert.strictEqual(result.failed, false);
+}
+assert.throws(
+  () => analyzeScatter([{
+    observation: 0,
+    params: { size: 1 },
+    rate: 1,
+  }], 'size', 'size', false),
+  /must name different parameters/,
+);
+assert.doesNotMatch(analyzeScatter([0, 1].map((observation) => ({
+  observation,
+  params: { size: 1 },
+  rate: 1_234_567.89,
+})), 'size', undefined, false), /\(!\)/);
+assert.match(analyzeScatter([
+  { observation: 0, params: { method: 'a', size: 1 }, rate: 10 },
+  { observation: 0, params: { method: 'b', size: 1 }, rate: 20 },
+  { observation: 1, params: { method: 'a', size: 1 }, rate: 30 },
+  { observation: 1, params: { method: 'b', size: 1 }, rate: 50 },
+], 'size', undefined, false), /\n\s*1\s+2\s+/);
+
+function run(script, args, options = undefined) {
+  return spawnSync(process.execPath, [script, ...args], {
+    encoding: 'utf8',
+    timeout: 30_000,
+    ...options,
+  });
+}
+
+{
+  const pidLog = tmpdir.resolve('pids');
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ], {
+    env: { __proto__: null, ...process.env, NODE_BENCH_PID_LOG: pidLog },
+  });
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"binary","filename","configuration","rate","time"');
+  assert.strictEqual(lines.length, 9);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"old",')).length,
+                     4);
+  assert.strictEqual(lines.filter((line) => line.startsWith('"new",')).length,
+                     4);
+  assert.deepStrictEqual(lines.slice(1).map((line) => line.slice(0, 5)), [
+    '"old"', '"old"', '"new"', '"new"',
+    '"new"', '"new"', '"old"', '"old"',
+  ]);
+  assert(lines.slice(1).every(
+    (line) => line.includes('"tools/simple.js"')));
+  const pids = fs.readFileSync(pidLog, 'utf8').trim().split('\n');
+  assert.strictEqual(new Set(pids).size, 4);
+}
+
+{
+  const result = run(scatter, [
+    '--node', process.execPath,
+    '--runs', '2',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0],
+                     '"filename","method","size","rate","time"');
+  assert.strictEqual(lines.length, 5);
+  assert(lines.slice(1).every(
+    (line) => line.startsWith('"tools/simple.js","loop",')));
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  const lines = result.stdout.trim().split('\n');
+  assert.strictEqual(lines[0], '"filename","rate","time"');
+  assert.strictEqual(lines.length, 2);
+  assert.strictEqual(lines[1].split(',').length, 3);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-reserved-param.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /parameter 'rate' is reserved/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /requires one logical benchmark name per file/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--', fixtures.path('bench-runner/tools-collision.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /Distinct benchmarks would share the CSV group/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--', fixtures.path('bench-runner/a.cjs'),
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /set of reported benchmarks changed between runs/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '1',
+    '--name-pattern', 'missing',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /No benchmark samples were produced/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', 'invalid',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--runs must be an integer/);
+}
+
+{
+  const result = run(scatter, [
+    '--runs', '2',
+    '--analyze',
+    '--xaxis', 'size',
+    '--category', 'method',
+    '--no-chart',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout,
+               /size\s+method\s+samples\s+rate\s+confidence\.interval/);
+  assert.match(result.stdout, /Change between consecutive size values/);
+  assert.match(result.stdout, /Mann-Whitney U.*Cliff's delta/);
+  assert.doesNotMatch(result.stdout, /"filename","method"/);
+}
+
+{
+  const result = run(scatter, [
+    '--analyze',
+    '--', benchmark,
+  ]);
+  assert.strictEqual(result.status, 1);
+  assert.match(result.stderr, /--analyze requires --xaxis/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '2',
+    '--max-regression', '100',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /Holm-Bonferroni correction/);
+  assert.match(result.stdout, /one-sided p-values against the 100% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const result = run(compare, [
+    '--old', process.execPath,
+    '--new', process.execPath,
+    '--runs', '1',
+    '--max-regression', '0',
+    '--', fixtures.path('bench-runner/tools-no-params.cjs'),
+  ]);
+  assert.strictEqual(result.status, 0, result.stderr);
+  assert.strictEqual(result.stderr, '');
+  assert.match(result.stdout, /confidence\s+improvement\s+accuracy/);
+  assert.match(result.stdout, /one-sided p-values against the 0% threshold/);
+  assert.doesNotMatch(result.stdout, /"binary","filename"/);
+}
+
+{
+  const benchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/buffer-compare-offset.js');
+  const nodeBenchmark = path.resolve(
+    __dirname, '../../benchmark/buffers/_buffer-compare-offset.node-bench.js');
+  const legacy = run(legacyScatter, [
+    '--runs', '1',
+    benchmark,
+  ]);
+  const modern = run(scatter, [
+    '--runs', '1',
+    '--', nodeBenchmark,
+  ]);
+  assert.strictEqual(legacy.status, 0, legacy.stderr);
+  assert.strictEqual(modern.status, 0, modern.stderr);
+  const legacyLines = legacy.stdout.trim().split('\n');
+  const modernLines = modern.stdout.trim().split('\n');
+  assert.deepStrictEqual(
+    legacyLines[0].replaceAll(' ', '').split(',').sort(),
+    modernLines[0].split(',').sort(),
+  );
+  assert.strictEqual(modernLines[0],
+                     '"filename","method","n","size","rate","time"');
+  assert.strictEqual(legacyLines.length, 9);
+  assert.strictEqual(modernLines.length, 9);
+  const name = path.join('buffers', 'buffer-compare-offset.js');
+  assert(legacyLines[1].startsWith(`"${name}",`));
+  assert(modernLines[1].startsWith(`"${name}",`));
+}
diff --git a/test/parallel/test-blocklist.js b/test/parallel/test-blocklist.js
index ca4e96b0cbdd..f1fc42f6304e 100644
--- a/test/parallel/test-blocklist.js
+++ b/test/parallel/test-blocklist.js
@@ -955,3 +955,40 @@ const util = require('util');
   assert(!blockList.check('10.2.0.1'));
   assert.strictEqual(blockList.rules.length, 1);
 }
+
+{
+  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
+  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
+  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
+  // in that notation.
+  const bl = new BlockList();
+  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
+  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
+  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');
+
+  const expected = [
+    'Address: IPv6 ::ffff:192.0.2.128',
+    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
+    'Subnet: IPv6 ::ffff:10.0.0.0/120',
+  ];
+  assert.deepStrictEqual(bl.toJSON().sort(), expected);
+
+  const restored = new BlockList();
+  restored.fromJSON(bl.toJSON());
+
+  // The restored rules must be identical (lossless round-trip).
+  assert.deepStrictEqual(restored.toJSON().sort(), expected);
+
+  // And it must still match the same addresses as the original.
+  [
+    ['::ffff:192.0.2.128', true],  // the single address
+    ['::ffff:192.0.2.129', false],
+    ['::ffff:10.0.0.50', true],    // inside the subnet
+    ['::ffff:10.0.1.0', false],
+    ['::ffff:172.16.0.5', true],   // inside the range
+    ['::ffff:172.16.0.20', false],
+  ].forEach(([address, result]) => {
+    assert.strictEqual(bl.check(address, 'ipv6'), result);
+    assert.strictEqual(restored.check(address, 'ipv6'), result);
+  });
+}
diff --git a/test/parallel/test-bootstrap-modules.js b/test/parallel/test-bootstrap-modules.js
index b4827a13fcea..e6a40d45e26f 100644
--- a/test/parallel/test-bootstrap-modules.js
+++ b/test/parallel/test-bootstrap-modules.js
@@ -118,12 +118,14 @@ expected.atRunTime = new Set([
 
 const { isMainThread } = require('worker_threads');
 // Binaries built without the snapshot (e.g. cross-compiled) and
-// --no-node-snapshot bootstrap the main context from scratch, like a worker.
-const mainContextFromSnapshot = isMainThread &&
+// --no-node-snapshot bootstrap the context from scratch; so do workers under
+// --no-worker-snapshot.
+const contextFromSnapshot =
   process.config.variables.node_use_node_snapshot &&
-  !process.execArgv.includes('--no-node-snapshot');
+  !process.execArgv.includes('--no-node-snapshot') &&
+  (isMainThread || !process.execArgv.includes('--no-worker-snapshot'));
 
-if (mainContextFromSnapshot) {
+if (contextFromSnapshot) {
   [
     'Internal Binding cjs_lexer',
     'NativeModule internal/modules/esm/assert',
@@ -148,7 +150,8 @@ if (mainContextFromSnapshot) {
 } else if (isMainThread) {
   expected.beforePreExec.delete(getFormatNativeModule);
   expected.atRunTime.add(getFormatNativeModule);
-} else {  // Worker.
+}
+if (!isMainThread) {
   [
     'NativeModule diagnostics_channel',
     'NativeModule internal/abort_controller',
diff --git a/test/parallel/test-buffer-alloc-alignment.js b/test/parallel/test-buffer-alloc-alignment.js
index a1a3890ddc20..a55c3fe5fba8 100644
--- a/test/parallel/test-buffer-alloc-alignment.js
+++ b/test/parallel/test-buffer-alloc-alignment.js
@@ -111,6 +111,24 @@ for (const alloc of [Buffer.allocUnsafe, Buffer.allocUnsafeSlow]) {
   assert.strictEqual(buf.buffer.byteLength, 100);
 }
 
+// The padding an aligned allocation needs does not leave a partial element
+// behind it, so a typed array view running from the buffer to the end of its
+// ArrayBuffer can be created without an explicit length.
+{
+  const bufs = [Buffer.allocUnsafe(8), Buffer.allocUnsafeSlow(4096, 4096)];
+  for (const alignment of alignments) {
+    bufs.push(Buffer.allocUnsafe(8, alignment),
+              Buffer.allocUnsafeSlow(8, alignment));
+  }
+  for (const buf of bufs) {
+    const rest = buf.buffer.byteLength - buf.byteOffset;
+    assert.strictEqual(new BigUint64Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+    assert.strictEqual(new Uint32Array(buf.buffer, buf.byteOffset).byteLength,
+                       rest);
+  }
+}
+
 // Buffer.allocUnsafeSlow() is never pooled, even when aligned.
 {
   const a = Buffer.allocUnsafeSlow(64, 64);
diff --git a/test/parallel/test-buffer-tostring-rangeerror.js b/test/parallel/test-buffer-tostring-rangeerror.js
index b34f4c612618..856ed84d21cd 100644
--- a/test/parallel/test-buffer-tostring-rangeerror.js
+++ b/test/parallel/test-buffer-tostring-rangeerror.js
@@ -34,6 +34,12 @@ function test(getBuffer) {
       return;
     }
   }
+  // MAX_STRING_LENGTH counts UTF-16 units, not bytes. Uninitialized memory can
+  // hold multi-byte UTF-8 sequences, which decode to fewer units than they
+  // occupy bytes, and a single one of them is enough to bring the result down
+  // to MAX_STRING_LENGTH or less. ASCII bytes keep the decoded length equal to
+  // the buffer length.
+  buf.fill(0);
   assert.throws(() => { buf.toString('utf8'); }, message);
 }
 
diff --git a/test/parallel/test-buffer-tostring.js b/test/parallel/test-buffer-tostring.js
index a3dad0146d75..676d2f85f567 100644
--- a/test/parallel/test-buffer-tostring.js
+++ b/test/parallel/test-buffer-tostring.js
@@ -9,6 +9,13 @@ for (const encoding of ['utf8', 'utf-8', 'ucs2', 'ucs-2', 'ascii', 'latin1',
   assert.strictEqual(Buffer.from('foo', encoding).toString(encoding), 'foo');
 }
 
+// Ignore an incomplete trailing code unit when decoding unaligned UTF-16LE.
+for (const size of [514, 516]) {
+  const buffer = Buffer.alloc(size, 0x61);
+  assert.strictEqual(buffer.toString('utf16le', 1),
+                     '\u6161'.repeat((size - 1) >>> 1));
+}
+
 // base64
 ['base64', 'BASE64'].forEach((encoding) => {
   assert.strictEqual(Buffer.from('Zm9v', encoding).toString(encoding), 'Zm9v');
diff --git a/test/parallel/test-child-process-fork-closed-channel-segfault.js b/test/parallel/test-child-process-fork-closed-channel-segfault.js
index 73bd118ddce3..779e02205e29 100644
--- a/test/parallel/test-child-process-fork-closed-channel-segfault.js
+++ b/test/parallel/test-child-process-fork-closed-channel-segfault.js
@@ -76,6 +76,7 @@ const server = net
           // Ignore errors when sending the second handle because the worker
           // may already have exited.
           if (err && err.code !== 'ERR_IPC_CHANNEL_CLOSED' &&
+                     err.code !== 'EPIPE' &&
                      err.code !== 'ECONNRESET' &&
                      err.code !== 'ECONNREFUSED' &&
                      err.code !== 'EMFILE') {
diff --git a/test/parallel/test-child-process-send-boundsocket.js b/test/parallel/test-child-process-send-boundsocket.js
new file mode 100644
index 000000000000..fff38a108ec9
--- /dev/null
+++ b/test/parallel/test-child-process-send-boundsocket.js
@@ -0,0 +1,79 @@
+'use strict';
+
+// This test verifies that an un-adopted TCP net.BoundSocket can be sent to a
+// child process as the sendHandle argument of subprocess.send(). The parent
+// binds synchronously to reserve the port, then hands the bound socket off;
+// the child adopts it via server.listen() and accepts connections.
+
+const common = require('../common');
+
+const assert = require('assert');
+const net = require('net');
+const { fork } = require('child_process');
+
+if (process.argv[2] === 'child') {
+  process.on('message', common.mustCall((msg, bound) => {
+    assert.ok(bound instanceof net.BoundSocket);
+    // The bound address survives the send.
+    assert.strictEqual(bound.address().port, msg.port);
+
+    const server = net.createServer(common.mustCall((socket) => {
+      socket.end('from-child');
+      server.close();
+    }));
+    server.listen(bound, common.mustCall(() => {
+      assert.strictEqual(server.address().port, msg.port);
+      // Adoption consumed the bound socket.
+      assert.throws(() => bound.address(), {
+        code: 'ERR_SOCKET_HANDLE_ADOPTED',
+      });
+      process.send('listening');
+    }));
+  }));
+  return;
+}
+
+const tmpdir = require('../common/tmpdir');
+tmpdir.refresh();
+
+const child = fork(__filename, ['child']);
+
+// Guards throw synchronously while no handle send is in flight (queued sends
+// defer conversion).
+const pipeBound = new net.BoundSocket({ path: common.PIPE });
+assert.throws(() => child.send('x', pipeBound), {
+  code: 'ERR_INVALID_HANDLE_TYPE',
+});
+pipeBound.close();
+
+const closedBound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+closedBound.close();
+assert.throws(() => child.send('x', closedBound), {
+  code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+});
+
+const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+const { port } = bound.address();
+
+child.send({ port }, bound, common.mustSucceed());
+
+// The source is left in the adopted state; further use throws.
+assert.throws(() => bound.address(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.fd(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.close(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+
+child.on('message', common.mustCall((msg) => {
+  assert.strictEqual(msg, 'listening');
+  const client = net.connect(port, '127.0.0.1');
+  client.setEncoding('utf8');
+  let response = '';
+  client.on('data', (chunk) => { response += chunk; });
+  client.on('end', common.mustCall(() => {
+    assert.strictEqual(response, 'from-child');
+    child.disconnect();
+  }));
+}));
+
+child.on('exit', common.mustCall((code) => {
+  assert.strictEqual(code, 0);
+}));
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 90c399790f65..375c46c11ab7 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -12,7 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -65,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!hasOpenSSL3)
+  if (!hasOpenSSL(3))
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
   if (common.isMacOS) {
     expect('--use-system-ca', 'B\n');
diff --git a/test/parallel/test-config-json-schema.js b/test/parallel/test-config-json-schema.js
index 82679660a30f..08973bd17ee2 100644
--- a/test/parallel/test-config-json-schema.js
+++ b/test/parallel/test-config-json-schema.js
@@ -10,9 +10,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('this test requires OpenSSL 3.x');
 }
 
diff --git a/test/parallel/test-crypto-async-sign-verify.js b/test/parallel/test-crypto-async-sign-verify.js
index 96b4b5d90679..a60dc73d67b3 100644
--- a/test/parallel/test-crypto-async-sign-verify.js
+++ b/test/parallel/test-crypto-async-sign-verify.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const util = require('util');
 const crypto = require('crypto');
@@ -100,7 +100,7 @@ test('rsa_public.pem', 'rsa_private.pem', 'sha256', false,
 // ED25519
 test('ed25519_public.pem', 'ed25519_private.pem', undefined, true);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // ED448
   test('ed448_public.pem', 'ed448_private.pem', undefined, true);
 
@@ -173,7 +173,7 @@ MCowBQYDK2VuAyEA6pwGRbadNQAI/tYN8+/p/0/hbsdHfOEGr1ADiLVk/Gc=
 
   let expected = /no default digest/;
   let expectedCode = 'ERR_OSSL_EVP_NO_DEFAULT_DIGEST';
-  if (hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3) || isBoringSSL) {
     expected = /operation[\s_]not[\s_]supported[\s_]for[\s_]this[\s_]keytype/i;
     expectedCode = 'ERR_OSSL_EVP_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE';
   }
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index 3ad34729f871..f11778ee7708 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -29,7 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const isFipsEnabled = crypto.getFips() === 1;
 const fips3 = hasFIPS(3);
@@ -834,7 +834,7 @@ if (fips3) {
     }), {
     code: 'ERR_OSSL_EVP_UNSUPPORTED',
   });
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -852,7 +852,7 @@ if (fips3) {
 
 // ChaCha20-Poly1305 should respect the authTagLength option and should not
 // require the authentication tag before calls to update() during decryption.
-if (!fips3 && !process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const key = Buffer.alloc(32);
   const iv = Buffer.alloc(12);
 
@@ -903,7 +903,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) {
 // shorter tags as long as their length was valid according to NIST SP 800-38D.
 // For ChaCha20-Poly1305, we intentionally deviate from that because there are
 // no recommended or approved authentication tag lengths below 16 bytes.
-if (!fips3 && !process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
@@ -942,7 +942,7 @@ if (!fips3 && !process.features.openssl_is_boringssl) {
 }
 
 // https://github.com/nodejs/node/issues/45874
-if (!fips3 && !process.features.openssl_is_boringssl) {
+if (!fips3 && !isBoringSSL) {
   const rfcTestCases = TEST_CASES.filter(({ algo, tampered }) => {
     return algo === 'chacha20-poly1305' && tampered === false;
   });
diff --git a/test/parallel/test-crypto-boringssl-evp-list.js b/test/parallel/test-crypto-boringssl-evp-list.js
index 3f142c24f28a..f2d8fd4796c0 100644
--- a/test/parallel/test-crypto-boringssl-evp-list.js
+++ b/test/parallel/test-crypto-boringssl-evp-list.js
@@ -1,10 +1,12 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!process.features.openssl_is_boringssl)
+if (!isBoringSSL)
   common.skip('BoringSSL-only test');
 
 const assert = require('assert');
diff --git a/test/parallel/test-crypto-certificate.js b/test/parallel/test-crypto-certificate.js
index 6462654680ea..54f61d8a3f6e 100644
--- a/test/parallel/test-crypto-certificate.js
+++ b/test/parallel/test-crypto-certificate.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { Certificate } = crypto;
 const fixtures = require('../common/fixtures');
 
@@ -42,7 +42,7 @@ function copyArrayBuffer(buf) {
 
 function checkMethods(certificate) {
 
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     assert.strictEqual(certificate.verifySpkac(spkacValid), !hasFIPS(3));
   assert.strictEqual(certificate.verifySpkac(spkacFail), false);
 
@@ -58,7 +58,7 @@ function checkMethods(certificate) {
   );
   assert.strictEqual(certificate.exportChallenge(spkacFail), '');
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const ab = copyArrayBuffer(spkacValid);
     const expected = !hasFIPS(3);
     assert.strictEqual(certificate.verifySpkac(ab), expected);
diff --git a/test/parallel/test-crypto-dh-curves.js b/test/parallel/test-crypto-dh-curves.js
index ee8849163ae8..22b05fb89609 100644
--- a/test/parallel/test-crypto-dh-curves.js
+++ b/test/parallel/test-crypto-dh-curves.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const {
   DH_CHECK_P_NOT_PRIME,
   DH_CHECK_P_NOT_SAFE_PRIME,
@@ -21,7 +21,7 @@ const p = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74' +
           'EE386BFB5A899FA5AE9F24117C4B1FE649286651ECE65381FFFFFFFFFFFFFFFF';
 crypto.createDiffieHellman(p, 'hex');
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const notPrime = Buffer.from(p, 'hex');
   notPrime[notPrime.length - 1] = 0xfd;
   assert.strictEqual(
@@ -63,7 +63,7 @@ assert.throws(
   });
 
 // Confirm DH_check() results are exposed for optional examination.
-const bad_dh = process.features.openssl_is_boringssl ?
+const bad_dh = isBoringSSL ?
   crypto.createDiffieHellman('abcd', 'hex', 0) :
   crypto.createDiffieHellman('02', 'hex');
 assert.notStrictEqual(bad_dh.verifyError, 0);
@@ -77,7 +77,7 @@ if (hasOpenSSL(3)) {
     () => crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                      Buffer.from(p, 'hex')),
     { code: 'ERR_OSSL_DH_BAD_GENERATOR' });
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   assert.strictEqual(
     crypto.createDiffieHellman(Buffer.from(p, 'hex'),
                                Buffer.from(p, 'hex')).verifyError,
@@ -144,9 +144,15 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
     ecdh4.setPrivateKey(ecdh1.getPrivateKey());
     ecdh4.setPublicKey(ecdh1.getPublicKey());
 
+    const ecdh4Secret = ecdh4.computeSecret(ecdh2.getPublicKey());
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
+
     assert.throws(() => {
       ecdh4.setPublicKey(ecdh3.getPublicKey());
     }, { message: 'Failed to convert Buffer to EC_POINT' });
+    assert.deepStrictEqual(ecdh4.computeSecret(ecdh2.getPublicKey()),
+                           ecdh4Secret);
 
     // Verify that we can use ECDH without having to use newly generated keys.
     const ecdh5 = crypto.createECDH('secp256k1');
@@ -190,6 +196,8 @@ if (availableCurves.has('prime256v1') && availableCurves.has('secp256k1')) {
                        sharedSecret);
     assert.strictEqual(ecdh5.computeSecret(peerPubPtUnComp, 'hex', 'hex'),
                        sharedSecret);
+    assert.strictEqual(ecdh5.computeSecret(peerPubPtComp, 'hex', 'hex'),
+                       sharedSecret);
 
     // Verify that we still have the same key pair as before the computation.
     assert.strictEqual(ecdh5.getPrivateKey('hex'), cafebabeKey);
@@ -260,3 +268,31 @@ if (availableCurves.has('prime256v1') && availableHashes.has('sha256')) {
     '-----END EC PRIVATE KEY-----';
   crypto.createSign('SHA256').sign(ecPrivateKey);
 }
+
+if (hasFIPS(3) && availableCurves.has('secp256k1')) {
+  const originalFips = crypto.getFips();
+
+  try {
+    crypto.setFips(0);
+    const local = crypto.createECDH('secp256k1');
+    const peer = crypto.createECDH('secp256k1');
+    local.generateKeys();
+    const peerPublicKey = peer.generateKeys();
+
+    local.computeSecret(peerPublicKey);
+    crypto.setFips(1);
+    assert.throws(() => local.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+
+    const installed = crypto.createECDH('secp256k1');
+    installed.setPrivateKey(Buffer.from('cafebabe'.repeat(8), 'hex'));
+    assert.throws(() => installed.computeSecret(peerPublicKey), {
+      code: 'ERR_CRYPTO_INVALID_KEYPAIR',
+      name: 'RangeError',
+    });
+  } finally {
+    crypto.setFips(originalFips);
+  }
+}
diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
index 3ff9b746e020..d9f7065655cb 100644
--- a/test/parallel/test-crypto-dh-errors.js
+++ b/test/parallel/test-crypto-dh-errors.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // https://github.com/nodejs/node/issues/32738
 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -25,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
 });
 
 for (const bits of [-1, 0, 1]) {
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     assert.throws(() => crypto.createDiffieHellman(bits), {
       code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
       name: 'Error',
diff --git a/test/parallel/test-crypto-dh-group-setters.js b/test/parallel/test-crypto-dh-group-setters.js
index 37d0a44d0e1e..ccc370e2352d 100644
--- a/test/parallel/test-crypto-dh-group-setters.js
+++ b/test/parallel/test-crypto-dh-group-setters.js
@@ -1,12 +1,14 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-modp2-views.js b/test/parallel/test-crypto-dh-modp2-views.js
index e32c515e1536..ce2d8823beec 100644
--- a/test/parallel/test-crypto-dh-modp2-views.js
+++ b/test/parallel/test-crypto-dh-modp2-views.js
@@ -5,9 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS, modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-modp2.js b/test/parallel/test-crypto-dh-modp2.js
index 0bf36f93a39a..a0ec31a1eb4f 100644
--- a/test/parallel/test-crypto-dh-modp2.js
+++ b/test/parallel/test-crypto-dh-modp2.js
@@ -5,9 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS, modp2buf } = require('../common/crypto');
+const { hasFIPS, modp2buf, isBoringSSL } = require('../common/crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('Skipping unsupported Diffie-Hellman tests');
 }
 
diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
index 0ade828eb234..9c0270304f2a 100644
--- a/test/parallel/test-crypto-dh-stateless.js
+++ b/test/parallel/test-crypto-dh-stateless.js
@@ -5,8 +5,11 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const {
+  hasOpenSSL,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
+const isBoringSSL = commonIsBoringSSL;
 
 // Error code for a key-type mismatch during (EC)DH. The underlying OpenSSL
 // error code varies by version, and in OpenSSL 4.0 by platform: some builds
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index f5d239f1d457..7b9a9d50d890 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -9,6 +9,7 @@ const crypto = require('crypto');
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 {
@@ -100,7 +101,7 @@ const {
 // Through a fluke of history, g=0 defaults to DH_GENERATOR (2).
 {
   const g = 0;
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman('abcdef', g), {
       code: 'ERR_CRYPTO_OPERATION_FAILED',
       name: 'Error'
@@ -112,7 +113,7 @@ const {
 }
 
 {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     assert.throws(() => crypto.createDiffieHellman('abcdef', Buffer.from([2])), {
       code: 'ERR_CRYPTO_OPERATION_FAILED',
       name: 'Error'
diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js
index 06c88272438a..65c373d35d25 100644
--- a/test/parallel/test-crypto-ecb.js
+++ b/test/parallel/test-crypto-ecb.js
@@ -25,14 +25,14 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 const crypto = require('crypto');
 
 if (crypto.getFips()) {
   common.skip('BF-ECB is not FIPS 140-2 compatible');
 }
 
-if (hasOpenSSL3) {
+if (hasOpenSSL(3)) {
   common.skip('Blowfish is only available with the legacy provider in ' +
     'OpenSSl 3.x');
 }
diff --git a/test/parallel/test-crypto-eddsa-variants.js b/test/parallel/test-crypto-eddsa-variants.js
index 3a75a7bf4f6f..10e9fba7e52c 100644
--- a/test/parallel/test-crypto-eddsa-variants.js
+++ b/test/parallel/test-crypto-eddsa-variants.js
@@ -8,6 +8,7 @@ const crypto = require('crypto');
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // RFC 8032 Section 7 test vectors for Ed25519, Ed25519ctx, and Ed448.
@@ -180,7 +181,7 @@ function createKeyPair(algorithm, secretKeyHex, publicKeyHex) {
 }
 
 for (const v of vectors) {
-  if (v.algorithm.startsWith('Ed448') && process.features.openssl_is_boringssl) continue;
+  if (v.algorithm.startsWith('Ed448') && isBoringSSL) continue;
   if (v.algorithm.endsWith('ctx') || v.context) {
     if (!hasOpenSSL(3, 2)) continue;
   }
diff --git a/test/parallel/test-crypto-encap-decap.js b/test/parallel/test-crypto-encap-decap.js
index 7cafa0f2aa93..199ad68fa365 100644
--- a/test/parallel/test-crypto-encap-decap.js
+++ b/test/parallel/test-crypto-encap-decap.js
@@ -6,10 +6,14 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const {
+  hasOpenSSL,
+  hasFIPS,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
 const { promisify } = require('util');
 
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 const isFips = hasFIPS(3);
 
 if (!hasOpenSSL(3) && !isBoringSSL) {
diff --git a/test/parallel/test-crypto-fips-indicator-strict.js b/test/parallel/test-crypto-fips-indicator-strict.js
index cc65d0016269..5e003d7015b2 100644
--- a/test/parallel/test-crypto-fips-indicator-strict.js
+++ b/test/parallel/test-crypto-fips-indicator-strict.js
@@ -6,7 +6,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasFIPS,
+  hasOpenSSL,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   common.skip('BoringSSL does not support FIPS');
 }
 
@@ -18,7 +24,6 @@ const { Worker } = require('node:worker_threads');
 const {
   spawnSyncAndExitWithoutError,
 } = require('../common/child_process');
-const { hasFIPS, hasOpenSSL } = require('../common/crypto');
 
 const channelName = 'crypto.fips.indicator';
 const mode = process.env.NODE_TEST_FIPS_FORCE_MODE;
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index ea20d895b1c8..ad67ec181c7e 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support FIPS');
 
 const assert = require('assert');
@@ -14,7 +16,6 @@ const { spawnSyncAndAssert } = require('../common/child_process');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
-const { hasOpenSSL, hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -23,11 +24,11 @@ const FIPS_ERROR_STRING2 =
   '--force-fips at startup.';
 const FIPS_UNSUPPORTED_ERROR_STRING = 'fips mode not supported';
 const FIPS_ENABLE_ERROR_STRING =
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     '--enable-fips requires an active OpenSSL provider named "fips"' :
     'OpenSSL error when trying to enable FIPS:';
 const FIPS_FORCE_ERROR_STRING =
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     '--force-fips requires an active OpenSSL provider named "fips"' :
     'OpenSSL error when trying to enable FIPS:';
 
@@ -146,7 +147,7 @@ if (!sharedOpenSSL()) {
     'require("crypto").getFips()',
     { ...process.env, 'OPENSSL_CONF': ' ' });
 
-  if (hasOpenSSL3) {
+  if (hasOpenSSL(3)) {
     // Disabling FIPS mode should not throw after OpenSSL updates the default
     // property query.
     testHelper(
@@ -191,7 +192,7 @@ assert.ok(test_result === 1 || test_result === 0);
 // ("Error: Cannot set FIPS mode in a non-FIPS build.").
 // Due to this uncertainty the following tests are skipped when configured
 // with --shared-openssl.
-if (!sharedOpenSSL() && !hasOpenSSL3) {
+if (!sharedOpenSSL() && !hasOpenSSL(3)) {
   // OpenSSL config file should be able to turn on FIPS mode
   testHelper(
     'stdout',
@@ -224,7 +225,7 @@ if (!sharedOpenSSL() && !hasOpenSSL3) {
 // will not work as expected with that version.
 // TODO(danbev) Revisit these test once FIPS support is available in
 // OpenSSL 3.x.
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_OFF}`],
diff --git a/test/parallel/test-crypto-getcipherinfo.js b/test/parallel/test-crypto-getcipherinfo.js
index 5afd2e5a4208..faf45c766c5c 100644
--- a/test/parallel/test-crypto-getcipherinfo.js
+++ b/test/parallel/test-crypto-getcipherinfo.js
@@ -10,7 +10,7 @@ const {
   getCiphers,
   getCipherInfo,
 } = require('crypto');
-const { hasFIPS, hasOpenSSL3 } = require('../common/crypto');
+const { hasFIPS, hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 
@@ -18,7 +18,7 @@ const ciphers = getCiphers();
 
 assert.strictEqual(getCipherInfo(-1), undefined);
 assert.strictEqual(getCipherInfo('cipher that does not exist'), undefined);
-if (hasOpenSSL3) {
+if (hasOpenSSL(3)) {
   assert.deepStrictEqual(
     ciphers.filter((cipher) => cipher.includes('cbc-hmac')), []);
   for (const cipher of [
@@ -54,7 +54,7 @@ if (ciphers.includes('aes-128-wrap-inv')) {
 }
 assert(!ciphers.some((cipher) => /^\d+(?:\.\d+)+$/.test(cipher)));
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // A failed provider fetch must not contaminate the OpenSSL error queue.
   assert.throws(() => createHash('sha256', { outputLength: 28 }), {
     code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH',
@@ -63,7 +63,7 @@ if (!process.features.openssl_is_boringssl) {
 
 for (const cipher of ciphers) {
   const info = getCipherInfo(cipher);
-  if (process.features.openssl_is_boringssl && !info) {
+  if (isBoringSSL && !info) {
     // BoringSSL reports some legacy ciphers in getCiphers() but returns no
     // info for them (e.g. des-ede3, des-ede3-ecb, rc2-40-cbc).
     common.printSkipMessage(`Skipping unsupported ${cipher} test case`);
@@ -115,7 +115,7 @@ assert(getCipherInfo('aes-128-cbc', { ivLength: 16 }));
 
 assert(!getCipherInfo('aes-128-ccm', { ivLength: 1 }));
 assert(!getCipherInfo('aes-128-ccm', { ivLength: 14 }));
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   for (let n = 7; n <= 13; n++)
     assert(getCipherInfo('aes-128-ccm', { ivLength: n }));
 } else {
@@ -126,7 +126,7 @@ assert(!getCipherInfo('aes-128-ocb', { ivLength: 16 }));
 if (hasFIPS(3)) {
   assert.strictEqual(
     getCipherInfo('aes-128-ocb', { ivLength: 12 }), undefined);
-} else if (!process.features.openssl_is_boringssl) {
+} else if (!isBoringSSL) {
   for (let n = 1; n < 16; n++)
     assert(getCipherInfo('aes-128-ocb', { ivLength: n }));
 } else {
diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/parallel/test-crypto-hash-stream-pipe.js
index ac851646a918..c6b9433456ea 100644
--- a/test/parallel/test-crypto-hash-stream-pipe.js
+++ b/test/parallel/test-crypto-hash-stream-pipe.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -30,10 +32,10 @@ const crypto = require('crypto');
 
 const stream = require('stream');
 const s = new stream.PassThrough();
-const h = process.features.openssl_is_boringssl ?
+const h = isBoringSSL ?
   crypto.createHash('sha512') :
   crypto.createHash('sha3-512');
-const expect = process.features.openssl_is_boringssl ?
+const expect = isBoringSSL ?
   'fba055c6fd0c5b6645407749ed7a8b41' +
   'b8f629f2163c3ca3701d864adabda1f8' +
   '93c37bf82b22fdd151ba8e357f611da4' +
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index 44734e7aeb6f..7039b2c75d5c 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -1,5 +1,7 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
@@ -189,7 +191,7 @@ assert.throws(
 }
 
 // Test XOF hash functions and the outputLength option.
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const invalidXofLength = {
     code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH',
     name: 'Error',
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index bfde3b324331..7051c2fae07c 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,7 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -108,6 +108,23 @@ const { hasOpenSSL } = require('../common/crypto');
     code: 'ERR_OUT_OF_RANGE'
   });
 
+  {
+    const info = new Uint8Array(2048);
+    Object.defineProperty(info, 'byteLength', {
+      __proto__: null,
+      get() {
+        return 1;
+      },
+    });
+
+    const calls = [
+      () => hkdf('sha256', 'a', '', info, 10, common.mustNotCall()),
+      () => hkdfSync('sha256', 'a', '', info, 10),
+    ];
+    for (const call of calls)
+      assert.throws(call, { code: 'ERR_OUT_OF_RANGE' });
+  }
+
   assert.throws(
     () => hkdf('sha512', 'a', '', '', 64 * 255 + 1, common.mustNotCall()), {
       code: 'ERR_CRYPTO_INVALID_KEYLEN'
@@ -125,7 +142,7 @@ const algorithms = [
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!hasOpenSSL(3) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3) && !isBoringSSL)
   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
 
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
diff --git a/test/parallel/test-crypto-key-objects-ec-jwk-private.js b/test/parallel/test-crypto-key-objects-ec-jwk-private.js
new file mode 100644
index 000000000000..bede4e2f31c0
--- /dev/null
+++ b/test/parallel/test-crypto-key-objects-ec-jwk-private.js
@@ -0,0 +1,79 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const {
+  createECDH,
+  createPrivateKey,
+  createPublicKey,
+  getCurves,
+  getFips,
+  sign,
+  verify,
+} = require('crypto');
+
+const curves = [
+  ['prime256v1', 'P-256', 32,
+   'ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'],
+  ['secp384r1', 'P-384', 48,
+   'ffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf' +
+   '581a0db248b0a77aecec196accc52973'],
+  ['secp521r1', 'P-521', 66,
+   '01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff' +
+   'fa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'],
+];
+if (!getFips() && getCurves().includes('secp256k1')) {
+  curves.push(['secp256k1', 'secp256k1', 32,
+               'fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141']);
+}
+
+for (const [namedCurve, crv, width, orderHex] of curves) {
+  const order = BigInt(`0x${orderHex}`);
+  const encode = (scalar) => Buffer.from(
+    scalar.toString(16).padStart(width * 2, '0'), 'hex');
+  const makeJwk = (scalar) => {
+    const ecdh = createECDH(namedCurve);
+    ecdh.setPrivateKey(encode(scalar));
+    const point = ecdh.getPublicKey();
+    return {
+      kty: 'EC',
+      crv,
+      x: point.subarray(1, 1 + width).toString('base64url'),
+      y: point.subarray(1 + width).toString('base64url'),
+      d: encode(scalar).toString('base64url'),
+    };
+  };
+  const generator = makeJwk(1n);
+  const other = makeJwk(2n);
+  const message = Buffer.from('EC JWK private key consistency');
+
+  for (const jwk of [generator, other, makeJwk(order - 1n)]) {
+    const key = createPrivateKey({ format: 'jwk', key: jwk });
+    assert.deepStrictEqual(key.export({ format: 'jwk' }), jwk);
+    const publicJwk = { kty: jwk.kty, crv, x: jwk.x, y: jwk.y };
+    const publicKey = createPublicKey({ format: 'jwk', key: publicJwk });
+    assert(verify('sha256', message, publicKey, sign('sha256', message, key)));
+  }
+
+  const invalid = [
+    { ...generator, d: other.d },
+    { ...generator, x: other.x, y: other.y },
+    ...[0n, order, order + 1n].map((scalar) => ({
+      ...generator, d: encode(scalar).toString('base64url'),
+    })),
+    { ...generator, d: '' },
+    {
+      ...generator,
+      x: Buffer.alloc(width).toString('base64url'),
+      y: Buffer.alloc(width).toString('base64url'),
+    },
+  ];
+  for (const jwk of invalid) {
+    assert.throws(() => createPrivateKey({ format: 'jwk', key: jwk }), {
+      code: 'ERR_CRYPTO_INVALID_JWK',
+    });
+  }
+}
diff --git a/test/parallel/test-crypto-key-objects-raw.js b/test/parallel/test-crypto-key-objects-raw.js
index 024d5f6f199f..4a129d1a6185 100644
--- a/test/parallel/test-crypto-key-objects-raw.js
+++ b/test/parallel/test-crypto-key-objects-raw.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 // EC: NIST and OpenSSL curve names are both recognized for raw-public and raw-private
 {
@@ -67,7 +67,7 @@ const { hasOpenSSL } = require('../common/crypto');
     ['x25519', 'x25519_public.pem'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     rawPublicKeys.push(
       ['ed448', 'ed448_public.pem'],
       ['x448', 'x448_public.pem'],
@@ -76,7 +76,7 @@ const { hasOpenSSL } = require('../common/crypto');
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     rawPublicKeys.push(
       ['ml-dsa-44', 'ml_dsa_44_public.pem'],
       ['ml-kem-768', 'ml_kem_768_public.pem'],
@@ -122,7 +122,7 @@ if (hasOpenSSL(3, 5)) {
   const unsupportedKeyTypes = [
     ['rsa', 'rsa_public_2048.pem', 'rsa_private_2048.pem'],
   ];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     unsupportedKeyTypes.push(['dsa', 'dsa_public.pem', 'dsa_private.pem']);
   } else {
     common.printSkipMessage('Skipping unsupported dsa test case');
@@ -148,7 +148,7 @@ if (hasOpenSSL(3, 5)) {
   }
 
   // DH keys also don't support raw formats
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const privKeyObj = crypto.createPrivateKey(
       fixtures.readKey('dh_private.pem', 'ascii'));
     assert.throws(() => privKeyObj.export({ format: 'raw-private' }),
@@ -170,7 +170,7 @@ if (hasOpenSSL(3, 5)) {
 
 // PQC import throws when PQC is not supported
 if (!hasOpenSSL(3, 5)) {
-  const unsupported = process.features.openssl_is_boringssl ?
+  const unsupported = isBoringSSL ?
     // BoringSSL supports ML-DSA and ML-KEM-{768,1024}, but not ML-KEM-512 or SLH-DSA.
     ['ml-kem-512', 'slh-dsa-sha2-128f', 'slh-dsa-shake-128f'] :
     [
@@ -232,7 +232,7 @@ if (!hasOpenSSL(3, 5)) {
 }
 
 // ML-KEM: public keys of different type cannot be imported as the other type
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   const mlKem768Pub = crypto.createPublicKey(
     fixtures.readKey('ml_kem_768_public.pem', 'ascii'));
   const mlKem1024Pub = crypto.createPublicKey(
@@ -251,7 +251,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 }
 
 // ML-DSA: -44 and -65 public keys cannot be imported as the other type
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   const mlDsa44Pub = crypto.createPublicKey(
     fixtures.readKey('ml_dsa_44_public.pem', 'ascii'));
   const mlDsa65Pub = crypto.createPublicKey(
@@ -333,10 +333,10 @@ if (hasOpenSSL(3, 5)) {
     namedCurve: 'P-256',
   }), { code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS' });
 
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
-  for (const type of process.features.openssl_is_boringssl ?
+  for (const type of isBoringSSL ?
     ['ed25519', 'x25519'] :
     ['ed25519', 'ed448', 'x25519', 'x448']) {
     const priv = crypto.createPrivateKey(
@@ -364,7 +364,7 @@ if (hasOpenSSL(3, 5)) {
 }
 
 // raw-private cannot be used for ml-kem and ml-dsa
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   for (const type of ['ml-kem-768', 'ml-dsa-44']) {
     const priv = crypto.createPrivateKey(
       fixtures.readKey(`${type.replaceAll('-', '_')}_private_seed_only.pem`, 'ascii'));
@@ -472,7 +472,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
                 { code: 'ERR_INVALID_ARG_VALUE' });
 
   // PQC raw-seed -> createPublicKey
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     const mlDsaPriv = crypto.createPrivateKey(
       fixtures.readKey('ml_dsa_44_private_seed_only.pem', 'ascii'));
     const mlDsaPub = crypto.createPublicKey(
@@ -521,10 +521,10 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
 // x25519, ed25519, x448, and ed448 cannot be used as 'ec' namedCurve values
 {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     common.printSkipMessage('Skipping unsupported ed448/x448 test cases');
   }
-  for (const type of process.features.openssl_is_boringssl ?
+  for (const type of isBoringSSL ?
     ['ed25519', 'x25519'] :
     ['ed25519', 'x25519', 'ed448', 'x448']) {
     const priv = crypto.createPrivateKey(
diff --git a/test/parallel/test-crypto-key-objects-to-crypto-key.js b/test/parallel/test-crypto-key-objects-to-crypto-key.js
index 9d42b7719722..f699ec5462c8 100644
--- a/test/parallel/test-crypto-key-objects-to-crypto-key.js
+++ b/test/parallel/test-crypto-key-objects-to-crypto-key.js
@@ -404,7 +404,11 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   }
 }
 
-const unsupportedToCryptoKeyAlgorithms = new Set();
+const unsupportedToCryptoKeyAlgorithms = new Set([
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]);
 
 for (const name of Object.keys(kSupportedAlgorithms.importKey)) {
   const vectors = tests[name];
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index ba9a05387f21..fbd2ae6ff1c4 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -27,6 +27,7 @@ const {
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
@@ -351,7 +352,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
     createPrivateKey({ key: '' });
   }, hasOpenSSL(3) ? {
     message: 'error:1E08010C:DECODER routines::unsupported',
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     message: 'error:0900006e:PEM routines:OPENSSL_internal:NO_START_LINE',
     code: 'ERR_OSSL_PEM_NO_START_LINE',
     reason: 'NO_START_LINE',
@@ -384,7 +385,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   }, hasOpenSSL(3) ? {
     message: /error:1E08010C:DECODER routines::unsupported/,
     library: 'DECODER routines'
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     library: 'public key routines',
     message: 'error:06000066:public key routines:OPENSSL_internal:DECODE_ERROR'
   } : {
@@ -439,7 +440,7 @@ for (const info of [
   const fipsUnsupported =
     rejectsXCurves && keyType.startsWith('x');
 
-  if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
+  if (isBoringSSL && keyType.endsWith('448')) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
     continue;
   }
@@ -631,7 +632,7 @@ for (const info of [
   const { keyType, namedCurve } = info;
   const fipsUnsupported = fips3 && namedCurve === 'secp256k1';
 
-  if (process.features.openssl_is_boringssl && !getCurves().includes(namedCurve)) {
+  if (isBoringSSL && !getCurves().includes(namedCurve)) {
     common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
     continue;
   }
@@ -861,7 +862,7 @@ for (const info of [
     { code: 'ERR_CRYPTO_JWK_UNSUPPORTED_KEY_TYPE' });
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Test RSA-PSS.
   {
     // This key pair does not restrict the message digest algorithm or salt
diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
index ea35facbdc7e..52c82ea5725c 100644
--- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js
+++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('not supported by BoringSSL');
 
 const assert = require('assert');
@@ -12,25 +14,23 @@ const {
   generateKeyPair,
 } = require('crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-
 // Test async DSA key object generation.
 {
   generateKeyPair('dsa', {
-    modulusLength: hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL(3) ? 2048 : 512,
     divisorLength: 256
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL(3) ? 2048 : 512,
       divisorLength: 256
     });
 
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL(3) ? 2048 : 512,
       divisorLength: 256
     });
   }));
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index 6c7129c7efba..5d0254491cd2 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -4,20 +4,21 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('not supported by BoringSSL');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   assertApproximateSize,
   testSignVerify,
   spkiExp,
+  hasOpenSSL,
 } = require('../common/crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('not supported by BoringSSL');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
 
 // Test async DSA key generation.
 {
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
index bde6dc1d694b..9b81c700a231 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk-ec.js
@@ -8,12 +8,12 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // Test async elliptic curve key generation with 'jwk' encoding and named
 // curve.
 for (const curve of ['P-384', 'P-256', 'P-521', 'secp256k1']) {
-  if (process.features.openssl_is_boringssl && curve === 'secp256k1') {
+  if (isBoringSSL && curve === 'secp256k1') {
     common.printSkipMessage(`Skipping unsupported ${curve} test case`);
     continue;
   }
diff --git a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
index cfef18c889b6..9985631b4093 100644
--- a/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
+++ b/test/parallel/test-crypto-keygen-async-elliptic-curve-jwk.js
@@ -8,13 +8,13 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const rejectsXCurves = hasFIPS(3, 5);
 
 // Test async elliptic curve key generation with 'jwk' encoding.
 {
   for (const type of ['ed25519', 'ed448', 'x25519', 'x448']) {
-    if (process.features.openssl_is_boringssl && type.endsWith('448')) {
+    if (isBoringSSL && type.endsWith('448')) {
       common.printSkipMessage(`Skipping unsupported ${type} test case`);
       continue;
     }
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
index 246cbe5dd1ac..cd7e59be97fa 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
@@ -4,20 +4,21 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('BoringSSL does not support paramEncoding: explicit');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
+  hasOpenSSL,
 } = require('../common/crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+if (isBoringSSL)
+  common.skip('BoringSSL does not support paramEncoding: explicit');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
 // private key with paramEncoding explicit.
@@ -43,7 +44,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index 081e709f46ec..5c0878fc634f 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -4,14 +4,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
-  common.skip('BoringSSL does not support paramEncoding: explicit');
-
-const assert = require('assert');
-const {
-  generateKeyPair,
-} = require('crypto');
 const {
+  isBoringSSL,
   hasFIPS,
   testSignVerify,
   spkiExp,
@@ -19,6 +13,14 @@ const {
   hasOpenSSL,
 } = require('../common/crypto');
 
+if (isBoringSSL)
+  common.skip('BoringSSL does not support paramEncoding: explicit');
+
+const assert = require('assert');
+const {
+  generateKeyPair,
+} = require('crypto');
+
 {
   // Test async explicit elliptic curve key generation with an encrypted
   // private key.
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
index 8084cdfc0b3b..e6209a09041d 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve.js
@@ -4,18 +4,20 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  testSignVerify,
+  spkiExp,
+  sec1Exp,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support paramEncoding: explicit');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const {
-  testSignVerify,
-  spkiExp,
-  sec1Exp,
-} = require('../common/crypto');
 
 // Test async explicit elliptic curve key generation, e.g. for ECDSA,
 // with a SEC1 private key with paramEncoding explicit.
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
index 4c11401d0fc5..ba86fcdb94e3 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
@@ -12,7 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
-  hasOpenSSL3,
+  hasOpenSSL,
 } = require('../common/crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -39,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  hasOpenSSL3 ? {
+                  hasOpenSSL(3) ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 52765f3d7fe7..90d32cd73bc4 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -4,7 +4,13 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support arbitrary RSA modulus length ' +
               'or RSA-PSS/DSA key generation');
 
@@ -12,7 +18,6 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
 
diff --git a/test/parallel/test-crypto-keygen-dh-classic.js b/test/parallel/test-crypto-keygen-dh-classic.js
index 13c5db2d0603..a78d068ef79d 100644
--- a/test/parallel/test-crypto-keygen-dh-classic.js
+++ b/test/parallel/test-crypto-keygen-dh-classic.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support DH key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // Test classic Diffie-Hellman key generation.
 {
diff --git a/test/parallel/test-crypto-keygen-eddsa.js b/test/parallel/test-crypto-keygen-eddsa.js
index 5dbdf9a7aeea..0f9f8421ce77 100644
--- a/test/parallel/test-crypto-keygen-eddsa.js
+++ b/test/parallel/test-crypto-keygen-eddsa.js
@@ -8,13 +8,13 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const rejectsXCurves = hasFIPS(3, 5);
 
 // Test EdDSA key generation.
 {
   for (const keyType of ['ed25519', 'ed448', 'x25519', 'x448']) {
-    if (process.features.openssl_is_boringssl && keyType.endsWith('448')) {
+    if (isBoringSSL && keyType.endsWith('448')) {
       common.printSkipMessage(`Skipping unsupported ${keyType} test case`);
       continue;
     }
diff --git a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
index 9d1fdf23bc0b..91ace4caff67 100644
--- a/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
+++ b/test/parallel/test-crypto-keygen-invalid-parameter-encoding-dsa.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support DSA key pair generation');
 
 const assert = require('assert');
@@ -12,7 +14,6 @@ const assert = require('assert');
 const {
   generateKeyPairSync,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 const fips3 = hasFIPS(3);
 
diff --git a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
index 778899972863..44243791b38f 100644
--- a/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
+++ b/test/parallel/test-crypto-keygen-no-rsassa-pss-params.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // 'rsa-pss' should not add a RSASSA-PSS-params sequence by default.
 // Regression test for: https://github.com/nodejs/node/issues/39936
diff --git a/test/parallel/test-crypto-keygen-raw.js b/test/parallel/test-crypto-keygen-raw.js
index 41ef9362dcac..e748830757f8 100644
--- a/test/parallel/test-crypto-keygen-raw.js
+++ b/test/parallel/test-crypto-keygen-raw.js
@@ -11,14 +11,14 @@ const {
   createPublicKey,
   createPrivateKey,
 } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const rejectsXCurves = hasFIPS(3, 5);
 
 // Test generateKeyPairSync with raw encoding for EdDSA/ECDH key types.
 {
   const types = ['ed25519', 'x25519'];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     types.push('ed448', 'x448');
   }
   for (const type of types) {
@@ -59,7 +59,7 @@ const rejectsXCurves = hasFIPS(3, 5);
 // Test async generateKeyPair with raw encoding for EdDSA/ECDH key types.
 {
   const types = ['ed25519', 'x25519'];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     types.push('ed448', 'x448');
   }
   for (const type of types) {
@@ -174,7 +174,7 @@ const rejectsXCurves = hasFIPS(3, 5);
 }
 
 // Test error: raw with DSA.
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert.throws(() => generateKeyPairSync('dsa', {
     modulusLength: 2048,
     publicKeyEncoding: { format: 'raw-public' },
@@ -221,7 +221,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // PQC key types
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   // Test raw encoding for ML-DSA key types (raw-public + raw-seed only).
   {
     for (const type of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) {
@@ -248,7 +248,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   // Test raw encoding for ML-KEM key types (raw-public + raw-seed only).
   {
     for (const type of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
-      if (process.features.openssl_is_boringssl && type === 'ml-kem-512') {
+      if (isBoringSSL && type === 'ml-kem-512') {
         common.printSkipMessage(`Skipping unsupported ${type} test case`);
         continue;
       }
@@ -275,7 +275,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   // Test raw encoding for SLH-DSA key types.
   {
     for (const type of ['slh-dsa-sha2-128f', 'slh-dsa-shake-128f']) {
-      if (process.features.openssl_is_boringssl) {
+      if (isBoringSSL) {
         common.printSkipMessage(`Skipping unsupported ${type} test case`);
         continue;
       }
@@ -290,7 +290,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
   }
 
   // Test error: raw-seed with SLH-DSA (not supported).
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.throws(() => generateKeyPairSync('slh-dsa-sha2-128f', {
       publicKeyEncoding: { format: 'raw-public' },
       privateKeyEncoding: { format: 'raw-seed' },
diff --git a/test/parallel/test-crypto-keygen-rfc8017-9-1.js b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
index 3234084afe10..e1781093c0c2 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-9-1.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-9-1.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // RFC 8017, 9.1.: "Assuming that the mask generation function is based on a
 // hash function, it is RECOMMENDED that the hash function be the same as the
diff --git a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
index f7cb70560e7e..f1543462c394 100644
--- a/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
+++ b/test/parallel/test-crypto-keygen-rfc8017-a-2-3.js
@@ -4,14 +4,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
-const { hasFIPS } = require('../common/crypto');
 
 // RFC 8017, A.2.3.: "For a given hashAlgorithm, the default value of
 // saltLength is the octet length of the hash value."
diff --git a/test/parallel/test-crypto-keygen-rsa-pss.js b/test/parallel/test-crypto-keygen-rsa-pss.js
index 88d522a223b9..386db4fe0115 100644
--- a/test/parallel/test-crypto-keygen-rsa-pss.js
+++ b/test/parallel/test-crypto-keygen-rsa-pss.js
@@ -4,7 +4,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl)
+const {
+  isBoringSSL,
+  hasFIPS,
+  testEncryptDecrypt,
+  testSignVerify,
+} = require('../common/crypto');
+
+if (isBoringSSL)
   common.skip('BoringSSL does not support RSA-PSS key pair generation');
 
 const assert = require('assert');
@@ -12,11 +19,6 @@ const {
   constants,
   generateKeyPair,
 } = require('crypto');
-const {
-  hasFIPS,
-  testEncryptDecrypt,
-  testSignVerify,
-} = require('../common/crypto');
 
 // Test RSA-PSS.
 {
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index c525a54aa434..a68c7c07c936 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -14,8 +14,11 @@ const {
 } = require('crypto');
 const { inspect } = require('util');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const {
+  hasOpenSSL,
+  isBoringSSL: commonIsBoringSSL,
+} = require('../common/crypto');
+const isBoringSSL = commonIsBoringSSL;
 
 // Test invalid parameter encoding.
 {
@@ -379,7 +382,7 @@ const isBoringSSL = process.features.openssl_is_boringssl;
   let invalidExponentError = /bad e value/;
   if (isBoringSSL) {
     invalidExponentError = /BAD_E_VALUE/;
-  } else if (hasOpenSSL3) {
+  } else if (hasOpenSSL(3)) {
     invalidExponentError = /exponent/;
   }
   for (const publicExponent of [1, 1 + 0x10001]) {
diff --git a/test/parallel/test-crypto-mac-cache-snapshot.js b/test/parallel/test-crypto-mac-cache-snapshot.js
index 1fd37367d2a8..024a4afe8c36 100644
--- a/test/parallel/test-crypto-mac-cache-snapshot.js
+++ b/test/parallel/test-crypto-mac-cache-snapshot.js
@@ -4,8 +4,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (!hasOpenSSL(3) || isBoringSSL)
   common.skip('this test requires OpenSSL 3 EVP_MAC support');
 
 const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-mac-cache.js b/test/parallel/test-crypto-mac-cache.js
index dfe99e943bb2..a836ef92657e 100644
--- a/test/parallel/test-crypto-mac-cache.js
+++ b/test/parallel/test-crypto-mac-cache.js
@@ -5,8 +5,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3 || process.features.openssl_is_boringssl)
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
+if (!hasOpenSSL(3) || isBoringSSL)
   common.skip('this test requires OpenSSL 3 EVP_MAC support');
 
 const assert = require('node:assert');
diff --git a/test/parallel/test-crypto-mac-errors.js b/test/parallel/test-crypto-mac-errors.js
index 43e464bb737e..8bc8cebfcf51 100644
--- a/test/parallel/test-crypto-mac-errors.js
+++ b/test/parallel/test-crypto-mac-errors.js
@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 EVP_MAC support is required');
 }
 
diff --git a/test/parallel/test-crypto-mac-unsupported.js b/test/parallel/test-crypto-mac-unsupported.js
index 68bb79f301e5..1721e9d1c1a7 100644
--- a/test/parallel/test-crypto-mac-unsupported.js
+++ b/test/parallel/test-crypto-mac-unsupported.js
@@ -6,9 +6,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (hasOpenSSL3 && !process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3) && !isBoringSSL) {
   common.skip('this test requires a build without EVP_MAC support');
 }
 
diff --git a/test/parallel/test-crypto-mac-vectors.js b/test/parallel/test-crypto-mac-vectors.js
index ec9f0cffe877..19544ccf4ec1 100644
--- a/test/parallel/test-crypto-mac-vectors.js
+++ b/test/parallel/test-crypto-mac-vectors.js
@@ -8,9 +8,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 EVP_MAC support is required');
 }
 
diff --git a/test/parallel/test-crypto-mac.js b/test/parallel/test-crypto-mac.js
index f41bd86509eb..c275b87a0e6c 100644
--- a/test/parallel/test-crypto-mac.js
+++ b/test/parallel/test-crypto-mac.js
@@ -8,9 +8,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3) || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 EVP_MAC support is required');
 }
 
diff --git a/test/parallel/test-crypto-negative-zero.js b/test/parallel/test-crypto-negative-zero.js
index 0af9220569c3..0e9525fcaf6c 100644
--- a/test/parallel/test-crypto-negative-zero.js
+++ b/test/parallel/test-crypto-negative-zero.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 function getOutcome(fn) {
   try {
@@ -110,7 +110,7 @@ function assertSameErrorOrSuccess(actual, expected) {
                          }));
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert.strictEqual(
     crypto.createHash('shake128', { outputLength: -0 }).digest('hex'),
     '',
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index 90d19ff97fcb..0354aad8b0be 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('node:assert/strict');
@@ -57,3 +57,21 @@ if (isMainThread) {
   assert(common.nodeProcessAborted(cp.status, cp.signal),
          `process did not abort, code:${cp.status} signal:${cp.signal}`);
 }
+
+// AIX keeps OpenSSL as V8's entropy source, so a DRBG that cannot be
+// fetched still aborts at startup there.
+if (!common.isAIX) {
+  // A configuration whose random section names a DRBG that cannot be
+  // fetched starts normally; the first crypto call fails, without a hang.
+  const fixtures = require('../common/fixtures');
+  const { spawnSync } = require('node:child_process');
+  const randomConf = fixtures.path('openssl3-conf', 'random_unavailable.cnf');
+  const cp = spawnSync(process.execPath,
+                       [ `--openssl-config=${randomConf}`, '-e',
+                         'require("node:crypto").randomBytes(8)' ],
+                       { encoding: 'utf8' });
+  assert(!common.nodeProcessAborted(cp.status, cp.signal),
+         `process aborted, code:${cp.status} signal:${cp.signal}`);
+  assert.strictEqual(cp.status, 1);
+  assert.match(cp.stderr, /unable to fetch drbg/);
+}
diff --git a/test/parallel/test-crypto-oneshot-hash-xof.js b/test/parallel/test-crypto-oneshot-hash-xof.js
index 656e7944396e..46b60b22c755 100644
--- a/test/parallel/test-crypto-oneshot-hash-xof.js
+++ b/test/parallel/test-crypto-oneshot-hash-xof.js
@@ -1,13 +1,15 @@
 'use strict';
+
 // This tests crypto.hash() works.
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto) common.skip('missing crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   common.skip('BoringSSL does not support XOF hash functions');
 }
 
diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
index 6e7a7fffee58..dce34409400a 100644
--- a/test/parallel/test-crypto-padding.js
+++ b/test/parallel/test-crypto-padding.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 // Input data.
 const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -83,7 +83,7 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
 assert.throws(function() {
   // Input must have block length %.
   enc(ODD_LENGTH_PLAIN, false);
-}, hasOpenSSL3 ? {
+}, hasOpenSSL(3) ? {
   message: /wrong[\s_]final[\s_]block[\s_]length/i,
   code: /ERR_OSSL(_EVP)?_WRONG_FINAL_BLOCK_LENGTH/,
   reason: /wrong[\s_]final[\s_]block[\s_]length/i,
diff --git a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
index 8f2a10725c94..f4e1d781abc3 100644
--- a/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
+++ b/test/parallel/test-crypto-pqc-encrypted-pkcs8.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -21,7 +21,7 @@ const algorithms = new Set([
   'ml-kem-512', 'ml-kem-768', 'ml-kem-1024',
 ]);
 // BoringSSL does not support ML-KEM-512.
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   algorithms.delete('ml-kem-512');
 }
 
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
index f2a19799c515..cd8f8c926f5b 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-dsa.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [
     }
   }
 
-  if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+  if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
       code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
     });
@@ -120,7 +120,7 @@ for (const [asymmetricKeyType, pubLen] of [
         [keys.private_seed_only, true, true],
         [keys.private_priv_only, false, false],
       ]) {
-        if (process.features.openssl_is_boringssl && !seedOnly) {
+        if (isBoringSSL && !seedOnly) {
           common.printSkipMessage('Skipping unsupported private key format test');
           continue;
         }
diff --git a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
index 81353b5115dd..d08a479f421c 100644
--- a/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-key-objects-ml-kem.js
@@ -4,7 +4,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
@@ -100,7 +100,7 @@ for (const [asymmetricKeyType, pubLen] of [
     }
   }
 
-  if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+  if (!hasOpenSSL(3, 5) && !isBoringSSL) {
     assert.throws(() => createPublicKey(keys.public), {
       code: hasOpenSSL(3) ? 'ERR_OSSL_EVP_DECODE_ERROR' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
     });
@@ -110,7 +110,7 @@ for (const [asymmetricKeyType, pubLen] of [
         code: hasOpenSSL(3) ? 'ERR_OSSL_UNSUPPORTED' : 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM',
       });
     }
-  } else if (process.features.openssl_is_boringssl && asymmetricKeyType === 'ml-kem-512') {
+  } else if (isBoringSSL && asymmetricKeyType === 'ml-kem-512') {
     // BoringSSL does not support ML-KEM-512.
     assert.throws(() => createPublicKey(keys.public),
                   { code: 'ERR_OSSL_EVP_UNSUPPORTED_ALGORITHM' });
@@ -123,7 +123,7 @@ for (const [asymmetricKeyType, pubLen] of [
     assertPublicKey(publicKey);
 
     {
-      const entries = process.features.openssl_is_boringssl ?
+      const entries = isBoringSSL ?
         // BoringSSL only supports the seed-only PKCS#8 private key encoding.
         [[keys.private_seed_only, true]] :
         [
diff --git a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
index e6534c988c4e..9f9b25bed8b0 100644
--- a/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-keygen-ml-dsa.js
@@ -4,14 +4,14 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   for (const asymmetricKeyType of ['ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87']) {
     assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), {
       code: 'ERR_INVALID_ARG_VALUE',
diff --git a/test/parallel/test-crypto-pqc-keygen-ml-kem.js b/test/parallel/test-crypto-pqc-keygen-ml-kem.js
index 620f65c3a8d1..bcc5e5996683 100644
--- a/test/parallel/test-crypto-pqc-keygen-ml-kem.js
+++ b/test/parallel/test-crypto-pqc-keygen-ml-kem.js
@@ -4,19 +4,19 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
 
-const algorithms = process.features.openssl_is_boringssl ?
+const algorithms = isBoringSSL ?
   // BoringSSL does not support ML-KEM-512.
   ['ml-kem-768', 'ml-kem-1024'] :
   ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024'];
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   for (const asymmetricKeyType of ['ml-kem-512', 'ml-kem-768', 'ml-kem-1024']) {
     assert.throws(() => generateKeyPair(asymmetricKeyType, common.mustNotCall()), {
       code: 'ERR_INVALID_ARG_VALUE',
@@ -72,7 +72,7 @@ if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
   }
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   assert.throws(() => generateKeyPair('ml-kem-512', common.mustNotCall()), {
     code: 'ERR_INVALID_ARG_VALUE',
     message: /The argument 'type' must be a supported key type/
diff --git a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
index 535e6a33d5cc..e095269bf610 100644
--- a/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
+++ b/test/parallel/test-crypto-pqc-sign-verify-ml-dsa.js
@@ -4,9 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -39,7 +39,7 @@ for (const [asymmetricKeyType, sigLen] of [
     [keys.private_seed_only, true],
     [keys.private_priv_only, false],
   ]) {
-    if (process.features.openssl_is_boringssl && !seedOnly) {
+    if (isBoringSSL && !seedOnly) {
       common.printSkipMessage('Skipping unsupported private key format test');
       continue;
     }
@@ -52,7 +52,7 @@ for (const [asymmetricKeyType, sigLen] of [
         assert.strictEqual(verify(undefined, data, keys.public, Buffer.alloc(sigLen)), false);
         assert.strictEqual(verify(undefined, data, keys.public, signature), true);
         assert.strictEqual(verify(undefined, data, privateKey, signature), true);
-        const code = process.features.openssl_is_boringssl ?
+        const code = isBoringSSL ?
           'ERR_OSSL_EVP_COMMAND_NOT_SUPPORTED' : 'ERR_OSSL_INVALID_DIGEST';
         assert.throws(() => sign('sha256', data, privateKey), { code });
         assert.throws(
@@ -72,7 +72,7 @@ for (const [asymmetricKeyType, sigLen] of [
           }));
         }));
 
-        const message = process.features.openssl_is_boringssl ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/;
+        const message = isBoringSSL ? /COMMAND_NOT_SUPPORTED/ : /invalid digest/;
         sign('sha256', data, privateKey, common.expectsError(message));
         verify('sha256', data, keys.public, Buffer.alloc(sigLen), common.expectsError(message));
       }
diff --git a/test/parallel/test-crypto-prepare-asymmetric-key.js b/test/parallel/test-crypto-prepare-asymmetric-key.js
new file mode 100644
index 000000000000..de5ea1b483d1
--- /dev/null
+++ b/test/parallel/test-crypto-prepare-asymmetric-key.js
@@ -0,0 +1,101 @@
+'use strict';
+
+// Flags: --expose-internals
+
+const common = require('../common');
+if (!common.hasCrypto) common.skip('missing crypto');
+const assert = require('node:assert');
+const crypto = require('node:crypto');
+const fixtures = require('../common/fixtures');
+const {
+  prepareAsymmetricKey,
+  getKeyObjectHandle,
+  kConsumePublic,
+  kConsumePrivate,
+  kCreatePublic,
+  kCreatePrivate,
+} = require('internal/crypto/keys');
+
+const pem = fixtures.readKey('ec_p256_private.pem');
+const keyObject = crypto.createPrivateKey(pem);
+const contexts = [kConsumePublic, kConsumePrivate, kCreatePublic, kCreatePrivate];
+
+for (const input of [
+  pem,
+  new Uint8Array(pem),
+  new DataView(Uint8Array.from(pem).buffer),
+  Uint8Array.from(pem).buffer,
+  new SharedArrayBuffer(pem.length),
+]) {
+  Object.defineProperty(input, 'key', { get: common.mustNotCall() });
+  Object.defineProperty(input, 'format', { get: common.mustNotCall() });
+  Object.defineProperty(input, Symbol.toStringTag, { value: 'KeyObject' });
+  for (const context of contexts) {
+    assert.strictEqual(prepareAsymmetricKey(input, context).data, input);
+    assert.strictEqual(prepareAsymmetricKey({ key: input }, context).data, input);
+  }
+}
+
+for (const context of [kConsumePublic, kConsumePrivate, kCreatePublic]) {
+  const options = { key: keyObject, format: 'raw-public', asymmetricKeyType: 'invalid' };
+  assert.strictEqual(prepareAsymmetricKey(options, context).data, getKeyObjectHandle(keyObject));
+}
+
+{
+  const reads = [];
+  const values = { key: pem.toString(), encoding: 'utf8', format: 'pem' };
+  const options = {};
+  for (const name of ['key', 'encoding', 'format', 'properties', 'type', 'cipher', 'passphrase']) {
+    Object.defineProperty(options, name, {
+      get() {
+        reads.push(name);
+        return values[name];
+      },
+    });
+  }
+  assert.deepStrictEqual(prepareAsymmetricKey(options, kConsumePrivate).data, pem);
+  assert.deepStrictEqual(reads, [
+    'key', 'encoding', 'format', 'properties', 'format', 'type', 'cipher', 'passphrase', 'encoding',
+  ]);
+}
+
+{
+  const input = {
+    key: pem.toString(),
+    encoding: 'invalid',
+    get format() { return 'pem'; },
+    get type() { return assert.fail('String conversion must precede encoding option parsing'); },
+  };
+  assert.throws(() => prepareAsymmetricKey(input, kConsumePrivate), { code: 'ERR_UNKNOWN_ENCODING' });
+}
+
+{
+  const raw = keyObject.export({ format: 'raw-private' });
+  const input = { key: raw, format: 'raw-private', asymmetricKeyType: 'ec', namedCurve: 'P-256' };
+  assert.strictEqual(prepareAsymmetricKey(input, kConsumePrivate).data, raw);
+  assert.throws(() => prepareAsymmetricKey({ ...input, key: raw.toString('hex') }, kConsumePrivate), {
+    code: 'ERR_INVALID_ARG_TYPE',
+  });
+}
+
+for (const encoding of [undefined, 'buffer', 'utf8', 'hex', 'base64']) {
+  const inputEncoding = encoding === 'buffer' ? 'utf8' : encoding;
+  const passphrase = Buffer.from('password');
+  const result = prepareAsymmetricKey({
+    key: pem.toString(inputEncoding),
+    passphrase: passphrase.toString(inputEncoding),
+    encoding,
+  }, kConsumePrivate);
+  assert.deepStrictEqual(result.data, pem);
+  assert.deepStrictEqual(result.passphrase, passphrase);
+}
+
+for (const [options, optionName] of [
+  [{ format: 'invalid' }, 'format'],
+  [{ format: 'der', type: 'invalid' }, 'type'],
+]) {
+  assert.throws(() => prepareAsymmetricKey({ key: pem, ...options }, kConsumePrivate, 'options.key'), {
+    code: 'ERR_INVALID_ARG_VALUE',
+    message: new RegExp(`options\\.key\\.${optionName}`),
+  });
+}
diff --git a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
index 1afc5df8d94d..3ca57279c00f 100644
--- a/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
+++ b/test/parallel/test-crypto-provider-cipher-cache-snapshot.js
@@ -5,12 +5,12 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
 const { buildSnapshot, runWithSnapshot } = require('../common/snapshot');
 
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const entry = fixtures.path('snapshot', 'crypto-provider-cipher-cache.js');
diff --git a/test/parallel/test-crypto-provider-cipher-cache.js b/test/parallel/test-crypto-provider-cipher-cache.js
index bde9988480ed..3654ae982435 100644
--- a/test/parallel/test-crypto-provider-cipher-cache.js
+++ b/test/parallel/test-crypto-provider-cipher-cache.js
@@ -5,8 +5,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3)
+const { hasOpenSSL } = require('../common/crypto');
+if (!hasOpenSSL(3))
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('assert');
diff --git a/test/parallel/test-crypto-provider-hash-options.js b/test/parallel/test-crypto-provider-hash-options.js
index 609d00d7f7b0..ecccc02f01e4 100644
--- a/test/parallel/test-crypto-provider-hash-options.js
+++ b/test/parallel/test-crypto-provider-hash-options.js
@@ -3,12 +3,14 @@
 
 const common = require('../common');
 
+const { isBoringSSL } = require('../common/crypto');
+
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
 if (Number(process.versions.openssl.split('.')[0]) < 4 ||
-    process.features.openssl_is_boringssl) {
+    isBoringSSL) {
   common.skip('OpenSSL 4 provider support is required');
 }
 
diff --git a/test/parallel/test-crypto-provider-hashes.js b/test/parallel/test-crypto-provider-hashes.js
index 166efaa0d7fd..1cf453f9b22b 100644
--- a/test/parallel/test-crypto-provider-hashes.js
+++ b/test/parallel/test-crypto-provider-hashes.js
@@ -26,9 +26,9 @@ const {
   sign,
   verify,
 } = require('node:crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3 || process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3) || isBoringSSL) {
   common.skip('OpenSSL 3 provider support is required');
 }
 
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index bda98652cf59..7c56dcd28dc8 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -12,6 +12,7 @@ const fixtures = require('../common/fixtures');
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 const fips3 = hasFIPS(3);
 const fips35 = hasFIPS(3, 5);
@@ -74,7 +75,7 @@ const openssl1DecryptError = {
 const decryptError = fips4 ?
   { code: 'ERR_OSSL_BAD_DECRYPT' } : hasOpenSSL(3) ?
     { message: 'error:1C800064:Provider routines::bad decrypt' } :
-    process.features.openssl_is_boringssl ? {
+    isBoringSSL ? {
       message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
       code: 'ERR_OSSL_BAD_DECRYPT',
       reason: 'BAD_DECRYPT',
@@ -87,7 +88,7 @@ const decryptPrivateKeyError = fips4 ? {
   code: 'ERR_OSSL_BAD_DECRYPT',
 } : hasOpenSSL(3) ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
-} : process.features.openssl_is_boringssl ? {
+} : isBoringSSL ? {
   message: 'error:1e000065:Cipher functions:OPENSSL_internal:BAD_DECRYPT',
 } : openssl1DecryptError;
 
@@ -373,7 +374,7 @@ function test_rsa(padding, encryptOaepHash, decryptOaepHash) {
 test_rsa('RSA_NO_PADDING');
 test_rsa('RSA_PKCS1_OAEP_PADDING');
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   test_rsa('RSA_PKCS1_PADDING');
 } else {
   common.printSkipMessage('Skipping unsupported RSA_PKCS1_PADDING test case');
@@ -548,7 +549,7 @@ assert.throws(() => {
 //
 // Test DSA signing and verification
 //
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const input = 'I AM THE WALRUS';
 
   // DSA signatures vary across runs so there is no static string to verify
@@ -586,7 +587,7 @@ if (!process.features.openssl_is_boringssl) {
 //
 // Test DSA signing and verification with PKCS#8 private key
 //
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const input = 'I AM THE WALRUS';
 
   // DSA signatures vary across runs so there is no static string to verify
@@ -618,7 +619,7 @@ const input = 'I AM THE WALRUS';
   }, decryptPrivateKeyError);
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // DSA signatures vary across runs so there is no static string to verify
   // against.
   const dsaDigest = fips3 ? 'SHA256' : 'SHA1';
diff --git a/test/parallel/test-crypto-rsa-multiprime-jwk.js b/test/parallel/test-crypto-rsa-multiprime-jwk.js
new file mode 100644
index 000000000000..be434c76e828
--- /dev/null
+++ b/test/parallel/test-crypto-rsa-multiprime-jwk.js
@@ -0,0 +1,62 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const fixtures = require('../common/fixtures');
+const { hasFIPS } = require('../common/crypto');
+const {
+  createPrivateKey,
+} = require('crypto');
+const { subtle } = globalThis.crypto;
+
+if (process.features.openssl_is_boringssl)
+  common.skip('multi-prime RSA is not available with BoringSSL');
+if (hasFIPS())
+  common.skip('multi-prime RSA is not available in FIPS mode');
+
+const privateKey = createPrivateKey(
+  fixtures.readKey('rsa_private_2048_3_primes.pem'));
+const pkcs8 = privateKey.export({ format: 'der', type: 'pkcs8' });
+const jwk = privateKey.export({ format: 'jwk' });
+
+assert.strictEqual(jwk.oth.length, 1);
+assert.deepStrictEqual(Object.keys(jwk.oth[0]), ['r', 'd', 't']);
+
+const importedKey = createPrivateKey({ key: jwk, format: 'jwk' });
+assert.deepStrictEqual(importedKey.export({ format: 'jwk' }), jwk);
+assert.deepStrictEqual(
+  importedKey.export({ format: 'der', type: 'pkcs8' }),
+  pkcs8);
+
+for (const field of ['r', 'd', 't']) {
+  const invalidJwk = {
+    ...jwk,
+    oth: [{ ...jwk.oth[0] }],
+  };
+  delete invalidJwk.oth[0][field];
+  assert.throws(
+    () => createPrivateKey({ key: invalidJwk, format: 'jwk' }),
+    { code: 'ERR_CRYPTO_INVALID_JWK' });
+}
+
+(async () => {
+  const algorithm = { name: 'RSA-PSS', hash: 'SHA-256' };
+  const cryptoKey = await subtle.importKey(
+    'pkcs8', pkcs8, algorithm, true, ['sign']);
+  const exportedJwk = await subtle.exportKey('jwk', cryptoKey);
+
+  const exportedKeyMaterial = { ...exportedJwk };
+  delete exportedKeyMaterial.key_ops;
+  delete exportedKeyMaterial.ext;
+  delete exportedKeyMaterial.alg;
+  assert.deepStrictEqual(exportedKeyMaterial, jwk);
+
+  const importedCryptoKey = await subtle.importKey(
+    'jwk', exportedJwk, algorithm, true, ['sign']);
+  assert.deepStrictEqual(
+    Buffer.from(await subtle.exportKey('pkcs8', importedCryptoKey)),
+    pkcs8);
+})().then(common.mustCall());
diff --git a/test/parallel/test-crypto-scrypt.js b/test/parallel/test-crypto-scrypt.js
index 3012a8fa55d5..0f033e05d6d2 100644
--- a/test/parallel/test-crypto-scrypt.js
+++ b/test/parallel/test-crypto-scrypt.js
@@ -5,7 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const isFips = hasFIPS(3);
 
 if (typeof crypto.scrypt !== 'function' || typeof crypto.scryptSync !== 'function')
@@ -203,7 +203,7 @@ for (const options of toobig) {
   const expected = isFips ? {
     code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
   } : {
-    message: process.features.openssl_is_boringssl ?
+    message: isBoringSSL ?
       /Invalid scrypt params:.*(INVALID_PARAMETERS|MEMORY_LIMIT_EXCEEDED)/ :
       /Invalid scrypt params:.*memory limit exceeded/,
     code: 'ERR_CRYPTO_INVALID_SCRYPT_PARAMS',
diff --git a/test/parallel/test-crypto-sec-level.js b/test/parallel/test-crypto-sec-level.js
index f2c0e3900624..ff32b29bb2b7 100644
--- a/test/parallel/test-crypto-sec-level.js
+++ b/test/parallel/test-crypto-sec-level.js
@@ -2,6 +2,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -15,7 +17,7 @@ const assert = require('assert');
 // This test simply validates that we can get some value for the secLevel
 // when needed by tests.
 const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   assert.strictEqual(secLevel, 0);
 } else {
   assert.ok(secLevel >= 0 && secLevel <= 5);
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 8bd93c5281da..3c79d1bb8a6d 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -13,14 +13,23 @@ if (common.isASan) {
   common.skip('ASan does not play well with secure heap allocations');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (common.hasV8Sandbox) {
+  common.skip('--secure-heap is not available with the V8 sandbox');
+}
+
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   common.skip('BoringSSL does not support secure heap');
 }
 
 const assert = require('assert');
 const { fork } = require('child_process');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 const {
   secureHeapUsed,
   createDiffieHellman,
@@ -61,6 +70,28 @@ if (process.argv[2] === 'child') {
   return;
 }
 
+if (process.argv[2] === 'workers') {
+  // Eight Workers held alive at once. A 1 KiB secure heap has room for a
+  // few DRBGs only, so an isolate setup that drew its entropy through
+  // OpenSSL would fail for the later Workers and abort the process.
+  const { Worker } = require('worker_threads');
+  const i32 = new Int32Array(new SharedArrayBuffer(4));
+  let online = 0;
+  for (let i = 0; i < 8; i++) {
+    const worker = new Worker(
+      'const { workerData } = require("worker_threads");' +
+      'Atomics.wait(workerData.i32, 0, 0);',
+      { eval: true, workerData: { i32 } });
+    worker.on('online', () => {
+      if (++online === 8) {
+        Atomics.store(i32, 0, 1);
+        Atomics.notify(i32, 0);
+      }
+    });
+  }
+  return;
+}
+
 const child = fork(
   process.argv[1],
   ['child'],
@@ -70,6 +101,19 @@ child.on('exit', common.mustCall((code) => {
   assert.strictEqual(code, 0);
 }));
 
+// AIX keeps OpenSSL as V8's entropy source, so a Worker's isolate setup
+// still draws on the secure heap there.
+if (!common.isAIX) {
+  const child = fork(
+    process.argv[1],
+    ['workers'],
+    { execArgv: ['--secure-heap=1024', '--secure-heap-min=4'] });
+  child.on('exit', common.mustCall((code, signal) => {
+    assert.strictEqual(signal, null);
+    assert.strictEqual(code, 0);
+  }));
+}
+
 {
   const child = fork(fixtures.path('a.js'), {
     execArgv: ['--secure-heap=3', '--secure-heap-min=3'],
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index e8398c21bafd..4b874a7e43fb 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -12,6 +12,7 @@ const {
   hasOpenSSL,
   hasFIPS,
   opensslCli,
+  isBoringSSL,
 } = require('../common/crypto');
 
 // Test certificates
@@ -80,7 +81,7 @@ if (fips30) {
       });
   }, { message: hasOpenSSL(3) ?
     'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
-    process.features.openssl_is_boringssl ?
+    isBoringSSL ?
       'error:0600006d:public key routines:OPENSSL_internal:ILLEGAL_OR_UNSUPPORTED_PADDING_MODE' :
       'bye, bye, error stack' });
 
@@ -376,7 +377,7 @@ assert.throws(
   }, hasOpenSSL(3) ? {
     code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /illegal or unsupported padding mode/,
-  } : process.features.openssl_is_boringssl ? {
+  } : isBoringSSL ? {
     code: 'ERR_OSSL_EVP_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /ILLEGAL_OR_UNSUPPORTED_PADDING_MODE/,
   } : {
@@ -460,7 +461,7 @@ for (const pair of [
     raw: true },
   { private: fixtures.readKey('ed448_private.pem', 'ascii'),
     public: fixtures.readKey('ed448_public.pem', 'ascii'),
-    skip: process.features.openssl_is_boringssl,
+    skip: isBoringSSL,
     algo: null,
     supportsContext: hasOpenSSL(3, 2),
     sigLen: 114,
@@ -721,7 +722,7 @@ MFkwEwYHKoZIzj0CAQYIKoEcz1UBgi0DQgAE1fiOx1BhdoAvpolZdyX46aGWlNoa
   const keys = [['ec-key.pem', 64], dsaKey];
 
   for (const [file, length] of keys) {
-    if (process.features.openssl_is_boringssl && file.startsWith('dsa_')) {
+    if (isBoringSSL && file.startsWith('dsa_')) {
       common.printSkipMessage(`Skipping unsupported ${file} test case`);
       continue;
     }
@@ -857,7 +858,7 @@ if (!opensslCli) {
   }));
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Test RSA-PSS.
   {
     // This key pair does not restrict the message digest algorithm or salt
@@ -1022,7 +1023,7 @@ if (!process.features.openssl_is_boringssl) {
   // Ed25519 and Ed448 must use the one-shot methods
   const keys = [{ privateKey: fixtures.readKey('ed25519_private.pem', 'ascii'),
                   publicKey: fixtures.readKey('ed25519_public.pem', 'ascii') }];
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     keys.push({ privateKey: fixtures.readKey('ed448_private.pem', 'ascii'),
                 publicKey: fixtures.readKey('ed448_public.pem', 'ascii') });
   } else {
@@ -1042,7 +1043,7 @@ if (!process.features.openssl_is_boringssl) {
   }
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   // Dh, x25519 and x448 should not be used for signing/verifying
   // https://github.com/nodejs/node/issues/53742
   for (const algo of ['dh', 'x25519', 'x448']) {
diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
index ed0916b036a9..9584e48f2cbd 100644
--- a/test/parallel/test-crypto-stream.js
+++ b/test/parallel/test-crypto-stream.js
@@ -28,7 +28,7 @@ if (!common.hasCrypto) {
 const assert = require('assert');
 const stream = require('stream');
 const crypto = require('crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 if (!crypto.getFips()) {
   // Small stream to buffer converter
@@ -73,7 +73,7 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
 const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
 
 cipher.pipe(decipher)
-  .on('error', common.expectsError((hasOpenSSL3 || process.features.openssl_is_boringssl) ? {
+  .on('error', common.expectsError((hasOpenSSL(3) || isBoringSSL) ? {
     message: /bad[\s_]decrypt/i,
     library: /Provider routines|Cipher functions/,
     reason: /bad[\s_]decrypt/i,
diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
index 353699cf9117..c1416fd0703a 100644
--- a/test/parallel/test-crypto-x509.js
+++ b/test/parallel/test-crypto-x509.js
@@ -19,7 +19,7 @@ const {
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { readFileSync } = require('fs');
 
 const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
@@ -28,8 +28,8 @@ const ca = readFileSync(fixtures.path('keys', 'ca1-cert.pem'));
 
 const privateKey = createPrivateKey(key);
 
-if (!process.features.openssl_is_boringssl) {
-  const expectedPubkeys = hasOpenSSL3 ? [
+if (!isBoringSSL) {
+  const expectedPubkeys = hasOpenSSL(3) ? [
     [
       'rsa_pss_cert_2048.pem',
       292,
@@ -88,7 +88,7 @@ emailAddress=ry@tinyclouds.org`;
 
 let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
 CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!hasOpenSSL3)
+if (!hasOpenSSL(3))
   infoAccessCheck += '\n';
 
 const der = Buffer.from(
@@ -156,7 +156,7 @@ const der = Buffer.from(
 
   assert.deepStrictEqual(x509.raw, der);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(x509.validFromDate, new Date('2022-09-03T21:40:37Z'));
     assert.deepStrictEqual(x509.validToDate, new Date('2296-06-17T21:40:37Z'));
   }
@@ -399,10 +399,10 @@ tAt3hIKFD1bJt6c6WtMH2Su3syosWxmdmGk5ihslB00lvLpfj/wed8i3bkcB1doq
 UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
 -----END CERTIFICATE-----`;
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     const cert = new X509Certificate(certPem);
     assert.throws(() => cert.publicKey, {
-      message: hasOpenSSL3 ? /decode error/ : /wrong tag/,
+      message: hasOpenSSL(3) ? /decode error/ : /wrong tag/,
       name: 'Error'
     });
 
@@ -446,7 +446,7 @@ UidvpWWipVLZgK+oDks+bKTobcoXGW9oXobiIYqslXPy
 -----END CERTIFICATE-----`.trim();
   const c1 = new X509Certificate(certPemUTCTime);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(c1.validFromDate, new Date('1949-12-25T23:59:58Z'));
     assert.deepStrictEqual(c1.validToDate, new Date('1950-01-01T23:59:58Z'));
   }
@@ -483,7 +483,7 @@ CWwQO8JZjJqFtqtuzy2n+gLCvqePgG/gmSqHOPm2ZbLW
 -----END CERTIFICATE-----`.trim();
   const c2 = new X509Certificate(certPemGeneralizedTime);
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     assert.deepStrictEqual(c2.validFromDate, new Date('2049-12-26T00:00:01Z'));
     assert.deepStrictEqual(c2.validToDate, new Date('2050-01-02T00:00:01Z'));
   }
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 047f051d1e94..3e431c788c62 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,7 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const isFips = hasFIPS(3);
 
 // Test Certificates
@@ -154,7 +154,7 @@ assert(crypto.getHashes().includes('sha1'));
 assert(crypto.getHashes().includes('sha256'));
 assert(!crypto.getHashes().includes('SHA1'));
 assert(!crypto.getHashes().includes('SHA256'));
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   assert(crypto.getHashes().includes('RSA-SHA1'));
   assert(!crypto.getHashes().includes('rsa-sha1'));
 }
@@ -230,7 +230,7 @@ assert.throws(() => {
     assert.throws(() => { throw err; }, {
       code: 'ERR_OSSL_INVALID_KEY_LENGTH',
     });
-  } else if (process.features.openssl_is_boringssl) {
+  } else if (isBoringSSL) {
     // BoringSSL rejects the tiny RSA key while decoding it, before signing.
     assert.throws(() => { throw err; }, {
       name: 'Error',
@@ -270,7 +270,7 @@ if (!hasOpenSSL(3)) {
   const sha1_privateKey = fixtures.readKey('rsa_private_pkcs8_bad.pem',
                                            'ascii');
 
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     // BoringSSL accepts the PKCS#8 payload despite the legacy PEM label.
     const signature = crypto.createSign('sha1').sign(sha1_privateKey);
     assert(Buffer.isBuffer(signature));
diff --git a/test/parallel/test-diagnostics-channel-tracing-channel-context.js b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
new file mode 100644
index 000000000000..e0e605854032
--- /dev/null
+++ b/test/parallel/test-diagnostics-channel-tracing-channel-context.js
@@ -0,0 +1,85 @@
+'use strict';
+
+const common = require('../common');
+
+// This test ensures that tracing channels create an independent mutable
+// context for each call while preserving explicitly provided contexts.
+
+const assert = require('node:assert');
+const dc = require('node:diagnostics_channel');
+
+const lengthChannel = dc.tracingChannel('test:length');
+assert.strictEqual(lengthChannel.traceSync.length, 1);
+assert.strictEqual(lengthChannel.tracePromise.length, 1);
+
+function subscribe(channel, contexts, isPromise = false) {
+  let endCalls = 0;
+  let asyncStartCalls = 0;
+  let asyncEndCalls = 0;
+
+  channel.subscribe({
+    start: common.mustCall((context) => {
+      context.invocation = contexts.length;
+      contexts.push(context);
+    }, 4),
+    end: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, endCalls++);
+    }, 4),
+    asyncStart: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncStartCalls++);
+    }, isPromise ? 4 : 0),
+    asyncEnd: common.mustCall((context) => {
+      assert.strictEqual(context.invocation, asyncEndCalls++);
+    }, isPromise ? 4 : 0),
+  });
+}
+
+const syncChannel = dc.tracingChannel('test:sync-context');
+const syncContexts = [];
+subscribe(syncChannel, syncContexts);
+
+const syncProvided = { provided: true };
+assert.strictEqual(syncChannel.traceSync(() => 'omitted'), 'omitted');
+assert.strictEqual(syncChannel.traceSync(() => 'undefined', undefined),
+                   'undefined');
+assert.strictEqual(syncChannel.traceSync(() => 'provided', syncProvided),
+                   'provided');
+
+assert.strictEqual(Object.getPrototypeOf(syncContexts[0]), null);
+assert.strictEqual(Object.getPrototypeOf(syncContexts[1]), null);
+assert.notStrictEqual(syncContexts[0], syncContexts[1]);
+assert.strictEqual(syncContexts[2], syncProvided);
+assert.deepStrictEqual(syncContexts.slice(0, 3).map(({ result }) => result),
+                       ['omitted', 'undefined', 'provided']);
+
+const syncError = new Error('sync');
+assert.throws(() => syncChannel.traceSync(() => {
+  throw syncError;
+}), (error) => error === syncError);
+assert.strictEqual(syncContexts[3].error, syncError);
+
+const promiseChannel = dc.tracingChannel('test:promise-context');
+const promiseContexts = [];
+subscribe(promiseChannel, promiseContexts, true);
+
+const promiseProvided = { provided: true };
+const promiseError = new Error('promise');
+Promise.resolve()
+  .then(() => promiseChannel.tracePromise(() => Promise.resolve('omitted')))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('undefined'), undefined))
+  .then(() => promiseChannel.tracePromise(
+    () => Promise.resolve('provided'), promiseProvided))
+  .then(() => assert.rejects(
+    promiseChannel.tracePromise(() => Promise.reject(promiseError)),
+    promiseError))
+  .then(common.mustCall(() => {
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[0]), null);
+    assert.strictEqual(Object.getPrototypeOf(promiseContexts[1]), null);
+    assert.notStrictEqual(promiseContexts[0], promiseContexts[1]);
+    assert.strictEqual(promiseContexts[2], promiseProvided);
+    assert.deepStrictEqual(
+      promiseContexts.slice(0, 3).map(({ result }) => result),
+      ['omitted', 'undefined', 'provided']);
+    assert.strictEqual(promiseContexts[3].error, promiseError);
+  }));
diff --git a/test/parallel/test-dlopen-binary.js b/test/parallel/test-dlopen-binary.js
new file mode 100644
index 000000000000..8a575a52c975
--- /dev/null
+++ b/test/parallel/test-dlopen-binary.js
@@ -0,0 +1,51 @@
+// Flags: --expose-internals
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { internalBinding } = require('internal/test/binding');
+
+// dlopenBinary() loads a native addon from bytes already in memory, for an
+// addon that the dynamic loader cannot open by path (e.g. one served by a
+// virtual file system). It is internal: process.dlopen() keeps its documented
+// (module, filename[, flags]) signature and never takes the bytes.
+const { dlopenBinary } = internalBinding('process_methods');
+assert.strictEqual(typeof dlopenBinary, 'function');
+assert.strictEqual(process.dlopen.length, 0);
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+const bytes = fs.readFileSync(addonPath);
+const flags = (os.constants.dlopen?.RTLD_LAZY) || 0;
+
+// A path that does not exist on disk, as a VFS-resident addon would be.
+const fakePath = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+assert.ok(!fs.existsSync(fakePath));
+
+const m = { exports: {} };
+dlopenBinary(m, fakePath, flags, bytes);
+assert.strictEqual(typeof m.exports.hello, 'function');
+assert.strictEqual(m.exports.hello(), 'world');
+
+// The flags argument may be left undefined when passing bytes.
+const m2 = { exports: {} };
+dlopenBinary(m2, fakePath, undefined, bytes);
+assert.strictEqual(m2.exports.hello(), 'world');
+
+// Without the bytes, that nonexistent path cannot be loaded.
+assert.throws(() => dlopenBinary({ exports: {} }, fakePath, flags),
+              { code: 'ERR_DLOPEN_FAILED' });
+
+// A non-buffer binary is rejected.
+assert.throws(
+  () => dlopenBinary({ exports: {} }, fakePath, flags, 'nope'),
+  { code: 'ERR_INVALID_ARG_TYPE' });
+
+// process.dlopen() ignores a fourth argument rather than loading from it: the
+// public signature is unchanged, so this still fails on the missing path.
+assert.throws(
+  () => process.dlopen({ exports: {} }, fakePath, flags, bytes),
+  { code: 'ERR_DLOPEN_FAILED' });
diff --git a/test/parallel/test-dns-resolver-max-timeout.js b/test/parallel/test-dns-resolver-max-timeout.js
index 7abac39323e1..1a4aaef96c96 100644
--- a/test/parallel/test-dns-resolver-max-timeout.js
+++ b/test/parallel/test-dns-resolver-max-timeout.js
@@ -52,9 +52,11 @@ server.bind(0, common.mustCall(async () => {
 
   // Test that maxTimeout is effective.
   // Without maxTimeout, the timeout will keep increasing when retrying.
-  const timeout1 = await timeout(address, { timeout: 500, tries: 3 });
-  // With maxTimeout, the timeout will always be 500 when retrying.
-  const timeout2 = await timeout(address, { timeout: 500, tries: 3, maxTimeout: 500 });
+  // Expired tries are only noticed on the resolver's `timeout` ms timer tick,
+  // so use enough tries that the doubling run cannot overlap the capped one.
+  const timeout1 = await timeout(address, { timeout: 100, tries: 5 });
+  // With maxTimeout, the timeout will always be 100 when retrying.
+  const timeout2 = await timeout(address, { timeout: 100, tries: 5, maxTimeout: 100 });
   console.log(`timeout1: ${timeout1}, timeout2: ${timeout2}`);
   assert.strictEqual(timeout1 !== undefined && timeout2 !== undefined, true);
   assert.strictEqual(timeout1 > timeout2, true);
diff --git a/test/parallel/test-domain-deprecation.js b/test/parallel/test-domain-deprecation.js
new file mode 100644
index 000000000000..48b4df6b238f
--- /dev/null
+++ b/test/parallel/test-domain-deprecation.js
@@ -0,0 +1,12 @@
+'use strict';
+const common = require('../common');
+
+const domainWarning =
+  'The `domain` module is deprecated and should not be used.';
+common.expectWarning('DeprecationWarning', domainWarning, 'DEP0032');
+
+const domain = require('domain');
+const assert = require('assert');
+
+assert.strictEqual(typeof domain.create, 'function');
+assert.strictEqual(typeof domain.Domain, 'function');
diff --git a/test/parallel/test-domain-http-server.js b/test/parallel/test-domain-http-server.js
index 160241d569b1..6555a58f305e 100644
--- a/test/parallel/test-domain-http-server.js
+++ b/test/parallel/test-domain-http-server.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 // Copyright Joyent, Inc. and other Node contributors.
 //
 // Permission is hereby granted, free of charge, to any person obtaining a
diff --git a/test/parallel/test-domain-implicit-binding.js b/test/parallel/test-domain-implicit-binding.js
index 9f119a420368..84c140a1d77e 100644
--- a/test/parallel/test-domain-implicit-binding.js
+++ b/test/parallel/test-domain-implicit-binding.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 'use strict';
 
 const common = require('../common');
diff --git a/test/parallel/test-domain-implicit-fs.js b/test/parallel/test-domain-implicit-fs.js
index abb4e89f085d..6e3a1cf68ab4 100644
--- a/test/parallel/test-domain-implicit-fs.js
+++ b/test/parallel/test-domain-implicit-fs.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 // Copyright Joyent, Inc. and other Node contributors.
 //
 // Permission is hereby granted, free of charge, to any person obtaining a
diff --git a/test/parallel/test-domain-multi.js b/test/parallel/test-domain-multi.js
index 635208acac3c..6dc470e4bf4a 100644
--- a/test/parallel/test-domain-multi.js
+++ b/test/parallel/test-domain-multi.js
@@ -19,6 +19,8 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+// Flags: --no-deprecation
+
 'use strict';
 // Tests of multiple domains happening at once.
 
diff --git a/test/parallel/test-domain-promise.js b/test/parallel/test-domain-promise.js
index 7b1796d84fea..b96a4cd64a4c 100644
--- a/test/parallel/test-domain-promise.js
+++ b/test/parallel/test-domain-promise.js
@@ -1,3 +1,5 @@
+// Flags: --no-deprecation
+
 'use strict';
 const common = require('../common');
 const assert = require('assert');
diff --git a/test/parallel/test-error-value-type-detection.mjs b/test/parallel/test-error-value-type-detection.mjs
index e44b19297a96..cb794514ed39 100644
--- a/test/parallel/test-error-value-type-detection.mjs
+++ b/test/parallel/test-error-value-type-detection.mjs
@@ -209,3 +209,58 @@ assert.strictEqual(
   determineSpecificType(new WeakSet()),
   'an instance of WeakSet',
 );
+
+// Anonymous classes have an empty `name`, so the value is inspected instead.
+// `inspect(..., { depth: -1 })` prints this one as `{}` because it has no own
+// properties; the values below carry a `constructor` property of their own and
+// print as `[Object]`.
+assert.strictEqual(
+  determineSpecificType(new (class {})()),
+  '{}',
+);
+
+// `constructor` is an ordinary, user-controlled property that need not be a
+// function. Describing such a value must not throw.
+assert.strictEqual(
+  determineSpecificType(JSON.parse('{"constructor": 5}')),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: '' } }),
+  '[Object]',
+);
+
+// A `constructor.name` that is not a usable string must not be interpolated
+// into the message.
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: Symbol('x') } }),
+  '[Object]',
+);
+
+assert.strictEqual(
+  determineSpecificType({ constructor: { name: 42 } }),
+  '[Object]',
+);
+
+// `constructor` and its `name` are each read once. Both may be accessors, so
+// repeated reads are observable, and a `name` validated by one read and
+// interpolated from another need not be the same value twice.
+let constructorReads = 0;
+let nameReads = 0;
+const named = {
+  get constructor() {
+    constructorReads++;
+    return { get name() { nameReads++; return 'Foo'; } };
+  },
+};
+assert.strictEqual(determineSpecificType(named), 'an instance of Foo');
+assert.strictEqual(constructorReads, 1);
+assert.strictEqual(nameReads, 1);
+
+// Building the error must not fail when `constructor` is a truthy primitive.
+assert.strictEqual(
+  new errorsModule.codes.ERR_INVALID_ARG_TYPE(
+    'arg', 'string', JSON.parse('{"constructor": 5}')).code,
+  'ERR_INVALID_ARG_TYPE',
+);
diff --git a/test/parallel/test-external-memory-reasonable-size.js b/test/parallel/test-external-memory-reasonable-size.js
index 14e2573328ba..f9ff1af8e5a1 100644
--- a/test/parallel/test-external-memory-reasonable-size.js
+++ b/test/parallel/test-external-memory-reasonable-size.js
@@ -8,7 +8,7 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { spawnSync } = require('child_process');
+const { execSync } = require('child_process');
 const { totalmem } = require('os');
 
 // The smallest limit V8 accepts is 1 GB, so the child has to allocate more
@@ -20,14 +20,15 @@ for (const flag of [
   '--external-memory-max-reasonable-size=1',
   '--external_memory_max_reasonable_size=1',
 ]) {
-  const child = spawnSync(process.execPath, [
-    flag, '-e', 'new Float64Array(150_000_000)',
-  ]);
-
-  assert.notStrictEqual(
-    child.status,
-    0,
-    `${flag} was not honored, the child exited cleanly`,
+  // The child aborts with over a gigabyte resident, so keep it from writing a
+  // core file; on some hosts that dump alone outlasts the test timeout.
+  const [cmd, opts] = common.escapePOSIXShell`"${process.execPath}" ${flag} -e "new Float64Array(150_000_000)"`;
+  assert.throws(
+    () => execSync(common.isWindows ? cmd : `ulimit -c 0; ${cmd}`, { ...opts, stdio: 'pipe' }),
+    (err) => {
+      assert.notStrictEqual(err.status, 0, `${flag} was not honored, the child exited cleanly`);
+      assert.match(err.stderr.toString(), /kMaxReasonableBytes/);
+      return true;
+    },
   );
-  assert.match(child.stderr.toString(), /kMaxReasonableBytes/);
 }
diff --git a/test/parallel/test-fs-cp-async-destination-appears-late.mjs b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
new file mode 100644
index 000000000000..40ec15e1ef39
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-destination-appears-late.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() into a destination that did not exist when it was
+// checked, but does by the time the copy starts, fails with EEXIST instead
+// of copying through whatever appeared there.
+import '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { createHook } from 'node:async_hooks';
+import { existsSync, lstatSync, mkdirSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+tmpdir.refresh();
+const src = nextdir();
+const dest = nextdir();
+const target = nextdir();
+mkdirSync(src);
+mkdirSync(target);
+writeFileSync(join(src, 'file'), 'x');
+
+let injected = false;
+const hook = createHook({
+  init(id, type) {
+    if (!injected && type === 'FSREQCALLBACK' && !existsSync(dest)) {
+      injected = true;
+      symlinkSync(target, dest, 'dir');
+    }
+  },
+}).enable();
+const outcome = await promises.cp(src, dest, { recursive: true }).then(() => null, (err) => err);
+hook.disable();
+assert.ok(injected, 'the hook found no request to inject the symbolic link at');
+assert.strictEqual(outcome?.code, 'EEXIST');
+assert.strictEqual(outcome?.syscall, 'mkdir');
+assert.ok(lstatSync(dest).isSymbolicLink());
+assert.ok(!existsSync(join(target, 'file')));
diff --git a/test/parallel/test-fs-cp-async-file-modes.mjs b/test/parallel/test-fs-cp-async-file-modes.mjs
new file mode 100644
index 000000000000..358f6c339b7b
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-file-modes.mjs
@@ -0,0 +1,35 @@
+// This tests that cp() gives copied files the mode of their source, including
+// the setuid, setgid and sticky bits, as cpSync() does.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('file modes are not meaningful on Windows');
+
+tmpdir.refresh();
+const modes = { suid: 0o4755, sgid: 0o2755, sticky: 0o1755, private: 0o600 };
+const src = nextdir();
+mkdirSync(src);
+for (const [name, mode] of Object.entries(modes)) {
+  writeFileSync(join(src, name), 'x');
+  chmodSync(join(src, name), mode);
+}
+const modesIn = (dir) => Object.fromEntries(
+  Object.keys(modes).map((name) => [name, statSync(join(dir, name)).mode & 0o7777]));
+const expected = modesIn(src);
+
+const viaCp = nextdir();
+await promises.cp(src, viaCp, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCp), expected);
+
+const viaCpTimestamps = nextdir();
+await promises.cp(src, viaCpTimestamps, { recursive: true, preserveTimestamps: true });
+assert.deepStrictEqual(modesIn(viaCpTimestamps), expected);
+
+const viaCpSync = nextdir();
+cpSync(src, viaCpSync, { recursive: true });
+assert.deepStrictEqual(modesIn(viaCpSync), expected);
diff --git a/test/parallel/test-fs-cp-async-special-files-in-tree.mjs b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
new file mode 100644
index 000000000000..9a028f297caa
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-special-files-in-tree.mjs
@@ -0,0 +1,53 @@
+// This tests that cp() rejects a socket or a FIFO found inside the copied
+// tree with the same errors as for a top-level one, while cpSync() skips them.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { cpSync, existsSync, mkdirSync, writeFileSync, promises } from 'node:fs';
+import { createServer } from 'node:net';
+import { join } from 'node:path';
+import { nextdir } from '../common/fs.js';
+import tmpdir from '../common/tmpdir.js';
+
+if (common.isWindows)
+  common.skip('No socket/FIFO support on Windows');
+if (common.isInsideDirWithUnusualChars)
+  common.skip('Test is broken in directories with unusual characters');
+
+tmpdir.refresh();
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'd'), { recursive: true });
+  writeFileSync(join(src, 'd', 'file'), 'x');
+  const server = createServer();
+  // The socket path can exceed the platform limit in a deep tmpdir; skip then.
+  const listening = await new Promise((resolve) => {
+    server.on('error', () => resolve(false));
+    server.listen(join(src, 'd', 's.sock'), () => resolve(true));
+  });
+  if (!listening) {
+    common.printSkipMessage('socket path too long');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_SOCKET' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'd', 'file')));
+    server.close();
+  }
+}
+
+{
+  const src = nextdir();
+  mkdirSync(join(src, 'dir'), { recursive: true });
+  writeFileSync(join(src, 'dir', 'file'), 'x');
+  if (spawnSync('mkfifo', [join(src, 'dir', 'fifo')]).status !== 0) {
+    common.printSkipMessage('mkfifo not available');
+  } else {
+    await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'ERR_FS_CP_FIFO_PIPE' });
+    const dest = nextdir();
+    cpSync(src, dest, { recursive: true });
+    assert.ok(existsSync(join(dest, 'dir', 'file')));
+  }
+}
diff --git a/test/parallel/test-fs-cp-async-symlink-targets.mjs b/test/parallel/test-fs-cp-async-symlink-targets.mjs
new file mode 100644
index 000000000000..81e861c90859
--- /dev/null
+++ b/test/parallel/test-fs-cp-async-symlink-targets.mjs
@@ -0,0 +1,29 @@
+// This tests that cp() into a new destination writes the same link targets
+// as path.resolve() of the original ones: relative targets made absolute
+// lexically (intermediate links kept), absolute targets left as they are.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { mkdirSync, readlinkSync, symlinkSync, writeFileSync, promises } from 'node:fs';
+import { join, resolve } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('symbolic links need elevated privileges on Windows');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'real'), { recursive: true });
+writeFileSync(join(src, 'real', 'file'), 'data');
+symlinkSync('real', join(src, 'alias'));
+symlinkSync('alias/file', join(src, 'link'));
+const absoluteTarget = join(tmpdir.path, 'x', '..', 'elsewhere');
+symlinkSync(absoluteTarget, join(src, 'abs'));
+
+for (const filter of [undefined, () => true]) {
+  const dest = nextdir();
+  await promises.cp(src, dest, { recursive: true, filter });
+  assert.strictEqual(readlinkSync(join(dest, 'link')), resolve(src, 'alias/file'));
+  assert.strictEqual(readlinkSync(join(dest, 'alias')), resolve(src, 'real'));
+  assert.strictEqual(readlinkSync(join(dest, 'abs')), absoluteTarget);
+}
diff --git a/test/parallel/test-fs-cp-async-with-mode-flags.mjs b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
index 99f6b5fe09d9..6e10d5859ef1 100644
--- a/test/parallel/test-fs-cp-async-with-mode-flags.mjs
+++ b/test/parallel/test-fs-cp-async-with-mode-flags.mjs
@@ -29,3 +29,14 @@ cp(src, dest, mustNotMutateObjectDeep({
   assert(err.code === 'ENOTSUP' || err.code === 'ENOTTY' ||
     err.code === 'ENOSYS' || err.code === 'EXDEV');
 }));
+
+// The mode flags reach copyFile() whether or not a filter is given.
+{
+  const { promises } = await import('node:fs');
+  const outcome = (filter) => promises.cp(src, nextdir(), {
+    recursive: true,
+    mode: constants.COPYFILE_FICLONE_FORCE,
+    filter,
+  }).then(() => 'copied', (err) => `${err.code} ${err.syscall}`);
+  assert.strictEqual(await outcome(undefined), await outcome(() => true));
+}
diff --git a/test/parallel/test-fs-cp-sync-directory-mode.mjs b/test/parallel/test-fs-cp-sync-directory-mode.mjs
new file mode 100644
index 000000000000..f022af268f1e
--- /dev/null
+++ b/test/parallel/test-fs-cp-sync-directory-mode.mjs
@@ -0,0 +1,64 @@
+// This tests that cpSync gives the directories it creates the mode of the
+// corresponding source directory, as cp does.
+import { mustNotMutateObjectDeep, isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, statSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import { isMainThread } from 'node:worker_threads';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('directory modes are not meaningful on Windows');
+if (!isMainThread)
+  skip('process.umask() is not available in workers');
+
+tmpdir.refresh();
+const mask = process.umask(0o022);
+
+const src = nextdir();
+mkdirSync(join(src, 'private', 'inner'), { recursive: true, mode: 0o700 });
+mkdirSync(join(src, 'shared'), { mode: 0o775 });
+writeFileSync(join(src, 'private', 'inner', 'file'), 'x', { mode: 0o600 });
+
+function modes(root) {
+  return ['.', 'private', 'private/inner', 'shared', 'private/inner/file']
+    .map((p) => (statSync(join(root, p)).mode & 0o777).toString(8));
+}
+
+const destSync = nextdir();
+cpSync(src, destSync, mustNotMutateObjectDeep({ recursive: true }));
+assert.deepStrictEqual(modes(destSync), modes(src));
+
+const destAsync = nextdir();
+await promises.cp(src, destAsync, { recursive: true });
+assert.deepStrictEqual(modes(destAsync), modes(src));
+
+// A read-only source directory can still be copied; its copy ends up read-only too.
+{
+  const roSrc = nextdir();
+  mkdirSync(join(roSrc, 'sub'), { recursive: true });
+  writeFileSync(join(roSrc, 'sub', 'file'), 'x');
+  chmodSync(join(roSrc, 'sub'), 0o555);
+  chmodSync(roSrc, 0o555);
+  const readOnly = [roSrc, join(roSrc, 'sub')];
+  for (const copy of [(dest) => cpSync(roSrc, dest, { recursive: true }),
+                      (dest) => promises.cp(roSrc, dest, { recursive: true })]) {
+    const dest = nextdir();
+    await copy(dest);
+    assert.strictEqual(statSync(join(dest, 'sub', 'file')).size, 1);
+    assert.deepStrictEqual(
+      [dest, join(dest, 'sub')].map((p) => (statSync(p).mode & 0o777).toString(8)), ['555', '555']);
+    readOnly.push(dest, join(dest, 'sub'));
+  }
+  // Let tmpdir clean up.
+  for (const dir of readOnly) chmodSync(dir, 0o755);
+}
+
+// An existing destination directory keeps its own mode.
+const existing = nextdir();
+mkdirSync(existing, { mode: 0o711 });
+cpSync(src, existing, mustNotMutateObjectDeep({ recursive: true }));
+assert.strictEqual((statSync(existing).mode & 0o777).toString(8), '711');
+assert.deepStrictEqual(modes(existing).slice(1), modes(src).slice(1));
+process.umask(mask);
diff --git a/test/parallel/test-fs-cp-unreadable-directory.mjs b/test/parallel/test-fs-cp-unreadable-directory.mjs
new file mode 100644
index 000000000000..c6343e6b277e
--- /dev/null
+++ b/test/parallel/test-fs-cp-unreadable-directory.mjs
@@ -0,0 +1,33 @@
+// This tests that cp() and cpSync() report an unreadable directory inside the
+// source tree as an error instead of terminating the process.
+import { isWindows, skip } from '../common/index.mjs';
+import { nextdir } from '../common/fs.js';
+import assert from 'node:assert';
+import { chmodSync, cpSync, mkdirSync, readdirSync, writeFileSync, promises } from 'node:fs';
+import { join } from 'node:path';
+import tmpdir from '../common/tmpdir.js';
+
+if (isWindows)
+  skip('no way to make a directory unreadable');
+if (process.getuid() === 0)
+  skip('root can read the directory anyway');
+
+tmpdir.refresh();
+const src = nextdir();
+mkdirSync(join(src, 'locked'), { recursive: true });
+writeFileSync(join(src, 'file'), 'x');
+chmodSync(join(src, 'locked'), 0o000);
+try {
+  readdirSync(join(src, 'locked'));
+  chmodSync(join(src, 'locked'), 0o700);
+  skip('the directory is still readable');
+} catch {
+  // Expected: it is unreadable.
+}
+
+try {
+  assert.throws(() => cpSync(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+  await assert.rejects(promises.cp(src, nextdir(), { recursive: true }), { code: 'EACCES' });
+} finally {
+  chmodSync(join(src, 'locked'), 0o700);
+}
diff --git a/test/parallel/test-fs-glob.mjs b/test/parallel/test-fs-glob.mjs
index 692f11716d55..ed7317508087 100644
--- a/test/parallel/test-fs-glob.mjs
+++ b/test/parallel/test-fs-glob.mjs
@@ -983,3 +983,31 @@ describe('glob - seen cache', function() {
     );
   });
 });
+
+// gh-58991: exclude patterns must apply the same case-sensitivity as include
+// patterns. On case-insensitive filesystems include patterns match entries
+// regardless of case, so literal exclude patterns must match that behavior.
+const skipCaseTests = { skip: !common.isWindows && !common.isMacOS };
+describe('glob - exclude case-insensitive consistency', skipCaseTests, function() {
+  test('literal exclude ignores case (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude matches differently-cased results (sync)', () => {
+    assert.deepStrictEqual(
+      globSync('A/b', { cwd: fixtureDir, exclude: ['a/b'] }), []);
+  });
+  test('literal exclude ignores case (async)', async () => {
+    const promisified = promisify(glob);
+    assert.deepStrictEqual(
+      await promisified('a/b', { cwd: fixtureDir, exclude: ['A/B'] }), []);
+  });
+  test('literal exclude ignores case (promise)', async () => {
+    const actual = [];
+    for await (const entry of asyncGlob(
+      'a/b', { cwd: fixtureDir, exclude: ['A/B'] })) {
+      actual.push(entry);
+    }
+    assert.deepStrictEqual(actual, []);
+  });
+});
diff --git a/test/parallel/test-fs-mkdtemp-buffer.js b/test/parallel/test-fs-mkdtemp-buffer.js
new file mode 100644
index 000000000000..c9c04d57eaca
--- /dev/null
+++ b/test/parallel/test-fs-mkdtemp-buffer.js
@@ -0,0 +1,26 @@
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const tmpdir = require('../common/tmpdir');
+tmpdir.refresh();
+
+const prefixString = path.join(tmpdir.path, 'buffer-');
+const prefixBuffer = Buffer.from(prefixString);
+
+// 1. Test Sync API
+const resultSync = fs.mkdtempSync(prefixBuffer);
+assert.strictEqual(Buffer.isBuffer(resultSync), true);
+
+// 2. Test Callback API
+fs.mkdtemp(prefixBuffer, common.mustSucceed((result) => {
+  assert.strictEqual(Buffer.isBuffer(result), true);
+}));
+
+// 3. Test Promises API
+fs.promises.mkdtemp(prefixBuffer)
+  .then(common.mustCall((resultPromise) => {
+    assert.strictEqual(Buffer.isBuffer(resultPromise), true);
+  }));
diff --git a/test/parallel/test-fs-mkdtemp.js b/test/parallel/test-fs-mkdtemp.js
index e93809d5b445..3c2323440e08 100644
--- a/test/parallel/test-fs-mkdtemp.js
+++ b/test/parallel/test-fs-mkdtemp.js
@@ -64,14 +64,13 @@ function handler(err, folder) {
 {
   const tmpFolder = fs.mkdtempSync(Buffer.from(tmpdir.resolve('foo.')));
 
-  assert.strictEqual(path.basename(tmpFolder).length, 'foo.XXXXXX'.length);
+  assert.strictEqual(path.basename(tmpFolder.toString()).length, 'foo.XXXXXX'.length);
   assert(fs.existsSync(tmpFolder));
 
   const utf8 = fs.mkdtempSync(Buffer.from(tmpdir.resolve('\u0222abc.')));
-  assert.strictEqual(Buffer.byteLength(path.basename(utf8)),
+  assert.strictEqual(Buffer.byteLength(path.basename(utf8.toString())),
                      Buffer.byteLength('\u0222abc.XXXXXX'));
   assert(fs.existsSync(utf8));
-
   fs.mkdtemp(Buffer.from(tmpdir.resolve('bar.')), common.mustCall(handler));
 
   // Same test as above, but making sure that passing an options object doesn't
diff --git a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
index 36ebc23491ca..b299a7d5d572 100644
--- a/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-aggregate-errors.js
@@ -67,7 +67,9 @@ async function checkAggregateError(op) {
   tmpdir.refresh();
   await checkAggregateError((filePath) => truncate(filePath));
   await checkAggregateError((filePath) => readFile(filePath));
-  await checkAggregateError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkAggregateError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkAggregateError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-close-errors.js b/test/parallel/test-fs-promises-file-handle-close-errors.js
index 901e71c15ac5..c368f3acb931 100644
--- a/test/parallel/test-fs-promises-file-handle-close-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-close-errors.js
@@ -62,7 +62,9 @@ async function checkCloseError(op) {
   tmpdir.refresh();
   await checkCloseError((filePath) => truncate(filePath));
   await checkCloseError((filePath) => readFile(filePath));
-  await checkCloseError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkCloseError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkCloseError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-op-errors.js b/test/parallel/test-fs-promises-file-handle-op-errors.js
index 46b4acd0b8ff..d36056227841 100644
--- a/test/parallel/test-fs-promises-file-handle-op-errors.js
+++ b/test/parallel/test-fs-promises-file-handle-op-errors.js
@@ -56,7 +56,9 @@ async function checkOperationError(op) {
   tmpdir.refresh();
   await checkOperationError((filePath) => truncate(filePath));
   await checkOperationError((filePath) => readFile(filePath));
-  await checkOperationError((filePath) => writeFile(filePath, '123'));
+  // More than one write chunk (512 KiB), so that writeFile(path) goes through
+  // a FileHandle as well.
+  await checkOperationError((filePath) => writeFile(filePath, '123'.repeat(200_000)));
   if (common.isMacOS) {
     await checkOperationError((filePath) => lchmod(filePath, 0o777));
   }
diff --git a/test/parallel/test-fs-promises-file-handle-pull.js b/test/parallel/test-fs-promises-file-handle-pull.js
index 3fc531baf713..cdfaf273f933 100644
--- a/test/parallel/test-fs-promises-file-handle-pull.js
+++ b/test/parallel/test-fs-promises-file-handle-pull.js
@@ -198,7 +198,7 @@ async function testPullAbortSignal() {
   const ac = new AbortController();
   const fh = await open(filePath, 'r');
   try {
-    ac.abort();
+    ac.abort(null);
     const readable = fh.pull({ signal: ac.signal });
 
     await assert.rejects(
@@ -208,7 +208,7 @@ async function testPullAbortSignal() {
           assert.fail('Should not reach here');
         }
       },
-      (err) => err.name === 'AbortError',
+      (err) => err === null,
     );
   } finally {
     await fh.close();
diff --git a/test/parallel/test-fs-promises-file-handle-writer.js b/test/parallel/test-fs-promises-file-handle-writer.js
index ff90716400ef..a636844f8e57 100644
--- a/test/parallel/test-fs-promises-file-handle-writer.js
+++ b/test/parallel/test-fs-promises-file-handle-writer.js
@@ -764,8 +764,12 @@ async function testEndSyncReturnsFalseDuringAsync() {
   const p = w.write(Buffer.from('data'));
   assert.strictEqual(w.endSync(), -1);
 
+  const ending = w.end();
+  assert.strictEqual(w.writeSync(Buffer.from('more')), false);
+  assert.strictEqual(w.endSync(), -1);
+  await assert.rejects(w.write('more'), { code: 'ERR_INVALID_STATE' });
   await p;
-  const totalBytes = await w.end();
+  const totalBytes = await ending;
   await fh.close();
 
   assert.strictEqual(totalBytes, 4);
@@ -850,6 +854,50 @@ async function testEndRejectsOnErrored() {
   await fh.close();
 }
 
+async function testFailPreservesReason() {
+  for (const reason of [undefined, null, false, 0, '', 'failure']) {
+    const suffix = String(reason).replaceAll(' ', '-');
+    const filePath = path.join(tmpDir, `writer-fail-${suffix}.txt`);
+    const fh = await open(filePath, 'w');
+    const w = fh.writer();
+
+    w.fail(reason);
+
+    await assert.rejects(w.write('data'), (error) => error === reason);
+    await assert.rejects(w.end(), (error) => error === reason);
+    await fh.close();
+  }
+}
+
+async function testFailRejectsPendingWriteWithReason() {
+  const filePath = path.join(tmpDir, 'writer-fail-pending.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+  const reason = null;
+  const pending = w.write(Buffer.alloc(1024 * 1024));
+
+  w.fail(reason);
+
+  await assert.rejects(pending, (error) => error === reason);
+  await fh.close();
+}
+
+async function testFailWhileClosingPreservesReason() {
+  const filePath = path.join(tmpDir, 'writer-fail-closing.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+  const reason = false;
+  const pendingWrite = w.write(Buffer.alloc(1024 * 1024));
+  const pendingEnd = w.end();
+
+  w.fail(reason);
+
+  for (const promise of [pendingWrite, pendingEnd]) {
+    await assert.rejects(promise, (error) => error === reason);
+  }
+  await fh.close();
+}
+
 // =============================================================================
 // end() is idempotent when closing/closed
 // =============================================================================
@@ -914,7 +962,7 @@ async function testAsyncDisposeCallsFail() {
   // Writer should be in errored state - write should reject
   await assert.rejects(
     w.write(Buffer.from('more')),
-    (err) => err instanceof Error,
+    (reason) => reason === undefined,
   );
 
   // Handle should be unlocked and reusable
@@ -1060,6 +1108,27 @@ async function testWriterArgumentValidation() {
   }
 }
 
+async function testWriterWebIDLConversion() {
+  const filePath = path.join(tmpDir, 'writer-webidl.txt');
+  const fh = await open(filePath, 'w');
+  const w = fh.writer();
+
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(await w.end(null), 12);
+  await fh.close();
+
+  assert.strictEqual(fs.readFileSync(filePath, 'utf8'), '42trueobject');
+}
+
 // =============================================================================
 // Run all tests
 // =============================================================================
@@ -1104,6 +1173,9 @@ Promise.all([
   testEndSyncAutoClose(),
   testFullSyncPipeline(),
   testEndRejectsOnErrored(),
+  testFailPreservesReason(),
+  testFailRejectsPendingWriteWithReason(),
+  testFailWhileClosingPreservesReason(),
   testEndIdempotent(),
   testAsyncDisposeWhileClosing(),
   testAsyncDisposeCallsFail(),
@@ -1114,4 +1186,5 @@ Promise.all([
   testWriterLimitWritevSync(),
   testWriterLimitAndStart(),
   testWriterArgumentValidation(),
+  testWriterWebIDLConversion(),
 ]).then(common.mustCall());
diff --git a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
similarity index 56%
rename from test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
index 314d6dda9a2d..5231b7248f3a 100644
--- a/test/known_issues/test-fs-readdir-promise-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-promise-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs/promises');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }).then(common.mustCall());
diff --git a/test/parallel/test-fs-readdir-recursive-permission.js b/test/parallel/test-fs-readdir-recursive-permission.js
new file mode 100644
index 000000000000..b44454a213ce
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-permission.js
@@ -0,0 +1,89 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const allowed = tmpdir.resolve('allowed');
+const blocked = tmpdir.resolve('blocked');
+fs.mkdirSync(path.join(allowed, 'a', 'b'), { recursive: true });
+fs.mkdirSync(path.join(allowed, 'c'));
+fs.mkdirSync(blocked);
+fs.writeFileSync(path.join(allowed, 'top'), '');
+fs.writeFileSync(path.join(allowed, 'a', '1'), '');
+fs.writeFileSync(path.join(allowed, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(blocked, 'secret'), '');
+if (common.canCreateSymLink()) {
+  fs.symlinkSync(path.join(allowed, 'a'), path.join(allowed, 'c', 'link-to-a'), 'dir');
+}
+
+// Computed without the permission model, so by the native walk.
+const expected = fs.readdirSync(allowed, { recursive: true });
+assert(expected.includes(path.join('a', 'b', '2')));
+
+const { status, stderr } = spawnSync(process.execPath, [
+  '--permission',
+  `--allow-fs-read=${allowed}`,
+  '-e',
+  `
+    const assert = require('assert');
+    const fs = require('fs');
+    const path = require('path');
+    const { ALLOWED, BLOCKED } = process.env;
+    const expected = JSON.parse(process.env.EXPECTED);
+    const denied = {
+      code: 'ERR_ACCESS_DENIED',
+      permission: 'FileSystemRead',
+      resource: path.toNamespacedPath(BLOCKED),
+    };
+
+    function check(result, withFileTypes) {
+      if (!withFileTypes) {
+        assert.deepStrictEqual(result, expected);
+        return;
+      }
+      assert(result.every((dirent) => dirent instanceof fs.Dirent));
+      assert.deepStrictEqual(
+        result.map((dirent) => path.join(path.relative(ALLOWED, dirent.parentPath), dirent.name)),
+        expected,
+      );
+    }
+
+    let pending = 0;
+    process.on('exit', () => assert.strictEqual(pending, 0));
+    for (const withFileTypes of [false, true]) {
+      const options = { recursive: true, withFileTypes };
+      check(fs.readdirSync(ALLOWED, options), withFileTypes);
+      assert.throws(() => fs.readdirSync(BLOCKED, options), denied);
+
+      pending += 4;
+      fs.readdir(ALLOWED, options, (err, result) => {
+        assert.ifError(err);
+        check(result, withFileTypes);
+        pending--;
+      });
+      fs.readdir(BLOCKED, options, (err) => {
+        assert.throws(() => { throw err; }, denied);
+        pending--;
+      });
+      fs.promises.readdir(ALLOWED, options).then((result) => {
+        check(result, withFileTypes);
+        pending--;
+      });
+      assert.rejects(fs.promises.readdir(BLOCKED, options), denied).then(() => pending--);
+    }
+  `,
+], {
+  env: {
+    ...process.env,
+    ALLOWED: allowed,
+    BLOCKED: blocked,
+    EXPECTED: JSON.stringify(expected),
+  },
+});
+assert.strictEqual(status, 0, stderr.toString());
diff --git a/test/parallel/test-fs-readdir-recursive-tree.js b/test/parallel/test-fs-readdir-recursive-tree.js
new file mode 100644
index 000000000000..2c10f63f0748
--- /dev/null
+++ b/test/parallel/test-fs-readdir-recursive-tree.js
@@ -0,0 +1,230 @@
+'use strict';
+
+// Exercises the native recursive readdir (sync, callback and promise forms)
+// against a reference walk built from the non-recursive API.
+
+const common = require('../common');
+const assert = require('node:assert');
+const fs = require('node:fs');
+const path = require('node:path');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
+
+const root = tmpdir.resolve('tree');
+fs.mkdirSync(path.join(root, 'a', 'b', 'c'), { recursive: true });
+fs.mkdirSync(path.join(root, 'd'));
+fs.mkdirSync(path.join(root, '.hidden'));
+fs.mkdirSync(path.join(root, 'empty'));
+fs.writeFileSync(path.join(root, 'top'), '');
+fs.writeFileSync(path.join(root, 'a', '1'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', '2'), '');
+fs.writeFileSync(path.join(root, 'a', 'b', 'c', '3'), '');
+fs.writeFileSync(path.join(root, 'd', '4'), '');
+fs.writeFileSync(path.join(root, '.hidden', '5'), '');
+
+const canSymlink = common.canCreateSymLink();
+if (canSymlink) {
+  fs.symlinkSync(path.join(root, 'a'), path.join(root, 'd', 'link-to-a'), 'dir');
+  fs.symlinkSync(path.join(root, 'a', '1'), path.join(root, 'd', 'link-to-file'));
+  fs.symlinkSync(path.join(root, 'nowhere'), path.join(root, 'd', 'dangling'));
+}
+
+// Reference implementation: breadth-first, entries in readdir order,
+// directory symlinks followed (fs.readdir semantics).
+function reference(basePath) {
+  const entries = [];
+  const queue = [basePath];
+  for (let i = 0; i < queue.length; i++) {
+    const dir = queue[i];
+    for (const dirent of fs.readdirSync(dir, { withFileTypes: true })) {
+      const full = path.join(dir, dirent.name);
+      entries.push({
+        relative: path.relative(basePath, full),
+        isDirent: true,
+        name: dirent.name,
+        parentPath: dir,
+        isDirectory: dirent.isDirectory(),
+        isSymbolicLink: dirent.isSymbolicLink(),
+        isFile: dirent.isFile(),
+      });
+      let isDir = dirent.isDirectory();
+      if (!isDir && dirent.isSymbolicLink()) {
+        try {
+          isDir = fs.statSync(full).isDirectory();
+        } catch {
+          isDir = false;
+        }
+      }
+      if (isDir) queue.push(full);
+    }
+  }
+  return entries;
+}
+
+function fromDirents(dirents) {
+  return dirents.map((dirent) => {
+    return {
+      isDirent: dirent instanceof fs.Dirent,
+      name: dirent.name,
+      parentPath: dirent.parentPath,
+      isDirectory: dirent.isDirectory(),
+      isSymbolicLink: dirent.isSymbolicLink(),
+      isFile: dirent.isFile(),
+    };
+  });
+}
+
+function stripRelative(entries) {
+  return entries.map(({ relative, ...rest }) => rest);
+}
+
+const expected = reference(root);
+const expectedPaths = expected.map((entry) => entry.relative);
+const expectedDirents = stripRelative(expected);
+
+// The tree is only interesting if symlinks were followed.
+if (canSymlink) {
+  assert(expectedPaths.includes(path.join('d', 'link-to-a', 'b', 'c', '3')));
+  assert(!expectedPaths.includes(path.join('d', 'link-to-file', '1')));
+}
+assert(expectedPaths.includes(path.join('.hidden', '5')));
+assert(expectedPaths.includes('empty'));
+
+// Sync.
+assert.deepStrictEqual(fs.readdirSync(root, { recursive: true }), expectedPaths);
+assert.deepStrictEqual(
+  fromDirents(fs.readdirSync(root, { recursive: true, withFileTypes: true })),
+  expectedDirents,
+);
+
+// Callback.
+fs.readdir(root, { recursive: true }, common.mustSucceed((paths) => {
+  assert.deepStrictEqual(paths, expectedPaths);
+}));
+fs.readdir(root, { recursive: true, withFileTypes: true }, common.mustSucceed((dirents) => {
+  assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+}));
+
+// Promises.
+(async () => {
+  assert.deepStrictEqual(
+    await fs.promises.readdir(root, { recursive: true }),
+    expectedPaths,
+  );
+  assert.deepStrictEqual(
+    fromDirents(await fs.promises.readdir(root, { recursive: true, withFileTypes: true })),
+    expectedDirents,
+  );
+})().then(common.mustCall());
+
+// Mutating the options object after the call must not affect the result.
+{
+  const options = { recursive: true, withFileTypes: true };
+  fs.readdir(root, options, common.mustSucceed((dirents) => {
+    assert.deepStrictEqual(fromDirents(dirents), expectedDirents);
+  }));
+  options.withFileTypes = false;
+  options.recursive = false;
+}
+
+// Relative paths are relative to the path as given, while parentPath is the
+// path as given for the top level and a joined path below it.
+{
+  const relativeRoot = path.relative(process.cwd(), root) + path.sep;
+  const paths = fs.readdirSync(relativeRoot, { recursive: true });
+  assert.deepStrictEqual(paths, expectedPaths);
+  const dirents = fs.readdirSync(relativeRoot, { recursive: true, withFileTypes: true });
+  assert.strictEqual(dirents[0].parentPath, relativeRoot);
+  const nested = dirents.find((dirent) => dirent.name === '1');
+  assert.strictEqual(nested.parentPath, path.join(relativeRoot, 'a'));
+}
+
+// Buffer encodings and Buffer paths.
+{
+  const buffers = fs.readdirSync(root, { recursive: true, encoding: 'buffer' });
+  assert(buffers.every((entry) => Buffer.isBuffer(entry)));
+  assert.deepStrictEqual(buffers.map(String), expectedPaths);
+
+  const stringify = (dirent) => ({
+    ...fromDirents([dirent])[0],
+    name: String(dirent.name),
+    parentPath: String(dirent.parentPath),
+  });
+  const dirents = fs.readdirSync(root, { recursive: true, encoding: 'buffer', withFileTypes: true });
+  assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name)));
+  assert(dirents.every((dirent) => dirent.parentPath === root || Buffer.isBuffer(dirent.parentPath)));
+  assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+
+  // A Buffer path keeps parentPath a Buffer, whatever the encoding.
+  const bufferRoot = Buffer.from(root);
+  assert.deepStrictEqual(fs.readdirSync(bufferRoot, { recursive: true }), expectedPaths);
+  const bufferDirents = fs.readdirSync(bufferRoot, { recursive: true, withFileTypes: true });
+  assert(bufferDirents.every((dirent) => typeof dirent.name === 'string'));
+  assert(bufferDirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+  assert.strictEqual(bufferDirents[0].parentPath, bufferRoot);
+  assert.deepStrictEqual(bufferDirents.map(stringify), expectedDirents);
+
+  fs.readdir(bufferRoot, { recursive: true }, common.mustSucceed((paths) => {
+    assert.deepStrictEqual(paths, expectedPaths);
+  }));
+  fs.readdir(bufferRoot, { recursive: true, withFileTypes: true, encoding: 'buffer' }, common.mustSucceed((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.name) && Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, encoding: 'buffer' }).then(common.mustCall((paths) => {
+    assert.deepStrictEqual(paths.map(String), expectedPaths);
+  }));
+  fs.promises.readdir(bufferRoot, { recursive: true, withFileTypes: true }).then(common.mustCall((dirents) => {
+    assert(dirents.every((dirent) => Buffer.isBuffer(dirent.parentPath)));
+    assert.deepStrictEqual(dirents.map(stringify), expectedDirents);
+  }));
+}
+
+// Errors carry the directory that failed, for the root and below it.
+{
+  const missing = path.join(root, 'missing');
+  assert.throws(() => fs.readdirSync(missing, { recursive: true }), {
+    code: 'ENOENT',
+    syscall: 'scandir',
+    path: missing,
+  });
+  const file = path.join(root, 'top');
+  assert.throws(() => fs.readdirSync(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  });
+  fs.readdir(missing, { recursive: true }, common.mustCall((err) => {
+    assert.strictEqual(err.code, 'ENOENT');
+    assert.strictEqual(err.syscall, 'scandir');
+    assert.strictEqual(err.path, missing);
+  }));
+  assert.rejects(fs.promises.readdir(file, { recursive: true }), {
+    code: 'ENOTDIR',
+    syscall: 'scandir',
+    path: file,
+  }).then(common.mustCall());
+}
+
+if (!common.isWindows && !common.isIBMi && process.getuid() !== 0) {
+  const locked = tmpdir.resolve('locked');
+  const inner = path.join(locked, 'inner');
+  fs.mkdirSync(inner, { recursive: true });
+  fs.chmodSync(inner, 0);
+  try {
+    assert.throws(() => fs.readdirSync(locked, { recursive: true }), {
+      code: 'EACCES',
+      syscall: 'scandir',
+      path: inner,
+    });
+    fs.readdir(locked, { recursive: true }, common.mustCall((err) => {
+      assert.strictEqual(err.code, 'EACCES');
+      assert.strictEqual(err.path, inner);
+      fs.chmodSync(inner, 0o755);
+    }));
+  } catch (err) {
+    fs.chmodSync(inner, 0o755);
+    throw err;
+  }
+}
diff --git a/test/known_issues/test-fs-readdir-recursive-with-buffer.js b/test/parallel/test-fs-readdir-recursive-with-buffer.js
similarity index 55%
rename from test/known_issues/test-fs-readdir-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-recursive-with-buffer.js
index c2eae8f428fe..e3e17de10f27 100644
--- a/test/known_issues/test-fs-readdir-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 const common = require('../common');
@@ -11,5 +8,5 @@ const common = require('../common');
 const { readdir } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdir(Buffer.from(testDirPath), { recursive: true }, common.mustSucceed());
diff --git a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
similarity index 52%
rename from test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
rename to test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
index 0f60c290f15d..1ff966c3b7ea 100644
--- a/test/known_issues/test-fs-readdir-sync-recursive-with-buffer.js
+++ b/test/parallel/test-fs-readdir-sync-recursive-with-buffer.js
@@ -1,9 +1,6 @@
 'use strict';
 
-// This test will fail because the implementation does not properly
-// handle the case when the path is a Buffer and the function is called
-// in recursive mode.
-
+// Recursive readdir accepts a Buffer path.
 // Refs: https://github.com/nodejs/node/issues/58892
 
 require('../common');
@@ -11,5 +8,5 @@ require('../common');
 const { readdirSync } = require('node:fs');
 const { join } = require('node:path');
 
-const testDirPath = join(__dirname, '..', '..');
+const testDirPath = join(__dirname, '..', 'common');
 readdirSync(Buffer.from(testDirPath), { recursive: true });
diff --git a/test/parallel/test-fs-rm.js b/test/parallel/test-fs-rm.js
index e92bf8c07971..1d0578e3004d 100644
--- a/test/parallel/test-fs-rm.js
+++ b/test/parallel/test-fs-rm.js
@@ -631,3 +631,30 @@ if (isGitPresent) {
     }
   }
 }
+
+{
+  // Test that rmSync can delete read-only files (and directories containing read-only files recursively)
+  const dirname = nextDirPath();
+  const filePath = path.join(dirname, 'readonly-file.txt');
+  const recursiveDir = path.join(dirname, 'subdir');
+  const recursiveFilePath = path.join(recursiveDir, 'readonly-nested.txt');
+
+  fs.mkdirSync(recursiveDir, { recursive: true });
+  fs.writeFileSync(filePath, 'hello');
+  fs.writeFileSync(recursiveFilePath, 'world');
+
+  // Make files read-only
+  fs.chmodSync(filePath, 0o444);
+  fs.chmodSync(recursiveFilePath, 0o444);
+
+  // rmSync without recursive option on a file
+  fs.rmSync(filePath);
+  assert.strictEqual(fs.existsSync(filePath), false);
+
+  // rmSync with recursive option on a directory containing a read-only file
+  fs.rmSync(recursiveDir, { recursive: true });
+  assert.strictEqual(fs.existsSync(recursiveDir), false);
+
+  // Clean up parent directory
+  fs.rmSync(dirname, { recursive: true, force: true });
+}
diff --git a/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
new file mode 100644
index 000000000000..2573f582a312
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-aix-preserve-watch-error.js
@@ -0,0 +1,53 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (!common.isAIX)
+  common.skip('AIX-specific ENODEV handling');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('preserve-watch-error');
+const originalStatSync = fs.statSync;
+const originalWatch = fs.watch;
+const expected = new Error('watch failed');
+const verificationError = new Error('stat failed');
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+const failVerification = common.mustCall(() => {
+  throw verificationError;
+});
+
+expected.code = 'ENODEV';
+verificationError.code = 'EIO';
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  throw expected;
+});
+fs.statSync = (filename, options) => {
+  if (filename === directory && options?.throwIfNoEntry === false) {
+    return failVerification();
+  }
+  return Reflect.apply(originalStatSync, fs, [filename, options]);
+};
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, expected);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.statSync = originalStatSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
new file mode 100644
index 000000000000..b91dbe625aeb
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-read.js
@@ -0,0 +1,54 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-read');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let staleWatcherCloseCalls = 0;
+
+fs.mkdirSync(child, { recursive: true });
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    return { close: () => staleWatcherCloseCalls++ };
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.strictEqual(staleWatcherCloseCalls, 1);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
new file mode 100644
index 000000000000..8f570180a855
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-retry-directory-disappears-before-watch.js
@@ -0,0 +1,66 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('retry-directory-disappears-before-watch');
+const child = path.join(directory, 'child');
+const originalWatch = fs.watch;
+const changes = [];
+const watcher = new FSWatcher({ recursive: true });
+let childWatchCalls = 0;
+let directoryListener;
+let watchError;
+
+fs.mkdirSync(child, { recursive: true });
+watcher.on('change', (eventType, filename) => changes.push([eventType, filename]));
+fs.watch = common.mustCall((filename, options, listener) => {
+  if (filename === directory) {
+    directoryListener = listener;
+    return createWatcher();
+  }
+
+  assert.strictEqual(filename, child);
+  childWatchCalls++;
+  if (childWatchCalls === 1) {
+    fs.rmSync(child, { recursive: true });
+    try {
+      return Reflect.apply(originalWatch, fs, [filename, options, listener]);
+    } catch (error) {
+      watchError = error;
+      throw error;
+    }
+  }
+  return createWatcher();
+}, 3);
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.strictEqual(childWatchCalls, 1);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+
+  fs.mkdirSync(child);
+  directoryListener('rename', null);
+
+  assert.strictEqual(childWatchCalls, 2);
+  assert.deepStrictEqual(changes, [['rename', 'child']]);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
new file mode 100644
index 000000000000..7692c86a3abe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-read.js
@@ -0,0 +1,37 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-read');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let closeCalls = 0;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  return { close: () => closeCalls++ };
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    {
+      code: 'ENOENT',
+      filename: directory,
+    },
+  );
+  assert.strictEqual(closeCalls, 1);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
new file mode 100644
index 000000000000..c43f3e275184
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch-no-throw.js
@@ -0,0 +1,40 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch-no-throw');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true, throwIfNoEntry: false });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.match(watchError?.code, /^(ENOENT|ENODEV)$/);
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
new file mode 100644
index 000000000000..917489004650
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-root-disappears-before-watch.js
@@ -0,0 +1,46 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+
+if (common.isIBMi)
+  common.skip('IBMi does not support `fs.watch()`');
+
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('root-disappears-before-watch');
+const originalWatch = fs.watch;
+const watcher = new FSWatcher({ recursive: true });
+let watchError;
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  fs.rmSync(directory, { recursive: true });
+  try {
+    return Reflect.apply(originalWatch, fs, [filename, ...args]);
+  } catch (error) {
+    watchError = error;
+    throw error;
+  }
+});
+
+try {
+  assert.throws(
+    () => watcher[kFSWatchStart](directory),
+    (error) => {
+      assert.strictEqual(error, watchError);
+      assert.match(error.code, /^(ENOENT|ENODEV)$/);
+      return true;
+    },
+  );
+} finally {
+  watcher.close();
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-watch-recursive-watch-before-read.js b/test/parallel/test-fs-watch-recursive-watch-before-read.js
new file mode 100644
index 000000000000..4faeb5b8efbe
--- /dev/null
+++ b/test/parallel/test-fs-watch-recursive-watch-before-read.js
@@ -0,0 +1,42 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const tmpdir = require('../common/tmpdir');
+const { kFSWatchStart } = require('internal/fs/watchers');
+const { FSWatcher } = require('internal/fs/recursive_watch');
+
+function createWatcher() {
+  return { close() {} };
+}
+
+tmpdir.refresh();
+
+const directory = tmpdir.resolve('watch-before-read');
+const originalReaddirSync = fs.readdirSync;
+const originalWatch = fs.watch;
+const operations = [];
+const watcher = new FSWatcher({ recursive: true });
+
+fs.mkdirSync(directory);
+fs.watch = common.mustCall((filename) => {
+  assert.strictEqual(filename, directory);
+  operations.push('watch');
+  return createWatcher();
+});
+fs.readdirSync = common.mustCall((filename, ...args) => {
+  assert.strictEqual(filename, directory);
+  operations.push('read');
+  return Reflect.apply(originalReaddirSync, fs, [filename, ...args]);
+});
+
+try {
+  watcher[kFSWatchStart](directory);
+  assert.deepStrictEqual(operations, ['watch', 'read']);
+} finally {
+  watcher.close();
+  fs.readdirSync = originalReaddirSync;
+  fs.watch = originalWatch;
+}
diff --git a/test/parallel/test-fs-writefile-one-roundtrip.js b/test/parallel/test-fs-writefile-one-roundtrip.js
new file mode 100644
index 000000000000..bab6940eec26
--- /dev/null
+++ b/test/parallel/test-fs-writefile-one-roundtrip.js
@@ -0,0 +1,85 @@
+'use strict';
+// fs.writeFile() and fs.promises.writeFile() with a path perform
+// open + write + close as one thread pool request. This covers what that
+// request must keep doing: honor flags and mode, append, report the
+// failing syscall, accept every ArrayBufferView, write the data as it was at
+// the call even if the buffer is resized or detached right after, and write
+// buffers larger than one write() call in full.
+const common = require('../common');
+const tmpdir = require('../common/tmpdir');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { isMainThread } = require('worker_threads');
+
+tmpdir.refresh();
+let counter = 0;
+const next = () => tmpdir.resolve(`file-${counter++}`);
+
+async function check(write) {
+  {
+    const file = next();
+    await write(file, 'hello');
+    await write(file, ' world', { flag: 'a' });
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'hello world');
+    await assert.rejects(write(file, 'again', { flag: 'wx' }), { code: 'EEXIST', syscall: 'open', path: file });
+  }
+  {
+    const file = path.join(next(), 'missing-dir', 'file');
+    await assert.rejects(write(file, 'x'), { code: 'ENOENT', syscall: 'open', path: file });
+  }
+  {
+    const file = next();
+    await write(file, '');
+    assert.strictEqual(fs.statSync(file).size, 0);
+  }
+  if (!common.isWindows && isMainThread) {
+    const file = next();
+    const mask = process.umask(0o022);
+    await write(file, 'x', { mode: 0o640 });
+    process.umask(mask);
+    assert.strictEqual(fs.statSync(file).mode & 0o777, 0o640);
+  }
+  {
+    const file = next();
+    const units = new Uint16Array([0x6968]);
+    await write(file, units);
+    await write(file, new DataView(new TextEncoder().encode('!?').buffer, 1, 1), { flag: 'a' });
+    assert.deepStrictEqual(fs.readFileSync(file),
+                           Buffer.concat([Buffer.from(units.buffer), Buffer.from('?')]));
+  }
+  if (fs.existsSync('/dev/full')) {
+    // open() succeeds, write() fails.
+    await assert.rejects(write('/dev/full', 'x'), { code: 'ENOSPC', syscall: 'write' });
+  }
+  {
+    const file = next();
+    const resizable = new ArrayBuffer(64 * 1024, { maxByteLength: 128 * 1024 });
+    const view = new Uint8Array(resizable).fill(97);
+    const done = write(file, view);
+    resizable.resize(0);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'a'.repeat(64 * 1024));
+  }
+  {
+    const file = next();
+    const detached = new ArrayBuffer(1024);
+    const done = write(file, new Uint8Array(detached).fill(98));
+    detached.transfer(8);
+    await done;
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'b'.repeat(1024));
+  }
+  {
+    const file = next();
+    const big = Buffer.alloc(3 * 1024 * 1024 + 7, 'z');
+    await write(file, big);
+    assert.deepStrictEqual(fs.readFileSync(file), big);
+  }
+}
+
+(async () => {
+  await check((file, data, options) => new Promise((resolve, reject) => {
+    fs.writeFile(file, data, options, (err) => (err ? reject(err) : resolve()));
+  }));
+  await check(fs.promises.writeFile);
+})().then(common.mustCall());
diff --git a/test/parallel/test-http2-bidirectional-write-deadlock.js b/test/parallel/test-http2-bidirectional-write-deadlock.js
index 9dd4b91c5234..306dce021cb0 100644
--- a/test/parallel/test-http2-bidirectional-write-deadlock.js
+++ b/test/parallel/test-http2-bidirectional-write-deadlock.js
@@ -38,6 +38,7 @@ class StalledClientSocket extends Duplex {
     super();
     this.inner = net.connect(port, common.localhostIPv4);
     this.inner.on('data', (chunk) => this.push(chunk));
+    this.inner.on('end', () => this.push(null));
   }
   _read() {
     // Incoming data is pushed as it arrives.
@@ -54,7 +55,7 @@ class StalledClientSocket extends Duplex {
     callback();
   }
   _final(callback) {
-    callback();
+    this.inner.end(callback);
   }
   _destroy(err, callback) {
     this.inner.destroy();
@@ -101,7 +102,8 @@ server.listen(0, common.mustCall(() => {
     stallWrites = false;
     for (const callback of heldCallbacks) callback();
 
-    client.destroy();
+    req.end();
+    client.close();
     server.close();
   }));
 }));
diff --git a/test/parallel/test-http2-connection-window-size-option.js b/test/parallel/test-http2-connection-window-size-option.js
new file mode 100644
index 000000000000..ddf5932fb28d
--- /dev/null
+++ b/test/parallel/test-http2-connection-window-size-option.js
@@ -0,0 +1,108 @@
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const http2 = require('http2');
+
+const DEFAULT_WINDOW = 33554432;
+const SPEC_DEFAULT_WINDOW = 65535;
+
+// Set client & server's windows (or default if undefined) and validate that
+// the both peers see the remote value as expected.
+function check(serverWindow, clientWindow) {
+  const server = http2.createServer({ connectionWindowSize: serverWindow });
+  serverWindow ??= DEFAULT_WINDOW;
+  clientWindow ??= DEFAULT_WINDOW;
+
+  server.on('session', common.mustCall((session) => {
+    assert.strictEqual(session.state.effectiveLocalWindowSize, serverWindow);
+  }));
+
+  server.on('stream', common.mustCall((stream) => {
+    assert.strictEqual(stream.session.state.remoteWindowSize, clientWindow);
+    stream.respond({ ':status': 200 }, { endStream: true });
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    const client = http2.connect(`http://localhost:${server.address().port}`,
+                                 { connectionWindowSize: clientWindow });
+
+    client.on('connect', common.mustCall(() => {
+      assert.strictEqual(client.state.effectiveLocalWindowSize, clientWindow);
+    }));
+
+    const req = client.request();
+    req.resume();
+    req.on('close', common.mustCall(() => {
+      assert.strictEqual(client.state.remoteWindowSize, serverWindow);
+      client.close();
+      server.close();
+    }));
+  }));
+}
+
+check(undefined, undefined);
+
+// The option shrinks the window below the default, which setLocalWindowSize()
+// cannot do once the connection has been established.
+check(SPEC_DEFAULT_WINDOW, SPEC_DEFAULT_WINDOW);
+
+// Each end of the connection is configured independently.
+check(2 ** 20, 2 ** 21);
+
+// A window below the peer's fixed initial 65535 is the only case that shrinks
+// the window nghttp2 has already accounted for, leaving a reduction to pay off
+// before any WINDOW_UPDATE can be sent again. Larger windows, including the
+// default, only ever grow it. Send more than the window to prove the
+// connection still resumes rather than stalling once the reduction is paid.
+{
+  const windowSize = 16384;
+  const payload = Buffer.alloc(2 ** 18, 'x');
+  const server = http2.createServer({ connectionWindowSize: windowSize });
+
+  server.on('stream', common.mustCall((stream) => {
+    let received = 0;
+    stream.on('data', (chunk) => { received += chunk.length; });
+    stream.on('end', common.mustCall(() => {
+      assert.strictEqual(received, payload.length);
+      stream.respond({ ':status': 200 }, { endStream: true });
+    }));
+  }));
+
+  server.listen(0, common.mustCall(() => {
+    const client = http2.connect(`http://localhost:${server.address().port}`,
+                                 { connectionWindowSize: windowSize });
+    const req = client.request({ ':method': 'POST', ':path': '/' });
+    req.resume();
+    req.end(payload);
+    req.on('close', common.mustCall(() => {
+      client.close();
+      server.close();
+    }));
+  }));
+}
+
+for (const connectionWindowSize of [-1, 0, 2 ** 31, 1.5]) {
+  assert.throws(() => http2.createServer({ connectionWindowSize }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => http2.createSecureServer({ connectionWindowSize }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => http2.connect('http://localhost:80', { connectionWindowSize }),
+                { code: 'ERR_OUT_OF_RANGE' });
+}
+
+// Windows below the peer's fixed initial 65535 are permitted: they cannot
+// shrink that first burst, but they do throttle everything after it.
+for (const connectionWindowSize of [1, 1024, 65534]) {
+  http2.createServer({ connectionWindowSize }).close();
+}
+
+for (const connectionWindowSize of ['1024', null, {}]) {
+  assert.throws(() => http2.createServer({ connectionWindowSize }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => http2.connect('http://localhost:80', { connectionWindowSize }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
diff --git a/test/parallel/test-http2-util-update-options-buffer.js b/test/parallel/test-http2-util-update-options-buffer.js
index 888ddd287cf1..c046395f1a88 100644
--- a/test/parallel/test-http2-util-update-options-buffer.js
+++ b/test/parallel/test-http2-util-update-options-buffer.js
@@ -26,7 +26,8 @@ const IDX_OPTIONS_MAX_SETTINGS = 9;
 const IDX_OPTIONS_STREAM_RESET_RATE = 10;
 const IDX_OPTIONS_STREAM_RESET_BURST = 11;
 const IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION = 12;
-const IDX_OPTIONS_FLAGS = 13;
+const IDX_OPTIONS_CONNECTION_WINDOW_SIZE = 13;
+const IDX_OPTIONS_FLAGS = 14;
 
 {
   updateOptionsBuffer({
@@ -42,7 +43,8 @@ const IDX_OPTIONS_FLAGS = 13;
     maxSettings: 10,
     streamResetRate: 11,
     streamResetBurst: 12,
-    strictFieldWhitespaceValidation: false
+    strictFieldWhitespaceValidation: false,
+    connectionWindowSize: 13
   });
 
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_DEFLATE_DYNAMIC_TABLE_SIZE], 1);
@@ -58,6 +60,7 @@ const IDX_OPTIONS_FLAGS = 13;
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_STREAM_RESET_RATE], 11);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_STREAM_RESET_BURST], 12);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION], 1);
+  assert.strictEqual(optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE], 13);
 
   const flags = optionsBuffer[IDX_OPTIONS_FLAGS];
 
@@ -73,11 +76,13 @@ const IDX_OPTIONS_FLAGS = 13;
   assert.ok(flags & (1 << IDX_OPTIONS_STREAM_RESET_RATE));
   assert.ok(flags & (1 << IDX_OPTIONS_STREAM_RESET_BURST));
   assert.ok(flags & (1 << IDX_OPTIONS_STRICT_HTTP_FIELD_WHITESPACE_VALIDATION));
+  assert.ok(flags & (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE));
 }
 
 {
   optionsBuffer[IDX_OPTIONS_MAX_SEND_HEADER_BLOCK_LENGTH] = 0;
   optionsBuffer[IDX_OPTIONS_MAX_OUTSTANDING_PINGS] = 0;
+  optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE] = 0;
 
   updateOptionsBuffer({
     maxDeflateDynamicTableSize: 1,
@@ -94,6 +99,7 @@ const IDX_OPTIONS_FLAGS = 13;
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_HEADER_LIST_PAIRS], 6);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_SEND_HEADER_BLOCK_LENGTH], 0);
   assert.strictEqual(optionsBuffer[IDX_OPTIONS_MAX_OUTSTANDING_PINGS], 0);
+  assert.strictEqual(optionsBuffer[IDX_OPTIONS_CONNECTION_WINDOW_SIZE], 0);
 
   const flags = optionsBuffer[IDX_OPTIONS_FLAGS];
 
@@ -105,4 +111,5 @@ const IDX_OPTIONS_FLAGS = 13;
 
   assert.ok(!(flags & (1 << IDX_OPTIONS_MAX_SEND_HEADER_BLOCK_LENGTH)));
   assert.ok(!(flags & (1 << IDX_OPTIONS_MAX_OUTSTANDING_PINGS)));
+  assert.ok(!(flags & (1 << IDX_OPTIONS_CONNECTION_WINDOW_SIZE)));
 }
diff --git a/test/parallel/test-https-agent-additional-options.js b/test/parallel/test-https-agent-additional-options.js
index 3707855ed5c8..eca5f147a419 100644
--- a/test/parallel/test-https-agent-additional-options.js
+++ b/test/parallel/test-https-agent-additional-options.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const https = require('https');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const fips3 = hasFIPS(3);
 
@@ -17,7 +17,7 @@ const options = {
   minVersion: fips3 ? 'TLSv1.2' : 'TLSv1.1',
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   options.ciphers = fips3 ?
     'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
 }
@@ -36,7 +36,7 @@ function getBaseOptions(port) {
     servername: 'agent1',
   };
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     baseOptions.ciphers = fips3 ?
       'ECDHE-RSA-AES256-GCM-SHA384' : 'ALL@SECLEVEL=0';
   }
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index 971a8f359a6f..c4edc5b33db3 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const https = require('https');
 const { constants: { SSL_OP_NO_TICKET } } = require('crypto');
@@ -25,7 +25,7 @@ if (fips3) {
   options.maxVersion = 'TLSv1.3';
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   options.ciphers = fips3 ?
     'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
diff --git a/test/parallel/test-https-agent-session-reuse.js b/test/parallel/test-https-agent-session-reuse.js
index c5b7b78b8e02..da110e4aeb73 100644
--- a/test/parallel/test-https-agent-session-reuse.js
+++ b/test/parallel/test-https-agent-session-reuse.js
@@ -1,11 +1,13 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
 }
diff --git a/test/parallel/test-https-client-renegotiation-limit.js b/test/parallel/test-https-client-renegotiation-limit.js
index 729176b7c1aa..ee83c21c8762 100644
--- a/test/parallel/test-https-client-renegotiation-limit.js
+++ b/test/parallel/test-https-client-renegotiation-limit.js
@@ -20,12 +20,14 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-https-options-boolean-check.js b/test/parallel/test-https-options-boolean-check.js
index fa02a165b80f..776e966211c7 100644
--- a/test/parallel/test-https-options-boolean-check.js
+++ b/test/parallel/test-https-options-boolean-check.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff);
 const caArrDataView = toDataView(caCert);
 
 function filterBoringSSLKeyCertArrayCases(options, setName) {
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     return options;
 
   // The array-valued cases exercise multi-identity key/cert handling.
diff --git a/test/parallel/test-internal-webidl-buffer-source.js b/test/parallel/test-internal-webidl-buffer-source.js
index 9e522d7d7b8a..8e81f42a9456 100644
--- a/test/parallel/test-internal-webidl-buffer-source.js
+++ b/test/parallel/test-internal-webidl-buffer-source.js
@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const { test } = require('node:test');
 const vm = require('vm');
@@ -272,6 +272,92 @@ test('AllowSharedBufferSource handles growable shared buffers with explicit ' +
   }
 });
 
+test('Shared buffer growability checks do not read JavaScript properties', () => {
+  for (const [buffer, growable] of [
+    [new SharedArrayBuffer(8), false],
+    [new SharedArrayBuffer(8, { maxByteLength: 8 }), true],
+    [new SharedArrayBuffer(8, { maxByteLength: 16 }), true],
+    [vm.runInNewContext('new SharedArrayBuffer(8)'), false],
+    [vm.runInNewContext('new SharedArrayBuffer(8, { maxByteLength: 16 })'), true],
+  ]) {
+    const view = new Uint8Array(buffer);
+    const dataView = new DataView(buffer);
+    for (const mode of ['shadow', 'getter', 'prototype']) {
+      if (mode === 'shadow') {
+        Object.defineProperty(buffer, 'growable', {
+          value: !growable,
+          configurable: true,
+        });
+      } else if (mode === 'getter') {
+        Object.defineProperty(buffer, 'growable', {
+          get: common.mustNotCall('Unexpected growable getter'),
+          configurable: true,
+        });
+      } else {
+        delete buffer.growable;
+        Object.setPrototypeOf(buffer, null);
+      }
+
+      for (const value of [buffer, view, dataView]) {
+        if (growable) {
+          assert.throws(() => converters.AllowSharedBufferSource(value), {
+            code: 'ERR_INVALID_ARG_TYPE',
+          });
+        } else {
+          assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+        }
+        assert.strictEqual(converters.AllowSharedBufferSource(value, {
+          allowResizable: true,
+        }), value);
+      }
+
+      if (growable) {
+        assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+      }
+      assert.strictEqual(converters.Uint8Array(view, {
+        allowShared: true,
+        allowResizable: true,
+      }), view);
+    }
+  }
+});
+
+test('Shared WebAssembly buffer growability is checked per buffer', {
+  skip: typeof WebAssembly === 'undefined',
+}, () => {
+  const memory = new WebAssembly.Memory({ initial: 1, maximum: 2, shared: true });
+  for (const [buffer, growable] of [
+    [memory.buffer, false],
+    [memory.toResizableBuffer(), true],
+    [memory.toFixedLengthBuffer(), false],
+  ]) {
+    for (const value of [buffer, new Uint8Array(buffer), new DataView(buffer)]) {
+      if (growable) {
+        assert.throws(() => converters.AllowSharedBufferSource(value), {
+          code: 'ERR_INVALID_ARG_TYPE',
+        });
+      } else {
+        assert.strictEqual(converters.AllowSharedBufferSource(value), value);
+      }
+      assert.strictEqual(converters.AllowSharedBufferSource(value, {
+        allowResizable: true,
+      }), value);
+    }
+    const view = new Uint8Array(buffer);
+    if (growable) {
+      assert.throws(() => converters.Uint8Array(view, { allowShared: true }), {
+        code: 'ERR_INVALID_ARG_TYPE',
+      });
+    } else {
+      assert.strictEqual(converters.Uint8Array(view, { allowShared: true }), view);
+    }
+  }
+});
+
 test('BufferSource rejects objects with a forged @@toStringTag', () => {
   const fake = { [Symbol.toStringTag]: 'Uint8Array' };
   assert.throws(
diff --git a/test/parallel/test-internal-webidl-dictionary.js b/test/parallel/test-internal-webidl-dictionary.js
new file mode 100644
index 000000000000..fcc6f3e28127
--- /dev/null
+++ b/test/parallel/test-internal-webidl-dictionary.js
@@ -0,0 +1,67 @@
+'use strict';
+
+// Flags: --expose-internals
+
+const common = require('../common');
+const assert = require('node:assert/strict');
+const { createDictionaryConverter } = require('internal/webidl');
+
+const groups = [
+  [{ key: 'z', converter: String }, { key: 'b', converter: String }],
+  [{ key: 'c', converter: String }, { key: 'a', converter: String }],
+];
+let convert;
+Object.defineProperty(Array.prototype, 2, {
+  configurable: true,
+  get: common.mustNotCall(),
+  set: common.mustNotCall(),
+});
+try {
+  convert = createDictionaryConverter('Derived', groups);
+} finally {
+  delete Array.prototype[2];
+}
+
+const first = convert(null);
+const second = convert(undefined, new Proxy({}, { get: common.mustNotCall() }));
+assert.deepStrictEqual(first, { __proto__: null });
+assert.deepStrictEqual(second, first);
+assert.notStrictEqual(first, second);
+
+const trace = [];
+const input = {
+  __proto__: { c: 'inherited' },
+  b: {
+    toString: common.mustCall(() => {
+      trace.push('convert b');
+      input.z = 'changed';
+      return 'b';
+    }),
+  },
+  z: 'original',
+  a: 'a',
+};
+const result = convert(new Proxy(input, {
+  get(target, key) { trace.push(key); return target[key]; },
+}));
+assert.deepStrictEqual(trace, ['b', 'convert b', 'z', 'a', 'c']);
+assert.deepStrictEqual(result, { __proto__: null, b: 'b', z: 'changed', a: 'a', c: 'inherited' });
+
+trace.length = 0;
+convert(new Proxy({}, { get(target, key) { trace.push(key); } }));
+assert.deepStrictEqual(trace, ['b', 'z', 'a', 'c']);
+
+const defaults = createDictionaryConverter('Defaults', [[{
+  key: 'z', converter: common.mustNotCall(), defaultValue: common.mustCall(() => [], 2),
+}]]);
+assert.notStrictEqual(defaults(null).z, defaults(undefined).z);
+
+const required = createDictionaryConverter('Required', [[{
+  key: 'z', converter: common.mustNotCall(), defaultValue: common.mustCall(() => 'default', 2),
+}], [
+  { key: 'a', converter: common.mustNotCall(), required: true },
+  { key: 'b', converter: common.mustNotCall(), defaultValue: common.mustNotCall() },
+]]);
+for (const value of [null, undefined]) {
+  assert.throws(() => required(value), { code: 'ERR_MISSING_OPTION' });
+}
diff --git a/test/parallel/test-internal-webidl.js b/test/parallel/test-internal-webidl.js
index bd08648549be..f52896d5210f 100644
--- a/test/parallel/test-internal-webidl.js
+++ b/test/parallel/test-internal-webidl.js
@@ -1,7 +1,7 @@
 // Flags: --expose-internals
 'use strict';
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const vm = require('vm');
 const webidl = require('internal/webidl');
@@ -510,11 +510,50 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
   }), []);
 }
 
+for (const [prototype, value] of [
+  [Number.prototype, 1],
+  [String.prototype, 'iterator'],
+  [Boolean.prototype, true],
+  [BigInt.prototype, 1n],
+  [Symbol.prototype, Symbol()],
+]) {
+  let nextReads = 0;
+  Object.defineProperty(prototype, 'next', {
+    configurable: true,
+    get() {
+      nextReads++;
+      return () => ({ done: true });
+    },
+  });
+  try {
+    const iterable = { [Symbol.iterator]: () => value };
+    assertInvalidArgType(() => converters['sequence<DOMString>'](iterable));
+    assertInvalidArgType(() => structuredClone(null, { transfer: iterable }));
+    assert.strictEqual(nextReads, 0);
+  } finally {
+    delete prototype.next;
+  }
+}
+
 {
-  class Example {}
+  function iterator() {}
+  iterator.next = () => ({ done: true });
+  assert.deepStrictEqual(converters['sequence<DOMString>']({
+    [Symbol.iterator]: () => iterator,
+  }), []);
+}
+
+{
+  class Example {
+    #brand;
+
+    static is(value) {
+      return typeof value === 'object' && value !== null && #brand in value;
+    }
+  }
   const converter = webidl.createInterfaceConverter(
     'Example',
-    Example.prototype);
+    Example.is);
   const example = new Example();
 
   assert.strictEqual(converter(example), example);
@@ -523,6 +562,42 @@ assert.throws(() => webidl.requiredArguments(1, 2, opts), {
     code: 'ERR_INVALID_ARG_TYPE',
     message: 'Prefix: Context is not of type Example.',
   });
+  assertInvalidArgType(() => converter({ __proto__: Example.prototype }));
+  assertInvalidArgType(() => converter(new Proxy(example, {})));
+  Object.setPrototypeOf(example, null);
+  assert.strictEqual(converter(example), example);
+}
+
+{
+  const signal = AbortSignal.abort('reason');
+  for (const value of [
+    Object.create(AbortSignal.prototype, { aborted: { value: false } }),
+    { __proto__: signal },
+    Object.create(AbortSignal.prototype, Object.getOwnPropertyDescriptors(signal)),
+    new Proxy(signal, {}),
+  ]) {
+    assertInvalidArgType(() => converters.AbortSignal(value));
+    assertInvalidArgType(() => AbortSignal.any([value]));
+  }
+
+  Object.setPrototypeOf(signal, null);
+  assert.strictEqual(converters.AbortSignal(signal), signal);
+  const composite = AbortSignal.any([signal]);
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
+}
+
+{
+  const controller = new AbortController();
+  Object.defineProperties(controller.signal, {
+    aborted: { get: common.mustNotCall('Unexpected aborted getter') },
+    reason: { get: common.mustNotCall('Unexpected reason getter') },
+  });
+  const composite = AbortSignal.any([controller.signal]);
+  assert.strictEqual(composite.aborted, false);
+  controller.abort('reason');
+  assert.strictEqual(composite.aborted, true);
+  assert.strictEqual(composite.reason, 'reason');
 }
 
 {
diff --git a/test/parallel/test-mark-promise-handled.js b/test/parallel/test-mark-promise-handled.js
new file mode 100644
index 000000000000..c2c789310bbf
--- /dev/null
+++ b/test/parallel/test-mark-promise-handled.js
@@ -0,0 +1,25 @@
+'use strict';
+
+const common = require('../common');
+const assert = require('node:assert');
+const { markPromiseAsHandled } = require('node:util');
+
+process.on('unhandledRejection', common.mustNotCall());
+
+markPromiseAsHandled(Promise.reject(123));
+
+{
+  const { promise, reject } = Promise.withResolvers();
+  markPromiseAsHandled(promise);
+  reject(123);
+}
+
+{
+  const { promise, reject } = Promise.withResolvers();
+  reject(123);
+  markPromiseAsHandled(promise);
+}
+
+assert.throws(() => markPromiseAsHandled(123), {
+  code: 'ERR_INVALID_ARG_TYPE',
+});
diff --git a/test/parallel/test-module-isBuiltin.js b/test/parallel/test-module-isBuiltin.js
index a7815a8dfc1c..ccf359c32029 100644
--- a/test/parallel/test-module-isBuiltin.js
+++ b/test/parallel/test-module-isBuiltin.js
@@ -7,10 +7,14 @@ const { isBuiltin } = require('module');
 assert(isBuiltin('http'));
 assert(isBuiltin('sys'));
 assert(isBuiltin('node:fs'));
+assert(isBuiltin('node:bench'));
+assert(isBuiltin('node:bench/reporters'));
 assert(isBuiltin('node:test'));
 
 // Does not include internal modules
 assert(!isBuiltin('internal/errors'));
+assert(!isBuiltin('bench'));
+assert(!isBuiltin('bench/reporters'));
 assert(!isBuiltin('test'));
 assert(!isBuiltin(''));
 assert(!isBuiltin(undefined));
diff --git a/test/parallel/test-net-boundsocket-transfer-worker.js b/test/parallel/test-net-boundsocket-transfer-worker.js
new file mode 100644
index 000000000000..054be55d7343
--- /dev/null
+++ b/test/parallel/test-net-boundsocket-transfer-worker.js
@@ -0,0 +1,64 @@
+'use strict';
+
+// This test verifies that an un-adopted net.BoundSocket can be transferred to
+// a worker thread via worker_threads postMessage()'s transferList. The parent
+// thread binds synchronously to reserve the port, then hands the bound socket
+// off; the worker adopts it via server.listen() and accepts connections.
+
+const common = require('../common');
+
+const assert = require('assert');
+const net = require('net');
+const {
+  Worker,
+  parentPort,
+  threadId,
+  workerData,
+} = require('worker_threads');
+
+if (workerData?.role === 'server') {
+  parentPort.on('message', common.mustCall(({ bound, port }) => {
+    assert.ok(bound instanceof net.BoundSocket);
+    // The bound address survives the transfer.
+    assert.strictEqual(bound.address().port, port);
+
+    const server = net.createServer((socket) => {
+      socket.end(`served-by:${threadId}`);
+    });
+    server.listen(bound, common.mustCall(() => {
+      assert.strictEqual(server.address().port, port);
+      // Adoption consumed the bound socket.
+      assert.throws(() => bound.address(), {
+        code: 'ERR_SOCKET_HANDLE_ADOPTED',
+      });
+      parentPort.postMessage('listening');
+    }));
+  }));
+  return;
+}
+
+const worker = new Worker(__filename, { workerData: { role: 'server' } });
+
+const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+const { port } = bound.address();
+
+// Move the bound socket to the worker thread.
+worker.postMessage({ bound, port }, [bound]);
+
+// The source is left in the adopted state; further use throws.
+assert.throws(() => bound.address(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.fd(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+assert.throws(() => bound.close(), { code: 'ERR_SOCKET_HANDLE_ADOPTED' });
+
+worker.on('message', common.mustCall((msg) => {
+  assert.strictEqual(msg, 'listening');
+  const client = net.connect(port, '127.0.0.1');
+  client.setEncoding('utf8');
+  let response = '';
+  client.on('data', (chunk) => { response += chunk; });
+  client.on('end', common.mustCall(() => {
+    assert.match(response, /^served-by:\d+$/);
+    assert.notStrictEqual(response, `served-by:${threadId}`);
+    worker.terminate();
+  }));
+}));
diff --git a/test/parallel/test-net-transfer-guards.js b/test/parallel/test-net-transfer-guards.js
index 0879ec9da81a..d9b836deafbd 100644
--- a/test/parallel/test-net-transfer-guards.js
+++ b/test/parallel/test-net-transfer-guards.js
@@ -1,17 +1,31 @@
 'use strict';
 
-// This test verifies the guards that reject transferring a net.Socket or
-// net.Server that is not in a clean, movable state. Serialization is triggered
-// with a MessageChannel, so no worker thread is required.
+// This test verifies the guards that reject transferring a net.Socket,
+// net.Server or net.BoundSocket that is not in a clean, movable state.
+// Serialization is triggered with a MessageChannel, so no worker thread is
+// required.
 
 const common = require('../common');
 
 const assert = require('assert');
 const net = require('net');
 const { MessageChannel } = require('worker_threads');
+const tmpdir = require('../common/tmpdir');
+
+tmpdir.refresh();
 
 const { port1 } = new MessageChannel();
 
+// A pipe BoundSocket is not transferable; only TCP binds can move between
+// event loops.
+{
+  const bound = new net.BoundSocket({ path: common.PIPE });
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+  bound.close();
+}
+
 // A Server that is not listening (no handle) cannot be transferred.
 {
   const server = net.createServer();
@@ -20,6 +34,25 @@ const { port1 } = new MessageChannel();
   });
 }
 
+// A closed BoundSocket no longer owns a handle and cannot be transferred.
+{
+  const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+  bound.close();
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+}
+
+// An adopted BoundSocket no longer owns a handle and cannot be transferred.
+{
+  const bound = new net.BoundSocket({ host: '127.0.0.1', port: 0 });
+  const socket = new net.Socket({ handle: bound });
+  assert.throws(() => port1.postMessage({ bound }, [bound]), {
+    code: 'ERR_WORKER_HANDLE_NOT_TRANSFERABLE',
+  });
+  socket.destroy();
+}
+
 // A Socket that has already consumed data cannot be transferred, because that
 // buffered data would be lost on the sending side.
 {
diff --git a/test/parallel/test-perf-hooks-histogram-stats.js b/test/parallel/test-perf-hooks-histogram-stats.js
index 61a3894924ff..581579d12686 100644
--- a/test/parallel/test-perf-hooks-histogram-stats.js
+++ b/test/parallel/test-perf-hooks-histogram-stats.js
@@ -5,6 +5,85 @@ require('../common');
 const assert = require('assert');
 const { createHistogram, importHistogram } = require('perf_hooks');
 
+// ---------------------------------------------------------------------------
+// meanCI([options]) — confidence interval for the mean
+// ---------------------------------------------------------------------------
+{
+  const empty = createHistogram();
+  const emptyCI = empty.meanCI();
+  assert.strictEqual(Object.getPrototypeOf(emptyCI), null);
+  assert.ok(Number.isNaN(emptyCI.mean));
+  assert.ok(Number.isNaN(emptyCI.lower));
+  assert.ok(Number.isNaN(emptyCI.upper));
+
+  // A confidence interval is undefined with fewer than two samples.
+  const one = createHistogram();
+  one.record(42);
+  const oneCI = one.meanCI();
+  assert.strictEqual(oneCI.mean, 42);
+  assert.ok(Number.isNaN(oneCI.lower));
+  assert.ok(Number.isNaN(oneCI.upper));
+
+  // This known sample has a 95% Student's t confidence interval of
+  // approximately [3.334149, 7.665851].
+  const h = createHistogram();
+  for (let i = 1; i <= 10; i++) h.record(i);
+  const ci95 = h.meanCI();
+  assert.strictEqual(ci95.mean, h.mean);
+  assert.ok(Math.abs(ci95.lower - 3.3341494103866087) < 1e-6);
+  assert.ok(Math.abs(ci95.upper - 7.665850589613392) < 1e-6);
+
+  // Higher confidence produces a wider interval.
+  const ci90 = h.meanCI({ confidence: 0.90 });
+  const ci99 = h.meanCI({ confidence: 0.99 });
+  assert.ok((ci99.upper - ci99.lower) > (ci90.upper - ci90.lower));
+
+  // Very low confidence levels retain precision near the center of the
+  // distribution. With two samples, the t-distribution has one degree of
+  // freedom and the expected interval width is tan(pi * confidence / 2).
+  const two = createHistogram();
+  two.record(1);
+  two.record(2);
+  const lowConfidence = 1e-9;
+  const narrowCI = two.meanCI({ confidence: lowConfidence });
+  const expectedWidth = Math.tan(Math.PI * lowConfidence / 2);
+  const actualWidth = narrowCI.upper - narrowCI.lower;
+  assert.ok(Math.abs(actualWidth - expectedWidth) / expectedWidth < 1e-4);
+
+  // Very high confidence levels are not truncated by the quantile search.
+  const extremeCI = two.meanCI({ confidence: 0.9999999 });
+  assert.ok(extremeCI.lower < -3_000_000);
+  assert.ok(extremeCI.upper > 3_000_000);
+
+  const highestCI = two.meanCI({
+    confidence: 1 - Number.EPSILON / 2,
+  });
+  assert.ok(Number.isFinite(highestCI.lower));
+  assert.ok(Number.isFinite(highestCI.upper));
+
+  // Constant values have no sampling uncertainty.
+  const constant = createHistogram();
+  for (let i = 0; i < 100; i++) constant.record(7);
+  assert.deepStrictEqual(constant.meanCI(), {
+    __proto__: null,
+    mean: 7,
+    lower: 7,
+    upper: 7,
+  });
+
+  // Validation.
+  assert.throws(() => h.meanCI({ confidence: 0 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 1 }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: NaN }),
+                { code: 'ERR_OUT_OF_RANGE' });
+  assert.throws(() => h.meanCI({ confidence: 'high' }),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => h.meanCI(null),
+                { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 // ---------------------------------------------------------------------------
 // welchTest(other) — Welch's t-test
 // ---------------------------------------------------------------------------
@@ -586,6 +665,7 @@ const { createHistogram, importHistogram } = require('perf_hooks');
   const wrongThis = {};
 
   const methods = [
+    ['meanCI', []],
     ['welchTest', [h]],
     ['mannWhitneyTest', [h]],
     ['cohensD', [h]],
@@ -633,6 +713,7 @@ const { createHistogram, importHistogram } = require('perf_hooks');
   stub[kHandle] = null;
 
   assert.strictEqual(stub.welchTest(h), undefined);
+  assert.strictEqual(stub.meanCI(), undefined);
   assert.strictEqual(stub.mannWhitneyTest(h), undefined);
   assert.strictEqual(stub.percentileCI(50), undefined);
   assert.strictEqual(stub.burnRate(0.999), undefined);
diff --git a/test/parallel/test-perf-hooks-resourcetiming-attributes.js b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
new file mode 100644
index 000000000000..66fee5265cd4
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-attributes.js
@@ -0,0 +1,116 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+const {
+  PerformanceResourceTiming,
+  performance,
+} = require('perf_hooks');
+
+// Covers the IDL attributes finalResponseHeadersStart,
+// firstInterimResponseStart, renderBlockingStatus, contentType and contentEncoding,
+// and the spec requirement that responseStart prefers a non-zero
+// firstInterimResponseStart over finalResponseHeadersStart.
+
+function createTimingInfo(overrides = {}) {
+  return {
+    startTime: 0,
+    redirectStartTime: 0,
+    redirectEndTime: 0,
+    postRedirectStartTime: 0,
+    finalServiceWorkerStartTime: 0,
+    finalNetworkRequestStartTime: 0,
+    finalNetworkResponseStartTime: 0,
+    endTime: 0,
+    encodedBodySize: 0,
+    decodedBodySize: 0,
+    finalConnectionTimingInfo: null,
+    ...overrides,
+  };
+}
+
+function markResourceTiming(timingInfo, bodyInfo) {
+  return performance.markResourceTiming(
+    timingInfo,
+    'http://localhost:8080',
+    'fetch',
+    {},
+    '',
+    bodyInfo,
+    200,
+    '',
+  );
+}
+
+// Default values when no optional timing or body metadata is present.
+{
+  const resource = markResourceTiming(createTimingInfo(), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 0);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 0);
+  assert.strictEqual(resource.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(resource.contentType, '');
+  assert.strictEqual(resource.contentEncoding, '');
+}
+
+// responseStart falls back to the final response when no interim response timing was recorded.
+{
+  const resource = markResourceTiming(createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 0,
+  }), {});
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 0);
+  assert.strictEqual(resource.responseStart, 123);
+}
+
+// Values reflected from timing info and body info.
+{
+  const timingInfo = createTimingInfo({
+    finalNetworkResponseStartTime: 123,
+    firstInterimNetworkResponseStartTime: 45,
+    renderBlocking: true,
+  });
+  const bodyInfo = {
+    contentType: 'text/html',
+    contentEncoding: 'gzip',
+  };
+  const resource = markResourceTiming(timingInfo, bodyInfo);
+
+  assert.strictEqual(resource.finalResponseHeadersStart, 123);
+  assert.strictEqual(resource.firstInterimResponseStart, 45);
+  assert.strictEqual(resource.responseStart, 45);
+  assert.strictEqual(resource.renderBlockingStatus, 'blocking');
+  assert.strictEqual(resource.contentType, 'text/html');
+  assert.strictEqual(resource.contentEncoding, 'gzip');
+
+  const json = resource.toJSON();
+  assert.strictEqual(json.finalResponseHeadersStart, 123);
+  assert.strictEqual(json.firstInterimResponseStart, 45);
+  assert.strictEqual(json.responseStart, 45);
+  assert.strictEqual(json.renderBlockingStatus, 'blocking');
+  assert.strictEqual(json.contentType, 'text/html');
+  assert.strictEqual(json.contentEncoding, 'gzip');
+}
+
+// The attributes are enumerable getters on the prototype and perform a
+// brand check like the other PerformanceResourceTiming attributes.
+for (const name of [
+  'finalResponseHeadersStart',
+  'firstInterimResponseStart',
+  'renderBlockingStatus',
+  'contentType',
+  'contentEncoding',
+]) {
+  const desc = Object.getOwnPropertyDescriptor(
+    PerformanceResourceTiming.prototype, name);
+  assert.strictEqual(desc.enumerable, true, name);
+  assert.strictEqual(typeof desc.get, 'function', name);
+  assert.throws(() => desc.get.call({}), {
+    code: 'ERR_INVALID_THIS',
+  }, name);
+}
+
+performance.clearResourceTimings();
diff --git a/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
new file mode 100644
index 000000000000..40bcd1184a7d
--- /dev/null
+++ b/test/parallel/test-perf-hooks-resourcetiming-fetch.mjs
@@ -0,0 +1,67 @@
+// The ESM common wrapper does not export localhostIPv4.
+// eslint-disable-next-line node-core/require-common-first
+import common from '../common/index.js';
+
+import assert from 'node:assert';
+import { once } from 'node:events';
+import { createServer } from 'node:http';
+import {
+  PerformanceResourceTiming,
+  performance,
+} from 'node:perf_hooks';
+
+// This test ensures that built-in fetch creates a PerformanceResourceTiming
+// entry with the resource timing attributes exposed by Node.js.
+
+const responseBody = 'Hello world';
+const server = createServer(common.mustCall((req, res) => {
+  res.end(responseBody);
+}));
+
+server.listen(0, common.localhostIPv4);
+await once(server, 'listening');
+
+async function closeServer() {
+  if (server.listening) {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+try {
+  performance.clearResourceTimings();
+
+  const url = `http://${common.localhostIPv4}:${server.address().port}/`;
+  const response = await fetch(url);
+  assert.strictEqual(await response.text(), responseBody);
+  await closeServer();
+
+  const entries = performance.getEntriesByName(url, 'resource');
+  assert.strictEqual(entries.length, 1);
+
+  const [entry] = entries;
+  assert(entry instanceof PerformanceResourceTiming);
+  assert.strictEqual(entry.initiatorType, 'fetch');
+  assert.strictEqual(entry.responseStatus, 200);
+  assert(entry.finalResponseHeadersStart > 0);
+  assert.strictEqual(entry.firstInterimResponseStart, 0);
+  assert.strictEqual(entry.responseStart, entry.finalResponseHeadersStart);
+  assert(entry.responseEnd >= entry.responseStart);
+  assert.strictEqual(entry.renderBlockingStatus, 'non-blocking');
+  assert.strictEqual(entry.contentType, '');
+  assert.strictEqual(entry.contentEncoding, '');
+
+  const json = entry.toJSON();
+  for (const name of [
+    'finalResponseHeadersStart',
+    'firstInterimResponseStart',
+    'responseStart',
+    'renderBlockingStatus',
+    'contentType',
+    'contentEncoding',
+  ]) {
+    assert.strictEqual(json[name], entry[name], name);
+  }
+} finally {
+  performance.clearResourceTimings();
+  await closeServer();
+}
diff --git a/test/parallel/test-perf-hooks-resourcetiming.js b/test/parallel/test-perf-hooks-resourcetiming.js
index f76cd669004e..9a94ba795e95 100644
--- a/test/parallel/test-perf-hooks-resourcetiming.js
+++ b/test/parallel/test-perf-hooks-resourcetiming.js
@@ -174,6 +174,8 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
@@ -181,6 +183,9 @@ function createTimingInfo({
     decodedBodySize: 0,
     responseStatus: 200,
     deliveryType: '',
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: '',
   });
   assert.strictEqual(util.inspect(performance.getEntries()), `[
   PerformanceResourceTiming {
@@ -200,13 +205,18 @@ function createTimingInfo({
     connectEnd: 0,
     secureConnectionStart: 0,
     requestStart: 0,
+    finalResponseHeadersStart: 0,
+    firstInterimResponseStart: 0,
     responseStart: 0,
     responseEnd: 0,
     transferSize: 0,
     encodedBodySize: 0,
     decodedBodySize: 0,
     deliveryType: '',
-    responseStatus: 200
+    responseStatus: 200,
+    renderBlockingStatus: 'non-blocking',
+    contentType: '',
+    contentEncoding: ''
   }
 ]`);
   assert.strictEqual(util.inspect(resource), `PerformanceResourceTiming {
@@ -226,13 +236,18 @@ function createTimingInfo({
   connectEnd: 0,
   secureConnectionStart: 0,
   requestStart: 0,
+  finalResponseHeadersStart: 0,
+  firstInterimResponseStart: 0,
   responseStart: 0,
   responseEnd: 0,
   transferSize: 0,
   encodedBodySize: 0,
   decodedBodySize: 0,
   deliveryType: '',
-  responseStatus: 200
+  responseStatus: 200,
+  renderBlockingStatus: 'non-blocking',
+  contentType: '',
+  contentEncoding: ''
 }`);
 
   assert(resource instanceof PerformanceEntry);
diff --git a/test/parallel/test-permission-audit-addons-does-not-deny.js b/test/parallel/test-permission-audit-addons-does-not-deny.js
new file mode 100644
index 000000000000..dd08058ab3ff
--- /dev/null
+++ b/test/parallel/test-permission-audit-addons-does-not-deny.js
@@ -0,0 +1,65 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not disable native addon
+// loading. In audit mode process.dlopen() must reach the regular loading
+// path (failing with ERR_DLOPEN_FAILED for a missing file, after publishing
+// the denial to the diagnostics channel) instead of being rejected upfront
+// with ERR_DLOPEN_DISABLED, which is still the expected behavior under
+// --permission.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+
+function run(flag) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:addon', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    try {
+      process.dlopen({ exports: {} }, '/nonexistent/audit-test.node');
+      console.log('RESULT NO_THROW');
+    } catch (e) {
+      console.log('RESULT THREW ' + e.code);
+    }
+    console.log('AUDIT ' + JSON.stringify(msgs));
+  `;
+
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8' },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+test('audit mode reaches the real dlopen and logs the denial', () => {
+  const { result, msgs } = run('--permission-audit');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_FAILED');
+  assert.strictEqual(msgs.length, 1);
+  assert.strictEqual(msgs[0].permission, 'Addon');
+});
+
+test('enforce mode still disables dlopen upfront', () => {
+  const { result } = run('--permission');
+  assert.strictEqual(result, 'THREW ERR_DLOPEN_DISABLED');
+});
diff --git a/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
new file mode 100644
index 000000000000..f2d98a0b6f83
--- /dev/null
+++ b/test/parallel/test-permission-audit-fs-lstat-symlink-does-not-deny.js
@@ -0,0 +1,144 @@
+'use strict';
+
+const common = require('../common');
+const { isMainThread } = require('worker_threads');
+
+if (!isMainThread) {
+  common.skip('This test only works on a main thread');
+}
+
+// This test ensures that --permission-audit does not deny fs.lstat() and
+// fs.symlink(), whose permission checks live in the JavaScript layer, while
+// --permission still denies them. Audit mode must publish the denial through
+// the diagnostics channel and let the operation continue. Each API is covered
+// in its three flavours (sync, callback and promise), since every flavour
+// carries its own copy of the check.
+
+const assert = require('assert');
+const { spawnSync } = require('child_process');
+const { test } = require('node:test');
+const fixtures = require('../common/fixtures');
+const tmpdir = require('../common/tmpdir');
+
+const blockedFile = fixtures.path('permission', 'deny', 'protected-file.md');
+
+function run(flag, { op, name }) {
+  const childScript = `
+    const dc = require('node:diagnostics_channel');
+    const msgs = [];
+    dc.subscribe('node:permission-model:fs', (m) => msgs.push({
+      permission: m.permission,
+      resource: m.resource,
+    }));
+    (async () => {
+      try {
+        await (${op});
+        console.log('RESULT NO_THROW');
+      } catch (e) {
+        console.log('RESULT THREW ' + e.code);
+      }
+      console.log('AUDIT ' + JSON.stringify(msgs));
+    })();
+  `;
+
+  const env = {
+    ...process.env,
+    BLOCKED_FILE: blockedFile,
+    LINK_PATH: tmpdir.resolve(`audit-symlink-${flag.replace(/\W/g, '')}-${name}`),
+  };
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [flag, '-e', childScript],
+    { encoding: 'utf8', env },
+  );
+  assert.strictEqual(status, 0, stderr);
+  const lines = stdout.split('\n');
+  const resultLine = lines.find((l) => l.startsWith('RESULT '));
+  assert.ok(resultLine, stdout);
+  const auditLine = lines.find((l) => l.startsWith('AUDIT '));
+  assert.ok(auditLine, stdout);
+  return {
+    result: resultLine.replace('RESULT ', ''),
+    msgs: JSON.parse(auditLine.replace('AUDIT ', '')),
+  };
+}
+
+const lstatOps = [
+  {
+    name: 'lstatSync',
+    api: 'fs.lstatSync()',
+    op: 'require("node:fs").lstatSync(process.env.BLOCKED_FILE)',
+  },
+  {
+    name: 'lstatCallback',
+    api: 'fs.lstat()',
+    op: 'new Promise((resolve, reject) => require("node:fs").lstat(' +
+      'process.env.BLOCKED_FILE, (err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'lstatPromises',
+    api: 'fsPromises.lstat()',
+    op: 'require("node:fs").promises.lstat(process.env.BLOCKED_FILE)',
+  },
+];
+
+const symlinkOps = [
+  {
+    name: 'symlinkSync',
+    api: 'fs.symlinkSync()',
+    op: 'require("node:fs").symlinkSync(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+  {
+    name: 'symlinkCallback',
+    api: 'fs.symlink()',
+    op: 'new Promise((resolve, reject) => require("node:fs").symlink(' +
+      'process.env.BLOCKED_FILE, process.env.LINK_PATH, ' +
+      '(err) => err ? reject(err) : resolve()))',
+  },
+  {
+    name: 'symlinkPromises',
+    api: 'fsPromises.symlink()',
+    op: 'require("node:fs").promises.symlink(process.env.BLOCKED_FILE, ' +
+      'process.env.LINK_PATH)',
+  },
+];
+
+tmpdir.refresh();
+
+for (const entry of lstatOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, () => {
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.strictEqual(msgs.length, 1);
+    assert.strictEqual(msgs[0].permission, 'FileSystemRead');
+    assert.ok(msgs[0].resource.endsWith('protected-file.md'));
+  });
+
+  test(`enforce mode still denies ${entry.api}`, () => {
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
+
+for (const entry of symlinkOps) {
+  test(`audit mode does not deny ${entry.api} but logs the denial`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result, msgs } = run('--permission-audit', entry);
+    assert.strictEqual(result, 'NO_THROW');
+    assert.ok(
+      msgs.some((m) => m.permission === 'FileSystem'),
+      JSON.stringify(msgs),
+    );
+  });
+
+  test(`enforce mode still denies ${entry.api}`, (t) => {
+    if (!common.canCreateSymLink()) {
+      return t.skip('insufficient privileges to create symlinks');
+    }
+    const { result } = run('--permission', entry);
+    assert.strictEqual(result, 'THREW ERR_ACCESS_DENIED');
+  });
+}
diff --git a/test/parallel/test-permission-dlopen-binary.js b/test/parallel/test-permission-dlopen-binary.js
new file mode 100644
index 000000000000..3bf2321564fc
--- /dev/null
+++ b/test/parallel/test-permission-dlopen-binary.js
@@ -0,0 +1,113 @@
+// Flags: --expose-internals
+'use strict';
+
+// Loading an addon from bytes materializes them into an image in the temporary
+// directory, so dlopenBinary() requires file-system write access on top of the
+// addon permission every dlopen already needs. Granting only one of the two is
+// not enough.
+
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) common.skip('the hello-world addon is not built');
+
+// Loads the addon from bytes at a path that does not exist on disk, as an
+// addon served by a virtual file system would be, and reports what happened.
+const child = `
+  const { internalBinding } = require('internal/test/binding');
+  const fs = require('fs');
+  const os = require('os');
+  const path = require('path');
+  const { dlopenBinary } = internalBinding('process_methods');
+  const bytes = fs.readFileSync(${JSON.stringify(addonPath)});
+  const target = path.join(os.tmpdir(), 'nonexistent-vfs-dir', 'binding.node');
+  const m = { exports: {} };
+  try {
+    dlopenBinary(m, target, undefined, bytes);
+    console.log('LOADED', m.exports.hello());
+  } catch (err) {
+    console.log('DENIED', err.code, err.permission ?? '');
+  }
+`;
+
+function run(...permissions) {
+  return spawnSync(
+    process.execPath,
+    ['--expose-internals', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', child],
+    { encoding: 'utf8' });
+}
+
+// Both permissions granted: the addon loads.
+{
+  const res = run('--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// Addons allowed but no write access: refused by the file-system check, so the
+// bytes are never materialized.
+{
+  const res = run('--allow-addons');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
+
+// Write access but addons disallowed: refused before the bytes are looked at,
+// the same as any other dlopen under the permission model.
+{
+  const res = run('--allow-fs-write=*');
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /DENIED ERR_DLOPEN_DISABLED/);
+}
+
+// Without the permission model neither check applies.
+{
+  const res = spawnSync(process.execPath, ['--expose-internals', '-e', child],
+                        { encoding: 'utf8' });
+  assert.strictEqual(res.status, 0, res.stderr);
+  assert.match(res.stdout, /LOADED world/);
+}
+
+// The same, reached the way a program actually gets here: an addon inside a
+// mounted VFS. Mounting one under the permission model needs --allow-fs-vfs.
+{
+  const mounted = `
+    const fs = require('fs');
+    const vfs = require('node:vfs');
+    const myVfs = vfs.create();
+    myVfs.writeFileSync('/binding.node',
+                        fs.readFileSync(${JSON.stringify(addonPath)}));
+    const mountPoint = myVfs.mount();
+    try {
+      console.log('LOADED', require(mountPoint + '/binding.node').hello());
+    } catch (err) {
+      console.log('DENIED', err.code, err.permission ?? '');
+    }
+  `;
+  const vfsRun = (...permissions) => spawnSync(
+    process.execPath,
+    ['--experimental-vfs', '--permission', '--allow-fs-read=*',
+     ...permissions, '-e', mounted],
+    { encoding: 'utf8' });
+
+  const ok = vfsRun('--allow-fs-vfs', '--allow-addons', '--allow-fs-write=*');
+  assert.strictEqual(ok.status, 0, ok.stderr);
+  assert.match(ok.stdout, /LOADED world/);
+
+  // Mounting itself is refused without --allow-fs-vfs.
+  const noVfs = vfsRun('--allow-addons', '--allow-fs-write=*');
+  assert.notStrictEqual(noVfs.status, 0);
+  assert.match(noVfs.stderr, /ERR_INVALID_STATE/);
+  assert.match(noVfs.stderr, /--allow-fs-vfs/);
+
+  // Mounted, addons allowed, but no write access: the addon is refused.
+  const noWrite = vfsRun('--allow-fs-vfs', '--allow-addons');
+  assert.strictEqual(noWrite.status, 0, noWrite.stderr);
+  assert.match(noWrite.stdout, /DENIED ERR_ACCESS_DENIED FileSystemWrite/);
+}
diff --git a/test/parallel/test-permission-net-udp-handle.js b/test/parallel/test-permission-net-udp-handle.js
index b6925421f829..10e90610d0c1 100644
--- a/test/parallel/test-permission-net-udp-handle.js
+++ b/test/parallel/test-permission-net-udp-handle.js
@@ -60,6 +60,7 @@ if (mode === 'ipc-denied') {
   const droppedSocket = dgram.createSocket('udp4');
   const sender = dgram.createSocket('udp4');
   droppedSocket.bind(0, '127.0.0.1', common.mustCall(() => {
+    const { port } = droppedSocket.address();
     const child = fork(__filename, ['ipc-drop'], {
       execArgv: [
         '--permission',
@@ -73,7 +74,10 @@ if (mode === 'ipc-denied') {
       if (message === 'ready') {
         child.send('socket', droppedSocket);
       } else if (message === 'receiving') {
-        const { port } = droppedSocket.address();
+        // Sending the socket over IPC keeps this copy open and receiving, so
+        // both ends compete for incoming datagrams. Stop receiving before the
+        // first one goes out.
+        droppedSocket.close();
         timer = setInterval(() => {
           sender.send('after-drop', port, '127.0.0.1');
         }, 10);
@@ -81,7 +85,6 @@ if (mode === 'ipc-denied') {
         assert.strictEqual(message, 'received');
         clearInterval(timer);
         sender.close();
-        droppedSocket.close();
         child.disconnect();
       }
     }, 3));
diff --git a/test/parallel/test-permission-openssl-store.js b/test/parallel/test-permission-openssl-store.js
index ca2f240a9520..f97657051ca9 100644
--- a/test/parallel/test-permission-openssl-store.js
+++ b/test/parallel/test-permission-openssl-store.js
@@ -4,8 +4,8 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL3 } = require('../common/crypto');
-if (!hasOpenSSL3)
+const { hasOpenSSL } = require('../common/crypto');
+if (!hasOpenSSL(3))
   common.skip('requires OpenSSL 3.x');
 
 // Verifies the openssl.store permission: allowed when --allow-openssl-store is
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 8349d4c3af6f..f5aeec017964 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -5,7 +5,7 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
 const rootDir = path.resolve(__dirname, '..', '..');
 const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -44,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   documented.delete('--openssl-legacy-provider');
   documented.delete('--openssl-shared-config');
 }
@@ -63,8 +63,8 @@ const conditionalOpts = [
     filter: (opt) => {
       return [
         '--openssl-config',
-        hasOpenSSL3 ? '--openssl-legacy-provider' : '',
-        hasOpenSSL3 ? '--openssl-shared-config' : '',
+        hasOpenSSL(3) ? '--openssl-legacy-provider' : '',
+        hasOpenSSL(3) ? '--openssl-shared-config' : '',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 14ac88d76cd2..420625b01f59 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -104,12 +104,12 @@ assert.match(
 assert.match(process.versions.modules, /^\d+$/);
 
 if (common.hasCrypto) {
-  const { hasOpenSSL3 } = require('../common/crypto');
+  const { hasOpenSSL } = require('../common/crypto');
   assert.match(process.versions.ncrypto, commonTemplate);
   if (process.config.variables.node_shared_openssl) {
     assert.ok(process.versions.openssl);
   } else {
-    const versionRegex = hasOpenSSL3 ?
+    const versionRegex = hasOpenSSL(3) ?
       // The following also matches a development version of OpenSSL 3.x which
       // can be in the format '3.0.0-alpha4-dev'. This can be handy when
       // building and linking against the main development branch of OpenSSL.
diff --git a/test/parallel/test-quic-h3-header-interest.mjs b/test/parallel/test-quic-h3-header-interest.mjs
new file mode 100644
index 000000000000..4fe05b6f6d3e
--- /dev/null
+++ b/test/parallel/test-quic-h3-header-interest.mjs
@@ -0,0 +1,76 @@
+// Flags: --experimental-quic --experimental-stream-iter --no-warnings
+
+// Verify HTTP/3 header interest is tracked independently of onheaders and
+// that pre-set trailing headers keep the response open until they are sent.
+
+import { hasQuic, skip, mustCall } from '../common/index.mjs';
+import assert from 'node:assert';
+import * as fixtures from '../common/fixtures.mjs';
+
+if (!hasQuic) {
+  skip('QUIC is not enabled');
+}
+
+const { createPrivateKey } = await import('node:crypto');
+const { listen, connect } = await import('node:quic');
+const { bytes } = await import('stream/iter');
+
+const key = createPrivateKey(fixtures.readKey('agent1-key.pem'));
+const cert = fixtures.readKey('agent1-cert.pem');
+const encoder = new TextEncoder();
+const decoder = new TextDecoder();
+const serverDone = Promise.withResolvers();
+
+const serverEndpoint = await listen(mustCall(async (serverSession) => {
+  serverSession.onstream = mustCall(async (stream) => {
+    await stream.closed;
+    serverSession.close();
+    serverDone.resolve();
+  });
+}), {
+  sni: { '*': { keys: [key], certs: [cert] } },
+  onheaders: mustCall(function() {
+    this.sendInformationalHeaders({
+      ':status': '103',
+      'link': '</style.css>; rel=preload',
+    });
+    this.sendHeaders({ ':status': '200' });
+    this.pendingTrailers = { 'x-checksum': 'abc123' };
+    const writer = this.writer;
+    writer.writeSync(encoder.encode('body'));
+    writer.endSync();
+  }),
+});
+
+const clientSession = await connect(serverEndpoint.address, {
+  servername: 'localhost',
+  verifyPeer: 'manual',
+});
+await clientSession.opened;
+
+const infoReceived = Promise.withResolvers();
+const trailersReceived = Promise.withResolvers();
+const stream = await clientSession.createBidirectionalStream({
+  headers: {
+    ':method': 'GET',
+    ':path': '/',
+    ':scheme': 'https',
+    ':authority': 'localhost',
+  },
+  oninfo: mustCall((headers) => {
+    assert.strictEqual(headers[':status'], 103);
+    infoReceived.resolve();
+  }),
+  ontrailers: mustCall((headers) => {
+    assert.strictEqual(headers['x-checksum'], 'abc123');
+    trailersReceived.resolve();
+  }),
+});
+
+assert.strictEqual(decoder.decode(await bytes(stream)), 'body');
+await Promise.all([infoReceived.promise, trailersReceived.promise]);
+assert.strictEqual(stream.headers[':status'], 200);
+
+await Promise.all([stream.closed, serverDone.promise]);
+await clientSession.close();
+await serverEndpoint.close();
diff --git a/test/parallel/test-quic-internal-endpoint-options.mjs b/test/parallel/test-quic-internal-endpoint-options.mjs
index 29529c05e613..a81832c71094 100644
--- a/test/parallel/test-quic-internal-endpoint-options.mjs
+++ b/test/parallel/test-quic-internal-endpoint-options.mjs
@@ -56,7 +56,7 @@ const cases = [
     valid: [
       1, 10, 100, 1000, 10000, 10000n,
     ],
-    invalid: [-1, -1n, 'a', null, false, true, {}, [], () => {}]
+    invalid: [-1, -1n, 0, 0n, 'a', null, false, true, {}, [], () => {}]
   },
   {
     key: 'retryRate',
diff --git a/test/parallel/test-quic-stream-writer-api.mjs b/test/parallel/test-quic-stream-writer-api.mjs
index 009cb4ff8a4a..6ccd52b046a4 100644
--- a/test/parallel/test-quic-stream-writer-api.mjs
+++ b/test/parallel/test-quic-stream-writer-api.mjs
@@ -16,7 +16,7 @@ const { bytes } = await import('stream/iter');
 
 const encoder = new TextEncoder();
 
-const totalStreams = 5;
+const totalStreams = 6;
 const serverResults = [];
 const allDone = Promise.withResolvers();
 
@@ -88,6 +88,25 @@ await clientSession.opened;
   await stream.closed;
 }
 
+// Web IDL Writer argument conversion
+{
+  const stream = await clientSession.createBidirectionalStream();
+  const w = stream.writer;
+  await w.write(42, null);
+  await w.writev(new Set([true, { toString: () => 'object' }]));
+  assert.throws(
+    () => w.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => w.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(w.endSync(), 12);
+  for await (const _ of stream) { /* drain */ } // eslint-disable-line no-unused-vars
+  await stream.closed;
+}
+
 {
   const stream = await clientSession.createBidirectionalStream();
   const w = stream.writer;
@@ -111,8 +130,8 @@ await clientSession.opened;
 {
   const stream = await clientSession.createBidirectionalStream();
   const w = stream.writer;
-  const testError = new Error('writer fail test');
-  w.fail(testError);
+  const reason = null;
+  w.fail(reason);
   // After fail, canWrite is null.
   assert.strictEqual(w.canWrite, null);
   // drainableProtocol returns null when errored.
@@ -122,8 +141,12 @@ await clientSession.opened;
   assert.strictEqual(w.endSync(), -1);
   // WriteSync after fail returns false.
   assert.strictEqual(w.writeSync(encoder.encode('x')), false);
-  // Write after fail throws with the original error.
-  await assert.rejects(w.write(encoder.encode('x')), testError);
+  // Stored failure takes precedence over per-operation cancellation.
+  const signal = AbortSignal.abort('operation cancelled');
+  await assert.rejects(
+    w.write(encoder.encode('x'), { signal }),
+    (error) => error === reason);
+  await assert.rejects(w.end({ signal }), (error) => error === reason);
   // Don't await stream.closed here — the reset stream may not trigger
   // server onstream (no data was sent before fail), so the server
   // won't count it. The stream is cleaned up when the session closes.
@@ -139,4 +162,5 @@ assert.strictEqual(decoder.decode(serverResults[0]), 'async write');
 assert.strictEqual(decoder.decode(serverResults[1]), 'hello writev');
 assert.strictEqual(decoder.decode(serverResults[2]), 'async writev');
 assert.strictEqual(decoder.decode(serverResults[3]), 'end async');
-assert.strictEqual(decoder.decode(serverResults[4]), 'capacity');
+assert.strictEqual(decoder.decode(serverResults[4]), '42trueobject');
+assert.strictEqual(decoder.decode(serverResults[5]), 'capacity');
diff --git a/test/parallel/test-runner-coverage.js b/test/parallel/test-runner-coverage.js
index bc65221a45f8..fa56c5af3e80 100644
--- a/test/parallel/test-runner-coverage.js
+++ b/test/parallel/test-runner-coverage.js
@@ -116,6 +116,8 @@ test('test coverage report', async (t) => {
 
 test('test tap coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
@@ -154,6 +156,8 @@ test('test tap coverage reporter', skipIfNoInspector, async (t) => {
 
 test('test spec coverage reporter', skipIfNoInspector, async (t) => {
   await t.test('coverage is reported and dumped to NODE_V8_COVERAGE if present', (t) => {
+    // A dump left here would match the negative checks below on pid reuse.
+    t.after(() => tmpdir.refresh());
     const fixture = fixtures.path('test-runner', 'coverage.js');
     const args = [
       '--experimental-test-coverage',
diff --git a/test/parallel/test-sqlite-aggregate-function.mjs b/test/parallel/test-sqlite-aggregate-function.mjs
index 5d12eeb24b6f..6c921b866cbe 100644
--- a/test/parallel/test-sqlite-aggregate-function.mjs
+++ b/test/parallel/test-sqlite-aggregate-function.mjs
@@ -7,6 +7,19 @@ describe('DatabaseSync.prototype.aggregate()', () => {
   describe('input validation', () => {
     const db = new DatabaseSync(':memory:');
 
+    // The length property is configurable, so any type can reach the
+    // conversion that derives the aggregate's arity from it.
+    const lengths = ['abc', {}, [], null, undefined, NaN, 1.5,
+                     Symbol.iterator, 10n, true, 2 ** 40];
+
+    function withLength(fn, length) {
+      Object.defineProperty(fn, 'length', {
+        configurable: true,
+        value: length,
+      });
+      return fn;
+    }
+
     test('throws if options.start is not provided', (t) => {
       t.assert.throws(() => {
         db.aggregate('sum', {
@@ -81,6 +94,37 @@ describe('DatabaseSync.prototype.aggregate()', () => {
         message: /The "options\.inverse" argument must be a function/,
       });
     });
+
+    test('throws if options.step.length is not an integer', (t) => {
+      for (const length of lengths) {
+        t.assert.throws(() => {
+          db.aggregate('sum', {
+            start: 0,
+            step: withLength((acc, value) => acc + value, length),
+            result: (total) => total
+          });
+        }, {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "options\.step\.length" property must be an integer/,
+        }, `length=${String(length)}`);
+      }
+    });
+
+    test('throws if options.inverse.length is not an integer', (t) => {
+      for (const length of lengths) {
+        t.assert.throws(() => {
+          db.aggregate('sum', {
+            start: 0,
+            step: (acc, value) => acc + value,
+            inverse: withLength((acc, value) => acc - value, length),
+            result: (total) => total
+          });
+        }, {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "options\.inverse\.length" property must be an integer/,
+        }, `length=${String(length)}`);
+      }
+    });
   });
 });
 
diff --git a/test/parallel/test-sqlite-backup.mjs b/test/parallel/test-sqlite-backup.mjs
index d1e09569e1ca..f995ae3ca72a 100644
--- a/test/parallel/test-sqlite-backup.mjs
+++ b/test/parallel/test-sqlite-backup.mjs
@@ -1,5 +1,10 @@
 // Flags: --expose-gc
-import { isWindows, skipIfSQLiteMissing } from '../common/index.mjs';
+import {
+  isWindows,
+  skipIfSQLiteMissing,
+  spawnPromisified,
+} from '../common/index.mjs';
+import fixtures from '../common/fixtures.js';
 import tmpdir from '../common/tmpdir.js';
 import { join } from 'node:path';
 import { describe, test } from 'node:test';
@@ -364,3 +369,13 @@ test('source database is kept alive while a backup is in flight', async (t) => {
   const rows = backupDb.prepare('SELECT COUNT(*) AS n FROM data').get();
   t.assert.strictEqual(rows.n, 500);
 });
+
+test('backup promise settles when the backup is the last active request', async (t) => {
+  const { code, signal, stderr } = await spawnPromisified(process.execPath, [
+    fixtures.path('sqlite', 'backup-last-request.mjs'),
+    nextDb(),
+  ]);
+
+  t.assert.strictEqual(signal, null);
+  t.assert.strictEqual(code, 0, stderr);
+});
diff --git a/test/parallel/test-sqlite-custom-functions.js b/test/parallel/test-sqlite-custom-functions.js
index 6b5f974ede89..0b783ce9bcf6 100644
--- a/test/parallel/test-sqlite-custom-functions.js
+++ b/test/parallel/test-sqlite-custom-functions.js
@@ -71,6 +71,28 @@ suite('DatabaseSync.prototype.function()', () => {
         message: /The "options\.directOnly" argument must be a boolean/,
       });
     });
+
+    test('throws if function.length is not an integer', () => {
+      // The length property is configurable, so any type can reach the
+      // conversion that derives the function's arity from it.
+      const lengths = ['abc', {}, [], null, undefined, NaN, 1.5,
+                       Symbol.iterator, 10n, true, 2 ** 40];
+
+      for (const length of lengths) {
+        const fn = () => 1;
+        Object.defineProperty(fn, 'length', {
+          configurable: true,
+          value: length,
+        });
+
+        assert.throws(() => {
+          db.function('foo', fn);
+        }, {
+          code: 'ERR_INVALID_ARG_TYPE',
+          message: /The "function\.length" property must be an integer/,
+        }, `length=${String(length)}`);
+      }
+    });
   });
 
   suite('useBigIntArguments', () => {
diff --git a/test/parallel/test-sqlite-data-types.js b/test/parallel/test-sqlite-data-types.js
index bac5a6283135..516233fcb0e8 100644
--- a/test/parallel/test-sqlite-data-types.js
+++ b/test/parallel/test-sqlite-data-types.js
@@ -80,6 +80,70 @@ suite('data binding and mapping', () => {
       query.get(5),
       { __proto__: null, key: 5, int: 1, double: 0, text: '1', buf: null }
     );
+
+    t.assert.deepStrictEqual(
+      stmt.run(6, undefined, undefined, undefined, undefined),
+      { changes: 1, lastInsertRowid: 6 }
+    );
+    t.assert.deepStrictEqual(
+      query.get(6),
+      { __proto__: null, key: 6, int: null, double: null, text: null, buf: null }
+    );
+  });
+
+  test('undefined is bound as NULL', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.after(() => { db.close(); });
+    const setup = db.exec(
+      'CREATE TABLE types(key INTEGER PRIMARY KEY, val INTEGER) STRICT;'
+    );
+    t.assert.strictEqual(setup, undefined);
+    const stmt = db.prepare('INSERT INTO types (key, val) VALUES ($k, $v)');
+    const query = db.prepare('SELECT * FROM types WHERE key = ?');
+
+    // An explicit `undefined` and an omitted named parameter are equivalent.
+    t.assert.deepStrictEqual(
+      stmt.run({ k: 1, v: undefined }),
+      { changes: 1, lastInsertRowid: 1 }
+    );
+    t.assert.deepStrictEqual(
+      stmt.run({ k: 2 }),
+      { changes: 1, lastInsertRowid: 2 }
+    );
+    t.assert.deepStrictEqual(
+      query.get(1),
+      { __proto__: null, key: 1, val: null }
+    );
+    t.assert.deepStrictEqual(
+      query.get(2),
+      { __proto__: null, key: 2, val: null }
+    );
+
+    t.assert.deepStrictEqual(
+      db.prepare('SELECT ? AS a').get(undefined),
+      { __proto__: null, a: null }
+    );
+  });
+
+  test('undefined is not treated as the named parameters argument', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.after(() => { db.close(); });
+
+    // `undefined` is not an object, so it is bound as an anonymous parameter
+    // rather than being treated as the named parameters argument.
+    t.assert.throws(() => {
+      db.prepare('SELECT $k AS a').get(undefined);
+    }, {
+      code: 'ERR_SQLITE_ERROR',
+      message: /column index out of range/,
+    });
+
+    t.assert.throws(() => {
+      db.prepare('SELECT ? AS a').get(1, undefined);
+    }, {
+      code: 'ERR_SQLITE_ERROR',
+      message: /column index out of range/,
+    });
   });
 
   test('large strings are bound correctly', (t) => {
@@ -126,7 +190,6 @@ suite('data binding and mapping', () => {
     t.assert.strictEqual(setup, undefined);
 
     [
-      undefined,
       () => {},
       Symbol(),
       /foo/,
diff --git a/test/parallel/test-sqlite-options-getter-reentry.js b/test/parallel/test-sqlite-options-getter-reentry.js
new file mode 100644
index 000000000000..1aaf4c4fbb79
--- /dev/null
+++ b/test/parallel/test-sqlite-options-getter-reentry.js
@@ -0,0 +1,244 @@
+'use strict';
+const { skipIfSQLiteMissing } = require('../common');
+skipIfSQLiteMissing();
+const tmpdir = require('../common/tmpdir');
+const { join } = require('node:path');
+const { backup, DatabaseSync } = require('node:sqlite');
+const { suite, test } = require('node:test');
+
+tmpdir.refresh();
+
+const invalidState = {
+  code: 'ERR_INVALID_STATE',
+  message: /database is not open/,
+};
+
+// A property getter on the options bag runs arbitrary JavaScript in the middle
+// of the call, so state validated before the options were read can be stale by
+// the time it is used.
+suite('closing the database from an options getter', () => {
+  test('prepare() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.prepare('SELECT 1', {
+        get returnArrays() {
+          db.close();
+          return false;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('function() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.function('fn', {
+        get useBigIntArguments() {
+          db.close();
+          return false;
+        },
+      }, () => 1);
+    }, invalidState);
+  });
+
+  test('function() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const fn = () => 1;
+    Object.defineProperty(fn, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 0;
+      },
+    });
+    t.assert.throws(() => {
+      db.function('fn', fn);
+    }, invalidState);
+  });
+
+  test('aggregate() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.aggregate('agg', {
+        get start() {
+          db.close();
+          return 0;
+        },
+        step: (acc, value) => acc,
+      });
+    }, invalidState);
+  });
+
+  test('aggregate() throws when the length getter closes the database', (t) => {
+    const db = new DatabaseSync(':memory:');
+    const step = (acc, value) => acc;
+    Object.defineProperty(step, 'length', {
+      configurable: true,
+      get() {
+        db.close();
+        return 2;
+      },
+    });
+    t.assert.throws(() => {
+      db.aggregate('agg', { start: 0, step });
+    }, invalidState);
+  });
+
+  test('deserialize() throws instead of using a closed connection', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(image, {
+        get dbName() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('createSession() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.createSession({
+        get db() {
+          db.close();
+          return 'main';
+        },
+      });
+    }, invalidState);
+  });
+
+  test('applyChangeset() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    db.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+    const session = db.createSession();
+    db.exec('INSERT INTO data (key) VALUES (1)');
+    const changeset = session.changeset();
+
+    t.assert.throws(() => {
+      db.applyChangeset(changeset, {
+        get onConflict() {
+          db.close();
+          return undefined;
+        },
+      });
+    }, invalidState);
+  });
+
+  test('backup() throws instead of using a closed connection', (t) => {
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      backup(db, join(tmpdir.path, 'getter-backup.db'), {
+        get rate() {
+          db.close();
+          return 1;
+        },
+      });
+    }, invalidState);
+  });
+});
+
+// The state check runs before the options bag is read, so a call that is
+// already doomed must not execute any of the caller's getters.
+test('options getters do not run on an already-closed database', (t) => {
+  const source = new DatabaseSync(':memory:');
+  source.exec('CREATE TABLE data(key INTEGER PRIMARY KEY)');
+  const image = source.serialize();
+  const session = source.createSession();
+  source.exec('INSERT INTO data (key) VALUES (1)');
+  const changeset = session.changeset();
+
+  const cases = {
+    prepare: (db, options) => db.prepare('SELECT 1', options),
+    function: (db, options) => db.function('fn', options, () => 1),
+    aggregate: (db, options) => db.aggregate('agg', options),
+    deserialize: (db, options) => db.deserialize(image, options),
+    createSession: (db, options) => db.createSession(options),
+    applyChangeset: (db, options) => db.applyChangeset(changeset, options),
+    backup: (db, options) =>
+      backup(db, join(tmpdir.path, 'closed-backup.db'), options),
+  };
+
+  // The property each method reads first, and a valid value for it, so that a
+  // getter which does run leaves the "did not run" assertion as the failure
+  // rather than a type error from the returned value.
+  const probes = {
+    prepare: ['returnArrays', false],
+    function: ['useBigIntArguments', false],
+    aggregate: ['start', 0],
+    deserialize: ['dbName', 'main'],
+    createSession: ['db', 'main'],
+    applyChangeset: ['onConflict', undefined],
+    backup: ['rate', 1],
+  };
+
+  for (const [name, invoke] of Object.entries(cases)) {
+    const db = new DatabaseSync(':memory:');
+    db.close();
+
+    const [key, value] = probes[name];
+    let ran = false;
+    const options = {
+      get [key]() {
+        ran = true;
+        return value;
+      },
+    };
+
+    t.assert.throws(() => invoke(db, options), invalidState, name);
+    t.assert.strictEqual(ran, false, `${name} ran an options getter`);
+  }
+});
+
+suite('resizing a deserialize() buffer from an options getter', () => {
+  test('throws rather than handing uninitialized memory to SQLite', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    source.prepare('INSERT INTO data (value) VALUES (?)').run('hello');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength, {
+      maxByteLength: image.byteLength,
+    });
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          buffer.resize(1024);
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+
+  test('throws when the buffer is detached', (t) => {
+    const source = new DatabaseSync(':memory:');
+    source.exec('CREATE TABLE data(value TEXT)');
+    const image = source.serialize();
+
+    const buffer = new ArrayBuffer(image.byteLength);
+    new Uint8Array(buffer).set(image);
+
+    const db = new DatabaseSync(':memory:');
+    t.assert.throws(() => {
+      db.deserialize(new Uint8Array(buffer), {
+        get dbName() {
+          structuredClone(buffer, { transfer: [buffer] });
+          return 'main';
+        },
+      });
+    }, {
+      code: 'ERR_INVALID_STATE',
+      message: /"buffer" argument was resized/,
+    });
+  });
+});
diff --git a/test/parallel/test-sqlite-session.js b/test/parallel/test-sqlite-session.js
index c36ed84a0858..40da13c4bb7f 100644
--- a/test/parallel/test-sqlite-session.js
+++ b/test/parallel/test-sqlite-session.js
@@ -462,6 +462,42 @@ test('database.applyChangeset() - changeset detached by filter', (t) => {
   ]);
 });
 
+test('database.applyChangeset() - changeset detached by SQL function', (t) => {
+  const database1 = new DatabaseSync(':memory:');
+  const database2 = new DatabaseSync(':memory:');
+  let changeset;
+  let detached = false;
+
+  database1.exec('CREATE TABLE data(key INTEGER PRIMARY KEY, value TEXT)');
+  database2.function('validate_changeset_value', (value) => {
+    if (!detached) {
+      detached = true;
+      const transferred = structuredClone(changeset.buffer, {
+        transfer: [changeset.buffer],
+      });
+      new Uint8Array(transferred).fill(0);
+    }
+    return value.length;
+  });
+  database2.exec(`
+    CREATE TABLE data(
+      key INTEGER PRIMARY KEY,
+      value TEXT CHECK (validate_changeset_value(value))
+    )
+  `);
+
+  const session = database1.createSession();
+  database1.exec("INSERT INTO data VALUES (1, 'hello'), (2, 'world')");
+  changeset = session.changeset();
+
+  t.assert.strictEqual(database2.applyChangeset(changeset), true);
+  t.assert.strictEqual(changeset.byteLength, 0);
+  deepStrictEqual(t)(database2.prepare('SELECT * FROM data').all(), [
+    { key: 1, value: 'hello' },
+    { key: 2, value: 'world' },
+  ]);
+});
+
 test('database.createSession() - filter changes', (t) => {
   const database1 = new DatabaseSync(':memory:');
   const database2 = new DatabaseSync(':memory:');
diff --git a/test/parallel/test-stream-iter-broadcast-backpressure.js b/test/parallel/test-stream-iter-broadcast-backpressure.js
index 698f1821aeea..e42bb93d5f1f 100644
--- a/test/parallel/test-stream-iter-broadcast-backpressure.js
+++ b/test/parallel/test-stream-iter-broadcast-backpressure.js
@@ -3,7 +3,8 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { broadcast, text } = require('stream/iter');
+const { broadcast, ondrain, text } = require('stream/iter');
+const { setImmediate } = require('timers/promises');
 
 // =============================================================================
 // Backpressure policies
@@ -47,6 +48,36 @@ async function testDropNewest() {
   assert.strictEqual(data, 'K'.repeat(16384));
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, broadcast: bc } = broadcast({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = bc.push()[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await setImmediate();
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    bc.cancel();
+  }
+}
+
 // =============================================================================
 // Block backpressure
 // =============================================================================
@@ -63,14 +94,14 @@ async function testBlockBackpressure() {
   // Next write should block
   let writeResolved = false;
   const writePromise = writer.write(kChunk).then(() => { writeResolved = true; });
-  await new Promise(setImmediate);
+  await setImmediate();
   assert.strictEqual(writeResolved, false);
 
   // Drain consumer to unblock the pending write
   const iter = consumer[Symbol.asyncIterator]();
   const first = await iter.next();
   assert.strictEqual(first.done, false);
-  await new Promise(setImmediate);
+  await setImmediate();
   assert.strictEqual(writeResolved, true);
 
   writer.endSync();
@@ -92,7 +123,7 @@ async function testBlockBackpressureContent() {
 
   writer.writeSync(chunk1);
   const writePromise = writer.write(chunk2);
-  await new Promise(setImmediate);
+  await setImmediate();
 
   // Read all and verify content
   const iter = consumer[Symbol.asyncIterator]();
@@ -128,11 +159,7 @@ async function testStrictBackpressureOverflow() {
   });
 
   writer.fail();
-  await assert.rejects(pending, {
-    name: 'TypeError',
-    code: 'ERR_INVALID_STATE',
-    message: 'Invalid state: Failed',
-  });
+  await assert.rejects(pending, (reason) => reason === undefined);
 }
 
 async function testEndDrainsPendingWrite() {
@@ -165,7 +192,7 @@ async function testEndDrainsPendingWrite() {
 
   let endResolved = false;
   endPromise.then(common.mustCall(() => { endResolved = true; }));
-  await new Promise(setImmediate);
+  await setImmediate();
   assert.strictEqual(endResolved, false);
 
   assert.strictEqual((await iter.next()).done, true);
@@ -269,6 +296,7 @@ async function testEndSyncReturnValue() {
 Promise.all([
   testDropOldest(),
   testDropNewest(),
+  testDropPoliciesReportPhysicalCapacity(),
   testBlockBackpressure(),
   testBlockBackpressureContent(),
   testStrictBackpressureOverflow(),
diff --git a/test/parallel/test-stream-iter-consumers-bytes.js b/test/parallel/test-stream-iter-consumers-bytes.js
index 53d0a3858f87..531917eb9734 100644
--- a/test/parallel/test-stream-iter-consumers-bytes.js
+++ b/test/parallel/test-stream-iter-consumers-bytes.js
@@ -101,6 +101,31 @@ async function testAsyncConsumersAbortPendingNormalization() {
   }
 }
 
+async function testAsyncConsumerSignalPreservesProtocolPrecedence() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    __proto__: null,
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('protocol');
+    },
+    async *[Symbol.asyncIterator]() {
+      iteratorCalls++;
+      yield 'iterator';
+    },
+  };
+
+  const result = await text(source, {
+    __proto__: null,
+    signal: new AbortController().signal,
+  });
+
+  assert.strictEqual(result, 'protocol');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+}
+
 async function testBytesEmpty() {
   const data = await bytes(from([]));
   assert.ok(data instanceof Uint8Array);
@@ -255,6 +280,7 @@ Promise.all([
   testBytesAsyncAbort(),
   testAsyncConsumersAbortPendingNext(),
   testAsyncConsumersAbortPendingNormalization(),
+  testAsyncConsumerSignalPreservesProtocolPrecedence(),
   testBytesEmpty(),
   testArrayBufferSyncBasic(),
   testArrayBufferAsync(),
diff --git a/test/parallel/test-stream-iter-consumers-merge.js b/test/parallel/test-stream-iter-consumers-merge.js
index 84aeb24b6159..becf68ee63a1 100644
--- a/test/parallel/test-stream-iter-consumers-merge.js
+++ b/test/parallel/test-stream-iter-consumers-merge.js
@@ -108,6 +108,109 @@ async function testMergeSourceError() {
   );
 }
 
+async function testMergeFalsySourceErrors() {
+  const reasons = [undefined, null, false, 0, '', NaN];
+
+  for (const reason of reasons) {
+    const noError = { __proto__: null };
+    let actual = noError;
+    try {
+      await text(merge(rejectedSource(reason), from('other')));
+    } catch (error) {
+      actual = error;
+    }
+    assert.strictEqual(Object.is(actual, reason), true);
+  }
+}
+
+function rejectedSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return Promise.reject(reason);
+    },
+  };
+}
+
+function pendingSource() {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return this;
+    },
+    next() {
+      return new Promise(() => {});
+    },
+    return() {
+      return new Promise(() => {});
+    },
+  };
+}
+
+async function testMergeSourceErrorDoesNotAwaitCleanup() {
+  const reason = new Error('source failed');
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    text(merge(rejectedSource(reason), pendingSource())).then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(outcome.error, reason);
+}
+
+async function testMergeBreakDoesNotAwaitCleanup() {
+  async function* readySource() {
+    yield [Uint8Array.of(1)];
+  }
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    (async () => {
+      for await (const batch of merge(readySource(), pendingSource())) {
+        assert.deepStrictEqual(batch, [Uint8Array.of(1)]);
+        break;
+      }
+      return true;
+    })(),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.strictEqual(outcome, true);
+}
+
+async function testMergeNaNAbortDoesNotAwaitCleanup() {
+  const ac = new AbortController();
+  const iterator = merge(pendingSource(), pendingSource(), {
+    __proto__: null,
+    signal: ac.signal,
+  })[Symbol.asyncIterator]();
+  const next = iterator.next();
+  await new Promise(setImmediate);
+  ac.abort(NaN);
+
+  const timedOut = { __proto__: null };
+  const outcome = await Promise.race([
+    next.then(
+      () => ({ __proto__: null, status: 'fulfilled' }),
+      (error) => ({ __proto__: null, status: 'rejected', error }),
+    ),
+    new Promise((resolve) => setImmediate(resolve, timedOut)),
+  ]);
+
+  assert.notStrictEqual(outcome, timedOut);
+  assert.strictEqual(outcome.status, 'rejected');
+  assert.strictEqual(Object.is(outcome.error, NaN), true);
+}
+
 async function testMergeConsumerBreak() {
   let source1Return = false;
   let source2Return = false;
@@ -296,9 +399,8 @@ async function testMergeCleanupErrorOnly() {
   );
 }
 
-// Primary error + cleanup error: a source throws during iteration AND
-// iterator.return() also throws. Should get a SuppressedError.
-async function testMergePrimaryAndCleanupError() {
+// A primary source error must not wait for asynchronous cleanup failures.
+async function testMergePrimaryErrorPrecedesCleanupError() {
   async function* badSource() {
     yield [new TextEncoder().encode('x')];
     throw new Error('primary boom');
@@ -319,15 +421,7 @@ async function testMergePrimaryAndCleanupError() {
         // Consume until error
       }
     },
-    (err) => {
-      assert.ok(
-        err instanceof SuppressedError,
-        `Expected SuppressedError, got ${err.constructor.name}`,
-      );
-      assert.strictEqual(err.error.message, 'primary boom');
-      assert.strictEqual(err.suppressed.message, 'cleanup boom');
-      return true;
-    },
+    { message: 'primary boom' },
   );
 }
 
@@ -353,6 +447,27 @@ async function testMergeBreakWithCleanupError() {
   );
 }
 
+async function testMergeMultiSourceBreakWithCleanupError() {
+  async function* failingReturnSource() {
+    try {
+      yield [new TextEncoder().encode('data')];
+    } finally {
+      await Promise.resolve();
+      throwInFinally('async cleanup on break');
+    }
+  }
+
+  await assert.rejects(
+    async () => {
+      // eslint-disable-next-line no-unused-vars
+      for await (const _ of merge(failingReturnSource(), from('other'))) {
+        break;
+      }
+    },
+    { message: 'async cleanup on break' },
+  );
+}
+
 Promise.all([
   testMergeTwoSources(),
   testMergeSingleSource(),
@@ -360,6 +475,10 @@ Promise.all([
   testMergeWithAbortSignal(),
   testMergeSyncSources(),
   testMergeSourceError(),
+  testMergeFalsySourceErrors(),
+  testMergeSourceErrorDoesNotAwaitCleanup(),
+  testMergeBreakDoesNotAwaitCleanup(),
+  testMergeNaNAbortDoesNotAwaitCleanup(),
   testMergeConsumerBreak(),
   testMergeSignalMidIteration(),
   testMergeSignalDuringPendingMultiSourceRead(),
@@ -368,6 +487,7 @@ Promise.all([
   testMergeStringSources(),
   testMergeObjectLikeSources(),
   testMergeCleanupErrorOnly(),
-  testMergePrimaryAndCleanupError(),
+  testMergePrimaryErrorPrecedesCleanupError(),
   testMergeBreakWithCleanupError(),
+  testMergeMultiSourceBreakWithCleanupError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-consumers-text.js b/test/parallel/test-stream-iter-consumers-text.js
index a8fb7a74367f..68be098ff8f6 100644
--- a/test/parallel/test-stream-iter-consumers-text.js
+++ b/test/parallel/test-stream-iter-consumers-text.js
@@ -143,17 +143,17 @@ function testTextSyncUnsupportedEncodingThrowsRangeError() {
   );
 }
 
-async function testTextNonStringEncodingThrowsTypeError() {
+async function testTextConvertedEncodingThrowsRangeError() {
   await assert.rejects(
     () => text(from('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
-function testTextSyncNonStringEncodingThrowsTypeError() {
+function testTextSyncConvertedEncodingThrowsRangeError() {
   assert.throws(
     () => textSync(fromSync('hello'), { encoding: 1 }),
-    { code: 'ERR_INVALID_ARG_TYPE' },
+    { code: 'ERR_INVALID_ARG_VALUE' },
   );
 }
 
@@ -173,6 +173,6 @@ Promise.all([
   testTextSyncBOMStripped(),
   testTextUnsupportedEncodingThrowsRangeError(),
   testTextSyncUnsupportedEncodingThrowsRangeError(),
-  testTextNonStringEncodingThrowsTypeError(),
-  testTextSyncNonStringEncodingThrowsTypeError(),
+  testTextConvertedEncodingThrowsRangeError(),
+  testTextSyncConvertedEncodingThrowsRangeError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-duplex.js b/test/parallel/test-stream-iter-duplex.js
index 0969b91e7d21..354fa28b67a6 100644
--- a/test/parallel/test-stream-iter-duplex.js
+++ b/test/parallel/test-stream-iter-duplex.js
@@ -14,32 +14,26 @@ async function testBasicDuplex() {
 
   // A writes, B reads
   await channelA.writer.write('hello from A');
-  await channelA.close();
-
+  const closing = channelA.close();
   const dataAtB = await text(channelB.readable);
+  await closing;
   assert.strictEqual(dataAtB, 'hello from A');
 }
 
 async function testBidirectional() {
   const [channelA, channelB] = duplex();
 
-  // A writes to B, B writes to A concurrently
-  const writeA = (async () => {
-    await channelA.writer.write('A to B');
-    await channelA.close();
-  })();
-
-  const writeB = (async () => {
-    await channelB.writer.write('B to A');
-    await channelB.close();
-  })();
-
-  const readAtB = text(channelB.readable);
-  const readAtA = text(channelA.readable);
-
-  await Promise.all([writeA, writeB]);
+  await channelA.writer.write('A to B');
+  await channelB.writer.write('B to A');
 
-  const [dataAtA, dataAtB] = await Promise.all([readAtA, readAtB]);
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
+  const [dataAtA, dataAtB] = await Promise.all([
+    text(channelA.readable),
+    text(channelB.readable),
+  ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'A to B');
   assert.strictEqual(dataAtA, 'B to A');
@@ -51,19 +45,29 @@ async function testMultipleWrites() {
   await channelA.writer.write('one');
   await channelA.writer.write('two');
   await channelA.writer.write('three');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'onetwothree');
 }
 
 async function testChannelClose() {
   const [channelA, channelB] = duplex();
-
-  await channelA.close();
-
-  // Should be able to close twice without error
-  await channelA.close();
+  const iteratorA = channelA.readable[Symbol.asyncIterator]();
+  const otherIteratorA = channelA.readable[Symbol.asyncIterator]();
+  const pendingRead = iteratorA.next();
+
+  const closing = channelA.close();
+  assert.strictEqual(channelA.close(), closing);
+  await closing;
+
+  assert.strictEqual((await pendingRead).done, true);
+  assert.strictEqual((await otherIteratorA.next()).done, true);
+  assert.strictEqual(
+    (await channelA.readable[Symbol.asyncIterator]().next()).done, true);
+  await assert.rejects(channelB.writer.write('late'), {
+    code: 'ERR_INVALID_STATE',
+  });
 
   // B's readable should end (A -> B direction is closed)
   const batches = [];
@@ -73,6 +77,20 @@ async function testChannelClose() {
   assert.strictEqual(batches.length, 0);
 }
 
+async function testConcurrentChannelClose() {
+  const [channelA, channelB] = duplex();
+
+  const results = await Promise.allSettled([
+    channelA.close(),
+    channelB.close(),
+  ]);
+
+  assert.deepStrictEqual(results, [
+    { status: 'fulfilled', value: undefined },
+    { status: 'fulfilled', value: undefined },
+  ]);
+}
+
 async function testWithOptions() {
   const [channelA, channelB] = duplex({
     budget: 16384,
@@ -80,9 +98,9 @@ async function testWithOptions() {
   });
 
   await channelA.writer.write('msg');
-  await channelA.close();
-
+  const closing = channelA.close();
   const data = await text(channelB.readable);
+  await closing;
   assert.strictEqual(data, 'msg');
 }
 
@@ -95,15 +113,17 @@ async function testPerChannelOptions() {
   // Channel A -> B direction uses A's options
   // Channel B -> A direction uses B's options
   await channelA.writer.write('from-a');
-  await channelA.close();
-
   await channelB.writer.write('from-b');
-  await channelB.close();
+
+  const endA = channelA.writer.end();
+  const endB = channelB.writer.end();
 
   const [dataAtA, dataAtB] = await Promise.all([
     text(channelA.readable),
     text(channelB.readable),
   ]);
+  await Promise.all([endA, endB]);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtB, 'from-a');
   assert.strictEqual(dataAtA, 'from-b');
@@ -146,17 +166,39 @@ async function testWriterEndWithPreAbortedSignal() {
 async function testEmptyDuplex() {
   const [channelA, channelB] = duplex();
 
-  // Close without writing
-  await channelA.close();
-  await channelB.close();
+  await channelA.writer.end();
+  await channelB.writer.end();
 
   const dataAtA = await bytes(channelA.readable);
   const dataAtB = await bytes(channelB.readable);
+  await Promise.all([channelA.close(), channelB.close()]);
 
   assert.strictEqual(dataAtA.byteLength, 0);
   assert.strictEqual(dataAtB.byteLength, 0);
 }
 
+async function testCloseWaitsForDrain() {
+  const [channelA, channelB] = duplex();
+  await channelA.writer.write('buffered');
+
+  let closed = false;
+  const closing = channelA.close().then(common.mustCall(() => {
+    closed = true;
+  }));
+  await new Promise(setImmediate);
+  assert.strictEqual(closed, false);
+
+  assert.strictEqual(await text(channelB.readable), 'buffered');
+  await closing;
+}
+
+async function testClosePropagatesWriterFailure() {
+  const [channelA] = duplex();
+  const reason = new Error('writer failed');
+  channelA.writer.fail(reason);
+  await assert.rejects(channelA.close(), (error) => error === reason);
+}
+
 // Channel fail propagation
 async function testChannelFail() {
   const [a, b] = duplex();
@@ -195,11 +237,14 @@ Promise.all([
   testBidirectional(),
   testMultipleWrites(),
   testChannelClose(),
+  testConcurrentChannelClose(),
   testWithOptions(),
   testPerChannelOptions(),
   testAbortSignal(),
   testWriterEndWithPreAbortedSignal(),
   testEmptyDuplex(),
+  testCloseWaitsForDrain(),
+  testClosePropagatesWriterFailure(),
   testChannelFail(),
   testAbortSignalBothChannels(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-from-async.js b/test/parallel/test-stream-iter-from-async.js
index 5ef78088bfbd..a4726d633ef0 100644
--- a/test/parallel/test-stream-iter-from-async.js
+++ b/test/parallel/test-stream-iter-from-async.js
@@ -31,6 +31,30 @@ async function testFromAsyncGenerator() {
   assert.deepStrictEqual(batches[1][0], new Uint8Array([30, 40]));
 }
 
+async function testFromBoundsNestedAsyncIterable() {
+  let nestedClosed = false;
+  async function* nested() {
+    try {
+      let value = 0;
+      while (true) yield new Uint8Array([value++]);
+    } finally {
+      nestedClosed = true;
+    }
+  }
+
+  async function* source() {
+    yield nested();
+  }
+
+  const iterator = from(source())[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  assert.strictEqual(first.done, false);
+  assert.strictEqual(first.value.length, 128);
+
+  await iterator.return();
+  assert.strictEqual(nestedClosed, true);
+}
+
 async function testFromSyncIterableAsAsync() {
   // Sync iterable passed to from() should work
   function* gen() {
@@ -235,6 +259,20 @@ async function testFromTopLevelProtocolOverIterator() {
   assert.strictEqual(result, 'from-protocol');
 }
 
+async function testFromHandlesProtocolRejectionUntilIteration() {
+  const reason = new Error('protocol failed');
+  const iterable = from({
+    [Symbol.for('Stream.toAsyncStreamable')]: common.mustCall(
+      () => Promise.reject(reason)),
+  });
+
+  await new Promise(setImmediate);
+  await assert.rejects(
+    iterable[Symbol.asyncIterator]().next(),
+    (error) => error === reason,
+  );
+}
+
 // DataView input should be converted to Uint8Array (zero-copy)
 async function testFromDataView() {
   const buf = new ArrayBuffer(5);
@@ -260,6 +298,7 @@ function testFromUndefinedThrows() {
 Promise.all([
   testFromString(),
   testFromAsyncGenerator(),
+  testFromBoundsNestedAsyncIterable(),
   testFromSyncIterableAsAsync(),
   testFromSyncIterableAwaitsPromiseValues(),
   testFromSyncIterableRejectsNestedAsyncIterable(),
@@ -279,5 +318,6 @@ Promise.all([
   testFromTopLevelToStreamable(),
   testFromTopLevelAsyncPrecedence(),
   testFromTopLevelProtocolOverIterator(),
+  testFromHandlesProtocolRejectionUntilIteration(),
   testFromDataView(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pipeto-edge.js b/test/parallel/test-stream-iter-pipeto-edge.js
index 3f09c4dfd42d..13223a226a1f 100644
--- a/test/parallel/test-stream-iter-pipeto-edge.js
+++ b/test/parallel/test-stream-iter-pipeto-edge.js
@@ -1,33 +1,41 @@
 // Flags: --experimental-stream-iter
 'use strict';
 
-// Edge case tests for pipeToSync: endSync fallback, preventFail.
+// Edge case tests for pipeToSync close and failure behavior.
 
 const common = require('../common');
 const assert = require('assert');
 const { pipeToSync, fromSync } = require('stream/iter');
 
-// pipeToSync endSync returns negative → falls back to end()
-async function testPipeToSyncEndSyncFallback() {
+// pipeToSync cannot complete when endSync() requires async fallback.
+async function testPipeToSyncEndSyncFailure() {
   let endCalled = false;
   const writer = {
     writeSync() { return true; },
-    endSync() { return -1; }, // Negative → triggers end() fallback
+    endSync() { return -1; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer, { preventFail: true }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual(endCalled, false);
 }
 
-// pipeToSync endSync missing → falls back to end()
+// pipeToSync requires endSync() when closing is enabled.
 async function testPipeToSyncNoEndSync() {
+  let writeCalled = false;
   let endCalled = false;
   const writer = {
-    writeSync() { return true; },
+    writeSync() { writeCalled = true; return true; },
     end() { endCalled = true; },
   };
-  pipeToSync(fromSync('data'), writer);
-  assert.strictEqual(endCalled, true);
+  assert.throws(
+    () => pipeToSync(fromSync('data'), writer),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.strictEqual(writeCalled, false);
+  assert.strictEqual(endCalled, false);
 }
 
 // pipeToSync with preventFail: true — source error does NOT call fail()
@@ -61,7 +69,7 @@ async function testPipeToSyncPreventClose() {
 }
 
 Promise.all([
-  testPipeToSyncEndSyncFallback(),
+  testPipeToSyncEndSyncFailure(),
   testPipeToSyncNoEndSync(),
   testPipeToSyncPreventFail(),
   testPipeToSyncPreventClose(),
diff --git a/test/parallel/test-stream-iter-pipeto-signal.js b/test/parallel/test-stream-iter-pipeto-signal.js
index ec1324a4e04b..be04c8c635df 100644
--- a/test/parallel/test-stream-iter-pipeto-signal.js
+++ b/test/parallel/test-stream-iter-pipeto-signal.js
@@ -9,6 +9,51 @@ const assert = require('assert');
 const { setTimeout } = require('timers/promises');
 const { pipeTo, from } = require('stream/iter');
 
+async function testPipeToPreAbortedSignalFailsWriter() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustCall((error) => assert.strictEqual(error, reason)),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, { signal: AbortSignal.abort(reason) }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
+async function testPipeToPreAbortedSignalPreventFail() {
+  const reason = new Error('already aborted');
+  let sourceTouched = false;
+  const source = {
+    [Symbol.asyncIterator]() {
+      sourceTouched = true;
+      return {};
+    },
+  };
+  const writer = {
+    write: common.mustNotCall(),
+    fail: common.mustNotCall(),
+  };
+
+  await assert.rejects(
+    pipeTo(source, writer, {
+      signal: AbortSignal.abort(reason),
+      preventFail: true,
+    }),
+    (error) => error === reason,
+  );
+  assert.strictEqual(sourceTouched, false);
+}
+
 // pipeTo with live signal, no transforms — abort mid-stream
 async function testPipeToLiveSignalNoTransforms() {
   const ac = new AbortController();
@@ -116,6 +161,8 @@ async function testPipeToLiveSignalWithTransformsCompletes() {
 }
 
 Promise.all([
+  testPipeToPreAbortedSignalFailsWriter(),
+  testPipeToPreAbortedSignalPreventFail(),
   testPipeToLiveSignalNoTransforms(),
   testPipeToLiveSignalNoTransformsPendingNext(),
   testPipeToLiveSignalWithTransforms(),
diff --git a/test/parallel/test-stream-iter-pipeto.js b/test/parallel/test-stream-iter-pipeto.js
index 5d8b5088f540..4711b291a7af 100644
--- a/test/parallel/test-stream-iter-pipeto.js
+++ b/test/parallel/test-stream-iter-pipeto.js
@@ -71,6 +71,7 @@ async function testPipeToSyncSourceError() {
   let failCalled = false;
   const writer = {
     writeSync() { return true; },
+    endSync: common.mustNotCall(),
     fail(reason) { failCalled = true; },
   };
   function* failingSource() {
@@ -127,6 +128,7 @@ async function testPipeToSyncWithTransforms() {
   const chunks = [];
   const writer = {
     writeSync(chunk) { chunks.push(new TextDecoder().decode(chunk)); return true; },
+    endSync() { return 0; },
   };
   const upper = (batch) => {
     if (batch === null) return null;
@@ -160,6 +162,7 @@ async function testPipeToSyncWriterTransformMethodIgnored() {
       chunks.push(new TextDecoder().decode(chunk));
       return true;
     },
+    endSync() { return 0; },
   };
 
   pipeToSync(fromSync('hello'), writer);
@@ -240,11 +243,11 @@ async function testPipeToSyncMinimalWriter() {
     },
   };
 
-  pipeToSync(fromSync('minimal-sync'), minimalWriter);
+  pipeToSync(fromSync('minimal-sync'), minimalWriter, { preventClose: true });
   assert.strictEqual(chunks.length > 0, true);
 }
 
-async function testPipeToSyncIterableFastPathWritesIncrementally() {
+async function testPipeToSyncIterableUsesFromBatching() {
   let pulled = 0;
   let firstWritePulled = 0;
   const chunks = [];
@@ -267,7 +270,7 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
 
   const totalBytes = await pipeTo(source(), writer);
   assert.strictEqual(totalBytes, 3);
-  assert.strictEqual(firstWritePulled, 1);
+  assert.strictEqual(firstWritePulled, 3);
   assert.deepStrictEqual(chunks, [
     new Uint8Array([0x61]),
     new Uint8Array([0x62]),
@@ -275,7 +278,31 @@ async function testPipeToSyncIterableFastPathWritesIncrementally() {
   ]);
 }
 
-async function testPipeToSyncIterableFastPathWriteFallback() {
+async function testPipeToSourceNormalizationIndependentOfWriter() {
+  function source() {
+    return {
+      *[Symbol.iterator]() {
+        yield {
+          async *[Symbol.asyncIterator]() {
+            yield 'nested';
+          },
+        };
+      },
+    };
+  }
+
+  for (const hasWriteSync of [false, true]) {
+    const writer = { write: common.mustNotCall() };
+    if (hasWriteSync) writer.writeSync = common.mustNotCall();
+
+    await assert.rejects(
+      pipeTo(source(), writer, { preventClose: true, preventFail: true }),
+      { code: 'ERR_INVALID_ARG_TYPE' },
+    );
+  }
+}
+
+async function testPipeToSyncIterableWriteFallback() {
   const asyncWrites = [];
   const writer = {
     writeSync(chunk) {
@@ -296,7 +323,7 @@ async function testPipeToSyncIterableFastPathWriteFallback() {
   assert.deepStrictEqual(asyncWrites, [new Uint8Array([0x62])]);
 }
 
-async function testPipeToSyncIterableFastPathAsyncValue() {
+async function testPipeToSyncIterableAsyncValue() {
   const chunks = [];
   const writer = {
     write: common.mustNotCall(),
@@ -334,7 +361,8 @@ Promise.all([
   testPipeToSyncPreventClose(),
   testPipeToMinimalWriter(),
   testPipeToSyncMinimalWriter(),
-  testPipeToSyncIterableFastPathWritesIncrementally(),
-  testPipeToSyncIterableFastPathWriteFallback(),
-  testPipeToSyncIterableFastPathAsyncValue(),
+  testPipeToSyncIterableUsesFromBatching(),
+  testPipeToSyncIterableWriteFallback(),
+  testPipeToSyncIterableAsyncValue(),
+  testPipeToSourceNormalizationIndependentOfWriter(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-pull-async.js b/test/parallel/test-stream-iter-pull-async.js
index 3159b718f27e..c341cf296ddd 100644
--- a/test/parallel/test-stream-iter-pull-async.js
+++ b/test/parallel/test-stream-iter-pull-async.js
@@ -3,7 +3,16 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pull, from, text, tap } = require('stream/iter');
+const {
+  broadcast,
+  from,
+  pull,
+  push,
+  share,
+  tap,
+  text,
+  toAsyncStreamable,
+} = require('stream/iter');
 
 async function testPullIdentity() {
   const data = await text(pull(from('hello-async')));
@@ -40,23 +49,72 @@ async function testPullStatefulTransform() {
   assert.strictEqual(data, 'data-ASYNC-END');
 }
 
+async function testPullStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    async function*(source) {
+      assert.strictEqual(this, descriptor);
+      for await (const chunks of source) {
+        yield chunks;
+      }
+    });
+
+  assert.strictEqual(await text(pull(from('receiver'), descriptor)), 'receiver');
+}
+
 async function testPullWithAbortSignal() {
   async function* gen() {
     yield [new Uint8Array([1])];
   }
 
-  const result = pull(gen(), { signal: AbortSignal.abort() });
-  await assert.rejects(
-    async () => {
-      // eslint-disable-next-line no-unused-vars
-      for await (const _ of result) {
-        assert.fail('Should not reach here');
-      }
-    },
+  assert.throws(
+    () => pull(gen(), { signal: AbortSignal.abort() }),
     { name: 'AbortError' },
   );
 }
 
+async function testPullNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return {
+        async *[Symbol.asyncIterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pull(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(await text(result), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+}
+
+function testPullPreAbortOrdering() {
+  const reason = new Error('already aborted');
+  let protocolCalls = 0;
+  const source = {
+    [toAsyncStreamable]() {
+      protocolCalls++;
+      return from('data');
+    },
+  };
+  const signal = AbortSignal.abort(reason);
+
+  assert.throws(() => pull(source, { signal }), (error) => error === reason);
+  assert.strictEqual(protocolCalls, 1);
+  assert.throws(
+    () => pull(null, { signal }),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+}
+
 async function testPullChainedTransforms() {
   const enc = new TextEncoder();
   const transforms = [
@@ -170,6 +228,61 @@ async function testPullSignalAbortWhileSourceNextPending() {
   await assert.rejects(next, { name: 'AbortError' });
 }
 
+async function testPullReturnWhileSourceNextPending() {
+  let startNext;
+  const nextStarted = new Promise((resolve) => { startNext = resolve; });
+  const source = {
+    [Symbol.asyncIterator]() {
+      return {
+        next() {
+          startNext();
+          return new Promise(() => {});
+        },
+      };
+    },
+  };
+
+  const iter = pull(source)[Symbol.asyncIterator]();
+  const next = assert.rejects(iter.next(), { name: 'AbortError' });
+  await nextStarted;
+
+  const timeout = {};
+  const result = await Promise.race([
+    iter.return(),
+    new Promise((resolve) => setImmediate(resolve, timeout)),
+  ]);
+
+  assert.notStrictEqual(result, timeout);
+  assert.deepStrictEqual(result, { value: undefined, done: true });
+  await next;
+}
+
+async function testTransformedConsumerReturnBeforeNext() {
+  const identity = (chunks) => chunks;
+  const pushed = push(identity);
+  const { broadcast: bc } = broadcast();
+  const broadcastConsumer = bc.push(identity);
+  const shared = share(from('shared'));
+  const sharedConsumer = shared.pull(identity);
+
+  assert.strictEqual(bc.consumerCount, 1);
+  assert.strictEqual(shared.consumerCount, 1);
+
+  const cases = [
+    [pushed.readable, common.mustCall(
+      () => assert.strictEqual(pushed.writer.canWrite, null))],
+    [broadcastConsumer, common.mustCall(
+      () => assert.strictEqual(bc.consumerCount, 0))],
+    [sharedConsumer, common.mustCall(
+      () => assert.strictEqual(shared.consumerCount, 0))],
+  ];
+
+  for (const [readable, verify] of cases) {
+    await readable[Symbol.asyncIterator]().return();
+    verify();
+  }
+}
+
 async function testPullSignalAbortWithTransformWhileSourceNextPending() {
   const source = {
     [Symbol.asyncIterator]() {
@@ -411,12 +524,17 @@ async function testTransformOptionsNotShared() {
     testPullIdentity(),
     testPullStatelessTransform(),
     testPullStatefulTransform(),
+    testPullStatefulTransformReceiver(),
     testPullWithAbortSignal(),
+    testPullNormalizesSourceAtCallTime(),
+    testPullPreAbortOrdering(),
     testPullChainedTransforms(),
     testPullSourceError(),
     testTapCallbackError(),
     testPullSignalAbortMidIteration(),
     testPullSignalAbortWhileSourceNextPending(),
+    testPullReturnWhileSourceNextPending(),
+    testTransformedConsumerReturnBeforeNext(),
     testPullSignalAbortWithTransformWhileSourceNextPending(),
     testPullConsumerBreakCleanup(),
     testPullTransformReturnsPromise(),
diff --git a/test/parallel/test-stream-iter-pull-sync.js b/test/parallel/test-stream-iter-pull-sync.js
index c47a6b3f9233..af481dbfa137 100644
--- a/test/parallel/test-stream-iter-pull-sync.js
+++ b/test/parallel/test-stream-iter-pull-sync.js
@@ -3,7 +3,13 @@
 
 const common = require('../common');
 const assert = require('assert');
-const { pullSync, fromSync, bytesSync, tapSync } = require('stream/iter');
+const {
+  pullSync,
+  fromSync,
+  bytesSync,
+  tapSync,
+  toStreamable,
+} = require('stream/iter');
 
 function testPullSyncIdentity() {
   // No transforms - just pass through
@@ -11,6 +17,30 @@ function testPullSyncIdentity() {
   assert.deepStrictEqual(data, new TextEncoder().encode('hello'));
 }
 
+function testPullSyncNormalizesSourceAtCallTime() {
+  let protocolCalls = 0;
+  let iteratorCalls = 0;
+  const source = {
+    [toStreamable]() {
+      protocolCalls++;
+      return {
+        *[Symbol.iterator]() {
+          iteratorCalls++;
+          yield 'data';
+        },
+      };
+    },
+  };
+
+  const result = pullSync(source);
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 0);
+  assert.strictEqual(new TextDecoder().decode(bytesSync(result)), 'data');
+  assert.strictEqual(protocolCalls, 1);
+  assert.strictEqual(iteratorCalls, 1);
+  assert.throws(() => pullSync(null), { code: 'ERR_INVALID_ARG_TYPE' });
+}
+
 function testPullSyncStatelessTransform() {
   const upper = (chunks) => {
     if (chunks === null) return null;
@@ -44,6 +74,20 @@ function testPullSyncStatefulTransform() {
   assert.strictEqual(data, 'data-END');
 }
 
+function testPullSyncStatefulTransformReceiver() {
+  const descriptor = {};
+  descriptor.transform = common.mustCall(
+    function*(source) {
+      assert.strictEqual(this, descriptor);
+      yield* source;
+    });
+
+  assert.strictEqual(
+    new TextDecoder().decode(bytesSync(pullSync(fromSync('receiver'), descriptor))),
+    'receiver',
+  );
+}
+
 function testPullSyncChainedTransforms() {
   const addExcl = (chunks) => {
     if (chunks === null) return null;
@@ -177,8 +221,10 @@ function testPullSyncInvalidTransform() {
 
 Promise.all([
   testPullSyncIdentity(),
+  testPullSyncNormalizesSourceAtCallTime(),
   testPullSyncStatelessTransform(),
   testPullSyncStatefulTransform(),
+  testPullSyncStatefulTransformReceiver(),
   testPullSyncChainedTransforms(),
   testPullSyncSourceError(),
   testPullSyncEmptySource(),
diff --git a/test/parallel/test-stream-iter-push-writer.js b/test/parallel/test-stream-iter-push-writer.js
index 8ce555ca9251..854bd69f0ac6 100644
--- a/test/parallel/test-stream-iter-push-writer.js
+++ b/test/parallel/test-stream-iter-push-writer.js
@@ -19,6 +19,36 @@ async function testOndrain() {
   assert.strictEqual(ondrain(writer), null);
 }
 
+async function testDropPoliciesReportPhysicalCapacity() {
+  const chunk = new Uint8Array(16384);
+
+  for (const backpressure of ['drop-oldest', 'drop-newest']) {
+    const { writer, readable } = push({
+      budget: chunk.byteLength,
+      backpressure,
+    });
+    const iterator = readable[Symbol.asyncIterator]();
+
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+
+    let drained = false;
+    const drain = ondrain(writer);
+    drain.then(common.mustCall(() => { drained = true; }));
+
+    // Drop policies still accept writes despite having no physical capacity.
+    assert.strictEqual(writer.writeSync(chunk), true);
+    assert.strictEqual(writer.canWrite, false);
+    await new Promise(setImmediate);
+    assert.strictEqual(drained, false);
+
+    assert.strictEqual((await iterator.next()).done, false);
+    assert.strictEqual(await drain, true);
+    assert.strictEqual(writer.canWrite, true);
+    await iterator.return();
+  }
+}
+
 async function testOndrainNonDrainable() {
   // Non-drainable objects return null
   assert.strictEqual(ondrain(null), null);
@@ -54,9 +84,9 @@ async function testWriteWithSignalRejects() {
   await assert.rejects(writePromise, { name: 'AbortError' });
 
   // Clean up
-  writer.end();
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+  const end = writer.end();
+  await text(readable);
+  await end;
 }
 
 async function testWriteWithPreAbortedSignal() {
@@ -70,9 +100,10 @@ async function testWriteWithPreAbortedSignal() {
 
   // Writer should still be usable for other writes
   writer.write('ok');
-  writer.end();
+  const end = writer.end();
   const data = await text(readable);
   assert.strictEqual(data, 'ok');
+  await end;
 }
 
 async function testCancelledWriteRemovedFromQueue() {
@@ -97,7 +128,7 @@ async function testCancelledWriteRemovedFromQueue() {
   // The cancelled write should NOT occupy a pending slot.
   // A new write should succeed now that the buffer has room.
   await writer.write(kChunk);
-  writer.end();
+  const end = writer.end();
 
   const result = await iter.next();
   assert.ok(!result.done);
@@ -106,7 +137,8 @@ async function testCancelledWriteRemovedFromQueue() {
     totalBytes += chunk.byteLength;
   }
   assert.strictEqual(totalBytes, 16384);
-  await iter.return();
+  assert.strictEqual((await iter.next()).done, true);
+  await end;
 }
 
 async function testOndrainResolvesFalseOnConsumerBreak() {
@@ -184,7 +216,7 @@ async function testWritevSyncInvalidChunkDoesNotQueue() {
   const { writer, readable } = push({ budget: 16384 });
 
   assert.throws(
-    () => writer.writevSync([1]),
+    () => writer.writevSync([Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
 
@@ -294,6 +326,21 @@ async function testEndSignalAbortWhileDraining() {
   assert.strictEqual(await completedEnd, 5);
 }
 
+async function testFactorySignalAbortWhileDraining() {
+  const controller = new AbortController();
+  const reason = new Error('stream aborted while draining');
+  const { writer, readable } = push({ signal: controller.signal });
+
+  writer.writeSync('hello');
+  const end = writer.end();
+  const endRejected = assert.rejects(end, (error) => error === reason);
+  controller.abort(reason);
+
+  await endRejected;
+  await assert.rejects(text(readable), (error) => error === reason);
+  await assert.rejects(writer.end(), (error) => error === reason);
+}
+
 async function testEndAfterEndSyncWaitsForDrain() {
   const { writer, readable } = push();
   writer.writeSync('hello');
@@ -424,6 +471,20 @@ async function testConsumerReturnResolvesPendingRead() {
   assert.strictEqual(readResult.done, true);
 }
 
+async function testEndRejectsAfterConsumerReturn() {
+  const { writer, readable } = push();
+  writer.writeSync('data');
+  const iter = readable[Symbol.asyncIterator]();
+
+  await iter.return();
+
+  await assert.rejects(
+    writer.end({ signal: AbortSignal.timeout(common.platformTimeout(100)) }),
+    { code: 'ERR_INVALID_STATE' },
+  );
+  assert.strictEqual((await iter.next()).done, true);
+}
+
 // iterator.throw() rejects a pending read with the thrown error
 async function testConsumerThrowRejectsPendingRead() {
   const { readable } = push();
@@ -446,28 +507,48 @@ async function testConsumerThrowRejectsPendingRead() {
   await readRejects;
 }
 
-// end() while writes are pending rejects those writes
-async function testEndRejectsPendingWrites() {
+// end() drains writes that were already pending, then waits for EOF to be read.
+async function testEndDrainsPendingWrites() {
   const kChunk = new Uint8Array(16384);
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   writer.writeSync(kChunk); // fill budget
 
   // This write blocks on backpressure
   const writePromise = writer.write(kChunk);
+  const endPromise = writer.end();
+  await assert.rejects(writer.write(kChunk), { code: 'ERR_INVALID_STATE' });
 
-  await new Promise(setImmediate);
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
 
-  // Ending should reject the pending write
-  writer.endSync();
+  assert.strictEqual((await iterator.next()).done, false);
+  await writePromise;
+  assert.strictEqual((await iterator.next()).done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
 
-  await assert.rejects(
-    () => writePromise,
-    { code: 'ERR_INVALID_STATE' },
-  );
+  assert.strictEqual((await iterator.next()).done, true);
+  assert.strictEqual(await endPromise, kChunk.byteLength * 2);
+  assert.strictEqual(ended, true);
+}
 
-  // Clean up: drain the readable
-  // eslint-disable-next-line no-unused-vars
-  for await (const _ of readable) { break; }
+async function testEndWaitsForEofPull() {
+  const { writer, readable } = push();
+  writer.writeSync('hello');
+  const endPromise = writer.end();
+  let ended = false;
+  endPromise.then(common.mustCall(() => { ended = true; }));
+  const iterator = readable[Symbol.asyncIterator]();
+
+  const data = await iterator.next();
+  assert.strictEqual(data.done, false);
+  await Promise.resolve();
+  assert.strictEqual(ended, false);
+
+  assert.strictEqual((await iterator.next()).done, true);
+  await endPromise;
+  assert.strictEqual(ended, true);
 }
 
 async function testEndIdempotentWhenClosed() {
@@ -502,6 +583,23 @@ async function testAsyncDispose() {
   }
 }
 
+async function testAsyncDisposeWaitsAfterEndSync() {
+  const { writer, readable } = push({ budget: 16384 });
+  writer.writeSync('hello');
+  assert.strictEqual(writer.endSync(), -1);
+
+  let disposed = false;
+  const disposal = writer[Symbol.asyncDispose]().then(() => {
+    disposed = true;
+  });
+  await Promise.resolve();
+  assert.strictEqual(disposed, false);
+
+  assert.strictEqual(await text(readable), 'hello');
+  await disposal;
+  assert.strictEqual(disposed, true);
+}
+
 async function testSyncDispose() {
   const { writer, readable } = push({ budget: 16384 });
   writer.writeSync('hello');
@@ -572,6 +670,7 @@ async function testFailRejectsPendingReadWithFalsyReason() {
 
 Promise.all([
   testOndrain(),
+  testDropPoliciesReportPhysicalCapacity(),
   testOndrainNonDrainable(),
   testWriteWithSignalRejects(),
   testWriteWithPreAbortedSignal(),
@@ -589,6 +688,7 @@ Promise.all([
   testEndAsyncReturnValue(),
   testEndWithPreAbortedSignal(),
   testEndSignalAbortWhileDraining(),
+  testFactorySignalAbortWhileDraining(),
   testEndAfterEndSyncWaitsForDrain(),
   testWriteUint8Array(),
   testOndrainWaitsForDrain(),
@@ -599,10 +699,13 @@ Promise.all([
   testFailRejectsFutureReadWithFalsyReason(),
   testFailRejectsPendingReadWithFalsyReason(),
   testConsumerReturnResolvesPendingRead(),
+  testEndRejectsAfterConsumerReturn(),
   testConsumerThrowRejectsPendingRead(),
-  testEndRejectsPendingWrites(),
+  testEndDrainsPendingWrites(),
+  testEndWaitsForEofPull(),
   testEndIdempotentWhenClosed(),
   testEndRejectsWhenErrored(),
   testAsyncDispose(),
+  testAsyncDisposeWaitsAfterEndSync(),
   testSyncDispose(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-reason-propagation.js b/test/parallel/test-stream-iter-reason-propagation.js
new file mode 100644
index 000000000000..7511dbb2c410
--- /dev/null
+++ b/test/parallel/test-stream-iter-reason-propagation.js
@@ -0,0 +1,271 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  Broadcast,
+  broadcast,
+  from,
+  fromSync,
+  pipeTo,
+  pipeToSync,
+  pull,
+  push,
+  share,
+  shareSync,
+} = require('stream/iter');
+
+const reasons = [undefined, null, false, 0, '', 'failure'];
+
+async function rejectsWith(promise, expected) {
+  await assert.rejects(promise, (reason) => reason === expected);
+}
+
+function throwsWith(fn, expected) {
+  assert.throws(fn, (reason) => reason === expected);
+}
+
+function asyncThrowingSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return {
+        __proto__: null,
+        next() { return Promise.reject(reason); },
+      };
+    },
+  };
+}
+
+function syncThrowingSource(reason) {
+  return {
+    __proto__: null,
+    [Symbol.iterator]() {
+      return {
+        __proto__: null,
+        next() { throw reason; },
+      };
+    },
+  };
+}
+
+async function testPipeReasons() {
+  for (const reason of reasons) {
+    let asyncFailCalled = false;
+    let asyncFailReason;
+    const asyncWriter = {
+      __proto__: null,
+      write() {},
+      fail(error) { asyncFailCalled = true; asyncFailReason = error; },
+    };
+    const asyncSource = asyncThrowingSource(reason);
+
+    await rejectsWith(pipeTo(asyncSource, asyncWriter), reason);
+    assert.strictEqual(asyncFailCalled, true);
+    assert.strictEqual(asyncFailReason, reason);
+
+    let syncFailCalled = false;
+    let syncFailReason;
+    const syncWriter = {
+      __proto__: null,
+      writeSync() { return true; },
+      endSync() { return 0; },
+      fail(error) { syncFailCalled = true; syncFailReason = error; },
+    };
+    const syncSource = syncThrowingSource(reason);
+
+    throwsWith(() => pipeToSync(syncSource, syncWriter), reason);
+    assert.strictEqual(syncFailCalled, true);
+    assert.strictEqual(syncFailReason, reason);
+  }
+}
+
+async function testSharedSourceReasons() {
+  for (const reason of reasons) {
+    const asyncSource = asyncThrowingSource(reason);
+    const asyncIterator = share(asyncSource).pull()[Symbol.asyncIterator]();
+    await rejectsWith(asyncIterator.next(), reason);
+
+    const syncSource = syncThrowingSource(reason);
+    const syncIterator = shareSync(syncSource).pull()[Symbol.iterator]();
+    throwsWith(() => syncIterator.next(), reason);
+  }
+}
+
+async function testBroadcastFromReason() {
+  const reason = 'source failure';
+  const source = asyncThrowingSource(reason);
+  const { broadcast: channel } = Broadcast.from(source);
+  await rejectsWith(channel.push()[Symbol.asyncIterator]().next(), reason);
+}
+
+async function testWriterFailReasons() {
+  for (const reason of reasons) {
+    const pushed = push();
+    pushed.writer.fail(reason);
+    await rejectsWith(
+      pushed.readable[Symbol.asyncIterator]().next(), reason);
+    await rejectsWith(pushed.writer.write('data'), reason);
+    await rejectsWith(pushed.writer.end(), reason);
+
+    const broadcasted = broadcast();
+    const iterator = broadcasted.broadcast.push()[Symbol.asyncIterator]();
+    const pendingRead = iterator.next();
+    broadcasted.writer.fail(reason);
+    await rejectsWith(pendingRead, reason);
+    await rejectsWith(broadcasted.writer.write('data'), reason);
+    await rejectsWith(broadcasted.writer.end(), reason);
+    await rejectsWith(
+      broadcasted.broadcast.push()[Symbol.asyncIterator]().next(), reason);
+  }
+}
+
+async function testDisposeFailsWithUndefined() {
+  const pushed = push();
+  pushed.writer[Symbol.dispose]();
+  await rejectsWith(
+    pushed.readable[Symbol.asyncIterator]().next(), undefined);
+
+  const broadcasted = broadcast();
+  const next = broadcasted.broadcast
+    .push()[Symbol.asyncIterator]().next();
+  broadcasted.writer[Symbol.dispose]();
+  await rejectsWith(next, undefined);
+}
+
+async function testExplicitUndefinedCancellation() {
+  const broadcasted = broadcast();
+  const broadcastNext = broadcasted.broadcast
+    .push()[Symbol.asyncIterator]().next();
+  broadcasted.broadcast.cancel(undefined);
+  await rejectsWith(broadcastNext, undefined);
+
+  const shared = share(from('data'));
+  const shareIterator = shared.pull()[Symbol.asyncIterator]();
+  shared.cancel(undefined);
+  await rejectsWith(shareIterator.next(), undefined);
+
+  const syncShared = shareSync(fromSync('data'));
+  const syncIterator = syncShared.pull()[Symbol.iterator]();
+  syncShared.cancel(undefined);
+  throwsWith(() => syncIterator.next(), undefined);
+}
+
+async function testPendingWriteAbortReasons() {
+  const chunk = new Uint8Array(16384);
+
+  const pushed = push({ budget: chunk.byteLength });
+  pushed.writer.writeSync(chunk);
+  const pushController = new AbortController();
+  const pushWrite = pushed.writer.write('data', {
+    signal: pushController.signal,
+  });
+  pushController.abort(null);
+  await rejectsWith(pushWrite, null);
+
+  const broadcasted = broadcast({ budget: chunk.byteLength });
+  broadcasted.broadcast.push();
+  broadcasted.writer.writeSync(chunk);
+  const broadcastController = new AbortController();
+  const broadcastWrite = broadcasted.writer.write('data', {
+    signal: broadcastController.signal,
+  });
+  broadcastController.abort(null);
+  await rejectsWith(broadcastWrite, null);
+  broadcasted.broadcast.cancel();
+}
+
+async function testTransformReasons() {
+  for (const thrownReason of [undefined, 'transform failure']) {
+    let observedReason;
+    const watchSignal = (batch, { signal }) => {
+      signal.addEventListener('abort', () => {
+        observedReason = signal.reason;
+      }, { once: true });
+      return batch;
+    };
+    const throwReason = () => { throw thrownReason; };
+    const transformed = pull(from('data'), watchSignal, throwReason);
+    const iterator = transformed[Symbol.asyncIterator]();
+    await rejectsWith(iterator.next(), thrownReason);
+    assert.strictEqual(observedReason, thrownReason);
+  }
+
+  const controller = new AbortController();
+  const started = Promise.withResolvers();
+  const waitForAbort = (batch, { signal }) => {
+    started.resolve();
+    const { promise, reject } = Promise.withResolvers();
+    signal.addEventListener('abort', () => reject(signal.reason), {
+      once: true,
+    });
+    return promise;
+  };
+  const abortedIterator = pull(from('data'), waitForAbort, {
+    signal: controller.signal,
+  })[Symbol.asyncIterator]();
+  const next = abortedIterator.next();
+  await started.promise;
+  controller.abort(null);
+  await rejectsWith(next, null);
+}
+
+async function testIteratorThrowReasonReachesTransforms() {
+  const reason = undefined;
+  let observedReason;
+  const transformed = pull(from('data'), (batch, { signal }) => {
+    signal.addEventListener('abort', () => {
+      observedReason = signal.reason;
+    }, { once: true });
+    return batch;
+  });
+  const iterator = transformed[Symbol.asyncIterator]();
+
+  await iterator.next();
+  await rejectsWith(iterator.throw(reason), reason);
+  assert.strictEqual(observedReason, reason);
+}
+
+async function testErroredWriterPrecedesOperationSignal() {
+  const failure = 0;
+  const consumerReason = 'consumer failure';
+  const signal = AbortSignal.abort(null);
+  const { writer, readable } = push();
+  const iterator = readable[Symbol.asyncIterator]();
+
+  writer.fail(failure);
+
+  await rejectsWith(writer.write('data', { signal }), failure);
+  await rejectsWith(writer.end({ signal }), failure);
+  await rejectsWith(iterator.throw(consumerReason), consumerReason);
+  await rejectsWith(writer.write('data'), failure);
+}
+
+async function testCompletedBroadcastConsumerStaysCompleted() {
+  const { writer, broadcast: channel } = broadcast();
+  const iterator = channel.push()[Symbol.asyncIterator]();
+
+  await iterator.return();
+  writer.fail(undefined);
+
+  assert.deepStrictEqual(await iterator.next(), {
+    __proto__: null,
+    done: true,
+    value: undefined,
+  });
+}
+
+Promise.all([
+  testPipeReasons(),
+  testSharedSourceReasons(),
+  testBroadcastFromReason(),
+  testWriterFailReasons(),
+  testDisposeFailsWithUndefined(),
+  testExplicitUndefinedCancellation(),
+  testPendingWriteAbortReasons(),
+  testTransformReasons(),
+  testIteratorThrowReasonReachesTransforms(),
+  testErroredWriterPrecedesOperationSignal(),
+  testCompletedBroadcastConsumerStaysCompleted(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-resizable-buffers.js b/test/parallel/test-stream-iter-resizable-buffers.js
new file mode 100644
index 000000000000..b66973393cac
--- /dev/null
+++ b/test/parallel/test-stream-iter-resizable-buffers.js
@@ -0,0 +1,178 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const {
+  array,
+  arraySync,
+  broadcast,
+  pipeTo,
+  pipeToSync,
+  push,
+  share,
+  shareSync,
+} = require('stream/iter');
+
+const kResizeError = {
+  code: 'ERR_INVALID_STATE',
+  message: /resized or detached/,
+};
+
+async function testBufferedViewMutationRejected() {
+  const resizable = new ArrayBuffer(1, { maxByteLength: 2 });
+  const growable = new SharedArrayBuffer(1, { maxByteLength: 2 });
+  const detachable = new ArrayBuffer(1);
+  const cases = [
+    [new Uint8Array(resizable), () => resizable.resize(2)],
+    [new Uint8Array(growable), () => growable.grow(2)],
+    [new Uint8Array(detachable), () => {
+      structuredClone(detachable, { transfer: [detachable] });
+    }],
+  ];
+
+  for (const [view, mutate] of cases) {
+    const { writer, readable } = push();
+    assert.strictEqual(writer.writeSync(view), true);
+    mutate();
+    await assert.rejects(
+      readable[Symbol.asyncIterator]().next(),
+      kResizeError,
+    );
+  }
+}
+
+async function testDropOldestUsesAcceptedByteLength() {
+  const buffer = new ArrayBuffer(16384, { maxByteLength: 16384 });
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'drop-oldest',
+  });
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(0);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(2)), true);
+  assert.strictEqual(writer.writeSync(Uint8Array.of(3)), true);
+  writer.endSync();
+
+  assert.strictEqual((await iterator.next()).value[0][0], 2);
+  assert.strictEqual((await iterator.next()).value[0][0], 3);
+  assert.strictEqual((await iterator.next()).done, true);
+}
+
+async function testPendingWritesRejectResizedViews() {
+  const pushResult = push({ budget: 16384, backpressure: 'unbounded' });
+  assert.strictEqual(
+    pushResult.writer.writeSync(new Uint8Array(16384)), true);
+  const pushBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const pushPending = pushResult.writer.write(new Uint8Array(pushBuffer));
+  const pushRejected = assert.rejects(pushPending, kResizeError);
+  pushBuffer.resize(2);
+  const pushIterator = pushResult.readable[Symbol.asyncIterator]();
+  assert.strictEqual((await pushIterator.next()).done, false);
+  await pushRejected;
+  pushResult.writer.endSync();
+  assert.strictEqual((await pushIterator.next()).done, true);
+
+  const { writer, broadcast: bc } = broadcast({
+    budget: 16384,
+    backpressure: 'unbounded',
+  });
+  const broadcastIterator = bc.push()[Symbol.asyncIterator]();
+  assert.strictEqual(writer.writeSync(new Uint8Array(16384)), true);
+  const broadcastBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const broadcastPending = writer.write(new Uint8Array(broadcastBuffer));
+  const broadcastRejected = assert.rejects(broadcastPending, kResizeError);
+  broadcastBuffer.resize(2);
+  assert.strictEqual((await broadcastIterator.next()).done, false);
+  await broadcastRejected;
+  writer.endSync();
+  assert.strictEqual((await broadcastIterator.next()).done, true);
+}
+
+async function testBroadcastRejectsResizedBufferedView() {
+  const buffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const { writer, broadcast: bc } = broadcast();
+  const iterator = bc.push()[Symbol.asyncIterator]();
+
+  assert.strictEqual(writer.writeSync(new Uint8Array(buffer)), true);
+  buffer.resize(2);
+
+  await assert.rejects(iterator.next(), kResizeError);
+  await assert.rejects(writer.end(), kResizeError);
+}
+
+async function testShareRejectsResizedBufferedView() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const shared = share([[new Uint8Array(asyncBuffer)]]);
+  const first = shared.pull()[Symbol.asyncIterator]();
+  const second = shared.pull()[Symbol.asyncIterator]();
+
+  assert.strictEqual((await first.next()).done, false);
+  asyncBuffer.resize(2);
+  await assert.rejects(second.next(), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const sharedSync = shareSync([[new Uint8Array(syncBuffer)]]);
+  const firstSync = sharedSync.pull()[Symbol.iterator]();
+  const secondSync = sharedSync.pull()[Symbol.iterator]();
+
+  assert.strictEqual(firstSync.next().done, false);
+  syncBuffer.resize(2);
+  assert.throws(() => secondSync.next(), kResizeError);
+}
+
+async function testConsumersRejectResizedViews() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  async function* asyncSource() {
+    yield [new Uint8Array(asyncBuffer)];
+    asyncBuffer.resize(2);
+  }
+  await assert.rejects(array(asyncSource(), { limit: 1 }), kResizeError);
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  function* syncSource() {
+    yield [new Uint8Array(syncBuffer)];
+    syncBuffer.resize(2);
+  }
+  assert.throws(() => arraySync(syncSource(), { limit: 1 }), kResizeError);
+}
+
+async function testPipeRejectsWriterResize() {
+  const asyncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const asyncWriter = {
+    write() {
+      asyncBuffer.resize(2);
+    },
+    fail: common.mustCall(),
+  };
+  await assert.rejects(
+    pipeTo([new Uint8Array(asyncBuffer)], asyncWriter),
+    kResizeError,
+  );
+
+  const syncBuffer = new ArrayBuffer(1, { maxByteLength: 2 });
+  const syncWriter = {
+    writeSync() {
+      syncBuffer.resize(2);
+      return true;
+    },
+    fail: common.mustCall(),
+  };
+  assert.throws(
+    () => pipeToSync(
+      [new Uint8Array(syncBuffer)], syncWriter, { preventClose: true }),
+    kResizeError,
+  );
+}
+
+Promise.all([
+  testBufferedViewMutationRejected(),
+  testDropOldestUsesAcceptedByteLength(),
+  testPendingWritesRejectResizedViews(),
+  testBroadcastRejectsResizedBufferedView(),
+  testShareRejectsResizedBufferedView(),
+  testConsumersRejectResizedViews(),
+  testPipeRejectsWriterResize(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-share-async.js b/test/parallel/test-stream-iter-share-async.js
index c96a0cb0f3c3..dafb157a7512 100644
--- a/test/parallel/test-stream-iter-share-async.js
+++ b/test/parallel/test-stream-iter-share-async.js
@@ -143,6 +143,70 @@ async function testShareCancelWithFalsyReason() {
   }
 }
 
+async function testShareCancelWhileSourcePullPending() {
+  const noReason = { __proto__: null };
+
+  for (const reason of [noReason, 0]) {
+    const sourceStarted = Promise.withResolvers();
+    const sourceNext = Promise.withResolvers();
+    let nextCalls = 0;
+    let returnCalls = 0;
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() {
+            nextCalls++;
+            sourceStarted.resolve();
+            return sourceNext.promise;
+          },
+          async return() {
+            returnCalls++;
+            return { __proto__: null, done: true, value: undefined };
+          },
+        };
+      },
+    };
+    const shared = share(source);
+    const iterator = shared.pull()[Symbol.asyncIterator]();
+    const read = iterator.next().then(
+      (value) => ({ __proto__: null, rejected: false, value }),
+      (error) => ({ __proto__: null, rejected: true, error }),
+    );
+
+    await sourceStarted.promise;
+    if (reason === noReason) {
+      shared.cancel();
+    } else {
+      shared.cancel(reason);
+    }
+
+    const timedOut = { __proto__: null };
+    const outcome = await Promise.race([
+      read,
+      new Promise((resolve) => setImmediate(resolve, timedOut)),
+    ]);
+    assert.notStrictEqual(outcome, timedOut);
+    if (reason === noReason) {
+      assert.strictEqual(outcome.rejected, false);
+      assert.strictEqual(outcome.value.done, true);
+    } else {
+      assert.strictEqual(outcome.rejected, true);
+      assert.strictEqual(outcome.error, reason);
+    }
+    assert.strictEqual(nextCalls, 1);
+
+    sourceNext.resolve({
+      __proto__: null,
+      done: false,
+      value: [Uint8Array.of(1)],
+    });
+    await new Promise(setImmediate);
+    assert.strictEqual(returnCalls, 1);
+  }
+}
+
 async function testShareAbortSignal() {
   const ac = new AbortController();
   const reason = new Error('share aborted');
@@ -272,6 +336,27 @@ async function testShareSourceError() {
   }, { message: 'share source boom' });
 }
 
+async function testShareSourceErrorFollowsBufferedData() {
+  const reason = new Error('share source boom');
+  async function* failingSource() {
+    yield [Uint8Array.of(1)];
+    throw reason;
+  }
+
+  const shared = share(failingSource());
+  const fast = shared.pull()[Symbol.asyncIterator]();
+  const slow = shared.pull()[Symbol.asyncIterator]();
+  const returned = shared.pull()[Symbol.asyncIterator]();
+  await returned.return();
+
+  assert.deepStrictEqual((await fast.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(fast.next(), (error) => error === reason);
+
+  assert.deepStrictEqual((await slow.next()).value, [Uint8Array.of(1)]);
+  await assert.rejects(slow.next(), (error) => error === reason);
+  assert.strictEqual((await returned.next()).done, true);
+}
+
 async function testShareLateJoiningConsumer() {
   // A consumer that joins after some data has been consumed should only
   // see data remaining in the buffer (not items already trimmed).
@@ -380,12 +465,14 @@ Promise.all([
   testShareCancelMidIteration(),
   testShareCancelWithReason(),
   testShareCancelWithFalsyReason(),
+  testShareCancelWhileSourcePullPending(),
   testShareAbortSignal(),
   testShareAbortSignalWhileSourcePullPending(),
   testSharePullAbortSignalRejectsPendingNext(),
   testSharePullPreAbortedSignalDoesNotAddConsumer(),
   testShareAlreadyAborted(),
   testShareSourceError(),
+  testShareSourceErrorFollowsBufferedData(),
   testShareLateJoiningConsumer(),
   testShareConsumerBreak(),
   testShareMultipleConsumersConcurrentPull(),
diff --git a/test/parallel/test-stream-iter-share-coverage.js b/test/parallel/test-stream-iter-share-coverage.js
index 48866e61deab..8b0cc1967f2f 100644
--- a/test/parallel/test-stream-iter-share-coverage.js
+++ b/test/parallel/test-stream-iter-share-coverage.js
@@ -88,32 +88,122 @@ async function testSyncIteratorThrow() {
   assert.strictEqual(shared.consumerCount, 0);
 }
 
-// Async source throws non-Error value → wrapError
+async function testCompletedSyncConsumerStaysCompleted() {
+  const reason = undefined;
+  const source = {
+    __proto__: null,
+    [Symbol.iterator]() {
+      return {
+        __proto__: null,
+        next() { throw reason; },
+      };
+    },
+  };
+  const shared = shareSync(source);
+  const completed = shared.pull()[Symbol.iterator]();
+  const active = shared.pull()[Symbol.iterator]();
+
+  completed.return();
+  let caught = false;
+  try {
+    active.next();
+  } catch (error) {
+    caught = true;
+    assert.strictEqual(error, reason);
+  }
+  assert.strictEqual(caught, true);
+  assert.deepStrictEqual(completed.next(), {
+    __proto__: null,
+    done: true,
+    value: undefined,
+  });
+}
+
+async function testSyncCancelIgnoresCleanupError() {
+  const reason = null;
+  const source = {
+    __proto__: null,
+    [Symbol.iterator]() {
+      let done = false;
+      return {
+        __proto__: null,
+        next() {
+          if (done) return { done: true, value: undefined };
+          done = true;
+          return { done: false, value: [Buffer.from('data')] };
+        },
+        get return() { throw new Error('cleanup failed'); },
+      };
+    },
+  };
+  const shared = shareSync(source);
+  const iterator = shared.pull()[Symbol.iterator]();
+
+  iterator.next();
+  shared.cancel(reason);
+
+  assert.strictEqual(shared.consumerCount, 0);
+  assert.throws(() => iterator.next(), (error) => error === reason);
+}
+
+async function testAsyncCancelIgnoresCleanupGetterError() {
+  const reason = null;
+  const source = {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      let done = false;
+      return {
+        __proto__: null,
+        next() {
+          if (done) return Promise.resolve({ done: true, value: undefined });
+          done = true;
+          return Promise.resolve({
+            done: false,
+            value: [Buffer.from('data')],
+          });
+        },
+        get return() { throw new Error('cleanup failed'); },
+      };
+    },
+  };
+  const shared = share(source);
+  const iterator = shared.pull()[Symbol.asyncIterator]();
+
+  await iterator.next();
+  shared.cancel(reason);
+
+  assert.strictEqual(shared.consumerCount, 0);
+  await assert.rejects(iterator.next(), (error) => error === reason);
+}
+
+// Async source preserves a non-Error thrown value.
 async function testShareSourceThrowsNonError() {
+  const reason = 'not an error';
   async function* source() {
     yield [new TextEncoder().encode('ok')];
-    throw 'not an error'; // eslint-disable-line no-throw-literal
+    throw reason;
   }
   const shared = share(source());
   const consumer = shared.pull();
   await assert.rejects(async () => {
     // eslint-disable-next-line no-unused-vars
     for await (const batch of consumer) { /* consume */ }
-  }, { code: 'ERR_OPERATION_FAILED' });
+  }, (error) => error === reason);
 }
 
-// Sync source throws non-Error value → wrapError
+// Sync source preserves a non-Error thrown value.
 async function testSyncShareSourceThrowsNonError() {
+  const reason = 42;
   function* source() {
     yield [new TextEncoder().encode('ok')];
-    throw 42; // eslint-disable-line no-throw-literal
+    throw reason;
   }
   const shared = shareSync(source());
   const consumer = shared.pull();
   assert.throws(() => {
     // eslint-disable-next-line no-unused-vars
     for (const batch of consumer) { /* consume */ }
-  }, { code: 'ERR_OPERATION_FAILED' });
+  }, (error) => error === reason);
 }
 
 Promise.all([
@@ -123,6 +213,9 @@ Promise.all([
   testSyncShareDispose(),
   testAsyncIteratorThrow(),
   testSyncIteratorThrow(),
+  testCompletedSyncConsumerStaysCompleted(),
+  testSyncCancelIgnoresCleanupError(),
+  testAsyncCancelIgnoresCleanupGetterError(),
   testShareSourceThrowsNonError(),
   testSyncShareSourceThrowsNonError(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-to-readable.js b/test/parallel/test-stream-iter-to-readable.js
index d8287036e7e7..a58bf0087df5 100644
--- a/test/parallel/test-stream-iter-to-readable.js
+++ b/test/parallel/test-stream-iter-to-readable.js
@@ -16,13 +16,15 @@ const {
   toReadableSync,
 } = require('stream/iter');
 
+const kNeverResolves = new Promise(() => { });
+
 function collect(readable) {
-  return new Promise((resolve, reject) => {
-    const chunks = [];
-    readable.on('data', (chunk) => chunks.push(chunk));
-    readable.on('end', () => resolve(Buffer.concat(chunks)));
-    readable.on('error', reject);
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const chunks = [];
+  readable.on('data', (chunk) => chunks.push(chunk));
+  readable.on('end', () => resolve(Buffer.concat(chunks)));
+  readable.on('error', reject);
+  return promise;
 }
 
 // =============================================================================
@@ -105,6 +107,84 @@ async function testErrorAsync() {
   }, { message: 'source failed' });
 }
 
+async function testFalsyErrorAsync() {
+  for (const [reason, code] of [
+    [null, 'ERR_FALSY_VALUE_REJECTION'],
+    [{ __proto__: null }, 'ERR_OPERATION_FAILED'],
+  ]) {
+    const source = {
+      __proto__: null,
+      [Symbol.asyncIterator]() {
+        return {
+          __proto__: null,
+          next() { return Promise.reject(reason); },
+          return() { return Promise.resolve({ done: true }); },
+        };
+      },
+    };
+
+    await assert.rejects(collect(toReadable(source)), (error) => {
+      return error.code === code && error.reason === reason;
+    });
+  }
+}
+
+async function testFalsyThenableCleanupError() {
+  const reason = null;
+  const source = {
+    __proto__: null,
+    [Symbol.asyncIterator]() {
+      return {
+        __proto__: null,
+        next() { return kNeverResolves; },
+        return() {
+          return {
+            __proto__: null,
+            then(resolve, reject) { reject(reason); },
+          };
+        },
+      };
+    },
+  };
+  const readable = toReadable(source);
+  const { promise, resolve } = Promise.withResolvers();
+  readable.once('error', resolve);
+
+  readable.destroy();
+
+  const result = await promise;
+  assert.strictEqual(result.code, 'ERR_FALSY_VALUE_REJECTION');
+  assert.strictEqual(result.reason, reason);
+}
+
+async function testFalsyCleanupGetterErrors() {
+  for (const [symbol, create] of [
+    [Symbol.asyncIterator, toReadable],
+    [Symbol.iterator, toReadableSync],
+  ]) {
+    const reason = false;
+    const source = {
+      __proto__: null,
+      [symbol]() {
+        return {
+          __proto__: null,
+          next() { return kNeverResolves; },
+          get return() { throw reason; },
+        };
+      },
+    };
+    const readable = create(source);
+    const { promise, resolve } = Promise.withResolvers();
+    readable.once('error', resolve);
+
+    readable.destroy();
+
+    const result = await promise;
+    assert.strictEqual(result.code, 'ERR_FALSY_VALUE_REJECTION');
+    assert.strictEqual(result.reason, reason);
+  }
+}
+
 // =============================================================================
 // fromStreamIter: empty source
 // =============================================================================
@@ -155,16 +235,16 @@ async function testDestroyAsync() {
 
   // Read a couple chunks then destroy
   const chunks = [];
-  await new Promise((resolve, reject) => {
-    readable.on('data', (chunk) => {
-      chunks.push(chunk);
-      if (chunks.length >= 3) {
-        readable.destroy();
-      }
-    });
-    readable.on('close', resolve);
-    readable.on('error', reject);
+  const { promise, resolve, reject } = Promise.withResolvers();
+  readable.on('data', (chunk) => {
+    chunks.push(chunk);
+    if (chunks.length >= 3) {
+      readable.destroy();
+    }
   });
+  readable.on('close', resolve);
+  readable.on('error', reject);
+  await promise;
 
   assert.ok(chunks.length >= 3);
   assert.ok(returnCalled, 'iterator.return() should have been called');
@@ -190,15 +270,20 @@ async function testDestroyDuringBackpressure() {
   const readable = toReadable(gen(), { highWaterMark: 1 });
 
   // Read one chunk to start the pump, then destroy while it's waiting
-  const chunk = await new Promise((resolve) => {
+  {
+    const { promise, resolve } = Promise.withResolvers();
     readable.once('readable', () => resolve(readable.read()));
-  });
-  assert.ok(chunk);
+    assert.ok(await promise);
+  }
 
   // The pump should be waiting on backpressure now. Destroy the stream.
   readable.destroy();
 
-  await new Promise((resolve) => readable.on('close', resolve));
+  {
+    const { promise, resolve } = Promise.withResolvers();
+    readable.on('close', resolve);
+    await promise;
+  }
   assert.ok(readable.destroyed);
   assert.ok(returnCalled, 'iterator.return() should have been called');
 }
@@ -243,11 +328,11 @@ async function testPipeAsync() {
     },
   });
 
-  await new Promise((resolve, reject) => {
-    readable.pipe(writable);
-    writable.on('finish', resolve);
-    writable.on('error', reject);
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  readable.pipe(writable);
+  writable.on('finish', resolve);
+  writable.on('error', reject);
+  await promise;
 
   assert.strictEqual(Buffer.concat(chunks).toString(), 'pipe test data');
 }
@@ -472,6 +557,24 @@ async function testErrorSync() {
   }, { message: 'sync source failed' });
 }
 
+async function testFalsyErrorSync() {
+  const reason = false;
+  const source = {
+    __proto__: null,
+    [Symbol.iterator]() {
+      return {
+        __proto__: null,
+        next() { throw reason; },
+      };
+    },
+  };
+
+  await assert.rejects(collect(toReadableSync(source)), (error) => {
+    return error.code === 'ERR_FALSY_VALUE_REJECTION' &&
+           error.reason === reason;
+  });
+}
+
 // =============================================================================
 // fromStreamIterSync: empty source
 // =============================================================================
@@ -506,7 +609,9 @@ async function testDestroySync() {
   readable.read();  // Start iteration
   readable.destroy();
 
-  await new Promise((resolve) => readable.on('close', resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  readable.on('close', resolve);
+  await promise;
   assert.ok(returnCalled, 'iterator.return() should have been called');
 }
 
@@ -615,6 +720,9 @@ Promise.all([
   testMultiBatchAsync(),
   testBackpressureAsync(),
   testErrorAsync(),
+  testFalsyErrorAsync(),
+  testFalsyThenableCleanupError(),
+  testFalsyCleanupGetterErrors(),
   testEmptyAsync(),
   testEmptyBatchAsync(),
   testDestroyAsync(),
@@ -628,6 +736,7 @@ Promise.all([
   testBackpressureSync(),
   testBackpressureSyncMultiChunkBatch(),
   testErrorSync(),
+  testFalsyErrorSync(),
   testDestroySync(),
   testRoundTrip(),
   testRoundTripWithCompression(),
diff --git a/test/parallel/test-stream-iter-transform-roundtrip.js b/test/parallel/test-stream-iter-transform-roundtrip.js
index df63483d6c85..a734b6c3132e 100644
--- a/test/parallel/test-stream-iter-transform-roundtrip.js
+++ b/test/parallel/test-stream-iter-transform-roundtrip.js
@@ -19,6 +19,7 @@ const {
   decompressBrotli,
   decompressZstd,
 } = require('zlib/iter');
+const zlib = require('zlib');
 
 // =============================================================================
 // Helper: compress then decompress, verify round-trip equality
@@ -42,6 +43,18 @@ async function testGzipRoundTrip() {
   assert.strictEqual(result, input);
 }
 
+async function testValidatedTransformReceiver() {
+  const descriptor = compressGzip();
+  const transform = descriptor.transform;
+  descriptor.transform = common.mustCall(function(source, options) {
+    assert.strictEqual(this, descriptor);
+    return Reflect.apply(transform, this, [source, options]);
+  });
+
+  const result = await bytes(pull(from('receiver'), descriptor));
+  assert.ok(result.byteLength > 0);
+}
+
 async function testGzipLargeData() {
   // 100KB of repeated text - exercises multi-chunk path
   const input = 'gzip large data test. '.repeat(5000);
@@ -131,6 +144,20 @@ async function testZstdActuallyCompresses() {
             `Compressed ${compressed.byteLength} should be < original ${inputBuf.byteLength}`);
 }
 
+async function testZstdConcatenatedFrames() {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b');
+  const input = Buffer.concat([first, second]);
+  const result = await bytes(pull(from(input), decompressZstd()));
+  assert.strictEqual(Buffer.from(result).toString(), 'ab');
+
+  const withJunk = await bytes(pull(
+    from([first, Buffer.from('junk'), second]),
+    decompressZstd(),
+  ));
+  assert.strictEqual(Buffer.from(withJunk).toString(), 'a');
+}
+
 // =============================================================================
 // Binary data round-trip - verify no corruption on non-text data
 // =============================================================================
@@ -250,6 +277,7 @@ async function testGzipWithLevel() {
 (async () => {
   // Gzip
   await testGzipRoundTrip();
+  await testValidatedTransformReceiver();
   await testGzipLargeData();
   await testGzipActuallyCompresses();
 
@@ -267,6 +295,7 @@ async function testGzipWithLevel() {
   await testZstdRoundTrip();
   await testZstdLargeData();
   await testZstdActuallyCompresses();
+  await testZstdConcatenatedFrames();
 
   // Binary data
   await testBinaryRoundTripGzip();
diff --git a/test/parallel/test-stream-iter-transform-sync.js b/test/parallel/test-stream-iter-transform-sync.js
index d674c26cca10..991dba2748ed 100644
--- a/test/parallel/test-stream-iter-transform-sync.js
+++ b/test/parallel/test-stream-iter-transform-sync.js
@@ -19,6 +19,7 @@ const {
   decompressBrotliSync,
   decompressZstdSync,
 } = require('zlib/iter');
+const { zstdCompressSync } = require('zlib');
 
 // =============================================================================
 // Helper: sync compress then decompress, verify round-trip equality
@@ -118,6 +119,15 @@ function testZstdLargeData() {
   assert.strictEqual(result, input);
 }
 
+function testZstdConcatenatedFrames() {
+  const input = Buffer.concat([
+    zstdCompressSync('a'),
+    zstdCompressSync('b'),
+  ]);
+  const result = bytesSync(pullSync(fromSync(input), decompressZstdSync()));
+  assert.strictEqual(Buffer.from(result).toString(), 'ab');
+}
+
 // =============================================================================
 // Cross-algorithm: compress async-compatible, decompress sync (and vice versa)
 // The sync transforms should produce output compatible with the standard format
@@ -218,6 +228,7 @@ testBrotliRoundTrip();
 testBrotliLargeData();
 testZstdRoundTrip();
 testZstdLargeData();
+testZstdConcatenatedFrames();
 testGzipWithOptions();
 testBrotliWithOptions();
 testMixedStatelessAndStateful();
diff --git a/test/parallel/test-stream-iter-validation.js b/test/parallel/test-stream-iter-validation.js
index 8dcfb46f173f..871c891a6539 100644
--- a/test/parallel/test-stream-iter-validation.js
+++ b/test/parallel/test-stream-iter-validation.js
@@ -22,7 +22,7 @@ const {
 // =============================================================================
 
 // Budget must be integer >= 16384
-assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => push({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => push({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 // Values < 16384 are rejected
 assert.throws(() => push({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
@@ -68,12 +68,11 @@ assert.throws(() => push('bad', {}), { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
-// Writer.write rejects non-string/non-Uint8Array
+// Writer chunks use the Web IDL (Uint8Array or USVString) conversion.
 {
   const { writer } = push();
-  assert.throws(() => writer.writeSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync({}), { code: 'ERR_INVALID_ARG_TYPE' });
-  assert.throws(() => writer.writeSync(true), { code: 'ERR_INVALID_ARG_TYPE' });
+  assert.throws(() => writer.writeSync(Symbol()),
+                { code: 'ERR_INVALID_ARG_TYPE' });
   writer.endSync();
 }
 
@@ -87,7 +86,7 @@ assert.throws(() => duplex({ a: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => duplex({ b: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
 
 // Budget validation (cascades through to push())
-assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => duplex({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => duplex({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -99,16 +98,16 @@ assert.throws(() => duplex({ budget: 0 }), { code: 'ERR_OUT_OF_RANGE' });
   const [a, b] = duplex({ budget: Number.MAX_SAFE_INTEGER });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 // Per-direction overrides
 {
   const [a, b] = duplex({ a: { budget: 16384 }, b: { budget: 32768 } });
   assert.strictEqual(a.writer.canWrite, true);
   assert.strictEqual(b.writer.canWrite, true);
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 assert.throws(() => duplex({ signal: {} }), { code: 'ERR_INVALID_ARG_TYPE' });
@@ -129,7 +128,7 @@ assert.throws(() => pullSync(fromSync('a'), 42), { code: 'ERR_INVALID_ARG_TYPE'
 // broadcast() validation
 // =============================================================================
 
-assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => broadcast({ budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => broadcast({ budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -214,7 +213,7 @@ assert.throws(() => Broadcast.from(42), { code: 'ERR_INVALID_ARG_TYPE' });
 // =============================================================================
 
 assert.throws(() => share(42), { code: 'ERR_INVALID_ARG_TYPE' });
-assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_INVALID_ARG_TYPE' });
+assert.throws(() => share(from('a'), { budget: 'bad' }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: 1.5 }), { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => share(from('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
               { code: 'ERR_OUT_OF_RANGE' });
@@ -239,7 +238,7 @@ share(from('a'), { budget: Number.MAX_SAFE_INTEGER }).cancel();
 
 assert.throws(() => shareSync(42), { code: 'ERR_INVALID_ARG_TYPE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 'bad' }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: 1.5 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => shareSync(fromSync('a'), { budget: Number.MAX_SAFE_INTEGER + 1 }),
@@ -274,7 +273,7 @@ assert.throws(() => bytesSync(fromSync('a'), { limit: 'bad' }),
 assert.throws(() => bytesSync(fromSync('a'), { limit: -1 }),
               { code: 'ERR_OUT_OF_RANGE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 42 }),
-              { code: 'ERR_INVALID_ARG_TYPE' });
+              { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => textSync(fromSync('a'), { encoding: 'bogus' }),
               { code: 'ERR_INVALID_ARG_VALUE' });
 assert.throws(() => arrayBufferSync(fromSync('a'), { limit: 'bad' }),
@@ -318,7 +317,7 @@ async function testAsyncValidation() {
   await assert.rejects(
     () => bytes(from('a'), { limit: -1 }), { code: 'ERR_OUT_OF_RANGE' });
   await assert.rejects(
-    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_TYPE' });
+    () => text(from('a'), { encoding: 42 }), { code: 'ERR_INVALID_ARG_VALUE' });
   await assert.rejects(
     () => text(from('a'), { encoding: 'not-a-real-encoding' }),
     { code: 'ERR_INVALID_ARG_VALUE' });
@@ -397,8 +396,8 @@ async function testAsyncValidation() {
 // Duplex with valid options
 {
   const [a, b] = duplex({ budget: 16384 });
-  a.close();
-  b.close();
+  a.writer.endSync();
+  b.writer.endSync();
 }
 
 // Broadcast with valid options
diff --git a/test/parallel/test-stream-iter-webidl.js b/test/parallel/test-stream-iter-webidl.js
new file mode 100644
index 000000000000..904bf77a647f
--- /dev/null
+++ b/test/parallel/test-stream-iter-webidl.js
@@ -0,0 +1,159 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { Writable } = require('stream');
+const {
+  Broadcast,
+  broadcast,
+  bytesSync,
+  from,
+  fromWritable,
+  fromSync,
+  pipeTo,
+  pull,
+  push,
+  share,
+  shareSync,
+  text,
+  textSync,
+} = require('stream/iter');
+
+function testDictionaryAndIntegerConversion() {
+  const pushed = push(null);
+  assert.strictEqual(pushed.writer.endSync(), 0);
+  const transformedWithNull = push((chunks) => chunks, null);
+  transformedWithNull.writer.endSync();
+
+  const broadcasted = broadcast(null);
+  assert.strictEqual(broadcasted.writer.endSync(), 0);
+
+  share(from(''), null).cancel();
+  shareSync(fromSync(''), null).cancel();
+
+  assert.deepStrictEqual(bytesSync(fromSync('data'), null),
+                         new TextEncoder().encode('data'));
+  assert.deepStrictEqual(
+    bytesSync(fromSync('data'), { limit: '4.9' }),
+    new TextEncoder().encode('data'),
+  );
+  assert.throws(
+    () => bytesSync(fromSync('data'), { limit: -1 }),
+    { name: 'TypeError', code: 'ERR_OUT_OF_RANGE' },
+  );
+
+  const converted = push({
+    budget: '16384.9',
+    backpressure: { toString: () => 'strict' },
+  });
+  assert.strictEqual(converted.writer.canWrite, true);
+  converted.writer.endSync();
+
+  let signalReads = 0;
+  const transformed = push((chunks) => chunks, {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  transformed.writer.endSync();
+}
+
+async function testUnknownDictionaryMembers() {
+  const source = pull(from('pull'), {
+    transform: 1,
+    write: 1,
+    unknown: true,
+  });
+  assert.strictEqual(await text(source), 'pull');
+
+  let ended = false;
+  const writer = {
+    write() {},
+    end() { ended = true; },
+  };
+  await pipeTo(from('pipe'), writer, {
+    transform: 1,
+    write: 1,
+  });
+  assert.strictEqual(ended, true);
+
+  const options = {
+    get encoding() {
+      throw new Error('unknown member was read');
+    },
+  };
+  assert.deepStrictEqual(bytesSync(fromSync('bytes'), options),
+                         new TextEncoder().encode('bytes'));
+  assert.strictEqual(textSync(fromSync('text'), {
+    encoding: { toString: () => 'utf-8' },
+  }), 'text');
+}
+
+async function testWriterConversion() {
+  const { writer, readable } = push();
+
+  await writer.write(42, null);
+  assert.strictEqual(writer.writevSync(new Set([
+    null,
+    true,
+    { toString: () => 'object' },
+  ])), true);
+
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.writev('not a sequence object'),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+  assert.throws(
+    () => writer.write('invalid options', 1),
+    { code: 'ERR_INVALID_ARG_TYPE' },
+  );
+
+  writer.endSync();
+  assert.strictEqual(await text(readable), '42nulltrueobject');
+}
+
+async function testOtherWriterConversions() {
+  const output = [];
+  const writable = new Writable({
+    write(chunk, encoding, callback) {
+      output.push(chunk.toString());
+      callback();
+    },
+  });
+  const classicWriter = fromWritable(writable);
+  await classicWriter.write(42, null);
+  await classicWriter.writev(new Set([false, '!']));
+  await classicWriter.end(null);
+  assert.strictEqual(output.join(''), '42false!');
+
+  const result = broadcast();
+  const source = result.broadcast.push();
+  await result.writer.write(42, null);
+  await result.writer.writev(new Set([true]));
+  result.writer.endSync();
+  assert.strictEqual(await text(source), '42true');
+
+  let signalReads = 0;
+  const fromResult = Broadcast.from(from(''), {
+    get signal() {
+      signalReads++;
+      return undefined;
+    },
+  });
+  assert.strictEqual(signalReads, 1);
+  fromResult.broadcast.cancel();
+}
+
+Promise.all([
+  testDictionaryAndIntegerConversion(),
+  testUnknownDictionaryMembers(),
+  testWriterConversion(),
+  testOtherWriterConversions(),
+]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-writable-from.js b/test/parallel/test-stream-iter-writable-from.js
index 46cfb627cb4a..5cf7371caa5a 100644
--- a/test/parallel/test-stream-iter-writable-from.js
+++ b/test/parallel/test-stream-iter-writable-from.js
@@ -6,6 +6,7 @@
 
 const common = require('../common');
 const assert = require('assert');
+const { setImmediate, setTimeout } = require('timers/promises');
 const {
   push,
   text,
@@ -28,6 +29,79 @@ async function testBasicWrite() {
   assert.strictEqual(result, 'hello world');
 }
 
+async function testFalsyWriterRejectionBecomesClassicError() {
+  const nonCoercible = { __proto__: null };
+  const trapped = new Proxy({}, {
+    getPrototypeOf() { throw new Error('unexpected coercion'); },
+  });
+  for (const [reason, code] of [
+    [null, 'ERR_FALSY_VALUE_REJECTION'],
+    [nonCoercible, 'ERR_OPERATION_FAILED'],
+    [trapped, 'ERR_OPERATION_FAILED'],
+  ]) {
+    let failed = false;
+    let failReason;
+    const writable = toWritable({
+      __proto__: null,
+      write() { return Promise.reject(reason); },
+      fail(error) { failed = true; failReason = error; },
+    });
+    writable.on('error', common.mustCall());
+
+    const { promise, resolve, reject } = Promise.withResolvers();
+    writable.write('data', common.mustCall((error) => {
+      for (const symbol of Object.getOwnPropertySymbols(error)) {
+        delete error[symbol];
+      }
+      if (error) reject(error);
+      else resolve();
+    }));
+
+    await assert.rejects(promise, (error) => {
+      return error.code === code && error.reason === reason;
+    });
+    await setImmediate();
+    assert.strictEqual(failed, true);
+    assert.strictEqual(failReason, reason);
+  }
+}
+
+async function testClassicWrapperReusePreservesErrorIdentity() {
+  const first = toWritable({
+    __proto__: null,
+    write() { return Promise.reject(null); },
+    fail() {},
+  });
+  first.on('error', common.mustCall());
+  let wrapper;
+  {
+    const { promise, resolve } = Promise.withResolvers();
+    first.write('first', common.mustCall((error) => {
+      wrapper = error;
+      resolve();
+    }));
+    await promise;
+  }
+
+  let failReason;
+  const second = toWritable({
+    __proto__: null,
+    write() { return Promise.reject(wrapper); },
+    fail(reason) { failReason = reason; },
+  });
+  second.on('error', common.mustCall());
+  {
+    const { promise, resolve } = Promise.withResolvers();
+    second.write('second', common.mustCall((error) => {
+      assert.strictEqual(error, wrapper);
+      resolve();
+    }));
+    await promise;
+  }
+  await setImmediate();
+  assert.strictEqual(failReason, wrapper);
+}
+
 // =============================================================================
 // _write delegates to writer.write()
 // =============================================================================
@@ -46,12 +120,12 @@ async function testWriteDelegatesToWriter() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve, reject) => {
-    writable.write('hello', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('hello', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await promise;
 
   assert.strictEqual(Buffer.concat(chunks).toString(), 'hello');
 }
@@ -86,7 +160,9 @@ async function testWritevDelegation() {
   writable.write('c');
   writable.uncork();
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   // Writev should have been called with the batched chunks
   assert.ok(batches.length > 0, 'writev should have been called');
@@ -129,9 +205,9 @@ async function testWriteSyncFirst() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => {
-    writable.write('test', resolve);
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('test', resolve);
+  await promise;
 
   assert.ok(syncCalled, 'writeSync should have been called');
   assert.ok(!asyncCalled, 'write should not have been called');
@@ -160,9 +236,9 @@ async function testWriteSyncFallback() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => {
-    writable.write('test', resolve);
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('test', resolve);
+  await promise;
 
   assert.ok(syncCalled, 'writeSync should have been called');
   assert.ok(asyncCalled, 'write should have been called as fallback');
@@ -191,7 +267,9 @@ async function testEndSyncFirst() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   assert.ok(endSyncCalled, 'endSync should have been called');
   assert.ok(!endAsyncCalled, 'end should not have been called');
@@ -220,7 +298,9 @@ async function testEndSyncFallback() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   assert.ok(endSyncCalled, 'endSync should have been called');
   assert.ok(endAsyncCalled, 'end should have been called as fallback');
@@ -243,7 +323,9 @@ async function testFinalDelegatesToEnd() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => writable.end(resolve));
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(resolve);
+  await promise;
 
   assert.ok(endCalled, 'writer.end() should have been called');
 }
@@ -261,13 +343,13 @@ async function testDestroyDelegatesToFail() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});  // Prevent unhandled
+  writable.on('error', common.mustCall());
 
   const testErr = new Error('destroy test');
   writable.destroy(testErr);
 
   // Give a tick for destroy to propagate
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
 
   assert.strictEqual(failReason, testErr);
 }
@@ -286,13 +368,14 @@ async function testWriteErrorPropagation() {
   };
 
   const writable = toWritable(writer);
-
-  await assert.rejects(new Promise((resolve, reject) => {
-    writable.write('data', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  }), { message: 'write failed' });
+  writable.on('error', common.mustCall());
+
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('data', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await assert.rejects(promise, { message: 'write failed' });
 }
 
 // =============================================================================
@@ -343,12 +426,12 @@ async function testPushWriterBlockBackpressureNoDuplicate() {
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   const writable = toWritable(writer);
 
-  await new Promise((resolve, reject) => {
-    writable.write('a', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('a', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await promise;
 
   writable.write('b');
   writable.end();
@@ -365,12 +448,12 @@ async function testPushWriterBlockBackpressureWritevNoDuplicate() {
   const { writer, readable } = push({ budget: 16384, backpressure: 'unbounded' });
   const writable = toWritable(writer);
 
-  await new Promise((resolve, reject) => {
-    writable.write('a', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('a', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await promise;
 
   writable.cork();
   writable.write('b');
@@ -423,16 +506,14 @@ async function testSyncCallbackDeferred() {
 
   const writable = toWritable(writer);
 
-  const p = new Promise((resolve) => {
-    writable.write('test', () => {
-      callbackTick = true;
-      resolve();
-    });
-    // Callback should NOT have fired synchronously
-    assert.strictEqual(callbackTick, false);
-  });
-
-  await p;
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('test', common.mustCall(() => {
+    callbackTick = true;
+    resolve();
+  }));
+  // Callback should NOT have fired synchronously
+  assert.strictEqual(callbackTick, false);
+  await promise;
   assert.strictEqual(callbackTick, true);
 }
 
@@ -452,10 +533,10 @@ async function testMinimalWriter() {
 
   const writable = toWritable(writer);
 
-  await new Promise((resolve) => {
-    writable.write('minimal');
-    writable.end(resolve);
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.write('minimal');
+  writable.end(resolve);
+  await promise;
 
   assert.strictEqual(Buffer.concat(chunks).toString(), 'minimal');
 }
@@ -474,7 +555,7 @@ async function testDestroyWithoutError() {
   const writable = toWritable(writer);
   writable.destroy();
 
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
 
   assert.ok(!failCalled, 'fail should not be called on clean destroy');
 }
@@ -491,12 +572,12 @@ async function testDestroyWithError() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});
+  writable.on('error', common.mustCall());
 
   const err = new Error('test');
   writable.destroy(err);
 
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
 
   assert.strictEqual(failReason, err);
 }
@@ -512,12 +593,12 @@ async function testDestroyWithoutFail() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});
+  writable.on('error', common.mustCall());
 
   // Should not throw even though writer has no fail()
   writable.destroy(new Error('test'));
 
-  await new Promise((resolve) => setTimeout(resolve, 10));
+  await setTimeout(10);
   assert.ok(writable.destroyed);
 }
 
@@ -553,13 +634,14 @@ async function testWriteSyncThrowsPropagation() {
   };
 
   const writable = toWritable(writer);
-
-  await assert.rejects(new Promise((resolve, reject) => {
-    writable.write('test', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  }), { message: 'sync broken' });
+  writable.on('error', common.mustCall());
+
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('test', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+  await assert.rejects(promise, { message: 'sync broken' });
 }
 
 // =============================================================================
@@ -575,13 +657,15 @@ async function testWriteThrowsSyncPropagation() {
   };
 
   const writable = toWritable(writer);
+  writable.on('error', common.mustCall());
 
-  await assert.rejects(new Promise((resolve, reject) => {
-    writable.write('data', (err) => {
-      if (err) reject(err);
-      else resolve();
-    });
-  }), { message: 'sync throw from write' });
+  const { promise, resolve, reject } = Promise.withResolvers();
+  writable.write('data', common.mustCall((err) => {
+    if (err) reject(err);
+    else resolve();
+  }));
+
+  await assert.rejects(promise, { message: 'sync throw from write' });
 }
 
 // =============================================================================
@@ -598,15 +682,16 @@ async function testEndThrowsSyncPropagation() {
   };
 
   const writable = toWritable(writer);
-  writable.on('error', () => {});
+  writable.on('error', common.mustCall());
 
-  await new Promise((resolve) => {
-    writable.end(common.mustCall((err) => {
-      assert.ok(err);
-      assert.strictEqual(err.message, 'sync throw from end');
-      resolve();
-    }));
-  });
+  const { promise, resolve } = Promise.withResolvers();
+  writable.end(common.mustCall((err) => {
+    assert.ok(err);
+    assert.strictEqual(err.message, 'sync throw from end');
+    resolve();
+  }));
+
+  await promise;
 }
 
 // =============================================================================
@@ -619,6 +704,8 @@ testHighWaterMarkIsMaxSafeInt();
 
 Promise.all([
   testBasicWrite(),
+  testFalsyWriterRejectionBecomesClassicError(),
+  testClassicWrapperReusePreservesErrorIdentity(),
   testWriteDelegatesToWriter(),
   testWritevDelegation(),
   testWriteSyncFirst(),
diff --git a/test/parallel/test-stream-iter-writable-interop.js b/test/parallel/test-stream-iter-writable-interop.js
index 110e8e0a7d2e..9940ffc34c93 100644
--- a/test/parallel/test-stream-iter-writable-interop.js
+++ b/test/parallel/test-stream-iter-writable-interop.js
@@ -7,6 +7,7 @@
 const common = require('../common');
 const assert = require('assert');
 const { Writable } = require('stream');
+const { setImmediate } = require('timers/promises');
 const {
   from,
   fromWritable,
@@ -356,7 +357,7 @@ async function testEndReturnsByteCount() {
 
 async function testFail() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
-  writable.on('error', () => {});  // Prevent unhandled error
+  writable.on('error', common.mustCall());
   const writer = fromWritable(writable);
 
   writer.fail(new Error('test fail'));
@@ -496,6 +497,7 @@ async function testPipeToWithTransform() {
 
 async function testDispose() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
+  writable.on('error', common.mustCall());
   const writer = fromWritable(writable);
 
   writer[Symbol.dispose]();
@@ -504,6 +506,7 @@ async function testDispose() {
 
 async function testAsyncDispose() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
+  writable.on('error', common.mustCall());
   const writer = fromWritable(writable);
 
   await writer[Symbol.asyncDispose]();
@@ -511,25 +514,18 @@ async function testAsyncDispose() {
 }
 
 // =============================================================================
-// write() validates chunk type
+// write() rejects values that cannot be converted to USVString
 // =============================================================================
 
-async function testWriteInvalidChunkType() {
+function testWriteInvalidChunkType() {
   const writable = new Writable({ write(chunk, enc, cb) { cb(); } });
   const writer = fromWritable(writable);
 
-  await assert.rejects(
-    writer.write(42),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write(null),
-    { code: 'ERR_INVALID_ARG_TYPE' },
-  );
-  await assert.rejects(
-    writer.write({}),
+  assert.throws(
+    () => writer.write(Symbol('invalid')),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
+  writable.destroy();
 }
 
 // =============================================================================
@@ -559,7 +555,7 @@ function testWritevInvalidChunkUncorks() {
   const writer = fromWritable(writable);
 
   assert.throws(
-    () => writer.writev([new Uint8Array([1]), 42]),
+    () => writer.writev([new Uint8Array([1]), Symbol('invalid')]),
     { code: 'ERR_INVALID_ARG_TYPE' },
   );
   assert.strictEqual(writable.writableCorked, 0);
@@ -588,7 +584,7 @@ async function testFailRejectsPendingWaiters() {
       // Never call cb -- stuck
     },
   });
-  writable.on('error', () => {});  // Prevent unhandled error
+  writable.on('error', common.mustCall());
 
   const writer = fromWritable(writable, { backpressure: 'unbounded' });
 
@@ -601,6 +597,58 @@ async function testFailRejectsPendingWaiters() {
   await assert.rejects(writePromise, { message: 'fail reason' });
 }
 
+async function testFailPreservesReason() {
+  let classicError;
+  const writable = new Writable({
+    highWaterMark: 1,
+    write() {},
+  });
+  writable.on('error', common.mustCall((error) => { classicError = error; }));
+  const writer = fromWritable(writable, { backpressure: 'unbounded' });
+  const pending = writer.write('blocked data');
+  const draining = ondrain(writer);
+
+  writer.fail(null);
+
+  await assert.rejects(pending, (reason) => reason === null);
+  await assert.rejects(draining, (reason) => reason === null);
+  await assert.rejects(writer.write('more'), (reason) => reason === null);
+  await assert.rejects(writer.end(), (reason) => reason === null);
+  await setImmediate();
+  assert.strictEqual(classicError.code, 'ERR_FALSY_VALUE_REJECTION');
+  assert.strictEqual(classicError.reason, null);
+}
+
+async function testEndThrowPreservesReason() {
+  const reason = undefined;
+  const writable = new Writable({
+    write(chunk, encoding, callback) { callback(); },
+  });
+  writable.on('error', common.mustCall());
+  writable.end = () => { throw reason; };
+  const writer = fromWritable(writable);
+
+  await assert.rejects(writer.end(), (error) => error === reason);
+  await assert.rejects(writer.write('more'), (error) => error === reason);
+}
+
+async function testFailWhileClosingPreservesReason() {
+  let finish;
+  const writable = new Writable({
+    write(chunk, encoding, callback) { callback(); },
+    final(callback) { finish = callback; },
+  });
+  writable.on('error', common.mustCall());
+  const writer = fromWritable(writable);
+  const ending = writer.end();
+
+  writer.fail(false);
+
+  await assert.rejects(ending, (reason) => reason === false);
+  await assert.rejects(writer.write('more'), (reason) => reason === false);
+  finish();
+}
+
 // =============================================================================
 // dispose rejects pending block waiters
 // =============================================================================
@@ -612,6 +660,7 @@ async function testDisposeRejectsPendingWaiters() {
       // Never call cb -- stuck
     },
   });
+  writable.on('error', common.mustCall());
 
   const writer = fromWritable(writable, { backpressure: 'unbounded' });
 
@@ -620,7 +669,7 @@ async function testDisposeRejectsPendingWaiters() {
 
   writer[Symbol.dispose]();
 
-  await assert.rejects(writePromise, { name: 'AbortError' });
+  await assert.rejects(writePromise, (reason) => reason === undefined);
 }
 
 // =============================================================================
@@ -679,5 +728,8 @@ Promise.all([
   testAsyncDispose(),
   testWriteInvalidChunkType(),
   testFailRejectsPendingWaiters(),
+  testFailPreservesReason(),
+  testFailWhileClosingPreservesReason(),
+  testEndThrowPreservesReason(),
   testDisposeRejectsPendingWaiters(),
 ]).then(common.mustCall());
diff --git a/test/parallel/test-stream-iter-writer-reentrancy.js b/test/parallel/test-stream-iter-writer-reentrancy.js
new file mode 100644
index 000000000000..119bda269239
--- /dev/null
+++ b/test/parallel/test-stream-iter-writer-reentrancy.js
@@ -0,0 +1,65 @@
+// Flags: --experimental-stream-iter
+'use strict';
+
+const common = require('../common');
+const assert = require('assert');
+const { broadcast, push } = require('stream/iter');
+
+const factories = [
+  () => push({ budget: 16384 }),
+  () => {
+    const { writer, broadcast: bc } = broadcast({ budget: 16384 });
+    return { __proto__: null, writer, readable: bc.push() };
+  },
+];
+
+async function testWritevReentrancy() {
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        assert.strictEqual(
+          writer.writeSync(new Uint8Array(16384)), true);
+        return Uint8Array.of(42);
+      }),
+    });
+
+    let resolved = false;
+    const write = writer.writev(chunks).then(common.mustCall(() => {
+      resolved = true;
+    }));
+    await new Promise(setImmediate);
+    assert.strictEqual(resolved, false);
+
+    const iterator = readable[Symbol.asyncIterator]();
+    assert.strictEqual((await iterator.next()).value[0].byteLength, 16384);
+    await write;
+    assert.strictEqual((await iterator.next()).value[0][0], 42);
+    writer.endSync();
+    assert.strictEqual((await iterator.next()).done, true);
+  }
+
+  for (const factory of factories) {
+    const { writer, readable } = factory();
+    const chunks = [];
+    Object.defineProperty(chunks, 0, {
+      __proto__: null,
+      enumerable: true,
+      get: common.mustCall(() => {
+        writer.endSync();
+        return Uint8Array.of(42);
+      }),
+    });
+
+    await assert.rejects(writer.writev(chunks), {
+      code: 'ERR_INVALID_STATE',
+    });
+    assert.strictEqual(
+      (await readable[Symbol.asyncIterator]().next()).done, true);
+  }
+}
+
+testWritevReentrancy().then(common.mustCall());
diff --git a/test/parallel/test-stream-readable-unobserved-eof-readable.js b/test/parallel/test-stream-readable-unobserved-eof-readable.js
new file mode 100644
index 000000000000..5eb6d1b2b631
--- /dev/null
+++ b/test/parallel/test-stream-readable-unobserved-eof-readable.js
@@ -0,0 +1,76 @@
+'use strict';
+const common = require('../common');
+const { Readable } = require('stream');
+const assert = require('assert');
+
+// When a stream reaches its end while nobody is observing it, the
+// end-of-stream 'readable' emission is not scheduled. It is emitted
+// later if a 'readable' listener is attached, and read()/resume()
+// still reach 'end' on their own.
+
+{
+  // Listener attached synchronously after push(null) gets 'readable'
+  // and then 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  let readableEmitted = false;
+  r.on('readable', common.mustCall(() => {
+    readableEmitted = true;
+    assert.strictEqual(r.read(), null);
+  }));
+  r.on('end', common.mustCall(() => {
+    assert.strictEqual(readableEmitted, true);
+  }));
+}
+
+{
+  // Listener attached one macrotask after the unobserved end still gets
+  // the owed 'readable' before 'end'.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    let readableEmitted = false;
+    r.on('readable', common.mustCall(() => {
+      readableEmitted = true;
+      assert.strictEqual(r.read(), null);
+    }));
+    r.on('end', common.mustCall(() => {
+      assert.strictEqual(readableEmitted, true);
+    }));
+  }));
+}
+
+{
+  // A stream that ends unobserved still emits 'end' when resumed later.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.resume();
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // read() after an unobserved end consumes the owed notification: a
+  // 'readable' listener attached afterwards does not receive it, but
+  // 'end' is still emitted.
+  const r = new Readable({ read() {} });
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    assert.strictEqual(r.read(), null);
+    r.on('end', common.mustCall());
+  }));
+}
+
+{
+  // A 'data' listener attached after an unobserved end still gets 'end'.
+  const r = new Readable({ read() {} });
+  r.push('x');
+  r.push(null);
+  setImmediate(common.mustCall(() => {
+    r.on('data', common.mustCall((chunk) => {
+      assert.strictEqual(chunk.toString(), 'x');
+    }));
+    r.on('end', common.mustCall());
+  }));
+}
diff --git a/test/parallel/test-stream-some-find-every.mjs b/test/parallel/test-stream-some-find-every.mjs
index 0617102bc471..c18e418ddce5 100644
--- a/test/parallel/test-stream-some-find-every.mjs
+++ b/test/parallel/test-stream-some-find-every.mjs
@@ -1,6 +1,6 @@
 import * as common from '../common/index.mjs';
 import { setTimeout } from 'timers/promises';
-import { Readable } from 'stream';
+import { PassThrough, Readable } from 'stream';
 import assert from 'assert';
 
 
@@ -77,6 +77,36 @@ function oneTo5Async() {
     await findStream.find(common.mustCall((x) => x > 1, 2));
     await checkDestroyed(findStream);
 
+    const openSomeStream = new PassThrough({ objectMode: true });
+    openSomeStream.write(1);
+    openSomeStream.write(2);
+    openSomeStream.write(3);
+    assert.strictEqual(
+      await openSomeStream.some(common.mustCall((x) => x > 2, 3)),
+      true,
+    );
+    await checkDestroyed(openSomeStream);
+
+    const openEveryStream = new PassThrough({ objectMode: true });
+    openEveryStream.write(1);
+    openEveryStream.write(2);
+    openEveryStream.write(3);
+    assert.strictEqual(
+      await openEveryStream.every(common.mustCall((x) => x < 3, 3)),
+      false,
+    );
+    await checkDestroyed(openEveryStream);
+
+    const openFindStream = new PassThrough({ objectMode: true });
+    openFindStream.write(1);
+    openFindStream.write(2);
+    openFindStream.write(3);
+    assert.strictEqual(
+      await openFindStream.find(common.mustCall((x) => x > 1, 2)),
+      2,
+    );
+    await checkDestroyed(openFindStream);
+
     // When short circuit isn't possible the whole stream is iterated
     await oneTo5().some(common.mustCall(() => false, 5));
     await oneTo5().every(common.mustCall(() => true, 5));
diff --git a/test/parallel/test-tick-processor-arguments.js b/test/parallel/test-tick-processor-arguments.js
index 406b13b676d7..a2d99192f979 100644
--- a/test/parallel/test-tick-processor-arguments.js
+++ b/test/parallel/test-tick-processor-arguments.js
@@ -19,6 +19,17 @@ const files = fs.readdirSync(tmpdir.path);
 const logfile = files.find((name) => /\.log$/.test(name));
 assert(logfile);
 
+// Drop the shared-library entries: the tick processor resolves the C++
+// symbols of every listed library through nm (and c++filt on macOS), which is
+// slow on builds that link many shared libraries and depends on the host
+// toolchain. This test only checks that CLI arguments reach the tick
+// processor; C++ symbol resolution is covered by test/tick-processor.
+const logpath = tmpdir.resolve(logfile);
+fs.writeFileSync(logpath, fs.readFileSync(logpath, 'utf8')
+  .split('\n')
+  .filter((line) => !line.startsWith('shared-library,'))
+  .join('\n'));
+
 // Make sure that the --preprocess argument is passed through correctly,
 // as an example flag listed in deps/v8/tools/tickprocessor.js.
 // Any of the other flags there should work for this test too, if --preprocess
diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
index c319e766ce8a..1b80571e70e6 100644
--- a/test/parallel/test-tls-alert-handling.js
+++ b/test/parallel/test-tls-alert-handling.js
@@ -6,7 +6,8 @@ if (!common.hasCrypto) {
 }
 
 const {
-  hasOpenSSL3,
+  hasOpenSSL,
+  isBoringSSL,
 } = require('../common/crypto');
 
 const assert = require('assert');
@@ -38,7 +39,7 @@ const errorHandler = common.mustCall((err) => {
   assert.match(err.code,
                /ERR_SSL_(WRONG_VERSION_NUMBER|PACKET_LENGTH_TOO_LONG|BAD_RECORD_TYPE)/);
   assert.strictEqual(err.library, 'SSL routines');
-  if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+  if (!hasOpenSSL(3) && !isBoringSSL)
     assert.strictEqual(err.function, 'ssl3_get_record');
   assert.match(err.reason,
                /wrong[\s_]version[\s_]number|packet[\s_]length[\s_]too[\s_]long|bad[\s_]record[\s_]type/i);
@@ -99,7 +100,7 @@ function sendBADTLSRecord() {
     assert.match(err.code,
                  /ERR_SSL_(TLSV1_ALERT_PROTOCOL_VERSION|TLSV1_ALERT_RECORD_OVERFLOW|(SSL\/)?TLS_ALERT_UNEXPECTED_MESSAGE)/);
     assert.strictEqual(err.library, 'SSL routines');
-    if (!hasOpenSSL3 && !process.features.openssl_is_boringssl)
+    if (!hasOpenSSL(3) && !isBoringSSL)
       assert.strictEqual(err.function, 'ssl3_read_bytes');
     assert.match(err.reason,
                  /tlsv1[\s_]alert[\s_]protocol[\s_]version|tlsv1[\s_]alert[\s_]record[\s_]overflow|(ssl\/)?tls[\s_]alert[\s_]unexpected[\s_]message/i);
diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js
index f20bf42a2dcd..5c229d7e05cd 100644
--- a/test/parallel/test-tls-alert.js
+++ b/test/parallel/test-tls-alert.js
@@ -29,6 +29,7 @@ const {
   hasOpenSSL,
   hasFIPS,
   opensslCli,
+  isBoringSSL,
 } = require('../common/crypto');
 
 if (!opensslCli) {
@@ -56,7 +57,7 @@ if (hasFIPS(3)) {
 }
 
 const server = tls.Server(serverOptions, null).listen(0, common.mustCall(() => {
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     let gotClientError = false;
     let gotServerError = false;
     function maybeClose() {
diff --git a/test/parallel/test-tls-cert-ext-encoding.js b/test/parallel/test-tls-cert-ext-encoding.js
index 154e0cdcf022..973e9fad32ee 100644
--- a/test/parallel/test-tls-cert-ext-encoding.js
+++ b/test/parallel/test-tls-cert-ext-encoding.js
@@ -3,9 +3,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (hasOpenSSL3)
+if (hasOpenSSL(3))
   // TODO(danbev) This test fails with the following error:
   // error:0D00008F:asn1 encoding routines::no matching choice type
   //
diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js
index 517054c6e290..da06156e2e07 100644
--- a/test/parallel/test-tls-client-auth.js
+++ b/test/parallel/test-tls-client-auth.js
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const {
   assert, connect, keys, tls
@@ -111,7 +111,7 @@ if (tls.DEFAULT_MAX_VERSION === 'TLSv1.3') connect({
   // and sends a fatal Alert to the client that the client discovers there has
   // been a fatal error.
   pair.client.conn.once('error', common.mustCall((err) => {
-    const expectedErr = process.features.openssl_is_boringssl ?
+    const expectedErr = isBoringSSL ?
       'ERR_SSL_TLSV1_ALERT_CERTIFICATE_REQUIRED' :
       'ERR_SSL_TLSV13_ALERT_CERTIFICATE_REQUIRED';
     assert.strictEqual(err.code, expectedErr);
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index 638df3ff0141..f1c179db8fae 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -3,13 +3,18 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const {
+  isBoringSSL,
+  hasOpenSSL,
+  hasFIPS,
+} = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testEphemeralKeyInfo();
   return;
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index 8f3b2eafbb8a..f08be448dd19 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -13,7 +13,7 @@ const secLevel = require('internal/crypto/util').getOpenSSLSecLevel();
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const fips3 = hasFIPS(3);
 const fips4 = hasFIPS(4);
 
@@ -88,7 +88,7 @@ function testDHE3072() {
   test(3072, false, null);
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   if (fips3 && !fips4) {
     // The FIPS provider rejects explicit DH parameters without a validated
     // subgroup, while OpenSSL's built-in FFDHE group remains available.
@@ -129,7 +129,7 @@ for (const minDHSize of [true, false, null, undefined, {}, [], '', '1']) {
   });
 }
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   process.on('exit', function() {
     assert.strictEqual(nsuccess, 1);
     assert.strictEqual(nerror, 1);
diff --git a/test/parallel/test-tls-client-reject.js b/test/parallel/test-tls-client-reject.js
index cff0aabc89a7..90e3127ba471 100644
--- a/test/parallel/test-tls-client-reject.js
+++ b/test/parallel/test-tls-client-reject.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -31,7 +33,7 @@ const fixtures = require('../common/fixtures');
 const options = {
   key: fixtures.readKey('rsa_private.pem'),
   cert: fixtures.readKey('rsa_cert.crt'),
-  ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+  ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
 };
 
 const server = tls.createServer(options, function(socket) {
@@ -48,7 +50,7 @@ function unauthorized() {
     port: server.address().port,
     servername: 'localhost',
     rejectUnauthorized: false,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(function() {
     let _data;
     assert(!socket.authorized);
@@ -70,7 +72,7 @@ function rejectUnauthorized() {
   console.log('reject unauthorized');
   const socket = tls.connect(server.address().port, {
     servername: 'localhost',
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustNotCall());
   socket.on('data', common.mustNotCall());
   socket.on('error', common.mustCall(function(err) {
@@ -84,7 +86,7 @@ function rejectUnauthorizedUndefined() {
   const socket = tls.connect(server.address().port, {
     servername: 'localhost',
     rejectUnauthorized: undefined,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustNotCall());
   socket.on('data', common.mustNotCall());
   socket.on('error', common.mustCall(function(err) {
@@ -98,7 +100,7 @@ function authorized() {
   const socket = tls.connect(server.address().port, {
     ca: [fixtures.readKey('rsa_cert.crt')],
     servername: 'localhost',
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(function() {
     console.log('... authorized');
     assert(socket.authorized);
diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
index 80c4753d065e..33e74af13eda 100644
--- a/test/parallel/test-tls-client-renegotiation-13.js
+++ b/test/parallel/test-tls-client-renegotiation-13.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const fixtures = require('../common/fixtures');
 
@@ -32,7 +32,7 @@ connect({
   assert.strictEqual(client.getProtocol(), 'TLSv1.3');
 
   const ok = client.renegotiate({}, common.mustCall((err) => {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.throws(() => { throw err; }, {
         message: 'TLS session renegotiation is unsupported by this TLS ' +
                  'implementation',
@@ -40,7 +40,7 @@ connect({
       });
     } else {
       assert.throws(() => { throw err; }, {
-        message: hasOpenSSL3 ?
+        message: hasOpenSSL(3) ?
           'error:0A00010A:SSL routines::wrong ssl version' :
           'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
         code: 'ERR_SSL_WRONG_SSL_VERSION',
diff --git a/test/parallel/test-tls-client-renegotiation-limit.js b/test/parallel/test-tls-client-renegotiation-limit.js
index 9b7f62865b33..b712e6f7d9eb 100644
--- a/test/parallel/test-tls-client-renegotiation-limit.js
+++ b/test/parallel/test-tls-client-renegotiation-limit.js
@@ -25,13 +25,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli } = require('../common/crypto');
+const { opensslCli, isBoringSSL } = require('../common/crypto');
 
 if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 65f3dc6867c4..6f54bbd97667 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -26,7 +26,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').assertFiniteFieldDheUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-dhparam-auto-boringssl.js b/test/parallel/test-tls-dhparam-auto-boringssl.js
index 54f2190d1a94..d2334c7feb0e 100644
--- a/test/parallel/test-tls-dhparam-auto-boringssl.js
+++ b/test/parallel/test-tls-dhparam-auto-boringssl.js
@@ -1,9 +1,11 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!process.features.openssl_is_boringssl)
+if (!isBoringSSL)
   common.skip('only applies to BoringSSL builds');
 
 const assert = require('assert');
diff --git a/test/parallel/test-tls-disable-renegotiation.js b/test/parallel/test-tls-disable-renegotiation.js
index 84a6ead4a544..1934becc2a62 100644
--- a/test/parallel/test-tls-disable-renegotiation.js
+++ b/test/parallel/test-tls-disable-renegotiation.js
@@ -1,5 +1,7 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
 
@@ -8,7 +10,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testRenegotiationUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js
index b01051d5b457..cc74130a2e39 100644
--- a/test/parallel/test-tls-ecdh-multiple.js
+++ b/test/parallel/test-tls-ecdh-multiple.js
@@ -12,6 +12,7 @@ const {
   opensslCli,
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../common/crypto');
 const crypto = require('crypto');
 
@@ -31,7 +32,7 @@ function loadPEM(n) {
 
 // The FIPS provider and OpenSSL 4.0 disable support for deprecated elliptic
 // curves from RFC 8422 (including secp256k1) by default.
-const ecdhCurve = process.features.openssl_is_boringssl ||
+const ecdhCurve = isBoringSSL ||
   hasOpenSSL(4, 0) || hasFIPS(3) ?
   'prime256v1:secp521r1' :
   'secp256k1:prime256v1:secp521r1';
@@ -82,7 +83,7 @@ const server = tls.createServer(options, (conn) => {
   }
 
   // Deprecated RFC 8422 curves are disabled by default in OpenSSL 4.0.
-  if (process.features.openssl_is_boringssl || hasOpenSSL(4, 0)) {
+  if (isBoringSSL || hasOpenSSL(4, 0)) {
     unsupportedCurves.push('secp256k1');
   }
 
diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js
index 6ecdfbeecbe3..7d8bf61239ac 100644
--- a/test/parallel/test-tls-empty-sni-context.js
+++ b/test/parallel/test-tls-empty-sni-context.js
@@ -3,7 +3,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -26,7 +26,7 @@ const server = tls.createServer(options, (c) => {
   }, common.mustNotCall());
 
   c.on('error', common.mustCall((err) => {
-    const expectedErr = process.features.openssl_is_boringssl ?
+    const expectedErr = isBoringSSL ?
       'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR' : hasOpenSSL(4, 0) ?
         'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
           'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
diff --git a/test/parallel/test-tls-finished.js b/test/parallel/test-tls-finished.js
index b23b4567d27e..5a33257cebc1 100644
--- a/test/parallel/test-tls-finished.js
+++ b/test/parallel/test-tls-finished.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -21,7 +23,7 @@ const pem = (n) => fixtures.readKey(`${n}.pem`);
 const server = tls.createServer({
   key: pem('agent1-key'),
   cert: pem('agent1-cert'),
-  ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+  ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
 }, common.mustCall((alice) => {
   msg.server = {
     alice: alice.getFinished(),
@@ -34,7 +36,7 @@ server.listen(0, common.mustCall(() => {
   const bob = tls.connect({
     port: server.address().port,
     rejectUnauthorized: false,
-    ...(process.features.openssl_is_boringssl ? { maxVersion: 'TLSv1.2' } : {}),
+    ...(isBoringSSL ? { maxVersion: 'TLSv1.2' } : {}),
   }, common.mustCall(() => {
     msg.client = {
       alice: bob.getPeerFinished(),
diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
index 2d4de5639afb..cb8f1ba826b5 100644
--- a/test/parallel/test-tls-getcipher.js
+++ b/test/parallel/test-tls-getcipher.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL: commonIsBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
@@ -36,7 +38,7 @@ const options = {
   honorCipherOrder: true
 };
 
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 let clients = 0;
 const expectedClients = isBoringSSL ? 1 : 2;
 const server = tls.createServer(options, common.mustCall(() => {
diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
index 2fe971444271..e3e0a1fa2418 100644
--- a/test/parallel/test-tls-getprotocol.js
+++ b/test/parallel/test-tls-getprotocol.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // This test ensures that `getProtocol` returns the right protocol
 // from a TLS connection
@@ -28,7 +28,7 @@ let clientConfigs = [
   },
 ];
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // Remove the TLSv1 and TLSv1.1 cases. BoringSSL does not negotiate those
   // legacy protocols in this configuration; keep TLSv1.2 to cover getProtocol()
   // on a successful BoringSSL TLS handshake.
@@ -42,7 +42,7 @@ const serverConfig = {
   cert: fixtures.readKey('agent2-cert.pem')
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   serverConfig.ciphers = fips3 ?
     'ECDHE-RSA-AES256-GCM-SHA384' : 'RSA@SECLEVEL=0';
 }
diff --git a/test/parallel/test-tls-honorcipherorder.js b/test/parallel/test-tls-honorcipherorder.js
index fbee483d83b9..fcaed53353a8 100644
--- a/test/parallel/test-tls-honorcipherorder.js
+++ b/test/parallel/test-tls-honorcipherorder.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const mustCall = common.mustCall;
 const tls = require('tls');
 const util = require('util');
@@ -17,7 +17,7 @@ const util = require('util');
 // default method is updated in the future
 const SSL_Method = 'TLSv1_2_method';
 const localhost = '127.0.0.1';
-const config = process.features.openssl_is_boringssl || hasFIPS(3) ? {
+const config = isBoringSSL || hasFIPS(3) ? {
   serverCiphers:
     'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256',
   clientPreferenceCiphers:
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index 797c7c171dc5..8f60ef0520c4 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -27,13 +27,13 @@ if (!common.hasCrypto) {
 }
 
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const tls = require('tls');
-const errorMessageRegex = process.features.openssl_is_boringssl ?
+const errorMessageRegex = isBoringSSL ?
   /^Error: error:0b000074:X\.509 certificate routines:OPENSSL_internal:KEY_VALUES_MISMATCH$/ :
-  hasOpenSSL3 ?
+  hasOpenSSL(3) ?
     /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
     /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
 
diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
index 5106217718db..77f9c0935025 100644
--- a/test/parallel/test-tls-legacy-pfx.js
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -4,9 +4,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
 }
 
diff --git a/test/parallel/test-tls-max-send-fragment.js b/test/parallel/test-tls-max-send-fragment.js
index 2e319fcdaeaf..d389cf50d3d7 100644
--- a/test/parallel/test-tls-max-send-fragment.js
+++ b/test/parallel/test-tls-max-send-fragment.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -64,7 +66,7 @@ const server = tls.createServer({
   // both out-of-range values and reports success, so assert that difference
   // explicitly instead of using a truthiness shortcut.
   const acceptsOutOfRangeFragmentSize =
-    process.features.openssl_is_boringssl;
+    isBoringSSL;
   assert.strictEqual(c.setMaxSendFragment(511),
                      acceptsOutOfRangeFragmentSize);
   assert.strictEqual(c.setMaxSendFragment(16385),
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index 83797238cf4b..932ad7f0f219 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -5,15 +5,17 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
-  require('../common/boringssl').testLegacyProtocolUnsupported();
-  return;
-}
-
 const {
+  isBoringSSL,
   hasOpenSSL,
   hasFIPS,
 } = require('../common/crypto');
+
+if (isBoringSSL) {
+  require('../common/boringssl').testLegacyProtocolUnsupported();
+  return;
+}
+
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
 
diff --git a/test/parallel/test-tls-multi-key.js b/test/parallel/test-tls-multi-key.js
index 239cb8aec725..cc52eb9e65d4 100644
--- a/test/parallel/test-tls-multi-key.js
+++ b/test/parallel/test-tls-multi-key.js
@@ -27,7 +27,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').assertMultiKeyUnsupported();
   return;
 }
@@ -35,7 +37,6 @@ if (process.features.openssl_is_boringssl) {
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
-const { hasFIPS } = require('../common/crypto');
 
 // Key is ordered as ec, rsa, cert is ordered as rsa, ec.
 test({
diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
index b5bbb6decc12..d8a533049b2e 100644
--- a/test/parallel/test-tls-multi-pfx.js
+++ b/test/parallel/test-tls-multi-pfx.js
@@ -3,14 +3,15 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasFIPS } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testMultiPfxSelectionDifference();
   return;
 }
 
 const assert = require('assert');
 const tls = require('tls');
-const { hasFIPS } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const fips3 = hasFIPS(3);
 const fips4 = hasFIPS(4);
diff --git a/test/parallel/test-tls-no-cert-required.js b/test/parallel/test-tls-no-cert-required.js
index 499ab2dfd14e..36da97526b6b 100644
--- a/test/parallel/test-tls-no-cert-required.js
+++ b/test/parallel/test-tls-no-cert-required.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -28,7 +30,7 @@ const assert = require('assert');
 const tls = require('tls');
 
 // Omitting the cert or pfx option to tls.createServer() should not throw.
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // AECDH-NULL-SHA is a no-authentication/no-encryption cipher and hence
   // does not need a certificate. BoringSSL does not provide that anonymous
   // cipher suite, so only this cipher-specific no-cert case is skipped.
diff --git a/test/parallel/test-tls-options-boolean-check.js b/test/parallel/test-tls-options-boolean-check.js
index f7dd7bb102f3..4366502aacb3 100644
--- a/test/parallel/test-tls-options-boolean-check.js
+++ b/test/parallel/test-tls-options-boolean-check.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -41,7 +43,7 @@ const certDataView = toDataView(certBuff);
 const caArrDataView = toDataView(caCert);
 
 function filterBoringSSLKeyCertArrayCases(options, setName) {
-  if (!process.features.openssl_is_boringssl)
+  if (!isBoringSSL)
     return options;
 
   // The array-valued cases exercise multi-identity key/cert handling.
diff --git a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
index 0ba55f9153b9..0045517b0224 100644
--- a/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
+++ b/test/parallel/test-tls-psk-alpn-callback-exception-handling.js
@@ -10,11 +10,12 @@
 // throw exceptions during validation.
 
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js
index c9c93d533501..8a0115a76125 100644
--- a/test/parallel/test-tls-psk-circuit.js
+++ b/test/parallel/test-tls-psk-circuit.js
@@ -5,12 +5,13 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL, hasOpenSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
 
-const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
index 692550fc1c19..29d164f019da 100644
--- a/test/parallel/test-tls-psk-server.js
+++ b/test/parallel/test-tls-psk-server.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
index cca22067a0fe..b013d9f02c7a 100644
--- a/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
+++ b/test/parallel/test-tls-reduced-SECLEVEL-in-cipher.js
@@ -1,10 +1,12 @@
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').assertOpenSSLSecurityLevelsUnsupported();
   return;
 }
diff --git a/test/parallel/test-tls-server-verify.js b/test/parallel/test-tls-server-verify.js
index 439e32131030..c7487f593eb7 100644
--- a/test/parallel/test-tls-server-verify.js
+++ b/test/parallel/test-tls-server-verify.js
@@ -26,7 +26,7 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-const { opensslCli } = require('../common/crypto');
+const { opensslCli, isBoringSSL } = require('../common/crypto');
 
 if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
@@ -125,7 +125,7 @@ let testCases =
      ] },
   ];
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   // Remove the delayed client-certificate verification case. It depends on TLS
   // renegotiation to request a client certificate after the initial handshake,
   // but BoringSSL does not support caller-initiated renegotiation.
diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js
index 0789879e1dce..54b7eeca2e9b 100644
--- a/test/parallel/test-tls-session-cache.js
+++ b/test/parallel/test-tls-session-cache.js
@@ -28,6 +28,7 @@ const {
   hasOpenSSL,
   hasFIPS,
   opensslCli,
+  isBoringSSL: commonIsBoringSSL,
 } = require('../common/crypto');
 
 if (!opensslCli) {
@@ -38,7 +39,7 @@ const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
 const { spawn } = require('child_process');
-const isBoringSSL = process.features.openssl_is_boringssl;
+const isBoringSSL = commonIsBoringSSL;
 
 doTest({ tickets: false }, function() {
   doTest({ tickets: true }, function() {
diff --git a/test/parallel/test-tls-set-ciphers-error.js b/test/parallel/test-tls-set-ciphers-error.js
index b79bd512ffe1..102186f9e399 100644
--- a/test/parallel/test-tls-set-ciphers-error.js
+++ b/test/parallel/test-tls-set-ciphers-error.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 {
   const options = {
@@ -21,7 +21,7 @@ const { hasOpenSSL } = require('../common/crypto');
   assert.throws(() => tls.createServer(options, common.mustNotCall()),
                 /no[_ ]cipher[_ ]match/i);
   options.ciphers = 'TLS_not_a_cipher';
-  if (process.features.openssl_is_boringssl) {
+  if (isBoringSSL) {
     tls.createServer(options).close();
   } else {
     assert.throws(() => tls.createServer(options, common.mustNotCall()),
diff --git a/test/parallel/test-tls-set-default-ca-certificates-recovery.js b/test/parallel/test-tls-set-default-ca-certificates-recovery.js
index ea6f98d5686e..d4154a2da62e 100644
--- a/test/parallel/test-tls-set-default-ca-certificates-recovery.js
+++ b/test/parallel/test-tls-set-default-ca-certificates-recovery.js
@@ -3,6 +3,7 @@
 // This tests error recovery and fallback behavior for tls.setDefaultCACertificates()
 
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto) common.skip('missing crypto');
 
 const assert = require('assert');
@@ -27,7 +28,7 @@ function testRecovery(expectedCerts) {
   {
     const invalidCert = '-----BEGIN CERTIFICATE-----\nvalid cert content\n-----END CERTIFICATE-----';
     assert.throws(() => tls.setDefaultCACertificates([fixtureCert, invalidCert]), {
-      code: process.features.openssl_is_boringssl ?
+      code: isBoringSSL ?
         'ERR_OSSL_PEM_ASN.1_ENCODING_ROUTINES' :
         'ERR_OSSL_PEM_ASN1_LIB',
     });
diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
index e1bf8b93f8a3..ca111e83ef2b 100644
--- a/test/parallel/test-tls-set-sigalgs.js
+++ b/test/parallel/test-tls-set-sigalgs.js
@@ -3,7 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 // Test sigalgs: option for TLS.
@@ -41,7 +41,7 @@ function test(csigalgs, ssigalgs, shared_sigalgs, cerr, serr) {
       assert(pair.client.conn);
       // BoringSSL's OpenSSL-compatible SSL_get_shared_sigalgs() API always
       // returns zero, so a successful handshake still reports an empty list.
-      const expectedSharedSigalgs = process.features.openssl_is_boringssl ?
+      const expectedSharedSigalgs = isBoringSSL ?
         [] :
         shared_sigalgs;
       assert.deepStrictEqual(
@@ -74,7 +74,7 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
 const handshakeErr = hasOpenSSL(4, 0) ?
   'ERR_SSL_TLS_ALERT_HANDSHAKE_FAILURE' : hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
-const noSharedSigalgsErr = process.features.openssl_is_boringssl ?
+const noSharedSigalgsErr = isBoringSSL ?
   'ERR_SSL_NO_COMMON_SIGNATURE_ALGORITHMS' :
   'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITHMS';
 test('RSA-PSS+SHA384', 'ECDSA+SHA256',
diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/parallel/test-tls-ticket-cluster.js
index f183b53f24c0..fa3c23c2a6e2 100644
--- a/test/parallel/test-tls-ticket-cluster.js
+++ b/test/parallel/test-tls-ticket-cluster.js
@@ -20,11 +20,13 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
 }
diff --git a/test/parallel/test-tls-ticket.js b/test/parallel/test-tls-ticket.js
index 8316f5e8da8d..b6aa7a6de9c3 100644
--- a/test/parallel/test-tls-ticket.js
+++ b/test/parallel/test-tls-ticket.js
@@ -20,7 +20,9 @@
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 'use strict';
+
 const common = require('../common');
+const { isBoringSSL } = require('../common/crypto');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
@@ -30,7 +32,7 @@ const net = require('net');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
 
-if (process.features.openssl_is_boringssl &&
+if (isBoringSSL &&
     tls.DEFAULT_MAX_VERSION !== 'TLSv1.2') {
   require('../common/boringssl').testTls13SessionTicketSemanticsDiffer();
   return;
diff --git a/test/parallel/test-tls-write-error.js b/test/parallel/test-tls-write-error.js
index f6ec7b9bd245..08b943aab713 100644
--- a/test/parallel/test-tls-write-error.js
+++ b/test/parallel/test-tls-write-error.js
@@ -7,7 +7,7 @@ const { TestTLSSocket, ccs } = require('../common/tls');
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const https = require('https');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 // Regression test for an use-after-free bug in the TLS implementation that
 // would occur when `SSL_write()` failed.
@@ -22,7 +22,7 @@ const opts = {
 };
 const rejectsClientHello = hasFIPS(3) && !hasFIPS(3, 5);
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   opts.ciphers = 'ALL@SECLEVEL=0';
 }
 
diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js
index 7a7b80fa4c10..4d1a8165277e 100644
--- a/test/parallel/test-trace-env.js
+++ b/test/parallel/test-trace-env.js
@@ -19,8 +19,8 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
     if (common.hasCrypto) {
       assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
 
-      const { hasOpenSSL3 } = require('../common/crypto');
-      if (hasOpenSSL3) {
+      const { hasOpenSSL } = require('../common/crypto');
+      if (hasOpenSSL(3)) {
         assert.match(output, /get "OPENSSL_CONF"/);
       }
     }
diff --git a/test/parallel/test-trace-events-fs-async.js b/test/parallel/test-trace-events-fs-async.js
index 9b8e21b3d560..2a658838b39e 100644
--- a/test/parallel/test-trace-events-fs-async.js
+++ b/test/parallel/test-trace-events-fs-async.js
@@ -47,8 +47,10 @@ function chown({ uid, gid }) {
 
 function close() {
   const fs = require('fs');
-  fs.writeFile('fs3.txt', '123', 'utf8', () => {
-    fs.unlinkSync('fs3.txt');
+  fs.open('fs3.txt', 'w', (err, fd) => {
+    fs.close(fd, () => {
+      fs.unlinkSync('fs3.txt');
+    });
   });
 }
 
@@ -173,7 +175,8 @@ function mktmp() {
 
 function open() {
   const fs = require('fs');
-  fs.writeFile('fs16.txt', '123', 'utf8', () => {
+  fs.open('fs16.txt', 'w', (err, fd) => {
+    fs.closeSync(fd);
     fs.unlinkSync('fs16.txt');
   });
 }
diff --git a/test/parallel/test-trace-events-get-category-enabled-buffer.js b/test/parallel/test-trace-events-get-category-enabled-buffer.js
index 79d2a1cf30da..929f1ae3f2a8 100644
--- a/test/parallel/test-trace-events-get-category-enabled-buffer.js
+++ b/test/parallel/test-trace-events-get-category-enabled-buffer.js
@@ -15,31 +15,30 @@ common.skipIfPerfettoEnabled();
 const { createTracing, getEnabledCategories } = require('trace_events');
 const assert = require('assert');
 
-const binding = require('internal/test/binding');
-const getCategoryEnabledBuffer = binding.internalBinding('trace_events').getCategoryEnabledBuffer;
+const { categoryEnabledChecker } = require('internal/trace_events');
 
 it('should track enabled/disabled categories', () => {
   const random = Math.random().toString().slice(2);
   const category = `node.${random}`;
 
-  const buffer = getCategoryEnabledBuffer(category);
+  const isEnabled = categoryEnabledChecker(category);
 
   const tracing = createTracing({
     categories: [category],
   });
 
-  assert.ok(buffer[0] === 0, `the buffer[0] should start with value 0, got: ${buffer[0]}`);
+  assert.strictEqual(isEnabled(), false);
 
   tracing.enable();
 
   let currentCategories = getEnabledCategories();
 
   assert.ok(currentCategories.includes(category), `the getEnabledCategories should include ${category}, got: ${currentCategories}`);
-  assert.ok(buffer[0] > 0, `the buffer[0] should be greater than 0, got: ${buffer[0]}`);
+  assert.strictEqual(isEnabled(), true);
 
   tracing.disable();
 
   currentCategories = getEnabledCategories();
   assert.ok(currentCategories === undefined, `the getEnabledCategories should return undefined, got: ${currentCategories}`);
-  assert.ok(buffer[0] === 0, `the buffer[0] should be 0, got: ${buffer[0]}`);
+  assert.strictEqual(isEnabled(), false);
 });
diff --git a/test/parallel/test-vfs-addon.js b/test/parallel/test-vfs-addon.js
new file mode 100644
index 000000000000..1c138a187d0a
--- /dev/null
+++ b/test/parallel/test-vfs-addon.js
@@ -0,0 +1,37 @@
+// Flags: --experimental-vfs
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const vfs = require('node:vfs');
+
+const addonPath = path.join(
+  __dirname, '..', 'addons', 'hello-world', 'build', 'Release', 'binding.node');
+if (!fs.existsSync(addonPath)) {
+  common.skip('the hello-world addon is not built');
+}
+
+// A native addon inside a mounted VFS can be require()d: dlopen() cannot open
+// the reserved mount path, so the loader hands the addon's bytes to
+// process.dlopen's `binary` option, which loads them from a private temporary
+// image (an in-memory memfd on Linux).
+const myVfs = vfs.create();
+myVfs.writeFileSync('/binding.node', fs.readFileSync(addonPath));
+const mountPoint = myVfs.mount();
+
+const before = new Set(fs.readdirSync(os.tmpdir()));
+const addon = require(path.join(mountPoint, 'binding.node'));
+assert.strictEqual(addon.hello(), 'world');
+
+// On Linux the memfd path never touches the filesystem; on other POSIX the
+// temp image is unlinked right after loading, so no addon temp file lingers.
+// (Windows keeps a delete-on-close file until exit, so skip the check there.)
+if (process.platform !== 'win32') {
+  const leaked = fs.readdirSync(os.tmpdir())
+    .filter((f) => f.startsWith('node-addon') && !before.has(f));
+  assert.deepStrictEqual(leaked, [], `addon temp not cleaned up: ${leaked}`);
+}
+
+myVfs.unmount();
diff --git a/test/parallel/test-vfs-fs-promises.js b/test/parallel/test-vfs-fs-promises.js
index a5761d4ca5dd..b720aad37ccc 100644
--- a/test/parallel/test-vfs-fs-promises.js
+++ b/test/parallel/test-vfs-fs-promises.js
@@ -31,6 +31,11 @@ const vfs = require('node:vfs');
   // statfs
   const sfs = await fsp.statfs(p('src/hello.txt'));
   assert.strictEqual(typeof sfs.bsize, 'number');
+  await assert.rejects(fsp.statfs(p('missing')), {
+    code: 'ENOENT',
+    syscall: 'statfs',
+    path: p('missing'),
+  });
 
   // Path-based writes
   await fsp.writeFile(p('src/pw.txt'), 'pdata');
@@ -86,6 +91,9 @@ const vfs = require('node:vfs');
 
   // FileHandle via fsp.open
   const handle = await fsp.open(p('src/hello.txt'), 'r');
+  assert.strictEqual(handle.constructor.name, 'FileHandle');
+  assert.strictEqual(typeof handle.fd, 'number');
+  assert.strictEqual(typeof handle.createReadStream, 'function');
   assert.strictEqual(await handle.readFile('utf8'), 'hello');
   await handle.close();
 
diff --git a/test/parallel/test-vfs-fs-statSync.js b/test/parallel/test-vfs-fs-statSync.js
index 5a48c4e426fa..6e5d27c3059e 100644
--- a/test/parallel/test-vfs-fs-statSync.js
+++ b/test/parallel/test-vfs-fs-statSync.js
@@ -4,7 +4,7 @@
 // fs.statSync / fs.lstatSync / fs.statfsSync dispatch through the VFS layer,
 // including the `throwIfNoEntry: false` option.
 
-require('../common');
+const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
@@ -57,4 +57,19 @@ assert.strictEqual(
   assert.strictEqual(typeof s.bsize, 'bigint');
 }
 
+// statfsSync on a missing path throws ENOENT
+assert.throws(() => fs.statfsSync(path.join(mountPoint, 'missing')),
+              {
+                code: 'ENOENT',
+                syscall: 'statfs',
+                path: path.join(mountPoint, 'missing'),
+              });
+
+// Statfs on a missing path reports ENOENT through the callback
+fs.statfs(path.join(mountPoint, 'missing'), common.mustCall((err) => {
+  assert.strictEqual(err.code, 'ENOENT');
+  assert.strictEqual(err.syscall, 'statfs');
+  assert.strictEqual(err.path, path.join(mountPoint, 'missing'));
+}));
+
 myVfs.unmount();
diff --git a/test/parallel/test-vfs-handle-semantics.js b/test/parallel/test-vfs-handle-semantics.js
new file mode 100644
index 000000000000..3cd38fb7f833
--- /dev/null
+++ b/test/parallel/test-vfs-handle-semantics.js
@@ -0,0 +1,115 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// A file handle on a mounted path must answer the same `node:fs` calls the
+// way a descriptor on a real file does. These cases run against both the
+// memory provider and the ZipProvider, and state the real-fs outcome as the
+// expectation. Cases are independent so the runner reports each one.
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+const { test } = require('node:test');
+
+const { O_WRONLY, O_RDONLY, O_CREAT } = fs.constants;
+
+// Each provider is described by a function that mounts a fresh layer holding
+// one file `f` with the given content and returns that file's path.
+const providers = {
+  memory(content) {
+    const layer = vfs.create();
+    layer.writeFileSync('/f', content);
+    return path.join(layer.mount(), 'f');
+  },
+  zip(content) {
+    const entry = zlib.ZipEntry.createSync('f', Buffer.from(content));
+    const chunks = [];
+    for (const chunk of zlib.createZipArchiveSync([entry])) chunks.push(chunk);
+    const provider = new vfs.ZipProvider(new zlib.ZipBuffer(Buffer.concat(chunks)));
+    return path.join(vfs.create(provider).mount(), 'f');
+  },
+};
+
+for (const { 0: name, 1: fileWith } of Object.entries(providers)) {
+  test(`${name}: reading a write-only handle fails with EBADF`, () => {
+    const fd = fs.openSync(fileWith('x'), 'w');
+    try {
+      assert.throws(() => fs.readSync(fd, Buffer.alloc(4), 0, 4, 0), { code: 'EBADF' });
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: writing a read-only handle fails with EBADF`, () => {
+    const fd = fs.openSync(fileWith('x'), 'r');
+    try {
+      assert.throws(() => fs.writeSync(fd, Buffer.from('y')), { code: 'EBADF' });
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: extending a file with ftruncate zero-fills the new region`, () => {
+    const file = fileWith('hello world');
+    const fd = fs.openSync(file, 'r+');
+    fs.ftruncateSync(fd, 5);
+    fs.ftruncateSync(fd, 11);
+    fs.closeSync(fd);
+    // Shrinking then growing must not resurrect the bytes that were cut off.
+    assert.strictEqual(fs.readFileSync(file, 'latin1'), 'hello\0\0\0\0\0\0');
+  });
+
+  test(`${name}: readSync accepts a BigInt position`, () => {
+    const fd = fs.openSync(fileWith('hello'), 'r');
+    try {
+      const buf = Buffer.alloc(4);
+      const n = fs.readSync(fd, buf, 0, 4, 1n);
+      assert.strictEqual(buf.toString('utf8', 0, n), 'ello');
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: numeric O_WRONLY does not truncate`, () => {
+    const file = fileWith('hello');
+    const fd = fs.openSync(file, O_WRONLY);
+    fs.writeSync(fd, Buffer.from('J'), 0, 1, 0);
+    fs.closeSync(fd);
+    // Only O_TRUNC truncates.
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'Jello');
+  });
+
+  test(`${name}: numeric O_RDONLY | O_CREAT opens an existing file readable and intact`, () => {
+    const file = fileWith('hello');
+    const fd = fs.openSync(file, O_RDONLY | O_CREAT);
+    try {
+      const buf = Buffer.alloc(5);
+      const n = fs.readSync(fd, buf, 0, 5, 0);
+      assert.strictEqual(buf.toString('utf8', 0, n), 'hello');
+    } finally {
+      fs.closeSync(fd);
+    }
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'hello');
+  });
+
+  test(`${name}: an "a+" handle reads from the start of the file`, () => {
+    const fd = fs.openSync(fileWith('abc'), 'a+');
+    try {
+      const buf = Buffer.alloc(3);
+      // O_APPEND only moves writes to the end; the read offset starts at 0.
+      const n = fs.readSync(fd, buf, 0, 3, null);
+      assert.strictEqual(buf.toString('utf8', 0, n), 'abc');
+    } finally {
+      fs.closeSync(fd);
+    }
+  });
+
+  test(`${name}: writeFileSync with flag "r+" overwrites in place without truncating`, () => {
+    const file = fileWith('hello world');
+    fs.writeFileSync(file, 'HEY', { flag: 'r+' });
+    assert.strictEqual(fs.readFileSync(file, 'utf8'), 'HEYlo world');
+  });
+}
diff --git a/test/parallel/test-vfs-memory-provider-dynamic.js b/test/parallel/test-vfs-memory-provider-dynamic.js
index 9ddd105a5a55..13ed609820e7 100644
--- a/test/parallel/test-vfs-memory-provider-dynamic.js
+++ b/test/parallel/test-vfs-memory-provider-dynamic.js
@@ -46,35 +46,43 @@ function makeFileEntry(prototypeFrom, contentProvider) {
   return fileEntry;
 }
 
-// ===== Lazy-populated directory =====
-{
-  const provider = new MemoryProvider();
-  const root = getRoot(provider);
-
-  const dir = {
-    __proto__: Object.getPrototypeOf(root),
+function makeDirEntry(prototypeFrom, populate) {
+  const t = Date.now();
+  const dirEntry = { __proto__: Object.getPrototypeOf(prototypeFrom) };
+  Object.assign(dirEntry, {
     type: 1,           // TYPE_DIR
     mode: 0o755,
     children: new Map(),
-    populate: (scoped) => {
-      scoped.addFile('hello.txt', 'lazy hello');
-      scoped.addFile('dyn.txt', () => 'dynamic-string');
-      scoped.addDirectory('subdir', null);
-      scoped.addSymlink('link.txt', '/lazy/hello.txt');
-    },
+    populate,
     populated: false,
     nlink: 1,
     uid: 0,
     gid: 0,
-  };
-  const t = Date.now();
-  dir.atime = t; dir.mtime = t; dir.ctime = t; dir.birthtime = t;
-  dir.isFile = root.isFile.bind(dir);
-  dir.isDirectory = root.isDirectory.bind(dir);
-  dir.isSymbolicLink = root.isSymbolicLink.bind(dir);
-  dir.isDynamic = root.isDynamic.bind(dir);
-  dir.getContentSync = root.getContentSync.bind(dir);
-  dir.getContentAsync = root.getContentAsync.bind(dir);
+    atime: t,
+    mtime: t,
+    ctime: t,
+    birthtime: t,
+  });
+  dirEntry.isFile = prototypeFrom.isFile.bind(dirEntry);
+  dirEntry.isDirectory = prototypeFrom.isDirectory.bind(dirEntry);
+  dirEntry.isSymbolicLink = prototypeFrom.isSymbolicLink.bind(dirEntry);
+  dirEntry.isDynamic = prototypeFrom.isDynamic.bind(dirEntry);
+  dirEntry.getContentSync = prototypeFrom.getContentSync.bind(dirEntry);
+  dirEntry.getContentAsync = prototypeFrom.getContentAsync.bind(dirEntry);
+  return dirEntry;
+}
+
+// ===== Lazy-populated directory =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+
+  const dir = makeDirEntry(root, (scoped) => {
+    scoped.addFile('hello.txt', 'lazy hello');
+    scoped.addFile('dyn.txt', () => 'dynamic-string');
+    scoped.addDirectory('subdir', null);
+    scoped.addSymlink('link.txt', '/lazy/hello.txt');
+  });
   root.children.set('lazy', dir);
 
   const myVfs = vfs.create(provider);
@@ -125,3 +133,19 @@ function makeFileEntry(prototypeFrom, contentProvider) {
     assert.strictEqual(s, 'async-only');
   }));
 }
+
+// ===== Renaming over a lazy directory does not discard its entries =====
+{
+  const provider = new MemoryProvider();
+  const root = getRoot(provider);
+  root.children.set('lazy', makeDirEntry(root, (scoped) => {
+    scoped.addFile('keep.txt', 'keep');
+  }));
+
+  const myVfs = vfs.create(provider);
+  myVfs.mkdirSync('/src');
+
+  assert.throws(() => myVfs.renameSync('/src', '/lazy'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+  assert.strictEqual(myVfs.readFileSync('/lazy/keep.txt', 'utf8'), 'keep');
+}
diff --git a/test/parallel/test-vfs-rename.js b/test/parallel/test-vfs-rename.js
index 69daba43c11d..b1ca98dc684e 100644
--- a/test/parallel/test-vfs-rename.js
+++ b/test/parallel/test-vfs-rename.js
@@ -58,3 +58,67 @@ const vfs = require('node:vfs');
   assert.strictEqual(myVfs.existsSync('/a/b/c'), false);
   assert.strictEqual(myVfs.readFileSync('/a/file.txt', 'utf8'), 'data');
 }
+
+// Renaming a directory onto a non-empty directory throws ENOTEMPTY
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.mkdirSync('/dst');
+  myVfs.writeFileSync('/dst/keep.txt', 'keep');
+
+  assert.throws(() => myVfs.renameSync('/src', '/dst'), { code: 'ENOTEMPTY' });
+  assert.strictEqual(myVfs.readFileSync('/dst/keep.txt', 'utf8'), 'keep');
+  assert.strictEqual(myVfs.existsSync('/src'), true);
+}
+
+// Renaming a directory onto an empty directory succeeds
+{
+  const myVfs = vfs.create();
+  myVfs.mkdirSync('/src');
+  myVfs.writeFileSync('/src/a.txt', 'a');
+  myVfs.mkdirSync('/dst');
+
+  myVfs.renameSync('/src', '/dst');
+  assert.strictEqual(myVfs.existsSync('/src'), false);
+  assert.strictEqual(myVfs.readFileSync('/dst/a.txt', 'utf8'), 'a');
+}
+
+// Overwriting a file drops one of its links
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.writeFileSync('/b.txt', 'b');
+  myVfs.linkSync('/b.txt', '/b-link.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 2);
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.statSync('/b-link.txt').nlink, 1);
+  assert.strictEqual(myVfs.readFileSync('/b-link.txt', 'utf8'), 'b');
+}
+
+// Renaming a path onto itself is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.mkdirSync('/d');
+  myVfs.writeFileSync('/d/keep.txt', 'keep');
+
+  myVfs.renameSync('/a.txt', '/a.txt');
+  assert.strictEqual(myVfs.readFileSync('/a.txt', 'utf8'), 'a');
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 1);
+
+  myVfs.renameSync('/d', '/d');
+  assert.strictEqual(myVfs.readFileSync('/d/keep.txt', 'utf8'), 'keep');
+}
+
+// Renaming a hard link onto another link to the same file is a no-op
+{
+  const myVfs = vfs.create();
+  myVfs.writeFileSync('/a.txt', 'a');
+  myVfs.linkSync('/a.txt', '/b.txt');
+
+  myVfs.renameSync('/a.txt', '/b.txt');
+  assert.strictEqual(myVfs.existsSync('/a.txt'), true);
+  assert.strictEqual(myVfs.existsSync('/b.txt'), true);
+  assert.strictEqual(myVfs.statSync('/a.txt').nlink, 2);
+}
diff --git a/test/parallel/test-vfs-reserved-root-unowned.js b/test/parallel/test-vfs-reserved-root-unowned.js
new file mode 100644
index 000000000000..e6a5b319f610
--- /dev/null
+++ b/test/parallel/test-vfs-reserved-root-unowned.js
@@ -0,0 +1,59 @@
+// Flags: --experimental-vfs --expose-internals
+'use strict';
+
+// The module loader manufactures paths under the reserved VFS root that no
+// layer owns: resolving a mount point as a directory first probes the sibling
+// names `<mount>.js`, `<mount>.json`, ..., and a package.json walk-up passes
+// the parents of the mount point. Such paths cannot name anything real, but
+// they must still be answered by the VFS instead of being handed to the native
+// loader: on Windows the reserved root sits under `\\.\nul`, and
+// `\\.\nul\<anything>` opens the NUL device, which stats as a character device
+// and reads as empty. The native loader would then "find" a file at
+// `<mount>.js` and reject the empty package.json above it as invalid JSON.
+
+require('../common');
+const assert = require('assert');
+const path = require('path');
+const { pathToFileURL } = require('url');
+const vfs = require('node:vfs');
+const { loaderMethods } = require('internal/modules/helpers');
+const { getNormalizedVfsRoot } = require('internal/vfs/router');
+
+const layer = vfs.create();
+layer.writeFileSync('/index.js', 'module.exports = "ran";');
+const mountPoint = layer.mount();
+
+const root = getNormalizedVfsRoot();
+const unowned = [
+  `${mountPoint}.js`,
+  `${mountPoint}.json`,
+  `${mountPoint}.node`,
+  path.join(root, 'package.json'),
+  path.join(root, 'nope', 'index.js'),
+];
+
+for (const p of unowned) {
+  assert.ok(loaderMethods.internalModuleStat(p) < 0, p);
+  assert.throws(() => loaderMethods.readFileSync(p), { code: 'ENOENT' }, p);
+  assert.throws(() => loaderMethods.realpathSync(p), { code: 'ENOENT' }, p);
+  assert.strictEqual(loaderMethods.getNearestParentPackageJSON(p), undefined, p);
+  assert.strictEqual(loaderMethods.readPackageJSON(p, false), undefined, p);
+  assert.strictEqual(loaderMethods.getPackageType(pathToFileURL(p).href), undefined, p);
+  // The "not found" marker is the last candidate examined, like the native
+  // binding returns.
+  assert.strictEqual(
+    loaderMethods.getPackageScopeConfig(pathToFileURL(p).href),
+    path.join(path.dirname(p), 'package.json'), p);
+  // Upward walks (node_modules lookups) stop at the reserved root rather than
+  // continuing into the real file system.
+  assert.strictEqual(loaderMethods.getResolutionRoot(p), root, p);
+}
+
+// Paths outside the reserved root are still left to the native loader.
+assert.strictEqual(loaderMethods.getResolutionRoot(__filename), undefined);
+
+// The mount point itself resolves as a directory to its index through the
+// layer, which is the sequence that produced the sibling probes above.
+assert.strictEqual(require(mountPoint), 'ran');
+
+layer.unmount();
diff --git a/test/parallel/test-vfs-zip-provider-commit.js b/test/parallel/test-vfs-zip-provider-commit.js
new file mode 100644
index 000000000000..6a2874be4ee0
--- /dev/null
+++ b/test/parallel/test-vfs-zip-provider-commit.js
@@ -0,0 +1,102 @@
+// Flags: --experimental-vfs
+'use strict';
+
+// A ZipProvider handle commits its content to the archive when it is closed.
+// The effects `open(2)` has at open time, and the metadata an entry already
+// carries, must survive that model: opening with "w" creates or truncates
+// even without a write, rewriting an entry keeps its mode, fstat reports the
+// entry's mode, and a file cannot be renamed onto a directory. Each case
+// states the real-fs outcome as the expectation. Cases are independent so
+// the runner reports each one.
+
+require('../common');
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+const zlib = require('zlib');
+const vfs = require('node:vfs');
+const { test } = require('node:test');
+
+// Builds a writable in-memory archive from [name, content, options] triples
+// and mounts it, returning the mount point.
+function mountZip(entries) {
+  const list = entries.map(({ 0: name, 1: content, 2: options }) =>
+    zlib.ZipEntry.createSync(name, Buffer.from(content), options));
+  const chunks = [];
+  for (const chunk of zlib.createZipArchiveSync(list)) chunks.push(chunk);
+  const provider = new vfs.ZipProvider(new zlib.ZipBuffer(Buffer.concat(chunks)));
+  return vfs.create(provider).mount();
+}
+
+test('opening an existing file with "w" truncates it even without a write', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'f.txt');
+  fs.closeSync(fs.openSync(file, 'w'));
+  assert.strictEqual(fs.readFileSync(file, 'utf8'), '');
+});
+
+test('opening a new file with "w" creates it even without a write', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'new.txt');
+  fs.closeSync(fs.openSync(file, 'w'));
+  assert.strictEqual(fs.existsSync(file), true);
+});
+
+test('opening a new file with "a" creates it even without a write', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'log.txt');
+  fs.closeSync(fs.openSync(file, 'a'));
+  assert.strictEqual(fs.existsSync(file), true);
+});
+
+test('appending keeps the entry mode', () => {
+  const file = path.join(mountZip([['x.sh', 'a', { mode: 0o755 }]]), 'x.sh');
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o755);
+  fs.appendFileSync(file, 'b');
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o755);
+  assert.strictEqual(fs.readFileSync(file, 'utf8'), 'ab');
+});
+
+test('an in-place write keeps the entry mode', () => {
+  const file = path.join(mountZip([['x.sh', 'abc', { mode: 0o755 }]]), 'x.sh');
+  const fd = fs.openSync(file, 'r+');
+  fs.writeSync(fd, Buffer.from('Z'), 0, 1, 0);
+  fs.closeSync(fd);
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o755);
+});
+
+test('a new file gets the mode passed to open', () => {
+  const file = path.join(mountZip([['f.txt', 'hello']]), 'new.sh');
+  const fd = fs.openSync(file, 'w', 0o700);
+  fs.writeSync(fd, Buffer.from('#!'));
+  fs.closeSync(fd);
+  assert.strictEqual(fs.statSync(file).mode & 0o777, 0o700);
+});
+
+test('fstat reports the entry mode, not the open() mode argument', () => {
+  const file = path.join(mountZip([['x.sh', 'a', { mode: 0o755 }]]), 'x.sh');
+  const fd = fs.openSync(file, 'r');
+  try {
+    assert.strictEqual(fs.fstatSync(fd).mode & 0o777, 0o755);
+  } finally {
+    fs.closeSync(fd);
+  }
+});
+
+test('fstat reports the entry modification time', () => {
+  const modified = new Date('2020-01-02T03:04:05Z');
+  const file = path.join(mountZip([['f.txt', 'a', { modified }]]), 'f.txt');
+  const fd = fs.openSync(file, 'r');
+  try {
+    // ZIP timestamps have two-second resolution, so compare at that grain.
+    assert.strictEqual(Math.floor(fs.fstatSync(fd).mtimeMs / 2000),
+                       Math.floor(modified.getTime() / 2000));
+  } finally {
+    fs.closeSync(fd);
+  }
+});
+
+test('renaming a file onto an existing directory fails with EISDIR', () => {
+  const mount = mountZip([['dir/', ''], ['f', 'x']]);
+  assert.throws(() => fs.renameSync(path.join(mount, 'f'), path.join(mount, 'dir')),
+                { code: 'EISDIR' });
+  assert.strictEqual(fs.statSync(path.join(mount, 'dir')).isDirectory(), true);
+  assert.strictEqual(fs.readFileSync(path.join(mount, 'f'), 'utf8'), 'x');
+});
diff --git a/test/parallel/test-vfs-zip-provider-handle.js b/test/parallel/test-vfs-zip-provider-handle.js
index 3c88eacbb8c9..4263864e2410 100644
--- a/test/parallel/test-vfs-zip-provider-handle.js
+++ b/test/parallel/test-vfs-zip-provider-handle.js
@@ -98,7 +98,7 @@ function buildArchiveSync(entries, comment) {
   const handle = provider.openSync('/b.txt', 'r+');
 
   const buf = Buffer.alloc(4);
-  const { bytesRead } = handle.readSync(buf, 0, 4, 2);
+  const bytesRead = handle.readSync(buf, 0, 4, 2);
   assert.strictEqual(bytesRead, 4);
   assert.strictEqual(buf.toString(), '2345');
 
@@ -124,7 +124,8 @@ function buildArchiveSync(entries, comment) {
   const provider = new vfs.ZipProvider(zip);
 
   const handle = await provider.open('/c.txt', 'a');
-  assert.strictEqual(handle.position, 2); // Positioned at EOF on open
+  // O_APPEND only forces writes to the end; the read offset starts at 0.
+  assert.strictEqual(handle.position, 0);
 
   // Even with an explicit (wrong) position, append mode writes at the end.
   await handle.write(Buffer.from('z'), 0, 1, 0);
@@ -259,7 +260,7 @@ function buildArchiveSync(entries, comment) {
   assert.throws(() => provider.rmdirSync('/file.txt'), { code: 'ENOTDIR' });
 })().then(common.mustCall());
 
-// --- open(): EEXIST/ENOENT/EISDIR-on-wrong-direction, called directly on
+// --- open(): EEXIST/ENOENT/EBADF-on-wrong-direction, called directly on
 // the provider so the router can't short-circuit before delegating ---------
 (async () => {
   const archive = await buildArchive([await zlib.ZipEntry.create('a.txt', Buffer.from('x'))]);
@@ -271,12 +272,13 @@ function buildArchiveSync(entries, comment) {
   await assert.rejects(provider.open('/missing.txt', 'r'), { code: 'ENOENT' });
   assert.throws(() => provider.openSync('/missing.txt', 'r'), { code: 'ENOENT' });
 
-  // A handle opened write-only can't be read from, and vice versa.
+  // A handle opened write-only can't be read from, and vice versa: EBADF,
+  // as for any descriptor without the needed access.
   const writeOnly = await provider.open('/w.txt', 'w');
-  await assert.rejects(writeOnly.read(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await assert.rejects(writeOnly.read(Buffer.alloc(1), 0, 1, 0), { code: 'EBADF' });
   await writeOnly.close();
   const readOnly = await provider.open('/a.txt', 'r');
-  await assert.rejects(readOnly.write(Buffer.alloc(1), 0, 1, 0), { code: 'EISDIR' });
+  await assert.rejects(readOnly.write(Buffer.alloc(1), 0, 1, 0), { code: 'EBADF' });
   await readOnly.close();
 })().then(common.mustCall());
 
diff --git a/test/parallel/test-webcrypto-crypto-job-mode.js b/test/parallel/test-webcrypto-crypto-job-mode.js
index 327c6a6f154c..5f5f1761a4c7 100644
--- a/test/parallel/test-webcrypto-crypto-job-mode.js
+++ b/test/parallel/test-webcrypto-crypto-job-mode.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { types: { isCryptoKey } } = require('util');
 const { internalBinding } = require('internal/test/binding');
 const {
@@ -211,7 +211,7 @@ async function withObjectPrototypeSetters(names, fn) {
     }
   }
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     const pair = await subtle.generateKey(
       { name: 'ML-KEM-768' },
       true,
diff --git a/test/parallel/test-webcrypto-cryptokey-brand-check.js b/test/parallel/test-webcrypto-cryptokey-brand-check.js
index 3fe8aaa181a2..9174aebe8f05 100644
--- a/test/parallel/test-webcrypto-cryptokey-brand-check.js
+++ b/test/parallel/test-webcrypto-cryptokey-brand-check.js
@@ -1,13 +1,10 @@
 'use strict';
 
-// The four CryptoKey prototype getters (`type`, `extractable`,
-// `algorithm`, `usages`) are user-configurable per Web IDL, so they
-// can be invoked with an arbitrary `this`. The native callbacks that
-// implement them must brand-check their receiver and throw cleanly
-// (ERR_INVALID_THIS) rather than crashing the process or returning
-// garbage. This test exercises four progressively more hostile
-// receiver shapes, including subverting `instanceof` via
-// `Symbol.hasInstance`, to make sure the C++ brand check holds.
+// CryptoKey prototype getters and methods can be invoked with an
+// arbitrary `this`. They must brand-check their receiver and throw
+// cleanly (ERR_INVALID_THIS) rather than crashing the process or
+// returning garbage. This test exercises invalid receiver shapes,
+// including subverting `instanceof` via `Symbol.hasInstance`.
 //
 // It also verifies that `util.types.isCryptoKey()` cannot be fooled
 // by prototype spoofing.
@@ -17,7 +14,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('node:assert');
-const { types: { isCryptoKey } } = require('node:util');
+const { inspect, types: { isCryptoKey } } = require('node:util');
 const { subtle } = globalThis.crypto;
 
 (async () => {
@@ -29,22 +26,16 @@ const { subtle } = globalThis.crypto;
 
   const CryptoKey = key.constructor;
 
-  // Capture the underlying prototype getters once, so that subsequent
+  // Capture the underlying prototype members once, so that subsequent
   // tampering with `CryptoKey.prototype` cannot affect what we call.
-  const getters = {
-    type: Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'type').get,
-    extractable:
-      Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'extractable').get,
-    algorithm:
-      Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'algorithm').get,
-    usages:
-      Object.getOwnPropertyDescriptor(CryptoKey.prototype, 'usages').get,
-  };
+  const descriptors = Object.getOwnPropertyDescriptors(CryptoKey.prototype);
 
   // Sanity: each getter works on a real CryptoKey.
-  Object.entries(getters).forEach(([name, getter]) => {
-    assert.notStrictEqual(getter.call(key), undefined, `baseline ${name}`);
-  });
+  for (const name of Reflect.ownKeys(descriptors)) {
+    const { get } = descriptors[name];
+    if (get !== undefined)
+      Reflect.apply(get, key, []);
+  }
   assert.strictEqual(isCryptoKey(key), true);
   assert.strictEqual(Object.hasOwn(CryptoKey, 'getSlots'), false);
   const internalProto = Object.getPrototypeOf(key);
@@ -54,37 +45,53 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(Object.getPrototypeOf(internalProto), CryptoKey.prototype);
 
   const invalidThis = { code: 'ERR_INVALID_THIS', name: 'TypeError' };
+  const invalidArgType = { code: 'ERR_INVALID_ARG_TYPE', name: 'TypeError' };
+
+  async function assertInvalidReceiver(receiver) {
+    for (const name of Reflect.ownKeys(descriptors)) {
+      if (name === 'constructor') continue;
+      const descriptor = descriptors[name];
+      const args = name === inspect.custom ? [0, {}] : [];
+      for (const kind of ['get', 'set', 'value']) {
+        const member = descriptor[kind];
+        if (typeof member !== 'function') continue;
+        await assert.rejects(
+          async () => Reflect.apply(member, receiver, args),
+          invalidThis,
+          `CryptoKey.${String(name)} (${kind})`,
+        );
+      }
+    }
+  }
 
   // Plain object receiver.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call({}), invalidThis);
-  });
+  await assertInvalidReceiver({});
 
   // Null-prototype object receiver.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call({ __proto__: null }), invalidThis);
-  });
+  await assertInvalidReceiver({ __proto__: null });
 
   // Primitive receiver.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(1), invalidThis);
-  });
+  await assertInvalidReceiver(1);
 
   // Null.
-  Object.entries(getters).forEach(([, getter]) => {
-    // eslint-disable-next-line no-useless-call
-    assert.throws(() => getter.call(null), invalidThis);
-  });
+  await assertInvalidReceiver(null);
 
   // Undefined.
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(), invalidThis);
-  });
+  await assertInvalidReceiver(undefined);
 
   // Function
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(function() {}), invalidThis);
-  });
+  await assertInvalidReceiver(function() {});
+
+  const revoked = Proxy.revocable(key, {});
+  revoked.revoke();
+  for (const receiver of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    new Proxy(key, {}),
+    revoked.proxy,
+  ]) {
+    await assertInvalidReceiver(receiver);
+  }
 
   // Prototype spoofing with InternalCryptoKey.prototype must not pass
   // util.types.isCryptoKey().
@@ -94,10 +101,10 @@ const { subtle } = globalThis.crypto;
   assert.strictEqual(isCryptoKey(spoofed), false);
   await assert.rejects(
     subtle.sign('HMAC', spoofed, Buffer.from('payload')),
-    invalidThis);
+    invalidArgType);
   await assert.rejects(
     subtle.exportKey('jwk', spoofed),
-    invalidThis);
+    invalidArgType);
 
   // Subvert `instanceof CryptoKey` via Symbol.hasInstance, then
   // invoke the native getters on a forged object. The C++ tag
@@ -110,9 +117,7 @@ const { subtle } = globalThis.crypto;
   const fake = { foo: 'bar' };
   assert.strictEqual(fake instanceof CryptoKey, true);
   assert.strictEqual(isCryptoKey(fake), false);
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(fake), invalidThis);
-  });
+  await assertInvalidReceiver(fake);
 
   // Subverted `instanceof` plus a real BaseObject of a different
   // kind (a Buffer) as the receiver. Without the C++ tag check
@@ -120,13 +125,11 @@ const { subtle } = globalThis.crypto;
   const buf = Buffer.alloc(16);
   assert.strictEqual(buf instanceof CryptoKey, true);
   assert.strictEqual(isCryptoKey(buf), false);
-  Object.entries(getters).forEach(([, getter]) => {
-    assert.throws(() => getter.call(buf), invalidThis);
-  });
+  await assertInvalidReceiver(buf);
 
   // The real CryptoKey continues to work after all of the above.
-  assert.strictEqual(getters.type.call(key), 'secret');
-  assert.strictEqual(getters.extractable.call(key), true);
-  assert.strictEqual(getters.algorithm.call(key).name, 'HMAC');
-  assert.deepStrictEqual(getters.usages.call(key), ['sign']);
+  assert.strictEqual(descriptors.type.get.call(key), 'secret');
+  assert.strictEqual(descriptors.extractable.get.call(key), true);
+  assert.strictEqual(descriptors.algorithm.get.call(key).name, 'HMAC');
+  assert.deepStrictEqual(descriptors.usages.get.call(key), ['sign']);
 })().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-cryptokey-clone-transfer.js b/test/parallel/test-webcrypto-cryptokey-clone-transfer.js
index 4983e1c0bda3..2567ac69454d 100644
--- a/test/parallel/test-webcrypto-cryptokey-clone-transfer.js
+++ b/test/parallel/test-webcrypto-cryptokey-clone-transfer.js
@@ -17,6 +17,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('node:assert');
+const { KeyObject } = require('node:crypto');
 const { inspect } = require('node:util');
 const { once } = require('node:events');
 const { Worker, MessageChannel } = require('node:worker_threads');
@@ -320,6 +321,17 @@ async function checkRsaPssTransferToWorker({ publicKey, privateKey }) {
         { name: 'AES-GCM', iv }, k, ciphertext);
       assert.deepStrictEqual(Buffer.from(decrypted), plaintext);
     }
+
+    const bytes = new Uint8Array(await subtle.exportKey('raw', key));
+    const nullPrototypeClone = structuredClone(key);
+    Object.setPrototypeOf(nullPrototypeClone, null);
+    assert.deepStrictEqual(
+      new Uint8Array(await subtle.exportKey('raw', nullPrototypeClone)), bytes);
+    const typeGetter = Object.getOwnPropertyDescriptor(key.constructor.prototype, 'type').get;
+    const customInspect = key[inspect.custom];
+    assert.strictEqual(typeGetter.call(nullPrototypeClone), 'secret');
+    assert.strictEqual(typeof customInspect.call(nullPrototypeClone, 0, {}), 'string');
+    assert.deepStrictEqual(KeyObject.from(structuredClone(key)).export(), Buffer.from(bytes));
   }
 
   // ECDSA keypair (public extractable, private non-extractable)
diff --git a/test/parallel/test-webcrypto-deduplicate-usages.js b/test/parallel/test-webcrypto-deduplicate-usages.js
index d27675d873ce..1d7247644abd 100644
--- a/test/parallel/test-webcrypto-deduplicate-usages.js
+++ b/test/parallel/test-webcrypto-deduplicate-usages.js
@@ -13,7 +13,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const { createSecretKey } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function assertSameSet(actual, expected, msg) {
@@ -115,7 +115,7 @@ function assertSameSet(actual, expected, msg) {
     asymmetric.splice(asymmetric.findIndex(({ algorithm }) =>
       algorithm.name === 'X25519'), 1);
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     asymmetric.push({
       algorithm: { name: 'ML-DSA-65' },
       usages: ['verify', 'sign', 'verify', 'sign'],
@@ -297,7 +297,7 @@ function assertSameSet(actual, expected, msg) {
     assert.deepStrictEqual(imported.usages, ['sign']);
   })());
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     // ML-DSA JWK roundtrip.
     tests.push((async () => {
       const { privateKey } = await subtle.generateKey(
@@ -508,7 +508,7 @@ function assertSameSet(actual, expected, msg) {
     jwkPairVectors.splice(jwkPairVectors.findIndex(({ algorithm }) =>
       algorithm.name === 'X25519'), 1);
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     jwkPairVectors.push({
       algorithm: { name: 'ML-DSA-65' },
       usages: ['verify', 'sign', 'verify', 'sign'],
diff --git a/test/parallel/test-webcrypto-derivebits-cfrg.js b/test/parallel/test-webcrypto-derivebits-cfrg.js
index fae39ac89c5e..134360c62751 100644
--- a/test/parallel/test-webcrypto-derivebits-cfrg.js
+++ b/test/parallel/test-webcrypto-derivebits-cfrg.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const rejectsXCurves = hasFIPS(3, 5);
 
@@ -22,7 +22,7 @@ const kTests = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     {
       name: 'X448',
diff --git a/test/parallel/test-webcrypto-derivebits-hkdf.js b/test/parallel/test-webcrypto-derivebits-hkdf.js
index 539440ea7c31..fafd6a7afa58 100644
--- a/test/parallel/test-webcrypto-derivebits-hkdf.js
+++ b/test/parallel/test-webcrypto-derivebits-hkdf.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 
 function getDeriveKeyInfo(name, length, hash, ...usages) {
@@ -28,7 +28,7 @@ const kDerivedKeyTypes = [
   ['AES-KW', 256, undefined, 'wrapKey', 'unwrapKey'],
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kDerivedKeyTypes.push(
     ['HMAC', 256, 'SHA3-256', 'sign', 'verify'],
     ['HMAC', 256, 'SHA3-384', 'sign', 'verify'],
@@ -91,7 +91,7 @@ const kDerivations = {
         empty: '9e4b719033742101e90f1ad61e2ff3b4' +
                '256863667296d74389f1f02af2c4e6a6'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '386b0693d7a58c4ddf01b49bfbbd2fa87c6f911991543995170ba20ed28df599',
           empty: 'd029bc828b6c6c8bb16ce3d25f5058f19c7d2517745e11c5d65c6d242e82e47f',
@@ -131,7 +131,7 @@ const kDerivations = {
         empty: 'c8e12774135305c9147f2cc4766e5ead' +
                '25d8f457b9a1953d52677361ced558fb'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '9befc557f5baf4075b5fb38c014b41b92ab7534150baf64201069e8807d0e83d',
           empty: '54d1fa1aa7cad99dab0622b772170e775c103756183bac36a228fd817a98a3f6',
@@ -173,7 +173,7 @@ const kDerivations = {
         empty: 'e579d1f9e7f08e6f990ffcfcce1ed201' +
                'c5e37e62cdf606f0ba4aca80427fbc44'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: '24f38fd1905554b7cbf8395cc3976292d11ce24a0b3131da0fd4b109832d27e3',
           empty: '33d0a5151c0f52e4bb7fb67cf7a17063127624dc3e685903f49ebb07872084d1',
@@ -213,7 +213,7 @@ const kDerivations = {
         empty: 'b4f7e7557674d501cbfbc0148ad800c0' +
                '750189fe295a2aca5e1bf4122c85edf9'
       },
-      ...(!process.features.openssl_is_boringssl ? {
+      ...(!isBoringSSL ? {
         'SHA3-256': {
           normal: 'fe32459f7339dd2e8df6c6fc874ed9e81e3b7aad669edad9b71196f53ed95b12',
           empty: '04519be1eb94079c91306cc5b21946b3de6a78ad35ec83d4f4a37bafbda678d7',
diff --git a/test/parallel/test-webcrypto-derivebits.js b/test/parallel/test-webcrypto-derivebits.js
index 6ef2227ab2d2..e7deee0eeae3 100644
--- a/test/parallel/test-webcrypto-derivebits.js
+++ b/test/parallel/test-webcrypto-derivebits.js
@@ -7,7 +7,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const requiresLongHkdfInputs = hasFIPS(3) && !hasFIPS(3, 5);
 const rejectsWeakPbkdf2Inputs = hasFIPS(4);
@@ -120,6 +120,28 @@ const rejectsXCurves = hasFIPS(3, 5);
   }
 }
 
+// Test PBKDF2 rejects iteration counts beyond the native signed int range
+{
+  async function test() {
+    const key = await subtle.importKey(
+      'raw',
+      new Uint8Array([1]),
+      'PBKDF2',
+      false,
+      ['deriveBits']);
+    await assert.rejects(
+      subtle.deriveBits({
+        name: 'PBKDF2',
+        hash: 'SHA-256',
+        salt: new Uint8Array([2]),
+        iterations: 2 ** 31,
+      }, key, 8),
+      { name: 'NotSupportedError' });
+  }
+
+  test().then(common.mustCall());
+}
+
 // Test X25519 and X448 bit derivation
 {
   async function test(name) {
@@ -152,7 +174,7 @@ const rejectsXCurves = hasFIPS(3, 5);
     }
   } else {
     test('X25519').then(common.mustCall());
-    if (!process.features.openssl_is_boringssl) {
+    if (!isBoringSSL) {
       test('X448').then(common.mustCall());
     } else {
       common.printSkipMessage('Skipping unsupported X448 test case');
diff --git a/test/parallel/test-webcrypto-derivekey-cfrg.js b/test/parallel/test-webcrypto-derivekey-cfrg.js
index 13c4e56ce5b0..c9a9b60d091b 100644
--- a/test/parallel/test-webcrypto-derivekey-cfrg.js
+++ b/test/parallel/test-webcrypto-derivekey-cfrg.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const rejectsXCurves = hasFIPS(3, 5);
 
@@ -22,7 +22,7 @@ const kTests = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     {
       name: 'X448',
diff --git a/test/parallel/test-webcrypto-derivekey.js b/test/parallel/test-webcrypto-derivekey.js
index 631951c3f767..516838aaf0bf 100644
--- a/test/parallel/test-webcrypto-derivekey.js
+++ b/test/parallel/test-webcrypto-derivekey.js
@@ -6,7 +6,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
@@ -87,7 +87,7 @@ const fips4 = hasFIPS(4);
      'a7abd704d0be364c6d4a530b6f93fcaff95474a2eee5a127ff86c5d095a2a812'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       ['hello hello hello', 'there', 'my friend indeed', 'SHA3-256',
        '89b3751df2ada85322a57ec82f7d0a5c233c6def91c92e681bc5118bd5768dca'],
@@ -140,7 +140,7 @@ const fips4 = hasFIPS(4);
      '12790ce09027db067d680670f4dc704715b5120d139e8fde810afc34fb66f9f1'],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       ['hello hello hello', 'my friend indeed', 1000, 'SHA3-256',
        '0f69b46660cba27b95215d5676492c64ed6abf6d426669a4a02b0ca3a1c36c11'],
@@ -176,7 +176,7 @@ const fips4 = hasFIPS(4);
     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     vectors.push(
       [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
       [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
@@ -236,7 +236,7 @@ const fips4 = hasFIPS(4);
     [{ name: 'HMAC', hash: 'SHA-512' }, 'sign', 1024],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     vectors.push(
       [{ name: 'HMAC', hash: 'SHA3-256', length: 256 }, 'sign', 256],
       [{ name: 'HMAC', hash: 'SHA3-384', length: 384 }, 'sign', 384],
@@ -372,7 +372,7 @@ if (hasOpenSSL(3) && !hasFIPS()) {
     }
   } else {
     test('X25519').then(common.mustCall());
-    if (!process.features.openssl_is_boringssl) {
+    if (!isBoringSSL) {
       test('X448').then(common.mustCall());
     } else {
       common.printSkipMessage('Skipping unsupported X448 test case');
diff --git a/test/parallel/test-webcrypto-digest.js b/test/parallel/test-webcrypto-digest.js
index 7c0ef7668c61..47a56a912d69 100644
--- a/test/parallel/test-webcrypto-digest.js
+++ b/test/parallel/test-webcrypto-digest.js
@@ -9,7 +9,7 @@ const assert = require('assert');
 const { Buffer } = require('buffer');
 const { subtle } = globalThis.crypto;
 const { createHash, getHashes } = require('crypto');
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 const fips = hasFIPS();
 
 const kTests = [
@@ -19,7 +19,7 @@ const kTests = [
   ['SHA-512', ['sha512'], 512],
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   kTests.push(
     [{ name: 'cSHAKE128', outputLength: 256 }, ['shake128', { outputLength: 256 >> 3 }], 256],
     [{ name: 'cSHAKE256', outputLength: 512 }, ['shake256', { outputLength: 512 >> 3 }], 512],
@@ -150,7 +150,7 @@ const kDigestedData = {
           '60b22aab8d36a4c2a3affdb71234f49276737c575ddf7' +
           '4d14054cbd6fdb98fd0ddcbcb46f91ad76b6ee'
   },
-  ...(!process.features.openssl_is_boringssl ? {
+  ...(!isBoringSSL ? {
     'cshake128': {
       empty: '7f9c2ba4e88f827d616045507605853ed73b8093f6e' +
             'fbc88eb1a6eacfa66ef26',
diff --git a/test/parallel/test-webcrypto-encap-decap-ml-kem.js b/test/parallel/test-webcrypto-encap-decap-ml-kem.js
index dbb0a7d3fa8b..0503e66da235 100644
--- a/test/parallel/test-webcrypto-encap-decap-ml-kem.js
+++ b/test/parallel/test-webcrypto-encap-decap-ml-kem.js
@@ -6,9 +6,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -288,7 +288,7 @@ async function testDecapsulateBits({ name, publicKeyPem, privateKeyPem, results
   const variations = [];
 
   for (const vector of vectors) {
-    if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') {
+    if (isBoringSSL && vector.name === 'ML-KEM-512') {
       common.printSkipMessage(`Skipping unsupported ${vector.name} test`);
       continue;
     }
diff --git a/test/parallel/test-webcrypto-encrypt-decrypt.js b/test/parallel/test-webcrypto-encrypt-decrypt.js
index 1015752a8b0a..9a10b214d7aa 100644
--- a/test/parallel/test-webcrypto-encrypt-decrypt.js
+++ b/test/parallel/test-webcrypto-encrypt-decrypt.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 const { getFips } = require('crypto');
 const { subtle } = globalThis.crypto;
 
@@ -59,7 +59,7 @@ const { subtle } = globalThis.crypto;
 }
 
 // Test Encrypt/Decrypt RSA-OAEP w/ SHA-3
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const buf = globalThis.crypto.getRandomValues(new Uint8Array(50));
 
   async function test() {
diff --git a/test/parallel/test-webcrypto-export-import-cfrg.js b/test/parallel/test-webcrypto-export-import-cfrg.js
index fb8014840f34..1cc1cd478ac8 100644
--- a/test/parallel/test-webcrypto-export-import-cfrg.js
+++ b/test/parallel/test-webcrypto-export-import-cfrg.js
@@ -8,7 +8,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const rejectsXCurves = hasFIPS(3, 5);
 
@@ -96,7 +96,7 @@ const testVectors = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   testVectors.push(
     {
       name: 'Ed448',
diff --git a/test/parallel/test-webcrypto-export-import-ml-dsa.js b/test/parallel/test-webcrypto-export-import-ml-dsa.js
index 9c6e04da053c..d79b8138f8ac 100644
--- a/test/parallel/test-webcrypto-export-import-ml-dsa.js
+++ b/test/parallel/test-webcrypto-export-import-ml-dsa.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -105,7 +105,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
       extractable,
       privateUsages);
   } catch (err) {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.strictEqual(err.name, 'DataError');
       assert.strictEqual(err.cause.code, 'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
       common.printSkipMessage('Skipping unsupported private key format test');
@@ -525,7 +525,7 @@ async function testImportRawSeed({ name, privateUsages }, extractable) {
   }
 })().then(common.mustCall());
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
       const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii');
diff --git a/test/parallel/test-webcrypto-export-import-ml-kem.js b/test/parallel/test-webcrypto-export-import-ml-kem.js
index 862eea96726d..c6ae5e51c566 100644
--- a/test/parallel/test-webcrypto-export-import-ml-kem.js
+++ b/test/parallel/test-webcrypto-export-import-ml-kem.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
@@ -105,7 +105,7 @@ async function testImportPkcs8({ name, privateUsages }, extractable) {
       extractable,
       privateUsages);
   } catch (err) {
-    if (process.features.openssl_is_boringssl) {
+    if (isBoringSSL) {
       assert.strictEqual(err.name, 'DataError');
       assert.strictEqual(err.cause.code,
                          'ERR_OSSL_EVP_PRIVATE_KEY_WAS_NOT_SEED');
@@ -469,7 +469,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
 (async function() {
   const tests = [];
   for (const vector of testVectors) {
-    if (process.features.openssl_is_boringssl && vector.name === 'ML-KEM-512') {
+    if (isBoringSSL && vector.name === 'ML-KEM-512') {
       common.printSkipMessage('Skipping unsupported ML-KEM-512 test');
       continue;
     }
@@ -525,7 +525,7 @@ async function testImportJwk({ name, publicUsages, privateUsages }, extractable)
   }
 })().then(common.mustCall());
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   (async function() {
     for (const { name, privateUsages } of testVectors) {
       const pem = fixtures.readKey(getKeyFileName(name.toLowerCase(), 'private_priv_only'), 'ascii');
diff --git a/test/parallel/test-webcrypto-export-import-rsa.js b/test/parallel/test-webcrypto-export-import-rsa.js
index 294baff544a6..385b8e0bc520 100644
--- a/test/parallel/test-webcrypto-export-import-rsa.js
+++ b/test/parallel/test-webcrypto-export-import-rsa.js
@@ -1,6 +1,8 @@
 'use strict';
 
 const common = require('../common');
+
+const { isBoringSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 if (!common.hasCrypto)
@@ -19,7 +21,7 @@ const hashes = [
   'SHA-512',
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   hashes.push(
     'SHA3-256',
     'SHA3-384',
diff --git a/test/parallel/test-webcrypto-export-import.js b/test/parallel/test-webcrypto-export-import.js
index 30d1ea622fae..385ae8c65e9d 100644
--- a/test/parallel/test-webcrypto-export-import.js
+++ b/test/parallel/test-webcrypto-export-import.js
@@ -6,7 +6,7 @@ const fixtures = require('../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { subtle } = globalThis.crypto;
@@ -518,7 +518,7 @@ if (hasOpenSSL(3)) {
 }
 
 // SHA-3 hashes and JWK "alg"
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   const rsa = fixtures.readKey('rsa_private_2048.pem');
   const privateKey = createPrivateKey(rsa);
   const publicKey = createPublicKey(privateKey);
diff --git a/test/parallel/test-webcrypto-get-public-key.mjs b/test/parallel/test-webcrypto-get-public-key.mjs
index 65e3cb5334d9..6c03492cfbf9 100644
--- a/test/parallel/test-webcrypto-get-public-key.mjs
+++ b/test/parallel/test-webcrypto-get-public-key.mjs
@@ -56,6 +56,14 @@ for (const name of ['ML-KEM-512', 'ML-KEM-768', 'ML-KEM-1024']) {
   keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  keyGeneration[name] = vector(name, ['decapsulateBits'], ['encapsulateBits']);
+}
+
 const unsupportedGetPublicKeyAlgorithms = new Set([
   'AES-CBC',
   'AES-CTR',
diff --git a/test/parallel/test-webcrypto-kem-hybrids.js b/test/parallel/test-webcrypto-kem-hybrids.js
new file mode 100644
index 000000000000..0d1ec410c160
--- /dev/null
+++ b/test/parallel/test-webcrypto-kem-hybrids.js
@@ -0,0 +1,689 @@
+'use strict';
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { hasFIPS, hasOpenSSL } = require('../common/crypto');
+
+if (!hasOpenSSL(3, 5))
+  common.skip('requires OpenSSL >= 3.5');
+
+const assert = require('assert');
+const { once } = require('events');
+const { KeyObject } = require('crypto');
+const { MessageChannel } = require('worker_threads');
+const { subtle } = globalThis.crypto;
+const { SubtleCrypto } = globalThis;
+
+if (hasFIPS()) {
+  (async () => {
+    for (const name of [
+      'MLKEM768-P256',
+      'MLKEM768-X25519',
+      'MLKEM1024-P384',
+    ]) {
+      for (const operation of [
+        'generateKey',
+        'importKey',
+        'exportKey',
+        'getPublicKey',
+        'encapsulateBits',
+        'decapsulateBits',
+      ]) {
+        assert.strictEqual(SubtleCrypto.supports(operation, name), false);
+      }
+      assert.strictEqual(
+        SubtleCrypto.supports('encapsulateKey', name, 'HKDF'),
+        false);
+      assert.strictEqual(
+        SubtleCrypto.supports('decapsulateKey', name, 'HKDF'),
+        false);
+      await assert.rejects(
+        subtle.generateKey(
+          name,
+          true,
+          ['encapsulateBits', 'decapsulateBits']),
+        { name: 'NotSupportedError', message: 'Unrecognized algorithm name' });
+    }
+  })().then(common.mustCall());
+  return;
+}
+
+const vectors = [
+  {
+    name: 'MLKEM768-P256',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2049c039c845be659999c8fa48d7f62327c146cf1bc0b0bb1b91b30174b7bc220' +
+               'd422023bff6b0dee263532c503f3982e4d3e27071b855578a9a9aa63b8a8c339bf',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc04428a824ea7cf56ad2a64ed368b' +
+                '71315d80cee846007cff1d2eea2c3f0f921537304ae598f98dd10d1f102811a4e2d161c3fd8b' +
+                'bb193d4b25bee950ac839c0f9d',
+    sharedSecret: '9bd018e869bb01b63fb8f5da374a73d347ea14cb2bc570b13d0908e2288ec456',
+  },
+  {
+    name: 'MLKEM768-X25519',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: '3d209f716752f6408e7f89bceef97ac388530045377927644ef046c0a7cae978c8841a0133aa' +
+               'c4f1e1a7027277f671219cf58b85d29c8fec08edd432e787a3cf9936fe0026a113cb9efb1d72' +
+               '14049527bfe2141ea170b0294a59403ab0ce16760a8baa95b823cbb8aacdcc17ef32775223c7' +
+               '91e3740163941f9bb3f63346bef1c050c31f932c62719429aff14c2bd438ab135bed692d56c7' +
+               '7c04cbbffd6335b578318b513771e84b14ea821262141ca006ccb8bf2500aa1008970f216fe7' +
+               'f1ae34125aa290492c069a189222adc322f97649c762c7d3128ad3bb2667971d0744014bc3b6' +
+               '7445cbcd0b3e7ea69fb1cb9f9c331f97487920187292926d04a25a2650abbd44982bb0c3c630' +
+               '1fe6a61330d24d8a3c7021dc3e3392c79a139b37613bba67a2984298507b84a4d61eef18acfb' +
+               '979af2d39caa4c0db4513815359d76fc378c63a7f4f3053b17168d0221cf0c2eec5514ba235f' +
+               '81d04d67c3b5c518094917671c26a7c046457533cc32844581277a03eb065c4529a779a9a587' +
+               '8f2aac3f81db9ed3d8c9345697058cbb99d379bca16d8fdb61d129960390524791b9d3e501b9' +
+               '00bd1e5002e095be06c23f1fb212f5801f24b6b28c0c5493d246d02aa29fa3acfbe15ac4e212' +
+               'eb0b6f69ebbea259a2703aa4c308224bdb741c65c7a5d4bff788279507bbfe513d7aa5694e7b' +
+               '3cdf62ab36432742d4a0ca9b3570ba742fa803b46989c8526ea586cc4fc32866143b79601725' +
+               'fa545fd280b404530318bbc3371194710b6d74beaa629eb18a36a953b75915ae96999ba5c88c' +
+               'dc56a46861c50032c9b630bcc1445a30878979bc55a2c0955bf399b231203b90c651b6afe0e2' +
+               '42b5a543250b142f7291ed753d816098f7913302a8ce91641716623d4fc2ac6772aa5f367404' +
+               '2b7c4a18a2186289a4ac4e200774596ca03e6798c7506b984999db6ac142586bae0799f1e776' +
+               'f9f5247dc574d8556ddf9bbbc4ca3643263457f74248010d62d4311268360aecb4902b450bf2' +
+               '050ecb8ba7a92820d233f5a14ed31225a1d17ca6f19e825894cfb1807d922cbd60761134be41' +
+               '9144bcf72006366a4460137ad9136c113f05eb54c409520edc72e4150cc3a24b0f819eec11bb' +
+               'd19ca9645b0810a60b4a8a9e9c3955396a1653955b047bcf4f98433c27236c570d75f809e44a' +
+               'af2dc33665826351872c293350ab324518c8c0c80b521c80c81a56bdc968a5650315a830c8bb' +
+               '17532c62ccc23b1d46412c256b224fd4674491803501d0143125c7577239689965b6989ca561' +
+               '793c0f85c62a9e13487da17662a7188c70b1040a67ed4c3f85e74e3691822fb96314d6134fe6' +
+               'a626b3cbe1461d62a7b573b2cc75579ffa22967e36ceb2a1aa0b71875a22751d706b72ca9ecd' +
+               '0c8100ad0aa58009a5c83fffe91759e6baa0a9345af99fe3b69509dbc84032868844ab3f65bb' +
+               '1df8beadf36442e48e339c967023a525411544c789a2f04dacd06ffef78302210450b931f6b4' +
+               'c32aab34a3f5260b810f4c9a946fc22d3baabaa80ba8d9955d6dc35e8609b4256b482cdc9d89' +
+               '77c1a47a354e7c527fdb1672e166917b95cd6351820261daab361f8a2dcbb240c55abd6a8105' +
+               'e5291b427b566d731e6b7047189cff20d8b120e0b3e72472d1b0086812200fd3698e23f06e4f' +
+               '4e08bbb54cc2f63601b7f85accfeea2d17964c66b5194b0f08e18519faaee194e3c102823062',
+    ciphertext: 'd81018a94f8078e02105beaa814e003390befa4589bb614f77397af42d8e8150796f2c88a4ef' +
+                'ca81b8cf93c0ae3716c54ec1b045e3875f38c2dd12d7f717bd7fb701a9fecda5ed8b764c9a35' +
+                'd4a5c1d8930f6071f653eebb2d1afa77debb8302d16f17e0f5f3920a71a4d49beafa0e1c7e44' +
+                '3f8abca64a65a9e81a97e7357bf902573363c0e1a12e5228036828e3f759121fada92441fe33' +
+                '4e85d79347e470d2fed945541d832c54baaa3cb7526c3853954db4f73547cc7c27fd38398bfa' +
+                '7704952cb841e38b270e4db7435f0ee22f57d7ad3270bd0c88e71b4b864cf2277c65daa10a6d' +
+                'ad4c7abecd95cc4ebec39c08404b522e4ecc1545713f76bebd3b5a0f2feb3461936065dbd13f' +
+                '6a1f61e1b142a2af2e5a482ba2c50cf0317049c0b3bfd6d5e9240eba9111d2030fdea17e33b6' +
+                '524020d30b0c4f8069285f3a6ca267d287d01e827d8422bf5426e11688bfc73756af1841b1c8' +
+                '7e126cb50c914b5b2b8673488ad3b074cad77a3840eb12dd688f313ee1e9ff8c479a678f2763' +
+                '56fc9d65e1d5b4c1e9855b4175db144f7767c12061769190fe6b5e51563b91f94d131a2b796b' +
+                'd2980ed0dab4ae7a7110e920007a757158a5eb8662cbf89ddffe9d8196821313cdc00108853f' +
+                'c4746b111d5b56da638d8ed2973918960f5dfe93ead3ae521e957cec3c8d843e8fce234c70ad' +
+                '055177f235439d6098bdd771b1cfcfadaab4f50a7378185c62409f383c8ff658c2a2af66498c' +
+                'fd81e962766ac6b774e88424fb4f331837d0a28502708477caf8780a156d723f68fca791e1cd' +
+                '2397bfc2b24c77c765d9b2af36f732d52107517efd8157b283b440a613f756c364ca108971a8' +
+                '878199a93f260baec3e850033cc032c2e53f823576affb4d3b116e2d16049152c35aaa263ab3' +
+                '76f0ad5ede6a749607a283e3016e62191c0e8fde33e718cd989591c9a205d608d99fcb8a7471' +
+                '603d716cb01b56328d7d880aec2851f4e6d8b5016c25647e9026ebb441543e8012dbfcf078d4' +
+                '012b8c39184dd64f3821b4774ae4e36365f8baf2bd1f6667c017a1e65ff8a1554458fb3f367c' +
+                '02721752bfa56fc7fd566ae95ffb208f919ef12f4cf8a2fdd141a8df559bddb7b8d1f04ee6d4' +
+                'cf7805d142989caf216dfae985faaab9974f6d9f8aa1129084db8db912b1655f595ffbaa6649' +
+                '1ab4655fd734cfd4bb0c0289d4bcc8fc5e9943b351cb147c8db059a24004d1c3e3bb4c14a881' +
+                'e5101acb736c65c5d579acb67ee85a560277b43338fe79d34b772c5da001da3b5a3383dd8131' +
+                '9a0b4542e6d7e46eed5314cc70eb231de27b6e760db598ba19995cf69be0e4458e35f3f274ac' +
+                'a2455d43fe3344e183c6dc47c857dbe9907b41e41006d91b25adcafc098fe66f7554be8dad49' +
+                '3c4f4b1dbf7a51464139db474afab5572f92a2232b59be56a72c0505149dae5cde1e60287703' +
+                '7de7802b5f6fa47a4c9a3e52d6ca15339920254e9ffb53c7b834cc0288ed9905a1841e9390ea' +
+                '94a8898bd4c6b6d6027e4d43c7867242515bbeefe12340fc6b3d57762f8badb69433f9c6d060' +
+                'f85f5e5c6b6803a816d141c075f63541ad10',
+    sharedSecret: 'e5ba94031ea6efd69c09c254f6d9783136ba6037e2d4c43bcccf19d6f3f4343a',
+  },
+  {
+    name: 'MLKEM1024-P384',
+    seed: '0000000000000000000000000000000000000000000000000000000000000000',
+    publicKey: 'a10bc8b554cd51980cdbbccc3041420fd320fe8b74c7a84278c63c17070dc231b61ab269b9d6' +
+               '77d920261186654b4571f51797d5c342b8070bc6c92bca16adecc631e4e94c7508b111730c74' +
+               '9c73e2d6a6f97155cb269ccc06a71a21bef3d269463c935048a7f4636c7b320073709023f7b0' +
+               '4d0530571a9a6f718280870bb63875d3f599bc229b95869cd5bb5d26640856d40b828198fdf2' +
+               'c099998ffdf772e462336c521cd326b5e4997bd95c135c57bd02c7afa80a2923d510951778ee' +
+               '5125b2aa18f90445453b85789224725b259279698ac9426c882baabc38d4fb3a3f6831180918' +
+               'b9825e0e418154d78aebab5e7e7066e69b2567476bf1177fe079a38298be6f01b098c33851ab' +
+               '25312b52e32a5750c2b73d293c0b810473b310aaf062f19914c7377b2e90388f575bf5e68534' +
+               '53b95a74aa18d62d4ae37e6996a48ab5217488a92d7b01e315c50b68204143792afc4f8367c0' +
+               'ce065ab32014bdb5515fe0594608aad1218994724afaaaa2df0355f46666b6e02a387b6d3da4' +
+               '713edb610bb048c3a2078b800e9ea483f2009c96d24c71b2cbc8e1200c0277383c5c27895e29' +
+               '8c3607701ce58702a91903274a041408234cb0021ef2b1c5131419b444dc84b89d147d1fe43c' +
+               '43f676d906735d9ca2a59c2232d97fd4aa1ae2bb3d1b170ca553cb2574954fdc6689fac623cb' +
+               'aa31982d82424d5a564fef7a8ba51b44df15053b2b45bec4aa1ed49929123daf754175c59382' +
+               '58c608b24d062042ab4bbee5e553a5ea627521738ae5ab2e06bd98b020787b2f5fa51eb4c46c' +
+               '2bf90e55a49560340667f88ac41432b7f551dfd98c037c79f79b41b985a8b1f51345550cd816' +
+               '714362040778c43e378a288394bd028c8c31b5a904bc4a5648a596035cb38f0e276e12c9a96f' +
+               '8425056b05a136642dd2cb75463036485ba1a50539e420e1e31dfac529cad6c68ec067467494' +
+               '73e050a4ac92b7199beceb239b6c12c8e716b66607aeca64a5850b01f99d0b176a7759781ed7' +
+               '7cb1ba40d17ac5c6cb06c942c002c2cf6efcb121f10ad2a45ff781426e7104cbdca73b81865a' +
+               'b22b00ba834355ae485a262f354248932c2be178369a3dd7e2428fdc379346ab2b754c43db65' +
+               '7460cb09c5c48b5810cb7a5c6156cf87440c9e36a4869a8ac458b382fc178915a9ce1bcdda7c' +
+               '48807c207e656ffb80bf33e32bc8c7b20ef60572612ceac99ad1c56ce5a764b29b74c17a5b51' +
+               '0b1afcb18a1afc35c12ac213725325f9b7a2eb338fe4c0080c31a58a995db7027d900e785448' +
+               '87f90ada467d0e383c119c5399310bc6735874e8804ff6c2bae57f2c3357cb627033c12a5924' +
+               'b20ce5abf113172bd2b77086cac543811793bba71734c9f005ac2656460bc30a442b38872575' +
+               '8a623e37ba6e293abfb84f344229f373c214ca776a7c05adc465fed93b9cf77f0022ab71f1ad' +
+               'de369dd8f420a58c057c14cc18dc47da7c12b086473eab419652967001c4e42a381c8ba539a8' +
+               '75d21a9945133bab9bc1e53a600de77cbfb2aeab6b19ced4c6eaa8998ee6a1577255f7132d80' +
+               'a32d6c0c6ec44c9c4b28699a645bb0bc958e00275077925309519b0824c7000dfa61912ec049' +
+               '063a067d00b059053e508a5bfee63473869c8a8510af898cd7572854f5c38af96f5f97a73726' +
+               '32ea7bb4b6fb831c612af71191ff9806b379bcd43c6059b7b1f953741444af713c155d962722' +
+               'b947aa23a32a89b356a6a7508aad63968c1dea78ff18aac27a89aa7b42b0d7481dd3cc649421' +
+               'e51397782218ac5441760ba51a0328d66b436fec32d7aa4d68e0cad1bc14f7241c903480f809' +
+               '983fc2c30d93138cf63b59bc737ac08192893d039187a811bef3d3209eb7b8d1e05b5b251cef' +
+               '760a210b2732867ab32049ba3c354e3858aee7b71df792924730d8e842e484122b50677b0a30' +
+               '6e61cf21b62091da18b937192936a09e5a418cf78b666157dd477af1c36a12320129522840e3' +
+               '70941157808782a5335b0ac10d70e1beafd401074b84b9826cc58aad217bae0f419b2da89613' +
+               '3272d8f22c6f420fcc738fccc1082fc93c7df0994c6bcf2cc8a29037b6bb2b4bcef4b0ee8caf' +
+               '8506bc5ecba082a56806c1cede0b944338a69a668254c1150ae05030e256b2b67661ba027d97' +
+               '576da613ac8c7c29051f1240b96b0c127e264d5e1dbbfe9561a567d5c9103673b446b3ccea6c' +
+               '5f7f34f09348a5d4a58b0498871dc940ee97b50c0336f9a60c3299f99560ac70657a27befa70' +
+               '2265ce590583e04a28326092d3dea2118dd1df5e81d7d3014ec4b5ce67dcb45ef001769dd5d5' +
+               'ada76934d38d740924712bfae672169d8f8744c151346d285fbb653f83aa0f',
+    ciphertext: 'dc63d18bb9715fb6e3ba71cb439fcd3377a75305cc9b144e6758bf5794a272e6b4a0da33234c' +
+                '0ac1bb5b4e60e4c82eb1fb780d59e4e4616641a0595ba031e3ae69d971dcd5fff14e21731a8e' +
+                '1a221f46c7820d214630b707fa1b0de3a484698f3d49e0a75f1212b8c42d330dd909f15eac04' +
+                '02f19ee77fba9447e1c44304b0d8c371c17c5549fdbdec1e0a2e7be9f577d7a4b5b2618d9ba6' +
+                '7ab95a0297cd5c5a13c89cc5a57cbd9a8ae38d66455c9a3d2bc55b498775fee2f6dc224d376d' +
+                '5f526a8354c8ed724f60337e900b85627972383e1fd987d407a8834005814a4fdc94c947e5f3' +
+                '471459288cfb127952b3208f10c914200bbaac5fcebd2bc9e2848492bab17b9288ca8b81d1c2' +
+                'ac9522dcc0b6d5f51e10f3afbb5d65fbf919edef6323c4e92c6b0690c10db25a9182de9e919e' +
+                'a1b3e65ae6150635d5180ebd7d23a2264828bc3ee1fd34dba1924ad0db30c747e05baa9148f1' +
+                'a032769c685e04665fd802a79c4624f69a9198a426eac1b217d903cdacf8844e73365f3a219a' +
+                '700dda27edf6bea33602617c5fd105b301b884bfaaa1163b791ec09f82523fef65c87b75ed06' +
+                '3ceb127729b82c8712e1f41b547d095f55ee71f3f8b47a306cb5d9bdd817854c74a42eebf934' +
+                'a1136dea3fbc546ad8ce51b3171913722f08b0261d197590342bfe4108dcb08c62a98610cbfb' +
+                '8d3b2831f56dcac2220e29a5811f38f0824f21a6cbebc64fd89a09b110dffbe03799ffc74fe5' +
+                '65c80dbf6a66acd7bfd14cb90acba03405a7982d4c1c68caa75f8b72e4dd6401d7dce4db4f6b' +
+                '820a7886a604b66b4e5b9eea5e5eddc2bca458a25977bd1f02874c5d9daf2baf56b3040f24ce' +
+                '7fe14cc14d61c7960db4decb37d9779c8e36d69a7763066d8c1149312d26887a693dc222daa8' +
+                '92dd00cd8f3a558cf605e4c65c011c2e9f0d671ba10af2bb90ee0351ae5078eb7878399ec9eb' +
+                '4ace87a68269618bda12a7aed6fda0385496c5d10ac36b35255f4a31edfa8a2c516b65c63431' +
+                '013ed4909ec7a787a5efb9d3c3887b80ac18a44934b6559bd8a84b18e86fa1b0b9e1d9f92ba4' +
+                '95ba5595d82e5095612b79e805154bf428a7071662c7cefb6450165c6f8f6954c37219bff4a4' +
+                '9894a8aa37f940a40f4ec942c281e6c47ea408199927a724ff1c7460fc8fd47a98d0c9d4d1f0' +
+                '7994d8084f6e084935ad7c2985282fabd5ca13b942e10d35278f4ff4cb1cb96f3c862410e791' +
+                '44a46b4db1a3c3d4d63018ec5c01ca48cb67081482e7d434b4abe5fa3071f2fbb533f745602b' +
+                '0da6183b28e6c5dfa42dab7ae0bbbf7638e106be1bd7312cba399e08c96dbd69a128a2face2d' +
+                '4a02951533a25e82fe63d0aaaa2e8c75150215c93ab06c22f9cab8d1cae7424f8baa09b3260e' +
+                'cfa3c7c8d55a276b4b317f72ec86b1b145a63aca83ef8c1204d8ab0c96ea3f742de39db47020' +
+                '616e139285814f188029ace4587f14cf12b5ed81086d8213cf8cb578341e04e16f519b77ff4c' +
+                '2644a5732639d658d0c4eaf992bd7dbd5011b700a5fa63dc1b24a84a3c80656bab5705dc3a74' +
+                '312c80e8bdb24a7ac6e27bcb8c07ece62c6e5777dd3dc0657181f440c7524d907dd27950bcb2' +
+                '52aef7f8cbf453cee3fe3143a665072c787cea76de323aa41537df2f3a40a518a694b918953b' +
+                'de8d57084e32d3b1fdcf9d153e73f02624beaf6ebe23e6828a6a489583494f3cd790fc96bb6f' +
+                '5d8b198402965e2e668e6581e7cf1c8a47a92198388f2b4cd38df660f0ddd48ad126819c4435' +
+                'af3a12c89113d778ac544fd8079cb8aaa97d2ff1b608da574c4dcd87f4979390de3be405f0e4' +
+                '7788dd0b01662805079fd73c64e9278c036544add3694c838bfcfb08c8a5efb09549442123ea' +
+                'a59fa30fbb9198105f6be00163bac076193f6721c539714108bbfae167f5db8085c5838618f3' +
+                '2a968bbb25c40645a17c17b9bec64aea45832eec5adc25b53e677f67566fbf5ce2d9193a06bd' +
+                '9b477e601d589b25f422defc49105252cd9ca6adcbb36be8a01a8472b4d463f655be14ccff9b' +
+                '0571a2048e31c14b9b23e2d43fafa3f85ece6fd41896cc5c68993dbaa926f285ec94c72887de' +
+                '9564881d735c05f83aa474b3d4cd133a630ac63850771cb5270f6cb7a391170d66af3e4901b6' +
+                'eb0253f3f34ef57d6babd97aa99ce718c3bcb53ff13d4028a0c943bb9681106ce176242cccb7' +
+                '5df1d3f8d3706e5b068b042c3154d5e6292581b36499e6b069b9a490aa67f0675390539da855' +
+                '5e6a4e8a35a86fdfea83e1387bf4acc650ec1edae7c99aa3a48306ee1d1a5e513c0c6901f64d' +
+                '0a3ee285de3c11d49f90cd4323dafda14832f0d8b760c0e5a48633c967cfaf',
+    sharedSecret: '8c028c6ea72a1c59408e2b15dd8fed8008517e861cd2329b159bda1919ea656c',
+  },
+];
+
+const lengths = {
+  'MLKEM768-P256': { publicKey: 1249, ciphertext: 1153, groupElement: 65 },
+  'MLKEM768-X25519': { publicKey: 1216, ciphertext: 1120, groupElement: 32 },
+  'MLKEM1024-P384': { publicKey: 1665, ciphertext: 1665, groupElement: 97 },
+};
+
+async function roundTripViaMessageChannel(key) {
+  const { port1, port2 } = new MessageChannel();
+  port1.postMessage(key);
+  const [received] = await once(port2, 'message');
+  port1.close();
+  port2.close();
+  return received;
+}
+
+function buffers(vector) {
+  return {
+    seed: Buffer.from(vector.seed, 'hex'),
+    publicKey: Buffer.from(vector.publicKey, 'hex'),
+    ciphertext: Buffer.from(vector.ciphertext, 'hex'),
+    sharedSecret: Buffer.from(vector.sharedSecret, 'hex'),
+  };
+}
+
+async function testAlgorithmConfigPrototypePollution() {
+  const properties = [
+    'encapsulationKeyLength',
+    'ciphertextLength',
+    'groupOrder',
+    'namedCurve',
+  ];
+  const descriptors = new Map();
+
+  for (const property of properties) {
+    descriptors.set(
+      property,
+      Object.getOwnPropertyDescriptor(Object.prototype, property));
+    Object.defineProperty(Object.prototype, property, {
+      __proto__: null,
+      configurable: true,
+      get: common.mustNotCall(`Object.prototype.${property} getter`),
+      set: common.mustNotCall(`Object.prototype.${property} setter`),
+    });
+  }
+
+  try {
+    await subtle.generateKey(
+      'MLKEM768-X25519',
+      true,
+      ['encapsulateBits', 'decapsulateBits']);
+  } finally {
+    for (const property of properties) {
+      const descriptor = descriptors.get(property);
+      if (descriptor === undefined) {
+        delete Object.prototype[property];
+      } else {
+        Object.defineProperty(Object.prototype, property, descriptor);
+      }
+    }
+  }
+}
+
+async function testGeneratedRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { ciphertext } = buffers(vector);
+  const keyPair = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateKey', 'encapsulateBits', 'decapsulateKey', 'decapsulateBits']);
+  assert.strictEqual(Object.getPrototypeOf(keyPair), Object.prototype);
+  assert.deepStrictEqual(Object.keys(keyPair), ['publicKey', 'privateKey']);
+  const { privateKey, publicKey } = keyPair;
+
+  assert.strictEqual(publicKey.type, 'public');
+  assert.strictEqual(privateKey.type, 'private');
+  assert.strictEqual(publicKey.algorithm.name, algorithm.name);
+  assert.strictEqual(privateKey.algorithm.name, algorithm.name);
+  assert.deepStrictEqual(publicKey.usages, ['encapsulateKey', 'encapsulateBits']);
+  assert.deepStrictEqual(privateKey.usages, ['decapsulateKey', 'decapsulateBits']);
+
+  for (const key of [publicKey, privateKey]) {
+    assert.throws(() => KeyObject.from(key), {
+      code: 'ERR_INVALID_ARG_VALUE',
+      message: /cannot be represented by a single KeyObject/,
+    });
+  }
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKey);
+  assert.strictEqual(encapsulated.sharedKey.byteLength, 32);
+  assert.strictEqual(encapsulated.ciphertext.byteLength, ciphertext.byteLength);
+
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const encapsulatedKey = await subtle.encapsulateKey(
+    algorithm,
+    publicKey,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  const decapsulatedKey = await subtle.decapsulateKey(
+    algorithm,
+    privateKey,
+    encapsulatedKey.ciphertext,
+    { name: 'HMAC', hash: 'SHA-256' },
+    true,
+    ['sign']);
+  assert(KeyObject.from(encapsulatedKey.sharedKey)
+    .export()
+    .equals(KeyObject.from(decapsulatedKey).export()));
+}
+
+async function testVectorRoundTrip(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext, sharedSecret } = buffers(vector);
+  assert.strictEqual(seed.byteLength, 32);
+  assert.strictEqual(publicKey.byteLength, lengths[vector.name].publicKey);
+  assert.strictEqual(ciphertext.byteLength, lengths[vector.name].ciphertext);
+  assert.strictEqual(sharedSecret.byteLength, 32);
+
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyFromPrivate = await subtle.getPublicKey(
+    privateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', publicKeyFromPrivate))
+    .equals(publicKey));
+
+  const jwk = await subtle.exportKey('jwk', privateKey);
+  assert.strictEqual(jwk.kty, 'AKP');
+  assert.strictEqual(jwk.alg, algorithm.name);
+  assert(Buffer.from(jwk.pub, 'base64url').equals(publicKey));
+  assert(Buffer.from(jwk.priv, 'base64url').equals(seed));
+
+  const publicJwk = await subtle.exportKey('jwk', publicKeyFromPrivate);
+  assert.deepStrictEqual(publicJwk, {
+    kty: 'AKP',
+    alg: algorithm.name,
+    pub: jwk.pub,
+    key_ops: ['encapsulateBits'],
+    ext: true,
+  });
+  const jwkPublicKey = await subtle.importKey(
+    'jwk',
+    publicJwk,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', jwkPublicKey))
+    .equals(publicKey));
+
+  const jwkPrivateKey = await subtle.importKey(
+    'jwk',
+    jwk,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const vectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    jwkPrivateKey,
+    ciphertext);
+  assert(Buffer.from(vectorSharedSecret).equals(sharedSecret));
+
+  const implicitRejectionCiphertext = Buffer.from(ciphertext);
+  const pqCiphertextLength =
+    ciphertext.byteLength - lengths[vector.name].groupElement;
+  implicitRejectionCiphertext.fill(0, 0, pqCiphertextLength);
+  // Preserve the valid traditional group element so this only exercises
+  // ML-KEM implicit rejection.
+  assert(implicitRejectionCiphertext.subarray(pqCiphertextLength)
+    .equals(ciphertext.subarray(pqCiphertextLength)));
+
+  const implicitRejectionSharedSecret = Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext));
+  assert.strictEqual(implicitRejectionSharedSecret.byteLength, 32);
+  assert(!implicitRejectionSharedSecret.equals(sharedSecret));
+  assert(implicitRejectionSharedSecret.equals(Buffer.from(
+    await subtle.decapsulateBits(
+      algorithm,
+      privateKey,
+      implicitRejectionCiphertext))));
+
+  const publicKeyOnly = await subtle.importKey(
+    'raw-public',
+    publicKey,
+    algorithm,
+    true,
+    ['encapsulateBits']);
+  const clonedPrivateKey = structuredClone(privateKey);
+  const clonedPublicKey = structuredClone(publicKeyOnly);
+  const portPrivateKey = await roundTripViaMessageChannel(privateKey);
+  const portPublicKey = await roundTripViaMessageChannel(publicKeyOnly);
+  assert.deepStrictEqual(clonedPrivateKey, privateKey);
+  assert.deepStrictEqual(clonedPublicKey, publicKeyOnly);
+  assert.deepStrictEqual(portPrivateKey, privateKey);
+  assert.deepStrictEqual(portPublicKey, publicKeyOnly);
+  assert(Buffer.from(await subtle.exportKey('raw-seed', clonedPrivateKey))
+    .equals(seed));
+  assert(Buffer.from(await subtle.exportKey('raw-seed', portPrivateKey))
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', clonedPrivateKey)).priv, 'base64url')
+    .equals(seed));
+  assert(Buffer.from((await subtle.exportKey('jwk', portPrivateKey)).priv, 'base64url')
+    .equals(seed));
+
+  const clonedPublicKeyFromPrivate = await subtle.getPublicKey(
+    clonedPrivateKey,
+    ['encapsulateBits']);
+  assert(Buffer.from(await subtle.exportKey('raw-public', clonedPublicKeyFromPrivate))
+    .equals(publicKey));
+
+  const clonedVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    ciphertext);
+  assert(Buffer.from(clonedVectorSharedSecret).equals(sharedSecret));
+  const portVectorSharedSecret = await subtle.decapsulateBits(
+    algorithm,
+    portPrivateKey,
+    ciphertext);
+  assert(Buffer.from(portVectorSharedSecret).equals(sharedSecret));
+
+  const { publicKey: differentPublicKey } = await subtle.generateKey(
+    algorithm,
+    true,
+    ['encapsulateBits', 'decapsulateBits']);
+  assert.notDeepStrictEqual(publicKeyOnly, differentPublicKey);
+
+  const encapsulated = await subtle.encapsulateBits(algorithm, publicKeyOnly);
+  const decapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(decapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+  const clonedDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    clonedPrivateKey,
+    encapsulated.ciphertext);
+  assert(Buffer.from(clonedDecapsulated).equals(Buffer.from(encapsulated.sharedKey)));
+
+  const clonedEncapsulated = await subtle.encapsulateBits(algorithm, clonedPublicKey);
+  const originalDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    clonedEncapsulated.ciphertext);
+  assert(Buffer.from(originalDecapsulated).equals(Buffer.from(clonedEncapsulated.sharedKey)));
+
+  const portEncapsulated = await subtle.encapsulateBits(algorithm, portPublicKey);
+  const portDecapsulated = await subtle.decapsulateBits(
+    algorithm,
+    privateKey,
+    portEncapsulated.ciphertext);
+  assert(Buffer.from(portDecapsulated).equals(Buffer.from(portEncapsulated.sharedKey)));
+}
+
+async function testFailures(vector) {
+  const algorithm = { name: vector.name };
+  const { seed, publicKey, ciphertext } = buffers(vector);
+  const privateKey = await subtle.importKey(
+    'raw-seed',
+    seed,
+    algorithm,
+    true,
+    ['decapsulateBits']);
+  const publicKeyOnly = await subtle.getPublicKey(privateKey, ['encapsulateBits']);
+  const jwk = await subtle.exportKey('jwk', privateKey);
+
+  // JWK key usage validation precedes `key_ops` validation.
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['encapsulateBits', 'encapsulateBits'] },
+      algorithm,
+      true,
+      ['encapsulateBits']),
+    {
+      name: 'SyntaxError',
+      message: `Unsupported key usage for ${vector.name} key`,
+    });
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, key_ops: ['decapsulateBits', 'decapsulateBits'] },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError', message: 'Duplicate key operation' });
+
+  await assert.rejects(
+    subtle.importKey('raw-public', Buffer.alloc(publicKey.byteLength - 1), algorithm, true, ['encapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', Buffer.alloc(seed.byteLength - 1), algorithm, true, ['decapsulateBits']),
+    { name: 'DataError' });
+  await assert.rejects(
+    subtle.importKey('raw-public', publicKey, algorithm, true, ['decapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw-seed', seed, algorithm, true, ['encapsulateBits']),
+    { name: 'SyntaxError' });
+  await assert.rejects(
+    subtle.importKey('raw', publicKey, algorithm, true, ['encapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.importKey('raw-private', seed, algorithm, true, ['decapsulateBits']),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('spki', publicKeyOnly),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.exportKey('pkcs8', privateKey),
+    { name: 'NotSupportedError' });
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, Buffer.alloc(ciphertext.byteLength - 1)),
+    { name: 'OperationError' });
+
+  const badCiphertext = Buffer.from(ciphertext);
+  badCiphertext.fill(
+    0,
+    badCiphertext.byteLength - lengths[vector.name].groupElement);
+  await assert.rejects(
+    subtle.decapsulateBits(algorithm, privateKey, badCiphertext),
+    { name: 'OperationError' });
+
+  if (vector.name !== 'MLKEM768-X25519') {
+    const groupElementLength = lengths[vector.name].groupElement;
+    const nonCanonicalPublicKey = Buffer.from(publicKey);
+    const publicKeyPointOffset =
+      nonCanonicalPublicKey.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalPublicKey[publicKeyPointOffset], 0x04);
+    nonCanonicalPublicKey[publicKeyPointOffset] =
+      0x06 | (nonCanonicalPublicKey[nonCanonicalPublicKey.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.importKey(
+        'raw-public',
+        nonCanonicalPublicKey,
+        algorithm,
+        true,
+        ['encapsulateBits']),
+      { name: 'DataError' });
+
+    const nonCanonicalCiphertext = Buffer.from(ciphertext);
+    const ciphertextPointOffset =
+      nonCanonicalCiphertext.byteLength - groupElementLength;
+    assert.strictEqual(nonCanonicalCiphertext[ciphertextPointOffset], 0x04);
+    nonCanonicalCiphertext[ciphertextPointOffset] =
+      0x06 | (nonCanonicalCiphertext[nonCanonicalCiphertext.byteLength - 1] & 1);
+    await assert.rejects(
+      subtle.decapsulateBits(algorithm, privateKey, nonCanonicalCiphertext),
+      { name: 'OperationError' });
+  }
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, alg: 'ML-KEM-768' },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+
+  const badPublicKey = Buffer.from(publicKey);
+  badPublicKey[0] ^= 1;
+  await assert.rejects(
+    subtle.importKey(
+      'jwk',
+      { ...jwk, pub: badPublicKey.toString('base64url') },
+      algorithm,
+      true,
+      ['decapsulateBits']),
+    { name: 'DataError' });
+}
+
+function testSupports(vector) {
+  const algorithm = { name: vector.name };
+  assert(SubtleCrypto.supports('generateKey', algorithm));
+  assert(SubtleCrypto.supports('importKey', algorithm));
+  assert(SubtleCrypto.supports('exportKey', algorithm));
+  assert(SubtleCrypto.supports('getPublicKey', algorithm));
+  assert(SubtleCrypto.supports('encapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('decapsulateBits', algorithm));
+  assert(SubtleCrypto.supports('encapsulateKey', algorithm, 'HKDF'));
+  assert(SubtleCrypto.supports('decapsulateKey', algorithm, 'HKDF'));
+  assert(!SubtleCrypto.supports('sign', algorithm));
+}
+
+(async () => {
+  await testAlgorithmConfigPrototypePollution();
+  for (const vector of vectors) {
+    testSupports(vector);
+    await testGeneratedRoundTrip(vector);
+    await testVectorRoundTrip(vector);
+    await testFailures(vector);
+  }
+})().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-keygen.js b/test/parallel/test-webcrypto-keygen.js
index 6e264031c4d1..e63ea8dfc7da 100644
--- a/test/parallel/test-webcrypto-keygen.js
+++ b/test/parallel/test-webcrypto-keygen.js
@@ -6,7 +6,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { types: { isCryptoKey } } = require('util');
@@ -158,7 +158,7 @@ const vectors = {
   },
 };
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   vectors.Ed448 = {
     result: 'CryptoKeyPair',
     usages: [
@@ -200,7 +200,7 @@ if (hasOpenSSL(3)) {
   }
 }
 
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
     vectors[name] = {
       result: 'CryptoKeyPair',
@@ -504,7 +504,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
 
   let fipsExponentTest;
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     if (fips3) {
       fipsExponentTest = assert.rejects(
         subtle.generateKey({
@@ -722,7 +722,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
     [1024, 'SHA-512', ['sign', 'verify']],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       [256, 'SHA3-256', ['sign', 'verify']],
       [384, 'SHA3-384', ['sign', 'verify']],
@@ -808,7 +808,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
     ],
   ];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.push(
       [
         'Ed448',
@@ -836,7 +836,7 @@ assert.throws(() => new CryptoKey(), { code: 'ERR_ILLEGAL_CONSTRUCTOR' });
 }
 
 // Test ML-DSA Key Generation
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(
     name,
     privateUsages,
@@ -879,7 +879,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 }
 
 // Test ML-KEM Key Generation
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(
     name,
     privateUsages,
@@ -916,7 +916,7 @@ if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
 
   const kTests = ['ML-KEM-768', 'ML-KEM-1024'];
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     kTests.unshift('ML-KEM-512');
   } else {
     common.printSkipMessage('Skipping unsupported ML-KEM-512 test');
diff --git a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
index f25acd356e33..712b2745c078 100644
--- a/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
+++ b/test/parallel/test-webcrypto-promise-prototype-pollution.mjs
@@ -878,6 +878,19 @@ for (const name of [
   }));
 }
 
+for (const name of [
+  'MLKEM768-P256',
+  'MLKEM768-X25519',
+  'MLKEM1024-P384',
+]) {
+  addFixture(name, kemFixture({
+    name,
+    generateAlgorithm: algorithm(name),
+    importAlgorithm: algorithm(name),
+    spki: false,
+  }));
+}
+
 for (const name of ['HKDF', 'PBKDF2']) {
   addFixture(name, kdfFixture({
     name,
diff --git a/test/parallel/test-webcrypto-sign-verify-eddsa.js b/test/parallel/test-webcrypto-sign-verify-eddsa.js
index e34a3d43d2a3..2c1b0bd44001 100644
--- a/test/parallel/test-webcrypto-sign-verify-eddsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-eddsa.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -31,7 +31,7 @@ const smallOrderVerifyVectors = [
   },
 ];
 
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   smallOrderVerifyVectors.push({
     name: 'Ed448',
     publicKey: Buffer.concat([Buffer.from([1]), Buffer.alloc(56)]),
diff --git a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
index ba6eab08efb1..6925c0782f81 100644
--- a/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-ml-dsa.js
@@ -5,9 +5,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl)
+if (!hasOpenSSL(3, 5) && !isBoringSSL)
   common.skip('requires OpenSSL >= 3.5 or BoringSSL');
 
 const assert = require('assert');
diff --git a/test/parallel/test-webcrypto-sign-verify-rsa.js b/test/parallel/test-webcrypto-sign-verify-rsa.js
index 12633cd50de2..5b5fc7a69e82 100644
--- a/test/parallel/test-webcrypto-sign-verify-rsa.js
+++ b/test/parallel/test-webcrypto-sign-verify-rsa.js
@@ -6,7 +6,7 @@ if (!common.hasCrypto)
   common.skip('missing crypto');
 
 const assert = require('assert');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 const { subtle } = globalThis.crypto;
 const fips3 = hasFIPS(3);
 const rejectsSha1Signing = hasFIPS(3) && !hasFIPS(3, 5);
@@ -269,7 +269,7 @@ async function testSaltLength(keyLength, hash, hLen) {
       ['SHA-256', 32],
       ['SHA-384', 48],
       ['SHA-512', 64],
-      ...(!process.features.openssl_is_boringssl ? [
+      ...(!isBoringSSL ? [
         ['SHA3-256', 32],
         ['SHA3-384', 48],
         ['SHA3-512', 64],
diff --git a/test/parallel/test-webcrypto-sign-verify.js b/test/parallel/test-webcrypto-sign-verify.js
index db6c9e093872..295f13782389 100644
--- a/test/parallel/test-webcrypto-sign-verify.js
+++ b/test/parallel/test-webcrypto-sign-verify.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { getFips } = require('crypto');
@@ -152,7 +152,7 @@ if (hasOpenSSL(3)) {
 }
 
 // Test Sign/Verify Ed448
-if (!process.features.openssl_is_boringssl) {
+if (!isBoringSSL) {
   async function test(data) {
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
@@ -174,7 +174,7 @@ if (!process.features.openssl_is_boringssl) {
 }
 
 // Test Sign/Verify ML-DSA
-if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+if (hasOpenSSL(3, 5) || isBoringSSL) {
   async function test(name, data) {
     const ec = new TextEncoder();
     const { publicKey, privateKey } = await subtle.generateKey({
diff --git a/test/parallel/test-webcrypto-supports.mjs b/test/parallel/test-webcrypto-supports.mjs
index 6c3b2c640fd7..15874102a22b 100644
--- a/test/parallel/test-webcrypto-supports.mjs
+++ b/test/parallel/test-webcrypto-supports.mjs
@@ -71,6 +71,9 @@ function getSharedKeyLength(alg) {
     case 'ml-kem-512':
     case 'ml-kem-768':
     case 'ml-kem-1024':
+    case 'mlkem768-p256':
+    case 'mlkem768-x25519':
+    case 'mlkem1024-p384':
       return 256;
   }
 }
diff --git a/test/parallel/test-webcrypto-webidl-brand.js b/test/parallel/test-webcrypto-webidl-brand.js
new file mode 100644
index 000000000000..d4d785684906
--- /dev/null
+++ b/test/parallel/test-webcrypto-webidl-brand.js
@@ -0,0 +1,38 @@
+// Flags: --expose-internals
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const { subtle } = globalThis.crypto;
+const { CryptoKey } = require('internal/crypto/keys');
+const { converters } = require('internal/crypto/webidl');
+
+async function main() {
+  const bytes = new Uint8Array(16);
+  const key = await subtle.importKey('raw', bytes, 'AES-GCM', true, ['encrypt']);
+
+  for (const value of [
+    { __proto__: CryptoKey.prototype },
+    { __proto__: key },
+    Object.create(CryptoKey.prototype, Object.getOwnPropertyDescriptors(key)),
+    new Proxy(key, {}),
+  ]) {
+    assert.throws(() => converters.CryptoKey(value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+    await assert.rejects(subtle.exportKey('raw', value), {
+      name: 'TypeError',
+      code: 'ERR_INVALID_ARG_TYPE',
+    });
+  }
+
+  Object.setPrototypeOf(key, null);
+  assert.strictEqual(converters.CryptoKey(key), key);
+  assert.deepStrictEqual(new Uint8Array(await subtle.exportKey('raw', key)), bytes);
+}
+
+main().then(common.mustCall());
diff --git a/test/parallel/test-webcrypto-wrap-unwrap.js b/test/parallel/test-webcrypto-wrap-unwrap.js
index 5ffffe230ac6..60ceffd710c9 100644
--- a/test/parallel/test-webcrypto-wrap-unwrap.js
+++ b/test/parallel/test-webcrypto-wrap-unwrap.js
@@ -5,7 +5,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-const { hasOpenSSL, hasFIPS } = require('../common/crypto');
+const { hasOpenSSL, hasFIPS, isBoringSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { getFips } = require('crypto');
@@ -206,7 +206,7 @@ async function generateKeysToWrap() {
     },
   ];
 
-  if (hasOpenSSL(3, 5) || process.features.openssl_is_boringssl) {
+  if (hasOpenSSL(3, 5) || isBoringSSL) {
     for (const name of ['ML-DSA-44', 'ML-DSA-65', 'ML-DSA-87']) {
       parameters.push({
         algorithm: { name },
@@ -217,7 +217,7 @@ async function generateKeysToWrap() {
     }
   }
 
-  if (!process.features.openssl_is_boringssl) {
+  if (!isBoringSSL) {
     parameters.push(
       {
         algorithm: {
diff --git a/test/parallel/test-whatwg-webstreams-adapters-streambase.js b/test/parallel/test-whatwg-webstreams-adapters-streambase.js
index bd864ab8c141..8a42dd6a9b76 100644
--- a/test/parallel/test-whatwg-webstreams-adapters-streambase.js
+++ b/test/parallel/test-whatwg-webstreams-adapters-streambase.js
@@ -35,6 +35,8 @@ const {
 {
   const buf = Buffer.from('hello');
   const check = new Uint8Array(buf);
+  const buf2 = Buffer.from('world');
+  const check2 = new Uint8Array(buf2);
 
   const stream = new JSStream();
 
@@ -47,13 +49,20 @@ const {
     assert.deepStrictEqual(new Uint8Array(value), check);
 
     reader.read().then(common.mustCall(({ done, value }) => {
-      assert(done);
-      assert.strictEqual(value, undefined);
-    }));
+      assert(!done);
+      assert.deepStrictEqual(new Uint8Array(value), check2);
 
+      reader.read().then(common.mustCall(({ done, value }) => {
+        assert(done);
+        assert.strictEqual(value, undefined);
+      }));
+    }));
   }));
 
+  // Two reads land in the same read buffer; the second chunk must be
+  // sliced from its offset within it.
   stream.readBuffer(buf);
+  stream.readBuffer(buf2);
   stream.emitEOF();
 }
 
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index ab91e3345556..47901140cac0 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -10,7 +10,7 @@ const { X509Certificate } = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
 
 // Test that all certificate chains provided by the reporter are rejected.
 {
@@ -59,8 +59,8 @@ const { hasOpenSSL3 } = require('../common/crypto');
     'IP Address:8.8.8.8',
     'IP Address:8.8.4.4',
     // For backward-compatibility, include invalid IP address lengths.
-    hasOpenSSL3 ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
-    hasOpenSSL3 ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
+    hasOpenSSL(3) ? 'IP Address:<invalid length=5>' : 'IP Address:<invalid>',
+    hasOpenSSL(3) ? 'IP Address:<invalid length=6>' : 'IP Address:<invalid>',
     // IPv6 addresses are represented as OpenSSL does.
     'IP Address:A0B:C0D:E0F:0:0:0:7A7B:7C7D',
     // Regular email addresses don't require escaping.
@@ -88,22 +88,22 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // This is an OID that will likely never be assigned to anything, thus
     // OpenSSL should not know it.
     'Registered ID:1.3.9999.12.34',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:XmppAddr:abc123' :
       'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"XmppAddr:abc123\\u002c DNS:good.example.com"' :
       'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"XmppAddr:good.example.com\\u0000abc123"' :
       'othername:<unsupported>',
     // This is unsupported because the OID is not recognized.
     'othername:<unsupported>',
-    hasOpenSSL3 ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
+    hasOpenSSL(3) ? 'othername:SRVName:abc123' : 'othername:<unsupported>',
     // This is unsupported because it is an SRVName with a UTF8String value,
     // which is not allowed for SRVName.
     'othername:<unsupported>',
-    hasOpenSSL3 ?
+    hasOpenSSL(3) ?
       'othername:"SRVName:abc\\u0000def"' :
       'othername:<unsupported>',
   ];
@@ -173,7 +173,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL3 ? {
+    hasOpenSSL(3) ? {
       text: 'OCSP - othername:XmppAddr:good.example.com\n' +
             'OCSP - othername:<unsupported>\n' +
             'OCSP - othername:SRVName:abc123',
@@ -196,7 +196,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
         ],
       },
     },
-    hasOpenSSL3 ? {
+    hasOpenSSL(3) ? {
       text: 'OCSP - othername:"XmppAddr:good.example.com\\u0000abc123"',
       legacy: {
         'OCSP - othername': [
@@ -222,7 +222,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
     // Test the subjectAltName property of the X509Certificate API.
     const cert = new X509Certificate(pem);
     assert.strictEqual(cert.infoAccess,
-                       `${expected.text}${hasOpenSSL3 ? '' : '\n'}`);
+                       `${expected.text}${hasOpenSSL(3) ? '' : '\n'}`);
 
     // Test that the certificate obtained by checkServerIdentity has the correct
     // subjectaltname property.
@@ -439,7 +439,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
 
   // The hostname is the CN, but not a SAN entry.
   const servername = 'good.example.com';
-  const cnFallback = process.features.openssl_is_boringssl ? undefined :
+  const cnFallback = isBoringSSL ? undefined :
     servername;
   const certX509 = new X509Certificate(cert);
   assert.strictEqual(certX509.subject, `CN=${servername}`);
@@ -485,7 +485,7 @@ const { hasOpenSSL3 } = require('../common/crypto');
   assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4');
 
   // The newer X509Certificate API allows customizing this behavior:
-  const cnFallback = process.features.openssl_is_boringssl ? undefined :
+  const cnFallback = isBoringSSL ? undefined :
     servername;
   assert.strictEqual(certX509.checkHost(servername), cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
diff --git a/test/parallel/test-zlib-reject-garbage-after-end.js b/test/parallel/test-zlib-reject-garbage-after-end.js
index 8039865f5f11..5cd36f42c267 100644
--- a/test/parallel/test-zlib-reject-garbage-after-end.js
+++ b/test/parallel/test-zlib-reject-garbage-after-end.js
@@ -23,10 +23,13 @@ function callAsync(fn, input, options) {
   });
 }
 
-async function collect(stream, input) {
+async function collect(stream, ...inputs) {
   const chunks = [];
   stream.on('data', (chunk) => chunks.push(chunk));
-  stream.end(input);
+  for (let i = 0; i < inputs.length - 1; i++) {
+    stream.write(inputs[i]);
+  }
+  stream.end(inputs[inputs.length - 1]);
   await finished(stream);
   return Buffer.concat(chunks);
 }
@@ -79,6 +82,7 @@ const cases = [
     decompressSync: zlib.zstdDecompressSync,
     createDecompress: zlib.createZstdDecompress,
     defaultOutput: 'a',
+    trailingInput: Buffer.from('trailing junk'),
   },
 ];
 
@@ -89,10 +93,14 @@ for (const {
   decompressSync,
   createDecompress,
   defaultOutput,
+  trailingInput,
 } of cases) {
   test(`rejectGarbageAfterEnd rejects trailing input for ${label}`, async () => {
     const compressed = compress(Buffer.from('a'));
-    const withTrailingInput = Buffer.concat([compressed, compressed]);
+    const withTrailingInput = Buffer.concat([
+      compressed,
+      trailingInput ?? compressed,
+    ]);
 
     assert.strictEqual(decompressSync(withTrailingInput).toString(), defaultOutput);
     assert.strictEqual(
@@ -122,6 +130,134 @@ for (const {
   });
 }
 
+test('zstd decompresses concatenated frames regardless of chunking', async () => {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b');
+  const skippable = Buffer.alloc(12);
+  skippable.writeUInt32LE(0x184d2a50, 0);
+  skippable.writeUInt32LE(4, 4);
+  skippable.write('meta', 8);
+
+  for (const input of [
+    Buffer.concat([first, second]),
+    Buffer.concat([first, skippable, second]),
+  ]) {
+    for (const rejectGarbageAfterEnd of [false, true]) {
+      const options = { rejectGarbageAfterEnd };
+      assert.strictEqual(
+        zlib.zstdDecompressSync(input, options).toString(),
+        'ab',
+      );
+      assert.strictEqual(
+        (await callAsync(zlib.zstdDecompress, input, options)).toString(),
+        'ab',
+      );
+
+      for (let split = 0; split <= input.length; split++) {
+        assert.strictEqual(
+          (await collect(
+            zlib.createZstdDecompress(options),
+            input.subarray(0, split),
+            input.subarray(split),
+          )).toString(),
+          'ab',
+          `split at byte ${split}`,
+        );
+      }
+    }
+  }
+});
+
+test('zstd trailing junk handling is independent of chunking', async () => {
+  const compressed = zlib.zstdCompressSync('a');
+  const laterFrame = zlib.zstdCompressSync('b');
+  const junk = Buffer.from('trailing junk');
+
+  assert.strictEqual(
+    (await collect(
+      zlib.createZstdDecompress(),
+      compressed,
+      junk,
+      laterFrame,
+    )).toString(),
+    'a',
+  );
+  await assert.rejects(
+    collect(
+      zlib.createZstdDecompress({ rejectGarbageAfterEnd: true }),
+      compressed,
+      junk,
+    ),
+    trailingJunkError,
+  );
+});
+
+test('zstd handles incomplete trailing frame identifiers as junk', async () => {
+  const compressed = zlib.zstdCompressSync('a');
+  const framePrefix = zlib.zstdCompressSync('b').subarray(0, 3);
+
+  for (let length = 1; length <= framePrefix.length; length++) {
+    const trailing = framePrefix.subarray(0, length);
+    assert.strictEqual(
+      zlib.zstdDecompressSync(Buffer.concat([compressed, trailing])).toString(),
+      'a',
+    );
+    assert.throws(
+      () => zlib.zstdDecompressSync(Buffer.concat([compressed, trailing]), {
+        rejectGarbageAfterEnd: true,
+      }),
+      trailingJunkError,
+    );
+    assert.strictEqual(
+      (await collect(
+        zlib.createZstdDecompress(),
+        compressed,
+        trailing,
+      )).toString(),
+      'a',
+    );
+  }
+});
+
+test('zstd reports errors in subsequent frames', async () => {
+  const first = zlib.zstdCompressSync('a');
+  const second = zlib.zstdCompressSync('b', {
+    params: {
+      [zlib.constants.ZSTD_c_checksumFlag]: 1,
+    },
+  });
+  second[second.length - 1] ^= 1;
+  const input = Buffer.concat([first, second]);
+  const checksumError = { code: 'ZSTD_error_checksum_wrong' };
+
+  assert.throws(() => zlib.zstdDecompressSync(input), checksumError);
+  await assert.rejects(
+    collect(zlib.createZstdDecompress(), first, second),
+    checksumError,
+  );
+});
+
+test('zstd decompresses multiple frames across output buffers', async () => {
+  const firstInput = Buffer.allocUnsafe(1024);
+  const secondInput = Buffer.allocUnsafe(1024);
+  for (let i = 0; i < firstInput.length; i++) {
+    firstInput[i] = i;
+    secondInput[i] = i + 1;
+  }
+  const input = Buffer.concat([
+    zlib.zstdCompressSync(firstInput),
+    zlib.zstdCompressSync(secondInput),
+  ]);
+  const expected = Buffer.concat([firstInput, secondInput]);
+  const options = { chunkSize: 64 };
+
+  assert.deepStrictEqual(zlib.zstdDecompressSync(input, options), expected);
+  assert.deepStrictEqual(
+    await collect(zlib.createZstdDecompress(options), input),
+    expected,
+  );
+});
+
 test('rejectGarbageAfterEnd must be a boolean', () => {
   const compressed = zlib.deflateSync(Buffer.from('a'));
 
diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js
index 03b4a9c831ae..e428df491a34 100644
--- a/test/pummel/test-crypto-dh-hash.js
+++ b/test/pummel/test-crypto-dh-hash.js
@@ -30,9 +30,9 @@ if (common.isPi()) {
   common.skip('Too slow for Raspberry Pi devices');
 }
 
-const { hasOpenSSL3 } = require('../common/crypto');
+const { hasOpenSSL } = require('../common/crypto');
 
-if (!hasOpenSSL3) {
+if (!hasOpenSSL(3)) {
   common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
 }
 
diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js
index 824628732a55..cbfec26d14a1 100644
--- a/test/pummel/test-crypto-dh-keys.js
+++ b/test/pummel/test-crypto-dh-keys.js
@@ -32,7 +32,7 @@ if (common.isPi()) {
 
 const assert = require('assert');
 const crypto = require('crypto');
-const { hasFIPS } = require('../common/crypto');
+const { hasFIPS, isBoringSSL } = require('../common/crypto');
 
 for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17']) {
   // modp1 is 768 bits, FIPS requires >= 1024.
@@ -47,7 +47,7 @@ for (const name of ['modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'mo
     continue;
   }
   if ((name === 'modp1' && crypto.getFips() === 1) ||
-      (process.features.openssl_is_boringssl &&
+      (isBoringSSL &&
        (name === 'modp1' || name === 'modp2'))) {
     common.printSkipMessage(`Skipping unsupported ${name} test case`);
     continue;
diff --git a/test/sea/test-build-sea-vfs-incompatible-options.js b/test/sea/test-build-sea-vfs-incompatible-options.js
new file mode 100644
index 000000000000..3f76beff087d
--- /dev/null
+++ b/test/sea/test-build-sea-vfs-incompatible-options.js
@@ -0,0 +1,77 @@
+// This tests that --build-sea rejects "useVfs" combined with options it
+// does not support.
+
+'use strict';
+
+require('../common');
+const tmpdir = require('../common/tmpdir');
+const { skipIfBuildSEAIsNotSupported } = require('../common/sea');
+const { writeFileSync } = require('fs');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+skipIfBuildSEAIsNotSupported();
+
+// Test: "useVfs" is not a Boolean
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('invalid-useVfs.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": "true"
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" field of .*invalid-useVfs\.json is not a Boolean/,
+    });
+}
+
+// Test: "useVfs" with "useSnapshot"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-snapshot.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useSnapshot": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useSnapshot" is true/,
+    });
+}
+
+// Test: "useVfs" with "useCodeCache"
+{
+  tmpdir.refresh();
+  const config = tmpdir.resolve('vfs-code-cache.json');
+  writeFileSync(config, `
+{
+  "main": "bundle.js",
+  "output": "sea",
+  "useVfs": true,
+  "useCodeCache": true
+}
+  `, 'utf8');
+  spawnSyncAndAssert(
+    process.execPath,
+    ['--build-sea', config], {
+      cwd: tmpdir.path,
+    }, {
+      status: 1,
+      stderr: /"useVfs" is not supported when "useCodeCache" is true/,
+    });
+}
diff --git a/test/sea/test-single-executable-application-vfs-esm.js b/test/sea/test-single-executable-application-vfs-esm.js
new file mode 100644
index 000000000000..b591f6e9d62b
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs-esm.js
@@ -0,0 +1,39 @@
+'use strict';
+
+// This tests the SEA VFS integration with an ESM entry point - the bundled
+// assets are mounted as a virtual file system and the ESM main script runs
+// from inside the mount through the ESM loader.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs-esm'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS ESM tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sea/test-single-executable-application-vfs.js b/test/sea/test-single-executable-application-vfs.js
new file mode 100644
index 000000000000..46a50cd79f86
--- /dev/null
+++ b/test/sea/test-single-executable-application-vfs.js
@@ -0,0 +1,38 @@
+'use strict';
+
+// This tests the SEA VFS integration - the bundled assets are mounted as a
+// virtual file system and the main script runs from inside the mount.
+
+require('../common');
+
+const {
+  buildSEA,
+  skipIfBuildSEAIsNotSupported,
+} = require('../common/sea');
+
+skipIfBuildSEAIsNotSupported();
+
+const tmpdir = require('../common/tmpdir');
+const { spawnSyncAndAssert } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+tmpdir.refresh();
+const outputFile = buildSEA(fixtures.path('sea', 'vfs'));
+
+spawnSyncAndAssert(
+  outputFile,
+  {
+    env: {
+      ...process.env,
+      NODE_DEBUG_NATIVE: undefined,
+    },
+  },
+  {
+    stdout: /All SEA VFS tests passed!/,
+    stderr(stderr) {
+      if (/ExperimentalWarning: VirtualFileSystem/.test(stderr)) {
+        throw new Error('SEA VFS should not emit the public VirtualFileSystem warning');
+      }
+    },
+  },
+);
diff --git a/test/sequential/test-error-serdes.js b/test/sequential/test-error-serdes.js
index acd08903efab..75a37b376ca1 100644
--- a/test/sequential/test-error-serdes.js
+++ b/test/sequential/test-error-serdes.js
@@ -39,6 +39,10 @@ assert.strictEqual(cycle(new ReferenceError('foo')).name, 'ReferenceError');
 assert.strictEqual(cycle(new URIError('foo')).name, 'URIError');
 assert.strictEqual(cycle(new EvalError('foo')).name, 'EvalError');
 assert.strictEqual(cycle(new SyntaxError('foo')).name, 'SyntaxError');
+const aggregate = cycle(new AggregateError([new Error('inner')], 'aggregate'));
+assert(aggregate instanceof AggregateError);
+assert.strictEqual(aggregate.message, 'aggregate');
+assert.strictEqual(aggregate.errors[0].message, 'inner');
 
 class SubError extends Error {}
 
diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
index 2eb6228f79f2..5cb429f47dec 100644
--- a/test/sequential/test-tls-psk-client.js
+++ b/test/sequential/test-tls-psk-client.js
@@ -5,7 +5,9 @@ if (!common.hasCrypto) {
   common.skip('missing crypto');
 }
 
-if (process.features.openssl_is_boringssl) {
+const { isBoringSSL } = require('../common/crypto');
+
+if (isBoringSSL) {
   require('../common/boringssl').testPskTls13Unsupported();
   return;
 }
diff --git a/test/test-runner/test-run-watch-emit-restarted.mjs b/test/test-runner/test-run-watch-emit-restarted.mjs
index 200231c69043..fd596bd818ca 100644
--- a/test/test-runner/test-run-watch-emit-restarted.mjs
+++ b/test/test-runner/test-run-watch-emit-restarted.mjs
@@ -1,5 +1,5 @@
 // Test run({ watch: true }) emits test:watch:restarted when file is updated
-import * as common from '../common/index.mjs';
+import '../common/index.mjs';
 import { run } from 'node:test';
 import assert from 'node:assert';
 import { writeFileSync } from 'node:fs';
@@ -11,9 +11,8 @@ import { refreshForTestRunnerWatch, skipIfNoWatch, fixtureContent } from '../com
 skipIfNoWatch();
 refreshForTestRunnerWatch();
 
-let alreadyDrained = false;
 const events = [];
-const testWatchRestarted = common.mustCall(1);
+let written = false;
 
 const controller = new AbortController();
 const stream = run({
@@ -21,27 +20,24 @@ const stream = run({
   watch: true,
   signal: controller.signal,
 }).on('data', function({ type }) {
-  events.push(type);
-  if (type === 'test:watch:restarted') {
-    testWatchRestarted();
+  if (type !== 'test:watch:restarted' && type !== 'test:watch:drained') {
+    return;
   }
-  if (type === 'test:watch:drained') {
-    if (alreadyDrained) {
-      controller.abort();
-    }
-    alreadyDrained = true;
+  events.push(type);
+  // Watchers with latency (FSEvents) can still report the fixture setup after
+  // the first run has started, so only a restart after the write below counts.
+  if (written && type === 'test:watch:drained' && events.at(-2) === 'test:watch:restarted') {
+    controller.abort();
   }
 });
 
 await once(stream, 'test:watch:drained');
 
+events.length = 0;
+written = true;
 writeFileSync(join(tmpdir.path, 'test.js'), fixtureContent['test.js']);
 
 // eslint-disable-next-line no-unused-vars
 for await (const _ of stream);
 
-assert.partialDeepStrictEqual(events, [
-  'test:watch:drained',
-  'test:watch:restarted',
-  'test:watch:drained',
-]);
+assert.deepStrictEqual(events.slice(-2), ['test:watch:restarted', 'test:watch:drained']);
diff --git a/test/test-runner/test-runner.status b/test/test-runner/test-runner.status
index 149d6ab689cd..7d2d59d3540c 100644
--- a/test/test-runner/test-runner.status
+++ b/test/test-runner/test-runner.status
@@ -14,4 +14,3 @@ test-watch-create-isolation-none: SKIP
 # https://github.com/nodejs/node/issues/54534#issuecomment-5423551021
 test-run-watch-cwd-isolation-none: PASS, FLAKY
 test-run-watch-cwd-isolation-none-argv: PASS, FLAKY
-test-run-watch-emit-restarted: PASS, FLAKY
diff --git a/test/wasi/wasi.status b/test/wasi/wasi.status
index 14b671b6e3b1..a26617e01367 100644
--- a/test/wasi/wasi.status
+++ b/test/wasi/wasi.status
@@ -15,10 +15,3 @@ test-wasi-getrusage: SKIP
 # Unsupported on Windows and Android
 test-wasi-readdir: SKIP
 
-[$system==win32 || $system==macos]
-# https://github.com/nodejs/node/issues/64226#issuecomment-5423585588
-test-wasi-pthread: PASS, FLAKY
-
-[$system==linux]
-# https://github.com/nodejs/node/issues/59146
-test-wasi-pthread: PASS, FLAKY
diff --git a/test/wpt/status/WebCryptoAPI.cjs b/test/wpt/status/WebCryptoAPI.cjs
index 095be39151ef..eb85fa94e63e 100644
--- a/test/wpt/status/WebCryptoAPI.cjs
+++ b/test/wpt/status/WebCryptoAPI.cjs
@@ -3,6 +3,7 @@
 const {
   hasOpenSSL,
   hasFIPS,
+  isBoringSSL,
 } = require('../../common/crypto.js');
 
 const conditionalFileSkips = {};
@@ -10,7 +11,7 @@ const conditionalSubtestSkips = {};
 
 function skip(...files) {
   for (const file of files) {
-    const provider = process.features.openssl_is_boringssl ?
+    const provider = isBoringSSL ?
       'BoringSSL' :
       `OpenSSL ${process.versions.openssl}${hasFIPS(3) ? ' FIPS mode' : ''}`;
     conditionalFileSkips[file] = {
@@ -49,55 +50,63 @@ if (!hasOpenSSL(3, 2) || hasFIPS(3)) {
     'import_export/Argon2_importKey.tentative.https.any.js');
 }
 
-if (!hasOpenSSL(3, 5) && !process.features.openssl_is_boringssl) {
+if (!hasOpenSSL(3, 5) && !isBoringSSL) {
   skip(
     'encap_decap/encap_decap_bits.tentative.https.any.js',
     'encap_decap/encap_decap_keys.tentative.https.any.js',
+    'generateKey/failures_Hybrid-KEM.tentative.https.any.js',
     'generateKey/failures_ML-DSA.tentative.https.any.js',
     'generateKey/failures_ML-KEM.tentative.https.any.js',
+    'generateKey/successes_Hybrid-KEM.tentative.https.any.js',
     'generateKey/successes_ML-DSA.tentative.https.any.js',
     'generateKey/successes_ML-KEM.tentative.https.any.js',
+    'import_export/Hybrid-KEM_importKey.tentative.https.any.js',
     'import_export/ML-DSA_importKey.tentative.https.any.js',
     'import_export/ML-KEM_importKey.tentative.https.any.js',
+    'serialization/hybridkem.tentative.https.window.js',
     'serialization/mldsa.tentative.https.any.js',
     'serialization/mlkem.tentative.https.any.js',
     'sign_verify/mldsa.tentative.https.any.js');
 
   skipSubtests(
-    ['getPublicKey.tentative.https.any.js', /ml-(?:kem|dsa)/i],
+    ['getPublicKey.tentative.https.any.js', /ml-?(?:kem|dsa)/i],
     [
       'supports-modern.tentative.https.any.js',
-      /(?:ml-(?:kem|dsa)|(?:en|de)capsulateKey)/i,
+      /(?:ml-?(?:kem|dsa)|(?:en|de)capsulateKey)/i,
     ]);
 }
 
-if (process.features.openssl_is_boringssl) {
+if (isBoringSSL) {
   skip(
     'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',
     'digest/cshake.tentative.https.any.js',
     'digest/sha3.tentative.https.any.js',
     'generateKey/failures_Ed448.tentative.https.any.js',
+    'generateKey/failures_Hybrid-KEM.tentative.https.any.js',
     'generateKey/failures_X448.tentative.https.any.js',
     'generateKey/successes_Ed448.tentative.https.any.js',
+    'generateKey/successes_Hybrid-KEM.tentative.https.any.js',
     'generateKey/successes_X448.tentative.https.any.js',
+    'import_export/Hybrid-KEM_importKey.tentative.https.any.js',
     'import_export/okp_importKey_Ed448.tentative.https.any.js',
     'import_export/okp_importKey_failures_Ed448.tentative.https.any.js',
     'import_export/okp_importKey_failures_X448.tentative.https.any.js',
     'import_export/okp_importKey_X448.tentative.https.any.js',
     'serialization/ed448.tentative.https.any.js',
+    'serialization/hybridkem.tentative.https.window.js',
     'serialization/x448.tentative.https.any.js',
     'sign_verify/eddsa_curve448.tentative.https.any.js');
 
   skipSubtests(
-    ['encap_decap/encap_decap_bits.tentative.https.any.js', /ml-kem-512/i],
-    ['encap_decap/encap_decap_keys.tentative.https.any.js', /ml-kem-512/i],
+    ['encap_decap/encap_decap_bits.tentative.https.any.js', /(?:ml-kem-512|mlkem)/i],
+    ['encap_decap/encap_decap_keys.tentative.https.any.js', /(?:ml-kem-512|mlkem)/i],
     ['generateKey/failures_ML-KEM.tentative.https.any.js', /ml-kem-512/i],
     ['generateKey/successes_ML-KEM.tentative.https.any.js', /ml-kem-512/i],
-    ['getPublicKey.tentative.https.any.js', /(?:ed448|x448|ml-kem-512)/i],
+    ['getPublicKey.tentative.https.any.js', /(?:ed448|x448|ml-kem-512|mlkem)/i],
     ['import_export/ML-KEM_importKey.tentative.https.any.js', /ml-kem-512/i],
     ['serialization/mlkem.tentative.https.any.js', /ml-kem-512/i],
-    ['supports-modern.tentative.https.any.js', /ml-kem-512/i]);
+    ['supports-modern.tentative.https.any.js', /(?:ml-kem-512|mlkem)/i]);
 }
 
 if (hasFIPS(3)) {
@@ -143,12 +152,16 @@ if (hasFIPS(3, 5)) {
     'derive_bits_keys/cfrg_curves_bits_curve448.tentative.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve25519.https.any.js',
     'derive_bits_keys/cfrg_curves_keys_curve448.tentative.https.any.js',
+    'generateKey/failures_Hybrid-KEM.tentative.https.any.js',
+    'generateKey/successes_Hybrid-KEM.tentative.https.any.js',
     'generateKey/successes_X25519.https.any.js',
     'generateKey/successes_X448.tentative.https.any.js',
+    'import_export/Hybrid-KEM_importKey.tentative.https.any.js',
     'import_export/okp_importKey_X25519.https.any.js',
     'import_export/okp_importKey_X448.tentative.https.any.js',
     'import_export/okp_importKey_failures_X25519.https.any.js',
     'import_export/okp_importKey_failures_X448.tentative.https.any.js',
+    'serialization/hybridkem.tentative.https.window.js',
     'serialization/x25519.https.any.js',
     'serialization/x448.tentative.https.any.js');
 
@@ -157,11 +170,14 @@ if (hasFIPS(3, 5)) {
       'derive_bits_keys/derived_bits_length.https.any.js',
       /^X25519 derivation/,
     ],
-    ['getPublicKey.tentative.https.any.js', /(?:X25519|X448)/],
+    ['encap_decap/encap_decap_bits.tentative.https.any.js', /mlkem/i],
+    ['encap_decap/encap_decap_keys.tentative.https.any.js', /mlkem/i],
+    ['getPublicKey.tentative.https.any.js', /(?:X25519|X448|MLKEM)/],
     [
       'import_export/raw_format_aliases.tentative.https.any.js',
       /(?:X25519|X448)/,
     ],
+    ['supports-modern.tentative.https.any.js', /mlkem/i],
     [
       'supports.tentative.https.any.js',
       /(?:X25519|^deriveKey promise tests|^supports validates the ECDH public key$)/,
diff --git a/test/wpt/status/resource-timing.json b/test/wpt/status/resource-timing.json
index 74de815387ed..0299d6652047 100644
--- a/test/wpt/status/resource-timing.json
+++ b/test/wpt/status/resource-timing.json
@@ -23,25 +23,15 @@
   "idlharness.any.js": {
     "fail": {
       "expected": [
-        "PerformanceResourceTiming interface: attribute firstInterimResponseStart",
-        "PerformanceResourceTiming interface: attribute finalResponseHeadersStart",
-        "PerformanceResourceTiming interface: resource must inherit property \"finalResponseHeadersStart\" with the proper type",
-        "PerformanceResourceTiming interface: attribute renderBlockingStatus",
-        "PerformanceResourceTiming interface: attribute contentType",
-        "PerformanceResourceTiming interface: resource must inherit property \"firstInterimResponseStart\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"renderBlockingStatus\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentType\" with the proper type",
         "PerformanceResourceTiming interface: default toJSON operation on resource",
         "PerformanceResourceTiming interface: attribute workerRouterEvaluationStart",
         "PerformanceResourceTiming interface: attribute workerCacheLookupStart",
         "PerformanceResourceTiming interface: attribute workerMatchedRouterSource",
         "PerformanceResourceTiming interface: attribute workerFinalRouterSource",
-        "PerformanceResourceTiming interface: attribute contentEncoding",
         "PerformanceResourceTiming interface: resource must inherit property \"workerRouterEvaluationStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerCacheLookupStart\" with the proper type",
         "PerformanceResourceTiming interface: resource must inherit property \"workerMatchedRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type",
-        "PerformanceResourceTiming interface: resource must inherit property \"contentEncoding\" with the proper type"
+        "PerformanceResourceTiming interface: resource must inherit property \"workerFinalRouterSource\" with the proper type"
       ]
     }
   }
diff --git a/test/wpt/status/webidl.json b/test/wpt/status/webidl.json
index 73a89a373812..8dcbe1b247c8 100644
--- a/test/wpt/status/webidl.json
+++ b/test/wpt/status/webidl.json
@@ -6,6 +6,18 @@
       ]
     }
   },
+  "ecmascript-binding/es-exceptions/DOMException-stack-accessor.any.js": {
+    "fail": {
+      "note": "needs a V8 update, see https://github.com/nodejs/node/issues/63579",
+      "expected": [
+        "DOMException instance does not have an own stack property",
+        "Error.prototype.stack is an accessor property with correct attributes",
+        "Error.prototype.stack getter works on DOMException instances",
+        "Error.prototype.stack setter installs own data property on DOMException instances",
+        "Error.prototype.stack setter ignores Error.prototype itself"
+      ]
+    }
+  },
   "ecmascript-binding/global-immutable-prototype.any.js": {
     "fail": {
       "expected": [
diff --git a/tools/actions/commit-queue.sh b/tools/actions/commit-queue.sh
index e260773d14a5..0c3c70da89f0 100755
--- a/tools/actions/commit-queue.sh
+++ b/tools/actions/commit-queue.sh
@@ -72,7 +72,7 @@ commit_queue_failed() {
 Add https://github.com/nodejs/node/labels/commit-queue-squash to land it as one commit, or https://github.com/nodejs/node/labels/commit-queue-rebase to land the commits separately.'
   else
     if [ -z "$reported_failure" ]; then
-      reported_failure=$(grep -e '✘' -e '⚠' output | tail -n 10)
+      reported_failure=$(grep -e '✘' -e '✖' -e '⚠' output | tail -n 10)
     fi
     if [ -z "$reported_failure" ]; then
       reported_failure=$(tail -n 10 output)
diff --git a/tools/eslint/package-lock.json b/tools/eslint/package-lock.json
index fc7840daff98..d9f1b6c5e682 100644
--- a/tools/eslint/package-lock.json
+++ b/tools/eslint/package-lock.json
@@ -15,11 +15,11 @@
         "@eslint/js": "^10.0.1",
         "@eslint/markdown": "^8.0.3",
         "@stylistic/eslint-plugin": "^5.10.0",
-        "eslint": "^10.8.0",
+        "eslint": "^10.9.1",
         "eslint-formatter-tap": "^9.0.1",
-        "eslint-plugin-jsdoc": "^63.3.1",
-        "eslint-plugin-regexp": "^3.1.1",
-        "globals": "^17.8.0"
+        "eslint-plugin-jsdoc": "^64.2.1",
+        "eslint-plugin-regexp": "^3.2.0",
+        "globals": "^17.11.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -278,19 +278,31 @@
       }
     },
     "node_modules/@es-joy/jsdoccomment": {
-      "version": "0.90.0",
-      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.90.0.tgz",
-      "integrity": "sha512-51x9KxyTAN6guZOCd+lmcDdkhgdMdP/6iMMtg9dyhCWDc3+iSUyoB7f/9WAM/yGHmGFq25Vd6bXRR7CZcB+tog==",
+      "version": "0.95.1",
+      "resolved": "https://registry.npmjs.org/@es-joy/jsdoccomment/-/jsdoccomment-0.95.1.tgz",
+      "integrity": "sha512-LO/RI08Fo9bhXwB7Od9G+1j3eSNq63+ZS5CQO8YLXHbDg6kx6S/DhTeY0+Fc9uZrjK1zZSyTx8Sg5gv5DIoCnA==",
       "license": "MIT",
       "dependencies": {
         "@types/estree": "^1.0.9",
-        "@typescript-eslint/types": "^8.65.0",
-        "comment-parser": "1.4.7",
+        "@typescript-eslint/types": "^8.67.0",
+        "comment-parser": "1.4.8",
         "esquery": "^1.7.0",
-        "jsdoc-type-pratt-parser": "~7.3.0"
+        "jsdoc-type-pratt-parser": "~9.1.2"
       },
       "engines": {
-        "node": "^20.19.0 || ^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
+      }
+    },
+    "node_modules/@es-joy/jsdoccomment/node_modules/jsdoc-type-pratt-parser": {
+      "version": "9.1.2",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.1.2.tgz",
+      "integrity": "sha512-9EXymowgk1mb9RY1VxuwKc+AhaxfBk2CV0dWxgGM+l5RURTtiUoAx7MlKwcsiVcEXK5HEPa7FeH/tsRpqjEPRg==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9"
+      },
+      "engines": {
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/@es-joy/resolve.exports": {
@@ -447,27 +459,40 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
@@ -642,6 +667,15 @@
       "integrity": "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==",
       "license": "MIT"
     },
+    "node_modules/@types/node": {
+      "version": "26.4.0",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-26.4.0.tgz",
+      "integrity": "sha512-faiGnoIrLH/V8cibOMEAZ8pMw6oXqSukl29ra4mN8GdaB2ZewzeaLj+INpV5N+Z1eKWzY+IzaIZH2EIR6YZRNQ==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~8.3.0"
+      }
+    },
     "node_modules/@types/unist": {
       "version": "3.0.3",
       "resolved": "https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz",
@@ -649,9 +683,9 @@
       "license": "MIT"
     },
     "node_modules/@typescript-eslint/types": {
-      "version": "8.65.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.65.0.tgz",
-      "integrity": "sha512-JSSwWNy+H0E/01jJEM+hrX6N0OFDzFzeIhHFSAS01tlVaevpG8cFyYRPhS5yjGOvBUx3sqQHVMjCL1CAZZMxBg==",
+      "version": "8.69.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.69.0.tgz",
+      "integrity": "sha512-K3VrubUPhlo9VDBS6QdI8YB5j7ClpqLRdefcz6PFrhnwicehBweqQ9Evhl4l+FYz0HdDmMqIiSX0aldGRYtDCA==",
       "license": "MIT",
       "engines": {
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -699,12 +733,12 @@
       }
     },
     "node_modules/are-docs-informative": {
-      "version": "0.0.2",
-      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.0.2.tgz",
-      "integrity": "sha512-ixiS0nLNNG5jNQzgZJNoUpBKdo9yTYZMGJ+QgT2jmjR7G7+QHRCc4v6LQ3NgE7EBJq+o0ams3waJwkrlBom8Ig==",
+      "version": "0.1.1",
+      "resolved": "https://registry.npmjs.org/are-docs-informative/-/are-docs-informative-0.1.1.tgz",
+      "integrity": "sha512-sqRsNQBwbKLRX0jV5Cu5uzmtflf892n4Vukz7T659ebL4pz3mpOqCMU7lxMoBTFwnp10E3YB5ZcyHM41W5bcDA==",
       "license": "MIT",
       "engines": {
-        "node": ">=14"
+        "node": ">=18"
       }
     },
     "node_modules/argparse": {
@@ -723,9 +757,9 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.40",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
-      "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==",
+      "version": "2.11.20",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.20.tgz",
+      "integrity": "sha512-H0ulySigv6icDJ1F7SjtdCD6PrhTpdYCmP0CactWy1+ekh0AFd0o1Wn5T8b+hnTmdBx19u9yhL6wvCylXMY7zw==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -747,9 +781,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
-      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
+      "version": "4.28.8",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.8.tgz",
+      "integrity": "sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==",
       "funding": [
         {
           "type": "opencollective",
@@ -766,11 +800,11 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.38",
-        "caniuse-lite": "^1.0.30001799",
-        "electron-to-chromium": "^1.5.376",
-        "node-releases": "^2.0.48",
-        "update-browserslist-db": "^1.2.3"
+        "baseline-browser-mapping": "^2.11.12",
+        "caniuse-lite": "^1.0.30001809",
+        "electron-to-chromium": "^1.5.402",
+        "node-releases": "^2.0.53",
+        "update-browserslist-db": "^1.3.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -780,9 +814,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001800",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001800.tgz",
-      "integrity": "sha512-MMHtuAz9Ys840zAY5F4k6fV5GaivZ9sPk+nz0mY+GYVzRBnYkN0mpqkSR92oWRQ19yQWo4HvBV/FnC16AJX8MA==",
+      "version": "1.0.30001810",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001810.tgz",
+      "integrity": "sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==",
       "funding": [
         {
           "type": "opencollective",
@@ -829,9 +863,9 @@
       }
     },
     "node_modules/comment-parser": {
-      "version": "1.4.7",
-      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.7.tgz",
-      "integrity": "sha512-0h+uSNtQGW3D98eQt3jJ8L06Fves8hncB4V/PKdw/Qb8Hnk19VaKuTr55UNRYiSoVa7WwrFls+rh3ux9agmkeQ==",
+      "version": "1.4.8",
+      "resolved": "https://registry.npmjs.org/comment-parser/-/comment-parser-1.4.8.tgz",
+      "integrity": "sha512-rKZTGo4fzKYna8UcL0isTg5wkBNla7bxTypLwZQXjIdi++IdP1OJ41rI5Mti3/jltkPujbu4i9LIARYA+zpotQ==",
       "license": "MIT",
       "engines": {
         "node": ">= 12.0.0"
@@ -916,9 +950,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.383",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.383.tgz",
-      "integrity": "sha512-I2484/KkAvl8lm9VyjH2JnbOIV0d/UCqT7gbzs6l+o6Vmn9wgB66uVcKX+Vk6HrXtY6fbWTOEXuv8waDTuFNCw==",
+      "version": "1.5.420",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.420.tgz",
+      "integrity": "sha512-2yD6XreGusOfNV+dUcvipJEXc3n/n7fgr7996aszTG+YY5E4mqM4tOq/3uhP129cazL9YHbVWSpc79ePotWtPA==",
       "license": "ISC"
     },
     "node_modules/empathic": {
@@ -952,9 +986,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.8.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.0.tgz",
-      "integrity": "sha512-nuKKvN+oIBO0koN7Tm7dlkmnkc21mtt0QJLwAKzjLq14y6lRTdVG36MZHJ8eQHwdJMwZbQNMlPOYedMq/oVJvQ==",
+      "version": "10.9.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.9.1.tgz",
+      "integrity": "sha512-9VaAkDURekixUQJy0oJYl2DcN6oKMfxay7XzaGYAWQwsb6qfKf+x76R2k1L8kb1boc+FyCAaTA9GmiKaaiaF+A==",
       "license": "MIT",
       "workspaces": [
         "packages/*"
@@ -1022,17 +1056,17 @@
       }
     },
     "node_modules/eslint-plugin-jsdoc": {
-      "version": "63.3.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-63.3.1.tgz",
-      "integrity": "sha512-yVyTPtOY2tA8EjTwUtaM3pFxj9i/3m4/FSPMv5gMnDHSSleCpzIYQLyV8KnVmEIkkPpNhDlkDQ99mTfjxgqLxA==",
+      "version": "64.2.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jsdoc/-/eslint-plugin-jsdoc-64.2.1.tgz",
+      "integrity": "sha512-6GpSYxLPcbMw38S94Cngrgs1Zv8yLinQS1O17OxJVZ6deLbrMRCERUYQKceweSqEuG2kx5Amn4l3aKPkCp4geQ==",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "@es-joy/jsdoccomment": "~0.90.0",
+        "@es-joy/jsdoccomment": "~0.95.1",
         "@es-joy/resolve.exports": "1.2.0",
-        "are-docs-informative": "^0.0.2",
-        "comment-parser": "1.4.7",
+        "are-docs-informative": "^0.1.1",
+        "comment-parser": "1.4.8",
         "debug": "^4.4.3",
-        "escape-string-regexp": "^4.0.0",
+        "escape-string-regexp": "^5.0.0",
         "espree": "^11.2.0",
         "esquery": "^1.7.0",
         "html-entities": "^2.6.0",
@@ -1043,12 +1077,24 @@
         "to-valid-identifier": "^1.0.0"
       },
       "engines": {
-        "node": "^22.13.0 || >=24"
+        "node": "^22.22.2 || >=24.15.0"
       },
       "peerDependencies": {
         "eslint": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0"
       }
     },
+    "node_modules/eslint-plugin-jsdoc/node_modules/escape-string-regexp": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+      "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/eslint-plugin-jsdoc/node_modules/espree": {
       "version": "11.2.0",
       "resolved": "https://registry.npmjs.org/espree/-/espree-11.2.0.tgz",
@@ -1067,15 +1113,15 @@
       }
     },
     "node_modules/eslint-plugin-regexp": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.1.1.tgz",
-      "integrity": "sha512-MxR5nqoQCtVWmJwia0D2+NlXX1xzdpkslsVOZLEYQ4PQWEaL65PCZXURxaBc3lPnkNFpNxzMIRmYVxdl8giXRA==",
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-regexp/-/eslint-plugin-regexp-3.2.0.tgz",
+      "integrity": "sha512-4yq47CnLxyfHFKJEo5kvNaiJ0aDtBxSJWk4M2LiamplUXdWxdlzDYqImb/ZVCp+2BqkQjBAmw4Xc07Q8SXVDZg==",
       "license": "MIT",
       "dependencies": {
         "@eslint-community/eslint-utils": "^4.2.0",
         "@eslint-community/regexpp": "^4.11.0",
         "comment-parser": "^1.4.0",
-        "jsdoc-type-pratt-parser": "^7.0.0",
+        "jsdoc-type-pratt-parser": "^9.0.0",
         "refa": "^0.12.1",
         "regexp-ast-analysis": "^0.7.1",
         "scslre": "^0.3.0"
@@ -1319,9 +1365,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.8.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.8.0.tgz",
-      "integrity": "sha512-Zz/LMDZScFmkakeL2cTHzf+PbWKdpU3uclqkZT7TjDG58j5WPt0PpA+n9uPI24fZtlw07q0OtEi84K+umsRzqQ==",
+      "version": "17.11.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.11.0.tgz",
+      "integrity": "sha512-Z2I8hM+PbJDXQDq3Icgpzv+mPdwr68iZUU9d5WW4FuXfDUQfkZaZuvjMv42/5crNyw154+9+VWXbYrUgDXbxNw==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -1430,12 +1476,16 @@
       }
     },
     "node_modules/jsdoc-type-pratt-parser": {
-      "version": "7.3.0",
-      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-7.3.0.tgz",
-      "integrity": "sha512-DoyJXo7x/n48M3NsGOs9QnEws0ft0tV3YsSgvWMNxz2hZtz+Q6fpqUD96lVYX4a+jcEkzHeFNDJOn68TzXfbdA==",
+      "version": "9.2.1",
+      "resolved": "https://registry.npmjs.org/jsdoc-type-pratt-parser/-/jsdoc-type-pratt-parser-9.2.1.tgz",
+      "integrity": "sha512-V4Ww4EHnTcTLSOMoB0FsF72JhQvcAsriCm/LWnxJeGWoxIjEL2l9na11abQok5SYShq8m0Gl02el/xAbTCulvQ==",
       "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.9",
+        "@types/node": "^26.4.0"
+      },
       "engines": {
-        "node": ">=20.0.0"
+        "node": "^22.22.2 || >=24.15.0"
       }
     },
     "node_modules/jsesc": {
@@ -2438,9 +2488,9 @@
       "license": "MIT"
     },
     "node_modules/node-releases": {
-      "version": "2.0.50",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
-      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+      "version": "2.0.54",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.54.tgz",
+      "integrity": "sha512-YHs7BmmcsdAI5Ozuf8JZo6PT0mv2GIWC9vMfvUC3dp65M8hn7Ux8CPL+2oBI7juNuj9d0ndhTcznq2ODBps9cQ==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -2715,6 +2765,12 @@
         "node": ">= 0.8.0"
       }
     },
+    "node_modules/undici-types": {
+      "version": "8.3.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-8.3.0.tgz",
+      "integrity": "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ==",
+      "license": "MIT"
+    },
     "node_modules/unist-util-is": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/unist-util-is/-/unist-util-is-6.0.1.tgz",
@@ -2785,9 +2841,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
-      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.3.2.tgz",
+      "integrity": "sha512-UQ+MSxlhRm1bzjhU+DcuXfjFO1FzNtqhK5+9Yvlp90ItDLk5vT932A0rFu619nf7RVS+Y/VeaUW1jaRDqZ8VJw==",
       "funding": [
         {
           "type": "opencollective",
diff --git a/tools/eslint/package.json b/tools/eslint/package.json
index 30b0aa50c84c..c91990303d39 100644
--- a/tools/eslint/package.json
+++ b/tools/eslint/package.json
@@ -10,10 +10,10 @@
     "@eslint/js": "^10.0.1",
     "@eslint/markdown": "^8.0.3",
     "@stylistic/eslint-plugin": "^5.10.0",
-    "eslint": "^10.8.0",
+    "eslint": "^10.9.1",
     "eslint-formatter-tap": "^9.0.1",
-    "eslint-plugin-jsdoc": "^63.3.1",
-    "eslint-plugin-regexp": "^3.1.1",
-    "globals": "^17.8.0"
+    "eslint-plugin-jsdoc": "^64.2.1",
+    "eslint-plugin-regexp": "^3.2.0",
+    "globals": "^17.11.0"
   }
 }
diff --git a/tools/generate_config_gypi.py b/tools/generate_config_gypi.py
index 436767e633e1..d464d4b5859c 100755
--- a/tools/generate_config_gypi.py
+++ b/tools/generate_config_gypi.py
@@ -68,18 +68,19 @@ def translate_config(out_dir, config, v8_config):
           bool_string_to_number(config['node_enable_inspector']),
       'shlib_suffix': 'dylib' if sys.platform == 'darwin' else 'so',
       'tsan': bool_string_to_number(config['is_tsan']),
-      # TODO(zcbenz): Shared components are not supported in GN config yet.
       'node_shared': 'false',
-      'node_shared_brotli': 'false',
-      'node_shared_cares': 'false',
-      'node_shared_http_parser': 'false',
-      'node_shared_libuv': 'false',
-      'node_shared_nghttp2': 'false',
+      'node_shared_brotli': config['node_shared_brotli'],
+      'node_shared_cares': config['node_shared_cares'],
+      'node_shared_hdr_histogram': config['node_shared_hdr_histogram'],
+      'node_shared_http_parser': config['node_shared_http_parser'],
+      'node_shared_libuv': config['node_shared_libuv'],
+      'node_shared_nghttp2': config['node_shared_nghttp2'],
       'node_shared_nghttp3': 'false',
       'node_shared_ngtcp2': 'false',
       'node_shared_openssl': 'false',
-      'node_shared_sqlite': 'false',
+      'node_shared_sqlite': config['node_shared_sqlite'],
       'node_shared_zlib': 'false',
+      'node_shared_zstd': config['node_shared_zstd'],
     }
   }
   config_gypi['variables'].update(v8_config)
diff --git a/tools/nix/devTools.nix b/tools/nix/devTools.nix
index 474e365ceb4e..e33ae720785c 100644
--- a/tools/nix/devTools.nix
+++ b/tools/nix/devTools.nix
@@ -7,7 +7,9 @@
   pkgs.gh
   pkgs.git
   pkgs.jq
+  pkgs.ruff
   pkgs.shellcheck
+  pkgs.yamllint
 ]
 ++ (
   if (ncu-path == null) then
diff --git a/tools/nix/pkgs-26.05.nix b/tools/nix/pkgs-26.05.nix
index ad1278343aab..6e406d6b708b 100644
--- a/tools/nix/pkgs-26.05.nix
+++ b/tools/nix/pkgs-26.05.nix
@@ -1,10 +1,10 @@
 arg:
 let
   repo = "https://github.com/NixOS/nixpkgs";
-  rev = "f6107e546a5012172d93e79f1f7950da02ad798f";
+  rev = "c19db427a1fdfc7591c0b0baeb4665dcef2c61da";
   nixpkgs = import (builtins.fetchTarball {
     url = "${repo}/archive/${rev}.tar.gz";
-    sha256 = "04n8l03dspn0747lc2vhkzbxbjc9wyx0ay959wdj35qnpyzxap5w";
+    sha256 = "0chqd1d3hbqwnz7arg5lh6iqv13n13zlhia52wxn72h3r5mi5jcy";
   }) arg;
 in
 # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel
diff --git a/tools/nix/pkgs.nix b/tools/nix/pkgs.nix
index 6f9b5043d9b6..f93caa4d2a16 100644
--- a/tools/nix/pkgs.nix
+++ b/tools/nix/pkgs.nix
@@ -1,10 +1,10 @@
 arg:
 let
   repo = "https://github.com/NixOS/nixpkgs";
-  rev = "0e7911a191ea0fb9d6e8e771d24736d3618f8b1f";
+  rev = "e5ead30d0824debba629dcf0720abeddee57b7d6";
   nixpkgs = import (builtins.fetchTarball {
     url = "${repo}/archive/${rev}.tar.gz";
-    sha256 = "13ry2zkl0bbh7k7l0fpkb4xjsglzr3mzshvpcw4j9fn4s66jbmrq";
+    sha256 = "0sydiakqjp2qhr8h573bv48ng8928rjpwkx600xmxvsyz8kwczn1";
   }) arg;
 in
 # Unstable channel no longer supports Intel architecture for macOS. We can use the 26.05 channel
diff --git a/tools/nix/sharedLibDeps.nix b/tools/nix/sharedLibDeps.nix
index 788e9efedeb8..d57ceb4918bb 100644
--- a/tools/nix/sharedLibDeps.nix
+++ b/tools/nix/sharedLibDeps.nix
@@ -5,6 +5,7 @@
   withSQLite ? true,
   withSSL ? true,
   withFFI ? true,
+  withPerfetto ? false,
   withTemporal ? false,
 }:
 {
@@ -15,22 +16,18 @@
     libuv
     merve
     nbytes
+    nghttp2
     simdjson
     simdutf
     uvwasi
     zlib
     zstd
     ;
+  abseil = pkgs.abseil-cpp;
   cares = pkgs.c-ares;
   hdr-histogram = pkgs.hdrhistogram_c;
+  highway = pkgs.libhwy;
   http-parser = pkgs.llhttp;
-  nghttp2 = pkgs.nghttp2.overrideAttrs {
-    version = "1.69.0";
-    src = pkgs.fetchurl {
-      url = "https://github.com/nghttp2/nghttp2/releases/download/v1.69.0/nghttp2-1.69.0.tar.bz2";
-      hash = "sha256-PxhfWxw+d4heuc8/LE2ksan3OiS/WVe4KRg60Tf4Lcg=";
-    };
-  };
 }
 // (pkgs.lib.optionalAttrs withLief {
   inherit (pkgs) lief;
@@ -50,6 +47,9 @@
 // (pkgs.lib.optionalAttrs withSSL ({
   inherit (import ./openssl-matrix.nix { inherit pkgs; }) openssl;
 }))
+// (pkgs.lib.optionalAttrs withPerfetto {
+  perfetto = pkgs.perfetto.sdk;
+})
 // (pkgs.lib.optionalAttrs withTemporal {
   inherit (pkgs) temporal_capi;
 })
diff --git a/tools/nix/v8.nix b/tools/nix/v8.nix
index 90dadd336c8d..3c3c3ab47347 100644
--- a/tools/nix/v8.nix
+++ b/tools/nix/v8.nix
@@ -23,6 +23,8 @@
 }:
 
 let
+  useSharedAbseil = builtins.elem "--shared-abseil" configureFlags;
+  useSharedHighway = builtins.elem "--shared-highway" configureFlags;
   src =
     let
       inherit (lib) fileset;
@@ -35,7 +37,6 @@ let
         ../../node.gypi
         ../../tools/gyp/pylib
         ../../tools/gyp_node.py
-        ../../tools/v8_gypfiles/abseil.gyp
         ../../tools/v8_gypfiles/features.gypi
         ../../tools/v8_gypfiles/ForEachFormat.py
         ../../tools/v8_gypfiles/ForEachReplace.py
@@ -44,9 +45,12 @@ let
         ../../tools/v8_gypfiles/toolchain.gypi
         ../../tools/v8_gypfiles/v8.gyp
       ]
-      ++ lib.optionals (builtins.elem "--with-perfetto" configureFlags) [
-        ../../deps/perfetto
-      ]
+      ++ lib.optional (!useSharedAbseil) ../../tools/v8_gypfiles/abseil.gyp
+      ++ lib.optional (!useSharedHighway) ../../tools/v8_gypfiles/highway.gyp
+      ++ lib.optional (
+        builtins.elem "--with-perfetto" configureFlags
+        && !(builtins.elem "--shared-perfetto" configureFlags)
+      ) ../../deps/perfetto
       ++ lib.optionals (icu != null) [
         ../../tools/icu/icu_versions.json
         ../../tools/icu/icu-system.gyp
@@ -63,12 +67,16 @@ let
       potentiallyAlreadyRemovedFiles =
         # Files that are removed in the release tarball (see Makefile $(TARBALL) target)
         [ (fileset.difference ../../deps/v8/test ../../deps/v8/test/torque) ]
-        ++ (builtins.filter builtins.pathExists [
-          ../../deps/v8/samples
-          ../../deps/v8/tools/profviz
-          ../../deps/v8/tools/run-tests.py
-          ../../deps/v8/third_party/ittapi
-        ]);
+        ++ (builtins.filter builtins.pathExists (
+          [
+            ../../deps/v8/samples
+            ../../deps/v8/tools/profviz
+            ../../deps/v8/tools/run-tests.py
+            ../../deps/v8/third_party/ittapi
+          ]
+          ++ lib.optional useSharedAbseil ../../deps/v8/third_party/abseil-cpp
+          ++ lib.optional useSharedHighway ../../deps/v8/third_party/highway
+        ));
       trackedFiles =
         ({
           # This line is being modified by Makefile $(TARBALL) target, any change to it should be sync
@@ -197,9 +205,11 @@ stdenv.mkDerivation (finalAttrs: {
     find deps/v8/include -name '*.h' -print0 | while read -r -d "" file; do
       install -Dm644 "$file" -T "$out/include/''${file#deps/v8/include/}"
     done
-    find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
-      install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
-    done
+    ${lib.optionalString (!useSharedAbseil) ''
+      find deps/v8/third_party/abseil-cpp/absl -name '*.h' -print0 | while read -r -d "" file; do
+        install -Dm644 "$file" -T "$out/include/''${file#deps/v8/third_party/abseil-cpp/}"
+      done
+    ''}
 
     mkdir -p $out/lib/pkgconfig
     cat -> $out/lib/pkgconfig/v8.pc << EOF
diff --git a/tools/v8_gypfiles/d8.gyp b/tools/v8_gypfiles/d8.gyp
index 5b47ebf180dd..f59a155b169c 100644
--- a/tools/v8_gypfiles/d8.gyp
+++ b/tools/v8_gypfiles/d8.gyp
@@ -16,7 +16,6 @@
       'target_name': 'd8',
       'type': 'executable',
       'dependencies': [
-        'abseil.gyp:abseil',
         'v8.gyp:v8',
         'v8.gyp:v8_libbase',
         'v8.gyp:v8_libplatform',
@@ -77,6 +76,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },
   ],
diff --git a/tools/v8_gypfiles/highway.gyp b/tools/v8_gypfiles/highway.gyp
new file mode 100644
index 000000000000..c7f915b76e2f
--- /dev/null
+++ b/tools/v8_gypfiles/highway.gyp
@@ -0,0 +1,58 @@
+{
+  'includes': ['toolchain.gypi'],
+  'targets': [
+    {
+      'target_name': 'highway',
+      'type': 'static_library',
+      'toolsets': ['host', 'target'],
+      'variables': {
+        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
+      },
+      'all_dependent_settings': {
+        'include_dirs': [
+          '<(HIGHWAY_ROOT)/src',
+        ],
+        'conditions': [
+          ['v8_target_arch=="ia32"', {
+            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+          }],
+          ['v8_target_arch=="arm64"', {
+            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+          }],
+          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+          }],
+          ['v8_target_arch=="s390x"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['OS in "aix os400"', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+          ['v8_target_arch=="arm" and arm_version==7', {
+            'defines': ['HWY_BROKEN_EMU128=0',],
+          }],
+        ],
+      },
+      'include_dirs': [
+        '<(HIGHWAY_ROOT)/src',
+      ],
+      'conditions': [
+        ['v8_target_arch=="ia32"', {
+          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
+        }],
+        ['v8_target_arch=="arm64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
+        }],
+        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
+          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
+        }],
+        ['v8_target_arch=="riscv64"', {
+          'defines': ['HWY_BROKEN_TARGETS=HWY_RVV',],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
+      ],
+    },  # highway
+  ],
+}
diff --git a/tools/v8_gypfiles/v8.gyp b/tools/v8_gypfiles/v8.gyp
index 32fc99e2af9f..819dffb88984 100644
--- a/tools/v8_gypfiles/v8.gyp
+++ b/tools/v8_gypfiles/v8.gyp
@@ -62,7 +62,9 @@
           'BUILDING_V8_PLATFORM_SHARED',  # Make V8_PLATFORM_EXPORT visible.
         ]
       }],
-      ['node_shared=="true"', {
+      # The V8 static libraries get linked into libv8_debug_helper too, and
+      # the local-exec TLS model is only valid in an executable.
+      ['node_shared=="true" or node_enable_v8debughelper=="true"', {
         'defines': [
           'V8_TLS_USED_IN_LIBRARY',  # Enable V8_TLS_LIBRARY_MODE.
         ],
@@ -288,17 +290,19 @@
         'v8_base_without_compiler',
         'v8_initializers',
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<(V8_ROOT)/src/init/setup-isolate-full.cc',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_init
     {
@@ -310,7 +314,6 @@
         'v8_base_without_compiler',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'include_dirs': [
         '<(SHARED_INTERMEDIATE_DIR)',
@@ -320,7 +323,7 @@
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_initializers.*?sources = ")',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -390,6 +393,9 @@
              '<(V8_ROOT)/src/builtins/builtins-intl-gen.cc',
            ],
          }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_initializers
     {
@@ -492,7 +498,7 @@
         },
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -508,7 +514,6 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }, {
           'dependencies': [
@@ -521,9 +526,11 @@
             'v8_compiler_for_mksnapshot',
             'v8_initializers',
             'v8_libplatform',
-            'abseil.gyp:abseil',
           ]
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
         ['OS=="win" and clang==1', {
           'actions': [
             {
@@ -636,8 +643,14 @@
         'run_torque',
         'v8_libbase',
         'fp16',
-        'highway',
-        'abseil.gyp:abseil',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        ['node_shared_highway=="false"', {
+          'dependencies': ['highway.gyp:highway'],
+        }]
       ],
       'direct_dependent_settings': {
         'sources': [
@@ -983,10 +996,9 @@
         'v8_libbase',
         'v8_shared_internal_headers',
         'v8_pch',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1001,6 +1013,9 @@
         }, {
           'sources': ['<(V8_ROOT)/src/compiler/turbofan-disabled.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_compiler
     {
@@ -1104,7 +1119,6 @@
         'v8_zlib',
         'v8_pch',
         'simdutf',
-        'abseil.gyp:abseil',
       ],
       'includes': ['inspector.gypi'],
       'direct_dependent_settings': {
@@ -1125,8 +1139,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_base_without_compiler.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_snapshot_compression==1', {
@@ -1391,6 +1409,9 @@
             'libraries': ['-latomic', ],
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_base_without_compiler
     {
@@ -1412,7 +1433,6 @@
       'dependencies': [
         'v8_shared_internal_headers',
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1438,6 +1458,9 @@
           'cflags!': ['-O3'],
           'sources': ['<(V8_ROOT)/src/torque/implementation-visitor.cc'],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # torque_base
     {
@@ -1477,7 +1500,6 @@
 
       'dependencies': [
         'v8_headers',
-        'abseil.gyp:abseil',
       ],
 
       'conditions': [
@@ -1718,6 +1740,9 @@
           ],
         }
          ],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # v8_libbase
     {
@@ -1726,7 +1751,6 @@
       'toolsets': ['host', 'target'],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
       ],
       'sources': [
         '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?sources = ")',
@@ -1745,8 +1769,12 @@
           'sources': [
             '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/BUILD.gn"  "\\"v8_libplatform.*?v8_use_perfetto.*?sources \\+= ")',
           ],
-          'dependencies': [
-            '<(perfetto_gyp_file):perfetto_sdk',
+          'conditions': [
+            ['node_shared_perfetto=="false"', {
+              'dependencies': [
+                '<(perfetto_gyp_file):perfetto_sdk',
+              ],
+            }],
           ],
         }],
         ['v8_enable_system_instrumentation==1 and is_win', {
@@ -1761,6 +1789,9 @@
             '<(V8_ROOT)/src/libplatform/tracing/recorder-mac.cc',
           ],
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'direct_dependent_settings': {
         'include_dirs': [
@@ -1801,6 +1832,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         'BUILDING_V8_SHARED=1',
@@ -1808,7 +1842,6 @@
       ],
       'dependencies': [
         'v8_libbase',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1831,7 +1864,6 @@
         'v8_libplatform',
         'v8_maybe_icu',
         'v8_pch',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'sources': [
@@ -1856,7 +1888,7 @@
         },
       },
       'conditions': [
-        ['v8_use_perfetto==1', {
+        ['v8_use_perfetto==1 and node_shared_perfetto=="false"', {
           'dependencies': [
             '<(perfetto_gyp_file):perfetto_sdk',
           ],
@@ -1878,6 +1910,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
     },  # mksnapshot
     {
@@ -1885,7 +1920,6 @@
       'type': 'executable',
       'dependencies': [
         'torque_base',
-        'abseil.gyp:abseil',
         # "build/win:default_exe_manifest",
       ],
       'conditions': [
@@ -1906,6 +1940,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'defines!': [
         '_HAS_EXCEPTIONS=0',
@@ -1983,7 +2020,6 @@
         'v8_libbase',
         # "build/win:default_exe_manifest",
         'v8_maybe_icu',
-        'abseil.gyp:abseil',
       ],
       'conditions': [
         ['want_separate_host_toolset', {
@@ -2003,6 +2039,9 @@
             },
           },
         }],
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
       ],
       'sources': [
         "<(V8_ROOT)/src/regexp/gen-regexp-special-case.cc",
@@ -2440,56 +2479,6 @@
         ],
       },
     },  # fp16
-    {
-      'target_name': 'highway',
-      'type': 'static_library',
-      'toolsets': ['host', 'target'],
-      'variables': {
-        'HIGHWAY_ROOT': '../../deps/v8/third_party/highway',
-      },
-      'all_dependent_settings': {
-        'include_dirs': [
-          '<(HIGHWAY_ROOT)/src',
-        ],
-        'conditions': [
-          ['v8_target_arch=="ia32"', {
-            'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-          }],
-          ['v8_target_arch=="arm64"', {
-            'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-          }],
-          ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-            'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-          }],
-          ['v8_target_arch=="s390x"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['OS in "aix os400"', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-          ['v8_target_arch=="arm" and arm_version==7', {
-            'defines': ['HWY_BROKEN_EMU128=0',],
-          }],
-        ],
-      },
-      'include_dirs': [
-        '<(HIGHWAY_ROOT)/src',
-      ],
-      'conditions': [
-        ['v8_target_arch=="ia32"', {
-          'defines': ['HWY_BROKEN_TARGETS=(HWY_AVX2|HWY_AVX3)',],
-        }],
-        ['v8_target_arch=="arm64"', {
-          'defines': ['HWY_BROKEN_TARGETS=HWY_ALL_SVE',],
-        }],
-        ['v8_target_arch=="ppc64" or v8_target_arch=="s390x"', {
-          'defines': ['TOOLCHAIN_MISS_ASM_HWCAP_H',],
-        }],
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(HIGHWAY_ROOT)/BUILD.gn"  "source_set.\\"libhwy.*?sources = ")',
-      ],
-    },  # highway
     {
       'target_name': 'simdutf',
       'type': 'static_library',
diff --git a/tools/v8_gypfiles/v8_debug_helper.gyp b/tools/v8_gypfiles/v8_debug_helper.gyp
new file mode 100644
index 000000000000..e869cb4f9771
--- /dev/null
+++ b/tools/v8_gypfiles/v8_debug_helper.gyp
@@ -0,0 +1,177 @@
+{
+  'variables': {
+    'V8_ROOT': '../../deps/v8',
+    'v8_code': 1,
+    # v8windbg links the helper statically. When the helper is the requested
+    # artifact it is built as a shared library instead, so a debugger
+    # extension can load it on its own.
+    'v8_debug_helper_type%': 'static_library',
+    'conditions': [
+      [ 'node_enable_v8debughelper=="true"', {
+        'v8_debug_helper_type': 'shared_library',
+      }],
+    ],
+  },
+  'includes': ['toolchain.gypi', 'features.gypi'],
+  'targets': [
+    {
+      # Intermediate target to build the debug helper. dependencies_traverse
+      # stops gyp from propagating the library up to node.gypi as a link
+      # input. The library is only supposed to be loaded by a debugger.
+      'target_name': 'build_v8_debug_helper',
+      'type': 'none',
+      'dependencies_traverse': 0,
+      'hard_dependency': 1,
+      'dependencies': [
+        'v8_debug_helper',
+      ],
+    },  # build_v8_debug_helper
+    {
+      'target_name': 'v8_debug_helper',
+      'type': '<(v8_debug_helper_type)',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'gen_heap_constants',
+
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_snapshot',
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
+        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
+      ],
+      # Enable RTTI //build/config/compiler:rtti
+      'cflags_cc': [ '-frtti' ],
+      'cflags_cc!': [ '-fno-rtti' ],
+      'xcode_settings': {
+        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
+      },
+      'msvs_settings': {
+        'VCCLCompilerTool': {
+          'RuntimeTypeInfo': 'true',
+        },
+      },
+      'configurations': {
+        'Release': { # Override target_defaults.Release in common.gypi
+          'msvs_settings': {
+            'VCCLCompilerTool': {
+              'RuntimeTypeInfo': 'true',
+            },
+          },
+        },
+      },
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+        [ 'v8_enable_temporal_support==1 and node_shared_temporal_capi=="false"', {
+          'dependencies': [
+            '../../deps/crates/crates.gyp:temporal_capi',
+          ],
+        }],
+        [ 'v8_debug_helper_type=="shared_library"', {
+          # The entry points in debug-helper.h are only given default
+          # visibility, or dllexport on Windows, when this is defined. Node
+          # builds with hidden visibility, so without it the library exports
+          # nothing.
+          'defines': [ 'BUILDING_V8_DEBUG_HELPER' ],
+          'direct_dependent_settings': {
+            'defines': [ 'USING_V8_DEBUG_HELPER' ],
+          },
+        }],
+      ],
+    },  # v8_debug_helper
+    {
+      'target_name': 'gen_heap_constants',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'run_mkgrokdump',
+      ],
+      'direct_dependent_settings': {
+        'sources': [
+          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+        ],
+      },
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
+            '<(SHARED_INTERMEDIATE_DIR)',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # gen_heap_constants
+    {
+      'target_name': 'run_mkgrokdump',
+      'type': 'none',
+      'hard_dependency': 1,
+      'dependencies': [
+        'mkgrokdump',
+      ],
+      'actions': [
+        {
+          'action_name': 'run_gen_heap_constants',
+          'inputs': [
+            '<(V8_ROOT)/tools/run.py',
+          ],
+          'outputs': [
+            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
+          ],
+          'action': [
+            '<(python)',
+            '<(V8_ROOT)/tools/run.py',
+            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
+            '--outfile',
+            '<@(_outputs)',
+          ]
+        }
+      ]
+    },  # run_mkgrokdump
+    {
+      'target_name': 'mkgrokdump',
+      'type': 'executable',
+      'include_dirs': [
+        '<(V8_ROOT)',
+        '<(V8_ROOT)/include',
+      ],
+      'dependencies': [
+        'v8.gyp:v8_snapshot',
+        'v8.gyp:v8_libbase',
+        'v8.gyp:v8_libplatform',
+        'v8.gyp:v8_maybe_icu',
+        'v8.gyp:fp16',
+        'v8.gyp:generate_bytecode_builtins_list',
+        'v8.gyp:run_torque',
+      ],
+      'conditions': [
+        ['node_shared_abseil=="false"', {
+          'dependencies': ['abseil.gyp:abseil'],
+        }],
+      ],
+      'sources': [
+        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
+      ]
+    },  # mkgrokdump
+  ],
+}
diff --git a/tools/v8_gypfiles/v8windbg.gyp b/tools/v8_gypfiles/v8windbg.gyp
index 13d4306f224e..14823f60c0cb 100644
--- a/tools/v8_gypfiles/v8windbg.gyp
+++ b/tools/v8_gypfiles/v8windbg.gyp
@@ -24,7 +24,7 @@
         '<(V8_ROOT)/include',
       ],
       'dependencies': [
-        'v8_debug_helper',
+        'v8_debug_helper.gyp:v8_debug_helper',
         'v8.gyp:v8_libbase',
       ],
       'sources': [
@@ -40,129 +40,5 @@
         ],
       },
     },  # v8windbg
-    {
-      'target_name': 'v8_debug_helper',
-      'type': 'static_library',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'gen_heap_constants',
-
-        'abseil.gyp:abseil',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_snapshot',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/tools/debug_helper/BUILD.gn"  "\"v8_debug_helper_internal\".*?sources = ")',
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/class-debug-readers.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.cc",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/debug-macros.h",
-        "<(SHARED_INTERMEDIATE_DIR)/torque-generated/instance-types.h",
-      ],
-      # Enable RTTI //build/config/compiler:rtti
-      'cflags_cc': [ '-frtti' ],
-      'cflags_cc!': [ '-fno-rtti' ],
-      'xcode_settings': {
-        'GCC_ENABLE_CPP_RTTI': 'YES',  # -frtti
-      },
-      'msvs_settings': {
-        'VCCLCompilerTool': {
-          'RuntimeTypeInfo': 'true',
-        },
-      },
-      'configurations': {
-        'Release': { # Override target_defaults.Release in common.gypi
-          'msvs_settings': {
-            'VCCLCompilerTool': {
-              'RuntimeTypeInfo': 'true',
-            },
-          },
-        },
-      },
-    },  # v8_debug_helper
-    {
-      'target_name': 'gen_heap_constants',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'run_mkgrokdump',
-      ],
-      'direct_dependent_settings': {
-        'sources': [
-          '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-        ],
-      },
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/heap-constants-gen.cc',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/debug_helper/gen-heap-constants.py',
-            '<(SHARED_INTERMEDIATE_DIR)',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # gen_heap_constants
-    {
-      'target_name': 'run_mkgrokdump',
-      'type': 'none',
-      'hard_dependency': 1,
-      'dependencies': [
-        'mkgrokdump',
-      ],
-      'actions': [
-        {
-          'action_name': 'run_gen_heap_constants',
-          'inputs': [
-            '<(V8_ROOT)/tools/run.py',
-          ],
-          'outputs': [
-            '<(SHARED_INTERMEDIATE_DIR)/v8heapconst.py',
-          ],
-          'action': [
-            '<(python)',
-            '<(V8_ROOT)/tools/run.py',
-            '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)mkgrokdump<(EXECUTABLE_SUFFIX)',
-            '--outfile',
-            '<@(_outputs)',
-          ]
-        }
-      ]
-    },  # run_mkgrokdump
-    {
-      'target_name': 'mkgrokdump',
-      'type': 'executable',
-      'include_dirs': [
-        '<(V8_ROOT)',
-        '<(V8_ROOT)/include',
-      ],
-      'dependencies': [
-        'abseil.gyp:abseil',
-        'v8.gyp:v8_snapshot',
-        'v8.gyp:v8_libbase',
-        'v8.gyp:v8_libplatform',
-        'v8.gyp:v8_maybe_icu',
-        'v8.gyp:fp16',
-        'v8.gyp:generate_bytecode_builtins_list',
-        'v8.gyp:run_torque',
-      ],
-      'sources': [
-        '<!@pymod_do_main(GN-scraper "<(V8_ROOT)/test/mkgrokdump/BUILD.gn"  "mkgrokdump.*?sources = ")',
-      ]
-    },  # mkgrokdump
   ],
 }
diff --git a/typings/globals.d.ts b/typings/globals.d.ts
index 66e27bfe9ab2..7363e7088ee9 100644
--- a/typings/globals.d.ts
+++ b/typings/globals.d.ts
@@ -10,8 +10,10 @@ import { CryptoBinding } from './internalBinding/crypto';
 import { DebugBinding } from './internalBinding/debug';
 import { DiagnosticsChannelBinding } from './internalBinding/diagnostics_channel';
 import { EncodingBinding } from './internalBinding/encoding_binding';
+import { FFIBinding } from './internalBinding/ffi';
 import { FsBinding } from './internalBinding/fs';
 import { FsDirBinding } from './internalBinding/fs_dir';
+import { FsEventWrapBinding } from './internalBinding/fs_event_wrap';
 import { HeapUtilsBinding } from './internalBinding/heap_utils';
 import { HttpParserBinding } from './internalBinding/http_parser';
 import { ICUBinding } from './internalBinding/icu';
@@ -23,14 +25,18 @@ import { MessagingBinding } from './internalBinding/messaging';
 import { ModulesBinding } from './internalBinding/modules';
 import { OptionsBinding } from './internalBinding/options';
 import { OSBinding } from './internalBinding/os';
+import { PerformanceBinding } from './internalBinding/performance';
 import { PermissionBinding } from './internalBinding/permission';
 import { ProcessBinding } from './internalBinding/process';
 import { ProcessWrapBinding } from './internalBinding/process_wrap';
+import { ProfilerBinding } from './internalBinding/profiler';
 import { SeaBinding } from './internalBinding/sea';
 import { SerdesBinding } from './internalBinding/serdes';
 import { SignalWrapBinding } from './internalBinding/signal_wrap';
+import { StreamPipeBinding } from './internalBinding/stream_pipe';
 import { StringDecoderBinding } from './internalBinding/string_decoder';
 import { SymbolsBinding } from './internalBinding/symbols';
+import { TaskQueueBinding } from './internalBinding/task_queue';
 import { TimersBinding } from './internalBinding/timers';
 import { TypesBinding } from './internalBinding/types';
 import { URLBinding } from './internalBinding/url';
@@ -55,8 +61,10 @@ interface InternalBindingMap {
   debug: DebugBinding;
   diagnostics_channel: DiagnosticsChannelBinding;
   encoding_binding: EncodingBinding;
+  ffi: FFIBinding;
   fs: FsBinding;
   fs_dir: FsDirBinding;
+  fs_event_wrap: FsEventWrapBinding;
   heap_utils: HeapUtilsBinding;
   http_parser: HttpParserBinding;
   icu: ICUBinding;
@@ -68,14 +76,18 @@ interface InternalBindingMap {
   modules: ModulesBinding;
   options: OptionsBinding;
   os: OSBinding;
+  performance: PerformanceBinding;
   permission: PermissionBinding;
   process: ProcessBinding;
   process_wrap: ProcessWrapBinding;
+  profiler: ProfilerBinding;
   sea: SeaBinding;
   serdes: SerdesBinding;
   signal_wrap: SignalWrapBinding;
+  stream_pipe: StreamPipeBinding;
   string_decoder: StringDecoderBinding;
   symbols: SymbolsBinding;
+  task_queue: TaskQueueBinding;
   timers: TimersBinding;
   types: TypesBinding;
   url: URLBinding;
diff --git a/typings/internalBinding/crypto.d.ts b/typings/internalBinding/crypto.d.ts
index eb40d33c513c..e45a45ea7193 100644
--- a/typings/internalBinding/crypto.d.ts
+++ b/typings/internalBinding/crypto.d.ts
@@ -125,6 +125,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
   interface CryptoKeyPair {
@@ -605,6 +607,8 @@ declare namespace InternalCryptoBinding {
       algorithm: object | undefined,
       usagesMask: number,
       extractable: boolean,
+      secondaryHandle?: KeyObjectHandle,
+      seedData?: ArrayBuffer | SharedArrayBuffer | ArrayBufferView,
     ): CryptoKey;
   }
 
@@ -619,6 +623,8 @@ declare namespace InternalCryptoBinding {
     algorithm: object,
     usagesMask: number,
     handle: KeyObjectHandle,
+    secondaryHandle: KeyObjectHandle | undefined,
+    seedData: Buffer | undefined,
   ];
 
   type CreateNativeKeyObjectClassCallback =
diff --git a/typings/internalBinding/ffi.d.ts b/typings/internalBinding/ffi.d.ts
new file mode 100644
index 000000000000..0294d1987b03
--- /dev/null
+++ b/typings/internalBinding/ffi.d.ts
@@ -0,0 +1,101 @@
+declare namespace InternalFFIBinding {
+  type Buffer = Uint8Array;
+  type BufferSource = Buffer | ArrayBuffer | ArrayBufferView | SharedArrayBuffer;
+  type VoidType = 'void';
+  type NumberType =
+    | 'char'
+    | 'int8' | 'i8'
+    | 'uint8' | 'u8' | 'bool'
+    | 'int16' | 'i16'
+    | 'uint16' | 'u16'
+    | 'int32' | 'i32'
+    | 'uint32' | 'u32'
+    | 'float32' | 'f32' | 'float'
+    | 'float64' | 'f64' | 'double';
+  type BigIntType = 'int64' | 'i64' | 'uint64' | 'u64';
+  type PointerType =
+    | 'pointer' | 'ptr'
+    | 'string' | 'str'
+    | 'buffer' | 'arraybuffer'
+    | 'function';
+  type ValueType = NumberType | BigIntType | PointerType;
+  type ReturnType = VoidType | ValueType;
+  type FFICallback = (...args: any[]) => unknown;
+
+  interface FFIFunction {
+    (...args: unknown[]): unknown;
+    pointer: bigint;
+  }
+  interface FunctionSignature {
+    arguments?: readonly ValueType[];
+    return?: ReturnType;
+  }
+
+  class DynamicLibrary {
+    constructor(path: string | null);
+
+    readonly path: string;
+    readonly symbols: Record<string, bigint>;
+    readonly functions: Record<string, FFIFunction>;
+
+    close(): void;
+    getFunction(name: string, signature: FunctionSignature): FFIFunction;
+    getFunctions(): Record<string, FFIFunction>;
+    getFunctions(
+      definitions: Record<string, FunctionSignature>,
+    ): Record<string, FFIFunction>;
+    getSymbol(name: string): bigint;
+    getSymbols(): Record<string, bigint>;
+    registerCallback(callback: FFICallback): bigint;
+    registerCallback(
+      signature: FunctionSignature,
+      callback: FFICallback
+    ): bigint;
+    unregisterCallback(pointer: bigint): void;
+    refCallback(pointer: bigint): void;
+    unrefCallback(pointer: bigint): void;
+    [Symbol.dispose](): void;
+  }
+}
+export interface FFIBinding {
+  DynamicLibrary: typeof InternalFFIBinding.DynamicLibrary;
+  toString(pointer: bigint): string | null;
+  toBuffer(pointer: bigint, length: number, copy?: boolean): InternalFFIBinding.Buffer;
+  toArrayBuffer(pointer: bigint, length: number, copy?: boolean): ArrayBuffer;
+
+  exportBytes(source: InternalFFIBinding.BufferSource, pointer: bigint, length: number): void;
+  getRawPointer(source: InternalFFIBinding.BufferSource): bigint;
+  getCurrentEventLoop(): bigint;
+
+  getInt8(pointer: bigint, offset?: number): number;
+  getUint8(pointer: bigint, offset?: number): number;
+  getInt16(pointer: bigint, offset?: number): number;
+  getUint16(pointer: bigint, offset?: number): number;
+  getInt32(pointer: bigint, offset?: number): number;
+  getUint32(pointer: bigint, offset?: number): number;
+  getInt64(pointer: bigint, offset?: number): bigint;
+  getUint64(pointer: bigint, offset?: number): bigint;
+  getFloat32(pointer: bigint, offset?: number): number;
+  getFloat64(pointer: bigint, offset?: number): number;
+
+  setInt8(pointer: bigint, offset: number, value: number): void;
+  setUint8(pointer: bigint, offset: number, value: number): void;
+  setInt16(pointer: bigint, offset: number, value: number): void;
+  setUint16(pointer: bigint, offset: number, value: number): void;
+  setInt32(pointer: bigint, offset: number, value: number): void;
+  setUint32(pointer: bigint, offset: number, value: number): void;
+  setInt64(pointer: bigint, offset: number, value: number | bigint): void;
+  setUint64(pointer: bigint, offset: number, value: number | bigint): void;
+  setFloat32(pointer: bigint, offset: number, value: number): void;
+  setFloat64(pointer: bigint, offset: number, value: number): void;
+
+  charIsSigned: boolean;
+  uintptrMax: bigint;
+
+  kSbSharedBuffer: symbol;
+  kSbInvokeSlow: symbol;
+  kSbArguments: symbol;
+  kSbReturn: symbol;
+  kFastArguments: symbol;
+  kFastBufferInvoke: symbol;
+}
diff --git a/typings/internalBinding/fs_event_wrap.d.ts b/typings/internalBinding/fs_event_wrap.d.ts
new file mode 100644
index 000000000000..b1b815e8a35e
--- /dev/null
+++ b/typings/internalBinding/fs_event_wrap.d.ts
@@ -0,0 +1,28 @@
+import { owner_symbol } from './symbols';
+
+declare namespace InternalFsEventWrapBinding {
+  class FSEvent {
+    constructor();
+    [owner_symbol]?: object;
+    readonly initialized: boolean;
+    onchange?: (
+      status: number,
+      eventType: string,
+      filename: string | Uint8Array | null,
+    ) => void;
+    start(
+      filename: string | Uint8Array,
+      persistent: boolean,
+      recursive: boolean,
+      encoding: string,
+    ): number;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+  }
+}
+
+export interface FsEventWrapBinding {
+  FSEvent: typeof InternalFsEventWrapBinding.FSEvent;
+}
diff --git a/typings/internalBinding/performance.d.ts b/typings/internalBinding/performance.d.ts
new file mode 100644
index 000000000000..fa9a3810fc7a
--- /dev/null
+++ b/typings/internalBinding/performance.d.ts
@@ -0,0 +1,134 @@
+declare namespace InternalPerformanceBinding {
+  interface HistogramBase {
+    count(): number;
+    countBigInt(): bigint;
+    min(): number;
+    minBigInt(): bigint;
+    max(): number;
+    maxBigInt(): bigint;
+    mean(): number;
+    exceeds(): number;
+    exceedsBigInt(): bigint;
+    stddev(): number;
+    percentile(percentile: number): number;
+    percentileBigInt(percentile: number): bigint;
+    percentiles(percentiles: Map<number, number>): void;
+    percentilesBigInt(percentiles: Map<number, bigint>): void;
+    reset(): void;
+    skewness(): number;
+    kurtosis(): number;
+    cdf(value: number): number;
+    countAt(value: number): number;
+    ksTest(other: HistogramBase): number;
+    percentilesAt(
+      percentiles: Map<number, number>,
+      values: Float64Array,
+    ): void;
+    linearBuckets(stepSize: number, buckets: Map<number, number>): void;
+    logBuckets(
+      firstBucket: number,
+      base: number,
+      buckets: Map<number, number>,
+    ): void;
+    welchTest(
+      other: HistogramBase,
+      confidence: number,
+    ): [number, number, number, number, number];
+    mannWhitneyTest(other: HistogramBase): [number, number, number];
+    cohensD(other: HistogramBase): number;
+    cliffsD(other: HistogramBase): number;
+    percentileCI(percentile: number, confidence: number): [number, number, number];
+    ewmaMean(): number;
+    ewmaStddev(): number;
+    ewmaErrorRate(): number;
+  }
+
+  interface ELDHistogram extends HistogramBase {
+    start(reset?: boolean): void;
+    stop(): void;
+    close(callback?: () => void): void;
+    hasRef(): boolean;
+    ref(): void;
+    unref(): void;
+    getAsyncId(): number;
+    asyncReset(resource: object, executionAsyncId?: number): void;
+    getAsyncContextFrameForDebuggingOnly(): unknown;
+    getProviderType(): number;
+  }
+
+  interface Histogram extends HistogramBase {}
+
+  class Histogram {
+    constructor(
+      lowest: number | bigint,
+      highest: number | bigint,
+      figures: number,
+      halfLife?: number,
+      threshold?: number,
+    );
+    record(value: number | bigint): void;
+    recordDelta(): void;
+    recordCorrected(
+      value: number | bigint,
+      expectedInterval: number | bigint,
+    ): void;
+    add(other: Histogram): number;
+    subtract(other: Histogram): number;
+  }
+
+  interface Constants {
+    NODE_PERFORMANCE_GC_MAJOR: number;
+    NODE_PERFORMANCE_GC_MINOR: number;
+    NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP: number;
+    NODE_PERFORMANCE_GC_INCREMENTAL: number;
+    NODE_PERFORMANCE_GC_WEAKCB: number;
+    NODE_PERFORMANCE_GC_FLAGS_NO: number;
+    NODE_PERFORMANCE_GC_FLAGS_CONSTRUCT_RETAINED: number;
+    NODE_PERFORMANCE_GC_FLAGS_FORCED: number;
+    NODE_PERFORMANCE_GC_FLAGS_SYNCHRONOUS_PHANTOM_PROCESSING: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_AVAILABLE_GARBAGE: number;
+    NODE_PERFORMANCE_GC_FLAGS_ALL_EXTERNAL_MEMORY: number;
+    NODE_PERFORMANCE_GC_FLAGS_SCHEDULE_IDLE: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_GC: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_HTTP2: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_NET: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_DNS: number;
+    NODE_PERFORMANCE_ENTRY_TYPE_QUIC: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN_TIMESTAMP: number;
+    NODE_PERFORMANCE_MILESTONE_TIME_ORIGIN: number;
+    NODE_PERFORMANCE_MILESTONE_ENVIRONMENT: number;
+    NODE_PERFORMANCE_MILESTONE_NODE_START: number;
+    NODE_PERFORMANCE_MILESTONE_V8_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_START: number;
+    NODE_PERFORMANCE_MILESTONE_LOOP_EXIT: number;
+    NODE_PERFORMANCE_MILESTONE_BOOTSTRAP_COMPLETE: number;
+  }
+}
+
+type PerformanceObserverCallback =
+  | ((name: string,
+      type: string,
+      startTime: number,
+      duration: number,
+      details: unknown) => void)
+  | ((entry: unknown) => void);
+
+export interface PerformanceBinding {
+  Histogram: typeof InternalPerformanceBinding.Histogram;
+  constants: InternalPerformanceBinding.Constants;
+  observerCounts: Uint32Array;
+  milestones: Float64Array;
+  setupObservers(callback: PerformanceObserverCallback): void;
+  installGarbageCollectionTracking(): void;
+  removeGarbageCollectionTracking(): void;
+  notify(type: string, entry: unknown): void;
+  loopIdleTime(): number;
+  createELDHistogram(
+    interval: number,
+    samplePerIteration: boolean,
+  ): InternalPerformanceBinding.ELDHistogram;
+  markBootstrapComplete(): void;
+  uvMetricsInfo(): [number, number, number];
+  now(): number;
+}
diff --git a/typings/internalBinding/profiler.d.ts b/typings/internalBinding/profiler.d.ts
new file mode 100644
index 000000000000..67e5dca87696
--- /dev/null
+++ b/typings/internalBinding/profiler.d.ts
@@ -0,0 +1,8 @@
+export interface ProfilerBinding {
+  setCoverageDirectory(directory: string): void;
+  setSourceMapCacheGetter(getter: () => object | undefined): void;
+  startCoverage(): void;
+  takeCoverage(): void;
+  stopCoverage(): void;
+  endCoverage(): void;
+}
diff --git a/typings/internalBinding/sea.d.ts b/typings/internalBinding/sea.d.ts
index 15f4430d87d1..258e7f112ed0 100644
--- a/typings/internalBinding/sea.d.ts
+++ b/typings/internalBinding/sea.d.ts
@@ -1,5 +1,8 @@
 export interface SeaBinding {
   getAsset(key: string): ArrayBuffer | undefined;
+  getAssetKeys(): string[];
   isExperimentalSeaWarningNeeded(): boolean;
   isSea(): boolean;
+  isVfsEnabled(): boolean;
+  mainCodePath?: string;
 }
diff --git a/typings/internalBinding/stream_pipe.d.ts b/typings/internalBinding/stream_pipe.d.ts
new file mode 100644
index 000000000000..17568409af54
--- /dev/null
+++ b/typings/internalBinding/stream_pipe.d.ts
@@ -0,0 +1,17 @@
+declare namespace InternalStreamPipeBinding {
+  class StreamPipe {
+    constructor(source: object, sink: object);
+    readonly source: object | null;
+    readonly sink: object | null;
+    onunpipe?: () => void;
+    oncomplete?: () => void;
+    unpipe(): void;
+    start(): void;
+    isClosed(): boolean;
+    pendingWrites(): number;
+  }
+}
+
+export interface StreamPipeBinding {
+  StreamPipe: typeof InternalStreamPipeBinding.StreamPipe;
+}
diff --git a/typings/internalBinding/task_queue.d.ts b/typings/internalBinding/task_queue.d.ts
new file mode 100644
index 000000000000..5690317f3bfd
--- /dev/null
+++ b/typings/internalBinding/task_queue.d.ts
@@ -0,0 +1,13 @@
+export interface TaskQueueBinding {
+  enqueueMicrotask(callback: () => void): void;
+  setTickCallback(callback: () => void): void;
+  runMicrotasks(): void;
+  tickInfo: Uint8Array;
+  promiseRejectEvents: {
+    kPromiseRejectWithNoHandler: 0;
+    kPromiseHandlerAddedAfterReject: 1;
+  };
+  setPromiseRejectCallback(
+    callback: (type: 0 | 1, promise: Promise<unknown>, value: unknown) => void,
+  ): void;
+}
\ No newline at end of file
diff --git a/typings/internalBinding/timers.d.ts b/typings/internalBinding/timers.d.ts
index e03deeeca240..ccdee1db5044 100644
--- a/typings/internalBinding/timers.d.ts
+++ b/typings/internalBinding/timers.d.ts
@@ -5,4 +5,5 @@ export interface TimersBinding {
   toggleTimerRef(value: boolean): void;
   toggleImmediateRef(value: boolean): void;
   immediateInfo: Uint32Array;
+  timeoutInfo: Int32Array;
 }
diff --git a/typings/internalBinding/util.d.ts b/typings/internalBinding/util.d.ts
index a3026b5a0305..4c3eeca8ed82 100644
--- a/typings/internalBinding/util.d.ts
+++ b/typings/internalBinding/util.d.ts
@@ -47,6 +47,7 @@ export interface UtilBinding {
   styleText(format: Array<string> | string, text: string): string;
   isInsideNodeModules(frameLimit?: number): boolean;
   constructSharedArrayBuffer(length?: number): SharedArrayBuffer;
+  getSharedArrayBufferGrowable(this: SharedArrayBuffer): boolean;
 
   constants: {
     kPending: 0;
diff --git a/typings/internalBinding/zlib.d.ts b/typings/internalBinding/zlib.d.ts
index 706337eb45a7..84c437350433 100644
--- a/typings/internalBinding/zlib.d.ts
+++ b/typings/internalBinding/zlib.d.ts
@@ -32,12 +32,12 @@ declare namespace InternalZlibBinding {
 
   class ZstdCompress extends ZlibBase {
     constructor();
-    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView): void;
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView, rejectGarbageAfterEnd?: boolean): void;
   }
 
   class ZstdDecompress extends ZlibBase {
     constructor();
-    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView): void;
+    init(initParamsArray: Uint32Array, pledgedSrcSize: number | undefined, writeState: Uint32Array, callback: VoidFunction, dictionary?: ArrayBufferView, rejectGarbageAfterEnd?: boolean): void;
   }
 }